Compare compute types, including containers, virtual machines, and functions
Azure offers three main compute options: Virtual Machines, Containers, and Functions. Choosing the right one involves balancing cost, performance, and how much management work you are willing to do. Virtual Machines provide the most control but require you to manage the operating system, including patching and security. You pay a constant rate based on running time and the size of the machine.
Containers package an application with its dependencies, sharing the host operating system kernel for faster startup and more efficient resource use. This reduces costs but adds some management overhead when you need orchestration tools for many containers. Functions are a serverless model where you pay only for the milliseconds your code runs, scaling automatically with events. This is highly cost-efficient but can have slight performance delays called cold starts when a dormant function is triggered.
Evaluate the Advantages and Limitations of Each Compute Type
Each compute type has distinct trade-offs. Virtual Machines offer complete control over the OS and software, making them ideal for legacy applications that need specific configurations. The downside is you handle all updates and backups. Containers provide rapid deployment and consistent environments but offer less isolation than a VM and require an orchestrator for complex networks.
Functions eliminate infrastructure management and scale automatically, but they have execution timeouts and limited local storage. When deciding, consider criteria like deployment speed (containers deploy faster than functions, which deploy faster than VMs), resource utilization (functions are most efficient), scalability (functions scale automatically), and management complexity (VMs require the most, functions the least).
Understand the Core Concepts of Containers
Containers isolate applications by packaging code and dependencies into a portable unit. They share the host OS kernel, so they start quickly and use fewer resources than VMs. For hosting, you can use Azure Container Instances for simple deployments or Azure Container Apps for serverless container workloads. As your container environment grows, Azure Kubernetes Service (AKS) automates deployment, scaling, and management of containers.
Containers focus on application portability, making them ideal for consistent deployments across development stages. They differ from the infrastructure-as-a-service (IaaS) model of VMs, which provides full OS isolation. If your workload consists of short, event-driven tasks, serverless functions may be a better fit than containers.
Explore the Functionality of Azure Functions
Azure Functions is a serverless service that runs code in response to events called triggers. It removes the need to manage servers and automatically scales to meet demand. Azure offers several hosting plans to fit different needs. The Consumption plan charges you only when your functions run. The Premium plan keeps instances warm to avoid cold starts. The Dedicated plan runs functions on a fixed-cost App Service plan.
Common uses include building REST APIs, processing data from queues, and automating workflows. Developers can write code in multiple languages and use tools like the Azure Functions extension for Visual Studio Code to test locally and deploy.
Examine the Features and Use Cases of Virtual Machines
Azure Virtual Machines are an IaaS offering that emulates physical hardware in the cloud. You can run Windows or Linux and have full administrative control over the OS and software stack. This makes VMs ideal for migrating legacy applications that need specific configurations, but you are responsible for updates and backups.
VMs are chosen for scenarios like development and test environments, continuously running cloud-hosted applications, extending your datacenter into a hybrid cloud, and hosting legacy software. Before deploying, you select the VM's size, region, and supporting resources like virtual networks. To handle changing demand, you can group VMs into virtual machine scale sets for automatic scaling.
Describe virtual machine options, including Azure virtual machines, Azure Virtual Machine Scale Sets, availability sets, and Azure Virtual Desktop
Explore Azure Virtual Desktop
Azure Virtual Desktop (AVD) is a cloud service that provides a virtualized Windows desktop experience. Users can access their desktop from anywhere, which is ideal for remote work and secure application access. Key features include Scalability to accommodate more users, Centralized Management for administrators, and built-in Security features like multi-factor authentication.
Benefits include Cost Efficiency by reducing physical hardware needs and Flexibility for employees to work from any device. Use cases include Remote Work for maintaining productivity and Secure Access to sensitive corporate applications without exposing them to threats.
Evaluate Use Cases and Benefits
Azure Virtual Machines are on-demand, scalable resources where you have full control. Use them for development/test environments, cloud applications, and hybrid deployments. Azure Virtual Machine Scale Sets provide auto-scaling for a group of identical VMs, ensuring performance during traffic spikes. Availability Sets are logical groupings that protect VMs from outages by spreading them across different hardware racks.
Azure Virtual Desktop delivers virtualized desktops or apps to users anywhere. It's ideal for remote work, application testing, and cost-effective multi-session hosting. To decide, consider Scalability (scale sets for auto-scaling, availability sets for high availability), Cost (VMs are pay-as-you-go, AVD uses per-user pricing), Performance (choose VM series based on needs), and Management (VMs require full OS management, scale sets reduce manual work).
Analyze Availability Sets
An availability set groups VMs to achieve high availability. Azure distributes VMs in a set across multiple fault domains (separate racks of hardware) and update domains (groups updated one at a time). This ensures not all VMs fail or reboot simultaneously, meeting a 99.95% SLA. Benefits include Redundancy, Maintenance safety, and Guaranteed uptime.
Availability sets differ from scale sets (which focus on scaling) and availability zones (which offer geographical isolation). Use availability sets when you need simple redundancy for multiple VMs in a single region without autoscaling.
