Ilianko - User contributions [en]

Category:IaC

2026-10-27T12:01:13Z

Anko: Created page with "Category:Azure Category:AWS Category:Terraform"

[[Category:Azure]]
[[Category:AWS]]
[[Category:Terraform]]

Category:Devops Tools

2026-10-27T12:00:16Z

Anko:

==[[Github CLI (gh)]]==
gh --version
gh auth login
gh auth status
gh repo clone OWNER/REPO
gh repo create
gh repo list
gh repo view --web

[[Category:PKI]]
[[Category:IaC]]

Temporary Let's Encrypt certificate

2026-10-27T11:57:50Z

Anko:

Procedure to issue a temporary certificate signed by Let's Encrypt for <code>tst.lets.ef3.in</code> on Kubernetes with Istio.

'''Prerequisites:''' Istio with configured gateway (domain) and virtualservice (virtualhost).

== Create temporary instance for certbot ==
Save as <code>temp-letsencrypt-server.yaml</code>:
<pre>
apiVersion: v1
kind: Pod
metadata:
name: certbot-temp
namespace: ls-lets-website-tst
labels:
app: certbot-temp
spec:
containers:
- name: nginx
image: nginx
ports:
- containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: certbot-temp-svc
namespace: ls-lets-website-tst
spec:
selector:
app: certbot-temp
ports:
- port: 80
targetPort: 80
</pre>
Apply it:
<pre>
kubectl -n ls-lets-website-tst apply -f temp-letsencrypt-server.yaml
</pre>

== Route the acme-challenge to the certbot instance ==
The virtualservice is an Istio entity. Add this match to the routes:
<pre>
kubectl -n ls-lets-website-tst edit virtualservice ls-lets-vs

- match:
- uri:
prefix: /.well-known/acme-challenge/
route:
- destination:
host: certbot-temp-svc
port:
number: 80
</pre>

== Create certificate ==
<pre>
kubectl exec -it certbot-temp -n ls-lets-website-tst -- bash

# Inside the certbot pod: install certbot
apt-get update && apt-get install -y certbot

# Inside the pod: request the certificate
certbot certonly --webroot -w /usr/share/nginx/html -d tst.lets.ef3.in

exit
</pre>

== Copy the new certificate and the key ==
<pre>
kubectl exec -n "ls-lets-website-tst" "certbot-temp" -- cat /etc/letsencrypt/live/tst.lets.ef3.in/fullchain.pem > tst.lets.fullchain.pem

kubectl exec -n "ls-lets-website-tst" "certbot-temp" -- cat /etc/letsencrypt/live/tst.lets.ef3.in/privkey.pem > tst.lets.key.pem
</pre>
Check the certificate:
<pre>
openssl x509 --noout -in tst.lets.fullchain.pem --text

Certificate:
Data:
Version: 3 (0x2)
Signature Algorithm: ecdsa-with-SHA384
Issuer: C = US, O = Let's Encrypt, CN = YE1
Validity
Not Before: Oct 13 13:01:42 2026 GMT
Not After : Jan 11 13:01:41 2027 GMT
Subject: CN = tst.lets.ef3.in
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
ASN1 OID: prime256v1
...
</pre>

== Create Istio secret ==
<pre>
kubectl create secret tls tst.lets -n istio-ingress --key=tst.lets.key.pem --cert=tst.lets.fullchain.pem
</pre>

== Enable HTTPS at the gateway ==
<pre>
kubectl -n ls-lets-website-tst edit gateway ls-lets-gateway

- hosts:
- tst.lets.ef3.in
port:
name: https
number: 443
protocol: HTTPS
tls:
credentialName: tst.lets
mode: SIMPLE
</pre>

== Clean the environment ==
* Remove the locally saved *.pem files
* Remove the routing to the certbot pod
* Delete the certbot pod
<pre>
rm *pem
kubectl -n ls-lets-website-tst edit virtualservice ls-lets-vs
kubectl -n ls-lets-website-tst delete -f temp-letsencrypt-server.yaml
</pre>

[[Category:Security]]
[[Category:Kubernetes]]
[[Category:PKI]]

MediaWiki:Sidebar

2026-10-27T11:54:02Z

Anko:

* navigation
** mainpage|mainpage-description
** CV|CV
** Category:Devops Tools|Devops tools
** randompage-url|randompage

MediaWiki:Sidebar

2026-10-27T11:52:57Z

Anko:

* navigation
** mainpage|mainpage-description
** CV|CV
** Category:Devops tools|Devops Tools
** randompage-url|randompage

Category:Devops Tools

2026-10-27T11:51:55Z

Anko: Created page with " ==Github CLI (gh)== gh --version gh auth login gh auth status gh repo clone OWNER/REPO gh repo create gh repo list gh repo view --web"

==[[Github CLI (gh)]]==
gh --version
gh auth login
gh auth status
gh repo clone OWNER/REPO
gh repo create
gh repo list
gh repo view --web

Github CLI (gh)

2026-10-27T11:51:30Z

Anko:

'''GitHub CLI''' (''gh'') is GitHub's official command-line tool that brings pull requests, issues, GitHub Actions workflows, releases, gists, and other GitHub features directly to the terminal.

== Overview ==
''gh'' allows developers to interact with GitHub.com and GitHub Enterprise Server without leaving the command line. It automatically detects the current Git repository context, handles authentication and SSH/HTTPS Git credential configuration, and provides both interactive prompts and scriptable flags (including JSON output with ''--json'' and ''--jq'').

== Installation ==
* '''Windows (winget / choco / scoop):'''
winget install --id GitHub.cli
choco install gh
* '''macOS (Homebrew):'''
brew install gh
* '''Linux (Debian / Ubuntu):'''
sudo apt update
sudo apt install gh

=== Update ===
[[winget]] upgrade --id GitHub.cli

== Common Commands ==
<pre>
# Check installation
gh --version

# Authenticate
gh auth login

# Check authentication
gh auth status

# Clone a repository
gh repo clone OWNER/REPO

# Create a repository
gh repo create

# List repositories
gh repo list

# Open current repo in browser
gh repo view --web
</pre>

=== Authentication ===
gh auth login # Interactive login to GitHub.com or GitHub Enterprise
gh auth status # View active authentication state
gh auth setup-git # Configure git to use gh as a credential helper
gh auth token # Print the current authentication token

=== Repositories (gh repo) ===
gh repo clone OWNER/REPO # Clone a repository
gh repo create # Create a new repository on GitHub
gh repo fork # Fork an existing repository
gh repo view --web # Open the repository in the browser

=== Pull Requests (gh pr) ===
gh pr list # List open pull requests
gh pr create --fill # Create a pull request using commit info
gh pr checkout NUMBER # Check out a pull request branch locally
gh pr status # Show status of relevant pull requests
gh pr checks # View CI/CD check statuses for a PR
gh pr review --approve # Approve the current pull request
gh pr merge --squash --delete-branch # Squash-merge and delete branch

=== Issues (gh issue) ===
gh issue list # List issues in the repository
gh issue create # Create a new issue interactively
gh issue view NUMBER # View issue details and comments
gh issue develop NUMBER --checkout # Create and check out a branch linked to an issue
gh issue close NUMBER # Close an issue

=== GitHub Actions (gh run and gh workflow) ===
gh workflow list # List workflows in the repository
gh workflow run WORKFLOW_NAME # Trigger a workflow_dispatch event
gh run list # List recent workflow runs
gh run watch # Watch an in-progress workflow run live
gh run view --log-failed # View logs for failed steps in a run

=== Releases, Gists and Codespaces ===
gh release list # List repository releases
gh release create v1.0.0 --generate-notes # Create a release with auto-generated notes
gh gist create FILE # Create a new GitHub Gist
gh codespace list # List active GitHub Codespaces

=== update ===

== Scripting, REST/GraphQL API and Extensions ==
* '''Structured JSON and jq filtering:'''
gh pr list --json number,title,author
* '''Direct GitHub API requests (gh api):'''
gh api repos/{owner}/{repo}/releases/latest
gh api graphql -f query='{ viewer { login } }'
* '''Aliases and Extensions:'''
gh alias set co 'pr checkout'
gh extension search
gh extension install dlvhdr/gh-dash

== External Links ==
* [https://cli.github.com/ Official GitHub CLI Website]
* [https://cli.github.com/manual/ GitHub CLI Manual and Command Reference]
* [https://github.com/cli/cli GitHub CLI Source Repository (cli/cli)]

[[Category:Devops Tools]]
[[Category:CLI]]
[[Category:Git]]

MediaWiki:Sidebar

2026-10-27T11:50:42Z

Anko:

* navigation
** mainpage|mainpage-description
** CV|CV
** Category:Devops tools|Devops tools
** randompage-url|randompage

MediaWiki:Common.css

2026-10-27T10:07:31Z

Anko:

/* CSS placed here will be applied to all skins */
#column-content { margin-left: -16em }
#column-content #content { margin-left: 16em }

/* Scale up all Math extension formulas */
.mwe-math-element {
font-size: 140% !important; /* Increases the 'ex' unit size the SVGs use */
}

.mwe-math-element img {
transform: scale(1.4);
transform-origin: center left;
margin-right: 10px; /* Prevents the scaled image from hitting the next word */
}

/* Hide "Wiki tools" menu */
#p-tb { display: none !important; }

/* Hide "Page tools" menu */
#vector-page-tools { display: none !important; }

/* Hide "More" menu */
#p-cactions { display: none !important; }

/* Force the bottom category box to show */
#catlinks {
display: block !important;
}

/* Force the sidebar category box to show */
#catlinks-sidebar {
display: block !important;
}

Category:PKI

2026-10-27T10:03:43Z

Anko: Created page with "."

Category:Security

2026-10-27T10:03:29Z

Anko: Created page with "."

MediaWiki:Common.css

2026-10-27T10:00:04Z

Anko:

Temporary Let's Encrypt certificate

2026-10-27T09:53:09Z

Anko: Category Certificate -> PKI

Procedure to issue a temporary certificate signed by Let's Encrypt for <code>tst.lets.ef3.in</code> on Kubernetes with Istio.

== Create temporary instance for certbot ==
Save as <code>temp-letsencrypt-server.yaml</code>:
<pre>
apiVersion: v1
kind: Pod
metadata:
name: certbot-temp
namespace: ls-lets-website-tst
labels:
app: certbot-temp
spec:
containers:
- name: nginx
image: nginx
ports:
- containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: certbot-temp-svc
namespace: ls-lets-website-tst
spec:
selector:
app: certbot-temp
ports:
- port: 80
targetPort: 80
</pre>
Apply it:
<pre>
kubectl -n ls-lets-website-tst apply -f temp-letsencrypt-server.yaml
</pre>

== Route the acme-challenge to the certbot instance ==
The virtualservice is an Istio entity. Add this match to the routes:
<pre>
kubectl -n ls-lets-website-tst edit virtualservice ls-lets-vs

- match:
- uri:
prefix: /.well-known/acme-challenge/
route:
- destination:
host: certbot-temp-svc
port:
number: 80
</pre>

== Create certificate ==
<pre>
kubectl exec -it certbot-temp -n ls-lets-website-tst -- bash

# Inside the certbot pod: install certbot
apt-get update && apt-get install -y certbot

# Inside the pod: request the certificate
certbot certonly --webroot -w /usr/share/nginx/html -d tst.lets.ef3.in

exit
</pre>

== Copy the new certificate and the key ==
<pre>
kubectl exec -n "ls-lets-website-tst" "certbot-temp" -- cat /etc/letsencrypt/live/tst.lets.ef3.in/fullchain.pem > tst.lets.fullchain.pem

kubectl exec -n "ls-lets-website-tst" "certbot-temp" -- cat /etc/letsencrypt/live/tst.lets.ef3.in/privkey.pem > tst.lets.key.pem
</pre>
Check the certificate:
<pre>
openssl x509 --noout -in tst.lets.fullchain.pem --text

Certificate:
Data:
Version: 3 (0x2)
Signature Algorithm: ecdsa-with-SHA384
Issuer: C = US, O = Let's Encrypt, CN = YE1
Validity
Not Before: Oct 13 13:01:42 2026 GMT
Not After : Jan 11 13:01:41 2027 GMT
Subject: CN = tst.lets.ef3.in
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
ASN1 OID: prime256v1
...
</pre>

== Create Istio secret ==
<pre>
kubectl create secret tls tst.lets -n istio-ingress --key=tst.lets.key.pem --cert=tst.lets.fullchain.pem
</pre>

