- Under the shared responsibility model, which set of items remains the customer's responsibility no matter which cloud service type is used?
- Physical datacenter security and host infrastructure
- Power, cooling, and physical disks
- The hypervisor and physical network
- Information, devices, and accounts and identities
Correct answer: Information, devices, and accounts and identities
Information and data, devices, and accounts and identities always stay with the customer across IaaS, PaaS, and SaaS. The provider permanently owns physical datacenter security, host infrastructure, and the physical network, which never shift to the customer.
- A team migrates a web app from on-premises servers to Azure App Service (a PaaS offering). Which responsibility do they hand to Microsoft that they previously held on-premises?
- Managing their application code
- Managing their application data
- Managing their user accounts
- Managing the operating system and runtime updates
Correct answer: Managing the operating system and runtime updates
Moving to a PaaS like App Service hands operating system and runtime patching to Microsoft. The team keeps managing their own code, data, and accounts, which never transfer to the provider in any service model.
- Which statement correctly summarizes how the shared responsibility model assigns identity and account management?
- Identity and account management is always the provider's responsibility
- Identity and account management is always the customer's responsibility
- Identity and account management belongs to the provider only in SaaS
- Identity and account management is never required in the cloud
Correct answer: Identity and account management is always the customer's responsibility
Identity and account management is always the customer's responsibility regardless of service type. While the provider handles more of the lower stack as you move toward SaaS, controlling who can access resources stays with the customer.
- Which cloud deployment model gives an organization no ownership of physical hardware while delivering rapid elasticity through resources shared among many tenants?
- Private cloud
- Dedicated hosting model
- Community on-premises model
- Public cloud
Correct answer: Public cloud
The public cloud gives no hardware ownership and rapid elasticity because the provider owns multi-tenant infrastructure shared across many customers. This pooling of shared resources is what enables fast scaling without buying equipment.
- A hospital must run patient-records software on infrastructure it fully controls and owns, yet wants to use public cloud analytics for de-identified research data. Which deployment model supports both needs at once?
- Hybrid cloud
- Private cloud only
- Public cloud only
- On-premises only
Correct answer: Hybrid cloud
A hybrid cloud supports both needs because it links a controlled private environment with public cloud services. Sensitive records stay on owned infrastructure while research analytics run in the public cloud, something neither pure model provides alone.
- Which characteristic is unique to a private cloud when contrasted with a public cloud?
- It can scale resources up and down
- It charges based on consumption
- It uses single-tenant infrastructure dedicated to one organization
- It is accessible over a network
Correct answer: It uses single-tenant infrastructure dedicated to one organization
Single-tenant infrastructure dedicated to one organization is unique to the private cloud. Scaling, network access, and usage-based billing can apply to both, but only the private model dedicates the hardware to a single tenant.
- An organization weighs public versus private cloud and lists maximum hardware control with no shared tenancy as its top requirement. Which model satisfies that requirement, and what is the main trade-off?
- Public cloud, with the trade-off of more management work
- Private cloud, with the trade-off of taking on more maintenance and cost responsibility
- Public cloud, with the trade-off of less elasticity
- Private cloud, with the trade-off of mandatory multi-tenancy
Correct answer: Private cloud, with the trade-off of taking on more maintenance and cost responsibility
A private cloud satisfies maximum control and no shared tenancy, with the trade-off of greater maintenance and cost responsibility. Choosing single-tenant dedicated hardware means the organization manages and funds more of the environment itself.
- Which scenario best illustrates a hybrid cloud rather than a purely public deployment?
- A company runs every workload in a provider's public datacenters
- A company subscribes only to a finished web application
- A company buys all of its own servers and never uses external providers
- A company connects its on-premises datacenter to public cloud services so workloads can run in either place
Correct answer: A company connects its on-premises datacenter to public cloud services so workloads can run in either place
Connecting an on-premises datacenter to public cloud services so workloads can run in either place illustrates hybrid cloud. The defining trait is the integration of private and public environments, unlike all-public or all-private setups.
- What does the consumption-based (pay-as-you-go) pricing model let an organization avoid?
- Paying for resources only while they are used
- Scaling resources to match workload
- Large upfront purchases of hardware before knowing demand
- Receiving a monthly bill for usage
Correct answer: Large upfront purchases of hardware before knowing demand
Consumption-based pricing lets an organization avoid large upfront hardware purchases made before demand is known. Instead of buying capacity in advance, it pays for resources only while they run, which is the essence of pay-as-you-go.
- A research lab runs intense compute jobs only a few days each month and idles the rest of the time. Why does a consumption-based pricing model fit this usage pattern well?
- It bills only for the compute actually used, so idle days cost little
- It charges a fixed fee regardless of how often jobs run
- It requires buying peak capacity year-round
- It converts operating costs back into capital purchases
Correct answer: It bills only for the compute actually used, so idle days cost little
Consumption-based pricing fits because it bills only for compute actually used, so the lab pays little on idle days. Paying for active usage rather than provisioned peak capacity is far cheaper for spiky, intermittent workloads.
- Which billing concept describes treating computing as an ongoing operating expense (OpEx) rather than a one-time owned asset?
- Depreciation of purchased servers
- Capital investment in a datacenter
- Perpetual hardware ownership
- Pay-as-you-go consumption-based pricing
Correct answer: Pay-as-you-go consumption-based pricing
Pay-as-you-go consumption-based pricing treats computing as an ongoing operating expense rather than an owned asset. This OpEx approach replaces large capital purchases with recurring usage charges tied to actual consumption.
- A CFO wants predictable monthly cloud bills tied to usage and no large balance-sheet asset purchases. Which expenditure model does cloud consumption pricing primarily provide?
- Operational expenditure (OpEx)
- Capital expenditure (CapEx)
- Sunk cost only
- Fixed depreciation expense
Correct answer: Operational expenditure (OpEx)
Cloud consumption pricing primarily provides operational expenditure (OpEx), recurring usage-based costs rather than owned-asset purchases. This contrasts with capital expenditure, where the organization makes a large upfront investment in hardware it owns.
- Which of the following is most clearly a capital expenditure (CapEx) rather than an operational expenditure?
- A per-minute charge for a running Azure function
- A monthly invoice for cloud storage consumed
- Constructing and equipping a company-owned datacenter
- A subscription to a cloud-hosted productivity suite
Correct answer: Constructing and equipping a company-owned datacenter
Constructing and equipping a company-owned datacenter is a capital expenditure because it is a large upfront investment in owned assets. The per-use charges, monthly invoices, and subscriptions listed are recurring operating expenses.
- How does serverless computing change what a developer must manage compared with deploying to a virtual machine?
- The developer focuses on code while the provider handles scaling and infrastructure
- The developer must still size and patch the host server
- The developer must purchase physical capacity upfront
- The developer must keep the function running at all times
Correct answer: The developer focuses on code while the provider handles scaling and infrastructure
With serverless computing the developer focuses on code while the provider handles scaling and the underlying infrastructure. There is no host to size, patch, or keep continuously running, unlike managing a virtual machine.
- Which statement about serverless computing is accurate?
- There are literally no servers involved
- Customers manage and patch the servers themselves
- The provider manages the servers and the customer is billed based on execution
- Serverless always costs more than a dedicated VM
Correct answer: The provider manages the servers and the customer is billed based on execution
In serverless computing the provider manages the servers and the customer is billed based on execution. Servers still exist; the point is the customer never provisions or patches them and pays only when code runs.
- An e-commerce site occasionally processes uploaded images only when a customer submits a photo, and wants no compute cost when no photos arrive. Which cloud approach matches this event-driven, pay-per-run need?
- A continuously running dedicated server
- Serverless computing
- An owned on-premises cluster
- A perpetual software license
Correct answer: Serverless computing
Serverless computing matches an event-driven, pay-per-run need because code executes only on each event and billing follows execution. When no photos arrive, there is nothing running and therefore little to no compute charge.
- Which pair of cloud benefits is correctly matched to its purpose?
- High availability matches resources to demand; scalability ensures minimal downtime
- High availability ensures minimal downtime; scalability matches resources to demand
- Both high availability and scalability only reduce cost
- Both high availability and scalability only improve security
Correct answer: High availability ensures minimal downtime; scalability matches resources to demand
High availability ensures minimal downtime while scalability matches resources to demand. One benefit keeps the service running through redundancy; the other adjusts capacity up or down to follow workload, and the two are distinct goals.
