Introduction to Cloud Computing & Microsoft Azure

Microsoft Azure is a public cloud platform. Instead of buying and running your own servers, you rent computing power, storage, networking and higher-level services from Microsoft's global datacenters — and pay only for what you actually use.

Why organizations move to the cloud

Try it: who manages what?

Cloud computing comes in three flavors — IaaS, PaaS and SaaS — and the only real difference is how much of the stack you manage yourself versus how much Azure manages for you. Click each one and watch the stack change.

The shared responsibility model

A common exam topic. No matter which service model you pick, some things are always yours and some are always Microsoft's:

Cloud deployment models

How you manage Azure

Azure Portal, Regions & Resource Groups

Before you deploy anything, you need to understand three things: where your resources physically live (regions), how they're organized (resource groups), and how the whole account structure fits together.

Azure's physical hierarchy

You never pick a datacenter directly. You pick a region, and Azure decides which underlying buildings host your resources.

Choosing a region

Region pairs

Most regions are paired with another region at least 300 miles away in the same geography — for example Central India ↔ South India. During a broad outage Azure prioritizes restoring one region of each pair first, and several services replicate across the pair automatically for disaster recovery.

The management hierarchy

Separately from the physical hierarchy above, there's an organizational hierarchy that controls billing and permissions:

Resource groups in practice

A resource group is a logical container holding related resources — a VM together with its disk, network interface and public IP. A few rules worth memorizing:

Navigating the Azure Portal

Tagging

Tags are simple name:value labels you attach to resources — for example Environment:Production, Owner:Finance, CostCenter:4412. They don't change how a resource behaves, but they're what makes cost reports and bulk governance actually usable at scale.

Module 1 Exam

Eight questions covering cloud service models, the shared responsibility model, regions and resource groups. Instant feedback after each answer, then a final score. Aim for 70% or better before moving on.

Create and Manage Azure Virtual Machines

A virtual machine is Azure's classic IaaS offering: a full computer — CPU, memory, disk, network card — running on Microsoft's hardware, where you control the operating system and everything installed on it.

When a VM is the right choice

What gets created alongside your VM

Creating one VM actually creates several linked resources. Deleting the VM does not automatically delete all of them — a very common source of surprise costs.

VM size families

Azure groups VM sizes into families optimized for different workloads. The letter tells you the purpose:

Creating a VM in the portal

The creation wizard walks through tabs. The decisions that actually matter:

The same thing with the CLI is a single command:

az vm create \
  --resource-group rg-lab-prod-cin \
  --name web-vm-01 \
  --image Ubuntu2204 \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --generate-ssh-keys

Connecting to your VM

VM power states and what you pay for

Common troubleshooting

Azure VM Disks & Core Architecture

Disk choice is where VM performance is won or lost — and where a surprising share of the bill comes from. This lesson covers the three disk roles, the four performance tiers, and how resiliency options fit together.

The three disks attached to a VM

Managed disk performance tiers

Managed vs unmanaged disks

Modern Azure uses managed disks exclusively for new deployments. Azure handles the underlying storage accounts, replication and scaling for you — you just say "I want a 256 GB Premium SSD." Unmanaged disks (where you managed your own storage accounts) are legacy and shouldn't be used for anything new.

Disk encryption

Snapshots and images

Resiliency: how VMs stay available

Fault domains and update domains

These two terms are what an availability set actually does, and they're a reliable exam question:

Virtual Machine Scale Sets & Auto Scaling

A Virtual Machine Scale Set (VMSS) manages a group of identical VMs as a single resource — and grows or shrinks that group automatically based on demand. It's how you stop paying for peak capacity 24 hours a day.

Scaling up vs scaling out

Try it: watch autoscale react

This scale set is configured to scale out above 70% CPU and scale in below 30%, with a minimum of 2 and a maximum of 8 instances. Drag the slider to simulate changing load.

How a scale set is defined

Autoscale rule anatomy

Scaling modes

Upgrade policies

Creating a scale set from the CLI:

az vmss create \
  --resource-group rg-lab-prod-cin \
  --name web-vmss \
  --image Ubuntu2204 \
  --instance-count 2 \
  --vm-sku Standard_D2s_v3 \
  --upgrade-policy-mode rolling \
  --admin-username azureuser \
  --generate-ssh-keys

Module 2 Exam

Ten questions on virtual machines, disks, availability and scale sets. Instant feedback after each answer, then a final score. Aim for 70% or better before moving on.

Introduction to Azure Storage Accounts

A storage account is the container that holds all your Azure storage data services. It provides a unique namespace, and every blob, file share, queue and table lives inside one.

