Please enable JavaScript.

Coggle requires JavaScript to display documents.

Az-303 Certification Contents - Coggle Diagram

- - - - Azure security Center is an
        unified infrastructure security management system that strengthens the security posture of your data centers, and provides advanced threat protection across your hybrid workloads in the cloud
      - Related features used are Azure policy for organizational wide compliance, alerts and workbook for data visualisation
      - https://docs.microsoft.com/bs-latn-ba/azure/security-center/security-center-introduction
    - - configure diagnostic settings on resources
        
        There is a disgonostic settings pretty much in every azure resource, and you can send the logs to either Log Analytics, storage account or event hub.
      - create a performance baseline for resources
        
        Use Azure Metrics to create various performance charts for different resources
      - monitor for unused resources
      - monitor performance capacity
      - visualize diagnostics data using Azure Monitor
    - - monitor networking
      - monitor service health
    - - monitor spend
      - report on spend
    - - implement and configure Azure Monitor insights, including App Insights,
        Networks, Containers
      - configure a Log Analytics workspace
    - - collect alerts and metrics across multiple subscriptions
      - view Alerts in Azure Monitor logs
- - - - Azure KeyValue is a Secrets, Keys, Certificate, HSM keys Management service offered by Azure. It provide a central repository to store and manage your secrets, keys, certificates.
      - az keyvalut create
        https://docs.microsoft.com/en-us/cli/azure/keyvault?view=azure-cli-latest
      - public and private network access
      - Azure AD RBAC Policy
      - Monitoring
      - Throttling
    - - List of services supports managed identity:
        https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/services-support-managed-identities
      - Managed Identity provides Azure services with an automatically managed identity in Azure Active Directory to authenticate to any services that support azure ad authentication
      - System Assigned MI is bind to the azure service instance, if the service is removed, the MI is removed by azure as well
        
        when create resource add --assign-identity flag
      - User Assigned MI is an independent azure resource and can be bind to azure service instance, but it's managed seperately
        
        az identity create
        az webapp assign
    - - Azure Active Directory is Microsoft's cloud-based identity and access management service which help you authenticate and access internal and external resources such as Office 365, saas apps, azure, intranet resources etc.
      - Create from portal or az cli
        az ad app create
      - Setup Single Sign-on (SSO)
      - Branding
      - Roles & Permissions
      - Credentials such as password, certificates
      - https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app
  - - - Azure management groups are a way to manage your azure subscriptions. It provides one more level above subscriptions "management groups". Governance conditions are automatically applied to subscriptions within the "group"
        
        10,000 management groups can be supported in a single directory.
        
        A management group tree can support up to six levels of depth.
        
        Each management group and subscription can only support one parent.
        
        Each management group can have many children.
        
        All subscriptions and management groups are within a single hierarchy in each directory.
      - az account management-group create --name --display-name --parent
      - az account management-group update
        az account management-group delete
        az account management-group list
      - When moving management groups and subscriptions, the actor requires write access on both source and target
      - az account management-group subscription add
        az account management-group subscription remove
      - https://docs.microsoft.com/en-in/azure/governance/management-groups/create-management-group-portal
    - - Azure RBAC are based on security principles + role + scope
        
        Security principles is an object which represents a user, a group, a service principal, or a managed identity
        
        Role definition is a collection of permissions. Azure supports built in roles and custom roles
        
        Scope is the set of resources which the access applies to.
        