- A streaming service automatically grows from 5 to 50 servers during a live event and shrinks back afterward. Which cloud benefit is being demonstrated?
- High availability
- Single sign-on
- Strong encryption
- Scalability
Correct answer: Scalability
Growing from 5 to 50 servers during a spike and shrinking afterward demonstrates scalability. Scalability adjusts the amount of resources to match current demand, which is separate from keeping the service continuously available.
- In cloud terms, what does reliability primarily describe?
- The total monthly cost of resources
- The ability to recover from failures and continue functioning
- The number of regions a provider operates
- The speed of an internet connection
Correct answer: The ability to recover from failures and continue functioning
Reliability primarily describes the ability to recover from failures and continue functioning. In Azure this is achieved by distributing workloads across redundant infrastructure so the service keeps operating despite component failures.
- An architect designs a workload to remain operational and predictable even if an entire datacenter goes offline. Which cloud benefit is the central design goal?
- Consumption-based pricing
- Capital expenditure
- Reliability
- Vendor lock-in
Correct answer: Reliability
Remaining operational and predictable even when a datacenter fails makes reliability the central design goal. Reliability depends on redundancy across distributed infrastructure so that a single failure does not stop the workload.
- Which cloud service type sits between IaaS and SaaS, providing a managed platform for building and deploying applications without managing the underlying operating system?
- Platform as a service (PaaS)
- Infrastructure as a service (IaaS)
- Software as a service (SaaS)
- Network as a service
Correct answer: Platform as a service (PaaS)
Platform as a service (PaaS) sits between IaaS and SaaS, offering a managed platform for building and deploying apps without managing the OS. Developers supply code and data while the provider handles the platform beneath it.
- A company subscribes to a complete, ready-to-use customer relationship management application accessed through a browser. Which cloud service type are they consuming?
- Software as a service (SaaS)
- Platform as a service (PaaS)
- Infrastructure as a service (IaaS)
- Function as a service
Correct answer: Software as a service (SaaS)
Consuming a complete, ready-to-use CRM application through a browser is software as a service (SaaS). In SaaS the provider manages the entire stack and delivers finished software the customer simply signs in and uses.
- Which responsibility does the customer keep even when using a software as a service (SaaS) application?
- Patching the application's operating system
- Maintaining the physical servers
- Managing their own data and user access
- Configuring the underlying network hardware
Correct answer: Managing their own data and user access
Even with SaaS the customer keeps managing their own data and user access. The provider handles the OS, servers, and network, but data, accounts, and identities never fully transfer away from the customer.
- A business needs full administrative control of the operating system to install specialized, low-level software. Which cloud service type best meets this need?
- A finished SaaS suite
- Platform as a service (PaaS)
- Software as a service (SaaS)
- Infrastructure as a service (IaaS)
Correct answer: Infrastructure as a service (IaaS)
Infrastructure as a service (IaaS) best meets the need for full operating system control. IaaS provides virtual machines where the customer manages the OS and installed software, offering the most control of the three service types.
- Which statement accurately describes infrastructure as a service (IaaS)?
- The provider delivers a finished application the customer only uses
- The customer cannot choose the operating system
- The provider manages everything including the customer's code
- The provider supplies compute, storage, and networking while the customer manages the OS and apps
Correct answer: The provider supplies compute, storage, and networking while the customer manages the OS and apps
In IaaS the provider supplies compute, storage, and networking while the customer manages the operating system and applications. This gives the most control over the environment above the virtualization layer.
- A development team wants to publish a custom web app and let the provider handle the operating system, load balancing, and patching while the team manages only the code. Which service type fits?
- Infrastructure as a service (IaaS)
- Platform as a service (PaaS)
- Software as a service (SaaS)
- On-premises hosting
Correct answer: Platform as a service (PaaS)
Platform as a service (PaaS) fits because the provider handles the OS, load balancing, and patching while the team manages only the code. PaaS abstracts the platform so developers concentrate on building and deploying applications.
- Which factor most directly explains why a SaaS offering gives the customer the least operational responsibility among the three service types?
- The customer rents only raw virtual machines
- The customer must patch the operating system
- The provider manages nearly the entire technology stack
- The provider only supplies networking
Correct answer: The provider manages nearly the entire technology stack
A SaaS offering gives the least operational responsibility because the provider manages nearly the entire technology stack. The customer is left mainly with data and access concerns, while everything from hardware to application is provider-managed.
- An analyst evaluates IaaS, PaaS, and SaaS and notes that operational control and customer responsibility both decrease in the same direction. In which order does customer responsibility decrease?
- SaaS, then PaaS, then IaaS
- PaaS, then SaaS, then IaaS
- IaaS, then PaaS, then SaaS
- SaaS, then IaaS, then PaaS
Correct answer: IaaS, then PaaS, then SaaS
Customer responsibility decreases from IaaS to PaaS to SaaS. IaaS leaves the customer managing the OS and apps, PaaS removes OS management, and SaaS removes nearly everything but data and access.
- A regulated firm compares public and private cloud for a workload that handles classified data with strict isolation rules, while a separate public-facing website needs cheap elastic scaling. Which conclusion aligns best with cloud concepts?
- Put both workloads in a private cloud to guarantee scaling
- Use a private or hybrid approach for the classified workload and public cloud for the website
- Use public cloud for the classified workload because it is cheaper
- Neither workload can run in any cloud model
Correct answer: Use a private or hybrid approach for the classified workload and public cloud for the website
Using a private or hybrid approach for the classified workload and public cloud for the website aligns best with cloud concepts. Strict isolation favors dedicated infrastructure, while cheap elastic scaling is a public-cloud strength, so a mixed strategy serves both.
- A startup is unsure whether a new product will succeed and wants to limit financial risk on infrastructure. Why does consumption-based OpEx spending reduce that risk compared with a CapEx datacenter build?
- OpEx ties spending to actual usage, so costs shrink if demand never materializes
- CapEx automatically scales costs down if the product fails
- OpEx requires buying servers in advance
- CapEx eliminates all ongoing operating costs
Correct answer: OpEx ties spending to actual usage, so costs shrink if demand never materializes
Consumption-based OpEx ties spending to actual usage, so costs shrink if demand never materializes, which limits financial risk. A CapEx datacenter would lock the startup into hardware costs even if the product fails to gain traction.
- An architect must keep a customer-facing service running during component failures and also handle unpredictable traffic surges. Which combination of cloud benefits should the design prioritize, and why are both needed?
- High availability and scalability, because one keeps the service up and the other matches capacity to demand
- Only high availability, because it also adjusts capacity to demand
- Only scalability, because it also prevents all downtime
- Consumption pricing and tags, because they keep the service running
Correct answer: High availability and scalability, because one keeps the service up and the other matches capacity to demand
The design should prioritize high availability and scalability, because high availability keeps the service running through redundancy while scalability matches capacity to fluctuating demand. Each addresses a different requirement, so both are needed together.
- A team chooses between IaaS and PaaS for hosting a custom application, aiming to reduce maintenance while still deploying their own code. Which reasoning correctly favors PaaS?
- PaaS forces the team to patch the operating system, reducing maintenance
- PaaS lets the provider manage the OS and platform so the team only maintains the application code
- PaaS delivers a finished application, so no custom code is allowed
- IaaS removes all OS management, making it lower maintenance than PaaS
Correct answer: PaaS lets the provider manage the OS and platform so the team only maintains the application code
PaaS is favored because the provider manages the OS and platform so the team only maintains the application code. This reduces maintenance compared with IaaS, where the customer still patches and manages the operating system.
- When comparing serverless functions with always-on virtual machines for a workload that runs only sporadically, which trade-off analysis is most accurate?
- Serverless avoids paying for idle time but gives less control over the runtime environment than a VM
- Serverless always provides more control over the OS than a VM
- Always-on VMs eliminate charges during idle periods
- Serverless requires the customer to provision and patch the host
Correct answer: Serverless avoids paying for idle time but gives less control over the runtime environment than a VM
Serverless avoids paying for idle time but gives less control over the runtime environment than a virtual machine. A sporadic workload benefits from per-execution billing, while a VM offers more control at the cost of paying even when idle.
- What is an Azure region?