== Enable HTTPS at the gateway ==
<pre>
kubectl -n ls-lets-website-tst edit gateway ls-lets-gateway

- hosts:
- tst.lets.ef3.in
port:
name: https
number: 443
protocol: HTTPS
tls:
credentialName: tst.lets
mode: SIMPLE
</pre>

== Clean the environment ==
* Remove the locally saved *.pem files
* Remove the routing to the certbot pod
* Delete the certbot pod
<pre>
rm *pem
kubectl -n ls-lets-website-tst edit virtualservice ls-lets-vs
kubectl -n ls-lets-website-tst delete -f temp-letsencrypt-server.yaml
</pre>

[[Category:Security]]
[[Category:Kubernetes]]
[[Category:PKI]]

Create CA with openssl

2026-10-27T09:53:08Z

Anko: Category Certificate -> PKI

== Creating a certification authority ==

Certificate Authority - an organization that issues digital certificates

===Creating the directory structure===
mkdir CA
cd CA
mkdir certs crl newcerts private
chmod 700 private
touch index.txt
echo 1000 > serial

index.txt, serial - list of the certificates

===Configuration===
cp /etc/ssl/openssl.cnf ./
nano openssl.cnf

In openssl.conf, the path to the CA directory must be set in [ CA_default ]
Example: dir=/home/mrezhi/CA
[ CA_default ]
dir=/home/mrezhi/CA

[ usr_cert ]
# These extensions are added when 'ca' signs a request.
basicConstraints=CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
nsComment = "OpenSSL Generated Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

[ v3_ca ]
# Extensions for a typical CA
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = CA:true
keyUsage = cRLSign, keyCertSign

...
[ policy_match ]
countryName = match
stateOrProvinceName = supplied
organizationName = supplied
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

===Generating the private key===
openssl genrsa -aes256 -out private/ca.key.pem 4096

aes256 - encrypts the private key

===Generating the CA certificate===

openssl req -config openssl.cnf \
-new -x509 -days 3650 \
-key private/ca.key.pem \
-sha256 -extensions v3_ca \
-out certs/ca.cert.pem

The file is read-only
chmod 444 certs/ca.cert.pem

==Generating and signing certificates==

===Private key===
openssl genrsa -out private/student.tugab.bg.key.pem 4096
chmod 400 student.tugab.bg.key.pem

===Certificate signing request===
openssl req -config openssl.cnf \
-sha256 -new -key private/student.tugab.bg.key.pem \
-out certs/student.tugab.bg.csr.pem

or
openssl req -newkey rsa:2048 -keyout private/domain1.tugab.key -out certs/domain1.tugab.csr -config ./openssl.cnf

===Signing the certificate signing request===

openssl ca -config openssl.cnf \
-keyfile private/ca.key.pem \
-cert certs/ca.cert.pem \
-extensions usr_cert -notext -md sha256 \
-in certs/student.tugab.bg.csr.pem \
-out certs/student.tugab.bg.cert.pem

==Configuring a web server==

*Import a Linux/Debian virtual machine
*Copy the key pair to the hosting machine (FileZilla can be used)
*Install apache2
apt-get install apache2
*Enable the ssl module
a2enmod ssl
*Enable https
** nano /etc/apache2/ports.conf
** cp /etc/apache2/sites-available/default-ssl /etc/apache2/sites-enabled
** nano /etc/apache2/sites-enabled/default-ssl , set the paths to the certificates

===Browser===

Add the generated root certificate to the built-in certificates.

==Generate Server Certificate Commands==

*Access the server
ssh hq@ca-in-hq.ef3.local

*Root user and the configuration folder
su
cd /root/ca

*Define the FQDN
FQDN=xxx.ef3.local

*Generate the key. The key has no password. Length 4096 bits.
openssl genrsa -out private/$FQDN.key.pem 4096
chmod 400 private/$FQDN.key.pem

*Generate the request. Leave the default values, except for the FQDN, which is the name the certificate will be issued for. Location is optional...
openssl req -config openssl.cnf -sha256 -new -key private/$FQDN.key.pem -out csr/$FQDN.csr.pem
chmod 444 csr/$FQDN.csr.pem

*Generate the certificate. Valid for 3000 days.
openssl ca -config openssl.cnf -extensions server_cert -days 3000 -notext -md sha256 -in csr/$FQDN.csr.pem -out certs/$FQDN.cert.pem

*Save the certificate and key in a format convenient for import into Windows
openssl pkcs12 -export -out $FQDN.pfx \
-inkey private/$FQDN.key.pem \
-in certs/$FQDN.cert.pem

*Copy them so they can be downloaded through an sftp client
cp /root/ca/certs/$FQDN.cert.pem /home/?? hq or sf
cp /root/ca/private/$FQDN.key.pem /home/??
mv $FQDN.pfx /home/??

== Commands ==

*Open a certificate
openssl x509 -noout -text -in certs/ca.cert.pem

*Verify a certificate
openssl verify -CAfile certs/ca.cert.pem intermediate/certs/intermediate.cert.pem

*Create a private key
openssl genrsa -out intermediate/private/t19201.ef3.test.key.pem 4096

*Generate a pfx (certificate + password-protected key)
openssl pkcs12 -export -out t19201.pfx \
-inkey intermediate/private/t19201.ef3.test.key.pem \
-in intermediate/certs/t19201.ef3.test.cert.pem

== Revocation List ==

*Generate
openssl ca -config openssl.cnf -gencrl -out crl/ca-in-sf.ef3.local.crl.pem

*Verify
openssl crl -in ca-in-sf.ef3.local.crl.pem -noout -text

Published at http://crl.ef3.local/ca-in-sf.ef3.local.crl.pem

Published at http://crl.ef3.local/ca-in-hq.ef3.local.crl.pem

https://jamielinux.com/articles/2013/08/act-as-your-own-certificate-authority/

https://jamielinux.com/articles/2013/08/generate-certificate-revocation-list-revoke-certificates/

https://jamielinux.com/articles/2013/08/create-an-intermediate-certificate-authority/

openssl genrsa -out privkey.pem 2048

[[Category:Network Security]]
[[Category:PKI]]

Temporary Let's Encrypt certificate

2026-10-27T09:51:19Z

Anko: Add category Certificate

Create CA with openssl

2026-10-27T09:51:19Z

Anko: Add category Certificate

Certificates

2026-10-27T09:51:18Z

Anko: Anko moved page Certificates to Certificate old: Archive old page

#REDIRECT [[Certificate old]]

Certificate old

2026-10-27T09:51:18Z

Anko: Anko moved page Certificates to Certificate old: Archive old page

== openssl ==

Генериране на ключ:

== Създаване на сертифицираща организация ==

Certificate Authority - организация, която издава цифрови сертификати

===Създаване на директорийна структура===
mkdir CA
cd CA
mkdir certs crl newcerts private
chmod 700 private
touch index.txt
echo 1000 > serial

index.txt, serial - списък на сертификатите

===Настройки===
cp /etc/ssl/openssl.cnf ./
nano openssl.cnf

В openssl.conf за [ CA_default ] трябва да се настрои пътят към директорията CA
Примерно dir=/home/mrezhi/CA
[ CA_default ]
dir=/home/mrezhi/CA

[ usr_cert ]
# These extensions are added when 'ca' signs a request.
basicConstraints=CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
nsComment = "OpenSSL Generated Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

[ v3_ca ]
# Extensions for a typical CA
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = CA:true
keyUsage = cRLSign, keyCertSign

...
[ policy_match ]
countryName = match
stateOrProvinceName = supplied
organizationName = supplied
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

===Генериране на частен ключ===
openssl genrsa -aes256 -out private/ca.key.pem 4096

aes256 - криптира частния ключ

===Генериране на сертификат за CA===

openssl req -config openssl.cnf \
-new -x509 -days 3650 \
-key private/ca.key.pem \
-sha256 -extensions v3_ca \
-out certs/ca.cert.pem

Файлът е само за четене
chmod 444 certs/ca.cert.pem

==Генериране и подписване на сертификати==

===частен ключ===
openssl genrsa -out private/student.tugab.bg.key.pem 4096
chmod 400 student.tugab.bg.key.pem

===Искане за подпис===
openssl req -config openssl.cnf \
-sha256 -new -key private/student.tugab.bg.key.pem \
-out certs/student.tugab.bg.csr.pem

ili
openssl req -newkey rsa:2048 -keyout private/domain1.tugab.key -out certs/domain1.tugab.csr -config ./openssl.cnf

===Подписване на искането за подпис===

openssl ca -config openssl.cnf \
-keyfile private/ca.key.pem \
-cert certs/ca.cert.pem \
-extensions usr_cert -notext -md sha256 \
-in certs/student.tugab.bg.csr.pem \
-out certs/student.tugab.bg.cert.pem

==Конфигуриране на web server==

*Импортиране виртуална машина с Линукс\Дебиан
*копиране на двойката ключове на хостинг машината (може да се използва fileZilla
*инсталиране на apache2
apt-get install apache2
*активиране на ssl модула
a2enmod ssl
*актвиране на https
** nano /etc/apache2/ports.conf
** cp /etc/apache2/sites-available/default-ssl /etc/apache2/sites-enabled
** nano /etc/apache2/sites-enabled/default-ssl , да се настроят пътищата към сертификатите

===Браузър===

Да се добави генерираният root сертификат към вградените сертификати.

==Generate Server Certificate Commands==

*Достъп до сървъра
ssh hq@ca-in-hq.ef3.local

*роот потребител и папка със конфигурацията
su
cd /root/ca

*Дефиниране FQDN
FQDN=xxx.ef3.local

*Генериране на ключ. Ключа е без парола. Дължина 4096 бит-а.
openssl genrsa -out private/$FQDN.key.pem 4096
chmod 400 private/$FQDN.key.pem

*Генериране на рекуест. Оставят се стойностите по подразбиране, С изключение на FQDN, което е името за което ще бъде издаден сертификата. Location е опционално...
openssl req -config openssl.cnf -sha256 -new -key private/$FQDN.key.pem -out csr/$FQDN.csr.pem
chmod 444 csr/$FQDN.csr.pem

*Генериране на сертификат. Валидност 3000 дена.
openssl ca -config openssl.cnf -extensions server_cert -days 3000 -notext -md sha256 -in csr/$FQDN.csr.pem -out certs/$FQDN.cert.pem

*Записване на сертификата и ключа във формат удобен за импорт в Windows
openssl pkcs12 -export -out $FQDN.pfx \
-inkey private/$FQDN.key.pem \
-in certs/$FQDN.cert.pem

*копиране за да могат да бъдат изтеглени през sftp клиент
cp /root/ca/certs/$FQDN.cert.pem /home/?? hq ili sf
cp /root/ca/private/$FQDN.key.pem /home/??
mv $FQDN.pfx /home/??

