ExamSprintLab

Certification topics explained

Some topics show up on many exams and in many vendors’ skills outlines. Each guide here explains one topic in plain language, shows which exams test it, lists the traps exam questions build around it and ends with free practice questions. Pick a topic, then follow the links to the exam sections that cover it.

Identity and access

  1. AAA authentication, authorization, accountingAAA explained through one login: authentication, authorization and accounting, RADIUS vs TACACS+, a Cisco config sketch and the exam traps.
  2. Access reviews and entitlement managementEntitlement management grants and expires access; access reviews re-check it. Follow one guest through the lifecycle and learn the settings exams test.
  3. AWS IAM basics: roles, policies, evaluationAWS IAM for AI and ML exams: roles versus users, policy types, how allow and deny combine, and why roles beat access keys for SageMaker and Bedrock.
  4. Azure RBAC vs Microsoft Entra rolesAzure RBAC roles manage Azure resources, Microsoft Entra roles manage the directory. A decision table, the Global Administrator exception and exam traps.
  5. Conditional Access explained for examsConditional Access in Microsoft Entra as exam questions use it: signals, grant and block decisions, how stacked policies combine, and the traps to avoid.
  6. Entra Connect Sync vs Cloud SyncEntra Connect Sync or Entra Cloud Sync? A decision table, the sign-in method that is separate from sync, and the constraint words exam questions use.
  7. Entra External ID: B2B vs B2C explainedB2B collaboration, B2B direct connect, external tenants and Azure AD B2C: which one to pick, what B2C's end of sale means, and what SC-300 and AZ-104 test.
  8. Entra ID Protection and risk policiesMicrosoft Entra ID Protection explained as one incident: detections, user risk versus sign-in risk, risk levels, policies, remediation and licence traps.
  9. Managed identities vs service principalsChoose between managed identities, service principals and workload identity federation: a four-question decision path and the exam traps.
  10. MFA, passwordless and passkeys explainedRank Microsoft Entra sign-in methods from password to passkey: MFA, passwordless, phishing-resistant, authentication strengths and the exam traps.
  11. Privileged Identity Management (PIM)How Microsoft Entra PIM works for exams: eligible vs active roles, activation settings, approval, access reviews and when to pick PIM over other tools.
  12. SSO, SAML, OAuth and OIDC explainedSingle sign-on is the goal; SAML and OpenID Connect prove who you are; OAuth 2.0 delegates access. A decision table and two practice questions.

Security operations and concepts

  1. Backup types, RTO and RPO explainedFull, incremental and differential backups, RTO and RPO, MTTR and MTBF, and hot, warm and cold sites, with a worked restore example for exam scenarios.
  2. Common attack types: tell them apart on examsPhishing, injection, XSS, CSRF, on-path, DoS, password attacks and more: the clue in the scenario that identifies each attack, and the control that stops it.
  3. Cryptography basics for security examsSymmetric, asymmetric, hashing and PKI: which tool gives confidentiality, integrity or authentication, and how to pick the right one in an exam.
  4. Defender for Endpoint: plans, ASR, responseMicrosoft Defender for Endpoint for SC-200 and SC-900: Plan 1 vs Plan 2, ASR rule modes, device groups, automation levels, isolation and live response.
  5. Defender XDR vs Defender for CloudDefender XDR protects users, devices, email and apps; Defender for Cloud protects cloud resources. A decision table for the look-alike Defender products.
  6. Digital forensics and chain of custodyHow to collect digital evidence in the right order, keep a chain of custody, prove integrity with hashes and tell legal hold from e-discovery on exams.
  7. Incident response lifecycle: order of stepsThe incident response phases in order, how NIST SP 800-61 Rev. 2 and Rev. 3 differ, and how to pick the right next step in an exam scenario.
  8. KQL cheat sheet for certification examsKQL cheat sheet for exams: the pipe model, where, project, summarize, join kinds, has vs contains and time filters, plus the traps questions set.
  9. Microsoft Sentinel explained for examsMicrosoft Sentinel is a cloud SIEM with SOAR. Follow data from connector to incident to playbook, and learn which rule or automation type each question wants.
  10. NIST CSF, SP 800-53, ISO 27001, CIS ControlsNIST CSF 2.0, NIST SP 800-53, ISO/IEC 27001 and CIS Controls compared: what each is for, which one is certifiable, and how exams word the choice.
  11. Performance-based question practice tasksFour original simulation-style practice tasks (firewall rule order, log analysis, port choice, control types) with worked answers for CompTIA-style PBQs.
  12. Qualitative vs quantitative risk: SLE, ARO, ALEQualitative risk uses ratings, quantitative uses money. Worked SLE, ARO and ALE calculation, the cost-of-control test and how exams phrase it.
  13. Security control categories and typesSecurity control categories (technical, managerial, physical, operational) versus types (preventive, detective...), with a method to classify any control.
  14. Security+ acronyms grouped by exam domainSecurity+ acronyms explained in groups that follow the five SY0-801 domains, with the look-alike pairs that exam questions use as distractors.
  15. SIEM vs SOAR vs XDR: which tool does whatSIEM collects and correlates logs, SOAR automates the response, XDR joins detection across endpoint, identity and email. How exams separate the three.
  16. Vulnerability management and CVSS scoringHow CVSS scores severity, how CVE, EPSS and asset context change priority, and the scan, prioritise, remediate, verify loop that exams test.
  17. Zero Trust explained for security examsZero Trust means never trusting a request because of where it comes from. The three principles, the policy components and how exams phrase the question.

