CSLB General Building (B) — All Questions

In Azure, what is the primary purpose of a resource group?

• a.It is a physical server rack
• b.It is a billing currency
• c.It is a logical container that holds related Azure resources for management as a unit✓
• d.It is a network firewall device

A resource group is a logical container used to organize and manage related Azure resources together. Resources in a group typically share the same lifecycle, such as being deployed, updated, and deleted together. It also serves as a scope for applying permissions and policies.

What does an Azure region represent?

• a.A single physical server
• b.A billing account
• c.A type of virtual machine
• d.A set of datacenters deployed within a defined geographic area, connected by a low-latency network✓

An Azure region is a geographic area containing one or more datacenters networked together with low latency. Customers choose regions to place resources close to users and to meet data-residency needs. Region selection affects performance, cost, and available services.

What are Availability Zones within an Azure region designed to protect against?

• a.Datacenter-level failures, by providing physically separate locations with independent power and networking✓
• b.Software bugs in your application
• c.Incorrect billing charges
• d.Expired user passwords

Availability Zones are physically separate datacenters within a region, each with independent power, cooling, and networking. Distributing resources across zones protects applications from the failure of a single datacenter. This improves high availability within a single region.

Which Azure service provides on-demand, scalable virtual machines that you fully control at the operating system level?

• a.Azure App Service
• b.Azure Virtual Machines✓
• c.Azure Functions
• d.Azure Blob Storage

Azure Virtual Machines is an IaaS offering that lets you run and control full virtual servers in the cloud. You choose the OS, size, and installed software, and you manage patching and configuration. It suits workloads needing maximum control or custom environments.

Which Azure service is a fully managed platform for hosting web applications and APIs without managing the underlying servers?

• a.Azure Virtual Machines
• b.Azure Blob Storage
• c.Azure App Service✓
• d.Azure Virtual Network

Azure App Service is a PaaS offering for building and hosting web apps, REST APIs, and mobile backends. It manages the infrastructure, patching, and scaling so developers focus on code. It supports multiple languages and integrates with CI/CD pipelines.

Which Azure service lets you run small pieces of code (functions) without provisioning or managing servers, billed only while the code runs?

• a.Azure Virtual Machines
• b.Azure Kubernetes Service
• c.Azure SQL Database
• d.Azure Functions✓

Azure Functions is a serverless compute service that runs event-triggered code without managing infrastructure. You are billed based on executions and resource consumption while the function runs. It is ideal for lightweight, event-driven, or intermittent workloads.

Which Azure storage service is optimized for storing massive amounts of unstructured data such as images, videos, and backups?

• a.Azure Blob Storage✓
• b.Azure SQL Database
• c.Azure Virtual Network
• d.Azure Files

Azure Blob Storage is designed for large volumes of unstructured object data like media files, documents, and backups. It offers tiers (hot, cool, archive) to balance cost and access frequency. It is accessible over HTTP/HTTPS from anywhere.

Which Azure service provides fully managed file shares accessible over the SMB and NFS protocols?

• a.Azure Blob Storage
• b.Azure Files✓
• c.Azure Queue Storage
• d.Azure Table Storage

Azure Files offers managed cloud file shares that can be mounted by cloud or on-premises machines using SMB or NFS. It is useful for lift-and-shift scenarios and shared application data. Multiple systems can access the same files concurrently.

What is the primary function of an Azure Virtual Network (VNet)?

• a.It stores unstructured blobs
• b.It hosts serverless functions
• c.It provides an isolated, private network in Azure for resources to securely communicate✓
• d.It manages user identities

An Azure Virtual Network (VNet) is the fundamental building block for private networking in Azure. It lets resources such as VMs communicate securely with each other, the internet, and on-premises networks. VNets support subnets, routing, and network security controls.

Which service is Microsoft's cloud-based identity and access management solution used to sign in and access resources?

• a.Azure Blob Storage
• b.Azure Virtual Machines
• c.Azure Monitor
• d.Microsoft Entra ID✓

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity and access management service. It authenticates users and controls access to applications and Azure resources. It supports single sign-on, multifactor authentication, and conditional access.

Which Azure networking service acts as a load balancer that distributes incoming traffic across multiple backend resources?