- A single physical server rack inside one building
- A billing boundary used only for invoicing customers
- A software tool for writing deployment templates
- A set of datacenters deployed within a defined geographic area and connected through a low-latency network
Correct answer: A set of datacenters deployed within a defined geographic area and connected through a low-latency network
An Azure region is a set of datacenters deployed within a defined geographic area and connected through a dedicated low-latency network. When you deploy a resource you typically choose the region, which determines where your data and services physically reside.
- What is an Azure region pair?
- Two virtual machines configured to back each other up
- Two regions within the same geography paired for resiliency and used for replication during regional outages
- Two subscriptions billed together on one invoice
- Two resource groups that share the same tags
Correct answer: Two regions within the same geography paired for resiliency and used for replication during regional outages
An Azure region pair is two regions within the same geography that are paired for resiliency. Many Azure services replicate data across the pair, and Microsoft sequences platform updates and prioritizes recovery across paired regions during a broad outage.
- An organization must keep certain government workloads in datacenters that are physically and logically isolated from the standard global Azure infrastructure to meet compliance requirements. Which Azure offering addresses this need?
- A resource group
- A standard public region
- A sovereign region
- An availability set
Correct answer: A sovereign region
A sovereign region addresses this need because sovereign regions are physically and logically isolated instances of Azure for specific government or compliance scenarios. Examples include Azure Government and other isolated cloud instances separate from the global public cloud.
- What are Azure availability zones?
- Different geographic regions on separate continents
- Logical groupings used only for cost reporting
- Physically separate datacenter locations within an Azure region, each with independent power, cooling, and networking
- Identical copies of a single virtual machine image
Correct answer: Physically separate datacenter locations within an Azure region, each with independent power, cooling, and networking
Availability zones are physically separate datacenter locations within a single Azure region, each with independent power, cooling, and networking. Spreading resources across zones protects an application from the failure of any one datacenter in that region.
- What is an Azure datacenter?
- A pricing plan for virtual machines
- A type of role assignment for access control
- A web-based portal for managing subscriptions
- A physical facility that houses the servers, storage, and networking hardware that run Azure services
Correct answer: A physical facility that houses the servers, storage, and networking hardware that run Azure services
An Azure datacenter is a physical facility containing the servers, storage, and networking hardware that run Azure services. Multiple datacenters make up an availability zone or region, forming the physical foundation of the cloud.
- What is the purpose of an Azure resource group?
- To physically locate resources in a specific datacenter
- To bill each resource to a different customer automatically
- To replace the need for a subscription
- To serve as a logical container that holds related Azure resources for management
Correct answer: To serve as a logical container that holds related Azure resources for management
A resource group is a logical container that holds related Azure resources so they can be managed together. Applying actions like deployment, access control, or deletion at the resource-group level affects the resources it contains.
- In the Azure resource hierarchy, what role does a subscription play?
- It is a unit of management, billing, and scale that contains resource groups
- It is a single virtual machine instance
- It is a tool for writing infrastructure as code
- It is the physical datacenter where resources run
Correct answer: It is a unit of management, billing, and scale that contains resource groups
A subscription is a unit of management, billing, and scale that contains resource groups. Resources are deployed into resource groups, which live inside a subscription, and the subscription ties usage to billing and applies certain limits.
- An enterprise needs to apply a single governance policy across dozens of subscriptions at once. Which level of the Azure resource hierarchy lets them organize and manage multiple subscriptions together?
- Resource groups
- Individual resources
- Availability zones
- Management groups
Correct answer: Management groups
Management groups let an enterprise organize and manage multiple subscriptions together. They sit above subscriptions in the hierarchy, so policies and access applied to a management group are inherited by the subscriptions beneath it.
- Which list shows the Azure resource hierarchy ordered from the broadest scope down to the narrowest?
- Management groups, subscriptions, resource groups, resources
- Resources, resource groups, subscriptions, management groups
- Resource groups, resources, subscriptions, management groups
- Subscriptions, management groups, resources, resource groups
Correct answer: Management groups, subscriptions, resource groups, resources
The hierarchy from broadest to narrowest is management groups, then subscriptions, then resource groups, then resources. Settings such as policy and access applied higher in this chain are inherited by the levels below.
- Which Azure compute service provides an on-demand, scalable virtualized server where you control the operating system and installed software?
- Azure Policy
- Azure virtual machines
- Azure DNS
- Azure Functions
Correct answer: Azure virtual machines
Azure virtual machines provide on-demand, scalable virtualized servers where you control the operating system and installed software. They are an infrastructure-style compute option, giving full control over the guest OS and applications.
- An online store expects unpredictable spikes in traffic and wants Azure to automatically add or remove identical virtual machines to match demand. Which service is designed for this?
- Azure Data Box
- A single standalone virtual machine
- Azure DNS
- Azure Virtual Machine Scale Sets
Correct answer: Azure Virtual Machine Scale Sets
Azure Virtual Machine Scale Sets are designed to automatically add or remove identical virtual machines to match demand. They let you run and autoscale a group of load-balanced, identical VMs, which suits unpredictable traffic spikes.
- What is the primary purpose of an Azure availability set for virtual machines?
- To reduce the cost of storage accounts
- To translate domain names into IP addresses
- To move files between storage accounts
- To distribute VMs across fault and update domains so planned or unplanned outages do not take down all of them
Correct answer: To distribute VMs across fault and update domains so planned or unplanned outages do not take down all of them
An availability set distributes virtual machines across fault and update domains so a hardware failure or planned maintenance event does not take down all of them at once. This improves the availability of an application running on multiple VMs within a datacenter.
- Which Azure service delivers full Windows desktops and applications to users remotely from the cloud?
- Azure ExpressRoute
- Azure Virtual Desktop
- Azure Functions
- Azure Migrate
Correct answer: Azure Virtual Desktop
Azure Virtual Desktop delivers full Windows desktops and applications to users remotely from the cloud. It is a desktop and app virtualization service that lets people access a cloud-hosted desktop environment from many devices.
- A developer wants to package an application with its dependencies into a lightweight, portable unit that starts quickly and uses fewer resources than a full virtual machine. Which Azure compute option fits this description?
- An availability set
- Containers
- A dedicated physical server
- A management group
Correct answer: Containers
Containers fit because they package an application with its dependencies into a lightweight, portable unit. Containers share the host operating system kernel, so they start faster and use fewer resources than full virtual machines.
- A team needs to run small pieces of code in response to events without provisioning or managing any servers, paying only while the code runs. Which Azure service is the best fit?
- Azure DNS
- Azure Functions
- Azure virtual machines
- Azure Storage Explorer
Correct answer: Azure Functions
Azure Functions is the best fit because it runs small pieces of code in response to events without provisioning or managing servers. As a serverless compute service, it bills based on execution, so you pay primarily while the code runs.
- Which Azure service is designed to host web applications, REST APIs, and mobile back ends without requiring you to manage the underlying servers?
- Availability sets
- Azure DNS
- Azure Data Box
- Azure App Service
Correct answer: Azure App Service
Azure App Service is designed to host web applications, REST APIs, and mobile back ends as a managed platform. It handles the underlying servers, patching, and scaling so developers can focus on their application code.
- What is the primary function of an Azure virtual network?
- To enable Azure resources, such as virtual machines, to securely communicate with each other, the internet, and on-premises networks
- To convert capital expenses into operating expenses
- To assign roles to users for access control
- To store blobs and files at the archive tier
Correct answer: To enable Azure resources, such as virtual machines, to securely communicate with each other, the internet, and on-premises networks
An Azure virtual network enables Azure resources such as virtual machines to securely communicate with each other, the internet, and on-premises networks. It provides isolated, private networking within Azure for your resources.
- Two virtual networks in Azure need to communicate privately with each other over the Microsoft backbone without sending traffic over the public internet. Which feature connects them?
- An availability zone
- Azure DNS
- Virtual network peering
- A resource lock
Correct answer: Virtual network peering
Virtual network peering connects two virtual networks so they can communicate privately over the Microsoft backbone. Peered networks exchange traffic as if on the same network, without traversing the public internet.
- Which Azure service provides hosting and resolution of domain names using Microsoft's global network of name servers?
- Azure DNS
- Azure Functions
- Azure Data Box
- Azure Policy
Correct answer: Azure DNS
Azure DNS provides hosting and resolution of domain names using Microsoft's global network of name servers. It lets you manage your DNS records in Azure so that domain names resolve to the correct resources.
