Azure Fundamentals (AZ-900) — All Questions

In Azure, what is the primary purpose of a resource group?

• a.It is a billing currency
• b.It is a physical server rack
• c.It is a network firewall device
• d.It is a logical container that holds related Azure resources for management as a unit✓

A resource group is a logical container used to organize and manage related Azure resources together. Resources in a group typically share the same lifecycle, such as being deployed, updated, and deleted together. It also serves as a scope for applying permissions and policies.

What does an Azure region represent?

• a.A billing account
• b.A type of virtual machine
• c.A single physical server
• d.A set of datacenters deployed within a defined geographic area, connected by a low-latency network✓

An Azure region is a geographic area containing one or more datacenters networked together with low latency. Customers choose regions to place resources close to users and to meet data-residency needs. Region selection affects performance, cost, and available services.

What are Availability Zones within an Azure region designed to protect against?

• a.Incorrect billing charges
• b.Datacenter-level failures, by providing physically separate locations with independent power and networking✓
• c.Software bugs in your application
• d.Expired user passwords

Availability Zones are physically separate datacenters within a region, each with independent power, cooling, and networking. Distributing resources across zones protects applications from the failure of a single datacenter. This improves high availability within a single region.

Which Azure service provides on-demand, scalable virtual machines that you fully control at the operating system level?

• a.Azure App Service
• b.Azure Virtual Machines✓
• c.Azure Blob Storage
• d.Azure Functions

Azure Virtual Machines is an IaaS offering that lets you run and control full virtual servers in the cloud. You choose the OS, size, and installed software, and you manage patching and configuration. It suits workloads needing maximum control or custom environments.

Which Azure service is a fully managed platform for hosting web applications and APIs without managing the underlying servers?

• a.Azure App Service✓
• b.Azure Virtual Machines
• c.Azure Blob Storage
• d.Azure Virtual Network

Azure App Service is a PaaS offering for building and hosting web apps, REST APIs, and mobile backends. It manages the infrastructure, patching, and scaling so developers focus on code. It supports multiple languages and integrates with CI/CD pipelines.

Which Azure service lets you run small pieces of code (functions) without provisioning or managing servers, billed only while the code runs?

• a.Azure Functions✓
• b.Azure SQL Database
• c.Azure Kubernetes Service
• d.Azure Virtual Machines

Azure Functions is a serverless compute service that runs event-triggered code without managing infrastructure. You are billed based on executions and resource consumption while the function runs. It is ideal for lightweight, event-driven, or intermittent workloads.

Which Azure storage service is optimized for storing massive amounts of unstructured data such as images, videos, and backups?

• a.Azure SQL Database
• b.Azure Virtual Network
• c.Azure Blob Storage✓
• d.Azure Files

Azure Blob Storage is designed for large volumes of unstructured object data like media files, documents, and backups. It offers tiers (hot, cool, archive) to balance cost and access frequency. It is accessible over HTTP/HTTPS from anywhere.

Which Azure service provides fully managed file shares accessible over the SMB and NFS protocols?

• a.Azure Table Storage
• b.Azure Queue Storage
• c.Azure Files✓
• d.Azure Blob Storage

Azure Files offers managed cloud file shares that can be mounted by cloud or on-premises machines using SMB or NFS. It is useful for lift-and-shift scenarios and shared application data. Multiple systems can access the same files concurrently.

What is the primary function of an Azure Virtual Network (VNet)?

• a.It hosts serverless functions
• b.It provides an isolated, private network in Azure for resources to securely communicate✓
• c.It stores unstructured blobs
• d.It manages user identities

An Azure Virtual Network (VNet) is the fundamental building block for private networking in Azure. It lets resources such as VMs communicate securely with each other, the internet, and on-premises networks. VNets support subnets, routing, and network security controls.

Which service is Microsoft's cloud-based identity and access management solution used to sign in and access resources?

• a.Microsoft Entra ID✓
• b.Azure Virtual Machines
• c.Azure Monitor
• d.Azure Blob Storage

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity and access management service. It authenticates users and controls access to applications and Azure resources. It supports single sign-on, multifactor authentication, and conditional access.

Which Azure networking service acts as a load balancer that distributes incoming traffic across multiple backend resources?

• a.Azure Functions
• b.Azure Blob Storage
• c.Microsoft Entra ID
• d.Azure Load Balancer✓

Azure Load Balancer distributes inbound network traffic across a pool of backend resources such as virtual machines. This improves availability and scalability by preventing any single resource from being overwhelmed. It operates at the transport layer (Layer 4).

Which service securely connects an on-premises network to Azure over an encrypted tunnel across the public internet?

• a.Azure Functions
• b.Azure VPN Gateway✓
• c.Azure Blob Storage
• d.Azure Policy

Azure VPN Gateway establishes encrypted site-to-site or point-to-site connections between on-premises networks and Azure VNets over the internet. It secures traffic using IPsec/IKE tunnels. It is a common choice for hybrid connectivity when a private circuit is not required.

Which Azure service provides a dedicated, private connection from your on-premises network to Azure that does not traverse the public internet?

• a.Azure VPN Gateway
• b.Azure ExpressRoute✓
• c.Azure Blob Storage
• d.Azure DNS

Azure ExpressRoute creates a private, dedicated connection between on-premises infrastructure and Azure through a connectivity provider. Because traffic bypasses the public internet, it offers more reliability, consistent latency, and higher security. It suits large-scale or mission-critical hybrid workloads.

Which Azure service is a fully managed relational database based on the SQL Server engine?

• a.Azure Files
• b.Azure Blob Storage
• c.Azure Cosmos DB
• d.Azure SQL Database✓

Azure SQL Database is a fully managed PaaS relational database built on the SQL Server engine. Microsoft handles patching, backups, and high availability, reducing administrative work. It is ideal for applications needing a managed relational data store.

Which Azure service is a globally distributed, multi-model NoSQL database designed for low-latency access at planetary scale?

• a.Azure SQL Database
• b.Azure Blob Storage
• c.Azure Cosmos DB✓
• d.Azure Files

Azure Cosmos DB is a globally distributed NoSQL database offering low latency and elastic scalability. It supports multiple data models and APIs and can replicate data across regions. It is suited to globally responsive applications needing guaranteed performance.

What is the purpose of a subnet within an Azure Virtual Network?

• a.It segments the VNet's IP address space to organize and isolate groups of resources✓
• b.It manages user passwords
• c.It stores backup files
• d.It provides serverless compute

A subnet divides a VNet's address range into smaller segments, letting you group and isolate resources. Segmentation improves security and organization, for example separating web and database tiers. Network security rules can be applied at the subnet level.