The four data services

Account types

Redundancy — the most-tested topic

Redundancy decides how many copies of your data exist and where. Every option keeps at least three copies.

Access tiers for blob data

Securing access

Creating an account from the CLI:

az storage account create \
  --resource-group rg-lab-prod-cin \
  --name veplearnstorage01 \
  --location centralindia \
  --sku Standard_ZRS \
  --kind StorageV2 \
  --access-tier Hot

Azure Blob Storage & File Storage

Blob and File are the two storage services you'll use most. They solve different problems: blobs are for objects your application reads and writes, file shares are for drives your servers and users mount.

Blob storage structure

A blob's URL follows a predictable pattern:

https://veplearnstorage01.blob.core.windows.net/images/logo.png
       └── account ──┘                          └container┘└ blob ┘

The three blob types

Container access levels

Blob data protection

Azure Files

Azure Files gives you a fully managed network file share, reachable over SMB (Windows/Linux/macOS) or NFS (Linux, premium only). Unlike blobs, applications need no rewriting — it mounts as a normal drive.

Mounting a share on Linux:

sudo mount -t cifs \
  //veplearnstorage01.file.core.windows.net/appdata /mnt/appdata \
  -o vers=3.0,username=veplearnstorage01,password=<key>,serverino

Blob vs Files — choosing

Azure Queue Storage & Table Storage

The two remaining storage services are less flashy but solve real architectural problems: queues decouple components so they can fail independently, and tables store huge volumes of structured data cheaply.

Why queues exist

Without a queue, a web app that resizes uploaded images must do it while the user waits — and if the resizer crashes, the request is lost. A queue turns that into a durable hand-off:

How a message is consumed

Queue Storage doesn't delete a message when it's read. Instead it becomes invisible for a set time while the worker processes it:

Queue Storage vs Service Bus

Table Storage

Table Storage is a NoSQL key-value store: schemaless rows (entities) that can each carry different properties. It's very cheap and scales to billions of rows, but it is not a relational database — no joins, no foreign keys, no complex queries.

The two keys that decide everything

Together they form the primary key. A query supplying both is a point lookup — the fastest operation available. Supplying neither forces a full table scan.

Module 3 Exam

Ten questions on storage accounts, redundancy, access tiers, blobs, files, queues and tables. Aim for 70% or better before moving on.

Introduction to Azure Virtual Networks

A Virtual Network (VNet) is your own private, isolated slice of the Azure network. It's the foundation everything else sits on — VMs, databases, app services with private access all attach to a VNet.

What a VNet gives you

Scope and boundaries

Private address ranges (RFC 1918)

VNets use private IP space. These three ranges are reserved for private networks worldwide:

Public vs private IPs

Name resolution

By default, Azure provides DNS for every VNet automatically — VMs can resolve each other by hostname with no configuration. You can override this with custom DNS servers (common when integrating with on-premises Active Directory), or use Azure Private DNS zones for your own private domain names.

Creating a VNet with a subnet:

az network vnet create \
  --resource-group rg-lab-prod-cin \
  --name vnet-prod-cin \
  --address-prefix 10.20.0.0/16 \
  --subnet-name snet-web \
  --subnet-prefix 10.20.1.0/24

Subnets & IP Addressing in Azure

A subnet divides your VNet's address space into smaller segments. Subnets are how you separate tiers — web, application, database — so each can have its own security rules and routing.

Reading CIDR notation

The number after the slash says how many bits are fixed as the network portion. A bigger number means a smaller network:

A typical three-tier layout

Sizing subnets

Service endpoints vs private endpoints

Both let VNet resources reach PaaS services like Storage or SQL more securely, but they work differently:

Routing basics

Azure creates system routes automatically so everything inside a VNet can reach everything else. You override them with a User Defined Route (UDR) in a route table — most often to force traffic through a firewall or network virtual appliance before it leaves.

az network vnet subnet create \
  --resource-group rg-lab-prod-cin \
  --vnet-name vnet-prod-cin \
  --name snet-data \
  --address-prefix 10.20.3.0/24

Network Security Groups (NSG)

An NSG is a distributed firewall that filters traffic to and from Azure resources. It holds a prioritized list of allow/deny rules, evaluated in order until one matches.

The rules that matter

Try it: watch rule evaluation

This NSG protects a web server. Pick an incoming packet and watch which rule catches it — notice how everything below the matching rule is never even reached.

What defines a rule

Default rules you can't delete

Service tags

Rather than maintaining IP lists, use service tags — Microsoft-managed labels that stay current automatically: Internet, VirtualNetwork, AzureLoadBalancer, Storage, Sql, AzureCloud.