        Management group
        
        Subscription
        
        Resource group
        
        Resources
      - az role assignment create --role --scope --assignee
      - https://docs.microsoft.com/en-us/azure/role-based-access-control/quickstart-assign-role-user-portal
    - - az role definition create
      - https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles-portal
    - - You can elevate your access to ROOT level if you are global admin of the azure ad tenant
      - https://docs.microsoft.com/en-us/azure/role-based-access-control/best-practices
    - - Azure Active Directory (Azure AD) access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. User's access can be reviewed on a regular basis to make sure only the right people have continued access
        
        https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview
      - Azure Portal -> Azure Active Directory ->identity governance -> Access Review
      - Each reviewer requires an Azure AD P2 license except global admin
    - - Azure Policy are sets of business rules which helps to enforce organizational standard and to assess comliance at scale. It provides an aggregated view to evaluate the state of environment, and helps to bring resources to compliance or standards
        
        https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage
      - Policy Definition
        
        az policy definition create --name --description --rules
        
        https://docs.microsoft.com/en-us/azure/governance/policy/samples/
        
        az provider register --namespace 'Microsoft.PolicyInsights'
        
        az policy assignment create
      - Initiative Policy Definition
        
        An overarching goal for a group of policies
        
        az policy set-definition create
    - - A package or container which groups
        Role Assigment
        Policy Assignment
        ARM templates
        Resource Groups
        together to produce a repeatable set of azure resources which applies the organizational standards, patterns and requirements
      - Create a blueprint definition
      - Assign the blue print to a subscription
      - https://docs.microsoft.com/en-us/azure/governance/blueprints/tutorials/create-from-sample
  - - - https://docs.microsoft.com/en-us/azure/application-gateway/overview
    - - provides centralized protection of your web applications from common exploits and vulnerabilities
      - https://docs.microsoft.com/en-us/azure/web-application-firewall/overview
    - - Managed, cloud-base service which secures your virtual networks
      - https://docs.microsoft.com/en-us/azure/firewall/overview
    - - Layer 7 based load balance, can route request between regions
      - https://docs.microsoft.com/en-us/azure/frontdoor/front-door-overview
    - - DNS based load balancer, can route request between regions
      - https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview
      - https://docs.microsoft.com/en-us/azure/traffic-manager/quickstart-create-traffic-manager-profile
    - - Azure network security group to filter network traffic to and from Azure resources in an Azure virtual network.
      - Made by a set of rules which apply to inbound and outbound network traffics
      - Each rule you can specify the source, destination, port and protocal, just like a firewall rule
      - https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
      - https://docs.microsoft.com/en-us/azure/virtual-network/application-security-groups
    - - Azure Bastion is a fully paas service that can be provisioned into Vnet for secure and seamless RDP/SSH connection to vm in vnet in azure portal, where your VM doesn't need a public ip address
      - az network bastion create
      - Requires these to use:
        a VNET
        a VM
        a public ip address
      - https://docs.microsoft.com/en-us/azure/bastion/bastion-overview
  - - - Special services/tool sets provide by azure to migrate vms/databases/servers to Azure
      - https://docs.microsoft.com/en-us/azure/migrate/migrate-services-overview
    - - Azure backup service
      - Not only for vms, but disks, files stores, databases etc
      - https://docs.microsoft.com/en-us/azure/backup/backup-overview
    - - Azure site recovery service, includes 2 parts, recovery and back up
      - You can set up various configurations such RTO and RPOs etc
      - https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-overview
    - - Parts of Azure automation, enables you to schedule updates to your vm resources
      - https://docs.microsoft.com/en-us/azure/automation/automation-intro
- - - - az appservice ase create
      - App Services V2 which supports
        
        windows web apps
        
        linux web apps
        
        docker container
        
        mobile apps
        -functions
      - az appservice ase update
      - az webapp create
    - - az appservice plan create --is-linux
      - az appservice ase create
      - Running containers normally requires the underlying compute to be linux, windows are supported though
      - https://docs.microsoft.com/en-us/azure/app-service/quickstart-custom-container?pivots=container-linux
    - - az appservice plan create
      - az appservice plan update
      - An App Service Plan represents the underlying compute resources all apps hosted on this plan are going to comsume
      - Number of worker node represents how many copies of apps are running in the same plan, there are internal load balancer for routing between nodes.
      - https://docs.microsoft.com/en-us/azure/app-service/overview-hosting-plans
    - - Move app between regions:
        
        take back up of the app
        
        create app service plan in target region
        
        restor from backup
      - https://docs.microsoft.com/en-us/azure/app-service/configure-common
    - - Inbound
        