- An organization wants to create an encrypted connection between its on-premises network and Azure over the public internet for site-to-site connectivity. Which Azure service provides this?
- Azure VPN Gateway
- Azure Storage Explorer
- Azure Advisor
- Azure DNS
Correct answer: Azure VPN Gateway
Azure VPN Gateway provides an encrypted connection between on-premises networks and Azure over the public internet. It supports site-to-site connectivity, sending traffic through a secure tunnel across the public internet.
- A bank requires a private, dedicated connection from its datacenter to Azure that does not travel over the public internet and offers more consistent latency. Which service should it use?
- Azure DNS
- Virtual network peering
- Azure ExpressRoute
- Azure VPN Gateway
Correct answer: Azure ExpressRoute
Azure ExpressRoute should be used because it provides a private, dedicated connection from a datacenter to Azure that bypasses the public internet. This delivers more consistent latency and reliability than an internet-based VPN.
- How does a private endpoint differ from a public endpoint when accessing an Azure service?
- A private endpoint gives the service a private IP address inside your virtual network, while a public endpoint is reachable over the internet
- A private endpoint exposes the service to the open internet, while a public endpoint hides it
- A private endpoint only works for billing, while a public endpoint only works for storage
- There is no difference between the two
Correct answer: A private endpoint gives the service a private IP address inside your virtual network, while a public endpoint is reachable over the internet
A private endpoint gives the service a private IP address inside your virtual network, keeping traffic off the public internet, while a public endpoint is reachable over the internet. Private endpoints let resources connect to a service privately through the virtual network.
- Which Azure storage service is optimized for storing large amounts of unstructured data such as images, videos, and backups?
- A management group
- Azure DNS
- Blob storage
- An availability set
Correct answer: Blob storage
Blob storage is optimized for storing large amounts of unstructured data such as images, videos, and backups. Among Azure Storage services, blob storage is the object store designed for this kind of massive, unstructured content.
- A company stores data that is rarely accessed and wants to minimize storage cost, accepting higher retrieval latency and cost when the data is needed. Which Azure storage access tier is most appropriate?
- The hot access tier
- The archive access tier
- A virtual network
- An availability zone
Correct answer: The archive access tier
The archive access tier is most appropriate because it offers the lowest storage cost for rarely accessed data, in exchange for higher retrieval latency and cost. Storage tiers let you match cost to how frequently data is accessed.
- What does locally redundant storage (LRS) do to protect your data?
- It makes three copies of your data within a single datacenter in one region
- It encrypts data only while it is in transit
- It ships your data on a physical appliance
- It replicates data across multiple geographic regions
Correct answer: It makes three copies of your data within a single datacenter in one region
Locally redundant storage (LRS) makes three copies of your data within a single datacenter in one region. It protects against hardware failures inside that datacenter but does not protect against a complete regional or datacenter-wide outage.
- An organization must keep its storage available even if an entire Azure region experiences a disaster. Which redundancy option copies data to a secondary region?
- Geo-redundant storage (GRS)
- Locally redundant storage (LRS)
- Virtual network peering
- A single availability set
Correct answer: Geo-redundant storage (GRS)
Geo-redundant storage (GRS) copies data to a secondary region, protecting against a complete regional disaster. Unlike locally redundant storage, which stays within one region, GRS replicates to a paired region far away.
- What is the main purpose of Azure storage redundancy options such as LRS and GRS?
- To package applications into containers
- To determine how many copies of your data are kept and where, protecting against failures
- To assign roles to users
- To translate domain names to IP addresses
Correct answer: To determine how many copies of your data are kept and where, protecting against failures
Storage redundancy options determine how many copies of your data are kept and where they are stored, protecting against failures. Choosing among options like LRS and GRS balances durability and cost against the level of protection needed.
- A data engineer needs a command-line tool specifically designed to copy large numbers of blobs and files to and from Azure Storage with high performance. Which tool fits?
- AzCopy
- Azure Policy
- An availability set
- Azure DNS
Correct answer: AzCopy
AzCopy fits because it is a command-line tool designed to copy large numbers of blobs and files to and from Azure Storage with high performance. It is purpose-built for efficient, scriptable bulk data transfer.
- Which tool provides a graphical interface for managing and browsing Azure Storage accounts, including uploading and downloading blobs and files?
- Azure ExpressRoute
- Azure Functions
- Azure Storage Explorer
- Azure Advisor
Correct answer: Azure Storage Explorer
Azure Storage Explorer provides a graphical interface for managing and browsing Azure Storage accounts. It lets users upload, download, and manage blobs, files, queues, and tables visually rather than through commands.
- An organization wants to centralize its on-premises file shares in Azure while keeping a frequently accessed cache of files on local servers. Which service is designed for this?
- Azure VPN Gateway
- Azure DNS
- A resource lock
- Azure File Sync
Correct answer: Azure File Sync
Azure File Sync is designed to centralize file shares in Azure while keeping a frequently accessed cache on local Windows servers. It synchronizes on-premises file servers with Azure file shares, tiering less-used data to the cloud.
- A company plans to move its on-premises servers and databases to Azure and wants a service that helps discover, assess, and migrate these workloads. Which service should it use?
- Azure DNS
- Azure Functions
- Azure Storage Explorer
- Azure Migrate
Correct answer: Azure Migrate
Azure Migrate should be used because it helps discover, assess, and migrate on-premises servers, databases, and applications to Azure. It provides a centralized hub for planning and carrying out migrations.
- An organization must transfer hundreds of terabytes of data to Azure, but its internet connection is too slow for an online upload. Which Azure offering provides a physical appliance to ship the data?
- Azure Storage Explorer
- Azure DNS
- Azure Data Box
- Azure VPN Gateway
Correct answer: Azure Data Box
Azure Data Box provides a physical appliance to ship large amounts of data to Azure when network transfer is impractical. You load data onto the device and ship it to Microsoft, who uploads it into Azure, bypassing slow connections.
- Which Azure service is the cloud-based identity and access management service used to authenticate users and control access to applications?
- Microsoft Entra ID
- Azure Monitor
- Azure Data Box
- Azure DNS
Correct answer: Microsoft Entra ID
Microsoft Entra ID, formerly known as Azure Active Directory, is the cloud-based identity and access management service used to authenticate users and control access to applications. It is the directory service that manages identities in Azure.
- An organization wants to provide cloud-managed domain services such as domain join and group policy for legacy applications without deploying and managing its own domain controllers in Azure. Which service meets this need?
- Azure Data Box
- Azure Functions
- Microsoft Entra Domain Services
- Azure ExpressRoute
Correct answer: Microsoft Entra Domain Services
Microsoft Entra Domain Services meets this need by providing managed domain services such as domain join and group policy without requiring you to deploy and manage your own domain controllers. It offers traditional domain capabilities as a managed service.
- What is the main benefit of single sign-on (SSO) for users?
- It lets users sign in once and access multiple applications without re-entering credentials for each
- It replaces the need for a virtual network
- It moves data physically using an appliance
- It encrypts all data stored at rest
Correct answer: It lets users sign in once and access multiple applications without re-entering credentials for each
Single sign-on lets users sign in once and access multiple applications without re-entering credentials for each one. This reduces password fatigue and the number of credentials users must manage while still maintaining centralized control.
- A security team wants to require users to confirm their identity with a second factor, such as a phone approval, in addition to a password. Which authentication method provides this?
- Azure DNS
- Single sign-on (SSO)
- Multifactor authentication (MFA)
- A resource lock
Correct answer: Multifactor authentication (MFA)
Multifactor authentication (MFA) provides this by requiring a second verification factor in addition to a password, such as a phone approval or code. Requiring more than one factor makes compromised passwords far less useful to attackers.
- Which authentication approach lets users sign in without a traditional password, instead using methods such as biometrics or a security key?
- Locally redundant storage
- Passwordless authentication
- Virtual network peering
- Geo-redundant storage
Correct answer: Passwordless authentication
Passwordless authentication lets users sign in without a traditional password, using methods such as biometrics, a security key, or an authenticator app. Removing the password reduces the risk associated with stolen or weak passwords.
- An administrator wants to allow sign-in only when specific conditions are met, such as a known location or a compliant device, and block or require extra verification otherwise. Which Microsoft Entra capability provides this?
