Design compute solutions
Compute solutions are the services that run your application code. The main options are Azure Virtual Machines (VMs), Azure App Service, Azure Container Instances (ACI), Azure Kubernetes Service (AKS), and Azure Functions. Choosing the right one depends on how much control you need versus how much management work you want to handle. VMs give you full control over the operating system and are best for applications that need a specific, unchanging environment or must run continuously. App Service is a managed platform for web apps and APIs, where Azure handles the underlying servers, operating system, and web server software, letting you focus just on your code.
For applications built as containers, ACI provides the simplest way to run a single container without managing servers, while AKS manages a full cluster of containers, handling deployment, scaling, and operations. Azure Functions is a serverless option where you write small pieces of code that run only when triggered by an event; you pay only for the execution time, and Azure manages all the infrastructure. Scaling works differently for each option: VMs and App Service can scale out by adding more instances based on rules like CPU usage, AKS can scale the number of container pods, and Functions scales automatically with each incoming event.
Design an application architecture
Application architecture is the high-level plan for how all the parts of your application fit together and communicate. A common pattern is a multi-tier architecture, where you separate the presentation layer (web front-end), the business logic layer (application or API), and the data layer (database). Each tier can be scaled independently and placed in different network zones for security. For example, the web tier might be in a public subnet accessible from the internet, while the application and database tiers are in private subnets, with traffic flowing only from the web tier to the application tier and then to the database tier.
You also need to decide how these components communicate. They can use synchronous calls (like HTTP requests) for immediate responses or asynchronous messaging (using services like Azure Service Bus or Event Grid) for decoupled, event-driven workflows. This choice affects reliability and scalability. Furthermore, you must design for availability and disaster recovery, which might involve deploying duplicate application stacks across different Azure regions and using a traffic manager or Front Door to route users to the healthy region.
Design migrations
Migration is the process of moving an existing application and its data from an on-premises data center or another cloud to Azure. The first step is assessment, using tools like Azure Migrate to discover your current servers, map dependencies between them, and estimate costs and performance in Azure. You then choose a migration strategy: rehost (lift-and-shift) simply moves VMs to Azure with minimal changes, refactor involves some modification to use cloud services like managed databases, or rearchitect completely rebuilds the application to be cloud-native.
The actual migration often happens in waves. You typically start by replicating data from the source to Azure, then perform a cutover where you redirect users from the old system to the new one in Azure. Key considerations include network connectivity (setting up a VPN or ExpressRoute for secure, high-speed transfer), data transfer methods (online or offline), and ensuring the migrated application meets performance and compliance requirements in its new environment.
Design network solutions
Network solutions define how your Azure resources connect to each other and to the outside world. The core building block is a virtual network (VNet), which is like a private network in the cloud. You divide a VNet into subnets to isolate different types of traffic, such as putting web servers in one subnet and databases in another. To connect an on-premises network to Azure, you use a VPN Gateway for a secure tunnel over the internet or Azure ExpressRoute for a private, dedicated connection.
Controlling traffic flow is critical. Network Security Groups (NSGs) act as firewalls at the subnet or network interface level, allowing or denying traffic based on rules. For more advanced routing and inspection, you can use an Azure Firewall or deploy a network virtual appliance (NVA). To make services accessible from the internet, you use Azure Load Balancer (for distributing traffic across VMs) or Application Gateway (a web traffic load balancer with features like SSL termination). Outbound internet access for private resources is often provided by a NAT Gateway.
StudyCerts
StudyCerts