Azure Fundamentals (AZ-900) — All Questions

What is the primary purpose of Microsoft Cost Management in Azure?

• a.To store unstructured data
• b.To monitor, analyze, and optimize spending across Azure resources✓
• c.To host web applications
• d.To deploy virtual machines

Microsoft Cost Management provides tools to track, analyze, and control Azure spending. It offers cost analysis, budgets, and recommendations to optimize usage. This helps organizations stay within budget and identify savings opportunities.

What is the main use of tags applied to Azure resources?

• a.To increase the resource's performance
• b.To attach metadata (key-value pairs) for organizing, tracking costs, and managing resources✓
• c.To physically label servers in the datacenter
• d.To encrypt the resource's data

Tags are key-value pairs you assign to resources to add descriptive metadata. They enable grouping and filtering for cost reporting, ownership, and environment tracking. For example, tagging by department lets you break down spending accurately.

What does Azure Policy help an organization enforce?

• a.Rules and standards that keep resources compliant, such as allowed regions or required tags✓
• b.The pricing of virtual machines
• c.The physical location of datacenters
• d.The color scheme of the portal

Azure Policy lets you define and enforce organizational rules for resources at scale. Policies can require certain configurations, restrict resource types or regions, and flag non-compliant resources. This drives consistent governance and regulatory compliance.

What does role-based access control (RBAC) in Azure allow you to do?

• a.Deploy virtual machines faster
• b.Reduce storage costs
• c.Grant users only the specific permissions they need, scoped to particular resources✓
• d.Encrypt all network traffic automatically

Role-based access control (RBAC) assigns permissions through roles at a chosen scope such as a subscription, resource group, or resource. This follows the principle of least privilege, granting only the access users need. It centralizes and simplifies permission management.

What is the purpose of a resource lock in Azure?

• a.To encrypt data at rest
• b.To lower the monthly bill
• c.To speed up resource deployment
• d.To prevent accidental deletion or modification of critical resources✓

Resource locks protect important resources from accidental changes or deletion. A 'CanNotDelete' lock allows edits but blocks deletion, while a 'ReadOnly' lock blocks both changes and deletion. Locks apply regardless of a user's RBAC permissions.

Which Azure service collects telemetry such as metrics and logs to help you observe the health and performance of resources?

• a.Azure Key Vault
• b.Azure Monitor✓
• c.Azure Blob Storage
• d.Azure DNS

Azure Monitor gathers metrics, logs, and other telemetry from Azure resources and applications. It enables visualization, alerting, and analysis of performance and availability. This visibility is essential for detecting and diagnosing issues.

Which two lock types are available for Azure resource locks?

• a.Encrypt and Decrypt
• b.CanNotDelete and ReadOnly✓
• c.Public and Private
• d.Hot and Cool

Azure supports two lock types: CanNotDelete, which permits reads and updates but prevents deletion, and ReadOnly, which prevents any modification or deletion. These locks override RBAC permissions to safeguard resources. They are applied at the resource, group, or subscription scope.

What is the benefit of setting a budget in Microsoft Cost Management?

• a.It tracks spending against a defined threshold and can trigger alerts when limits are approached✓
• b.It provisions new subscriptions
• c.It automatically doubles your resource capacity
• d.It encrypts all your resources

A budget in Cost Management sets a spending threshold for a scope such as a subscription or resource group. When actual or forecasted costs approach the limit, alerts notify stakeholders. This proactive control helps prevent unexpected overspending.

Which tool provides personalized recommendations to improve the cost, security, reliability, performance, and operational excellence of your Azure resources?

• a.Azure Functions
• b.Azure Blob Storage
• c.Azure Advisor✓
• d.Azure DNS

Azure Advisor analyzes your resource configuration and usage, then provides tailored recommendations. Its guidance spans cost optimization, security, reliability, performance, and operational excellence. Following its suggestions improves your environment's efficiency and posture.

How can Azure Policy remediate a resource that is created without a required tag?

• a.It increases the resource's size
• b.It encrypts the resource
• c.It can be configured to deny the deployment or automatically add the missing tag✓
• d.It deletes the entire subscription

Azure Policy supports effects such as 'deny,' which blocks non-compliant deployments, and 'modify' or 'append,' which can add a required tag. This ensures resources meet standards either by prevention or automatic correction. Remediation tasks can also fix existing non-compliant resources.