Data protection and compliance

  1. Data classification in Microsoft PurviewSensitive information types, EDM, document fingerprinting and trainable classifiers compared, with confidence levels and how to pick the right one.
  2. DLP explained: Microsoft Purview policiesMicrosoft Purview DLP in plain terms: locations, conditions, actions, rule priority and the rollout stages, with the traps exam questions build on them.
  3. Insider Risk Management in PurviewHow Purview Insider Risk Management turns user activity into alerts and cases: templates, triggers, privacy, roles, and where it differs from DLP.
  4. Purview eDiscovery: search, hold, review, exportHow Microsoft Purview eDiscovery works for SC-900, SC-200, SC-401 and AB-900: Content search, cases, holds, review sets, roles and Standard vs Premium.
  5. Retention labels vs retention policiesRetention policies work on locations, retention labels on single items. When to use each, how conflicts resolve and what records change.
  6. Sensitivity labels explainedSensitivity labels classify and protect Microsoft 365 content: scopes, policies, defaults, priority, auto-labeling and the traps exam questions set.

Azure infrastructure

  1. App Service plans: tiers, scaling and sharingAn App Service plan is the set of VMs your apps run on. Learn what each tier unlocks, scale up vs scale out, and when to split apps into separate plans.
  2. Availability sets vs availability zonesAvailability sets protect VMs from rack and maintenance failures in one datacenter, zones from a datacenter loss. Decision table, example and exam traps.
  3. Azure Backup vs Site Recovery explainedAzure Backup restores data from a point in time, Site Recovery fails whole VMs over to another site. RPO and RTO worked example, vault types, traps.
  4. Azure Firewall vs NSG vs WAF: which to pickPick between NSG, Azure Firewall and Web Application Firewall by the layer each one filters, where it sits and what the exam scenario says it must block.
  5. Azure Functions triggers and bindingsCheat sheet for Azure Functions triggers and bindings: what exists, Python v2 syntax, auth levels, timer cron and retry defaults, with exam traps.
  6. Azure governance design for AZ-305Design Azure governance the AZ-305 way: management groups, subscriptions, Policy, RBAC and landing zones, with a decision table and a worked hierarchy.
  7. Azure Key Vault: access, network and recoveryAzure Key Vault holds secrets, keys and certificates. See the four gates a request passes: network, identity, role and deletion protection.
  8. Azure load balancing options comparedChoose between Azure Load Balancer, Application Gateway, Front Door and Traffic Manager with three questions on layer, scope and DNS versus proxy.
  9. Azure Monitor and Log Analytics explainedHow Azure Monitor collects metrics and logs, what a diagnostic setting does, how to design Log Analytics workspaces, and which alert type to pick.
  10. Azure Policy vs RBAC vs resource locksRBAC controls who may act, Azure Policy controls what may exist, locks stop delete or change for everyone. A phrase-to-tool cheat sheet with exam traps.
  11. Azure Resource Hierarchy ExplainedManagement groups, subscriptions, resource groups and resources: what each level holds, what inherits, what does not, and how exams test it.
