CAMPUX Cloud Bootcamp Recap · Phase Four · After Class Forty-One ← Class Forty-One
Phase Four — Recap
Classes 26–41 · Operate, Secure & AI
Read in fifteen minutes before the capstones
Phase Four Recap

Operate, secure & AI, in review.

The longest phase, and the one that separates a builder from an operator. You learned to package and run workloads, to watch them, to secure them, to control what they cost, to treat AI as infrastructure rather than magic, and to keep running when it breaks. Sixteen classes — here they are, drawn together before the capstones ask you to use all of them at once.

§1

The sixteen, one line each

This phase is broad on purpose: running a system is not one skill but a cluster of them. Read the arc — package and run, then watch, then secure and cost-control, then the AI trio, then the operations that keep it alive. Build IV sits inside this phase, after Class 35, as the milestone where the watching-and-cost half becomes an artifact.

26 · Containers & Docker
The image makes "works on my machine" true everywhere — the same bytes run identically in every environment.
27 · Containers on Azure
Where the image runs: Container Apps for most workloads, AKS when you genuinely need the cluster.
28 · Azure Monitor & Log Analytics
Pool the telemetry every resource emits into one place you can actually query.
29 · KQL Essentials
The query language that turns a pile of logs into an answer — transferable across Sentinel, App Insights, and Resource Graph.
30 · App Insights & Alerting
Instrument the app, then turn a query into an alert that wakes the right person at the right threshold.
31 · Security & DevSecOps
Security as a practice woven through the pipeline, not a gate bolted on at the end.
32 · Cost Management & FinOps
Cost as an engineering control: budgets that warn, right-sizing, and lifecycle rules that trim spend automatically.
33 · AI Foundations: Context, Tools & MCP
What actually goes in the model's window, what needs a tool, and the protocol that governs both.
34 · AI Infrastructure I: Deployment
An Azure OpenAI resource done properly — region, versioned deployments, managed identity, diagnostics from day one.
35 · AI Infrastructure II: Network & Cost
The valve on a runaway model bill: throttling, caching, history caps, and a private path.
36 · Incident Response
The runbook for when it breaks: detect, communicate, mitigate, and write the blameless postmortem.
37 · Azure Databases
The one component you cannot redeploy from code in an afternoon — and the backup and recovery respect that demands.
38 · API Management
Solve auth, throttling, and versioning once, at the front desk, for every consumer of your API.
39 · Azure DevOps Pipelines
The same CI/CD discipline as GitHub Actions, spoken in the older estate's nouns — worth two engineers who speak only one.
40 · Message Queues & Service Bus
Decouple a producer from a consumer with a durable buffer — the simple Storage Queue, or Service Bus when you need ordering, fan-out, or dead-lettering.
41 · Azure Functions
Event-driven, serverless compute: code with a trigger that runs when there is work and bills only then — the consumer at the end of the queue.
§2

The ideas that stay

Sixteen classes, five instincts. Keep these and the operational half of the job stops being a list of tools and becomes a way of thinking.

Reach for the platform, not the cluster
Most workloads want Container Apps and its scale-to-zero, not a standing AKS cluster. Knowing when you don't need Kubernetes is the senior judgement.
Monitoring is a question written in advance
You pool telemetry, express the thing you fear as KQL, and let an alert fire when the answer comes back wrong. Observability is preparation, not dashboards.
Security and cost are controls, not reports
DevSecOps and FinOps put guardrails in the path — a policy that blocks, a budget that warns — rather than a spreadsheet reviewed after the damage.
AI is infrastructure you govern
Context, deployment, network, and cost are the four handles. Treat a model like any other resource — identity, diagnostics, a bill — and it stops being magic.
Respect the state that can't be rebuilt
Everything else redeploys from code; the database does not. That single asymmetry is why backups, recovery drills, and incident runbooks exist.

The database is the one thing you can't redeploy.

§3

What you can now do

This is the operator's half of a cloud role — the capabilities that turn "I can build it" into "I can run it in production."

