Section 11 of 14
Use this section on exam day. It is pure recall, no learning. Read it once the night before and once the morning of the exam.
| Value | What it represents |
|---|---|
| 700 / 1000 | Passing score (~70%) |
| 40 - 60 | Number of questions per attempt |
| 100 - 120 min | Time allowed |
| 5 | Reserved IPs per subnet (.0, .1, .2, .3, last) |
| 50,000 MAU | Free B2B external identities per month |
| 99.9% / 99.95% / 99.99% | SLA: Single VM Premium SSD / Availability Set / Availability Zone |
| 15 hours / under 1 hour | Archive rehydration: Standard / High Priority |
| 180 / 90 / 30 days | Minimum retention: Archive / Cold / Cool tier |
| 11 / 12 / 16 nines | Durability: LRS / ZRS / GRS or GZRS |
| 100 - 4096 | NSG rule priority range (lower = higher priority) |
| 90% | Max cost savings with Spot VMs |
| 72% | Max cost savings with Reserved Instances |
| 5 / 20 slots | Deployment Slots: Standard / Premium tier |
| Standard tier | Minimum App Service tier for deployment slots and daily backups |
| 100 VMs | Maximum per Azure Backup policy |
| 100 / 12 / 12 | Action group rate limits: emails per hour / SMS per hour / voice calls per hour |
| 1 every 5 min | SMS and voice call rate (action groups) |
| 20 update domains | Max per Availability Set (default 5, max 20) |
| 2 fault domains | Default per Availability Set |
| 256-bit | Encryption used by Azure Data Box |
| 80 TB | Max usable storage per Azure Data Box device |
| 1 cloud endpoint | Per Azure File Sync sync group |
| 50 tags | Max per resource |
| TCP 1433 | SQL Server Always On AG ILB health probe port |
| TCP 445 | SMB - Azure Files connections |
| TCP 3389 / 22 | RDP / SSH |
| RSA 4096 | Max bit length for storage account customer-managed keys |
| 24 hours | Cloud endpoint scan interval in Azure File Sync |
| 14 days | Default soft delete retention for backup data |
P1 license: Conditional Access, Dynamic Groups, Group-Based Licensing, SSPR with writeback
P2 license: Identity Protection, Privileged Identity Management (PIM), access reviews
Owner = Contributor + ability to assign roles. Contributor cannot assign roles.
Locks override RBAC. Even Owner cannot delete a locked resource without removing the lock first.
Locks inherit DOWNWARD. Tags do NOT inherit.
Policy DENY = blocks non-compliant resource creation. Policy AUDIT = reports only.
Policy does NOT retroactively delete non-compliant resources.
Tags do not inherit by default - use Azure Policy if you need them to
Resource group move only changes RG, NOT location of the resource
Hybrid AD: Job Title, Contact Info, Display Name = on-prem source of authority
Hybrid AD: Usage Location = cloud-only, can be set in Entra even for synced users
Bulk Create = internal users. Bulk Invite = external/guest users.
License assignment to nested groups is NOT inherited
VNet Peering is non-transitive. Hub-spoke needs 'Allow Gateway Transit' + 'Use Remote Gateway' for transitivity.
Standard LB requires Standard Public IP. SKUs must match.
Private Endpoint = private IP in your VNet. Service Endpoint = secure route, no private IP.
ExpressRoute = avoid public internet. Site-to-Site VPN goes OVER the public internet.
App Gateway / Front Door = Layer 7 + WAF capable. Azure Load Balancer = Layer 4 only.
IP Flow Verify = NSG issue. Next Hop = routing issue. Connection Monitor = ongoing latency.
Azure Backup = file/VM restore. ASR = region-level DR failover.
Recovery Services Vault MUST be in the same region as the VMs it backs up
Recovery Services Vault must be created FIRST before backup configuration
Stop existing backup of a VM before configuring it in a different vault
AzCopy = bulk data transfer CLI. Azure File Sync = ongoing sync with cloud tiering.
AzCopy + Blob: SAS OR Entra ID. AzCopy + Files: SAS only.
VMSS = horizontal scale (more VMs). VM resize = vertical scale (needs deallocation if different cluster).
Bicep = modern IaC (replaces JSON ARM). Declarative, modular, human-readable.
ARM Complete mode DELETES resources not in the template. Always do what-if first.
Azure CLI: az <noun> <verb>. PowerShell: <Verb>-Az<Noun>
Azure Key Vault is the answer for password storage with managed identity access
Azure Advisor (Cost tab) identifies idle/underutilized resources for cost savings
DSC Extension or Custom Script Extension installs software on VMSS instances
ITSM Connector bridges Azure Monitor alerts to System Center Service Manager / ServiceNow
AzCopy 'azcopy make' = create container. 'azcopy copy' = transfer data. 'azcopy sync' = differential.
Data disks can be detached from a RUNNING VM. OS disks require stopping the VM.
Redeploying a VM: temp disk data is LOST, dynamic IPs are released, OS disk preserved
Availability Set: VMs must be stopped/deallocated before being added
Resize VM in an Availability Set: must STOP ALL VMs in the set first
Custom domain in Entra: verify with TXT or MX record. Custom domain in App Service: create CNAME or A record first.
Subdomain delegation in Azure DNS uses NS records
Default Entra domain: <tenant>.onmicrosoft.com
Reverse DNS in Azure returns <vmname>.internal.cloudapp.net
IKEv2 + route-based VPN for most VPN scenarios
Point-to-Site uses certificates - export from one client, install on another
ACI Container Groups: Linux only for multi-container. Windows ACI = single container only.
AKS pods get their own IP with Azure CNI. Kubenet shares the node's IP.
AKS billing: node VMs + networking + storage. Control plane is FREE.
Deployment slot swap is reversible - swap again to roll back.
Premium Files: billed on PROVISIONED size, not actual data written.
GPv1 does NOT support ZRS/GZRS - upgrade to GPv2 first
Lifecycle management does NOT support GPv1 or standard File Storage
Storage Explorer cannot create new storage accounts - only manage existing ones
Conditions on RBAC role assignments: only for Blob and Queue storage data actions
Storage Service Encryption is ALWAYS ON - cannot be disabled
Encryption at host: encrypts cache + temp disk on the host (combines with DES)
Azure Disk Encryption (ADE) - encryption persists if disk is downloaded from Azure