Which Azure service provides a container orchestration platform for deploying and managing containerized applications at scale?

• a.Azure DNS
• b.Azure Kubernetes Service (AKS)✓
• c.Azure Blob Storage
• d.Azure SQL Database

Azure Kubernetes Service (AKS) is a managed Kubernetes offering for orchestrating containerized workloads. It automates cluster management tasks such as scaling and upgrades. It is used to run microservices and portable containerized applications efficiently.

Which Azure service lets you run individual containers quickly without managing virtual machines or orchestrators?

• a.Azure Blob Storage
• b.Azure Kubernetes Service
• c.Azure Container Instances (ACI)✓
• d.Azure Virtual Machines

Azure Container Instances (ACI) runs containers on demand without provisioning or managing underlying servers or orchestration. It is ideal for simple, short-lived, or burst workloads. You pay per second for the compute resources the container consumes.

What does a Network Security Group (NSG) do in Azure?

• a.It manages billing alerts
• b.It hosts web applications
• c.It stores relational data
• d.It filters inbound and outbound network traffic to resources using allow/deny rules✓

A Network Security Group contains security rules that allow or deny network traffic to and from Azure resources such as VMs and subnets. Rules are based on source, destination, port, and protocol. NSGs are a core tool for controlling network-level access.

Which Azure service provides scalable, name-resolution (DNS) hosting for your domains within Azure?

• a.Azure Blob Storage
• b.Azure Policy
• c.Azure Functions
• d.Azure DNS✓

Azure DNS hosts your domain's DNS records on Microsoft's global network of name servers. It provides fast, reliable name resolution using Azure's infrastructure. You manage DNS records with the same tools and credentials as other Azure resources.

What is the main benefit of using availability sets for virtual machines in Azure?

• a.They encrypt all stored data
• b.They provide serverless functions
• c.They reduce the cost of storage
• d.They distribute VMs across fault and update domains to reduce the impact of hardware failures and maintenance✓

Availability sets group VMs across multiple fault domains and update domains within a datacenter. This ensures that hardware failures or planned maintenance affect only a subset of the VMs. As a result, the application stays available during such events.

Which Azure storage redundancy option keeps multiple copies of your data within a single datacenter?

• a.Read-access geo-redundant storage (RA-GRS)
• b.Locally redundant storage (LRS)✓
• c.Geo-redundant storage (GRS)
• d.Zone-redundant storage (ZRS)

Locally redundant storage (LRS) replicates data three times within a single physical location in the primary region. It is the lowest-cost option but does not protect against a datacenter-wide outage. Higher redundancy tiers spread copies across zones or regions.

Which storage redundancy option replicates data to a secondary region hundreds of miles away for regional disaster protection?

• a.Locally redundant storage (LRS)
• b.Premium SSD
• c.Geo-redundant storage (GRS)✓
• d.Zone-redundant storage (ZRS)

Geo-redundant storage (GRS) copies data to a secondary region far from the primary one. This protects against a complete regional outage such as a natural disaster. It offers the highest durability among the standard redundancy options.

What is Azure Blob Storage's 'archive' access tier best suited for?

• a.Real-time streaming video
• b.Rarely accessed data that can tolerate retrieval latency, stored at the lowest cost✓
• c.Active database files
• d.Frequently accessed transactional data

The archive tier stores data offline at the lowest cost, intended for long-term retention of rarely accessed data. Retrieving archived data takes time (rehydration) and incurs higher access costs. It suits compliance archives and backups that are seldom read.

Which Azure service provides a global content delivery network (CDN) to cache content closer to users?

• a.Microsoft Entra ID
• b.Azure Functions
• c.Azure SQL Database
• d.Azure Content Delivery Network (CDN)✓

Azure CDN caches static content at edge locations around the world, delivering it from a point of presence near each user. This reduces latency and offloads traffic from the origin. It improves performance for websites, media, and downloads.

Which Azure networking service provides a Layer 7 (application layer) load balancer with features like URL-based routing and web application firewall?

• a.Azure Blob Storage
• b.Azure Load Balancer
• c.Azure DNS
• d.Azure Application Gateway✓

Azure Application Gateway is a web traffic load balancer operating at Layer 7 (the application layer). It supports URL-based routing, SSL termination, and an optional Web Application Firewall (WAF). This makes it suited to advanced HTTP/HTTPS routing scenarios.

What is the role of a management group in the Azure resource hierarchy?

• a.It hosts virtual machines
• b.It provides DNS resolution
• c.It organizes multiple subscriptions together so governance can be applied across them✓
• d.It stores blob data

A management group sits above subscriptions in the Azure hierarchy and groups them for unified governance. Policies and access assignments applied to a management group flow down to all subscriptions within it. This simplifies management for organizations with many subscriptions.

Which statement correctly orders the Azure resource hierarchy from broadest to narrowest scope?

• a.Management group, subscription, resource group, resource✓
• b.Resource, resource group, subscription, management group
• c.Subscription, management group, resource, resource group
• d.Resource group, resource, subscription, management group

The Azure hierarchy from broadest to narrowest is management group, then subscription, then resource group, then individual resource. Governance settings applied at a higher level are inherited by everything beneath. Understanding this order is essential for scoping policy and access.

Which Azure service provides secure storage and management of secrets, keys, and certificates?

• a.Azure DNS
• b.Azure Functions
• c.Azure Blob Storage
• d.Azure Key Vault✓

Azure Key Vault safeguards cryptographic keys, secrets such as passwords, and certificates. It centralizes secret management and controls access with policies and identities. This keeps sensitive values out of application code and configuration files.

What does Azure Virtual Network peering enable?

• a.Direct, low-latency connectivity between two virtual networks so resources can communicate as if on one network✓
• b.Serverless code execution
• c.Automatic cost reporting
• d.Encryption of blob storage

VNet peering connects two virtual networks so their resources can communicate directly over the Azure backbone. Traffic between peered VNets stays on Microsoft's private network with low latency. It is commonly used to link workloads across VNets or regions.

Which Azure compute option is best described as 'serverless,' where you focus on code and the platform handles scaling automatically?

• a.Azure ExpressRoute
• b.Azure Functions✓
• c.Azure Virtual Machines
• d.Azure availability sets

Azure Functions embodies serverless computing: you write event-triggered code and the platform automatically provisions and scales the compute. There are no servers for you to manage. Billing is tied to executions and resources consumed during runs.

Which Azure service would you use to queue messages between application components to decouple and scale them independently?

• a.Microsoft Entra ID
• b.Azure Queue Storage✓
• c.Azure DNS
• d.Azure Blob Storage

Azure Queue Storage stores large numbers of messages that components can add and retrieve asynchronously. This decouples producers from consumers, letting each scale independently and absorb load spikes. It improves resilience in distributed applications.