• a.Azure Load Balancer✓
• b.Azure Blob Storage
• c.Azure Functions
• d.Microsoft Entra ID

Azure Load Balancer distributes inbound network traffic across a pool of backend resources such as virtual machines. This improves availability and scalability by preventing any single resource from being overwhelmed. It operates at the transport layer (Layer 4).

Which service securely connects an on-premises network to Azure over an encrypted tunnel across the public internet?

• a.Azure Blob Storage
• b.Azure VPN Gateway✓
• c.Azure Functions
• d.Azure Policy

Azure VPN Gateway establishes encrypted site-to-site or point-to-site connections between on-premises networks and Azure VNets over the internet. It secures traffic using IPsec/IKE tunnels. It is a common choice for hybrid connectivity when a private circuit is not required.

Which Azure service provides a dedicated, private connection from your on-premises network to Azure that does not traverse the public internet?

• a.Azure VPN Gateway
• b.Azure Blob Storage
• c.Azure ExpressRoute✓
• d.Azure DNS

Azure ExpressRoute creates a private, dedicated connection between on-premises infrastructure and Azure through a connectivity provider. Because traffic bypasses the public internet, it offers more reliability, consistent latency, and higher security. It suits large-scale or mission-critical hybrid workloads.

Which Azure service is a fully managed relational database based on the SQL Server engine?

• a.Azure Blob Storage
• b.Azure Cosmos DB
• c.Azure Files
• d.Azure SQL Database✓

Azure SQL Database is a fully managed PaaS relational database built on the SQL Server engine. Microsoft handles patching, backups, and high availability, reducing administrative work. It is ideal for applications needing a managed relational data store.

Which Azure service is a globally distributed, multi-model NoSQL database designed for low-latency access at planetary scale?

• a.Azure Cosmos DB✓
• b.Azure SQL Database
• c.Azure Blob Storage
• d.Azure Files

Azure Cosmos DB is a globally distributed NoSQL database offering low latency and elastic scalability. It supports multiple data models and APIs and can replicate data across regions. It is suited to globally responsive applications needing guaranteed performance.

What is the purpose of a subnet within an Azure Virtual Network?

• a.It stores backup files
• b.It segments the VNet's IP address space to organize and isolate groups of resources✓
• c.It manages user passwords
• d.It provides serverless compute

A subnet divides a VNet's address range into smaller segments, letting you group and isolate resources. Segmentation improves security and organization, for example separating web and database tiers. Network security rules can be applied at the subnet level.

Which Azure service provides a container orchestration platform for deploying and managing containerized applications at scale?

• a.Azure Blob Storage
• b.Azure SQL Database
• c.Azure Kubernetes Service (AKS)✓
• d.Azure DNS

Azure Kubernetes Service (AKS) is a managed Kubernetes offering for orchestrating containerized workloads. It automates cluster management tasks such as scaling and upgrades. It is used to run microservices and portable containerized applications efficiently.

Which Azure service lets you run individual containers quickly without managing virtual machines or orchestrators?

• a.Azure Kubernetes Service
• b.Azure Virtual Machines
• c.Azure Blob Storage
• d.Azure Container Instances (ACI)✓

Azure Container Instances (ACI) runs containers on demand without provisioning or managing underlying servers or orchestration. It is ideal for simple, short-lived, or burst workloads. You pay per second for the compute resources the container consumes.

What does a Network Security Group (NSG) do in Azure?

• a.It filters inbound and outbound network traffic to resources using allow/deny rules✓
• b.It stores relational data
• c.It manages billing alerts
• d.It hosts web applications

A Network Security Group contains security rules that allow or deny network traffic to and from Azure resources such as VMs and subnets. Rules are based on source, destination, port, and protocol. NSGs are a core tool for controlling network-level access.

Which Azure service provides scalable, name-resolution (DNS) hosting for your domains within Azure?

• a.Azure Blob Storage
• b.Azure DNS✓
• c.Azure Functions
• d.Azure Policy

Azure DNS hosts your domain's DNS records on Microsoft's global network of name servers. It provides fast, reliable name resolution using Azure's infrastructure. You manage DNS records with the same tools and credentials as other Azure resources.

What is the main benefit of using availability sets for virtual machines in Azure?