Examine Azure Virtual Machine Scale Sets
Azure Virtual Machine Scale Sets are groups of identical VMs managed as a single resource. They simplify large-scale deployments and ensure consistent configuration. Autoscaling automatically adjusts the number of VM instances based on demand using rules like CPU usage.
Scale sets provide built-in high availability by spreading instances across availability zones or fault domains and integrate with an Azure Load Balancer to distribute traffic. You can optimize costs using Spot VMs for discounted workloads and choose between Uniform and Flexible orchestration modes for update control.
Understand Azure Virtual Machines
Azure Virtual Machines (VMs) are on-demand computing resources. Each VM has an operating system disk and a temporary local disk. You choose a size based on CPU, memory, and network needs. VMs are created in a specific region. Availability sets and availability zones help ensure uptime, with zones offering 99.99% SLA when VMs are deployed across two or more zones.
Virtual Machine Scale Sets (VMSS) let you manage a group of load-balanced VMs as one unit with automatic scaling. Azure Virtual Desktop runs on Azure VMs to provide secure, scalable virtual desktops and apps to remote users.
Describe the resources required for virtual machines
Compute Resources for Virtual Machines
A VM image is a template with an OS and settings. You select an image using commands that filter by publisher and version. A VM size defines the amount of vCPUs, memory, and sometimes GPU capacity. Azure offers size categories like General purpose, Compute optimized, and Memory optimized to match different workloads. You can resize a VM later if your needs change.
To see available sizes in your region, you use a command that lists details like core count and memory. When creating or resizing a VM, you specify the size parameter. Resizing triggers a reboot but allows you to match resources to changing requirements.
High Availability and Scalability
High availability keeps services online during failures, while scalability allows resources to grow with demand. Availability sets group VMs across fault and update domains within a region for a 99.95% SLA. Availability zones are physically separate datacenters within a region, offering a 99.99% SLA when VMs are deployed across two or more zones.
Virtual Machine Scale Sets (VMSS) enable automatic scaling and central management. They provide horizontal scaling (changing the number of VMs) and support manual vertical scaling (changing VM sizes). Combining availability features with scale sets ensures both resilience and flexibility.
Networking Components for Virtual Machines
VMs require several networking components. A virtual network (vNet) is a logical boundary that isolates traffic. Within a vNet, subnets segment the network into smaller address ranges for organization and security. A network interface (NIC) links a VM to a subnet and can be assigned a public IP address for internet connectivity.
Network security groups (NSGs) act as firewalls at the subnet or NIC level, controlling traffic with rules based on ports and IP addresses. When deploying a VM, these resources are created together, with the VM's network profile referencing the NIC, subnet, vNet, public IP, and NSG.
Storage Options for Virtual Machines
VMs use disks for storage. Each VM has an OS disk and can have attached data disks. It's best to separate OS and data disks for protection. Azure provides managed disks, which are fully maintained, in three types: Standard HDD (low cost), Standard SSD (consistent performance), and Premium SSD (high performance).
VMs can also use ephemeral disks on the VM host for fast temporary storage like cache, but this data is lost if the VM is deallocated. When planning storage, consider workload I/O patterns, budget, data persistence needs, and scalability.
Tools like Azure Monitor, Azure Automation, and Azure Backup help maintain VM health and automate tasks. Before creating a VM, you must plan supporting resources like virtual networks, NICs, IP addresses, NSGs, and disks, each billed separately.
Use the Azure Pricing Calculator to estimate costs by selecting VM size, OS, instances, and runtime. After deployment, use Cost Management to view spending trends and set budgets. Azure Policy can enforce governance, such as restricting allowed VM sizes or blocking public IPs to control costs and security.
Describe application hosting options, including web apps, containers, and virtual machines
Virtual Machines in Azure
Azure Virtual Machines (VMs) are an Infrastructure-as-a-Service (IaaS) offering, giving you full control over the operating system. You select a region, OS image, VM size, and configure networking and disks. You are responsible for software installation, security patches, and updates. For reliability, use Availability Sets or Availability Zones to protect against failures, and Virtual Machine Scale Sets to automatically scale VM instances with demand.
VMs are ideal for migrating existing applications without rewriting code, hosting databases, or running custom software that needs a specific OS configuration.
Role and Benefits of Containers in Azure
Containers offer lightweight application virtualization by running isolated apps on a shared host OS. They package only the app code and dependencies, ensuring consistency across environments and faster startup than VMs. For hosting, Azure Container Instances (ACI) is for simple, on-demand tasks, while Azure Kubernetes Service (AKS) automates orchestration for complex microservices architectures.
These services integrate with Azure Container Registry and CI/CD pipelines for streamlined DevOps workflows.
Choosing a hosting option balances budget and performance. Azure App Service (a Platform-as-a-Service or PaaS) has predictable pricing tiers with automatic scaling but limits OS customization. Containers pay for underlying compute nodes and registries, maximizing resource efficiency through kernel sharing, though many containers on one host can create bottlenecks.
VMs offer complete customization for performance but have higher management overhead and variable costs, as you are billed per second while the VM runs, even if idle.