What is a key advantage of using PaaS services like Azure App Service over IaaS virtual machines for hosting a web app?

• a.The platform handles OS patching, scaling, and infrastructure so developers focus on the application✓
• b.You cannot deploy custom code
• c.You must manually patch the operating system
• d.You gain full control of the physical hardware

PaaS offerings such as Azure App Service manage the operating system, runtime, patching, and scaling for you. This reduces operational overhead compared to running and maintaining your own VMs. Developers can concentrate on building and deploying application features.

Which Azure service provides scalable big data analytics and data warehousing for large volumes of structured data?

• a.Azure DNS
• b.Azure Blob Storage
• c.Azure Key Vault
• d.Azure Synapse Analytics✓

Azure Synapse Analytics is an analytics service that combines data warehousing and big data processing. It can query large datasets using both serverless and provisioned resources. It supports enterprise reporting and advanced analytics at scale.

Which storage redundancy option replicates data synchronously across three availability zones in the primary region?

• a.Locally redundant storage (LRS)
• b.Geo-redundant storage (GRS)
• c.Zone-redundant storage (ZRS)✓
• d.Cool access tier

Zone-redundant storage (ZRS) writes copies of data across three separate availability zones within the primary region. This protects against the failure of a single datacenter/zone while keeping data in-region. It offers higher availability than LRS.

What best describes the purpose of Microsoft Entra ID single sign-on (SSO)?

• a.It hosts DNS zones
• b.It provisions virtual machines automatically
• c.It lets users sign in once and access multiple applications without re-entering credentials✓
• d.It encrypts data stored in blobs

Single sign-on (SSO) allows users to authenticate once with Microsoft Entra ID and then access many connected applications without repeated logins. This improves user experience and reduces password fatigue. It also strengthens security by centralizing authentication.

Which Azure service helps you migrate on-premises servers, databases, and applications to Azure with assessment and tracking tools?

• a.Azure Migrate✓
• b.Azure DNS
• c.Azure Blob Storage
• d.Azure Functions

Azure Migrate provides a central hub to discover, assess, and migrate on-premises workloads to Azure. It offers tools for server, database, and application migration along with readiness assessments. This streamlines planning and executing a cloud migration.

What is the primary function of a public IP address resource in Azure?

• a.It queues messages between apps
• b.It allows inbound and outbound communication between Azure resources and the internet✓
• c.It hosts static websites only
• d.It stores encryption keys

A public IP address enables Azure resources to communicate with the internet and public-facing services. It can be assigned to VMs, load balancers, and gateways. Without a public IP (or equivalent), a resource cannot be reached directly from the internet.

Which Azure feature lets a virtual machine authenticate to other Azure services without storing credentials in code?

• a.Storing passwords in the OS registry
• b.Emailing credentials to users
• c.Hardcoding keys in the application
• d.Managed identities in Microsoft Entra ID✓

Managed identities give Azure resources an automatically managed identity in Microsoft Entra ID. Resources use this identity to authenticate to services that support it, avoiding credentials in code. Azure handles the identity's lifecycle, improving security.

Which Azure service provides a fully managed, in-memory data cache to improve application performance?

• a.Azure DNS
• b.Azure Cache for Redis✓
• c.Azure Blob Storage
• d.Azure Migrate

Azure Cache for Redis is a managed in-memory data store based on the popular Redis engine. It speeds up applications by caching frequently accessed data close to compute. This reduces database load and improves response times.

What is an Azure region pair?

• a.Two regions in the same geography paired for replication and recovery✓
• b.Two subscriptions that are billed together on one invoice
• c.Two identical storage accounts inside one datacenter
• d.Two virtual machines placed within the very same server rack for performance

A region pair links two regions within the same geography for platform resilience. Azure staggers updates and prioritizes recovery across the pair. Some services replicate data to the paired region automatically.

In a region that supports Availability Zones, at minimum how many physically separate zones are provided?

• a.Three zones✓
• b.Ten zones
• c.One zone
• d.Twenty zones

Availability Zone-enabled regions provide at least three physically separate zones. Each zone has independent power, cooling, and networking. Spreading resources across zones protects against a datacenter-level failure.

Which statement about Azure resource groups is TRUE?

• a.Resource groups are physical server racks in a datacenter
• b.Each resource belongs to exactly one resource group✓
• c.Resource groups are not allowed to contain any resources
• d.A single resource can belong to many different resource groups simultaneously

Every Azure resource lives in exactly one resource group. The group is a logical container for related resources. It also serves as a scope for permissions and policies.

What is an Azure subscription primarily used for?

• a.A billing and management boundary for Azure resources✓
• b.A single DNS record entry
• c.A single physical fiber-optic cable running between two datacenters
• d.A single virtual machine instance

A subscription is a logical container that acts as a billing and management boundary. Resources are deployed into subscriptions, which link to an Entra tenant. Organizations often use several subscriptions to separate workloads.

Where do management groups sit in the Azure hierarchy?

• a.Inside a single resource group as a child object
• b.Directly below subscriptions in every case
• c.Below individual resources, nested inside each deployed resource itself
• d.Above subscriptions, to organize and govern them✓

Management groups sit above subscriptions and can be nested. Policies and access assigned to a management group flow down to all contained subscriptions. This enables governance at scale.

What is Azure Resource Manager (ARM)?

• a.The deployment and management layer for creating and managing Azure resources✓
• b.A specialized storage tier designed for infrequently accessed archival data sets
• c.A low-level physical networking protocol
• d.A particular family of virtual machine sizes

Azure Resource Manager is the control plane that handles requests to create, update, and delete resources. All portal, CLI, and API calls go through ARM. It provides consistent management, access control, and tagging.

What is the main purpose of an ARM template (or Bicep file)?

• a.To store large volumes of unstructured blob data cheaply
• b.To assign user roles and permissions only
• c.To define infrastructure as code for repeatable deployments✓
• d.To continuously monitor the CPU and memory usage of running virtual machines

ARM templates and Bicep files declare infrastructure as code. They enable consistent, repeatable, and automated deployments. Because they are declarative, applying the same file yields the same result.

Choosing a larger VM size with more vCPUs and memory is an example of what?

• a.Reducing overall redundancy in the system
• b.Scaling out horizontally to more instances
• c.Geo-replication of stored data
• d.Scaling up vertically✓

Increasing a single machine's CPU and memory is vertical scaling, or scaling up. Adding more instances instead is scaling out. Both approaches are supported in Azure.

Which Azure feature automatically maintains and scales a group of identical load-balanced VMs?

