Sample practice questions

A few real questions from this free bank, with full explanations. Use the practice tool above for the whole set.

1. 1. Manage identities & governance

   You need to grant a support engineer the ability to reset passwords and manage user accounts in Microsoft Entra ID, but not manage Azure resources like virtual machines. Which type of role assignment is appropriate?

   • a.An Azure RBAC role such as Contributor at the subscription scope
   • b.An Azure RBAC role such as Owner at the resource group scope
   • c.A Microsoft Entra role such as User Administrator
   • d.A custom Azure Policy definition assigned to the tenant

   Answer: c

   Explanation: Microsoft Entra roles (like User Administrator) control access to Entra ID resources such as users, groups, and directory settings. Azure RBAC roles (Contributor, Owner) control access to Azure resources like VMs and storage, which is not what is needed here. The two role systems are separate, so managing directory objects requires an Entra role, not an RBAC assignment.

2. 2. Manage identities & governance

   You want to automatically enforce that every new storage account created in a subscription uses only the East US region. Which Azure governance feature should you use?

   • a.Azure Policy with a deny effect on the location field
   • b.A resource lock set to ReadOnly
   • c.An Azure RBAC custom role that restricts regions
   • d.A tag applied to the subscription

   Answer: a

   Explanation: Azure Policy evaluates resources against rules and can use a deny effect to block creation of resources that do not meet conditions, such as an allowed-locations restriction. Resource locks and RBAC control who can act and whether resources can be deleted, but they cannot enforce property values like region. Tags are metadata and do not enforce anything by themselves.

3. 3. Manage identities & governance

   You need to group multiple users so you can assign an Azure RBAC role to all of them at once, and the membership should update automatically based on a user's department attribute. Which option should you configure?

   • a.An assigned (static) security group
   • b.A dynamic security group in Microsoft Entra ID
   • c.A Microsoft 365 group with manual membership
   • d.A management group

   Answer: b

   Explanation: A dynamic security group uses membership rules based on user attributes (such as department), so users are added or removed automatically as their attributes change. Assigned groups require manual membership management. You can then assign an RBAC role to the group so all members inherit the access.

4. 4. Implement & manage storage

   You must give an external partner temporary, time-limited read access to a single blob container without sharing your storage account keys. What should you generate?

   • a.A shared access signature (SAS) scoped to the container
   • b.A new storage account access key
   • c.A Microsoft Entra service principal with Owner rights
   • d.A CanNotDelete resource lock

   Answer: a

   Explanation: A shared access signature (SAS) provides delegated access with a defined expiry time, specific permissions, and a limited scope such as a single container, without exposing account keys. Sharing an account key grants full access with no expiry. A service principal with Owner would grant far more than temporary read access.

5. 5. Implement & manage storage

   You want to copy a large number of files from an on-premises server to Azure Blob Storage efficiently from the command line, with high throughput and resume support. Which tool is designed for this?

   • a.Azure Bastion
   • b.AzCopy
   • c.Azure Policy
   • d.Network Watcher

   Answer: b

   Explanation: AzCopy is a command-line utility optimized for high-performance, resumable bulk data transfer to and from Azure Blob and File storage. Azure Bastion provides secure RDP/SSH to VMs, and Network Watcher and Azure Policy serve networking diagnostics and governance respectively, not data copy.

6. 6. Deploy & manage compute

   Your web application experiences fluctuating traffic and you want a group of identical VMs that automatically increases or decreases instance count based on CPU load. What should you deploy?

   • a.A single large VM with manual resizing
   • b.An availability set of fixed VMs
   • c.Azure Container Instances
   • d.A virtual machine scale set with autoscale rules

   Answer: d

   Explanation: A virtual machine scale set manages a group of identical VMs and can automatically add or remove instances based on metrics like CPU using autoscale rules. Availability sets have a fixed set of VMs and do not scale automatically. A single VM cannot scale out, and Azure Container Instances runs containers, not managed VM fleets.

7. 7. Deploy & manage compute

   You need to run a single, short-lived container for a batch job without managing any orchestration or underlying VM infrastructure. Which Azure service is the simplest fit?

   • a.Azure Kubernetes Service (AKS)
   • b.A virtual machine scale set
   • c.Azure Container Instances (ACI)
   • d.Azure App Service

   Answer: c

   Explanation: Azure Container Instances (ACI) runs individual containers quickly without provisioning or managing VMs or an orchestrator, making it ideal for simple, short-lived or burst workloads. AKS is a full Kubernetes orchestration platform that adds complexity for a single container. App Service hosts web apps, and scale sets manage VMs, not standalone containers.

8. 8. Virtual networking

   You want to allow inbound HTTPS (TCP 443) traffic to a subnet while blocking all other inbound traffic. Which resource and configuration should you use?

   • a.An application security group with no rules
   • b.A network security group with an inbound allow rule for port 443 and the default deny
   • c.A route table with a custom route to the internet
   • d.Azure Bastion enabled on the subnet

   Answer: b

   Explanation: A network security group (NSG) contains prioritized allow and deny rules for inbound and outbound traffic; adding an allow rule for TCP 443 permits HTTPS while the default rules deny other inbound traffic. Application security groups are used to group VM NICs for use inside NSG rules, not as standalone filters. Route tables control traffic paths, not filtering, and Bastion provides secure management access.

9. 9. Virtual networking

   You need to distribute inbound HTTP traffic across backend VMs with URL path-based routing and web application firewall protection. Which Azure service should you use?

   • a.A public Standard Load Balancer
   • b.Azure Bastion
   • c.Azure Application Gateway
   • d.A VPN Gateway

   Answer: c

   Explanation: Azure Application Gateway is a layer 7 (HTTP/HTTPS) load balancer that supports URL path-based routing and an optional Web Application Firewall. A Load Balancer operates at layer 4 (TCP/UDP) and cannot route based on URL paths or provide a WAF. Bastion and VPN Gateway serve management access and cross-network connectivity, not load balancing.

10. 10. Monitor & maintain

    You want to run custom queries against collected VM performance and log data using Kusto Query Language (KQL). Which resource stores this data for querying?

    • a.A Recovery Services vault
    • b.A Log Analytics workspace
    • c.An Azure Policy initiative
    • d.A storage account access tier

    Answer: b

    Explanation: A Log Analytics workspace is the repository where Azure Monitor stores log and performance data, and you query it using Kusto Query Language (KQL). A Recovery Services vault stores backups and recovery points, not queryable logs. Azure Policy and storage tiers are unrelated to log querying.