  12. Azure Storage redundancy: LRS to RA-GZRSPick between LRS, ZRS, GRS, GZRS and the read-access variants by the failure you must survive. Decision table, worked example and exam traps.
  13. Azure Storage Types: Blob, Files, Disks, QueueWhich Azure storage service and account type fits which data: blobs, files, queues, tables, disks, premium accounts and access tiers, with exam traps.
  14. Azure VMs, Availability Sets and Scale SetsHow a single Azure VM, an availability set and a Virtual Machine Scale Set differ, Flexible vs Uniform orchestration, autoscale, and the exam traps.
  15. Azure VNets, subnets and peering explainedHow Azure virtual networks, subnets and peering fit together: address planning, the five reserved addresses and why peering is not transitive.
  16. Choosing an Azure compute servicePick between Azure VMs, App Service, Functions, Container Apps and AKS by how much you manage, what you deploy and how it scales, with exam traps.
  17. NSG rule evaluation in AzureHow Azure network security groups decide: priority order, the six default rules, subnet plus NIC NSGs and effective rules, traced with packet examples.
  18. Private endpoint vs service endpoint in AzurePrivate endpoint or service endpoint? What each does to the IP address, DNS and public access, with an example of locking a storage account to a VNet.
  19. SAS tokens and stored access policiesThree SAS types, why a leaked token cannot be revoked on its own, and how stored access policies and user delegation keys change the answer.
  20. Shared Responsibility Model: IaaS, PaaS, SaaSWho secures what in IaaS, PaaS and SaaS: the Azure responsibility matrix, the AWS 'of the cloud' vs 'in the cloud' split and how exam questions test it.

DevOps

  1. Ansible vs Terraform: which tool for whatAnsible vs Terraform for exams: Terraform provisions infrastructure and tracks state, Ansible configures systems over SSH. Decision table and questions.
  2. ARM templates vs Bicep vs TerraformARM templates, Bicep and Terraform compared for Azure: how each deploys, where state lives, what-if versus plan, and which one an exam scenario wants.
  3. CI/CD explained: pipeline stages and gatesContinuous integration, continuous delivery and continuous deployment told apart, with pipeline stages, approvals and gates walked through for exams.
  4. Docker basics: images, containers, DockerfileDocker basics for exams: image vs container, Dockerfile instructions, port publishing, volumes and layer caching, with a worked build and run.
  5. Git branching strategies comparedTrunk-based development, GitHub flow, GitFlow and release branches compared by team size, release cadence and versions supported, with exam-style traps.
  6. IaC: declarative vs imperative explainedDeclarative and imperative infrastructure as code compared: idempotence, state, what-if and plan, Bicep, Terraform, Ansible and scripts, with exam traps.
  7. Kubernetes and AKS basics for examsKubernetes and Azure Kubernetes Service basics: pods, Deployments, Services, node pools, scaling and the AKS control plane, plus how exams choose AKS.
  8. YAML pipelines basics: Azure and GitHubA cheat sheet for YAML pipelines: the structure of Azure Pipelines and GitHub Actions files, triggers, stages, jobs, steps, conditions and approvals.