• a.Azure Key Vault for secrets and certificates
• b.Virtual Machine Scale Sets✓
• c.Azure DNS name resolution service for hosting your public domains
• d.Azure Blob Storage for object data

Virtual Machine Scale Sets manage a group of identical VMs behind a load balancer. They can automatically scale the instance count based on demand. This supports large, elastic, highly available workloads.

In Azure App Service, what does the App Service plan define?

• a.The compute resources and pricing tier that host your app✓
• b.The redundancy level of your blob storage
• c.The operating system patch schedule for your VMs
• d.The DNS records and name-server settings for your organization's public domain

The App Service plan defines the underlying compute (size, tier, and instance count) that runs your apps. Multiple apps can share a plan. The chosen tier affects features, scale, and cost.

Azure Functions code typically runs in response to what?

• a.Events or triggers such as an HTTP request or new queue message✓
• b.The physical replacement of a failed disk
• c.A single fixed daily reboot of the underlying host operating system only
• d.Manual patching of servers by an administrator

Azure Functions is event-driven: code runs when a trigger fires, such as an HTTP request, timer, or queue message. You do not manage servers. Billing in the Consumption plan is based on executions and resources used.

Which scenario best fits Azure Container Instances?

• a.Orchestrating hundreds of interdependent microservices with complex scaling and self-healing
• b.Providing global DNS resolution for domains
• c.Hosting a full multi-node relational database cluster
• d.Running a short-lived container quickly without managing servers✓

Azure Container Instances runs containers on demand without provisioning VMs or orchestrators. It suits simple, short-lived, or bursty tasks. For complex orchestration, AKS is more appropriate.

What does Azure Kubernetes Service (AKS) primarily provide?

• a.A fully managed relational database engine based on SQL Server technology
• b.A managed secrets and certificate vault
• c.Managed orchestration of containerized workloads✓
• d.A global content delivery network for cached media

AKS is a managed Kubernetes service for orchestrating containers at scale. It automates cluster operations like scaling, upgrades, and self-healing. It is ideal for microservices architectures.

When you create a VNet, what must you define?

• a.A virtual machine operating system image
• b.A domain registrar account for the network
• c.A blob storage access tier such as hot, cool, or archive for objects
• d.A private IP address space (address range)✓

A virtual network requires a private IP address space, which you divide into subnets. Resources placed in the VNet receive addresses from these ranges. The VNet is the foundation for private networking in Azure.

Which Azure service provides secure RDP/SSH access to VMs in the portal without exposing public IP addresses?

• a.Azure Advisor
• b.Azure Bastion✓
• c.Azure DNS
• d.Azure Blob Storage

Azure Bastion gives secure browser-based RDP and SSH to VMs without assigning them public IPs. Connectivity happens over TLS within the portal. This reduces exposure to the public internet.

At what levels can a Network Security Group be associated?

• a.To a subnet or a network interface✓
• b.Only to an entire subscription and never to anything smaller than that
• c.To a single blob container
• d.Only to a management group at the top of the hierarchy

An NSG can be associated with a subnet or with a VM's network interface. Its rules allow or deny traffic by source, destination, port, and protocol. This controls network access at those levels.

A remote employee connects their laptop securely to Azure resources. Which VPN Gateway configuration fits?

• a.Site-to-site VPN between two fixed networks
• b.Point-to-site VPN✓
• c.A dedicated ExpressRoute private circuit provided through a connectivity partner
• d.Blob storage geo-replication

A point-to-site VPN connects an individual device to an Azure VNet over an encrypted tunnel. Site-to-site instead links whole networks. Point-to-site suits remote or mobile users.

Which is a defining characteristic of Azure ExpressRoute?

• a.It stores large amounts of unstructured object data
• b.It is a serverless event-driven compute option
• c.It always routes all of its traffic across the shared public internet backbone
• d.It provides a private connection that bypasses the public internet✓

ExpressRoute creates a private, dedicated connection between on-premises and Azure via a connectivity provider. Traffic does not traverse the public internet. This offers more consistent latency and higher reliability.

Azure DNS is used to host what?

• a.DNS records for your domain names✓
• b.Virtual machine operating-system disks and their attached data volumes
• c.Relational database tables
• d.Container images for deployment

Azure DNS hosts your domain's DNS records on Microsoft's global name-server network. It provides fast, reliable name resolution. You manage records with the same tools as other Azure resources.

At which network layer does Azure Load Balancer operate?

• a.Layer 1 (physical)
• b.Layer 2 (data link)
• c.Layer 4 (transport)✓
• d.Layer 7 (application)

Azure Load Balancer works at Layer 4, distributing TCP/UDP traffic across backend resources. For Layer 7 HTTP features like URL routing, Application Gateway is used. Layer 4 balancing is fast and protocol-agnostic.

Which capability is unique to Azure Application Gateway compared with a basic Layer 4 load balancer?

• a.It only forwards raw TCP packets blindly without any awareness of content
• b.It stores blob objects for websites
• c.URL-based routing and an optional Web Application Firewall✓
• d.It cannot inspect HTTP traffic at all

Application Gateway is a Layer 7 load balancer offering URL-based routing, SSL termination, and an optional WAF. These application-aware features go beyond Layer 4 balancing. It suits advanced HTTP/HTTPS scenarios.

Which blob access tier is optimized for data that is accessed frequently?

• a.Cold tier
• b.Archive tier
• c.Cool tier
• d.Hot tier✓

The hot tier is optimized for data accessed often, with the lowest access costs and higher storage cost. Cool and cold suit infrequently accessed data. Archive is the cheapest to store but slowest to retrieve.

Which access tier suits data that is infrequently accessed and stored for at least 30 days?

• a.Hot tier for active data
• b.Premium block blob tier
• c.Archive tier for rarely read data
• d.Cool tier✓

The cool tier targets infrequently accessed data kept for at least 30 days. It has lower storage cost but higher access cost than hot. Archive is for rarely accessed, long-retention data.

Which Azure managed disk type generally offers the highest performance for I/O-intensive workloads?

• a.Standard HDD for infrequent access
• b.Premium SSD✓
• c.Archive blob tier
• d.Cool blob tier

Premium SSD (and Ultra Disk) deliver high IOPS and low latency for demanding workloads. Standard HDD is cheaper but slower. Blob tiers are for object storage, not VM disks.

What problem does Azure Queue Storage help solve in an application architecture?

• a.Resolving domain names for the network
• b.Encrypting virtual machine operating-system disks and data disks at rest
• c.Decoupling components so they process work asynchronously✓
• d.Serving a public marketing website directly to users

Queue Storage holds messages that components add and retrieve asynchronously. This decouples producers from consumers so each can scale independently. It improves resilience and smooths load spikes.