== Commands ==

*Отваряне на сертификат
openssl x509 -noout -text -in certs/ca.cert.pem

*Проверка на сертификат
openssl verify -CAfile certs/ca.cert.pem intermediate/certs/intermediate.cert.pem

*Създаване на частен ключ
openssl genrsa -out intermediate/private/t19201.ef3.test.key.pem 4096

*Генериране на pfx (сертификат + ключ с парола)
openssl pkcs12 -export -out t19201.pfx \
-inkey intermediate/private/t19201.ef3.test.key.pem \
-in intermediate/certs/t19201.ef3.test.cert.pem

== Revocation List ==

*Генериране
openssl ca -config openssl.cnf -gencrl -out crl/ca-in-sf.ef3.local.crl.pem

*Проверка
openssl crl -in ca-in-sf.ef3.local.crl.pem -noout -text

Публикува се на http://crl.ef3.local/ca-in-sf.ef3.local.crl.pem

Публикува се на http://crl.ef3.local/ca-in-hq.ef3.local.crl.pem

https://jamielinux.com/articles/2013/08/act-as-your-own-certificate-authority/

https://jamielinux.com/articles/2013/08/generate-certificate-revocation-list-revoke-certificates/

https://jamielinux.com/articles/2013/08/create-an-intermediate-certificate-authority/

https://jamielinux.com/articles/2013/08/act-as-your-own-certificate-authority/

https://jamielinux.com/articles/2013/08/generate-certificate-revocation-list-revoke-certificates/

https://jamielinux.com/articles/2013/08/create-an-intermediate-certificate-authority/

openssl genrsa -out privkey.pem 2048

<

[[Category:Мрежова сигурност]]

Create CA with openssl

2026-10-27T09:46:49Z

Anko: Synced from t230

Certificate old

2026-10-27T09:41:18Z

Anko:

Certificate old

2026-10-27T09:40:03Z

Anko: /* Revocation List */

== openssl ==

Генериране на ключ:

== Създаване на сертифицираща организация ==

Certificate Authority - организация, която издава цифрови сертификати

===Създаване на директорийна структура===
mkdir CA
cd CA
mkdir certs crl newcerts private
chmod 700 private
touch index.txt
echo 1000 > serial

index.txt, serial - списък на сертификатите

===Настройки===
cp /etc/ssl/openssl.cnf ./
nano openssl.cnf

В openssl.conf за [ CA_default ] трябва да се настрои пътят към директорията CA
Примерно dir=/home/mrezhi/CA
[ CA_default ]
dir=/home/mrezhi/CA

[ usr_cert ]
# These extensions are added when 'ca' signs a request.
basicConstraints=CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
nsComment = "OpenSSL Generated Certificate"
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid,issuer

[ v3_ca ]
# Extensions for a typical CA
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid:always,issuer
basicConstraints = CA:true
keyUsage = cRLSign, keyCertSign

...
[ policy_match ]
countryName = match
stateOrProvinceName = supplied
organizationName = supplied
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

===Генериране на частен ключ===
openssl genrsa -aes256 -out private/ca.key.pem 4096

aes256 - криптира частния ключ

===Генериране на сертификат за CA===

openssl req -config openssl.cnf \
-new -x509 -days 3650 \
-key private/ca.key.pem \
-sha256 -extensions v3_ca \
-out certs/ca.cert.pem

Файлът е само за четене
chmod 444 certs/ca.cert.pem

==Генериране и подписване на сертификати==

===частен ключ===
openssl genrsa -out private/student.tugab.bg.key.pem 4096
chmod 400 student.tugab.bg.key.pem

===Искане за подпис===
openssl req -config openssl.cnf \
-sha256 -new -key private/student.tugab.bg.key.pem \
-out certs/student.tugab.bg.csr.pem

ili
openssl req -newkey rsa:2048 -keyout private/domain1.tugab.key -out certs/domain1.tugab.csr -config ./openssl.cnf

===Подписване на искането за подпис===

openssl ca -config openssl.cnf \
-keyfile private/ca.key.pem \
-cert certs/ca.cert.pem \
-extensions usr_cert -notext -md sha256 \
-in certs/student.tugab.bg.csr.pem \
-out certs/student.tugab.bg.cert.pem

==Конфигуриране на web server==

*Импортиране виртуална машина с Линукс\Дебиан
*копиране на двойката ключове на хостинг машината (може да се използва fileZilla
*инсталиране на apache2
apt-get install apache2
*активиране на ssl модула
a2enmod ssl
*актвиране на https
** nano /etc/apache2/ports.conf
** cp /etc/apache2/sites-available/default-ssl /etc/apache2/sites-enabled
** nano /etc/apache2/sites-enabled/default-ssl , да се настроят пътищата към сертификатите

===Браузър===

Да се добави генерираният root сертификат към вградените сертификати.

==Generate Server Certificate Commands==

*Достъп до сървъра
ssh hq@ca-in-hq.stemo.local

*роот потребител и папка със конфигурацията
su
cd /root/ca

*Дефиниране FQDN
FQDN=xxx.stemo.local

*Генериране на ключ. Ключа е без парола. Дължина 4096 бит-а.
openssl genrsa -out private/$FQDN.key.pem 4096
chmod 400 private/$FQDN.key.pem

*Генериране на рекуест. Оставят се стойностите по подразбиране, С изключение на FQDN, което е името за което ще бъде издаден сертификата. Location е опционално...
openssl req -config openssl.cnf -sha256 -new -key private/$FQDN.key.pem -out csr/$FQDN.csr.pem
chmod 444 csr/$FQDN.csr.pem

*Генериране на сертификат. Валидност 3000 дена.
openssl ca -config openssl.cnf -extensions server_cert -days 3000 -notext -md sha256 -in csr/$FQDN.csr.pem -out certs/$FQDN.cert.pem

*Записване на сертификата и ключа във формат удобен за импорт в Windows
openssl pkcs12 -export -out $FQDN.pfx \
-inkey private/$FQDN.key.pem \
-in certs/$FQDN.cert.pem

*копиране за да могат да бъдат изтеглени през sftp клиент
cp /root/ca/certs/$FQDN.cert.pem /home/?? hq ili sf
cp /root/ca/private/$FQDN.key.pem /home/??
mv $FQDN.pfx /home/??

== Commands ==

*Отваряне на сертификат
openssl x509 -noout -text -in certs/ca.cert.pem

*Проверка на сертификат
openssl verify -CAfile certs/ca.cert.pem intermediate/certs/intermediate.cert.pem

*Създаване на частен ключ
openssl genrsa -out intermediate/private/t19201.stemo.test.key.pem 4096

*Генериране на pfx (сертификат + ключ с парола)
openssl pkcs12 -export -out t19201.pfx \
-inkey intermediate/private/t19201.stemo.test.key.pem \
-in intermediate/certs/t19201.stemo.test.cert.pem

== Revocation List ==

*Генериране
openssl ca -config openssl.cnf -gencrl -out crl/ca-in-sf.stemo.local.crl.pem

*Проверка
openssl crl -in ca-in-sf.ef3.local.crl.pem -noout -text

Публикува се на http://crl.ef3.local/ca-in-sf.stemo.local.crl.pem

Публикува се на http://crl.ef3.local/ca-in-hq.stemo.local.crl.pem

https://jamielinux.com/articles/2013/08/act-as-your-own-certificate-authority/

https://jamielinux.com/articles/2013/08/generate-certificate-revocation-list-revoke-certificates/

https://jamielinux.com/articles/2013/08/create-an-intermediate-certificate-authority/

https://jamielinux.com/articles/2013/08/act-as-your-own-certificate-authority/

https://jamielinux.com/articles/2013/08/generate-certificate-revocation-list-revoke-certificates/

https://jamielinux.com/articles/2013/08/create-an-intermediate-certificate-authority/

openssl genrsa -out privkey.pem 2048

<

[[Category:Мрежова сигурност]]

Temporary Let's Encrypt certificate

2026-10-27T09:37:34Z

Anko: Synced from t230

Github Copilot

2026-10-27T07:50:54Z

Anko: Created page

= GitHub Copilot =

GitHub Copilot is an AI coding assistant from GitHub. It is available in editors, on github.com and as a terminal tool (Copilot CLI).

== Copilot CLI ==
* Terminal assistant that reads, edits and runs code using natural-language prompts.
* Can run shell commands, search code, use GitHub via the gh CLI and call MCP servers.

== Custom instructions ==
* Repository: '.github/copilot-instructions.md'
* Path-specific: '.github/instructions/*.instructions.md'
* Agents: 'AGENTS.md'
* User level: '$HOME/.copilot/copilot-instructions.md'

== MCP ==
Model Context Protocol servers extend Copilot with external tools, for example the MediaWiki MCP servers (t230 and ilianko.com).

== Links ==
* https://docs.github.com/en/copilot

[[Category:Tools]]

Github CLI (gh)

2026-10-27T07:22:00Z

Anko:

Github CLI (gh)

2026-10-27T07:20:04Z

Anko: /* Common Commands */

'''GitHub CLI''' (''gh'') is GitHub's official command-line tool that brings pull requests, issues, GitHub Actions workflows, releases, gists, and other GitHub features directly to the terminal.

== Overview ==
''gh'' allows developers to interact with GitHub.com and GitHub Enterprise Server without leaving the command line. It automatically detects the current Git repository context, handles authentication and SSH/HTTPS Git credential configuration, and provides both interactive prompts and scriptable flags (including JSON output with ''--json'' and ''--jq'').

== Installation ==
* '''Windows (winget / choco / scoop):'''
winget install --id GitHub.cli
choco install gh
* '''macOS (Homebrew):'''
brew install gh
* '''Linux (Debian / Ubuntu):'''
sudo apt update
sudo apt install gh

== Authentication ==
gh auth login # Interactive login to GitHub.com or GitHub Enterprise
gh auth status # View active authentication state
gh auth setup-git # Configure git to use gh as a credential helper
gh auth token # Print the current authentication token

== Common Commands ==
<pre>
# Check installation
gh --version

# Authenticate
gh auth login

# Check authentication
gh auth status

# Clone a repository
gh repo clone OWNER/REPO

# Create a repository
gh repo create

# List repositories
gh repo list

# Open current repo in browser
gh repo view --web
</pre>

=== Repositories (gh repo) ===
gh repo clone OWNER/REPO # Clone a repository
gh repo create # Create a new repository on GitHub
gh repo fork # Fork an existing repository
gh repo view --web # Open the repository in the browser

=== Pull Requests (gh pr) ===
gh pr list # List open pull requests
gh pr create --fill # Create a pull request using commit info
gh pr checkout NUMBER # Check out a pull request branch locally
gh pr status # Show status of relevant pull requests
gh pr checks # View CI/CD check statuses for a PR
gh pr review --approve # Approve the current pull request
gh pr merge --squash --delete-branch # Squash-merge and delete branch

=== Issues (gh issue) ===
gh issue list # List issues in the repository
gh issue create # Create a new issue interactively
gh issue view NUMBER # View issue details and comments
gh issue develop NUMBER --checkout # Create and check out a branch linked to an issue
gh issue close NUMBER # Close an issue

=== GitHub Actions (gh run and gh workflow) ===
gh workflow list # List workflows in the repository
gh workflow run WORKFLOW_NAME # Trigger a workflow_dispatch event
gh run list # List recent workflow runs
gh run watch # Watch an in-progress workflow run live
gh run view --log-failed # View logs for failed steps in a run

=== Releases, Gists and Codespaces ===
gh release list # List repository releases
gh release create v1.0.0 --generate-notes # Create a release with auto-generated notes
gh gist create FILE # Create a new GitHub Gist
gh codespace list # List active GitHub Codespaces

=== update ===

== Scripting, REST/GraphQL API and Extensions ==
* '''Structured JSON and jq filtering:'''
gh pr list --json number,title,author
* '''Direct GitHub API requests (gh api):'''
gh api repos/{owner}/{repo}/releases/latest
gh api graphql -f query='{ viewer { login } }'
* '''Aliases and Extensions:'''
gh alias set co 'pr checkout'
gh extension search
gh extension install dlvhdr/gh-dash

== External Links ==
* [https://cli.github.com/ Official GitHub CLI Website]
* [https://cli.github.com/manual/ GitHub CLI Manual and Command Reference]
* [https://github.com/cli/cli GitHub CLI Source Repository (cli/cli)]

[[Category:Developer Tools]]
[[Category:CLI]]
[[Category:Git]]

Github CLI (gh)

2026-10-27T07:19:44Z

Anko: /* Common Commands */

'''GitHub CLI''' (''gh'') is GitHub's official command-line tool that brings pull requests, issues, GitHub Actions workflows, releases, gists, and other GitHub features directly to the terminal.

== Overview ==
''gh'' allows developers to interact with GitHub.com and GitHub Enterprise Server without leaving the command line. It automatically detects the current Git repository context, handles authentication and SSH/HTTPS Git credential configuration, and provides both interactive prompts and scriptable flags (including JSON output with ''--json'' and ''--jq'').