Phase Four — capabilities gained
You can…Built on
Package a workload as a container and run it on Container Apps with a managed-identity pull and scale-to-zeroClasses 26–27
Pool telemetry in Log Analytics, query it in KQL, and wire a scheduled-query alert to an action groupClasses 28–30
Weave security through delivery and put cost guardrails — budgets, right-sizing, lifecycle — in placeClasses 31–32
Deploy a governed Azure OpenAI workload and put the valve on its network and its billClasses 33–35
Run an incident from detection to blameless postmortem, and protect a database you cannot rebuildClasses 36–37
Front an API with management for auth and throttling, and deliver on Azure DevOps as fluently as GitHubClasses 38–39
Decouple two systems with a durable queue and drain it with an idempotent, serverless Function that scales to zeroClasses 40–41
Case File · Campux Retail

The estate learns to run itself

Phase Four, seen through one client

Campux's deployed system became an operated one: containers with no credentials, a KQL alert that catches a failure before a customer does, a budget that shouted before the invoice, an AI chatbot whose tripled bill was brought back down with a valve, a database treated with the respect only backups prove, and a checkout that stopped waiting on the warehouse — decoupled by a queue and drained by a serverless function that scales to zero. Build IV — Eyes & Guardrails — is where you made the watching-and-cost half real. The capstones are where all sixteen classes are used at once.

§4

In your head

Six questions, none answerable from a single class — each pulls two or three of the sixteen together. Answer each in your head before you open the thread. Fast means it landed; slow means the thread names the class to revisit.

An internal API should cost nothing while idle but answer the first request within a second or two. What platform, and what one setting?
The thread · Classes 27, 32Azure Container Apps with min-replicas 0 — it drains to zero replicas when idle (you pay for none) and pays a brief cold start to wake on the next request. The trade is a little latency for near-zero idle cost, and it is yours to make per app.
A management operation failed at 3am and nobody knew until a customer complained. What loop should have caught it, end to end?
The thread · Classes 28–30The Activity log flowing into Log Analytics, a KQL scheduled-query watching for failures, and an action group that turns a non-empty result into a page. Data in, a question in KQL, an alert out — that is the loop, and it was missing.
An AI chatbot's monthly bill tripled without a traffic surge. Name two different levers you would pull.
The thread · Classes 33, 35Any two of: cap conversation history and answer length, serve repeat questions from a semantic cache, move cheap calls to a smaller model, and throttle per-consumer TPM at the gateway. The bill is context times calls times model — pull on any factor.
Every resource in the estate can be deleted and redeployed from code in an afternoon — except one. Which, and what does that asymmetry change about how you run it?
The thread · Classes 36–37The database — its data is state, not code. That is why it gets backups, point-in-time recovery, tested restore drills, and a place in the incident runbook, while stateless tiers get none of it. Respect follows what you cannot rebuild.
A second team wants to call your API, with their own rate limit and key. What single thing solves auth, throttling, and versioning for all consumers at once?
The thread · Class 38API Management — the front desk in front of the backend. Per-consumer keys and quotas, a versioned surface, and one place to solve the cross-cutting concerns instead of re-solving them inside every backend.
The checkout keeps timing out because the fulfilment service behind it is slow. What cuts the two apart, what runs the work, and what property must that worker have?
The thread · Classes 40–41A queue between them — the checkout writes "order placed" and returns, a Storage Queue or Service Bus buffers it, and an Azure Function drains it at its own pace. Because delivery is at-least-once, the Function must be idempotent — keyed on the order id — so a redelivered message never charges twice. A poison message dead-letters instead of wedging the line.
Notes
  1. A recap adds nothing new — if a line here is the first time an idea feels solid, the class it names is one click up in the index, and re-reading it now is time well spent. ↩
  2. Phase Four spans more ground than one exam: the security half maps toward AZ-500, the AI half toward the AI-focused certifications. Treat the capabilities in §3, not a single exam code, as the measure of the phase. ↩