Azure Table Storage is best described as what?

• a.A fully relational SQL database that supports complex joins and transactions
• b.A global content delivery network for caching media
• c.A NoSQL key-value store for structured, non-relational data✓
• d.A registry for storing container images

Azure Table Storage is a NoSQL key-value store for large amounts of structured, non-relational data. It scales cheaply for simple lookups. It does not support relational joins like a SQL database.

Which redundancy option combines zone redundancy in the primary region with replication to a secondary region?

• a.LRS, which stays within one datacenter
• b.ZRS, which stays within one region
• c.Premium solid-state disks provisioned for high-throughput database workloads
• d.GZRS (geo-zone-redundant storage)✓

GZRS writes data across availability zones in the primary region and also replicates to a secondary region. It combines zone and geo resilience. This provides very high durability and availability.

What does read-access geo-redundant storage (RA-GRS) add over standard GRS?

• a.Read access to the data in the secondary region✓
• b.Nothing at all, because the two options are completely identical in every way
• c.It automatically deletes older data to save space
• d.It removes the secondary copy of the data entirely

RA-GRS adds the ability to read from the secondary region even when the primary is available. Standard GRS keeps a secondary copy but normally does not allow reads from it unless a failover occurs. RA-GRS improves read availability.

Which is TRUE of Azure SQL Database as a PaaS offering?

• a.You must patch the guest operating system yourself
• b.It is only ever available as an on-premises installation inside your datacenter
• c.You manage the underlying physical servers directly
• d.Microsoft manages patching, backups, and high availability✓

Azure SQL Database is a fully managed PaaS relational database. Microsoft handles patching, backups, and high availability. You focus on the database schema, data, and queries.

Which capability is a hallmark of Azure Cosmos DB?

• a.It cannot scale its throughput up or down
• b.It exclusively supports the traditional Microsoft SQL Server relational engine
• c.Turnkey global distribution with low-latency reads and writes✓
• d.It runs only in a single region at a time

Cosmos DB offers turnkey global distribution with low-latency access and elastic scale. It supports multiple data models and APIs. This makes it ideal for globally responsive applications.

A team wants a managed open-source relational database. Which Azure option fits?

• a.Azure Database for PostgreSQL✓
• b.Azure DNS for domain name resolution
• c.Azure Blob Storage for large unstructured object and media data sets
• d.Azure Bastion for secure VM access

Azure Database for PostgreSQL (and MySQL/MariaDB) are managed open-source relational databases. Microsoft handles maintenance, backups, and scaling. They suit teams standardizing on open-source engines.

Why might an organization use multiple Azure subscriptions?

• a.To physically separate the server racks inside each of the provider's datacenters
• b.To completely disable Azure across the company
• c.To change the fundamental laws of physics for their workloads
• d.To separate environments, billing, or teams and manage limits✓

Multiple subscriptions help separate environments (dev/test/prod), teams, or billing. They also help work around per-subscription service limits. Management groups can then govern them together.

What happens to the resources inside a resource group when the group is deleted?

• a.They are all deleted along with the group✓
• b.They are automatically moved to another subscription for safekeeping
• c.They are converted into blob objects
• d.They become permanently read-only forever

Deleting a resource group deletes all resources it contains. This makes groups useful for managing the lifecycle of related resources together. Resource locks can prevent accidental deletion.

Which factor is LEAST relevant when choosing an Azure region for a deployment?

• a.The favorite color of the IT manager✓
• b.Data residency and compliance requirements
• c.Whether the needed services and features are available there
• d.Proximity to your users to reduce latency

Region choice should consider compliance, latency, cost, and service availability. Personal preferences like a favorite color are irrelevant. Sound region selection balances the meaningful technical and legal factors.

How do Availability Zones differ from availability sets?

• a.Availability zones are primarily designed to protect against application-level software bugs
• b.Availability sets replicate data to entirely different regions
• c.Zones use separate datacenters; sets spread VMs within a single datacenter✓
• d.They are identical and interchangeable concepts

Availability Zones are separate datacenters within a region, protecting against a datacenter failure. Availability sets spread VMs across fault and update domains inside one datacenter. Zones offer stronger, cross-datacenter resilience.

A workload runs briefly only when a file is uploaded, a few times a day. Which compute option is most cost-effective?

• a.A 24/7 AKS cluster with many always-running nodes
• b.A dedicated bare-metal server
• c.A large always-on virtual machine
• d.Azure Functions✓

Azure Functions on the Consumption plan bills only while code runs. For sporadic, event-driven tasks this is very cost-effective. Always-on VMs or clusters would cost far more for the same rare workload.

What is the benefit of deployment slots in Azure App Service?

• a.They store archived blob objects at the lowest possible long-term storage cost
• b.They let you stage and swap app versions with minimal downtime✓
• c.They resolve DNS records faster for the app
• d.They encrypt the connected database automatically

Deployment slots host different versions of an app, such as staging and production. You can validate in staging and then swap with production nearly instantly. This enables safe releases with minimal downtime.

Which statement about a single Azure Virtual Network is correct?

• a.A VNet is a physical hardware device
• b.A VNet can exist without belonging to any subscription
• c.A VNet is scoped to a single region✓
• d.A VNet spans multiple regions automatically by default

A VNet is scoped to one region and one subscription. To connect VNets across regions, you use peering or gateways. Understanding this scope is important for network design.

To connect two VNets over Microsoft's private backbone with low latency, you would use…

• a.the shared public internet with an encrypted tunnel between the two networks
• b.VNet peering✓
• c.the Azure DNS resolution service
• d.a single blob storage container

VNet peering links two virtual networks over Microsoft's backbone with low latency. Traffic stays on the private network, not the public internet. It is commonly used to connect workloads across VNets or regions.

Which feature lets you access a PaaS service like a storage account over a private IP inside your VNet?

• a.Azure Private Link / private endpoint✓
• b.An availability set for the VMs
• c.A ReadOnly resource lock on the account
• d.A publicly routable IP address exposed directly to the open internet at large

Azure Private Link exposes a PaaS service through a private endpoint with a private IP in your VNet. Traffic avoids the public internet. This improves security and simplifies network design.

Azure Blob, File, Queue, and Table services are all offered through what?

• a.An availability set of servers
• b.An Azure storage account✓
• c.A DNS zone resource
• d.A single dedicated virtual machine

These four data services are provided within an Azure storage account. The account defines settings like performance tier and redundancy. It is the top-level container for Azure Storage.

What is a snapshot of an Azure managed disk used for?

