The subscription. A resource group is a lifecycle-grouping convenience; resources in different resource groups within the same subscription communicate freely by default.

RBAC governs who can perform an action; Policy governs what configuration a resource is allowed to have. Both are evaluated independently — a request needs to pass both.

An SCP can only allow or deny an action outright; these Policy effects can actively remediate or alter a resource's configuration, not just gate it.

New subnets default to private — no automatic outbound internet path. An explicit method (NAT Gateway is the current recommendation) is now required.

An Azure Policy assignment using a Modify effect that force-injects the required tags at creation time.

Azure Virtual Network Manager's IPAM pools — they allocate guaranteed non-overlapping ranges from a shared source.

No — architecturally distinct (OAuth2/OIDC vs. LDAP/Kerberos), commonly run alongside on-premises AD DS via Entra Connect rather than replacing it.

No — Microsoft Entra roles and Azure RBAC roles are separate systems; Global Admin requires an explicit elevation step to gain Azure RBAC access.

Converts it from permanently active to eligible — activated only when needed, time-boxed, optionally requiring MFA/approval, dramatically shrinking the exposure window.

No credential is ever stored or can leak — Azure creates and rotates it automatically.

Workload identity federation — GitHub's OIDC token is exchanged for an Azure AD token per run, with no long-lived credential stored anywhere.

An administrative unit containing just that user population, with the role assigned scoped to it.

No — they're independent resources that merely reference the VM and persist, still billed, unless explicitly deleted too.

Premium SSD's IOPS/throughput are fixed by disk size; Premium SSD v2 tunes capacity, IOPS, and throughput independently.

Flexible mode — supports instance mixing, including Spot alongside on-demand, which Uniform mode cannot.

Quota is account-level permission to request resources; a capacity reservation guarantees the resources are physically available in the datacenter at scale-out time.

Most VM resizes require deallocation since the target size's hardware profile may require different physical host placement.

No — ephemeral disks store the OS disk on local host storage by design; they're for fully disposable, stateless instances only.

Five (network address, gateway, two for DNS, broadcast) — a /24 has 251 usable, not 254.

No — A peered with B and B peered with C does not let A reach C automatically.

GatewaySubnet — an exact, case-sensitive, non-negotiable name.

Overlapping address spaces cannot be peered. Centralized IPAM pools make this structurally impossible by allocating guaranteed non-overlapping ranges.

The registrar was never updated with the zone's assigned name servers — a step entirely outside Azure.

No — it's private (never touches the public internet) but not encrypted by default; IPsec over ExpressRoute is a separate, explicit layer.

Private Peering reaches VNets; Microsoft Peering reaches public Microsoft services — most orgs need both, configured separately.

Route-based VPN — supports multiple tunnels and BGP; policy-based is legacy-compatibility only.

A second circuit or a tested Site-to-Site VPN failover path — a single circuit is a real single point of failure.

A secured virtual hub with routing intent.

September 30, 2025 — Standard is now the only supported SKU for regular load balancing.

An attacker can bypass Front Door's WAF and rate limiting entirely by hitting the origin directly.

No — v2 SKUs span multiple Availability Zones by default.

Exclude dynamic, caller-specific routes from caching entirely — caching rules must be scoped per route, never applied blanket.

It's based on the legacy Ingress API and loses Azure support after November 2026 — Application Gateway for Containers (Gateway API) is the current direction.

A service endpoint keeps the service's public IP, just recognizing VNet-sourced traffic; a Private Endpoint gives the service an actual private IP inside the VNet and supports on-premises access.

No public IP or open management port on the target VM at all.

A structural fix for the rare case a port genuinely must be open temporarily — time-boxed, justified, auto-closing, rather than a port left open indefinitely.

The linked Private DNS zone integration — without it, the resource's DNS name still resolves to its public IP.

Cloud Security Explorer's attack path analysis — it evaluates the full resource graph together, not each control in isolation.

Four — Hot, Cool, Cold, and Archive (Cold is a newer addition many older references omit).

An early-deletion fee if the blob is accessed/moved before the tier's minimum storage duration elapses, plus up to 15 hours to rehydrate.

It's Entra-backed and genuinely revocable by revoking the underlying identity — a key-based SAS can't be individually revoked without a stored access policy.