In RBAC, what does the 'scope' of a role assignment determine?

• a.The billing currency
• b.The physical datacenter used
• c.The set of resources to which the granted permissions apply✓
• d.The color of the resource icon

The scope defines where a role's permissions take effect, such as a management group, subscription, resource group, or individual resource. Assigning at a broad scope grants access to everything beneath it. Choosing the narrowest appropriate scope supports least-privilege access.

What is a primary advantage of using management groups for governance?

• a.They store application secrets
• b.Policies and access assigned at a management group are inherited by all subscriptions within it✓
• c.They provide serverless compute
• d.They cache web content

Management groups let you apply governance such as Azure Policy and RBAC across many subscriptions at once. Assignments made at the management group level are inherited by all contained subscriptions and resources. This ensures consistent policy across a large organization.

Which feature helps you understand where your Azure money is going by breaking down spending by resource, tag, or service?

• a.Cost analysis in Microsoft Cost Management✓
• b.Azure DNS
• c.Availability zones
• d.Network peering

Cost analysis provides interactive breakdowns of your Azure spending across dimensions such as service, resource group, and tag. It helps identify cost drivers and trends over time. These insights support budgeting and optimization decisions.

What is the purpose of an Azure alert in Azure Monitor?

• a.To encrypt stored data
• b.To create new subscriptions
• c.To provision virtual networks
• d.To notify you or trigger an action when a monitored condition or threshold is met✓

Alerts in Azure Monitor watch metrics or logs and fire when defined conditions are met, such as high CPU usage. They can send notifications or trigger automated responses through action groups. This enables proactive operations and faster incident response.

Which Azure governance tool would you use to package policies, role assignments, and resource templates as a repeatable, enforceable set?

• a.Azure Blob Storage
• b.Azure Cache for Redis
• c.Azure Blueprints✓
• d.Azure DNS

Azure Blueprints lets you define a repeatable set of governance artifacts including policies, RBAC role assignments, and resource templates. You can deploy these consistently to new environments to ensure they start compliant. This standardizes how subscriptions are set up.

What does the principle of 'least privilege' mean when assigning RBAC roles?

• a.Users are given only the minimum permissions necessary to perform their tasks✓
• b.Permissions are assigned randomly
• c.Every user gets full administrator rights
• d.No user is ever given any access

Least privilege means granting users just enough access to do their jobs and no more. This reduces the risk and potential impact of compromised or misused accounts. RBAC supports this by allowing precise, scoped role assignments.

Which built-in RBAC role grants full access to manage all resources, including assigning roles to others?

• a.Contributor
• b.Reader
• c.Billing Reader
• d.Owner✓

The Owner role provides full access to manage resources and, unlike Contributor, can also grant access to others by assigning roles. Contributor can manage resources but cannot assign roles, and Reader can only view. Choosing the right role enforces least privilege.

Which built-in RBAC role lets a user manage resources but NOT grant access to other users?

• a.Contributor✓
• b.Guest
• c.Owner
• d.Reader

The Contributor role allows creating and managing all types of resources but does not permit assigning roles to others. That role-assignment capability is reserved for Owner and User Access Administrator. This separation supports controlled delegation.

Which built-in RBAC role provides view-only access with no ability to make changes?

• a.User Access Administrator
• b.Owner
• c.Reader✓
• d.Contributor

The Reader role grants the ability to view resources but not to create, modify, or delete them. It is ideal for auditors or stakeholders who need visibility without change rights. It represents the least-privileged of the common built-in roles.

What is the main benefit of applying consistent tagging across your Azure resources?

• a.It increases network bandwidth
• b.It reduces the number of regions used
• c.It enables accurate cost allocation and reporting by department, project, or environment✓
• d.It automatically encrypts the resources

Consistent tags let you slice cost and usage data by meaningful categories such as department or project. This supports chargeback, showback, and accountability across teams. Tagging standards can even be enforced through Azure Policy.

Which service helps you improve your organization's security posture by providing a security score and recommendations?

• a.Azure DNS
• b.Azure Cache for Redis
• c.Azure Blob Storage
• d.Microsoft Defender for Cloud✓

Microsoft Defender for Cloud assesses your resources' security and provides a secure score along with actionable recommendations. It helps identify misconfigurations and threats across your environment. Acting on its guidance strengthens overall security.