== Installation ==
* '''Windows (winget / choco / scoop):'''
winget install --id GitHub.cli
choco install gh
* '''macOS (Homebrew):'''
brew install gh
* '''Linux (Debian / Ubuntu):'''
sudo apt update
sudo apt install gh

== Authentication ==
gh auth login # Interactive login to GitHub.com or GitHub Enterprise
gh auth status # View active authentication state
gh auth setup-git # Configure git to use gh as a credential helper
gh auth token # Print the current authentication token

== Common Commands ==
<pre><code>
# Check installation
gh --version

# Authenticate
gh auth login

# Check authentication
gh auth status

# Clone a repository
gh repo clone OWNER/REPO

# Create a repository
gh repo create

# List repositories
gh repo list

# Open current repo in browser
gh repo view --web
</code></pre>

=== Repositories (gh repo) ===
gh repo clone OWNER/REPO # Clone a repository
gh repo create # Create a new repository on GitHub
gh repo fork # Fork an existing repository
gh repo view --web # Open the repository in the browser

=== Pull Requests (gh pr) ===
gh pr list # List open pull requests
gh pr create --fill # Create a pull request using commit info
gh pr checkout NUMBER # Check out a pull request branch locally
gh pr status # Show status of relevant pull requests
gh pr checks # View CI/CD check statuses for a PR
gh pr review --approve # Approve the current pull request
gh pr merge --squash --delete-branch # Squash-merge and delete branch

=== Issues (gh issue) ===
gh issue list # List issues in the repository
gh issue create # Create a new issue interactively
gh issue view NUMBER # View issue details and comments
gh issue develop NUMBER --checkout # Create and check out a branch linked to an issue
gh issue close NUMBER # Close an issue

=== GitHub Actions (gh run and gh workflow) ===
gh workflow list # List workflows in the repository
gh workflow run WORKFLOW_NAME # Trigger a workflow_dispatch event
gh run list # List recent workflow runs
gh run watch # Watch an in-progress workflow run live
gh run view --log-failed # View logs for failed steps in a run

=== Releases, Gists and Codespaces ===
gh release list # List repository releases
gh release create v1.0.0 --generate-notes # Create a release with auto-generated notes
gh gist create FILE # Create a new GitHub Gist
gh codespace list # List active GitHub Codespaces

=== update ===

== Scripting, REST/GraphQL API and Extensions ==
* '''Structured JSON and jq filtering:'''
gh pr list --json number,title,author
* '''Direct GitHub API requests (gh api):'''
gh api repos/{owner}/{repo}/releases/latest
gh api graphql -f query='{ viewer { login } }'
* '''Aliases and Extensions:'''
gh alias set co 'pr checkout'
gh extension search
gh extension install dlvhdr/gh-dash

== External Links ==
* [https://cli.github.com/ Official GitHub CLI Website]
* [https://cli.github.com/manual/ GitHub CLI Manual and Command Reference]
* [https://github.com/cli/cli GitHub CLI Source Repository (cli/cli)]

[[Category:Developer Tools]]
[[Category:CLI]]
[[Category:Git]]

Github CLI (gh)

2026-10-27T07:19:19Z

Anko: /* Common Commands */

'''GitHub CLI''' (''gh'') is GitHub's official command-line tool that brings pull requests, issues, GitHub Actions workflows, releases, gists, and other GitHub features directly to the terminal.

== Overview ==
''gh'' allows developers to interact with GitHub.com and GitHub Enterprise Server without leaving the command line. It automatically detects the current Git repository context, handles authentication and SSH/HTTPS Git credential configuration, and provides both interactive prompts and scriptable flags (including JSON output with ''--json'' and ''--jq'').

== Installation ==
* '''Windows (winget / choco / scoop):'''
winget install --id GitHub.cli
choco install gh
* '''macOS (Homebrew):'''
brew install gh
* '''Linux (Debian / Ubuntu):'''
sudo apt update
sudo apt install gh

== Authentication ==
gh auth login # Interactive login to GitHub.com or GitHub Enterprise
gh auth status # View active authentication state
gh auth setup-git # Configure git to use gh as a credential helper
gh auth token # Print the current authentication token

== Common Commands ==
<code>
# Check installation
gh --version

# Authenticate
gh auth login

# Check authentication
gh auth status

# Clone a repository
gh repo clone OWNER/REPO

# Create a repository
gh repo create

# List repositories
gh repo list

# Open current repo in browser
gh repo view --web
</code>

=== Repositories (gh repo) ===
gh repo clone OWNER/REPO # Clone a repository
gh repo create # Create a new repository on GitHub
gh repo fork # Fork an existing repository
gh repo view --web # Open the repository in the browser

=== Pull Requests (gh pr) ===
gh pr list # List open pull requests
gh pr create --fill # Create a pull request using commit info
gh pr checkout NUMBER # Check out a pull request branch locally
gh pr status # Show status of relevant pull requests
gh pr checks # View CI/CD check statuses for a PR
gh pr review --approve # Approve the current pull request
gh pr merge --squash --delete-branch # Squash-merge and delete branch

=== Issues (gh issue) ===
gh issue list # List issues in the repository
gh issue create # Create a new issue interactively
gh issue view NUMBER # View issue details and comments
gh issue develop NUMBER --checkout # Create and check out a branch linked to an issue
gh issue close NUMBER # Close an issue

=== GitHub Actions (gh run and gh workflow) ===
gh workflow list # List workflows in the repository
gh workflow run WORKFLOW_NAME # Trigger a workflow_dispatch event
gh run list # List recent workflow runs
gh run watch # Watch an in-progress workflow run live
gh run view --log-failed # View logs for failed steps in a run

=== Releases, Gists and Codespaces ===
gh release list # List repository releases
gh release create v1.0.0 --generate-notes # Create a release with auto-generated notes
gh gist create FILE # Create a new GitHub Gist
gh codespace list # List active GitHub Codespaces

=== update ===

== Scripting, REST/GraphQL API and Extensions ==
* '''Structured JSON and jq filtering:'''
gh pr list --json number,title,author
* '''Direct GitHub API requests (gh api):'''
gh api repos/{owner}/{repo}/releases/latest
gh api graphql -f query='{ viewer { login } }'
* '''Aliases and Extensions:'''
gh alias set co 'pr checkout'
gh extension search
gh extension install dlvhdr/gh-dash

== External Links ==
* [https://cli.github.com/ Official GitHub CLI Website]
* [https://cli.github.com/manual/ GitHub CLI Manual and Command Reference]
* [https://github.com/cli/cli GitHub CLI Source Repository (cli/cli)]

[[Category:Developer Tools]]
[[Category:CLI]]
[[Category:Git]]

Github CLI (gh)

2026-10-27T07:12:53Z

Anko: Created Github CLI (gh) reference page

'''GitHub CLI''' (''gh'') is GitHub's official command-line tool that brings pull requests, issues, GitHub Actions workflows, releases, gists, and other GitHub features directly to the terminal.

== Overview ==
''gh'' allows developers to interact with GitHub.com and GitHub Enterprise Server without leaving the command line. It automatically detects the current Git repository context, handles authentication and SSH/HTTPS Git credential configuration, and provides both interactive prompts and scriptable flags (including JSON output with ''--json'' and ''--jq'').

== Installation ==
* '''Windows (winget / choco / scoop):'''
winget install --id GitHub.cli
choco install gh
* '''macOS (Homebrew):'''
brew install gh
* '''Linux (Debian / Ubuntu):'''
sudo apt update
sudo apt install gh

== Authentication ==
gh auth login # Interactive login to GitHub.com or GitHub Enterprise
gh auth status # View active authentication state
gh auth setup-git # Configure git to use gh as a credential helper
gh auth token # Print the current authentication token

== Common Commands ==

=== Repositories (gh repo) ===
gh repo clone OWNER/REPO # Clone a repository
gh repo create # Create a new repository on GitHub
gh repo fork # Fork an existing repository
gh repo view --web # Open the repository in the browser

=== Pull Requests (gh pr) ===
gh pr list # List open pull requests
gh pr create --fill # Create a pull request using commit info
gh pr checkout NUMBER # Check out a pull request branch locally
gh pr status # Show status of relevant pull requests
gh pr checks # View CI/CD check statuses for a PR
gh pr review --approve # Approve the current pull request
gh pr merge --squash --delete-branch # Squash-merge and delete branch

=== Issues (gh issue) ===
gh issue list # List issues in the repository
gh issue create # Create a new issue interactively
gh issue view NUMBER # View issue details and comments
gh issue develop NUMBER --checkout # Create and check out a branch linked to an issue
gh issue close NUMBER # Close an issue

=== GitHub Actions (gh run and gh workflow) ===
gh workflow list # List workflows in the repository
gh workflow run WORKFLOW_NAME # Trigger a workflow_dispatch event
gh run list # List recent workflow runs
gh run watch # Watch an in-progress workflow run live
gh run view --log-failed # View logs for failed steps in a run

=== Releases, Gists and Codespaces ===
gh release list # List repository releases
gh release create v1.0.0 --generate-notes # Create a release with auto-generated notes
gh gist create FILE # Create a new GitHub Gist
gh codespace list # List active GitHub Codespaces

== Scripting, REST/GraphQL API and Extensions ==
* '''Structured JSON and jq filtering:'''
gh pr list --json number,title,author
* '''Direct GitHub API requests (gh api):'''
gh api repos/{owner}/{repo}/releases/latest
gh api graphql -f query='{ viewer { login } }'
* '''Aliases and Extensions:'''
gh alias set co 'pr checkout'
gh extension search
gh extension install dlvhdr/gh-dash

== External Links ==
* [https://cli.github.com/ Official GitHub CLI Website]
* [https://cli.github.com/manual/ GitHub CLI Manual and Command Reference]
* [https://github.com/cli/cli GitHub CLI Source Repository (cli/cli)]

[[Category:Developer Tools]]
[[Category:CLI]]
[[Category:Git]]

MediaWiki:Sidebar

2026-10-27T07:00:21Z

Anko:

* navigation
** mainpage|mainpage-description
** CV|CV
**Devops tools|Devops tools
** randompage-url|randompage

MediaWiki:Sidebar

2026-10-27T06:59:57Z

Anko:

* navigation
** mainpage|mainpage-description
** CV|CV
**Devops Tools|Devops Tools
** randompage-url|randompage

MediaWiki:Sidebar

2026-10-27T06:59:29Z

Anko:

* navigation
** mainpage|mainpage-description
** CV|CV
**devops-tools|Devops Tools
** randompage-url|randompage

Category:DP-420 Terminology

2026-10-26T15:18:01Z

Anko: Add 100-word category description for DP-420 Terminology

This category contains key terminology, concepts, and reference articles for the '''[[DP-420: Azure Cosmos DB Developer Specialty]]''' certification exam (''Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB''). It covers core NoSQL concepts, Request Units (RUs), logical and physical partitioning, data modeling strategies, provisioned and serverless throughput, global distribution, tunable consistency levels, client SDK connectivity, server-side JavaScript programming, indexing policies, Change Feed, Azure Synapse Link, Microsoft Fabric mirroring, monitoring diagnostics, backup and restore models, and data-plane security. Each article includes a concise technical overview, links to official Microsoft Learn documentation, and DP-420 style practice questions with detailed answer keys.

Azure Cosmos DB

2026-10-26T15:15:50Z

Anko:

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Core Concepts

'''Summary:''' Microsoft's globally distributed, multi-model NoSQL database service for cloud-native apps.

== Overview ==
Azure Cosmos DB is Microsoft's globally distributed, multi-model NoSQL database service designed for cloud-native applications requiring low latency, high availability, and elastic scalability. It supports multiple APIs (including the API for NoSQL, MongoDB, Cassandra, Gremlin, and Table), automatic and transparent horizontal partitioning, tunable consistency levels, and turnkey global distribution across any number of Azure regions.

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/cosmos-db/introduction Microsoft Learn: Welcome to Azure Cosmos DB]
* [https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/dp-420 Microsoft Learn: DP-420 study guide]

== DP-420 Style Practice Questions ==
'''Q1.''' What is a defining characteristic of Azure Cosmos DB compared to a traditional single-region relational database?
* A. Turnkey global distribution across multiple Azure regions with tunable consistency
* B. It only supports a single fixed consistency level
* C. It requires manual sharding scripts written by the developer
* D. It cannot scale horizontally

'''Q2.''' Which of the following APIs is NOT supported by Azure Cosmos DB?
* A. API for MySQL
* B. API for NoSQL
* C. API for MongoDB
* D. API for Cassandra

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (Azure Cosmos DB):''' A. Turnkey global distribution across multiple Azure regions with tunable consistency — Azure Cosmos DB provides built-in global distribution and multiple tunable consistency levels, unlike traditional single-region databases.
* '''Q2 (Azure Cosmos DB):''' A. API for MySQL — Azure Cosmos DB supports NoSQL, MongoDB, Cassandra, Gremlin, and Table APIs, but not a dedicated 'API for MySQL'.

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[:Category:DP-420 Terminology]]
[[Category:Core Concepts]]

DP-420: Azure Cosmos DB Developer Specialty

2026-10-26T15:12:09Z

Anko: /* Uncategorized */

'''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB''' — Key terminology reference for exam preparation.

