Describe Azure Architecture and Services · Topic 2 of 4
Compute and Networking Services
AZ-900 compute and networking: containers, VMs, functions, scale sets, availability sets, Virtual Desktop, VNets, peering, VPN Gateway, ExpressRoute and endpoints.
- 6 min
- Includes a diagram
- Virtual machines give control, containers are lightweight and portable, functions are serverless and event driven.
- Scale sets add and remove identical VMs automatically. Availability sets spread VMs inside a datacenter.
- Azure Virtual Desktop delivers desktops and apps from the cloud.
What it is
Compute is the processing power that runs your code. Networking connects your resources to each other, to the internet and to your own offices.
Azure offers several compute types and several ways to connect networks. The exam asks which one fits a given need.
How it works
Compute types
| Type | What it is | Choose it when |
|---|---|---|
| Virtual machines | A full virtual computer with your own operating system | You need full control or must move an app unchanged |
| Containers | Lightweight packages that share the host operating system | You want fast start and portable apps |
| Functions | Serverless code that runs when an event happens | You run short event driven tasks |
Containers start faster and use fewer resources than virtual machines because they do not each carry a full operating system. Azure Container Instances runs single containers and Azure Kubernetes Service manages many.
Virtual machine options
- Azure Virtual Machines: a single virtual machine you configure and manage.
- Virtual Machine Scale Sets: a group of identical virtual machines that can grow and shrink automatically.
- Availability sets: a way to spread machines across separate hardware and update schedules inside one datacenter so that one failure or update does not stop them all.
- Azure Virtual Desktop: a Windows desktop and apps delivered from the cloud to users.
Availability zones give a higher availability commitment than an availability set, because they separate machines across datacenters.
Resources a virtual machine needs
A virtual machine needs a size that sets its CPU and memory, an operating system disk, and a network interface connected to a virtual network. It may also have data disks and a public IP address. All of them sit in a resource group.
Application hosting options
| Option | You manage | Best for |
|---|---|---|
| Azure App Service | Only your code | Web apps and APIs |
| Containers | The container and its contents | Portable, microservice style apps |
| Virtual machines | The operating system and everything above it | Full control or unchanged legacy apps |
Virtual networking
An Azure virtual network (VNet) is your private network in Azure. It has an address space, which you divide into subnets to organise resources. Resources in a virtual network communicate privately.
- Peering connects two virtual networks over the Microsoft backbone, so they talk with low latency using private addresses, without a gateway.
- Azure DNS hosts your domain names and answers name lookups using Azure infrastructure.
- VPN Gateway sends encrypted traffic between a virtual network and another network across the public internet.
- ExpressRoute is a private connection from your network to Azure through a connectivity provider. It does not use the public internet, so it is more reliable and has lower latency than a VPN.
Public and private endpoints
A public endpoint is reached over the internet through a public IP address. A private endpoint gives an Azure service, such as a storage account, a private IP address inside your virtual network. Traffic then stays on the Microsoft network and never crosses the public internet. This feature is powered by Azure Private Link.
Container services in Azure
Three Azure services run containers, and the exam expects you to tell them apart.
| Service | What it does | Choose it when |
|---|---|---|
| Azure Container Instances | Runs a single container quickly, with nothing to manage | You need a simple, short-lived container |
| Azure Kubernetes Service | Manages and scales many containers with Kubernetes | You run a large, complex container system |
| Azure Container Apps | Runs containers on a serverless platform | You want containers with automatic scaling and little management |
Virtual network details
- Peering joins two virtual networks so that they communicate over the Microsoft backbone with private addresses. The networks can be in different regions.
- Subnets divide a virtual network. Resources in different subnets can talk to each other by default.
- Azure DNS hosts your DNS zones and answers name queries. It does not sell domain names, which you buy from a registrar.
Three kinds of VPN connection
VPN Gateway supports more than one pattern.
| Connection | Links |
|---|---|
| Site to site | Your office network to an Azure virtual network |
| Point to site | A single computer to an Azure virtual network |
| Network to network | One Azure virtual network to another |
All three use an encrypted tunnel across the internet. If a question stresses a private line that avoids the internet, the answer is ExpressRoute instead.
Choosing a hosting option
A web application needs a home. Pick the least management that meets the need.
- App Service for a standard web app or API, with no servers to manage.
- Containers when the app is already packaged, or needs a portable runtime.
- Virtual machines only when you need control of the operating system.
How the exam asks about this
- "Which service runs code in response to an event and charges per execution?" Azure Functions.
- "Which option gives the most control of the operating system?" A virtual machine.
- "Which connection does not use the public internet?" ExpressRoute.
- "Which feature connects two virtual networks over the Microsoft backbone?" Virtual network peering.
- "Which type of endpoint gives a service a private IP address in your network?" A private endpoint.
What to remember for the exam
- Virtual machines give control, containers are lightweight and portable, functions are serverless and event driven.
- Scale sets add and remove identical VMs automatically. Availability sets spread VMs inside a datacenter.
- Azure Virtual Desktop delivers desktops and apps from the cloud.
- A virtual network is divided into subnets. Peering connects virtual networks privately.
- VPN Gateway uses the internet with encryption. ExpressRoute uses a private connection.
- A private endpoint puts a service on a private IP in your virtual network.
"Private connection that does not use the public internet" points to ExpressRoute. "Encrypted tunnel over the internet" points to VPN Gateway.
Common mistakes
Calling ExpressRoute encrypted VPN. ExpressRoute is a private line, not a tunnel over the internet.
Choosing a virtual machine for every app. App Service or containers often need much less administration.
Confusing scale sets with availability sets. Scale sets change the number of machines. Availability sets spread machines for resilience.
Thinking peering needs a gateway. Peering uses the Microsoft backbone directly.
Check yourself
Which compute type runs short code in response to an event and bills for execution?
Azure Functions.
Which service creates an encrypted connection to Azure across the public internet?
VPN Gateway.
What does a private endpoint give an Azure service?
A private IP address inside your virtual network.
Topic 2 of 4 in Describe Azure Architecture and Services
Test yourself on Describe Azure Architecture and Services
The full Microsoft AZ-900 question bank has 500 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.