Chapter 2 Compliance and Cloud Governance

Why is cloud harder than on-prem?

Less control over infrastructure, and you must manage security, access, and compliance

What is compliance?

Following rules about data, laws, and security

Is compliance one-time?

No, it is continuous

What is an Azure region?

A geographic location with data centers

Why choose a region close to users?

Better performance and lower latency

What is data residency?

Controlling where your data is stored

Is the cheapest region always best?

No, performance and compliance matter more

What is a regional pair?

Two regions linked for backup and reliability

Why use region pairs?

Disaster recovery and high availability

What is GRS?

Data is automatically copied to another region

What is an Azure account?

Your identity or login

What is a subscription?

Where resources live and billing happens

Can one account have multiple subscriptions?

Yes

Where are resources stored?

In subscriptions

What is metering?

Tracking usage for billing

Most common subscription type?

Pay-As-You-Go

What does Cost Management do?

Tracks, predicts, and controls spending

What saves the most money long-term?

Reservations

What is Azure Hybrid Benefit?

Use existing licenses to save money

What are Dev/Test subscriptions used for?

Cheaper testing environments, not production

What is a Resource Group?

A container for resources

What happens if you delete a Resource Group?

Everything inside it is deleted

Does Resource Group location control resource location?

No

Can resources be in different regions inside one Resource Group?

Yes

Where do Management Groups sit?

Above subscriptions

Why use Management Groups?

To organize and control multiple subscriptions

What flows down from Management Groups?

Policies and permissions

What is Azure Policy?

Rules that control what can be created

What is an example of Azure Policy?

Only allow certain regions or require tags

What happens if a policy rule is broken?

Azure blocks the action

What is RBAC?

Role-Based Access Control, or who can do what

What are the 3 parts of RBAC?

User, role, and scope

What does the Owner role do?

Full access, including assigning roles

What is the difference between Contributor and Owner?

Contributor cannot assign roles

What do resource locks do?

Protect resources from changes or deletion

What is a CanNotDelete lock?

You can edit the resource but cannot delete it

Do locks override RBAC?

Yes

What are tags?

Labels used for organizing resources

Why use tags?

Organization and cost tracking

What is the format of a tag?

Key and value

What is the difference between Azure Policy and RBAC?

Policy controls what can be created, while RBAC controls who can do actions