- Azure Data Box
- Conditional Access
- Azure DNS
- Locally redundant storage
Correct answer: Conditional Access
Conditional Access provides this by enforcing access decisions based on signals such as user location, device compliance, and risk. It can allow, block, or require additional verification depending on the conditions of a sign-in.
- What does Azure role-based access control (RBAC) allow administrators to do?
- Translate domain names into IP addresses
- Grant users only the specific permissions they need by assigning roles at a chosen scope
- Package applications into containers
- Replicate storage data to a secondary region
Correct answer: Grant users only the specific permissions they need by assigning roles at a chosen scope
Azure RBAC allows administrators to grant users only the specific permissions they need by assigning roles at a chosen scope, such as a subscription or resource group. This supports least-privilege access by tailoring permissions to each role.
- Which principle best summarizes the Zero Trust security model?
- Trust everything inside the corporate network automatically
- Allow all traffic once a user signs in once
- Never trust, always verify each access request regardless of where it originates
- Rely only on a perimeter firewall for all protection
Correct answer: Never trust, always verify each access request regardless of where it originates
Zero Trust is best summarized as never trust, always verify, meaning every access request is verified regardless of where it originates. It assumes breach and validates each request explicitly rather than trusting anything inside a network perimeter.
- The defense-in-depth security approach is best described by which of the following?
- Relying on a single strong control to protect everything
- Removing all security controls to improve performance
- Storing data only in a single datacenter
- Using multiple layers of security controls so that if one layer fails, others still protect resources
Correct answer: Using multiple layers of security controls so that if one layer fails, others still protect resources
Defense in depth uses multiple layers of security controls so that if one layer fails, others still protect the resources. Layering protections across identity, network, compute, and data reduces the chance a single failure leads to a breach.
- What is the primary purpose of Microsoft Defender for Cloud?
- To copy files to Azure Storage from the command line
- To strengthen the security posture of resources and provide threat protection across Azure, hybrid, and multicloud environments
- To translate domain names to IP addresses
- To create and manage virtual networks
Correct answer: To strengthen the security posture of resources and provide threat protection across Azure, hybrid, and multicloud environments
Microsoft Defender for Cloud strengthens the security posture of resources and provides threat protection across Azure, hybrid, and multicloud environments. It assesses configurations, gives a secure score, and helps detect and respond to threats.
- A subscription owner notices that an idle virtual machine still incurs charges for its attached managed disk even though the VM is stopped. Which principle about Azure costs does this illustrate?
- Some resources continue to bill independently of whether a related compute resource is running
- Storage is always free once a virtual machine is deallocated
- Charges stop entirely the moment any resource is stopped
- Disk costs are billed only in the primary region
Correct answer: Some resources continue to bill independently of whether a related compute resource is running
Some resources continue to bill independently of a related compute resource is the principle illustrated. A managed disk is a separate billed resource, so it keeps accruing storage charges even when the VM it is attached to is stopped, showing that resource type and provisioning, not just compute state, drive cost.
- A company moves a workload from a pay-as-you-go arrangement to a one-year reserved capacity commitment and sees a lower hourly rate. Which factor affecting Azure costs is being leveraged here?
- The number of tags applied to the subscription
- The billing model or purchase commitment chosen for the resource
- The choice of web browser used for sign-in
- The display language of the portal
Correct answer: The billing model or purchase commitment chosen for the resource
The billing model or purchase commitment chosen is the factor being leveraged. Committing to reserved capacity for a term lowers the effective rate compared with pay-as-you-go, demonstrating that how you purchase a resource, not just how much you use, affects total Azure cost.
- Outbound data transfer leaving an Azure region to the public internet appears as a line item on a company's bill. Which category of Azure cost factor does this charge fall under?
- Resource locks
- Identity licensing only
- Availability zone selection
- Networking and data egress charges
Correct answer: Networking and data egress charges
Networking and data egress charges is the category this falls under. Azure generally bills for outbound data transfer leaving a region, so the volume and direction of network traffic is a recognized factor that affects costs separate from compute or storage capacity.
- Before committing to a project, a solutions architect wants to combine the estimated monthly price of several services into one shareable total and export it for a proposal. Which tool produces this exportable, multi-service estimate prior to deployment?
- Azure Advisor
- Azure Monitor
- A CanNotDelete lock
- The Azure pricing calculator
Correct answer: The Azure pricing calculator
The Azure pricing calculator produces this exportable, multi-service estimate before deployment. It lets you add many services, configure each, total the estimated monthly cost, and export or share the result, making it the planning tool for pre-purchase budgeting.
- A student wants to learn roughly how much a configuration of App Service and a database would cost per month without signing in or creating anything in Azure. Which tool can they use directly from a public web page?
- Azure cost management
- The Azure pricing calculator
- Azure Policy
- Azure Cloud Shell
Correct answer: The Azure pricing calculator
The Azure pricing calculator can be used directly from a public web page without signing in or provisioning resources. It is a freely accessible estimating tool, whereas cost management works only against real spending in an existing subscription.
- A finance team exports a detailed breakdown of last month's actual Azure charges grouped by resource group to share with department leads. Which Azure capability generates this report from real billing data?
- Azure cost management
- The Azure pricing calculator
- Azure Service Health
- ARM templates
Correct answer: Azure cost management
Azure cost management generates this report from real billing data, allowing you to analyze and export actual charges grouped by resource group, tag, or service. The pricing calculator only estimates costs and cannot report on charges that have already been incurred.
- Which capability allows an organization to detect a sudden, unexpected spike in actual Azure spending and investigate which resource caused it?
- An ARM template deployment
- A virtual network peering
- Cost analysis and anomaly detection within Azure cost management
- A ReadOnly lock
Correct answer: Cost analysis and anomaly detection within Azure cost management
Cost analysis and anomaly detection within Azure cost management allows this. By reviewing actual spend trends, the tool surfaces unusual increases and lets you drill into the responsible resource, which is a function of analyzing real usage rather than estimating future cost.
- An enterprise wants every resource to carry a CostCenter label so its finance system can later split the monthly invoice across business units automatically. Applying these labels is an example of using which Azure feature?
- Resource locks
- Region pairs
- Conditional Access
- Azure tags
Correct answer: Azure tags
Azure tags are the feature being used. A CostCenter tag is a name-value pair applied as metadata, letting cost reports group and allocate charges to business units. Tags enable this chargeback model without changing the resources themselves.
- An administrator wants to enforce that any new resource must include a Department tag, rejecting deployments that omit it. Which two services work together to both require and apply this metadata standard?
- Azure Policy to require the tag and Azure tags as the metadata being applied
- Azure Monitor and Application Insights
- Azure CLI and AzCopy
- Azure Arc and Azure DNS
Correct answer: Azure Policy to require the tag and Azure tags as the metadata being applied
Azure Policy to require the tag and Azure tags as the applied metadata work together here. Tags supply the name-value metadata, while a tagging policy enforces that the required tag is present, combining governance enforcement with cost-organization labeling.
- An organization with data spread across SQL databases, blob storage, and a third-party cloud wants one searchable catalog showing where personally identifiable information resides. Which Azure service builds this unified data map?
- Azure Monitor
- Azure Advisor
- Microsoft Purview
- Azure VPN Gateway
Correct answer: Microsoft Purview
Microsoft Purview builds this unified data map by scanning diverse sources and producing a searchable catalog that identifies and classifies sensitive data such as PII. It is the data governance solution for gaining visibility across an entire data estate.
- Which outcome is a primary goal of deploying Microsoft Purview in an organization?
- Lower-latency network routing between regions
- Improved understanding and governance of data assets through discovery and classification
- Automatic scaling of virtual machines
- Cheaper storage redundancy
Correct answer: Improved understanding and governance of data assets through discovery and classification
Improved understanding and governance of data assets through discovery and classification is a primary goal of Microsoft Purview. It catalogs and labels data across sources so organizations can manage compliance and risk, rather than addressing networking, compute scaling, or storage cost.
- A governance lead wants newly deployed resources to be allowed only in approved European regions, with any attempt to deploy elsewhere automatically blocked. Which Azure service enforces this geographic restriction?
- Azure Advisor
- Azure Policy
- Application Insights
- Azure Cloud Shell
Correct answer: Azure Policy
Azure Policy enforces this geographic restriction. An allowed-locations policy evaluates deployment requests and denies any that target unapproved regions, automatically blocking out-of-policy deployments and keeping resources within the permitted geographies.