__TOC__

== Core Concepts ==
; [[Azure Cosmos DB]]
: Microsoft's globally distributed, multi-model NoSQL database service for cloud-native apps.
; [[Request Unit (RU)]]
: Normalized currency measuring the cost of database operations, independent of hardware.
; [[Container]]
: Fundamental unit of scalability/storage in Cosmos DB for NoSQL, analogous to a table.
; [[Item (Document)]]
: Fundamental unit of data, stored as a self-describing JSON document within a container.
; [[API for NoSQL]]
: Cosmos DB's native API (formerly SQL API), queried with a SQL-like language; DP-420's focus.
; [[OLTP]]
: Online Transactional Processing; small, fast operations — Cosmos DB's core transactional workload type.
; [[OLAP]]
: Online Analytical Processing; large aggregations and analytical queries over historical data

== Data Modeling & Partitioning ==
; [[Partition Key]]
: Property used to distribute items across physical partitions for scalability.
; [[Logical Partition]]
: Group of items sharing the same partition key value; max 20 GB storage.
; [[Physical Partition]]
: Underlying infrastructure unit hosting one or more logical partitions.
; [[Synthetic Partition Key]]
: Concatenated/computed key combining multiple properties for better distribution.
; [[Hierarchical Partition Key]]
: Up to 3 levels of partition keys for granular, multi-tenant partitioning.
; [[Embedding (Denormalization)]]
: Nesting related data within a single document for fewer round trips.
; [[Referencing (Normalization)]]
: Storing related entities as separate documents linked by an id reference.
; [[Time to Live (TTL)]]
: Container/item setting that automatically deletes items after a set time.
; [[Unique Keys]]
: Container-level constraint enforcing uniqueness of property paths per logical partition.

== Throughput & Scaling ==
; [[Provisioned Throughput]]
: Reserved, guaranteed RU/s billed regardless of consumption; suits steady workloads.
; [[Serverless]]
: Consumption-based billing for actual RUs used; suits intermittent/unpredictable traffic.
; [[Autoscale Throughput]]
: Automatically scales RU/s between 10%-100% of a configured maximum based on demand.
; [[Database-Level Throughput]]
: Provisioned throughput shared across all containers in a database.
; [[az cosmosdb sql container update]]
: CLI: updates container config (indexing, TTL, unique keys), not throughput.
; [[az cosmosdb sql container throughput update]]
: CLI: changes a container's manual RU/s or autoscale max RU/s.
; [[az cosmosdb sql container throughput migrate]]
: CLI: switches a container between manual and autoscale throughput.
; [[az cosmosdb sql container redistribute-partition-throughput]]
: CLI: reallocates RU/s unevenly across physical partitions to relieve a hot partition.

== Data Distribution & Consistency ==
; [[Global Distribution]]
: Turnkey replication of data across any number of Azure regions, no code changes.
; [[Consistency Levels]]
: Five tunable levels (Strong, Bounded Staleness, Session, Consistent Prefix, Eventual).
; [[Automatic Failover]]
: Policy that automatically promotes a new write region during a regional outage.
; [[Multi-Region Writes]]
: Every region accepts reads and writes simultaneously (multi-master).
; [[Conflict Resolution Policy]]
: Defines how concurrent multi-region write conflicts are resolved (e.g., LWW).
; [[Session Token]]
: Value guaranteeing a client reads its own writes under session consistency.

== Client Connectivity & SDK ==
; [[Gateway Mode]]
: SDK connectivity via a single HTTPS endpoint; more firewall-friendly, higher latency.
; [[Direct Mode]]
: SDK connectivity direct to backend replicas over TCP; lower latency, more ports needed.
; [[Cosmos DB Emulator]]
: Local, offline tool emulating Cosmos DB for development/testing without Azure cost.
; [[Point Operation]]
: Single-item operation using id + partition key, more RU-efficient than a query.
; [[Patch Operation]]
: Partial update of specific item properties without replacing the whole document.
; [[Transactional Batch]]
: Groups multiple point operations on the same logical partition into one atomic transaction.
; [[Bulk Support]]
: SDK feature optimized for loading/updating large volumes of items across many partitions.
; [[Optimistic Concurrency (ETag)]]
: Uses the ETag property with if-match preconditions to detect write conflicts.
; [[Continuation Token]]
: Opaque value used to resume a paginated query/feed from where the last page left off.
; [[Cross-Partition Query]]
: Query spanning multiple physical partitions; tuned via MaxConcurrency and MaxBufferedItemCount.
; [[429 Throttling Error]]
: Error indicating a request was rate-limited due to exceeding provisioned RU/s.
; [[isTombstone]]

== Server-Side Programming ==
; [[x-ms-retry-after-ms]]
: http header value that represents in milliseconds the minimal waiting time between requests.
; [[Item response, Feed response]]
: Contains both returned data plus request charge, session token, and ETag
; [[Queries]]
: Queries
; [[Stored Procedure]]
: JavaScript logic executed server-side within a single logical partition transaction.
; [[BulkImportResponse]]
: Return object of the classic bulkImport stored procedure pattern; reports numDocsImported/continuation.
; [[Trigger]]
: Pre- or post-operation JavaScript logic, explicitly invoked by the client per request.
; [[User-Defined Function (UDF)]]
: Read-only JavaScript function extending SQL queries with custom computations.
; [[Aggregate Functions (COUNT, SUM, AVG, MIN, MAX)]]
: Built-in SQL aggregate operators (COUNT, SUM, AVG, MIN, MAX) used with GROUP BY.
; [[EXISTS & Array Functions (IS_ARRAY, ARRAY_CONTAINS)]]
: SQL subquery and array functions (EXISTS, IS_ARRAY, ARRAY_CONTAINS, ARRAY_LENGTH) for nested data.

== Integration & Analytics ==
; [[Change Feed]]
: Persistent, ordered log of item inserts/updates, consumable by apps and Azure Functions.
; [[Full-Text Query]]
: Native keyword search via FULLTEXTCONTAINS/FULLTEXTSCORE, backed by a full-text index.
; [[HTAP (Hybrid Transactional and Analytical Processing)]]
: Architecture running analytics over operational data without impacting transactional OLTP RUs, enabled via Synapse Link/analytical store.
; [[Azure Synapse Link / Analytical Store]]
: Near real-time analytics via a separate column-store, no RU impact on transactional data.
; [[Azure Cosmos DB Mirroring for Fabric]]
: Near real-time replication of Cosmos DB data into Microsoft Fabric's OneLake.
; [[OneLake]]
: Fabric's single, unified, tenant-wide data lake storing all workloads' data in Delta format.
; [[Delta Format]]
: Open-source ACID table format (Delta Lake) used for all data stored in OneLake.
; [[Apache Spark]]
: Distributed processing engine used in Synapse/Fabric notebooks to analyze Cosmos DB data.
; [[Serverless SQL Pool]]
: On-demand T-SQL query service in Azure Synapse to query Cosmos DB analytical store via OPENROWSET.
; [[Direct Lake]]
: Power BI mode reading Delta tables directly from OneLake — near-Import speed, always fresh.
; [[Azure Functions Integration]]
: Serverless compute triggered by Cosmos DB change feed for event-driven processing, denormalization, and data movement.
; [[Azure Logic Apps]]
: Low-code cloud workflow automation service integrating with Cosmos DB via connectors, triggers, and actions.
; [[Azure AI Search Integration]]
: Indexer pulls Cosmos DB data (via change feed) to enable full-text/semantic search.

== Optimization ==
; [[Indexing Policy]]
: Defines which properties are indexed, trading off query performance vs. write RU cost.
; [[Range Index]]
: Default index type for string/numeric properties; supports equality, range, and ORDER BY.
; [[Spatial Index]]
: Accelerates geospatial queries (ST_DISTANCE, ST_WITHIN) over GeoJSON properties.
; [[Composite Index]]
: Index across multiple properties to support efficient multi-property filter/sort queries.
; [[Vector Index]]
: Enables approximate nearest-neighbor similarity search over embeddings for AI/RAG scenarios.
; [[Wildcard / Included & Excluded Paths]]
: Path expressions (with optional /* wildcard) controlling exactly which properties are indexed.
; [[Integrated Cache]]
: In-memory caching layer (via dedicated gateway) reducing RU cost/latency for repeated reads.
; [[Change Feed Estimator]]
: Reports pending change feed lag to help decide when to scale out consumer instances.

== Maintenance & Security ==
; [[Alerts]]
: Cosmo DB alerts
; [[Normalized RU Consumption]]
: Azure Monitor metric showing % of provisioned throughput used; flags hot partitions.
; [[PartitionKeyRUConsumption (Diagnostic Log)]]
: Per-second RU/s consumption per partition key; pinpoints hot partitions.
; [[PartitionKeyStatistics (Diagnostic Log)]]
: Estimated storage size (KB) per logical partition key; flags storage skew.
; [[QueryRuntimeStatistics (Diagnostic Log)]]
: Logs query operations against the account for query performance analysis.
; [[ControlPlaneRequests (Diagnostic Log)]]
: Logs account control-plane operations, e.g. adding/removing replication regions.
; [[DataPlaneRequests (Diagnostic Log)]]
: Logs item-level create/read/replace/delete/query operations with RU charge and duration.
; [[KQL (Kusto Query Language)]]
: Query language used in Azure Monitor Log Analytics to analyze Cosmos DB diagnostic logs and metrics.
; [[Periodic Backup]]
: Original backup mode; scheduled snapshots, typically restored via a support request.
; [[Continuous Backup & Point-in-Time Restore]]
: Continuous backups enabling self-service restore to any timestamp in the retention window.
; [[Customer-Managed Keys]]
: Encrypt data at rest using a key you control in Azure Key Vault.
; [[Data Encryption Key (DEK)]]
: for Always Encrypted in Azure Cosmos DB, you must use the Azure Cosmos DB SDK (C#, Java, or Node.js).
; [[RBAC for Data Plane]]
: Fine-grained Microsoft Entra ID permissions for data operations, avoiding shared account keys.
; [[Cosmos DB Operator]]
: Provisions accounts, databases, and containers; cannot access data or use Data Explorer.
; [[Cosmos DB Account Reader Role]]
: Can read Azure Cosmos DB account data; cannot provision resources or make changes.
; [[Cosmos Backup Operator]]
: Submits a restore request for a periodic backup-enabled database or container.
; [[CosmosRestoreOperator]]
: Performs the restore action for an account in continuous backup mode.
; [[Always Encrypted]]
: Client-side encryption ensuring Cosmos DB never sees plaintext values of protected properties.
; [[Azure Data Factory (Data Movement)]]
: Pipeline-based ETL/ELT service for moving data into/out of Cosmos DB.
; [[ARM Templates (Infrastructure as Code)]]
: Declarative, version-controlled provisioning of Cosmos DB resources as code.
; [[log-analytics]]

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — terminology reference''

[[Category:DP-420 Terminology]]

Test

2026-10-26T15:07:46Z

Anko: Recreated DP-420 term page: test (Uncategorized)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Uncategorized

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Uncategorized]]

Log-analytics

2026-10-26T15:07:46Z

Anko: Recreated DP-420 term page: log-analytics (Maintenance & Security)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Maintenance & Security

== Overview ==
It can save data in:

<pre>
| Table | Purpose | When to Use | DP-420 Keywords |
| -------------------------------- | ------------------------------------------ | ---------------------------------- | --------------------------------------------------------- |
| **CDBDataPlaneRequests** | Individual requests made against Cosmos DB | Troubleshoot specific operations | Request charge, latency, 429, point read, query |
| **CDBDataPlaneRequests5M** | Aggregated metrics over 5-minute windows | Trend analysis and dashboards | Throughput trends, average latency, request counts |
| **CDBPartitionKeyRUConsumption** | RU consumption per partition key | Find hot partitions | Hot partition, skewed workload, RU distribution |
| **CDBPartitionKeyStatistics** | Statistics about partition key usage | Analyze partitioning effectiveness | Partition cardinality, partition growth, partition design |
| **CDBQueryRuntimeStatistics** | Query execution details | Optimize queries | Index utilization, query performance, scans |

</pre>

* Send to Log Analytics workspace
* Send to storage account
* Send to event hub
* Send to another Azure Monitor log
* Send to Azure

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/log-analytics/tutorial-kql Microsoft Learn: Tutorial - Write KQL queries to monitor Azure Cosmos DB]
* [https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/ Microsoft Learn: Overview of Kusto Query Language (KQL)]
* [https://learn.microsoft.com/en-us/azure/cosmos-db/monitor-resource-logs Microsoft Learn: Monitor and troubleshoot Azure Cosmos DB using diagnostic logs]

== DP-420 Style Practice Questions ==
'''Q1.''' What is the primary role of KQL (Kusto Query Language) in Azure Cosmos DB operations and troubleshooting?
* A. Querying and analyzing diagnostic logs and metrics in Azure Monitor Log Analytics to troubleshoot issues like throttling, hot partitions, and expensive queries
* B. Defining server-side stored procedures and triggers directly in Cosmos DB containers
* C. Querying JSON documents via the Cosmos DB API for NoSQL endpoint
* D. Creating and managing Cosmos DB indexing policies declaratively

'''Q2.''' In a KQL query for Azure Cosmos DB logs, what does the pipe (|) operator represent?
* A. It pipes the tabular output of the preceding operator as the input to the next operator in a data-flow pipeline
* B. It performs a logical bitwise OR between two numeric fields
* C. It defines a primary key constraint on the diagnostic table
* D. It separates alternative partition key values in a point read

'''Q3.''' Which resource-specific table would you query using KQL to inspect RU charges and HTTP status codes for individual data operations?
* A. CDBDataPlaneRequests
* B. CDBControlPlaneRequests
* C. CDBPartitionKeyStatistics
* D. AzureMetrics

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (KQL (Kusto Query Language)):''' A. Querying and analyzing diagnostic logs and metrics in Azure Monitor Log Analytics to troubleshoot issues like throttling, hot partitions, and expensive queries — KQL is the read-only query language for Azure Monitor Log Analytics used to analyze diagnostic logs like CDBDataPlaneRequests and CDBPartitionKeyRUConsumption.
* '''Q2 (KQL (Kusto Query Language)):''' A. It pipes the tabular output of the preceding operator as the input to the next operator in a data-flow pipeline — KQL uses the pipe (|) operator to pass data sequentially from one tabular expression/operator to another (e.g., filtering with where, then aggregating with summarize).
* '''Q3 (KQL (Kusto Query Language)):''' A. CDBDataPlaneRequests — CDBDataPlaneRequests logs individual data-plane operations along with RequestCharge, StatusCode, DurationMs, and ActivityId.

