Prices shown are a USD base. Your local-market price is calculated at checkout in your own currency, plus any local sales tax.
What is inside
20 chapters, in the order the interviews tend to ask them:
The shared responsibility model and the Well-Architected pillars
Microsoft Entra ID, tenant identity and Azure role-based access control
Subscriptions, management groups and resource groups
Virtual networks, subnets and virtual network peering
Network security groups, Azure Firewall and private endpoints
Availability zones and paired regions
Front Door, Application Gateway and Traffic Manager compared
App Service, Functions and Container Apps compared
AKS architecture, node pools and scaling
Choosing between Azure SQL Database, Managed Instance and Cosmos DB
Storage accounts, redundancy and access tiers
Service Bus, Event Grid and Event Hubs compared
Key Vault, customer-managed keys and rotation
Managed identities and service principals
Cosmos DB partitioning, consistency and throughput
Azure Monitor, Log Analytics and Application Insights
Cost management, budgets and the reservations decision
Infrastructure as Code with Bicep, ARM and Terraform
Landing zone design and Azure Policy guardrails
Migration patterns: lift and shift, re-platform and re-architect
How the answers are built
Each chapter opens with the checklist the question is really testing. A few from this pack:
Microsoft secures the physical infrastructure, the host operating system and the hypervisor, and that half is identical for every Azure service.
Entra ID is the tenant wide directory that holds users, groups, service principals and app registrations, and it authenticates; it does not authorise Azure resource access.
A management group is the tenant wide scope above subscriptions, and it exists so policy, governance and reporting apply without enumerating every subscription.
A virtual network's address space and location are fixed at creation, which makes the first address plan the one decision you cannot take back.
A network security group filters inside the virtual network with stateful rules, so return traffic is allowed without a matching rule.
An availability zone is a physically separate group of datacentres with independent power, cooling and networking inside a single region.
Questions this pack covers
Where does the responsibility line sit for an Azure virtual machine?
How does the responsibility line move when you adopt a platform service?
What is the difference between Microsoft Entra ID and Azure role-based access control?
Why does Azure RBAC behave additively across separate role assignments?
What does a management group add that a subscription cannot do on its own?
Why is a subscription both a quota boundary and a billing boundary?
Why is the address space of a virtual network effectively permanent?
How do you size subnets for a design that spans availability zones?
Each one is answered in full in the pack, with the reasoning written out rather than a bullet list.