• a.Distributing incoming requests across many servers
• b.Resolving domain names for the network
• c.Directly serving high-volume public web traffic to end users worldwide
• d.A point-in-time copy for backup or creating new disks✓

A snapshot captures a disk at a point in time. It can be used for backup or to create new identical disks. Snapshots support recovery and duplication scenarios.

Azure File Sync is primarily used to…

• a.cache Azure file shares on local Windows servers✓
• b.encrypt individual blob objects using customer-managed encryption keys
• c.orchestrate large fleets of containers
• d.route and balance network traffic across regions

Azure File Sync caches Azure file shares on on-premises Windows servers. This gives fast local access while centralizing data in Azure. It supports hybrid file-sharing scenarios.

Azure Cosmos DB supports multiple APIs. Which is one of them?

• a.NoSQL (Core) and MongoDB API✓
• b.An SMB file-sharing protocol API
• c.An RDP remote desktop protocol API
• d.A dedicated SMTP email-sending API for outbound mail delivery

Cosmos DB offers several APIs, including NoSQL (Core), MongoDB, Cassandra, Gremlin, and Table. This lets teams use familiar tools and models. It is a multi-model, globally distributed database.

What does an Azure SQL Database elastic pool allow?

• a.Hosting and orchestrating containers at scale
• b.Performing faster DNS lookups for applications
• c.Storing large unstructured blob objects at the lowest available archive cost
• d.Multiple databases to share a set of resources cost-effectively✓

An elastic pool lets several databases share a common set of resources. Databases with varying, unpredictable usage benefit as capacity is pooled. This can lower cost compared with provisioning each database separately.

Every Microsoft Entra (Azure AD) tenant has a single top-level management group called what?

• a.The root management group✓
• b.The primary billing subscription
• c.The default resource group that is created automatically in each region
• d.The tenant blob container

Each tenant has one root management group at the top of the hierarchy. All other management groups and subscriptions descend from it. Policies applied there can affect the entire tenant.

A benefit of deploying with ARM/Bicep templates is that they are declarative and idempotent, meaning…

• a.they can only ever be run one single time
• b.each separate run randomly changes the resulting configuration in unpredictable ways
• c.they delete all existing resources on every run
• d.applying the same template repeatedly yields the same end state✓

Declarative templates describe the desired end state, not step-by-step commands. Idempotency means running them repeatedly converges to that same state. This makes deployments predictable and repeatable.

To achieve the highest single-region VM availability SLA, you should deploy VMs across what?

• a.One subnet only, without redundancy
• b.One single server placed inside one rack in one datacenter room
• c.Multiple Availability Zones✓
• d.One managed disk shared by all instances

Spreading VMs across multiple Availability Zones protects against a datacenter failure and earns the highest single-region VM SLA. A single server offers no redundancy. Zones provide independent power, cooling, and networking.

Under the Azure Functions Consumption plan, you are billed based on…

• a.the number of executions and resources used while running✓
• b.the color theme selected in the portal
• c.a single flat monthly fee that applies regardless of how much you actually use
• d.the number of DNS records you host

The Consumption plan bills on the number of executions and the resources consumed during each run. When nothing runs, you pay nothing (aside from minor storage). This aligns cost with actual activity.

Which Azure service stores and manages container images?

• a.Azure DNS, which hosts your public domain name records globally
• b.Azure Container Registry✓
• c.Azure Bastion for secure VM access
• d.Azure Key Vault for secrets and certificates

Azure Container Registry stores and manages container images and related artifacts. Services like AKS and ACI pull images from it. It supports private, secure image distribution.

Which Azure service uses DNS to route users to the best endpoint across multiple regions?

• a.Azure Bastion, which provides secure browser-based access to virtual machines
• b.Azure Files for managed file shares
• c.Azure Key Vault for storing secrets
• d.Azure Traffic Manager✓

Azure Traffic Manager is a DNS-based traffic router. It directs users to the most appropriate regional endpoint using routing methods like performance or priority. It improves availability and responsiveness across regions.

Which service provides global HTTP load balancing, acceleration, and a WAF at the network edge?

• a.Azure Queue Storage for asynchronous messaging between application components
• b.Azure DNS for name resolution
• c.Azure Table Storage for NoSQL key-value data
• d.Azure Front Door✓

Azure Front Door provides global HTTP/HTTPS load balancing, acceleration, SSL offload, and an optional WAF at the edge. It routes users to the fastest healthy backend. It is used for global, high-performance web delivery.

How are Network Security Group rules evaluated?

• a.By priority number, with the lowest number processed first✓
• b.In a completely random order that changes on every network connection attempt
• c.Strictly alphabetically by the rule name
• d.Only inbound rules are ever considered

NSG rules are processed in priority order, lowest number first, and the first match applies. Both inbound and outbound rule sets exist. Careful priority ordering ensures the intended allow/deny behavior.

In every Azure subnet, a small number of IP addresses are…

• a.permanently unusable for the life of the subscription
• b.always assigned as publicly routable addresses reachable from the internet
• c.reserved by Azure for internal use✓
• d.assigned exclusively to DNS servers

Azure reserves a few addresses in each subnet (for the network address, gateway, DNS mapping, and broadcast). These cannot be assigned to your resources. You must account for them when sizing subnets.

What does a shared access signature (SAS) provide for Azure Storage?

• a.Completely free storage with no charges
• b.Permanent and unrestricted access to every resource in the storage account forever
• c.A convenient way to delete the entire storage account
• d.Delegated, time-limited access to specific resources✓

A SAS grants delegated, time-bound access to specific storage resources with defined permissions. It avoids sharing the account keys directly. This supports secure, scoped access for clients.

Blob lifecycle management policies help you…

• a.automatically move or delete blobs based on their age✓
• b.encrypt the whole virtual network and all of its attached subnets automatically
• c.resolve domain names more quickly for applications
• d.assign RBAC roles to users at scale

Lifecycle management policies automatically transition blobs to cooler tiers or delete them based on rules like age. This optimizes storage cost over time. It reduces manual data-management work.

Compared with Standard HDD, Premium SSD managed disks offer…

• a.higher performance at a higher cost✓
• b.noticeably lower cost together with noticeably lower input/output performance
• c.no meaningful difference of any kind
• d.the exact same performance for a lower monthly price

Premium SSD delivers higher IOPS and throughput than Standard HDD, at a higher price. You choose disk type based on performance needs and budget. High-performance workloads justify the premium tier.

Azure SQL Managed Instance is best suited for customers who want…

• a.near-full SQL Server compatibility with managed infrastructure✓
• b.a globally distributed NoSQL database with turnkey multi-region replication
• c.a managed container orchestration platform
• d.a global DNS hosting service

SQL Managed Instance offers high compatibility with on-premises SQL Server while Microsoft manages the infrastructure. It eases lift-and-shift migrations that need instance-level features. It bridges IaaS control and PaaS convenience.