- How can Azure Policy handle resources that already exist and do not meet a newly defined rule?
- It can flag them as noncompliant and, with certain effects, remediate them
- It immediately deletes them without notice
- It can only block future deployments and never sees existing resources
- It converts them into resource groups
Correct answer: It can flag them as noncompliant and, with certain effects, remediate them
It can flag them as noncompliant and, with certain effects, remediate them is how Azure Policy handles existing resources. Policy continuously audits the environment, reports resources that violate a rule, and can apply remediation tasks, rather than only governing new deployments.
- A manager wants to bundle several related governance rules, such as required tags and allowed VM sizes, and assign them together as one unit across a subscription. Which Azure Policy construct supports grouping multiple policies for assignment?
- A resource lock
- A tag
- A region pair
- A policy initiative (policy set)
Correct answer: A policy initiative (policy set)
A policy initiative, also called a policy set, supports grouping multiple policies for assignment as one unit. It lets an administrator bundle related rules and apply them together at a scope, simplifying governance compared with assigning each policy individually.
- During an audit, a team needs to guarantee that a configuration setting on a key vault cannot be changed even by administrators, while the vault remains readable. Which lock type accomplishes this?
- A CanNotDelete lock
- An Azure tag
- A Conditional Access policy
- A ReadOnly lock
Correct answer: A ReadOnly lock
A ReadOnly lock accomplishes this. It permits read operations but blocks any modification or deletion, so administrators can view the key vault yet cannot change its settings while the lock is in place, which is stricter than a delete-only lock.
- At which scopes can Azure resource locks be applied to protect resources from accidental changes or deletion?
- Only at the individual user level
- At the subscription, resource group, or individual resource level
- Only at the global tenant level
- Only on storage accounts
Correct answer: At the subscription, resource group, or individual resource level
At the subscription, resource group, or individual resource level is where locks can be applied. A lock set at a higher scope is inherited by the resources beneath it, letting administrators protect a single resource or a whole group from accidental deletion or modification.
- A team wants to deploy and configure resources from a phone or tablet using a touch-friendly graphical interface accessed through a web browser. Which Azure management option fits this requirement?
- The Azure portal
- Azure CLI
- Azure PowerShell
- AzCopy
Correct answer: The Azure portal
The Azure portal fits this requirement. As a browser-based graphical interface, it works across devices including phones and tablets, offering touch-friendly point-and-click management without installing command-line tooling.
- A manager wants a customized home screen in Azure that pins frequently used resources and key metric tiles for at-a-glance status. Which Azure management tool provides customizable dashboards?
- Azure CLI
- An ARM template
- The Azure portal
- Azure Data Box
Correct answer: The Azure portal
The Azure portal provides customizable dashboards. Users can pin resources, charts, and metric tiles to a personalized home screen for at-a-glance status, a visual convenience that the text-based CLI and PowerShell tools do not offer.
- A consultant working from a colleague's machine needs a command-line environment that already has the Azure CLI and PowerShell modules installed and stays available across sessions with persistent file storage. Which Azure service offers this?
- Azure Migrate
- Azure Cloud Shell
- A local terminal
- Azure Service Health
Correct answer: Azure Cloud Shell
Azure Cloud Shell offers this. It is a browser-accessible shell with the Azure CLI and PowerShell preinstalled and an attached storage share that persists files across sessions, so a consultant can work without installing tools on someone else's machine.
- What resource does Azure Cloud Shell require so that files and scripts created in a session are retained for next time?
- A dedicated virtual machine purchased by the user
- A resource lock on the subscription
- An associated Azure file share for persistent storage
- An ExpressRoute circuit
Correct answer: An associated Azure file share for persistent storage
An associated Azure file share for persistent storage is what Cloud Shell requires to retain files. The first time you launch it, Cloud Shell mounts a file share so scripts and files persist between sessions, rather than relying on a dedicated VM or other resources.
- A developer on a Mac wants to manage Azure resources from the terminal using a tool whose syntax follows the pattern az resource action, such as az vm start. Which tool matches this description?
- Azure PowerShell
- The Azure portal
- Azure CLI
- Microsoft Purview
Correct answer: Azure CLI
The Azure CLI matches this description. It is the cross-platform command-line tool whose commands follow the az resource action pattern, such as az vm start, and it runs natively on macOS, Linux, and Windows.
- On which platforms can Azure PowerShell modules be used to manage Azure, given modern cross-platform PowerShell?
- Only on Windows
- Only inside an ARM template
- On Windows, macOS, and Linux through PowerShell
- Only within Microsoft Purview
Correct answer: On Windows, macOS, and Linux through PowerShell
On Windows, macOS, and Linux through PowerShell is where Azure PowerShell can be used. With cross-platform PowerShell, the Az modules run beyond Windows, letting administrators manage Azure from multiple operating systems and from Cloud Shell.
- A hospital must keep its database servers on-premises for compliance but wants to apply consistent Azure governance, run Azure Policy against them, and see them in a single inventory. Which service projects these on-premises servers into Azure for management?
- Azure Migrate
- Azure Arc
- Azure Storage Explorer
- Azure DNS
Correct answer: Azure Arc
Azure Arc projects these on-premises servers into Azure for management. It onboards non-Azure machines so they appear in the Azure inventory and can be governed with Azure Policy, extending Azure's management plane to resources that must stay on-premises.
- How does Azure Arc primarily extend Azure's capabilities beyond the Azure platform?
- By projecting on-premises and multicloud resources into Azure so they can be managed with Azure tools
- By lowering the price of Azure virtual machines
- By providing a graphical web portal only
- By encrypting all internet traffic by default
Correct answer: By projecting on-premises and multicloud resources into Azure so they can be managed with Azure tools
By projecting on-premises and multicloud resources into Azure so they can be managed with Azure tools is how Azure Arc extends capabilities. It brings external servers, Kubernetes clusters, and data services under Azure governance and management rather than affecting pricing or traffic encryption.
- A team adopts a workflow where the desired state of their environment lives in text files in a Git repository, peer-reviewed like application code before being applied. Which practice are they following?
- Defense in depth
- Single sign-on
- Infrastructure as code
- Geo-redundant storage
Correct answer: Infrastructure as code
Infrastructure as code is the practice being followed. Storing the environment's desired state in version-controlled text files and reviewing changes like application code is the defining characteristic of managing infrastructure through code rather than manual configuration.
- When a user submits a request through the Azure portal, that request is authenticated and authorized before any resource action occurs. Which service performs this consistent authentication, authorization, and orchestration of management requests?
- Azure Resource Manager
- Azure Advisor
- Azure Monitor
- Application Insights
Correct answer: Azure Resource Manager
Azure Resource Manager performs this consistent authentication, authorization, and orchestration. Every management request, no matter the tool, passes through ARM, which checks permissions and then coordinates creating, updating, or deleting the targeted resources.
- Which of the following is enabled because all Azure management requests flow through Azure Resource Manager?
- Automatic price discounts on every resource
- The elimination of the need for any regions
- Consistent application of role-based access control and tagging across all tools
- Mandatory use of the Azure portal only
Correct answer: Consistent application of role-based access control and tagging across all tools
Consistent application of role-based access control and tagging across all tools is enabled because requests flow through Azure Resource Manager. Since ARM is the single management layer, access controls, tags, and policies apply uniformly whether you use the portal, CLI, PowerShell, or templates.
- A platform team wants a single declarative file that, when deployed, creates a resource group's full set of networking and compute resources and can be checked into version control. Which native Azure feature provides this JSON-based deployment file?
- Azure tags
- ARM templates
- Resource locks
- Azure Monitor alerts
Correct answer: ARM templates
ARM templates provide this native JSON-based deployment file. They declaratively describe the resources to create and can be stored in version control and redeployed, making them Azure's built-in mechanism for infrastructure as code through Azure Resource Manager.
- Which characteristic distinguishes an ARM template's deployment behavior from running a sequence of manual commands?
- It must be re-typed by hand for every deployment
- It can only delete resources, never create them
- It requires shipping a physical Data Box
- It declares the desired end state and lets Azure Resource Manager determine the operations needed to reach it
Correct answer: It declares the desired end state and lets Azure Resource Manager determine the operations needed to reach it
Declaring the desired end state and letting Azure Resource Manager determine the needed operations distinguishes an ARM template. Rather than scripting each imperative step, you describe the target configuration and ARM reconciles the environment to match it.