        Support IP Based SSL
        
        App Assigned address
        
        Dedicated inbound Address
        
        Restrict access of app from a set of address
        
        Access Restrictions
        
        Restrict access from a VNET
        
        Service Endpoints
        
        ILB ASE
        
        Private Endpoint
        
        Expose app on private IP in VNET
        
        Service Endpoint
        
        Protect with a WAF
        
        Application GateWay + ILB ASE
        
        Application GateWay + Service Endpoints
        
        Azure Front Door + Access Restrictioon
        
        Load Balance from different regions
        
        Load balance within same region
      - OutBound
        
        Access resource in VNET from same region
        
        VNET integration
        
        ASE
        
        Access resource in VNET from different region
        
        Gateway requires VNET integration
        
        ASE + VNET peering
        
        Access resources with service endpoints
        
        Access resources outside of azure in private network
        
        Hybrid Connections
        
        Access resources across Express Route
        
        Secure outbound traffic from app
        
        ASE
        
        VNET integration and NSG
        
        Route out bound traffic from app
        
        VNET integration with route tables
    - - Deployment slots for app services are just like another environment
      - It can be how swapped with production, to warm up the slot and when swap there is 0 down time for the production slot
      - az webapp deployment slot create/swap
      - https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots
    - - It's a Saas Service azure offers for simple schedule, automate, workflow, orchastration tasks to perform various actions with different integrated systems
      - Create them in portal is the easist, if you consider other options may as well build a function app or sth
      - https://docs.microsoft.com/en-us/azure/logic-apps/quickstart-create-first-logic-app-workflow
    - - az functionapp create
        
        https://docs.microsoft.com/en-us/azure/azure-functions/functions-create-function-app-portal
      - Azure functions are a variant of Azure App Service which is requires a azure storage account for storing meta data etc. It is an server less offering which is different than other app servics
  - - - Azure Container registry
        Container repository like docker hub
        private and provide different tiers
        premium tiers offers private link content security etc
      - az group create
        az acr create --sku
        az acr login --name
        docker tag {image} {acr}/{image}
        docker push
        az acr repository list
      - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-quick-task
    - - az group create
        az ask create --node-count --enable-addons --generate-ssh-keys
        az aks install-cli
        az aks get-credentials
        kubectl get nodes
        kubectl apply -f {yaml config}
        
        Access & Identity
        
        Kube RBAC
        
        kubectl create role
        kubectl create cluster role
        https://kubernetes.io/docs/reference/access-authn-authz/rbac/
        
        Azure Active Directory
        
        Azure RBAC for resources
        
        Azure RBAC for kubenetes
        
        Networking
        
        Kubenet networking
        
        https://docs.microsoft.com/en-us/azure/aks/concepts-network#kubenet-basic-networking
        
        Essentially the node will receive an ip wile the pods are using NAT connection from the node
        
        Azure Container Networking Interface
        Every pod is configured with an IP address
        
        Ingress Controller
        Layer 7 Load balancing
        
        Storage
        
        Azure managed disks
        
        Azure File Share
        
        Scaling
        
        Horizontal pod autoscalar
        
        Cluster autoscalar
        
        https://docs.microsoft.com/en-us/azure/aks/scale-cluster
      - https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough-portal
    - - use integrated web hooks to push and deploy images from ACR
      - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-webhook
      - https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-docker-cli
    - - az group create
        az container create -g -n --image --dns-name-label --ports
        az container logs
        az container attach
        az container delete
      - https://docs.microsoft.com/en-us/azure/container-instances/container-instances-quickstart-portal
- - - - Resource: Azure Storage Account Table Storage
      - Azure Table storage is a service that stores large amounts of structured NoSQL data in the cloud, providing a key/attribute store with a schemaless design which accepts authenticated calls from inside and outside the Azure cloud
      - Advantages & Disadvantages vs CosmosDB Table API
        
        Advantages:
        