Azure Cosmos DB lets you choose among several…

• a.DNS record types for name resolution
• b.consistency levels ranging from strong to eventual✓
• c.virtual machine size families
• d.blob storage access tiers only, such as hot, cool, cold, and archive

Cosmos DB provides tunable consistency levels from strong to eventual. This lets you balance latency, availability, and data freshness. Choosing the right level suits your application's needs.

Before using a service type in a subscription, ARM may require you to register the corresponding…

• a.resource provider✓
• b.DNS zone that hosts the public name records for the organization's domain
• c.blob storage container for objects
• d.availability set for virtual machines

Resource providers supply Azure services (for example, Microsoft.Compute). A provider may need to be registered in a subscription before its resources can be created. ARM manages this registration.

Which statement about moving Azure resources between resource groups is TRUE?

• a.Many resources can be moved, though some have restrictions✓
• b.It permanently deletes the resource being moved
• c.It always changes the region the resource runs in
• d.It is completely impossible for any type of Azure resource under all conditions

Many resources can be moved between resource groups or subscriptions, but some services have limitations. Moving does not change the resource's region. Always check move support before relying on it.

Azure Dedicated Host provides…

• a.a managed NoSQL database for global apps
• b.physical servers dedicated to a single customer's VMs✓
• c.global DNS-based traffic routing
• d.serverless event-driven functions that scale automatically with incoming demand

Azure Dedicated Host gives you physical servers dedicated to your organization's VMs. This supports compliance, licensing, and isolation requirements. You gain visibility and control over the underlying hardware.

Azure App Service can host web apps built in…

• a.only low-level assembly language compiled directly for the host processor
• b.no programming languages at all
• c.multiple languages such as .NET, Java, Node.js, Python, and PHP✓
• d.only the COBOL programming language

App Service supports many popular languages and frameworks, including .NET, Java, Node.js, Python, and PHP. It manages the hosting platform for you. This flexibility suits diverse web workloads.

To deploy a VPN or ExpressRoute gateway, a VNet needs a special subnet called…

• a.DefaultSubnet
• b.PublicSubnet
• c.BlobSubnet
• d.GatewaySubnet✓

A gateway requires a dedicated subnet named GatewaySubnet. Azure places the gateway resources there. Using the exact name is required for the gateway to deploy correctly.

Azure Private DNS zones are used to…

• a.store container images for deployment
• b.resolve names privately for resources inside your virtual networks✓
• c.assign RBAC roles to users
• d.host only public-facing marketing websites that anyone on the internet can reach

Private DNS zones provide name resolution within and between VNets without exposing records publicly. They support custom domain names for internal resources. This keeps internal naming private and manageable.

Which blob storage feature helps meet compliance by preventing data from being modified or deleted for a set period?

• a.Automatic autoscaling of the storage account
• b.Virtual network peering between two networks
• c.The hot access tier, which is optimized for frequently accessed active data
• d.Immutable (WORM) storage policies✓

Immutable, write-once-read-many (WORM) policies prevent blobs from being changed or deleted for a defined period. This helps meet regulatory retention requirements. It protects critical records from tampering.

A benefit of Azure managed disks over manually managing storage accounts for VM disks is…

• a.you must manually create and manage all of the underlying storage accounts yourself
• b.Azure handles the underlying storage accounts for you✓
• c.disks cannot be resized after creation
• d.no redundancy options are available for them

Managed disks let Azure handle the underlying storage accounts, simplifying management. You just specify disk type and size. They also improve reliability and scaling compared with unmanaged disks.

What is the relationship between a Microsoft Entra tenant and Azure subscriptions?

• a.A tenant can be associated with many subscriptions, but each subscription trusts one tenant✓
• b.Each tenant is permitted to have only one single subscription associated with it, ever
• c.Subscriptions and tenants are exactly the same thing
• d.Tenants are physical servers in a datacenter

A Microsoft Entra tenant is an identity boundary that can hold many subscriptions. Each subscription trusts exactly one tenant for authentication. This separates identity from billing and resource management.

Which ordering reflects increasing abstraction (less infrastructure to manage) for compute?

• a.Virtual machines are the most abstracted option
• b.VMs, then App Service, then Functions✓
• c.Azure Functions first, then App Service, and finally virtual machines at the end
• d.App Service is less abstracted than virtual machines

VMs (IaaS) require the most management, App Service (PaaS) less, and Functions (serverless) the least. Moving along this order, you manage less infrastructure. Choosing the right level balances control and simplicity.

To protect stored data against a complete regional outage, which redundancy level is the minimum needed?

• a.ZRS, which keeps copies within one region
• b.GRS or GZRS (geo-redundant)✓
• c.LRS, which keeps copies in one datacenter
• d.Premium solid-state disks configured for the highest possible database throughput

Protecting against a full regional outage requires geo-redundant storage (GRS or GZRS), which replicates to a second region. LRS and ZRS stay within one region. Geo-redundancy adds cross-region durability.

In Azure Cosmos DB, provisioned throughput is measured in…

• a.gigabytes transferred per second across the global replication network
• b.Request Units per second (RU/s)✓
• c.the number of DNS queries answered
• d.the count of virtual CPUs assigned

Cosmos DB measures throughput in Request Units per second (RU/s). RUs abstract the CPU, memory, and IOPS needed for operations. You provision or autoscale RU/s to match workload demand.

How can Azure App Service handle increased web traffic automatically?

• a.By deleting the app to reduce the load on servers
• b.By reducing available memory down to zero
• c.By turning off the connected database to conserve resources during peak traffic
• d.By scaling out to more instances based on rules✓

App Service can scale out automatically, adding instances when rules or metrics indicate higher demand. It scales back in when demand falls. This keeps performance steady while managing cost.

Which service provides outbound-only internet connectivity with a stable public IP for resources in a subnet?

• a.Azure Key Vault for secrets and certificates
• b.Azure NAT Gateway✓
• c.Azure DNS for resolving domain names
• d.Azure Bastion, providing secure browser-based RDP and SSH into virtual machines

Azure NAT Gateway provides scalable outbound internet connectivity with a consistent public IP. Resources initiate outbound traffic without needing individual public IPs. Inbound connections are not allowed through it.

How can you restrict a storage account so only specific networks can reach it?

• a.Add several additional DNS records
• b.Move all blobs to the archive access tier
• c.Configure storage firewall and virtual network rules✓
• d.Delete the entire storage account and recreate it in a different Azure region

Storage account firewalls and virtual network rules restrict access to selected networks or IP ranges. Combined with private endpoints, they limit exposure. This strengthens the security of stored data.