- A cost-conscious team wants Azure to automatically surface specific actions, like deleting orphaned public IP addresses or buying reservations, that would lower their bill. Which service delivers these personalized cost recommendations?
- The Azure pricing calculator
- Azure Advisor
- Azure Policy
- Azure Cloud Shell
Correct answer: Azure Advisor
Azure Advisor delivers these personalized cost recommendations. It analyzes actual usage and configuration to suggest concrete savings such as removing idle resources or purchasing reservations, going beyond the estimate-only pricing calculator to act on running resources.
- An IT team wants to subscribe to email notifications about Azure-side incidents and upcoming maintenance that specifically affect the subscriptions and regions they use. Which service supports configuring these personalized health alerts?
- Azure Service Health
- Azure Advisor
- Application Insights
- Azure tags
Correct answer: Azure Service Health
Azure Service Health supports configuring these personalized health alerts. It reports Azure platform incidents, planned maintenance, and advisories scoped to your subscriptions and regions, and lets you set up notifications so the right people are informed.
- An analyst wants to write a Kusto query to correlate sign-in events with error entries across multiple resources stored in a central workspace. Which Azure Monitor component holds this queryable log data?
- Application Insights
- Log Analytics
- Azure Service Health
- The Azure pricing calculator
Correct answer: Log Analytics
Log Analytics holds this queryable log data. As the Azure Monitor component backed by a workspace, it stores logs from many resources and lets analysts run Kusto queries to correlate events such as sign-ins and errors for investigation.
- A team wants an automated action, such as running a logic app to scale out, to occur whenever a defined metric threshold in Azure Monitor is breached. Which Azure Monitor capability triggers such automated responses?
- Azure Monitor alerts with action groups
- Azure tags
- Resource locks
- Azure Storage Explorer
Correct answer: Azure Monitor alerts with action groups
Azure Monitor alerts with action groups trigger such automated responses. When a metric or log condition is met, an alert fires and its action group can run automated tasks like invoking a logic app, enabling responses beyond simple notification.
- A developer instruments a web app and gains the ability to view an application map, trace individual requests end to end, and analyze failure rates by dependency. Which Azure Monitor feature provides this application-centric telemetry?
- Log Analytics only
- Azure Service Health
- Azure Policy
- Application Insights
Correct answer: Application Insights
Application Insights provides this application-centric telemetry. As the Azure Monitor application performance management feature, it offers application maps, distributed request tracing, and dependency failure analysis to help developers diagnose issues from the app's perspective.
- A workload's data must remain within a specific national boundary, and the company groups several related regions to understand which areas share data-residency and compliance commitments. What term describes this broader grouping of Azure regions that preserves a data-residency boundary?
- An Azure geography
- An availability zone
- A resource group
- A fault domain
Correct answer: An Azure geography
An Azure geography is the correct answer because it is a discrete market, typically aligned to a country or region, that contains one or more Azure regions and preserves data-residency and compliance boundaries. Availability zones are physically separate facilities inside a single region, not a national grouping. A resource group is a logical container for resources. A fault domain isolates hardware failures within a datacenter.
- A startup wants to deploy a container without provisioning or managing any virtual machines or orchestration cluster, paying per second only while the container runs. Which Azure service offers this simplest, serverless way to run a single container?
- Azure Container Instances
- Azure Kubernetes Service
- Azure Virtual Machine Scale Sets
- Azure App Service Environment
Correct answer: Azure Container Instances
Azure Container Instances is the answer because it runs containers on demand without requiring you to manage VMs or an orchestrator, billing per second of execution. Azure Kubernetes Service manages a cluster of nodes and adds orchestration overhead. Virtual Machine Scale Sets run VMs, not standalone containers. An App Service Environment is an isolated hosting environment for web apps, not a single-container service.
- An operations team needs to run and scale many containers across a managed cluster, with automatic scheduling, self-healing, and rolling updates of containerized microservices. Which Azure service provides this container orchestration?
- Azure Kubernetes Service
- Azure Container Instances
- Azure Functions
- Azure Batch
Correct answer: Azure Kubernetes Service
Azure Kubernetes Service is correct because it is Azure's managed Kubernetes offering for orchestrating, scaling, and self-healing fleets of containers across a cluster. Azure Container Instances runs individual containers without orchestration. Azure Functions runs event-driven code, not orchestrated container clusters. Azure Batch handles large-scale parallel compute jobs, not container orchestration.
- A team wants to distribute incoming network traffic across several backend virtual machines at the transport layer to improve availability and throughput within a region. Which Azure networking service is designed for this Layer 4 traffic distribution?
- Azure Load Balancer
- Azure DNS
- Azure Bastion
- Azure Firewall
Correct answer: Azure Load Balancer
Azure Load Balancer is the answer because it operates at Layer 4 (TCP/UDP) to distribute inbound traffic across a pool of backend virtual machines for high availability and scale. Azure DNS resolves domain names. Azure Bastion provides secure RDP/SSH access to VMs. Azure Firewall is a managed network security service, not a load distributor.
- An administrator must connect to a virtual machine using RDP or SSH without exposing the VM to a public IP address or opening management ports to the internet. Which Azure service provides secure browser-based connectivity for this?
- Azure Bastion
- Azure VPN Gateway
- Azure DNS
- Azure Content Delivery Network
Correct answer: Azure Bastion
Azure Bastion is correct because it provides secure RDP and SSH connectivity to virtual machines directly through the Azure portal over TLS, eliminating the need for public IP addresses on the VMs. A VPN Gateway connects networks, not individual VM consoles. Azure DNS resolves names. A Content Delivery Network caches content at the edge.
- A global media site wants to cache static images and videos at edge locations close to users to reduce latency and offload the origin server. Which Azure service is built to deliver content from points of presence near end users?
- Azure Content Delivery Network
- Azure Virtual Network
- Azure Bastion
- Azure ExpressRoute
Correct answer: Azure Content Delivery Network
The Azure Content Delivery Network is the answer because it caches static content at globally distributed edge points of presence so users receive data from a nearby location, lowering latency and origin load. A virtual network provides private networking, not edge caching. Bastion is for secure VM access. ExpressRoute is a private connectivity circuit, not a caching network.
- An application needs a fully managed relational database where Microsoft handles patching, backups, and high availability, and the team does not want to administer the underlying server. Which Azure service best fits this platform-as-a-service relational database need?
- Azure SQL Database
- An Azure virtual machine running SQL Server
- Azure Blob Storage
- Azure Table Storage
Correct answer: Azure SQL Database
Azure SQL Database is correct because it is a fully managed platform-as-a-service relational database where Microsoft handles patching, backups, and high availability. Running SQL Server on a virtual machine is infrastructure-as-a-service and requires you to manage the server. Azure Blob Storage holds unstructured objects, and Azure Table Storage is a NoSQL key-value store, neither of which is a managed relational database.
- A development team needs a globally distributed, multi-model NoSQL database that offers single-digit-millisecond response times and the ability to replicate data across many regions with elastic scaling. Which Azure database service is designed for this?
- Azure Cosmos DB
- Azure SQL Database
- Azure Files
- Azure Queue Storage
Correct answer: Azure Cosmos DB
Azure Cosmos DB is the answer because it is a globally distributed, multi-model NoSQL database providing low-latency, elastically scalable access with turnkey multi-region replication. Azure SQL Database is a relational PaaS database, not multi-model NoSQL. Azure Files provides managed SMB file shares. Azure Queue Storage stores messages, not database records.
- Two applications need to exchange messages reliably without being online at the same time, so one component drops messages into a store-and-forward buffer that the other reads later. Which Azure Storage service provides this simple message queuing?
- Azure Queue Storage
- Azure Blob Storage
- Azure Files
- Azure Disk Storage
Correct answer: Azure Queue Storage
Azure Queue Storage is correct because it stores large numbers of messages in a queue that decouples components, letting a producer and consumer communicate asynchronously without being available simultaneously. Azure Blob Storage holds unstructured objects, Azure Files provides file shares, and Azure Disk Storage provides VM disks, none of which is a messaging queue.