Application Security Groups & VNet Peering

Two features that make networks easier to manage as they grow: ASGs let you write rules about roles instead of IP addresses, and peering connects VNets together privately.

The problem ASGs solve

Without ASGs, NSG rules reference IP addresses. Add a web server and you must edit every rule that mentions the web tier. With ASGs you group NICs by role and write rules against the group name — new servers just join the group.

VNet peering

Peering connects two VNets so resources talk over Microsoft's backbone using private IPs — no VPN gateway, no public internet, low latency.

Three rules that trip people up

Hub-and-spoke

The standard enterprise pattern: a central hub VNet holds shared services (firewall, VPN gateway, DNS, Bastion), and each workload lives in its own spoke peered to the hub. It centralizes security and cuts costs, since one gateway serves every spoke.

az network vnet peering create \
  --resource-group rg-lab-prod-cin \
  --name hub-to-spoke1 \
  --vnet-name vnet-hub \
  --remote-vnet vnet-spoke1 \
  --allow-vnet-access --allow-forwarded-traffic

Connecting to on-premises

Azure Network Watcher & Network Troubleshooting

Network Watcher is the diagnostic toolbox for Azure networking. Rather than guessing why traffic is blocked, these tools tell you exactly which rule or route is responsible.

The diagnostic tools

A troubleshooting method that works

Common failures and their causes

Reading NSG flow logs

Flow logs write every connection to storage as JSON. Paired with Traffic Analytics, they answer questions raw logs can't: which hosts talk most, what's being denied repeatedly, and whether anything is scanning your subnets.

# Is this packet allowed, and by which rule?
az network watcher test-ip-flow \
  --vm web-vm-01 \
  --direction Inbound \
  --protocol TCP \
  --local 10.20.1.4:443 \
  --remote 198.51.100.7:60000

Module 4 Exam

Twelve questions on virtual networks, subnets, IP addressing, NSGs, ASGs, peering and troubleshooting. Aim for 70% or better before moving on.

Azure Load Balancer

Azure Load Balancer distributes incoming traffic across a pool of backend servers. It operates at Layer 4 — it sees IP addresses and ports, not URLs or content — which makes it extremely fast and protocol-agnostic.

Try it: watch traffic get distributed

Send requests through the load balancer and watch which backend server receives each one. Then take a server down and see how health probes reroute traffic away from it.

The four components

Public vs internal

Basic vs Standard SKU

Health probes

Distribution modes

az network lb create \
  --resource-group rg-lab-prod-cin \
  --name lb-web-prod \
  --sku Standard \
  --frontend-ip-name fe-public \
  --backend-pool-name bp-web

Azure Application Gateway

Application Gateway is a Layer 7 load balancer. Unlike the Layer 4 Load Balancer, it can read the actual HTTP request — the URL path, the hostname, the headers — and route based on what it finds.

Try it: path-based routing

Click a URL and watch which backend pool the gateway selects by inspecting the path.

What Layer 7 makes possible

How a request flows through

Web Application Firewall modes

Choosing between the load balancers

Azure DNS

Azure DNS hosts your domain's DNS records on Microsoft's global network of name servers. It doesn't sell you domains — you register elsewhere and delegate the name servers to Azure.

How a DNS lookup works

Record types you'll actually use

Alias records

Public vs private zones

TTL — time to live

TTL tells resolvers how long to cache a record. Long TTLs reduce lookups and cost; short TTLs let changes propagate fast.

az network dns record-set a add-record \
  --resource-group rg-lab-prod-cin \
  --zone-name veplearn.example \
  --record-set-name www \
  --ipv4-address 20.44.12.8

Azure Traffic Manager

Traffic Manager is a DNS-based global load balancer. It doesn't carry your traffic — it answers DNS queries with the IP of whichever endpoint its routing method selects, and the client then connects directly.

The six routing methods

Priority vs Performance vs Geographic

Endpoint types

Traffic Manager vs Front Door

Azure Front Door & CDN

Front Door is Microsoft's global entry point for web applications: a reverse proxy running at edge locations worldwide that combines global load balancing, caching, SSL offload and a web application firewall.

Why the edge matters

A user in Chennai requesting content from a server in Virginia waits for the round trip. An edge node in Chennai serving a cached copy answers in milliseconds. Front Door also terminates TLS at the edge, so the expensive handshake happens close to the user.

What Front Door provides

Caching behaviour

Front Door vs CDN

Choosing the right service — the summary

Module 5 Exam

Twelve questions on Load Balancer, Application Gateway, DNS, Traffic Manager and Front Door. Aim for 70% or better before moving on.