Azure Cloud

You can provision and organize Azure subscriptions, resource groups, and core infrastructure using the portal and command-line tools.

1. What cloud computing is: IaaS, PaaS and SaaS120 min
   • cloud service models
   • shared responsibility model
   • cloud economics
2. Azure global infrastructure: regions, availability zones and region pairs120 min
   • regions
   • availability zones
   • region pairs
   • latency considerations
3. Creating and securing a subscription, billing and the free account90 min
   • subscriptions
   • billing alerts
   • management scopes
   • cost management
4. The Azure Portal, Azure CLI, PowerShell and Cloud Shell150 min
   • az login
   • Az PowerShell module
   • Azure Cloud Shell
   • Cloud Shell storage
5. Management groups, subscriptions, resource groups and the Well-Architected Framework120 min
   • management groups
   • resource groups
   • Well-Architected pillars
   • resource locking

Hands-on project: Provision a multi-tenant resource group hierarchy using Azure CLI and apply tagging policies compliant with enterprise governance standards.

You can configure secure access controls, multi-factor authentication, and role-based permissions using Microsoft Entra ID.

1. Microsoft Entra ID (formerly Azure AD): users and groups90 min
   • Entra ID tenant
   • user lifecycle management
   • dynamic groups
   • guest accounts
2. Role-Based Access Control (RBAC) and built-in roles120 min
   • Owner
   • Contributor
   • Reader
   • custom role definitions
   • scope assignments
3. Authentication, MFA and Conditional Access120 min
   • multi-factor authentication
   • Conditional Access policies
   • named locations
   • sign-in risk
4. Service principals and managed identities150 min
   • system-assigned managed identity
   • user-assigned managed identity
   • app registrations
   • secret rotation
5. Hybrid identity and Microsoft 365 integration overview90 min
   • Microsoft Entra Connect
   • pass-through authentication
   • federation
   • license assignment

Hands-on project: Configure a secure Microsoft Entra ID tenant with custom security groups, Conditional Access policies enforcing MFA, and service principals for external automation.

You can deploy, scale, and secure virtual machine workloads behind enterprise load balancers and application gateways.

1. Azure Virtual Machines, images and sizes120 min
   • VM series (B, D, E, N)
   • marketplace images
   • custom images
   • cloud-init
2. SSH and RDP access, NSGs and connecting to VMs120 min
   • SSH keys
   • RDP protocol
   • Network Security Groups
   • Just-In-Time VM access
3. Managed disks, snapshots and storage120 min
   • Standard SSD
   • Premium SSD
   • disk snapshots
   • disk encryption
4. Azure Load Balancer and Application Gateway150 min
   • Layer 4 load balancing
   • Layer 7 routing
   • backend pools
   • SSL termination
5. Virtual Machine Scale Sets and autoscaling150 min
   • VMSS orchestration
   • autoscale rules
   • scale-out triggers
   • rolling upgrades

Hands-on project: Deploy an auto-scaling Linux virtual machine scale set running behind an Azure Application Gateway with custom health probes.

You can architect resilient cloud storage solutions with automated lifecycle management, access tiers, and secure shared access signatures.

1. Azure Storage accounts and Blob storage120 min
   • general-purpose v2
   • containers
   • block blobs
   • storage account keys
2. Access tiers, redundancy (LRS, GRS) and lifecycle management120 min
   • Hot
   • Cool
   • Archive tiers
   • LRS
   • ZRS
   • GRS
   • lifecycle management policies
3. Static website hosting and SAS tokens90 min
   • static web hosting container
   • Shared Access Signatures
   • stored access policies
   • CORS rules
4. Azure Files and managed disks120 min
   • SMB shares
   • NFS shares
   • Azure File Sync
   • managed disk performance tiers
5. Backup, archive and Azure Storage Explorer90 min
   • Recovery Services vault
   • Azure Backup
   • soft delete
   • Storage Explorer workflows

Hands-on project: Configure an Azure Storage account with blob versioning, lifecycle management rules moving cold data to archive tier, and SAS-token-restricted public uploads.

You can design segmented enterprise networks with peered VNets, custom routing, private DNS zones, and global edge delivery.