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Maintenance & Security]]

IsTombstone

2026-10-26T15:07:46Z

Anko: Recreated DP-420 term page: isTombstone (Client Connectivity & SDK)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Client Connectivity & SDK

== Overview ==
Tombstone in Azure Cosmos DB: When an item is deleted from a container, Azure Cosmos DB marks the item as a "tombstone" to ensure that the deletion is propagated correctly across all replicas in a distributed system. This ensures that the deleted item does not reappear after a replica catches up or after a period of network partition. For DP-420, if you see tombstones, think: Change Feed Delete notifications All Versions and Deletes mode CDC (similar to SQL Server Change Data Capture)

<pre>
| Mode | Creates | Updates | Deletes |
| ----------------------------- | ------- | ------- | -------------- |
| Latest Version Mode | ✅ | ✅ | ❌ |
| All Versions and Deletes Mode | ✅ | ✅ | ✅ (tombstones) |

</pre>

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/conceptual-resilient-sdk-applications Microsoft Learn: Handling rate limiting / request rate too large]

== DP-420 Style Practice Questions ==
'''Q1.''' What does a 429 error from Azure Cosmos DB typically indicate?
* A. The request was throttled because provisioned throughput (RU/s) was exceeded
* B. The requested item does not exist
* C. An authentication failure occurred
* D. A conflict occurred during multi-region writes

'''Q2.''' Which of these could help reduce the frequency of 429 errors?
* A. Improving partition key distribution to avoid hot partitions, or increasing provisioned RU/s
* B. Disabling the SDK's automatic retry policy
* C. Switching to gateway mode exclusively
* D. Reducing the number of properties indexed

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (429 Throttling Error):''' A. The request was throttled because provisioned throughput (RU/s) was exceeded — A 429 status code means the request rate exceeded the provisioned RU/s, triggering throttling.
* '''Q2 (429 Throttling Error):''' A. Improving partition key distribution to avoid hot partitions, or increasing provisioned RU/s — Better partition key distribution and/or higher provisioned throughput both help reduce 429 throttling errors.

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Client Connectivity & SDK]]

ARM Templates (Infrastructure as Code)

2026-10-26T15:07:45Z

Anko: Recreated DP-420 term page: ARM Templates (Infrastructure as Code) (Maintenance & Security)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Maintenance & Security

'''Summary:''' Declarative, version-controlled provisioning of Cosmos DB resources as code.

== Overview ==
Azure Resource Manager (ARM) templates (and equivalents like Bicep) allow you to declaratively define and provision Azure Cosmos DB resources — accounts, databases, containers, throughput settings, and indexing policies — as code, enabling repeatable, version-controlled deployments as part of a DevOps process, as opposed to imperative, manual configuration through the Azure portal or CLI commands.

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/cosmos-db/manage-with-templates Microsoft Learn: Manage Azure Cosmos DB resources with ARM templates]

== DP-420 Style Practice Questions ==
'''Q1.''' What is the main advantage of provisioning Azure Cosmos DB resources using ARM templates instead of the Azure portal?
* A. Declarative, repeatable, and version-controlled infrastructure as code
* B. Lower RU cost for provisioned throughput
* C. Automatic point-in-time restore
* D. Elimination of the need for a partition key

'''Q2.''' Which of these can be maintained in production using ARM templates, per the DP-420 objectives?
* A. Indexing policies
* B. The account's region priority list only
* C. The change feed estimator
* D. The integrated cache

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (ARM Templates (Infrastructure as Code)):''' A. Declarative, repeatable, and version-controlled infrastructure as code — ARM templates provide declarative, repeatable infrastructure-as-code deployments suitable for DevOps pipelines.
* '''Q2 (ARM Templates (Infrastructure as Code)):''' A. Indexing policies — The DP-420 objectives specifically call out maintaining indexing policies in production using ARM templates.

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Maintenance & Security]]

Azure Data Factory (Data Movement)

2026-10-26T15:07:45Z

Anko: Recreated DP-420 term page: Azure Data Factory (Data Movement) (Maintenance & Security)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Maintenance & Security

'''Summary:''' Pipeline-based ETL/ELT service for moving data into/out of Cosmos DB.

== Overview ==
Azure Data Factory is a cloud ETL/ELT service that can be used to move data into or out of Azure Cosmos DB as part of pipeline-based data movement strategies — such as bulk-loading data from other sources, or migrating/copying data between Cosmos DB accounts or containers — as an alternative to using SDK bulk operations, Kafka connectors, or Stream Analytics for data movement.

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/data-factory/connector-azure-cosmos-db Microsoft Learn: Copy data to/from Azure Cosmos DB using ADF]

== DP-420 Style Practice Questions ==
'''Q1.''' Which Azure service provides pipeline-based ETL/ELT capabilities for moving data into or out of Azure Cosmos DB?
* A. Azure Data Factory
* B. Azure Bastion
* C. Azure Front Door
* D. Azure DNS

'''Q2.''' Besides Azure Data Factory, which of these is also a valid data movement option for Azure Cosmos DB mentioned in the DP-420 objectives?
* A. A Kafka connector
* B. Always Encrypted
* C. A composite index
* D. A trigger

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (Azure Data Factory (Data Movement)):''' A. Azure Data Factory — Azure Data Factory (and Azure Synapse pipelines) provide pipeline-based data movement capabilities for Cosmos DB.
* '''Q2 (Azure Data Factory (Data Movement)):''' A. A Kafka connector — The DP-420 objectives list SDK bulk operations, ADF/Synapse pipelines, a Kafka connector, Stream Analytics, and the Spark connector as data movement options.

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Maintenance & Security]]

Always Encrypted

2026-10-26T15:07:45Z

Anko: Recreated DP-420 term page: Always Encrypted (Maintenance & Security)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Maintenance & Security

'''Summary:''' Client-side encryption ensuring Cosmos DB never sees plaintext values of protected properties.

== Overview ==
Always Encrypted for Azure Cosmos DB is a client-side encryption feature that encrypts sensitive data (specific properties) before it leaves the client application, ensuring that even Azure Cosmos DB itself never sees the plaintext values. Encryption and decryption happen using keys managed by the client, typically backed by Azure Key Vault, providing strong protection for highly sensitive fields.

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-always-encrypted Microsoft Learn: Always Encrypted for Azure Cosmos DB]

== DP-420 Style Practice Questions ==
'''Q1.''' What does Always Encrypted for Azure Cosmos DB protect against?
* A. Azure Cosmos DB (and anyone with access to the service) ever seeing plaintext values of protected properties
* B. Network-level attacks only
* C. Only attacks that occur during backup and restore
* D. Loss of the primary account key only

'''Q2.''' Where does encryption/decryption occur when using Always Encrypted?
* A. On the client side, before data leaves the application
* B. On the Cosmos DB server, before storage
* C. In transit only, using TLS
* D. Only during backup operations

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (Always Encrypted):''' A. Azure Cosmos DB (and anyone with access to the service) ever seeing plaintext values of protected properties — Always Encrypted ensures the database service itself never has access to plaintext values, protecting against server-side exposure.
* '''Q2 (Always Encrypted):''' A. On the client side, before data leaves the application — Always Encrypted performs client-side encryption/decryption, so sensitive data is never exposed in plaintext to the service.

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Maintenance & Security]]

CosmosRestoreOperator

2026-10-26T15:07:44Z

Anko: Recreated DP-420 term page: CosmosRestoreOperator (Maintenance & Security)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Maintenance & Security

'''Summary:''' Performs the restore action for an account in continuous backup mode.

== Overview ==
CosmosRestoreOperator is a built-in Azure RBAC (control-plane) role that can perform a restore action for an Azure Cosmos DB account in continuous backup mode, without granting broader account management or item data access permissions. This complements Cosmos Backup Operator, which instead submits restore requests for periodic backup-enabled databases/containers — the appropriate role depends on which backup mode (Periodic Backup or Continuous Backup & Point-in-Time Restore) the account uses.

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/databases#cosmosrestoreoperator Microsoft Learn: Azure built-in roles for Azure Cosmos DB]

== DP-420 Style Practice Questions ==
'''Q1.''' What permission does the CosmosRestoreOperator role grant?
* A. The ability to perform a restore action for an account in continuous backup mode
* B. The ability to submit a periodic backup restore request
* C. The ability to read item data using Data Explorer
* D. The ability to provision new databases and containers

'''Q2.''' Which role would you assign to submit a restore request for a periodic backup-enabled container instead?
* A. Cosmos Backup Operator
* B. Cosmos DB Operator
* C. Cosmos DB Account Reader Role
* D. CosmosRestoreOperator

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (CosmosRestoreOperator):''' A. The ability to perform a restore action for an account in continuous backup mode — CosmosRestoreOperator specifically enables restoring an account that has continuous backup mode enabled.
* '''Q2 (CosmosRestoreOperator):''' A. Cosmos Backup Operator — Cosmos Backup Operator is used for periodic backup restore requests, while CosmosRestoreOperator applies to continuous backup mode.

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Maintenance & Security]]

Cosmos Backup Operator

2026-10-26T15:07:44Z

Anko: Recreated DP-420 term page: Cosmos Backup Operator (Maintenance & Security)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Maintenance & Security

'''Summary:''' Submits a restore request for a periodic backup-enabled database or container.

== Overview ==
Cosmos Backup Operator is a built-in Azure RBAC (control-plane) role that can submit a restore request from the Azure portal for a periodic backup-enabled database or container, without granting the ability to read or write item data. This is distinct from CosmosRestoreOperator, which instead performs a restore action for an account configured in continuous backup mode — the two roles apply to the two different backup modes (Periodic Backup vs. Continuous Backup & Point-in-Time Restore).

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/databases#cosmos-backup-operator Microsoft Learn: Azure built-in roles for Azure Cosmos DB]

== DP-420 Style Practice Questions ==
'''Q1.''' What does the Cosmos Backup Operator built-in role allow?
* A. Submitting a restore request from the Azure portal for a periodic backup-enabled database or container
* B. Restoring a continuous-backup-enabled account directly
* C. Reading and writing items directly
* D. Provisioning new Azure Cosmos DB accounts

'''Q2.''' How does Cosmos Backup Operator differ from CosmosRestoreOperator?
* A. Backup Operator submits restore requests for periodic backup, while CosmosRestoreOperator performs restores for continuous backup accounts
* B. They are the same role with two names
* C. Backup Operator can read item data, but CosmosRestoreOperator cannot
* D. CosmosRestoreOperator only works with periodic backup mode

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (Cosmos Backup Operator):''' A. Submitting a restore request from the Azure portal for a periodic backup-enabled database or container — Cosmos Backup Operator submits restore requests for periodic backup-enabled databases/containers, not for continuous backup accounts.
* '''Q2 (Cosmos Backup Operator):''' A. Backup Operator submits restore requests for periodic backup, while CosmosRestoreOperator performs restores for continuous backup accounts — Cosmos Backup Operator handles periodic backup restore requests, whereas CosmosRestoreOperator restores accounts in continuous backup mode.