• a.They encrypt all stored data
• b.They reduce the cost of storage
• c.They distribute VMs across fault and update domains to reduce the impact of hardware failures and maintenance✓
• d.They provide serverless functions

Availability sets group VMs across multiple fault domains and update domains within a datacenter. This ensures that hardware failures or planned maintenance affect only a subset of the VMs. As a result, the application stays available during such events.

Which Azure storage redundancy option keeps multiple copies of your data within a single datacenter?

• a.Geo-redundant storage (GRS)
• b.Zone-redundant storage (ZRS)
• c.Read-access geo-redundant storage (RA-GRS)
• d.Locally redundant storage (LRS)✓

Locally redundant storage (LRS) replicates data three times within a single physical location in the primary region. It is the lowest-cost option but does not protect against a datacenter-wide outage. Higher redundancy tiers spread copies across zones or regions.

Which storage redundancy option replicates data to a secondary region hundreds of miles away for regional disaster protection?

• a.Geo-redundant storage (GRS)✓
• b.Locally redundant storage (LRS)
• c.Zone-redundant storage (ZRS)
• d.Premium SSD

Geo-redundant storage (GRS) copies data to a secondary region far from the primary one. This protects against a complete regional outage such as a natural disaster. It offers the highest durability among the standard redundancy options.

What is Azure Blob Storage's 'archive' access tier best suited for?

• a.Frequently accessed transactional data
• b.Rarely accessed data that can tolerate retrieval latency, stored at the lowest cost✓
• c.Real-time streaming video
• d.Active database files

The archive tier stores data offline at the lowest cost, intended for long-term retention of rarely accessed data. Retrieving archived data takes time (rehydration) and incurs higher access costs. It suits compliance archives and backups that are seldom read.

Which Azure service provides a global content delivery network (CDN) to cache content closer to users?

• a.Azure SQL Database
• b.Azure Functions
• c.Azure Content Delivery Network (CDN)✓
• d.Microsoft Entra ID

Azure CDN caches static content at edge locations around the world, delivering it from a point of presence near each user. This reduces latency and offloads traffic from the origin. It improves performance for websites, media, and downloads.

Which Azure networking service provides a Layer 7 (application layer) load balancer with features like URL-based routing and web application firewall?

• a.Azure Load Balancer
• b.Azure DNS
• c.Azure Blob Storage
• d.Azure Application Gateway✓

Azure Application Gateway is a web traffic load balancer operating at Layer 7 (the application layer). It supports URL-based routing, SSL termination, and an optional Web Application Firewall (WAF). This makes it suited to advanced HTTP/HTTPS routing scenarios.

What is the role of a management group in the Azure resource hierarchy?

• a.It organizes multiple subscriptions together so governance can be applied across them✓
• b.It stores blob data
• c.It hosts virtual machines
• d.It provides DNS resolution

A management group sits above subscriptions in the Azure hierarchy and groups them for unified governance. Policies and access assignments applied to a management group flow down to all subscriptions within it. This simplifies management for organizations with many subscriptions.

Which statement correctly orders the Azure resource hierarchy from broadest to narrowest scope?

• a.Resource, resource group, subscription, management group
• b.Management group, subscription, resource group, resource✓
• c.Subscription, management group, resource, resource group
• d.Resource group, resource, subscription, management group

The Azure hierarchy from broadest to narrowest is management group, then subscription, then resource group, then individual resource. Governance settings applied at a higher level are inherited by everything beneath. Understanding this order is essential for scoping policy and access.

Which Azure service provides secure storage and management of secrets, keys, and certificates?

• a.Azure Blob Storage
• b.Azure Functions
• c.Azure Key Vault✓
• d.Azure DNS

Azure Key Vault safeguards cryptographic keys, secrets such as passwords, and certificates. It centralizes secret management and controls access with policies and identities. This keeps sensitive values out of application code and configuration files.

What does Azure Virtual Network peering enable?

• a.Encryption of blob storage
• b.Serverless code execution
• c.Automatic cost reporting
• d.Direct, low-latency connectivity between two virtual networks so resources can communicate as if on one network✓

VNet peering connects two virtual networks so their resources can communicate directly over the Azure backbone. Traffic between peered VNets stays on Microsoft's private network with low latency. It is commonly used to link workloads across VNets or regions.