Networking

  1. ACLs explained: wildcard masks and orderCisco access lists for the CCNA: standard vs extended, wildcard mask arithmetic, top-down order, implicit deny and where to apply them, with worked lists.
  2. Administrative distance and the routing tableRead a routing table the way CCNA and Network+ expect: longest prefix first, then administrative distance, then metric, with a line-by-line show ip route.
  3. BGP basics: what to know for Network+BGP at exam depth: autonomous systems, eBGP vs iBGP, AS path, how it differs from OSPF and EIGRP, and the AD values 20 and 200 you may be asked.
  4. Cabling and Connectors: Cat6, Fiber, SFPPick the right network cable and connector: UTP categories, single-mode vs multimode fiber, DAC, RJ45, LC, SC, SFP and the faults each causes.
  5. Common ports cheat sheet: secure vs insecureWell-known TCP and UDP ports for Network+ and Security+, grouped by job, with each insecure protocol paired to its encrypted replacement.
  6. DHCP and DNS: DORA, relay, records, lookupsDHCP and DNS for Network+ and CCNA: DORA, relay agents, lease timers, record types and the resolution path, in one plug-in-to-browser example.
  7. EtherChannel and LACP: bundle links on a switchEtherChannel and LACP for the CCNA and Network+: why bundle links, active/passive modes, matching rules, load balancing and show etherchannel summary.
  8. HSRP and VRRP: first hop redundancy explainedFirst hop redundancy for the CCNA and Network+: how HSRP and VRRP share a virtual gateway IP, priority, preemption, states and how to read the output.
  9. IPv4 vs IPv6: addressing, SLAAC, dual stackIPv4 vs IPv6 for exam day: 128-bit notation, address types, SLAAC and EUI-64 with a worked example, DHCPv6, dual stack and what replaced broadcast.
  10. JSON vs YAML vs XML: formats and pitfallsThe same VLAN data in JSON, YAML and XML, how Python parses each, the pitfalls exams and real configs hit, and where each format appears in automation.
  11. NAT types: static, dynamic and PATNAT for the CCNA: static, dynamic and PAT overload, the four inside/outside local/global terms, and how to read a translation table, with worked examples.
  12. Network troubleshooting: commands and methodThe troubleshooting steps in order, plus which command answers which question (ping, traceroute, nslookup, netstat, show commands), with a worked fault.
  13. OSI vs TCP/IP model: layers and mappingThe OSI model and the TCP/IP model side by side: layer mapping, PDU names, devices per layer and how to use the layers to troubleshoot exam scenarios.
  14. OSPF explained: states, DR/BDR and costOSPF as the CCNA tests it: how two routers reach Full, what each neighbor state means when stuck, DR/BDR election, cost arithmetic and areas.
  15. Python for network engineers: the exam subsetThe Python a 200-901 candidate needs: data types, loops, functions, JSON, the requests library and try/except, with snippets that were run and checked.
  16. REST API basics: methods, status codes, authREST API basics for 200-901 and CCNA v1.1: HTTP methods, idempotency and safe retries, status codes, auth headers and pagination, traced through one request.
  17. REST vs NETCONF vs RESTCONF and YANGREST, NETCONF and RESTCONF compared for 200-901 CCNA Automation: one interface change done three ways, what YANG models, ports, encodings and exam traps.
  18. Spanning Tree Protocol: roles, states, rootSTP and Rapid PVST+ for the CCNA: root bridge election, root, designated and alternate ports, discarding/learning/forwarding, PortFast and BPDU guard.
  19. Static vs dynamic routing: when to use whichStatic versus dynamic routing for CCNA and Network+: a decision table by scenario, default and floating static routes, and how protocol families differ.
  20. Subnetting step by step, with worked examplesIPv4 subnetting without a calculator: the block-size method, four fully worked examples, VLSM planning and a CIDR table for CCNA and Network+.
  21. Switch, router, firewall, IDS and IPS comparedWhat a switch, router, firewall, IDS and IPS each look at and decide, followed through one packet, with placement rules and the traps in exam questions.
  22. VLANs and trunking: 802.1Q, native VLAN, routingVLANs and 802.1Q trunking as CCNA tests them: access vs trunk ports, the native VLAN mismatch, inter-VLAN routing and a build-and-debug walkthrough.
  23. VPN types and IPsec: AH, ESP and IKESite-to-site, client-to-site, clientless, split and full tunnels, plus IPsec AH vs ESP, tunnel vs transport mode and IKE, with a worked packet.
  24. Wireless networking: 802.11, bands, WPA3, APsWi-Fi for Network+ and CCNA: 802.11 generations, 2.4/5/6 GHz trade-offs, SSID vs BSSID, WPA2 vs WPA3 and controller-based vs autonomous access points.

