Chương 2 / 340% của kỳ thi

Azure Architecture and Core Services

This chapter covers the physical and organizational structure of Azure along with its most important services. You will learn how Azure organizes datacenters into regions and availability zones, how resources are grouped into resource groups and subscriptions, and the core compute, storage, networking, database, and identity services you will use to build solutions. As the largest exam domain, mastering these building blocks is central to Azure fundamentals.

Azure Global Infrastructure

Azure runs on a worldwide network of datacenters organized to deliver performance, resilience, and compliance. Understanding regions, availability zones, and their trade-offs helps you place resources correctly. These concepts drive both reliability and data-residency decisions.

Regions are geographic areas

An Azure region is a set of datacenters within a defined geography connected by a low-latency network; you choose regions to be near users and meet residency needs.

Availability Zones protect against datacenter failure

Zones are physically separate datacenters within a region with independent power, cooling, and networking, improving in-region high availability.

Region pairs support recovery

Many regions are paired with another region in the same geography to support geo-redundancy and disaster recovery.

Service availability varies by region

Not every service or VM size is offered in every region, so availability influences placement decisions.

The Azure Resource Hierarchy

Azure organizes resources in a four-level hierarchy that determines how you manage, secure, and bill them. Settings applied higher in the hierarchy are inherited below. Knowing this order is essential for scoping access and governance.

Resources are the base unit

A resource is a single manageable item such as a VM, storage account, or database.

Resource groups contain related resources

A resource group is a logical container for resources that typically share a lifecycle and serve as a scope for permissions and policy.

Subscriptions provide billing and limits

A subscription groups resource groups for billing, access management, and quota boundaries.

Management groups span subscriptions

Management groups sit above subscriptions to apply governance across many of them at once.

Hierarchy order matters

From broadest to narrowest the order is management group, subscription, resource group, resource, with inheritance flowing downward.

Core Compute Services

Azure offers a spectrum of compute options ranging from full control to fully serverless. Selecting the right one balances control, operational overhead, and cost. Each option targets a different workload profile.

Virtual Machines for full control

Azure Virtual Machines is IaaS that lets you run and manage complete servers, choosing the OS and installed software.

App Service for managed web hosting

Azure App Service is PaaS for hosting web apps and APIs without managing the underlying servers or patching.

Azure Functions for serverless code

Functions runs event-triggered code with automatic scaling, billing only while the code executes.

Containers with AKS and ACI

Azure Kubernetes Service orchestrates containers at scale, while Azure Container Instances runs individual containers quickly without managing servers.

Availability sets improve VM resilience

Availability sets spread VMs across fault and update domains so hardware failures or maintenance affect only a subset.

Storage and Databases

Azure provides specialized storage for different data types and a range of managed database services. Choosing correctly depends on whether data is structured, unstructured, or file-based, and how it is accessed. Redundancy options let you balance durability against cost.

Blob Storage for unstructured data

Azure Blob Storage holds large volumes of unstructured objects like media and backups, with hot, cool, and archive access tiers.

Azure Files for shared file access

Azure Files provides managed SMB/NFS file shares mountable by cloud and on-premises systems.

Redundancy options vary by scope

LRS copies data within one datacenter, ZRS across zones in a region, and GRS to a secondary region for disaster protection.

Managed relational databases

Azure SQL Database offers a fully managed relational database on the SQL Server engine, handling patching, backups, and availability.

Cosmos DB for global NoSQL

Azure Cosmos DB is a globally distributed, multi-model NoSQL database delivering low-latency access at large scale.

Networking and Identity

Networking connects Azure resources to each other, to on-premises networks, and to the internet, while identity controls who can sign in and access them. Together they form the connectivity and access foundation of any solution. These services secure and route traffic across your environment.

Virtual Networks provide private networking

A VNet is an isolated private network in Azure; subnets segment its address space to organize and isolate resources.

Load balancing distributes traffic

Azure Load Balancer works at Layer 4, while Application Gateway operates at Layer 7 with URL-based routing and an optional web application firewall.

Hybrid connectivity options

VPN Gateway connects on-premises networks over encrypted internet tunnels, while ExpressRoute provides a private dedicated connection that bypasses the internet.

Network Security Groups filter traffic

NSGs contain allow/deny rules based on source, destination, port, and protocol to control access to subnets and resources.

Microsoft Entra ID manages identity

Entra ID authenticates users and controls access, supporting single sign-on, multifactor authentication, and managed identities for resources.

Kiểm tra kiến thức của bạn

Câu hỏi luyện tập về Azure Architecture and Core Services

Management and Governance

Last updated: July 2026