Which Azure compute option is best described as 'serverless,' where you focus on code and the platform handles scaling automatically?

• a.Azure Functions✓
• b.Azure Virtual Machines
• c.Azure availability sets
• d.Azure ExpressRoute

Azure Functions embodies serverless computing: you write event-triggered code and the platform automatically provisions and scales the compute. There are no servers for you to manage. Billing is tied to executions and resources consumed during runs.

Which Azure service would you use to queue messages between application components to decouple and scale them independently?

• a.Azure Blob Storage
• b.Azure Queue Storage✓
• c.Azure DNS
• d.Microsoft Entra ID

Azure Queue Storage stores large numbers of messages that components can add and retrieve asynchronously. This decouples producers from consumers, letting each scale independently and absorb load spikes. It improves resilience in distributed applications.

What is a key advantage of using PaaS services like Azure App Service over IaaS virtual machines for hosting a web app?

• a.You gain full control of the physical hardware
• b.You must manually patch the operating system
• c.The platform handles OS patching, scaling, and infrastructure so developers focus on the application✓
• d.You cannot deploy custom code

PaaS offerings such as Azure App Service manage the operating system, runtime, patching, and scaling for you. This reduces operational overhead compared to running and maintaining your own VMs. Developers can concentrate on building and deploying application features.

Which Azure service provides scalable big data analytics and data warehousing for large volumes of structured data?

• a.Azure Blob Storage
• b.Azure DNS
• c.Azure Key Vault
• d.Azure Synapse Analytics✓

Azure Synapse Analytics is an analytics service that combines data warehousing and big data processing. It can query large datasets using both serverless and provisioned resources. It supports enterprise reporting and advanced analytics at scale.

Which storage redundancy option replicates data synchronously across three availability zones in the primary region?

• a.Zone-redundant storage (ZRS)✓
• b.Locally redundant storage (LRS)
• c.Geo-redundant storage (GRS)
• d.Cool access tier

Zone-redundant storage (ZRS) writes copies of data across three separate availability zones within the primary region. This protects against the failure of a single datacenter/zone while keeping data in-region. It offers higher availability than LRS.

What best describes the purpose of Microsoft Entra ID single sign-on (SSO)?

• a.It encrypts data stored in blobs
• b.It lets users sign in once and access multiple applications without re-entering credentials✓
• c.It provisions virtual machines automatically
• d.It hosts DNS zones

Single sign-on (SSO) allows users to authenticate once with Microsoft Entra ID and then access many connected applications without repeated logins. This improves user experience and reduces password fatigue. It also strengthens security by centralizing authentication.

Which Azure service helps you migrate on-premises servers, databases, and applications to Azure with assessment and tracking tools?

• a.Azure Blob Storage
• b.Azure Functions
• c.Azure Migrate✓
• d.Azure DNS

Azure Migrate provides a central hub to discover, assess, and migrate on-premises workloads to Azure. It offers tools for server, database, and application migration along with readiness assessments. This streamlines planning and executing a cloud migration.

What is the primary function of a public IP address resource in Azure?

• a.It stores encryption keys
• b.It queues messages between apps
• c.It hosts static websites only
• d.It allows inbound and outbound communication between Azure resources and the internet✓

A public IP address enables Azure resources to communicate with the internet and public-facing services. It can be assigned to VMs, load balancers, and gateways. Without a public IP (or equivalent), a resource cannot be reached directly from the internet.

Which Azure feature lets a virtual machine authenticate to other Azure services without storing credentials in code?

• a.Managed identities in Microsoft Entra ID✓
• b.Storing passwords in the OS registry
• c.Hardcoding keys in the application
• d.Emailing credentials to users

Managed identities give Azure resources an automatically managed identity in Microsoft Entra ID. Resources use this identity to authenticate to services that support it, avoiding credentials in code. Azure handles the identity's lifecycle, improving security.

Which Azure service provides a fully managed, in-memory data cache to improve application performance?

• a.Azure Blob Storage
• b.Azure Cache for Redis✓
• c.Azure DNS
• d.Azure Migrate

Azure Cache for Redis is a managed in-memory data store based on the popular Redis engine. It speeds up applications by caching frequently accessed data close to compute. This reduces database load and improves response times.