- An administrator wants a single web-based console to create, view, and manage Azure resources, monitor costs, and access dashboards without installing any software. Which Azure management tool provides this graphical experience?
- The Azure portal
- Azure PowerShell
- Azure CLI
- Azure Resource Manager templates
Correct answer: The Azure portal
The Azure portal is the answer because it is the browser-based graphical console for creating, configuring, monitoring, and managing Azure resources without installing software. Azure PowerShell and the Azure CLI are command-line interfaces. Azure Resource Manager templates are declarative files for infrastructure as code, not an interactive console.
- An engineer wants to automate repeatable Azure deployments by defining resources in a declarative JSON file so the same environment can be recreated consistently. Which Azure capability provides this infrastructure-as-code approach?
- Azure Resource Manager templates
- The Azure mobile app
- Azure Bastion
- Azure Monitor
Correct answer: Azure Resource Manager templates
Azure Resource Manager templates are correct because they let you declaratively define Azure infrastructure in JSON so deployments are repeatable and consistent. The Azure mobile app is for monitoring on the go, Azure Bastion provides secure VM access, and Azure Monitor collects telemetry, none of which is an infrastructure-as-code deployment mechanism.
- A team needs to check on running Azure resources and receive alerts from a smartphone while away from a computer. Which Microsoft-provided tool lets them monitor and perform basic management of Azure resources from a mobile device?
- The Azure mobile app
- Azure Cloud Shell
- Azure DNS
- Azure Container Registry
Correct answer: The Azure mobile app
The Azure mobile app is the answer because it allows users to monitor resource health, view alerts, and perform basic management tasks from a phone or tablet. Azure Cloud Shell is a browser-based command-line environment. Azure DNS resolves domain names, and Azure Container Registry stores container images; neither is a mobile management app.
- A developer wants an authenticated, browser-based shell with Azure CLI and PowerShell preinstalled so they can run management commands without configuring tools on their local machine. Which Azure service provides this?
- Azure Cloud Shell
- Azure Bastion
- Azure Resource Manager
- Azure Advisor
Correct answer: Azure Cloud Shell
Azure Cloud Shell is correct because it is an authenticated, browser-accessible shell that comes with the Azure CLI and Azure PowerShell preinstalled, requiring no local setup. Azure Bastion provides secure RDP/SSH to VMs. Azure Resource Manager is the deployment and management layer, and Azure Advisor offers best-practice recommendations; neither is an interactive shell.
- A retailer chooses West US 2 instead of an Australia region for an identical virtual machine and notices the published hourly rate differs. Apart from VM size and usage, which factor is most directly responsible for this price difference?
- The Azure region in which the resource is deployed
- The color of the management portal theme selected
- The number of tags applied to the resource
- Whether the resource group name contains numbers
Correct answer: The Azure region in which the resource is deployed
The Azure region in which the resource is deployed is responsible for the price difference. Pricing for the same service and size varies by region because of differing local infrastructure, energy, and operating costs, so an identical VM can cost more or less depending on the chosen region.
- A nonprofit qualifies for special discounted rates because it purchased Azure through an Enterprise Agreement rather than standard pay-as-you-go. Which Azure cost factor is influencing the price it pays?
- The brand of the user's local computer
- The type of customer agreement or purchasing program used
- The number of dashboards pinned in the portal
- The length of the subscription's display name
Correct answer: The type of customer agreement or purchasing program used
The type of customer agreement or purchasing program is the cost factor at work. Negotiated agreements such as Enterprise Agreements or offers like the Cloud Solution Provider program can change the effective rates a customer pays compared with standard pay-as-you-go pricing.
- A team applies the Environment=Dev tag to one virtual machine but does not tag a second VM in the same resource group. Which statement correctly describes how this tag behaves in Azure?
- Applying a tag to one resource automatically copies it to every other resource in the group
- Tags physically move resources into a separate region
- Tags are not inherited automatically, so the untagged VM does not gain the Environment tag from a sibling resource
- A resource may have only one tag at a time across the subscription
Correct answer: Tags are not inherited automatically, so the untagged VM does not gain the Environment tag from a sibling resource
Tags are not inherited automatically is the correct description. In Azure, a tag applied to one resource does not propagate to other resources or from a resource group to the resources inside it, so the second untagged VM does not receive the Environment tag unless it is applied directly or enforced by policy.
- A compliance officer wants to label and classify documents and emails across Microsoft 365 as well as catalog data sitting in Azure storage, using one unified data governance solution. Which Azure service is positioned to handle this end-to-end data governance and classification?
- Azure Bastion
- Azure DNS
- Azure Cloud Shell
- Microsoft Purview
Correct answer: Microsoft Purview
Microsoft Purview is the service positioned for this. It provides unified data governance, letting organizations discover, classify, and label data across cloud storage, on-premises sources, and Microsoft 365 from a single solution.
- When an administrator places a Read-only lock on a storage account, which action is still permitted on that resource?
- Viewing the storage account's configuration and listing its properties
- Deleting the storage account entirely
- Changing the storage account's redundancy setting
- Renaming the storage account
Correct answer: Viewing the storage account's configuration and listing its properties
Viewing the storage account's configuration is still permitted. A ReadOnly lock allows authorized users to read a resource and its settings but blocks any modification or deletion, so listing properties works while changes and deletes are denied.
- An IT pro on a Windows laptop wants to script the bulk creation of resource groups using cmdlets shaped like Verb-Noun, such as New-AzResourceGroup. Which Azure management tool uses this cmdlet syntax?
- The Azure mobile app
- Azure PowerShell
- Azure Bastion
- The Azure pricing calculator
Correct answer: Azure PowerShell
Azure PowerShell is the tool that uses this syntax. Its commands are PowerShell cmdlets following the Verb-Noun pattern, such as New-AzResourceGroup and Get-AzVM, making it well suited for administrators already familiar with PowerShell scripting.
- A platform engineer prefers writing infrastructure definitions in a concise, domain-specific language that compiles down to ARM JSON and is easier to read than raw JSON. Which Azure-native infrastructure-as-code language fits this description?
- Kusto Query Language
- Markdown
- Bicep
- YAML pipelines only
Correct answer: Bicep
Bicep fits this description. It is Azure's domain-specific language for declaratively deploying resources; it offers cleaner, more concise syntax than ARM JSON and transpiles into ARM templates that Azure Resource Manager processes.
- A startup founder wants to receive a push notification on a phone whenever an alert fires and to start or stop a virtual machine from anywhere using a touch-friendly Microsoft app. Which tool provides this on-the-go management?
- An ARM template
- Azure Policy
- A resource lock
- The Azure mobile app
Correct answer: The Azure mobile app
The Azure mobile app provides this on-the-go management. Available for iOS and Android, it lets users monitor resources, view alerts and notifications, and perform basic actions such as starting or stopping virtual machines from a phone or tablet.
- A multinational firm wants to organize many subscriptions into a hierarchy so that a single governance policy applied at the top automatically flows down to all subscriptions beneath it. Which Azure construct enables this hierarchical scope for policy and access inheritance?
- Management groups
- Resource locks
- Availability zones
- Network security groups
Correct answer: Management groups
Management groups enable this hierarchical scope. They sit above subscriptions and let organizations apply policies and role assignments that are inherited by all subscriptions and resources contained within the group, simplifying governance at scale.
- An operations lead wants a unified service that can collect telemetry from applications, virtual machines, and networks, then visualize it and trigger alerts, serving as the overarching observability platform in Azure. Which service serves this role?
- Azure Blueprints
- Azure Monitor
- Azure Key Vault
- Azure Front Door
Correct answer: Azure Monitor
Azure Monitor serves this role. It is the comprehensive monitoring platform that aggregates metrics and logs from applications, infrastructure, and networks, then supports visualization, analysis, and alerting across the environment.
- A governance team wants a packaged, repeatable definition that bundles ARM templates, role assignments, and policy assignments together so a new subscription can be stamped out in a compliant, standardized way. Which Azure capability is designed to orchestrate these governance artifacts as a single package?
- Azure Cost Management
- Azure Service Health
- Azure Blueprints
- Azure Cloud Shell
Correct answer: Azure Blueprints
Azure Blueprints is designed to orchestrate these artifacts. It lets organizations define a repeatable package of resource templates, role-based access assignments, and policy assignments so environments can be deployed in a consistent, governed manner.