Data and analytics

  1. Auto Loader: incremental file ingestionDatabricks Auto Loader for exams: cloudFiles, checkpoints, schema evolution modes, directory listing vs file notification, and Auto Loader vs COPY INTO.
  2. Batch vs streaming: how to chooseBatch, micro-batch and streaming compared for DP-700 and Databricks exams: latency needs, event time, watermarks, checkpoints and Fabric Eventstreams.
  3. Databricks compute types: all-purpose, job, SQLDatabricks compute types compared: serverless, all-purpose, job compute and SQL warehouses, plus access modes and the cluster-to-compute wording change.
  4. DAX basics: filter context and CALCULATEDAX basics for PL-300 and DP-600: row context vs filter context, how CALCULATE rewrites filters, and the percent-of-total pattern, with practice questions.
  5. Delta Lake explained: log, ACID, time travelDelta Lake in plain terms for exams: the transaction log, ACID writes, time travel, OPTIMIZE versus VACUUM, and the traps in Databricks and Fabric questions.
  6. Delta Sharing (now OpenSharing) explainedDelta Sharing, called OpenSharing in current Databricks docs: providers, shares, recipients, Databricks-to-Databricks vs open sharing, worked setup.
  7. Lakeflow Declarative Pipelines (ex-DLT)Lakeflow Declarative Pipelines, formerly Delta Live Tables: streaming tables vs materialized views, expectations, AUTO CDC and the names exams use.
  8. Lakehouse vs warehouse: Fabric and DatabricksFabric lakehouse, Fabric warehouse and the Databricks lakehouse compared, with a three-question decision framework and the traps exam questions set.
  9. Medallion architecture: bronze, silver, goldBronze, silver and gold layers walked through with a Delta table example in Databricks and Fabric, plus the traps exams set about what belongs where.
  10. OneLake shortcuts: rules, limits, securityHow Microsoft Fabric OneLake shortcuts work: where they live, what they point to, delete behaviour, permissions, caching and the DP-700 decisions.
  11. Power Query basics: steps, M and query foldingPower Query for PL-300 and Fabric Dataflow Gen2: applied steps and M, what query folding is and what breaks it, merge versus append, with a worked example.
  12. Row-level security: Power BI, Fabric and SQLRow-level security for PL-300, DP-600, DP-700 and DP-800, plus Databricks row filters: static vs dynamic RLS, OLS, SQL security policies, who bypasses them.
  13. Semantic model storage modes: Import, DirectQueryImport, DirectQuery, Dual, Direct Lake and composite models in Power BI and Fabric: what each does and the constraint words that decide exam answers.
  14. Spark basics: transformations, actions, shufflesApache Spark in exam terms: lazy transformations versus actions, partitions, shuffles, jobs and stages, traced step by step through one DataFrame query.
  15. SQL joins and window functions with resultsJoins and window functions shown with real result tables: inner vs left join, anti join, ROW_NUMBER, RANK, running totals, LAG. For DP-800 and Databricks.
  16. Star schema and relationships in Power BIStar schema for PL-300 and DP-600: facts versus dimensions, one-to-many cardinality, filter direction, bridge tables and role-playing dates, with questions.
  17. Unity Catalog explained: grants and storageUnity Catalog for Databricks and DP-750 exams: metastore, catalog.schema.table, privilege inheritance, volumes versus external locations, with a worked grant.