1. Virtual Network (VNet), subnets and address spaces120 min
   • CIDR blocks
   • subnets
   • private IP allocation
   • IP addresses
2. Route tables, NAT gateway and service endpoints120 min
   • user-defined routes
   • NAT Gateway
   • virtual network service endpoints
   • subnet delegation
3. Network Security Groups and Application Security Groups120 min
   • inbound rules
   • outbound rules
   • priority ordering
   • ASG grouping
4. Azure DNS and Private DNS zones90 min
   • public DNS zones
   • Private DNS zones
   • VNet linking
   • record sets
5. Azure Front Door, CDN and VNet peering150 min
   • global load balancing
   • WAF policies
   • CDN endpoints
   • global VNet peering

Hands-on project: Build a hub-and-spoke virtual network architecture with peered VNets, custom route tables, NAT gateway, and Azure Front Door routing.

You can provision, secure, and scale relational and NoSQL databases with automated replication and caching.

1. Azure SQL Database and SQL Managed Instance120 min
   • DTUs
   • vCores
   • serverless pools
   • SQL Managed Instance networking
2. Azure Database for PostgreSQL and MySQL120 min
   • flexible server
   • high availability
   • read replicas
   • parameter groups
3. Cosmos DB for NoSQL workloads120 min
   • Core SQL API
   • partition keys
   • consistency levels
   • Request Units (RUs)
4. Azure Cache for Redis90 min
   • Standard tier
   • Premium tier
   • clustering
   • eviction policies
5. Backups, replication and database security120 min
   • point-in-time restore
   • geo-backup
   • firewall rules
   • private endpoints for databases

Hands-on project: Deploy an Azure SQL database with transparent data encryption, automated geo-replication, and a companion Azure Cache for Redis instance.

You can build event-driven serverless workflows, managed APIs, and reactive data pipelines.

1. Serverless concepts and Azure Functions120 min
   • consumption plan
   • premium plan
   • App Service plans
   • runtime stack
2. Triggers and bindings120 min
   • HTTP trigger
   • Blob trigger
   • Cosmos DB output binding
   • queue bindings
3. Logic Apps and workflow automation120 min
   • designer workflows
   • connectors
   • enterprise integration
   • error handling
4. API Management and building APIs120 min
   • APIM gateway
   • product tiers
   • policy fragments
   • rate limiting
5. Event Grid and event-driven architectures90 min
   • event publishers
   • event subscriptions
   • dead-lettering
   • webhook endpoints

Hands-on project: Create an event-driven ingestion pipeline using Azure Blob triggers on Azure Functions publishing messages via Event Grid into Cosmos DB.

You can build, store, and orchestrate containerised applications using Azure Container Registry and Azure Kubernetes Service.

1. Running containers on Azure90 min
   • container landscape
   • Docker on Azure
   • container networking
2. Azure Container Registry (ACR)90 min
   • registry tiers
   • image tagging
   • vulnerability scanning
   • geo-replication
3. Azure Container Instances and Container Apps120 min
   • ACI resource groups
   • Azure Container Apps
   • revision management
   • KEDA scaling
4. Azure Kubernetes Service (AKS)150 min
   • managed control plane
   • node pools
   • Azure CNI
   • Kubernetes RBAC
5. Deploying containerized applications150 min
   • Kubernetes deployments
   • services
   • Ingress controllers
   • persistent volumes

Hands-on project: Deploy a multi-container microservices application to Azure Kubernetes Service with ingress routing, pulling private images from Azure Container Registry.

You can implement comprehensive system monitoring, log analytics, secrets management, and cloud threat protection.

1. Azure Monitor: metrics, alerts and dashboards120 min
   • metric alerts
   • action groups
   • activity log
   • custom dashboards
2. Log Analytics and Application Insights150 min
   • Kusto Query Language (KQL)
   • diagnostic settings
   • Application Insights SDK
   • dependency mapping
3. Azure Key Vault for secrets, keys and certificates120 min
   • secret management
   • key rotation
   • certificate enrollment
   • Access policies vs RBAC
4. Microsoft Defender for Cloud and Azure WAF120 min
   • Secure Score
   • defender plans
   • Web Application Firewall
   • threat detection
5. Cost Management, budgets and optimization90 min
   • cost analysis
   • budgets
   • advisor recommendations
   • reserved instances

Hands-on project: Configure Azure Monitor alerts, Log Analytics workspaces, Application Insights APM traces, and secure database credentials using Azure Key Vault.