What does an action group in Azure Monitor define?

• a.The set of notifications and automated actions to run when an alert fires✓
• b.The size of a virtual machine
• c.The redundancy level of storage
• d.The physical location of a datacenter

An action group is a reusable collection of notification targets and actions, such as emails, SMS, or webhooks. When an alert triggers, its associated action group carries out these responses. This lets you standardize how incidents are communicated and handled.

Which capability of Azure Policy shows how many of your resources currently meet defined standards?

• a.Compliance reporting✓
• b.DNS resolution
• c.Autoscaling
• d.Blob replication

Azure Policy provides compliance reporting that evaluates resources against assigned policies. It shows which resources are compliant or non-compliant, giving a clear governance overview. This helps organizations track and prove adherence to standards.

What is the purpose of the Azure Pricing Calculator?

• a.To estimate the cost of Azure services before deploying them✓
• b.To deploy resources into production
• c.To monitor live performance
• d.To encrypt stored data

The Azure Pricing Calculator lets you model and estimate the cost of Azure services based on your expected configuration and usage. It supports planning and budgeting before any resources are provisioned. This helps avoid surprises on the bill.

What does the Total Cost of Ownership (TCO) Calculator help organizations do?

• a.Configure DNS records
• b.Compare the cost of running workloads on-premises versus in Azure✓
• c.Encrypt data in transit
• d.Deploy virtual machines automatically

The TCO Calculator estimates the cost savings of migrating on-premises workloads to Azure. It compares current infrastructure expenses with projected Azure costs, including hardware, power, and staffing. This supports the business case for cloud migration.

Which of the following is a valid strategy to reduce Azure virtual machine costs for predictable, long-running workloads?

• a.Disabling monitoring entirely
• b.Running only during business hours without automation
• c.Deleting all backups
• d.Purchasing reserved instances for a one- or three-year term✓

Reserved instances let you commit to a VM for one or three years in exchange for a significant discount over pay-as-you-go pricing. They suit steady, predictable workloads that run continuously. This is a common cost-optimization technique in Azure.

What is Azure Spot pricing best suited for?

• a.Interruptible workloads that can tolerate being evicted when Azure needs the capacity back✓
• b.Mission-critical databases that must never stop
• c.Long-term reserved capacity
• d.Workloads requiring guaranteed uptime

Azure Spot pricing offers unused capacity at deep discounts, but Azure can reclaim (evict) it when demand rises. It is ideal for fault-tolerant, interruptible workloads like batch processing or testing. It should not be used for services that must run without interruption.

How does inheritance work when an Azure Policy is assigned at the subscription level?

• a.Only newly created resources in one region comply
• b.All resource groups and resources within that subscription inherit and must comply with the policy✓
• c.The policy applies to other subscriptions too
• d.Nothing inherits the policy

When a policy is assigned at the subscription scope, it applies to all resource groups and resources beneath it through inheritance. Lower scopes automatically fall under the higher-level assignment. This makes it efficient to enforce standards broadly.

What is the benefit of using Azure Monitor Log Analytics workspaces?

• a.They provision virtual machines
• b.They cache web content at the edge
• c.They host relational databases
• d.They collect and store log data so you can run queries and analyze it across resources✓

A Log Analytics workspace is a central repository where Azure Monitor stores log and performance data. You can query this data with a powerful language to investigate issues and build insights. Consolidating logs supports troubleshooting and reporting across your environment.

Which governance approach helps ensure resources are deployed only in approved geographic regions?

• a.Enabling zone-redundant storage
• b.Assigning the Reader RBAC role
• c.Applying a ReadOnly resource lock
• d.Using an Azure Policy that restricts allowed locations✓

A common Azure Policy restricts the regions in which resources may be deployed to an approved list. This supports data-residency and compliance requirements by preventing deployments elsewhere. Non-compliant deployment attempts are blocked or flagged.

What distinguishes RBAC from Azure Policy in governance?