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Maintenance & Security]]

Cosmos DB Account Reader Role

2026-10-26T15:07:44Z

Anko: Recreated DP-420 term page: Cosmos DB Account Reader Role (Maintenance & Security)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Maintenance & Security

'''Summary:''' Can read Azure Cosmos DB account data; cannot provision resources or make changes.

== Overview ==
Cosmos DB Account Reader Role is a built-in Azure RBAC (control-plane) role that can read Azure Cosmos DB account data — including viewing account configuration and reading item data — without permission to make any changes to the account or its resources. It is commonly assigned to auditors, monitoring tools, or team members who need read visibility into an account without provisioning rights (contrast with Cosmos DB Operator, which can provision resources but not read data).

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/databases#cosmosdb-account-reader-role Microsoft Learn: Azure built-in roles for Azure Cosmos DB]

== DP-420 Style Practice Questions ==
'''Q1.''' What does the Cosmos DB Account Reader Role permit?
* A. Reading Azure Cosmos DB account data and configuration, without making changes
* B. Provisioning new databases and containers
* C. Restoring a deleted account from continuous backup
* D. Submitting a periodic backup restore request

'''Q2.''' How does Cosmos DB Account Reader Role differ from Cosmos DB Operator?
* A. Account Reader can read account data but cannot provision resources, while Cosmos DB Operator can provision resources but cannot access data
* B. They are identical roles with different names
* C. Account Reader can restore accounts, while Cosmos DB Operator cannot
* D. Cosmos DB Operator can read data but not provision resources

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (Cosmos DB Account Reader Role):''' A. Reading Azure Cosmos DB account data and configuration, without making changes — This role provides read access to account data/configuration but no ability to modify resources or provision new ones.
* '''Q2 (Cosmos DB Account Reader Role):''' A. Account Reader can read account data but cannot provision resources, while Cosmos DB Operator can provision resources but cannot access data — Account Reader is read-focused on data/configuration, whereas Cosmos DB Operator is focused on provisioning without data access.

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Maintenance & Security]]

Cosmos DB Operator

2026-10-26T15:07:43Z

Anko: Recreated DP-420 term page: Cosmos DB Operator (Maintenance & Security)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Maintenance & Security

'''Summary:''' Provisions accounts, databases, and containers; cannot access data or use Data Explorer.

== Overview ==
Cosmos DB Operator is a built-in Azure RBAC (control-plane/ARM) role that lets you provision Azure Cosmos DB accounts, databases, and containers, but cannot access any data (item reads/writes) or use Data Explorer, and cannot read account keys/connection strings. It is distinct from Cosmos DB Account Reader Role (which can read account data), Cosmos Backup Operator (which manages periodic backup restore requests), and CosmosRestoreOperator (which restores continuous-backup accounts) — Cosmos DB Operator is purely about provisioning infrastructure.

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/databases#cosmos-db-operator Microsoft Learn: Azure built-in roles for Azure Cosmos DB]

== DP-420 Style Practice Questions ==
'''Q1.''' What can the Cosmos DB Operator built-in role do?
* A. Provision Azure Cosmos DB accounts, databases, and containers, without accessing data or using Data Explorer
* B. Read item data using Data Explorer
* C. Restore a deleted Azure Cosmos DB account
* D. Submit a periodic backup restore request

'''Q2.''' Why does the Cosmos DB Operator role exclude access to Data Explorer and account data?
* A. To enforce least privilege, separating infrastructure provisioning from data access
* B. Because it is a deprecated role
* C. Because it only applies to the MongoDB API
* D. Because data access is managed exclusively through Cosmos Backup Operator

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (Cosmos DB Operator):''' A. Provision Azure Cosmos DB accounts, databases, and containers, without accessing data or using Data Explorer — Cosmos DB Operator can provision accounts, databases, and containers, but explicitly cannot access data or use Data Explorer.
* '''Q2 (Cosmos DB Operator):''' A. To enforce least privilege, separating infrastructure provisioning from data access — Excluding Data Explorer/data access lets an operator provision resources (control plane) without being able to read or modify the actual data (data plane).

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Maintenance & Security]]

RBAC for Data Plane

2026-10-26T15:07:43Z

Anko: Recreated DP-420 term page: RBAC for Data Plane (Maintenance & Security)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Maintenance & Security

'''Summary:''' Fine-grained Microsoft Entra ID permissions for data operations, avoiding shared account keys.

== Overview ==
Azure Cosmos DB supports Azure role-based access control (RBAC) for data plane operations, allowing you to grant fine-grained permissions (read, write, specific operations) to Microsoft Entra ID identities for accessing data within containers, as an alternative or complement to using primary/secondary account keys, improving security by avoiding shared-secret key distribution.

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/security/how-to-grant-data-plane-role-based-access Microsoft Learn: Configure RBAC for data plane]

== DP-420 Style Practice Questions ==
'''Q1.''' What does data plane RBAC allow you to control in Azure Cosmos DB?
* A. Fine-grained permissions for Microsoft Entra ID identities to access and operate on data
* B. Which Azure regions data is replicated to
* C. The container's indexing policy
* D. The account's consistency level

'''Q2.''' What is an advantage of using Microsoft Entra ID-based data plane RBAC over primary/secondary account keys?
* A. It avoids distributing shared-secret keys and enables fine-grained, identity-based permissions
* B. It automatically enables multi-region writes
* C. It removes the need for TLS encryption
* D. It disables the need for a partition key

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (RBAC for Data Plane):''' A. Fine-grained permissions for Microsoft Entra ID identities to access and operate on data — Data plane RBAC controls what data operations specific Microsoft Entra ID identities are permitted to perform.
* '''Q2 (RBAC for Data Plane):''' A. It avoids distributing shared-secret keys and enables fine-grained, identity-based permissions — RBAC with Microsoft Entra ID avoids shared-secret key distribution and allows more granular, auditable access control.

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Maintenance & Security]]

Data Encryption Key (DEK)

2026-10-26T15:07:43Z

Anko: Recreated DP-420 term page: Data Encryption Key (DEK) (Maintenance & Security)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Maintenance & Security

'''Summary:''' for Always Encrypted in Azure Cosmos DB, you must use the Azure Cosmos DB SDK (C#, Java, or Node.js).

== Overview ==
Here is the sequence to create and use a Data Encryption Key (DEK):

# '''Create the Key Encryption Key (KEK):''' Before creating a DEK, you must create a master key in Azure Key Vault to protect it. Create a new RSA key in your vault, navigate to its current version, and copy the full Key Identifier (URI).
# '''Grant the Client Application Access to the KEK:''' The application running the Cosmos DB SDK needs permission to wrap and unwrap the DEK. Assign your application's Managed Identity permissions to the Key Vault to grant Get, List, Wrap Key, Unwrap Key, Verify, and Sign access.
# '''Initialize the Cosmos DB Client with a Key Resolver:''' In your application code, attach a Key Resolver to your Cosmos DB client instance so it can authenticate with Key Vault using the DefaultAzureCredential.
** '''C#:''' Use KeyResolver and .WithEncryption() when building the CosmosClient.
** '''Java:''' Use KeyEncryptionKeyClientBuilder.
** '''JavaScript/TypeScript:''' Pass an AzureKeyVaultEncryptionKeyResolver into the clientEncryptionOptions.

# '''Create the DEK via the SDK:''' Call the CreateClientEncryptionKey method on your Cosmos DB Database object, passing:
** A unique string identifier for this DEK.
** The encryption algorithm (AEAD_AES_256_CBC_HMAC_SHA256).
** The KEK URI you copied in the first step.

# '''Apply the DEK to a Container:''' When creating a new Cosmos DB container, define a ClientEncryptionPolicy. Specify which exact JSON properties should be encrypted, map them to your DEK's string identifier, and choose either Deterministic or Randomized encryption.

Once configured, your application will automatically request the wrapped DEK from Cosmos DB, decrypt it locally using Azure Key Vault, and seamlessly encrypt your properties before sending the data.

# Create DEK
<pre>
await database.CreateClientEncryptionKeyAsync(
id: "dek1",
encryptionAlgorithm:
DataEncryptionKeyEncryptionAlgorithm
.AeadAes256CbcHmacSha256,
encryptionKeyWrapMetadata: metadata);
</pre>
# Use encryption
<pre>
new CosmosClientBuilder(endpoint, credential)
.WithEncryption(keyResolver, keyStoreProvider)
.Build();
</pre>
# Create DEK
<pre>
await database.CreateClientEncryptionKeyAsync(
id: "dek1",
encryptionAlgorithm:
DataEncryptionKeyEncryptionAlgorithm
.AeadAes256CbcHmacSha256,
encryptionKeyWrapMetadata: metadata);
</pre>
# C# ClientEncryptionPolicy
<pre>
ClientEncryptionPolicy encryptionPolicy =
new ClientEncryptionPolicy(
new List
{
new ClientEncryptionIncludedPath
{
Path = "/email",
ClientEncryptionKeyId = "dek1",
EncryptionType =
ClientEncryptionEncryptionType.Deterministic,
EncryptionAlgorithm =
DataEncryptionKeyEncryptionAlgorithm
.AeadAes256CbcHmacSha256
},
new ClientEncryptionIncludedPath
{
Path = "/ssn",
ClientEncryptionKeyId = "dek1",
EncryptionType =
ClientEncryptionEncryptionType.Randomized,
EncryptionAlgorithm =
DataEncryptionKeyEncryptionAlgorithm
.AeadAes256CbcHmacSha256
}
});

ContainerProperties properties =
new ContainerProperties(
id: "Customers",
partitionKeyPath: "/customerId");

properties.ClientEncryptionPolicy = encryptionPolicy;

await database.CreateContainerAsync(properties);

//If the policy contains: Plain Text
// /email -> Deterministic
// SELECT * FROM c WHERE c.email = "john@contoso.com"
</pre>
# Create DEK
<pre>
CreateClientEncryptionKeyAsync()
</pre>

<pre>
1. Create KEK
2. Grant Key Vault permissions
3. Configure Cosmos Client
4. Create DEK
5. Create Encryption Policy
6. Create Container
7. Read/Write encrypted data
</pre>

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-setup-cmk Microsoft Learn: Customer-managed keys]

== DP-420 Style Practice Questions ==
'''Q1.''' What is the main advantage of using customer-managed keys (CMK) over platform-managed keys?
* A. Full control over encryption key management, rotation, and revocation via Azure Key Vault
* B. Lower cost than platform-managed keys
* C. Elimination of the need to configure network access control
* D. Automatic multi-region writes

'''Q2.''' Where are customer-managed keys typically stored and managed for Azure Cosmos DB?
* A. Azure Key Vault
* B. Inside the Cosmos DB container itself
* C. In the application's source code
* D. In Azure Active Directory Connect

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (Customer-Managed Keys):''' A. Full control over encryption key management, rotation, and revocation via Azure Key Vault — CMK gives the customer control over key lifecycle management, useful for meeting specific compliance requirements.
* '''Q2 (Customer-Managed Keys):''' A. Azure Key Vault — Customer-managed keys are stored and managed in Azure Key Vault, which Azure Cosmos DB references for encryption operations.

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Maintenance & Security]]

Customer-Managed Keys

2026-10-26T15:07:42Z

Anko: Recreated DP-420 term page: Customer-Managed Keys (Maintenance & Security)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Maintenance & Security

'''Summary:''' Encrypt data at rest using a key you control in Azure Key Vault.

== Overview ==
Customer-managed keys (CMK) allow you to encrypt Azure Cosmos DB data at rest using an encryption key that you control and manage in Azure Key Vault, rather than relying solely on Microsoft's platform-managed keys. This gives organizations control over key rotation, revocation, and compliance requirements, at the cost of additional operational responsibility for key management.

# '''Step 1: Prepare the Azure Key Vault''' Create or select an Azure Key Vault. You must ensure three specific settings are configured on the vault:
** Soft Delete and Purge Protection must be enabled (required by Cosmos DB to prevent accidental key loss).
** Permission model must be set to Azure role-based access control (RBAC) (required to grant permissions to a specific key rather than the whole vault).

# '''Step 2: Generate the Key and Assign Granular Permissions''' Inside your Key Vault, generate the encryption key and immediately lock down who can use it:
** Generate a new key (an RSA key size of 3072 or higher is recommended).
** Once generated, select that specific key, click on its Access control (IAM) menu, and add a role assignment.
** Assign the Key Vault Crypto Service Encryption User role to the Azure Cosmos DB principal.
** Before leaving the screen, copy the key's Key Identifier (URI).

