TRAP 1 Scalability vs Elasticity
Scalability = the ability to adjust resources (can be manual). Vertical = resize one resource. Horizontal = add/remove instances. Elasticity = automatic scaling with no manual action. All elastic systems are scalable; not all scalable systems are elastic.
TRAP 2 Availability Zones vs Availability Sets vs Region Pairs
Availability Sets: rack-level failure protection within one data center (update + fault domains). Availability Zones: entire data center outage protection (3 separate buildings, same region). Region Pairs: region-wide disaster protection (two regions 300+ miles apart). Three completely different levels of protection.
TRAP 3 Authentication vs Authorization
Authentication (AuthN) = proving WHO you are (passport check). Authorization (AuthZ) = determining WHAT you can do (boarding pass check). Entra ID handles authentication. RBAC handles authorization. You always authenticate first.
TRAP 4 Azure Policy vs Resource Locks
Azure Policy: controls what resources CAN BE CREATED and how they must be configured. Resource Locks: prevent modification or deletion of EXISTING resources. Policy = configuration governance. Locks = deletion/modification protection. Both are inherited downward.
TRAP 5 Tags are NOT inherited
Unlike policies, RBAC, and resource locks — tags do NOT flow down the hierarchy. A tag on a resource group does NOT appear on resources inside it. Must be applied explicitly at each level, or Azure Policy must enforce auto-tagging.
TRAP 6 Pricing Calculator vs Cost Management vs TCO Calculator
Pricing Calculator: estimate BEFORE deployment (planning). Cost Management: monitor and control AFTER deployment (ongoing). TCO Calculator: compare on-premises vs Azure costs (migration decision). Three different tools for three different stages.
TRAP 7 VPN Gateway vs ExpressRoute
VPN Gateway: encrypted connection over the PUBLIC internet. Variable latency. Lower cost. ExpressRoute: PRIVATE dedicated circuit — never touches the public internet. Predictable low latency. Higher cost. "Never traverse the public internet" = ExpressRoute.
TRAP 8 Azure Status vs Service Health vs Resource Health
Azure Status: global, public, ALL Azure services/regions, no auth required. Service Health: authenticated, only YOUR services/regions, personalized, configurable alerts. Resource Health: health of YOUR specific individual resource instance. These are three scopes within Azure Service Health.
TRAP 9 IaaS vs PaaS vs SaaS responsibility
IaaS: provider manages physical hardware only. PaaS: provider manages hardware AND OS/middleware. SaaS: provider manages everything. Data + user accounts + devices are ALWAYS the customer's regardless of model — this never transfers to the provider.
TRAP 10 Contributor cannot manage resource locks
Contributor can create and manage all Azure resources but does NOT have the Microsoft.Authorization/locks/* permission. A Contributor cannot create or remove resource locks — only Owner and User Access Administrator can. A Contributor cannot delete a locked resource even if they have delete permission on it.
TRAP 11 LRS vs ZRS vs GRS vs GZRS
LRS: 3 copies in 1 data center — survives hardware failure only. ZRS: 3 copies across 3 zones — survives data center outage, not region failure. GRS: LRS primary + secondary region — survives region failure, not zone failure in primary. GZRS: ZRS primary + secondary region — survives BOTH zone and region failure (Microsoft recommended).
| Factor | Private | Public | Hybrid |
|---|---|---|---|
| Owned by | The organization | Third-party provider | Both |
| Cost model | High CapEx | Pay-as-you-go OpEx | Mix |
| Control | Maximum | Limited | Mixed |
| Scalability | Limited (buy hardware) | Near-instant | Flexible |
| Analogy | Own a car | Take the bus | Drive to station, take the train |
| Layer | On-premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Physical infrastructure | You | Provider | Provider | Provider |
| Operating system | You | You | Provider | Provider |
| Applications | You | You | You | Provider |
| Data | You | You | You | You — always |
| User accounts | You | You | You | You — always |
| Devices | You | You | You | You — always |
| Scenario | Best choice | Why |
|---|---|---|
| Lowest cost, basic hardware protection only | LRS | 3 copies in 1 data center, cheapest |
| Survive a data center outage, stay in one region | ZRS | 3 copies across 3 availability zones |
| Survive a complete region failure | GRS | Secondary region copy (LRS in primary) |
| Maximum: survive both zone AND region failure | GZRS | ZRS primary + secondary region — Microsoft recommended |
| Service | Model | Choose when |
|---|---|---|
| Virtual Machines | IaaS | Full OS control, lift-and-shift, custom software |
| VM Scale Sets | IaaS | Auto-scaling identical VMs under load, up to 1,000 |
| App Service | PaaS | Web apps / REST APIs — focus on code, not servers |
| Azure Functions | PaaS (serverless) | Short event-driven tasks, pay per execution |
| ACI | PaaS | Simplest container deployment, no orchestration |
| Container Apps | PaaS (serverless) | Microservices, scale-to-zero containers |
| AKS | PaaS | Production Kubernetes, team has K8s expertise |
| Tool | Purpose | Inherited? | Can Contributor bypass? |
|---|---|---|---|
| Azure Policy | Enforce resource configuration standards | Yes | No — deny is absolute |
| Delete lock | Prevent deletion of existing resources | Yes | No — cannot manage locks |
| Read-only lock | Prevent modification AND deletion | Yes | No — cannot manage locks |
| RBAC roles | Control what actions identities can perform | Yes | Overridden by locks |
| Resource tags | Metadata for cost tracking and organization | No | N/A — not a security control |
| Tool | Use it when | Personalized? | Requires login? |
|---|---|---|---|
| Azure Advisor | Want proactive optimization recommendations | Yes — your resources | Yes |
| Azure Status | Check for widespread global Azure outage | No — all Azure | No (public) |
| Service Health | Check if YOUR services/regions are affected | Yes — your services | Yes |
| Resource Health | Check if a SPECIFIC resource is healthy | Yes — individual resource | Yes |
| Azure Monitor | Collect metrics/logs, set alerts, automate responses | Yes — configurable | Yes |