2.2 — Describe Azure compute and networking services

Azure Compute Services

Azure offers several compute models. Choosing the right one depends on how much control you need over the underlying infrastructure.

Virtual Machines (VMs)IaaS compute that gives full control over the OS, software, and configuration. The customer is responsible for OS updates, patches, and security. Best for lift-and-shift migrations and workloads needing custom OS-level configuration. are the most flexible compute option — you control the OS, software, and configuration, at the cost of managing patching and security yourself. For elastic workloads, VM Scale SetsAzure service that automatically creates and manages a group of identical, load-balanced VMs. They scale out (add VMs) or scale in (remove VMs) based on demand or a schedule. VMs can be distributed across availability zones for built-in high availability. automatically create and remove identical VMs based on demand or a schedule.

Availability Sets are an older HA mechanism for VMs within a single datacenter. They use:

• Fault domains — groups of VMs sharing a common power source and network switch (up to 3).
• Update domains — groups of VMs that can be rebooted together during maintenance (Azure ensures not all update domains reboot simultaneously).

Azure Virtual Desktop (AVD)A cloud-hosted desktop and app virtualization service. Key benefits: multi-session Windows 10/11, use your own licenses (Windows Enterprise), and desktops are accessible from anywhere. enables remote work scenarios where desktops and apps are streamed from Azure rather than run locally.

Containers vs. VMs

Containers package an app and its dependencies but share the host OS kernel — they do not virtualize hardware. They start in seconds and are much smaller than VMs. For simple isolated tasks, Azure Container Instances (ACI)The simplest way to run a container in Azure without managing VMs or orchestrators. Best for simple, isolated tasks and dev/test scenarios. is the fastest path. For complex microservices at scale, Azure Kubernetes Service (AKS)Managed Kubernetes for orchestrating many containers at scale with automatic bin-packing, self-healing, and rolling updates. provides managed orchestration with self-healing and rolling updates. For event-driven workloads with no infrastructure to manage, Azure FunctionsA serverless compute model that runs event-triggered code without provisioning or managing servers. Billed only for execution time. Triggers include HTTP requests, timers, queue messages, and blob storage events. Functions are stateless by default; Durable Functions add stateful workflows. runs code in response to triggers and bills only for actual execution time.

Azure Networking Services

An Azure Virtual Network (VNet)The fundamental building block for private networking in Azure. A VNet enables Azure resources to communicate securely with each other, the internet, and on-premises networks. VNets are scoped to a single region and can be divided into subnets. is the foundational private network construct in Azure — scoped to a single region and divided into subnets. To connect two VNets so their resources communicate as if on the same network, you use VNet PeeringConnects two VNets so their resources can communicate as if on the same network. Can be within a region (VNet peering) or across regions (global VNet peering). Peering is non-transitive — A-B and B-C peering does NOT give A access to C., which is non-transitive by default. For DNS hosting, Azure DNSA hosting service for DNS domains using Azure infrastructure. Supports public DNS zones (internet-facing) and private DNS zones (within VNets). Azure DNS is NOT a domain registrar — you register domains elsewhere then delegate to Azure DNS. supports both public and private DNS zones but is not a domain registrar.

Subnets are IP address subdivisions within a VNet. Azure reserves 5 IP addresses per subnet (first 4 and last 1). Network Security Groups (NSGs) are typically applied at the subnet level to filter traffic.

Connecting to On-Premises Networks

For encrypted connectivity over the public internet, Azure VPN GatewaySends encrypted traffic between a VNet and an on-premises network over the public internet using IPsec/IKE tunnels. Types: Site-to-Site (S2S for offices), Point-to-Site (P2S for remote workers), and VNet-to-VNet (connecting Azure VNets). supports Site-to-Site, Point-to-Site, and VNet-to-VNet connections. For a private, dedicated circuit that never touches the public internet, Azure ExpressRouteProvides a private, dedicated connection from on-premises to Azure through a connectivity provider — traffic does NOT travel over the public internet. Offers higher reliability, faster speeds, consistent latency, and higher security than VPN Gateway. delivers higher reliability, faster speeds, and consistent latency through a connectivity provider.

Public and Private Endpoints

For maximum security, use Private endpointsUse a private IP address from your VNet to connect to a specific Azure service instance. Traffic stays within the Microsoft network — never traversing the public internet. Powered by Azure Private Link. The service's public endpoint can be disabled entirely. to connect to PaaS services via a private IP from your VNet — the service's public endpoint can be disabled entirely. Service endpoints extend your VNet identity to Azure services over the Microsoft backbone, but the service still has a public endpoint (access is restricted to your VNet). Private endpoints are more secure because they remove the service from public internet exposure entirely.