Comparing Hosting Options
Deployment speed varies: web apps deploy fastest, containers deploy quickly using images, and VMs take longest due to OS provisioning. Resource isolation and scaling also differ. Web apps share infrastructure and scale automatically but restrict system access. Containers offer process-level isolation and dynamic scaling via orchestrators. Virtual machines provide the strongest isolation with dedicated resources but require manual setup or scale sets for scaling.
Choose web apps for simple websites or APIs, containers for microservices, and VMs for legacy applications or workloads needing custom server configurations.
Understanding Web Apps in Azure
Azure App Service is a PaaS for running web apps without managing servers. It provides runtime environments for languages like Python or Java on Windows or Linux. You create a resource group, configure an App Service plan for compute size and pricing, then deploy your code or a container.
The service includes features to scale up (higher tier) or scale out (more instances), deployment slots for testing, integration with Azure Monitor for logging, and managed identities for secure connections to other Azure resources.
Describe virtual networking, including the purpose of Azure virtual networks, Azure virtual subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
Understand Azure Virtual Networks
An Azure Virtual Network (VNet) is the foundational building block for networking in Azure. It provides an isolated, private network environment in the cloud for your resources, like VMs, allowing them to communicate securely with each other, the internet, and on-premises networks. Key features include traffic filtering, routing, and the ability to connect to other VNets.
Examine Azure Virtual Subnets
Subnets are logical subdivisions within a VNet. You place resources into specific subnets to organize and secure network traffic. This segmentation allows you to apply tailored security rules and routing policies, isolating workloads. For example, you might put web servers in one subnet and databases in another. Managing subnets requires specific permissions and is done via the Azure portal or CLI.
Analyze VNet Peering
Virtual Network Peering connects two Azure VNets seamlessly. Once peered, resources communicate directly with low latency over Microsoft's private backbone, as if on the same local network, without needing a VPN gateway. The VNet address ranges must not overlap. Peering can connect VNets in different regions, subscriptions, or tenants, but it is not transitive. Data transfer across peered networks is billed, but creating the peering connection is free.
Explore Azure DNS
Azure DNS is a hosting service for domain names. It translates human-friendly names (like www.example.com) into IP addresses so computers can find Azure resources. You can manage DNS records for your VNets using Azure tools. Setting up private DNS zones allows resources to resolve each other's names using private IP addresses, keeping internal communication secure and off the public internet.
Evaluate Azure VPN Gateway and ExpressRoute
Both Azure VPN Gateway and ExpressRoute provide secure connections from on-premises networks to Azure, but for different needs. A VPN Gateway creates an encrypted tunnel over the public internet. It's cost-effective for connecting remote offices or users with moderate bandwidth needs. The gateway sits in a dedicated subnet of your VNet.
ExpressRoute provides a private, dedicated connection that bypasses the public internet. It offers more predictable performance, higher reliability, and greater bandwidth, suitable for mission-critical workloads or strict compliance requirements. The choice is a tradeoff: VPN Gateway offers flexibility and lower cost, while ExpressRoute provides superior performance and isolation at a higher price.
Define public and private endpoints
Define Public Endpoints
Public endpoints provide access to Azure resources over the public internet. They are vital when external users or systems need to connect, such as Azure IoT Hub letting remote devices send data. Services like Azure Front Door use public endpoints as global entry points to route internet traffic. To protect these endpoints, organizations use security measures like Web Application Firewall (WAF) policies.
Public endpoints are the primary choice for broad accessibility, used for public websites, external APIs, and collecting data from global IoT devices.
Configuration of Public and Private Endpoints
Configuring a public endpoint involves a public IP address and proper DNS settings. Security is maintained externally using Network Security Groups (NSGs) and Azure Firewall. Configuring a private endpoint integrates the Azure resource directly into a Virtual Network (VNet), assigning it a private IP address. This requires local DNS updates and controls access internally using role-based access control (RBAC) and NSGs.
Continuous monitoring with Azure Monitor is essential for both types to track traffic and detect suspicious activity.
Define Private Endpoints
Private endpoints allow secure connections to Azure services over a private network boundary, not the public internet. By assigning a private IP from your VNet to a service like Azure Storage, traffic never leaves the Microsoft backbone, reducing exposure to threats. This is beneficial for security, compliance, and simplifying network architecture by avoiding complex internet-facing rules.
Establishing a private endpoint follows an order: create it in your VNet, link it to the Azure service, and update DNS. This enforces a zero-trust architecture.
Security Implications and Best Practices
The choice involves a tradeoff: public endpoints simplify access but increase the attack surface, while private endpoints, enabled via Azure Private Link, minimize exposure. Best practices include using NSGs and Azure Firewall for traffic filtering, enabling encryption for data in transit and at rest, and setting up Azure DDoS Protection on public endpoints.
Integrate Azure Monitor to gain visibility into connection patterns and detect anomalies, streaming logs to Azure Event Hubs or storage for analysis.
Use Cases for Public and Private Endpoints
Public endpoints are ideal where external accessibility is the priority: public web applications, external APIs, and distributed IoT devices. Private endpoints are best for scenarios where security and compliance are critical: protecting sensitive databases, hosting internal corporate applications, and enabling secure hybrid cloud connections from on-premises networks.