        Cost is only calculated after use, no reserve cost
        
        CORS support
        
        AutoSort Query results
        
        Support ID as property
        
        Optimized for storage
        
        Disadvantages:
        
        10s SLA vs 10ms SLA for cosmos db
        
        no fail over on secondary region
        
        no secondary indexes
        
        No Global Distribution, only read only secondary regions
        
        HA, need to configure readonly secondary
        
        Not optimized for throughput
      - Implemtation/Configuration Examples
        
        Azure Cli
        
        az group create
        az storage account create
        
        PowerShell
        
        ARM
        
        Azure Portal
      - Use Cases:
        
        Large amount of structured NoSQL data
        
        Quick Queries by cluster index(partitionkeys)
        
        No foreign keys, complex joins, store procedures, denormalized data is prefered
        
        OData protocol
    - - Resource: Azure Cosmos DB
        
        MongoDB API
        
        Gremlin API
        
        Table API/SQL API
        
        Although It's called Table API, It's not a Relational DB. It's one of the Multi-Model Azure offers for customers
        
        az group create
        az cosmosdb create
        az cosmosdb table create
        
        Etcd API
        
        Cassandra API
      - Azure Cosmos DB is Azure's Database as a Service offering, which features global distribution, multi-model, high availablility, elastic scale and single digit ms latency SLA.
    - - How to setup for high availablility for CosmosDb
        
        Create cosmosdb with multi-region
        az cosmosdb create -n {name} -g {resourceGroup} --default-consistency-level {consistencyLevel} -locations regionName ={region1} failoverPriority = 0, isZoneRedundant=false -locations regionName ={region2} failoverPriority = 1, isZoneRedundant=false
        
        Add Or Remove Regions
        `az cosmosdb update -n {name} -g {resourceGroup} -locations {list of locations}
        
        Enable Multi Write Master
        az cosmosdb update --ids {resourceId} --enable-multiple-write-locations true
        
        Enable Automatic Fail over
        az cosmosdb update --ids {resourceId} --enable-automatic-failover true
        
        Portal => CosmosDB => Replicate Data Globally
      - Single Region Account will lose availability during regional outage
      - Multi-region accounts with more than one region will still remain functional, Azure will promote secondary region to read&write if enable-automatic-failover is set
      - https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-manage-database-account#addremove-regions-from-your-database-account
  - - - az group create
        az sql server create
        az sql server firewall-rule create
        az sql db create
      - Transparent Data Encryption
        
        BYOK or Microsoft managed KEY
        
        az sql db tde set --status Enabled
      - Auditing
        
        Advanced Threat Protection
        
        Trigger alerts for abnormal activities
        
        Configure email for receiving alerts
        
        Review alerts/event in Azure Security Centre
        
        Send audit log to storage account append blob
        
        Portal to set where the audit log go
        
        Log Analytics and Event Hub are in preview
      - Dynamic Data Masking
        
        prevent unauthorized access to sensitive data
        
        policy-based security feature
        
        hides data in query result
        
        data is unchanged in db
      - User/Firewall Access
        
        SQL Login
        
        CREATE USER {user} WITH PASSWORD ="pwd"
        
        GRANT SELECT,INSERT, UPDATE, DELETE To {user}
        
        Azure Active Directory Login
        
        CREATE USER {user@domain.com} FROM EXTERNAL PROVIDER
        
        Server IP Firewall Setting
        
        VNet configuration
    - - az sql mi create
      - https://docs.microsoft.com/en-us/azure/azure-sql/managed-instance/quickstart-content-reference-guide
    - - Create Azure SQL Database
      - Add Database into fail over group
      - Configure auto fail over
      - Setup logins etc like the primary database
      - Create fail over group
      - https://docs.microsoft.com/en-us/azure/azure-sql/database/high-availability-sla
    - - How you can publish an update to SQL database
        
        data tier package(DACPAC)
        
        Run SQL scripts directly
        
        https://docs.microsoft.com/en-us/azure/devops/pipelines/targets/azure-sqldb?view=azure-devops&tabs=yaml