第 2 章，共 3 章40% 占考试比重
Azure Architecture and Core Services
This chapter covers the physical and organizational structure of Azure along with its most important services. You will learn how Azure organizes datacenters into regions and availability zones, how resources are grouped into resource groups and subscriptions, and the core compute, storage, networking, database, and identity services you will use to build solutions. As the largest exam domain, mastering these building blocks is central to Azure fundamentals.
Azure Global Infrastructure
Azure runs on a worldwide network of datacenters organized to deliver performance, resilience, and compliance. Understanding regions, availability zones, and their trade-offs helps you place resources correctly. These concepts drive both reliability and data-residency decisions.
Regions are geographic areas
An Azure region is a set of datacenters within a defined geography connected by a low-latency network; you choose regions to be near users and meet residency needs.
Availability Zones protect against datacenter failure
Zones are physically separate datacenters within a region with independent power, cooling, and networking, improving in-region high availability.
Region pairs support recovery
Many regions are paired with another region in the same geography to support geo-redundancy and disaster recovery.
Service availability varies by region
Not every service or VM size is offered in every region, so availability influences placement decisions.
The Azure Resource Hierarchy
Azure organizes resources in a four-level hierarchy that determines how you manage, secure, and bill them. Settings applied higher in the hierarchy are inherited below. Knowing this order is essential for scoping access and governance.
Resources are the base unit
A resource is a single manageable item such as a VM, storage account, or database.
Resource groups contain related resources
A resource group is a logical container for resources that typically share a lifecycle and serve as a scope for permissions and policy.
Subscriptions provide billing and limits
A subscription groups resource groups for billing, access management, and quota boundaries.
Management groups span subscriptions
Management groups sit above subscriptions to apply governance across many of them at once.
Hierarchy order matters
From broadest to narrowest the order is management group, subscription, resource group, resource, with inheritance flowing downward.
Core Compute Services
Azure offers a spectrum of compute options ranging from full control to fully serverless. Selecting the right one balances control, operational overhead, and cost. Each option targets a different workload profile.
Virtual Machines for full control
Azure Virtual Machines is IaaS that lets you run and manage complete servers, choosing the OS and installed software.
App Service for managed web hosting
Azure App Service is PaaS for hosting web apps and APIs without managing the underlying servers or patching.
Azure Functions for serverless code
Functions runs event-triggered code with automatic scaling, billing only while the code executes.
Containers with AKS and ACI
Azure Kubernetes Service orchestrates containers at scale, while Azure Container Instances runs individual containers quickly without managing servers.
Availability sets improve VM resilience
Availability sets spread VMs across fault and update domains so hardware failures or maintenance affect only a subset.
Storage and Databases
Azure provides specialized storage for different data types and a range of managed database services. Choosing correctly depends on whether data is structured, unstructured, or file-based, and how it is accessed. Redundancy options let you balance durability against cost.
Blob Storage for unstructured data
Azure Blob Storage holds large volumes of unstructured objects like media and backups, with hot, cool, and archive access tiers.
Azure Files for shared file access
Azure Files provides managed SMB/NFS file shares mountable by cloud and on-premises systems.
Redundancy options vary by scope
LRS copies data within one datacenter, ZRS across zones in a region, and GRS to a secondary region for disaster protection.
Managed relational databases
Azure SQL Database offers a fully managed relational database on the SQL Server engine, handling patching, backups, and availability.
Cosmos DB for global NoSQL
Azure Cosmos DB is a globally distributed, multi-model NoSQL database delivering low-latency access at large scale.
Networking and Identity
Networking connects Azure resources to each other, to on-premises networks, and to the internet, while identity controls who can sign in and access them. Together they form the connectivity and access foundation of any solution. These services secure and route traffic across your environment.
Virtual Networks provide private networking
A VNet is an isolated private network in Azure; subnets segment its address space to organize and isolate resources.
Load balancing distributes traffic
Azure Load Balancer works at Layer 4, while Application Gateway operates at Layer 7 with URL-based routing and an optional web application firewall.
Hybrid connectivity options
VPN Gateway connects on-premises networks over encrypted internet tunnels, while ExpressRoute provides a private dedicated connection that bypasses the internet.
Network Security Groups filter traffic
NSGs contain allow/deny rules based on source, destination, port, and protocol to control access to subnets and resources.
Microsoft Entra ID manages identity
Entra ID authenticates users and controls access, supporting single sign-on, multifactor authentication, and managed identities for resources.
测试你的知识
练习 Azure Architecture and Core Services 的相关题目