Enable hierarchical namespace (Data Lake Storage Gen2) — directory renames become atomic, metadata-only operations.

No — a single share is exactly one protocol; two separate shares are needed.

The partition key — low cardinality creates a hot partition no amount of provisioned RU/s fixes; high cardinality spreads load evenly.

Session — guarantees a client sees its own writes, without paying Strong consistency's full latency/throughput cost.

The listener always resolves to the current primary automatically; connecting to a specific server breaks after a failover role change.

An elastic pool — shared capacity covers non-overlapping peaks without provisioning each database individually.

The change feed — a guaranteed, ordered, exactly-once stream of inserts/updates.

System pools run critical pods (CoreDNS, metrics-server) and should be isolated; user pools run application workloads and shouldn't share resources with system pods.

Traditional Azure CNI gives every pod a real VNet IP, which can exhaust subnet address space fast at scale; Overlay avoids that.

Flex Consumption — adds private networking and instance-size control; the original Linux Consumption plan retires in 2028.

Unnecessary operational burden (cluster/node-pool/upgrade management) with no corresponding benefit — Container Apps would have fit without that ownership cost.

Durable Functions' billing model excludes orchestrator wait time — only activity function execution time is billed.

Service Bus guarantees reliable, ordered delivery of discrete work items; Event Grid is a low-latency fan-out router with no per-message delivery guarantee.

For high-volume, replayable event streaming (millions of events/second) — not reliable per-message work processing.

Without one, stale data can be served indefinitely after the source of truth changes — a correctness bug, not just a performance issue.

Logic Apps — the workflow is fundamentally integration-heavy, and its pre-built connectors avoid reimplementing SFTP/Teams integration code.

Azure RBAC became the default (API version 2026-02-01+), replacing the older Key Vault-specific access policy model as default for new vaults.

No — Managed HSM's data plane uses its own separate local RBAC, a deliberate isolation preventing privilege escalation.

Soft delete makes a deletion recoverable; purge protection additionally blocks even an Owner from permanently purging it before the retention period elapses.

Foundational CSPM now defaults to OFF for new subscriptions as of that date — it must be explicitly enabled.

The Azure Monitor OpenTelemetry Distro — vendor-neutral, avoiding lock-in to the proprietary SDK.

High-volume, rarely-queried tables cost meaningfully more on the default Analytics plan than on Basic/Auxiliary, which trade query capability for lower cost.

WHO/HOW to notify from the alert rule itself — one shared group can be reused across many rules.

Distributed tracing with a shared trace ID (W3C Trace Context) — showing the entire call chain as one connected timeline.

HA protects against local failures (VM/zone) with fast, usually automatic failover within a region; DR protects against a full regional failure, often with slower, more deliberate failover.

The vault must use GRS/GZRS replication — an LRS vault has no secondary-region copy to restore from.

Replication health alone doesn't validate whether the recovery plan's sequencing still reflects the current architecture — only an actual test failover exercises that.

Standard Backup's RPO can be up to 24 hours — near-zero RPO needs synchronous replication (e.g., a SQL failover group) layered on top, not periodic backup alone.

Deployments are additive by design — Deployment Stacks are needed to actually track and optionally delete unmanaged resources.

When there's a genuine multi-cloud requirement — otherwise Bicep's native integration and lack of separate state management make it the pragmatic default.

Yes — GitHub Actions since 2021, Azure DevOps service connections since February 2024, both via OIDC-based workload identity federation.

Running az deployment group what-if on a recurring schedule, independent of actual deployments, to surface drift proactively.

Active-active gives instant failover and full capacity utilization at the cost of real data-consistency complexity; active-passive is simpler but slower to recover and leaves capacity idle.

Reserved Instances offer a deeper discount (up to 72% vs. ~65%) when the footprint is confirmed stable — Savings Plans trade some discount for flexibility across VM families.

Concurrent writes to the same item are a real, if infrequent, possibility — without explicit conflict-resolution design, the default last-writer-wins can silently produce incorrect state.

Not necessarily — a footprint with genuine, demonstrated stability is exactly what Reserved Instances are built for, and the flexibility premium isn't justified without a real reason to expect change.