• a.RBAC encrypts data and Policy provisions VMs
• b.RBAC controls who can do what to resources, while Azure Policy controls what configurations resources may have✓
• c.They are identical and interchangeable
• d.Azure Policy assigns user passwords

RBAC governs identity and access, determining which users or identities can perform which actions on resources. Azure Policy governs resource properties and configurations, enforcing standards regardless of who deploys. Used together, they provide comprehensive governance.

Which feature lets you group related alerts and manage the notification recipients and automated responses centrally?

• a.Availability zones
• b.Action groups✓
• c.Peering connections
• d.Blob tiers

Action groups centralize the recipients and actions that respond to alerts, such as notifying an on-call team or invoking automation. Reusing an action group across many alerts keeps notification logic consistent. This simplifies operations and incident handling.

What is a key reason to enable diagnostic settings on Azure resources?

• a.To reduce the resource's memory
• b.To physically relocate the datacenter
• c.To route resource logs and metrics to destinations like Log Analytics for analysis and retention✓
• d.To change the billing currency

Diagnostic settings specify where a resource's platform logs and metrics are sent, such as a Log Analytics workspace, storage account, or event hub. This enables long-term retention, analysis, and integration with monitoring tools. It is foundational to observability and auditing.

Which statement best describes how tags and Azure Policy can work together?

• a.Tags replace the need for RBAC
• b.Azure Policy deletes all tags on creation
• c.Tags disable all Azure Policies
• d.Azure Policy can require, add, or enforce specific tags on resources automatically✓

Azure Policy can mandate that resources carry certain tags, append missing tags, or inherit tags from their resource group. This automates and enforces tagging standards across the environment. Consistent tags then power accurate cost tracking and organization.

Which factor most directly increases the monthly cost of an Azure virtual machine?

• a.The number of tags applied to the resource
• b.The VM size (its number of vCPUs and amount of memory)✓
• c.The number of descriptive metadata tags and key-value labels attached to the resource
• d.The color theme selected in the Azure portal

Compute cost scales with the VM size you select, because larger SKUs allocate more vCPUs and memory. Tags, names, and portal themes are metadata or cosmetic and have no effect on price.

How is network bandwidth generally billed in Azure?

• a.Outbound data transfer leaving Azure is typically charged, while most inbound data is free✓
• b.All inbound and outbound data transfer is billed at the same flat rate
• c.Network bandwidth is always included at no cost in every service
• d.Only the inbound data transferred into the Azure datacenter is metered and billed to the customer

Azure generally charges for egress (data flowing out of its datacenters) while ingress is usually free. This is why moving large volumes of data out of a region is a common, sometimes overlooked, cost driver.

Why might the exact same virtual machine size cost a different amount in two different Azure regions?

• a.Regions located farther from the equator always charge a premium because of higher cooling demands
• b.Pricing varies by region because the cost to operate each datacenter differs✓
• c.Region has no effect on price; all regions charge identical rates
• d.Only the primary region can host virtual machines at full price

Azure prices services per region, reflecting differences in local energy, land, labor, and taxes. Choosing a lower-cost region for latency-tolerant workloads is a legitimate optimization technique.

Azure Reservations require the customer to make what kind of commitment in exchange for a discount?

• a.A commitment to never resize the reserved resource
• b.A month-to-month commitment that can be canceled anytime for free
• c.A one-year or three-year commitment to a specific resource✓
• d.A commitment to keep the resource in a single availability zone

Reservations trade a 1-year or 3-year usage commitment for pricing well below pay-as-you-go. They fit steady, predictable workloads because you are effectively pre-paying for capacity you know you will use.

What does the Azure Hybrid Benefit allow an organization to do?

• a.Run Azure services for free for the first three years of a subscription
• b.Combine two separate Azure regions into a single shared billing zone with one blended rate
• c.Reuse existing on-premises Windows Server or SQL Server licenses with Software Assurance to lower Azure costs✓
• d.Automatically move on-premises servers into Azure without any migration tools

Azure Hybrid Benefit lets you apply eligible licenses you already own to Azure workloads, avoiding paying again for the software portion. It can be combined with Reservations for even deeper savings.

What can happen to an Azure Spot Virtual Machine when Azure needs the underlying capacity back?

• a.It is automatically upgraded to a reserved instance at no charge
• b.It continues running with a guaranteed service-level agreement
• c.It is migrated live to another region with guaranteed uptime
• d.It can be evicted (deallocated) with little notice✓

Spot VMs use Azure's surplus capacity at steep discounts, but Azure can reclaim that capacity at any time by evicting the VM. They are therefore appropriate only for interruptible, fault-tolerant work.