AI

  1. AI agents explained: tools, memory, guardrailsWhat an AI agent is, how tools, memory, planning and guardrails fit together, and how Copilot Studio, Foundry and Agentforce use the term on exams.
  2. AI governance: NIST AI RMF, ISO 42001, EU AI ActNIST AI RMF, ISO/IEC 42001 and EU AI Act risk tiers compared: voluntary framework, certifiable standard, binding law, and how exams test it.
  3. AWS AI services: match the service to the taskRekognition, Textract, Comprehend, Transcribe, Translate, Polly, Lex, Personalize: input-to-output cheat sheet, closed services, two practice questions.
  4. Bedrock vs SageMaker AI: which one to pickAmazon Bedrock or SageMaker AI? A decision table for AIF-C01 and MLA-C02 scenarios, with pricing shape, customization paths and two practice questions.
  5. Copilot vs Copilot Studio vs Foundry vs GitHubWhich Microsoft AI product is which: Microsoft 365 Copilot, Copilot Studio, Foundry and GitHub Copilot, with a decision table for AB and AI exams.
  6. Embeddings and vector search for AI examsEmbeddings turn text into vectors so search matches meaning. Cosine similarity, KNN vs HNSW, hybrid search with RRF, exam traps and two practice questions.
  7. Fine-tuning vs RAG vs promptingHow to choose between prompt engineering, RAG and fine-tuning for a generative AI requirement, with a decision table, a worked example and exam traps.
  8. LLM Evaluation: Metrics and LLM-as-JudgeHow LLM applications are evaluated: offline versus online, groundedness, relevance, ROUGE, BLEU, BERTScore and LLM-as-a-judge, with exam traps.
  9. MLflow basics: tracking, models, registryMLflow cheat sheet for ML exams: runs, params, metrics, artifacts, model flavors, the registry with aliases, and MLflow on Databricks, SageMaker, Azure ML.
  10. MLOps Basics: Registry, CI/CD, DriftMLOps basics for certification exams: model registry, CI/CD for ML, monitoring, data versus concept drift and retraining with a validation gate.
  11. Overfitting and ML Metrics ExplainedOverfitting, underfitting, train/validation/test splits and accuracy, precision, recall, F1 and AUC, worked through one confusion matrix you can verify.
  12. Prompt engineering basics: five fixes in orderPrompt engineering for AI-901, AIF-C01 and AB-730: instructions, examples, structure, grounding and temperature, with a worked rewrite and two questions.
  13. RAG explained: chunking, embeddings, retrievalRetrieval-augmented generation for exams: the pipeline from chunking to grounding, which stage to fix for which symptom, and two practice questions.
  14. Responsible AI principles: Microsoft vs AWSMicrosoft's six responsible AI principles, AWS's eight dimensions and content safety guardrails: how AI-901, AIF-C01 and AB-731 test them.
  15. SageMaker AI components along the ML lifecycleWhich SageMaker AI feature does what, stage by stage, which ones are closed to new customers in 2026, and how to choose an inference option. Two questions.

US tax

  1. Business entity types compared for US taxSole proprietorship, partnership, C corporation, S corporation and LLC: how each is taxed for 2025, which return it files and how SEE Part 2 tests it.
  2. Capital gains and losses: netting and ratesHow US capital gains and losses are netted for tax year 2025: holding period, short/long-term buckets, the $3,000 loss limit, carryovers and rates.
  3. Circular 230 basics for the SEE examCircular 230 (31 CFR Part 10) sets who may practise before the IRS and the duties they owe: diligence, conflicts, fees, records, sanctions. Exam guide.
  4. Depreciation and MACRS: 179, bonus, recoveryHow business assets are depreciated for tax year 2025: section 179, 100% bonus, MACRS classes and conventions, with a worked example and recapture.
  5. EIC due diligence for paid preparersThe earned income credit for tax year 2025 and the paid-preparer due diligence rules: Form 8867, the four requirements, record retention and penalty.
  6. Filing status: the five statuses and their testsThe five US filing statuses for tax year 2025 and the order to test them in: marital status on December 31, head of household and surviving spouse rules.
  7. Preparer penalties: IRC 6694 and 6695Which Internal Revenue Code penalties hit a paid return preparer: 6694(a) vs (b), the 6695 paperwork failures and due diligence, with a worked example.
  8. Schedule C and self-employment taxHow a sole proprietor's profit flows from Schedule C to Schedule SE and Form 1040 for tax year 2025, with a full self-employment tax calculation.
  9. Standard vs itemized deduction: how to chooseStandard or itemized deduction for tax year 2025: the amounts, who must itemize, the SALT cap and medical floor, and a worked comparison for exam day.
  10. Tax basis: how to find it for any assetBasis rules for tax year 2025: cost, gifted, inherited and converted property, stock splits, partner and S corporation basis, with worked examples.