# '''Step 3: Create the Azure Cosmos DB Account''' During the creation of your new Azure Cosmos DB account in the Azure portal, navigate to the Encryption tab. Select Customer-managed key and paste the Key URI you copied in Step 2. Cosmos DB will validate its access to that specific key and encrypt the new account.

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-setup-cmk Microsoft Learn: Customer-managed keys]

== DP-420 Style Practice Questions ==
'''Q1.''' What is the main advantage of using customer-managed keys (CMK) over platform-managed keys?
* A. Full control over encryption key management, rotation, and revocation via Azure Key Vault
* B. Lower cost than platform-managed keys
* C. Elimination of the need to configure network access control
* D. Automatic multi-region writes

'''Q2.''' Where are customer-managed keys typically stored and managed for Azure Cosmos DB?
* A. Azure Key Vault
* B. Inside the Cosmos DB container itself
* C. In the application's source code
* D. In Azure Active Directory Connect

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (Customer-Managed Keys):''' A. Full control over encryption key management, rotation, and revocation via Azure Key Vault — CMK gives the customer control over key lifecycle management, useful for meeting specific compliance requirements.
* '''Q2 (Customer-Managed Keys):''' A. Azure Key Vault — Customer-managed keys are stored and managed in Azure Key Vault, which Azure Cosmos DB references for encryption operations.

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Maintenance & Security]]

Continuous Backup & Point-in-Time Restore

2026-10-26T15:07:42Z

Anko: Recreated DP-420 term page: Continuous Backup & Point-in-Time Restore (Maintenance & Security)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Maintenance & Security

'''Summary:''' Continuous backups enabling self-service restore to any timestamp in the retention window.

== Overview ==
Continuous backup mode continuously backs up Azure Cosmos DB data, enabling self-service point-in-time restore (PITR) to any timestamp within the retention period (7 or 30 days depending on tier), without needing to contact support. This is useful for recovering from accidental data deletion/corruption or application bugs with much finer granularity than periodic backup.

Azure Cosmos DB accounts with periodic mode backup policy can be migrated to continuous mode using the Azure portal, Azure CLI, Azure PowerShell, or Bicep templates. Migration from periodic to continuous mode is one-way and isn't reversible. After you migrate from periodic to continuous mode, you get the benefits of continuous mode.

<pre>
// Set the backup policy for the Azure Cosmos DB account
AccountUpdateParameters accountUpdateParameters = new AccountUpdateParameters()
{
BackupPolicy = new ContinuousBackupPolicy()
{
Type = BackupPolicyType.Continuous,
}
};

await databaseAccount.ReplaceAccountAsync(accountUpdateParameters);
</pre>

<pre>
az cosmosdb update --resource-group "" --name "" \
--backup-policy-type "Continuous" --continuous-tier "Continuous7Days"
</pre>
'''Feature / Configuration''' '''Periodic Backup (Default)''' '''Continuous Backup (Point-in-Time)''' '''Restore Mechanism''' Requires submitting an Azure support ticket. Self-service Point-in-Time Restore (PITR) via portal/CLI. '''Retention Window''' Configurable up to 1 month (720 hours). Fixed tiers: 7-day, 30-day, or 35-day. '''Backup Interval''' Configurable (minimum 1 hour). Continuous ongoing backup (no interval required). '''Storage Redundancy''' Replicated to a paired region via Geo-Redundant Storage (GRS). Stored locally in the account's existing regions (not automatically geo-resistant). '''Supported APIs''' All Azure Cosmos DB APIs. SQL, MongoDB, Gremlin, and Table (Cassandra is not supported). '''Cost Structure''' Default (2 copies) is free. Billed for additional copies/retention. 7-day storage is free. 30/35-day tiers incur storage costs. All restores incur a fee. '''Migration''' Can be migrated to Continuous mode. '''One-way only:''' Cannot revert back to Periodic.
<pre>
Restored
Data plane
Databases
Containers
Items/documents
Throughput

❌ Not restored
Control plane
Networking
Security
Regional settings
Consistency settings
Programmability objects (Sprocs, Triggers, UDFs)
External integrations
</pre>

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/cosmos-db/continuous-backup-restore-introduction Microsoft Learn: Continuous backup and point-in-time restore]

== DP-420 Style Practice Questions ==
'''Q1.''' What capability does continuous backup mode enable that periodic backup does not?
* A. Self-service point-in-time restore to any timestamp within the retention window
* B. Multi-region writes
* C. Automatic index optimization
* D. Free throughput

'''Q2.''' Do you need to contact Microsoft support to perform a restore under continuous backup mode?
* A. No, restores can be self-service, initiated by the account owner
* B. Yes, a support ticket is always required
* C. Only for restores older than 24 hours
* D. Only when using the Cassandra API

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (Continuous Backup & Point-in-Time Restore):''' A. Self-service point-in-time restore to any timestamp within the retention window — Continuous backup enables self-service point-in-time restore to virtually any moment within the retention period.
* '''Q2 (Continuous Backup & Point-in-Time Restore):''' A. No, restores can be self-service, initiated by the account owner — Continuous backup allows account owners to self-service restore without needing to open a support request.

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Maintenance & Security]]

Periodic Backup

2026-10-26T15:07:41Z

Anko: Recreated DP-420 term page: Periodic Backup (Maintenance & Security)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Maintenance & Security

'''Summary:''' Original backup mode; scheduled snapshots, typically restored via a support request.

== Overview ==
Periodic backup is Azure Cosmos DB's original backup mode, which automatically takes backups of the account at a configurable interval (default every 4 hours) and retains a configurable number of backups, allowing restoration of an entire account to a previous backup point — typically requiring a support request to restore, and offering less granularity than continuous backup.

'''Exam shortcut:''' "Where are Periodic Backup backups stored by default?" → In the write region and geo-replicated to the Azure paired region (GRS).

* Periodic Backup → Contact Microsoft/Azure Support ✅
* Continuous Backup → Use self-service restore (RBAC permissions required) ✅

<pre>
| Backup type | CosmosRestoreOperator needed? |
| ----------- | ----------------------------- |
| Periodic | **No** |
| Continuous | **Yes** |
</pre>

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/cosmos-db/periodic-backup-restore-introduction Microsoft Learn: Periodic backup mode]

== DP-420 Style Practice Questions ==
'''Q1.''' How does periodic backup mode restore data?
* A. By restoring from the most recent scheduled backup snapshot, typically via a support request
* B. Automatically, to any exact second within the retention window, without support involvement
* C. Only by exporting a manual snapshot triggered by the developer
* D. By replaying the change feed from the beginning

'''Q2.''' What is a key limitation of periodic backup compared to continuous backup?
* A. Restores are limited to the granularity of the scheduled backup interval, not an exact point in time
* B. Periodic backup cannot be configured with any retention period
* C. Periodic backup only works with the MongoDB API
* D. Periodic backup requires multi-region writes to be enabled

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (Periodic Backup):''' A. By restoring from the most recent scheduled backup snapshot, typically via a support request — Periodic backup restores from scheduled backup snapshots and traditionally requires contacting support to initiate.
* '''Q2 (Periodic Backup):''' A. Restores are limited to the granularity of the scheduled backup interval, not an exact point in time — Periodic backup only allows restoring to backup snapshot points, unlike continuous backup's fine-grained point-in-time restore.

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Maintenance & Security]]

KQL (Kusto Query Language)

2026-10-26T15:07:41Z

Anko: Recreated DP-420 term page: KQL (Kusto Query Language) (Maintenance & Security)

← Back to [[DP-420: Azure Cosmos DB Developer Specialty|DP-420 Terminology Reference]]

'''Category:''' Maintenance & Security

'''Summary:''' Query language used in Azure Monitor Log Analytics to analyze Cosmos DB diagnostic logs and metrics.

== Overview ==
KQL (Kusto Query Language) is the read-only query language used to explore, analyze, and aggregate telemetry and diagnostic data in Azure Monitor Log Analytics, Azure Data Explorer, and Microsoft Fabric Real-Time Intelligence. In the context of Azure Cosmos DB and the DP-420 exam, KQL is used to query diagnostic log tables — such as CDBDataPlaneRequests, CDBQueryRuntimeStatistics, CDBPartitionKeyRUConsumption, and CDBControlPlaneRequests (or legacy AzureDiagnostics) — to analyze RU consumption patterns, troubleshoot HTTP 429 throttling errors, identify hot partitions, and pinpoint high-cost or slow queries. KQL queries are built using a pipeline model where data flows from left to right through tabular operators separated by the pipe (|) character, such as where, project, summarize, join, order by, and render.

Example 1 (KQL): Find operations throttled with HTTP 429 status code

<pre>
CDBDataPlaneRequests
| where TimeGenerated > ago(24h)
| where StatusCode == 429
| summarize Count429 = count() by bin(TimeGenerated, 5m), OperationName, PartitionKey
| order by Count429 desc
</pre>

This query identifies requests that were rate-limited (HTTP 429) across 5-minute intervals in the last 24 hours, grouping by operation and partition key to isolate hot partitions causing throttling.

Example 2 (KQL): Correlate high RU queries with query text

<pre>
CDBDataPlaneRequests
| where TimeGenerated > ago(1h) and todouble(RequestCharge) > 50.0
| project TimeGenerated, ActivityId, RequestCharge, DurationMs
| join kind=inner (
CDBQueryRuntimeStatistics
| project ActivityId, QueryText
) on $left.ActivityId == $right.ActivityId
| order by RequestCharge desc
| limit 20
</pre>

This query correlates request execution telemetry from <code>CDBDataPlaneRequests</code> with query text from <code>CDBQueryRuntimeStatistics</code> via <code>ActivityId</code> to find the top 20 most expensive queries.

== More Info & Links ==
* [https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/log-analytics/tutorial-kql Microsoft Learn: Tutorial - Write KQL queries to monitor Azure Cosmos DB]
* [https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/ Microsoft Learn: Overview of Kusto Query Language (KQL)]
* [https://learn.microsoft.com/en-us/azure/cosmos-db/monitor-resource-logs Microsoft Learn: Monitor and troubleshoot Azure Cosmos DB using diagnostic logs]

== DP-420 Style Practice Questions ==
'''Q1.''' What is the primary role of KQL (Kusto Query Language) in Azure Cosmos DB operations and troubleshooting?
* A. Querying and analyzing diagnostic logs and metrics in Azure Monitor Log Analytics to troubleshoot issues like throttling, hot partitions, and expensive queries
* B. Defining server-side stored procedures and triggers directly in Cosmos DB containers
* C. Querying JSON documents via the Cosmos DB API for NoSQL endpoint
* D. Creating and managing Cosmos DB indexing policies declaratively

'''Q2.''' In a KQL query for Azure Cosmos DB logs, what does the pipe (|) operator represent?
* A. It pipes the tabular output of the preceding operator as the input to the next operator in a data-flow pipeline
* B. It performs a logical bitwise OR between two numeric fields
* C. It defines a primary key constraint on the diagnostic table
* D. It separates alternative partition key values in a point read

'''Q3.''' Which resource-specific table would you query using KQL to inspect RU charges and HTTP status codes for individual data operations?
* A. CDBDataPlaneRequests
* B. CDBControlPlaneRequests
* C. CDBPartitionKeyStatistics
* D. AzureMetrics

== Answer Key ==
''Answers are listed at the very end so you can attempt the questions first.''

* '''Q1 (KQL (Kusto Query Language)):''' A. Querying and analyzing diagnostic logs and metrics in Azure Monitor Log Analytics to troubleshoot issues like throttling, hot partitions, and expensive queries — KQL is the read-only query language for Azure Monitor Log Analytics used to analyze diagnostic logs like CDBDataPlaneRequests and CDBPartitionKeyRUConsumption.
* '''Q2 (KQL (Kusto Query Language)):''' A. It pipes the tabular output of the preceding operator as the input to the next operator in a data-flow pipeline — KQL uses the pipe (|) operator to pass data sequentially from one tabular expression/operator to another (e.g., filtering with where, then aggregating with summarize).
* '''Q3 (KQL (Kusto Query Language)):''' A. CDBDataPlaneRequests — CDBDataPlaneRequests logs individual data-plane operations along with RequestCharge, StatusCode, DurationMs, and ActivityId.

----
''DP-420: Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB — term detail page''

[[Category:DP-420 Terminology]]
[[Category:Maintenance & Security]]