Azure Dev/Test pricing offers what advantage to eligible subscriptions?

• a.The automatic promotion and conversion of finished dev/test environments straight into production
• b.Guaranteed higher performance than standard subscriptions
• c.Reduced rates on certain services for non-production development and testing workloads✓
• d.A permanently free production environment for any workload

Dev/Test offers discounted rates on select services for teams building and testing, provided the resources are not used in production. It helps lower the cost of non-critical environments.

A budget alert in Microsoft Cost Management notifies stakeholders based on what?

• a.The number of resources deployed regardless of their cost
• b.Whether a resource has been assigned the correct tags
• c.The ambient physical temperature reported by sensors inside the datacenter facility
• d.Actual or forecasted spending crossing a defined threshold✓

Budgets track spend for a chosen scope and fire alerts when actual or forecasted costs approach the limit you set. This gives teams advance warning before overspending occurs.

Which action is an example of 'right-sizing' to reduce Azure costs?

• a.Moving every workload to the most expensive region
• b.Permanently deleting all diagnostic and activity logs in order to free up storage space
• c.Adding more tags to each resource to trigger discounts
• d.Resizing a consistently underutilized virtual machine to a smaller SKU✓

Right-sizing matches a resource's capacity to its real demand, so an over-provisioned VM is scaled down to a cheaper SKU. Azure Advisor frequently surfaces right-sizing opportunities.

What is the billing effect of stopping (deallocating) an Azure virtual machine?

• a.All storage and networking charges are eliminated immediately
• b.You are charged the same as when the VM is running
• c.The virtual machine is permanently deleted along with all of its attached data disks
• d.You stop paying for its compute while deallocated, though you still pay for attached disks✓

Deallocating releases the compute resources so you no longer pay for vCPU/memory time, but persistent disks and reserved IPs still incur charges. Fully stopped-deallocated is different from merely shutting down the guest OS.

How does autoscaling help control cost?

• a.It removes capacity when demand falls, so you avoid paying for idle resources✓
• b.It disables resource monitoring so that fewer metrics are collected and billed each month
• c.It applies a flat discount to every resource in the subscription
• d.It permanently locks capacity at the maximum size to avoid outages

Autoscaling adds instances during spikes and removes them when load drops, aligning spend with real demand. Paying only for what you actively use is a core cloud cost principle.

Moving rarely accessed blob data to the cool or archive access tier has what effect?

• a.It increases the redundancy to geo-redundant automatically
• b.It speeds up frequent read operations on that data
• c.It lowers storage cost for infrequently accessed data✓
• d.It converts the data into a relational database

Cooler tiers charge less for storage in exchange for higher access costs and, for archive, retrieval latency. Placing seldom-read data in the right tier is a simple, effective saving.

You want to estimate the monthly price of a new architecture before you deploy anything. Which tool should you use?

• a.Microsoft Defender for Cloud
• b.The Total Cost of Ownership (TCO) Calculator
• c.The Azure Pricing Calculator✓
• d.Azure Service Health

The Pricing Calculator models the cost of a configuration you plan to build in Azure. The TCO Calculator, by contrast, compares existing on-premises costs against Azure.

Your finance team wants to compare the cost of your current on-premises datacenter against running the same workloads in Azure. Which tool fits best?

• a.The Total Cost of Ownership (TCO) Calculator tool for migrations
• b.The Total Cost of Ownership (TCO) Calculator✓
• c.The Azure Pricing Calculator
• d.Azure Monitor

The TCO Calculator estimates the savings of migrating existing infrastructure to Azure, factoring in hardware, power, and staffing. It is aimed at building the business case for migration.

Which of the following is a genuine factor that affects the cost of an Azure service?

• a.The type of resource and the settings you choose for it✓
• b.The web browser used to access the portal
• c.How many users are viewing the Azure portal
• d.The number of characters in the resource's display name

Cost depends on the resource type, its configuration (size, tier, redundancy), and its region. Cosmetic factors like names or the browser used have no bearing on billing.

At which scopes can you analyze spending in Microsoft Cost Management?