You can author reproducible infrastructure templates with Bicep and Terraform, and automate delivery pipelines with Azure DevOps.

1. Infrastructure as Code with ARM templates and Bicep150 min
   • Bicep syntax
   • modules
   • parameters
   • az deployment group create
2. Introduction to Terraform on Azure150 min
   • azurerm provider
   • terraform state
   • variables
   • terraform apply
3. CI/CD with Azure DevOps Pipelines and GitHub Actions150 min
   • YAML pipelines
   • service connections
   • build stages
   • release gates
4. Messaging with Service Bus, Storage Queues and Event Hubs120 min
   • Azure Service Bus queues
   • topics and subscriptions
   • Storage Queues
   • Event Hubs streaming
5. High availability and disaster recovery120 min
   • Traffic Manager
   • cross-region replication
   • backup strategies
   • failover drills

Hands-on project: Build an end-to-end CI/CD pipeline in Azure DevOps that lints Bicep templates, runs automated infrastructure tests, and deploys a multi-tier cloud environment.

You can navigate exam objectives, question formats, and practical scenarios for AZ-900 Fundamentals and AZ-104 Administrator certifications.

1. Azure certification paths and how to choose60 min
   • role-based certifications
   • fundamentals exams
   • expert certifications
   • prerequisites
2. AZ-900 Fundamentals and AZ-104 Administrator focus120 min
   • identity domains
   • governance domains
   • storage domains
   • compute domains
3. Exam structure, domains and question patterns90 min
   • case studies
   • multiple-choice questions
   • active drag-and-drop
   • lab scenarios
4. Practice tests and exam strategy120 min
   • time management
   • elimination techniques
   • reviewing flagged items
   • passing score requirements
5. Hands-on review of frequently tested services120 min
   • VNet peering edge cases
   • RBAC inheritance
   • storage account encryption
   • load balancer probes

Hands-on project: Complete a simulated timed mock certification exam covering AZ-104 domains with code-based troubleshooting tasks.

You can reduce an Azure bill with evidence and enforce the policies that keep it down.

1. Reading an Azure bill90 min
   • Cost Management exports
   • Tags and showback
   • Orphaned disks and IPs
2. Paying less90 min
   • Reservations and savings plans
   • Spot VMs
   • Storage tiers and lifecycle
3. Right-sizing and scheduling90 min
   • Azure Monitor utilisation
   • Advisor recommendations
   • Auto-shutdown schedules
4. Guardrails that hold90 min
   • Azure Policy and initiatives
   • Management group scopes
   • Budgets and action groups

Hands-on project: Find the three largest avoidable costs in a Cost Management export, enforce a tagging policy with Azure Policy, right-size from Azure Monitor metrics, and set budgets with action groups that notify an owner.

You can design, build, test, and present a complete, production-grade cloud architecture on Azure adhering to Well-Architected Framework principles.

1. Design a scalable, secure and cost-aware architecture on Azure120 min
   • architecture blueprint
   • threat modeling
   • cost estimation
   • resiliency planning
2. Build it: VNet, compute, storage, database and identity180 min
   • end-to-end provisioning
   • network connectivity verification
   • database seeding
   • identity linking
3. Add monitoring, autoscaling and infrastructure as code150 min
   • Log Analytics workspace setup
   • metric alert configuration
   • autoscale rule integration
   • modular Bicep refactoring
4. Optimize for cost and document the design120 min
   • Azure Advisor review
   • right-sizing instances
   • architecture documentation
   • runbook creation
5. Portfolio, GitHub, mock interviews and career prep150 min
   • GitHub portfolio polishing
   • cloud engineer resume review
   • mock technical interview
   • salary negotiation

Hands-on project: Design and deploy a complete production web application architecture on Azure featuring Hub-Spoke networking, AKS, Azure SQL, Key Vault, and automated Bicep deployments.