The seven, one line each
Read the order and the logic shows itself: first the network the workload lives in, then the compute that runs in it, then the storage it writes to, then how traffic reaches it, then how to take the public door away entirely — and finally the truth that the portal is only a face over an API. Each class is the ground the next one stands on.
- 10 · Virtual Networks & Subnets
- The private network is the boundary; subnets segment it so a breach in one tier cannot wander into the others.
- 11 · Compute, Metal to Nothing
- The spectrum from a VM you run entirely to a Function you barely run at all — and matching the workload to the least you must operate.
- 12 · Storage Accounts, Four Doors
- Blobs, files, queues, tables — and choosing the access tier and redundancy by the value of the data, not by habit.
- 13 · Load Balancing & Traffic
- Distributing requests, and the L4-vs-L7 split: a load balancer moves packets, a gateway understands the URL.
- 14 · Private Connectivity
- Private endpoints pull a PaaS service off the public internet — the door closes, and only the VNet can knock.
- 15 · Hybrid & DNS
- Reaching Azure from the office, and the name resolution that quietly decides whether any of it actually connects.
- 16 · REST APIs & ARM
- What the portal is really doing: every click is a REST call to Azure Resource Manager, versioned and scriptable.
The ideas that stay
The service tiers will be renamed and repriced; these instincts hold. Keep these five and the whole of Azure infrastructure reads as variations on them.
- The network is the boundary
- Segmentation is a security decision made in advance. A flat network trusts everything once; subnets make trust deliberate.
- Run the least you can
- Compute is a ladder from VM to serverless. The senior move is reaching for the lowest rung the workload allows, not the most powerful one.
- Price storage to the data
- Tier and redundancy are a cost-versus-durability choice. Hot-and-geo-redundant for everything is how bills quietly balloon.
- Private by identity and network
- A private endpoint removes the public route; RBAC still governs who may use it. Real privacy needs both halves.
- The portal is a face over an API
- Everything is ARM underneath, so everything can be scripted, reviewed, and version-pinned. This is the door into Phase Three.
Segmentation is trust, decided in advance.
What you can now do
Topics are not the deliverable — capabilities are. Every line below is a task a junior cloud engineer is handed, and now one you could take.
| You can… | Built on |
|---|---|
| Design a virtual network with segmented subnets for a multi-tier workload | Class 10 |
| Choose the right compute — VM, scale set, App Service, or Function — and defend the choice | Class 11 |
| Pick a storage account's tier and redundancy from the data's value and access pattern | Class 12 |
| Distribute traffic at L4 or route it at L7, and say which a case needs | Class 13 |
| Put a private endpoint on a PaaS service so it has no public exposure at all | Class 14 |
| Read an Azure action as the ARM REST call it really is, and reason about api-versions | Classes 15–16 |
The estate grows a spine
Campux's governed-but-empty subscription became a place where things actually run: a segmented network, compute sized to each job, storage priced to the data, and a database pulled off the public internet behind a private endpoint. In Build II you assemble the same private application yourself — and because the data path is closed by design rather than by promise, it is the version an interviewer can probe without finding a hole.
In your head
Five questions, none answerable from a single class — each resolves only when two or three of the seven click together. Answer each in your head before you open the thread. Fast means it landed; slow means the thread names the class to revisit.
A web app must reach its database with no exposure to the public internet. Name the two things that together make that true.
A job runs for two seconds, a few hundred times a day, and nothing in between. What compute, and why not a virtual machine?
Data is written once, read maybe twice a year, and must survive an entire region going dark. Tier and redundancy?
Requests must go to different backends depending on the URL path. Load balancer or application gateway — and why?
A deployment script that worked last year now behaves strangely against the same resource. Nothing in your code changed. What did?
- A recap adds nothing new — if a line here is the first time an idea feels solid, the class it names is one click up in the index, and re-reading it now is time well spent. ↩
- Phase Two aligns to the AZ-104 (Azure Administrator) ground. This page is not exam prep, but clearing §3 without notes takes most of the exam's surprise away. ↩