• a.Management group, subscription, and resource group✓
• b.Only at the scope of one individual resource at a time
• c.Only for resources tagged as production
• d.Only across the entire Azure global cloud

Cost Management lets you view and filter costs at management group, subscription, and resource-group scopes. This flexibility supports both organization-wide and team-level financial visibility.

What does a 'free tier' offered by some Azure services provide?

• a.Unlimited use of the service forever at no charge
• b.A discount that applies to every other Azure service
• c.A limited amount of the service that you can use at no charge✓
• d.Brand-new physical server hardware shipped directly to your office

Many services include a free tier or free monthly allotment up to a defined limit, after which normal charges apply. It lets you evaluate or run small workloads without cost.

What does consumption-based (metered) billing mean in Azure?

• a.You are billed only once per year with no usage tracking
• b.You pay a single fixed fee regardless of how much you use
• c.You must purchase and rack physical server hardware before using any of the service
• d.You are charged per unit of usage, such as per GB stored or per compute hour✓

Metered billing charges for the actual quantity of a resource consumed, like gigabytes or vCPU-hours. This pay-for-what-you-use model is central to cloud economics.

Azure Reservations deliver the best value for which kind of workload?

• a.Workloads that can tolerate being evicted from their capacity at any moment
• b.Experimental workloads whose usage is completely unknown
• c.Short-lived batch jobs that run for only a few minutes
• d.Steady-state, predictable workloads that run consistently✓

Because a reservation is a 1- or 3-year commitment, it pays off when a resource runs consistently over that period. Unpredictable or interruptible workloads are better served by pay-as-you-go or Spot.

A cost alert in Microsoft Cost Management is primarily used to do what?

• a.Encrypt all of the subscription's billing data for regulatory compliance
• b.Notify the right people when spending reaches a defined threshold✓
• c.Increase the resource limits of the subscription
• d.Automatically shut down every resource in the subscription

Cost alerts watch spend against budgets or thresholds and send notifications so teams can react before overspending. They are informational triggers, not automatic resource controls.

To attribute cloud spend to a specific project for internal chargeback, what is the recommended approach?

• a.Assign each project its own physical datacenter
• b.Apply a consistent tag to the project's resources and filter cost analysis by that tag✓
• c.Provision a separate, dedicated Azure region exclusively for each individual project
• d.Rename every resource to include the project name in the resource ID

Consistent tagging lets Cost Management group and report spend by project, department, or environment. Filtering cost analysis on the tag produces accurate chargeback or showback figures.

An Azure savings plan for compute provides a discount in exchange for what commitment?

• a.Committing to never scale the workload up or down
• b.Committing to a fixed hourly spend on compute for a one- or three-year term✓
• c.Committing to use only a single availability zone
• d.Committing to delete all existing pay-as-you-go resources before the discount applies

A savings plan discounts compute usage up to a chosen hourly dollar commitment over 1 or 3 years, offering more flexibility than a reservation tied to a specific SKU. Usage above the commitment is billed at pay-as-you-go rates.

How is data transfer between two different Azure regions generally treated for billing?

• a.It is always free regardless of volume
• b.It is billed only if the regions are in different continents at a premium rate only
• c.It is charged the same as data written to local disk
• d.It is typically charged as inter-region (egress) bandwidth✓

Moving data across regions incurs egress bandwidth charges, unlike much traffic that stays within a region. Architects weigh this when deciding where to replicate or process data.

Which products can benefit from Azure Hybrid Benefit licensing savings?

• a.Only open-source database engines running inside Linux containers
• b.Only services that have no on-premises equivalent
• c.Windows Server and SQL Server (and certain Linux subscriptions)✓
• d.Any third-party software installed on a virtual machine

Azure Hybrid Benefit applies to eligible Windows Server and SQL Server licenses with Software Assurance, plus some Linux subscriptions. It reduces the software portion of the cost for those specific products.

Why are Azure Spot Virtual Machines offered at a large discount?

• a.They run on Azure's spare, unused capacity that can be reclaimed when needed✓
• b.They come with a stronger uptime guarantee than standard VMs
• c.They store data on slower disks that never change price
• d.They are permanently limited to only the very smallest available virtual machine sizes

Spot pricing monetizes idle capacity, so the discount reflects the risk that Azure may evict the VM to serve paying, on-demand customers. That trade-off makes Spot ideal for interruptible workloads.