By default, data in Azure managed disks and Storage is protected with…

• a.encryption applied only to blob objects and never to any virtual machine disks
• b.encryption only if you purchase a separate add-on
• c.encryption at rest using Storage Service Encryption✓
• d.no encryption of any kind

Azure encrypts data at rest by default using Storage Service Encryption. This applies to Storage and managed disks without extra configuration. You can also use customer-managed keys for more control.

What is an Azure geography?

• a.A billing currency used on invoices
• b.A discrete market, often a country, containing one or more regions for data residency✓
• c.A single physical server installed within one specific rack inside a datacenter room
• d.A particular virtual machine size family

An Azure geography is a discrete market, typically aligning with a country, that contains one or more regions. Geographies preserve data residency and compliance boundaries. Region pairs stay within the same geography.

Can a resource group in one region contain resources located in other regions?

• a.Yes, resources in a group can reside in different regions✓
• b.Only when the resources are in the same server rack
• c.Only if all of the resources involved happen to be blob storage objects specifically
• d.No, this is never possible under any circumstances

A resource group has its own metadata location, but the resources it contains can live in different regions. The group is a logical, not physical, boundary. This gives flexibility in organizing resources.

Which App Service tier provides a fully isolated, dedicated environment for high scale and security?

• a.The Free tier for small test apps
• b.The cool storage tier for infrequent data
• c.The Isolated (App Service Environment) tier✓
• d.The archive access tier used for rarely accessed long-term storage of blob data

The Isolated tier, using an App Service Environment, runs apps in a dedicated, network-isolated environment. It supports high scale and stricter security. It suits workloads with demanding compliance needs.

For running many interdependent microservices with automated scaling and self-healing, which is most appropriate?

• a.One standalone Azure Container Instance
• b.A single Azure Function triggered occasionally by an incoming HTTP request only
• c.A single static blob in storage
• d.Azure Kubernetes Service (AKS)✓

AKS orchestrates many containers with automated scaling, rolling upgrades, and self-healing. It suits complex microservices architectures. ACI or a single Function is better for simpler, isolated tasks.

An Azure VM typically has an OS disk, optional data disks, and a…

• a.queue disk for messages
• b.blob disk for object storage
• c.DNS disk used specifically for hosting the machine's public domain records
• d.temporary disk✓

An Azure VM has an OS disk, optional data disks, and a temporary disk for short-lived data like a page file. The temporary disk is not persistent and can be lost on deallocation. Persistent data belongs on managed disks.

Why might an enterprise choose ExpressRoute over a site-to-site VPN?

• a.It runs entirely over the shared public internet
• b.It offers more predictable latency and higher reliability over a private link✓
• c.It requires no connectivity provider at all
• d.It is always the cheapest possible connectivity option in every single scenario

ExpressRoute uses a private connection with more predictable latency and higher reliability than an internet VPN. It suits mission-critical or high-bandwidth hybrid workloads. It does require a connectivity provider and typically costs more.

Azure Storage accounts come in performance tiers named…

• a.Fast and Slow
• b.Bronze and Gold
• c.Hot and Cold
• d.Standard and Premium✓

Storage account performance comes in Standard and Premium tiers. Premium uses SSDs for low latency and high throughput. Standard is cost-effective for general-purpose data.

Which Cosmos DB option automatically scales throughput within a range based on usage?

• a.Autoscale (autoscale throughput)✓
• b.Only fixed, manually provisioned throughput that never changes automatically at all
• c.No scaling of any kind is possible
• d.DNS-based scaling of the database

Cosmos DB autoscale adjusts provisioned throughput automatically within a set maximum range. It handles variable workloads without manual tuning. You pay for the throughput actually used within that range.

Do Azure resources automatically inherit tags from their resource group?

• a.Tags cannot exist on individual resources
• b.No, tags are not inherited by default, though policy can add them✓
• c.Only blob objects inherit tags automatically
• d.Yes, every resource always automatically inherits every tag from its resource group

Resources do not inherit resource group tags by default. Azure Policy can enforce or append tags to achieve consistency. Tags support cost tracking and organization.

By default, resources in a VNet use which DNS unless you configure custom servers?

• a.No DNS resolution at all
• b.Only their own local host file with statically defined name-to-address mappings
• c.A random public resolver chosen each time
• d.Azure-provided DNS✓

By default, VNet resources use Azure-provided DNS for name resolution. You can configure custom DNS servers or Private DNS zones if needed. This default handles basic resolution automatically.

Azure App Service lets you add a custom domain and secure it with…

• a.a blob storage container
• b.no security controls at all
• c.only manually generated self-signed certificates that browsers do not trust
• d.a TLS/SSL certificate✓

App Service supports custom domains secured with TLS/SSL certificates, including managed certificates. This enables HTTPS on your own domain name. It protects traffic between users and the app.

Which storage service would you use to store large media files served to a website?

• a.Azure Blob Storage✓
• b.Azure Table Storage for key-value data
• c.Azure Queue Storage for messages
• d.Azure SQL Database for relational data

Blob Storage is designed for large unstructured objects like images and video. It integrates with CDN for fast delivery. It is the natural choice for website media assets.

Virtual Machine Scale Sets can automatically add or remove VM instances based on…

• a.nothing at all, because the number of instances always remains completely fixed
• b.only the current time zone name of the region
• c.the color assigned to the virtual machine
• d.metrics such as CPU usage or a defined schedule✓

Scale sets autoscale by adding or removing instances based on metrics like CPU or on a schedule. This matches capacity to demand automatically. It supports elastic, highly available workloads.

Virtual Network service endpoints allow…

• a.faster DNS resolution only
• b.the automatic deletion of a virtual network
• c.a subnet to reach specific Azure services over the backbone✓
• d.the full public internet exposure of every single resource in the subscription

Service endpoints extend a subnet's identity to selected Azure services over the Microsoft backbone. This keeps traffic off the public internet and can restrict service access to the VNet. It improves security for PaaS connectivity.

Which pairing correctly matches the database to its type?

• a.Azure SQL Database is a NoSQL store while Azure Cosmos DB is a relational engine
• b.Both Azure SQL Database and Cosmos DB are container registries
• c.Azure SQL Database is relational; Azure Cosmos DB is NoSQL✓
• d.Both Azure SQL Database and Cosmos DB are file shares

Azure SQL Database is a relational (SQL) database, while Cosmos DB is a globally distributed NoSQL database. Choosing between them depends on data model and scale needs. Matching workloads to the right type is a key skill.