A common, often-overlooked source of unnecessary Azure spend is which of the following?

• a.Applying additional descriptive tags and labels to every resource in the subscription
• b.Following Azure Advisor cost recommendations
• c.Over-provisioned or idle resources that continue to run without being used✓
• d.Reviewing the cost analysis dashboard regularly

Idle VMs, oversized SKUs, and orphaned disks keep billing while delivering no value. Regularly identifying and removing or resizing them is a primary optimization activity.

Azure Advisor's cost recommendations might suggest which of the following?

• a.Turning off all security monitoring to save money
• b.Buying reservations or resizing and shutting down underused virtual machines✓
• c.Moving all data to the most expensive storage tier
• d.Deleting your entire production subscription and all of the resources it contains

Advisor analyzes usage and recommends actions such as purchasing reservations or right-sizing idle VMs to cut cost. Its guidance is tailored to your actual resource utilization.

What is the role of an Azure billing account?

• a.It securely stores the encryption keys and certificates for all resources
• b.It defines which regions a subscription may deploy to
• c.It hosts the virtual machines used for billing calculations
• d.It manages invoices and payment for one or more subscriptions✓

A billing account is the top-level construct for managing invoices, payment methods, and the subscriptions grouped under it. It separates financial administration from technical resource management.

What does the cost forecast feature in Microsoft Cost Management help you do?

• a.Automatically purchase reservations on your behalf
• b.Guarantee that costs will never exceed a set amount
• c.Predict likely future spending based on historical usage patterns✓
• d.Encrypt and archive historical billing records for long-term retention

Forecasting projects future costs from past trends so teams can plan budgets and spot looming overruns. It is a planning aid, not an automatic spending control.

What is the scope flexibility of an Azure Reservation?

• a.It is limited to resources created after the reservation is purchased
• b.It can only ever be applied to one individual virtual machine at a time within the subscription
• c.It must be applied to every region simultaneously
• d.It can apply to a single subscription or be shared across all subscriptions in the billing account✓

Reservation scope can be set to a specific subscription or shared, letting the discount apply wherever matching usage occurs. Shared scope maximizes utilization of the commitment across an organization.

What is an Azure Policy initiative (also called a policy set)?

• a.A tool that encrypts resources that violate policy
• b.A group of related policy definitions managed and assigned together as a single unit✓
• c.A billing report that itemizes the monthly cost of every policy assignment you have made
• d.A single policy that can only ever contain one rule

An initiative bundles multiple policy definitions so you can assign and track them as one, with a unified compliance view. This simplifies enforcing a whole standard, such as a security baseline.

Which Azure Policy effect blocks a non-compliant resource from being created or updated?

• a.Append
• b.Deny✓
• c.Disabled
• d.Audit

The Deny effect stops a deployment that would violate the policy from ever succeeding. Audit only records non-compliance, while Append and Modify adjust the resource instead of blocking it.

Which Azure Policy effect records non-compliant resources without preventing their deployment?

• a.Audit✓
• b.Encrypt
• c.Delete
• d.Deny

The Audit effect logs a compliance warning but still allows the resource to be created. It is useful for measuring compliance before you enforce a stricter Deny.

What is the purpose of an Azure Policy exemption?

• a.To increase the compliance score artificially for all resources
• b.To exclude a specific resource or scope from evaluation of a policy or initiative✓
• c.To automatically and permanently delete any resource that is found to be non-compliant
• d.To grant a user administrative access to a subscription

An exemption formally excuses a resource or scope from a policy assignment, often for a documented business reason. It keeps compliance reporting honest by marking the exclusion rather than hiding it.

If you apply a CanNotDelete lock at the resource group level, what happens to the resources inside that group?

• a.The lock applies only to the resource group's name, not its contents
• b.They are immediately deleted to enforce the lock
• c.Only resources created after the lock are affected
• d.They inherit the lock and cannot be deleted until it is removed✓

Locks applied at a parent scope are inherited by child resources, so a CanNotDelete lock on a group protects every resource within it. The lock must be removed before those resources can be deleted.

A ReadOnly resource lock permits which operations on the locked resource?

• a.Deleting the resource, but without being able to read any of its properties
• b.All operations, with a warning message
• c.Reading the resource only; no create, update, or delete actions✓
• d.Reading and updating, but not deleting

A ReadOnly lock is the stricter of the two lock types, blocking any modification or deletion while still allowing the resource to be viewed. CanNotDelete is the less restrictive option that allows updates.

How do Azure Blueprints differ from a plain ARM template?

• a.Blueprints package templates together with policies and role assignments and keep a relationship to what was deployed✓
• b.Blueprints are used solely to estimate the projected monthly cost of a planned deployment before any resources are actually created
• c.Blueprints replace the need for subscriptions entirely
• d.Blueprints can only deploy a single virtual machine at a time

A blueprint orchestrates multiple artifacts (ARM templates, policy assignments, and RBAC) as a repeatable package and maintains a connection to the deployed environment. A standalone template only defines resources without that governance bundle.

What is Microsoft Purview primarily used for?

• a.Delivering content from edge locations
• b.Provisioning virtual machines at scale
• c.Hosting and serving relational databases for transactional applications across many regions worldwide
• d.Unified data governance: discovering, classifying, and managing data across an organization's estate✓

Microsoft Purview helps organizations map, classify, and govern data wherever it lives, on-premises and in the cloud. It supports compliance by making sensitive data discoverable and manageable.

What does the Microsoft Service Trust Portal provide?

• a.Live performance metrics for your own resources
• b.A tool whose sole purpose is to author and validate custom Azure Policy definitions written in JSON format
• c.Audit reports, compliance certifications, and security documentation about Microsoft's cloud services✓
• d.A place to deploy and manage your virtual machines

The Service Trust Portal is where you access Microsoft's independent audit reports (such as ISO and SOC) and compliance materials. Auditors and compliance teams use it to verify Microsoft's controls.

Azure Advisor groups its recommendations into which set of categories?

• a.Public, private, hybrid, and community
• b.Bronze, silver, gold, and platinum support tiers for each resource
• c.Compute, storage, networking, and databases
• d.Cost, security, reliability, operational excellence, and performance✓

Advisor aligns its guidance to five pillars: cost, security, reliability, operational excellence, and performance. This mirrors the well-architected approach to running healthy workloads.

Where can you review Microsoft's independent compliance certifications, such as ISO 27001 or SOC reports?

• a.A Network Security Group
• b.The Service Trust Portal (Microsoft's Trust Center)✓
• c.The Azure Pricing Calculator
• d.The Azure mobile app installed on phones and tablets

The Service Trust Portal and Trust Center publish Microsoft's certifications and audit documentation for customers and auditors. They demonstrate the compliance foundation Microsoft provides.

Microsoft Purview can automatically apply what to help protect sensitive information?

• a.Redundant availability zones inside a single region
• b.Network security group rules
• c.Virtual machine scale sets
• d.Data classifications and sensitivity labels✓

Purview scans data sources and can classify content and apply sensitivity labels, making it easier to govern and protect regulated data. Classification is the basis for downstream policies and reporting.

Every Microsoft Entra tenant in Azure has a single top-level management group known as what?

• a.The default resource group
• b.The root management group (Tenant Root Group)✓
• c.The global administrator account
• d.The organization's primary billing subscription

All management groups roll up to one built-in root management group at the top of the hierarchy. Policies or access assigned there can be inherited by every subscription in the tenant.

When does Azure Policy evaluate resources for compliance?

• a.Only when a user manually deletes a resource
• b.Only once, on the day the policy is written
• c.When a resource is created or updated, and again during periodic compliance scans✓
• d.Only once per month, at the moment the monthly invoice for the subscription is generated

Policy evaluates at resource creation/update and on a recurring schedule so existing resources are also assessed. This keeps the compliance picture current as your environment changes.

In cloud governance, what is the overarching goal?

• a.Making every resource publicly accessible
• b.Ensuring resources are used consistently, securely, and in line with organizational standards✓
• c.Guaranteeing that no resource is ever deleted
• d.Eliminating the need for any ongoing monitoring, logging, or auditing across the entire environment

Governance is about maintaining control, consistency, and compliance as an environment grows. Tools like Policy, RBAC, locks, and Blueprints implement that control at scale.

Do Azure resources automatically inherit tags from their parent resource group?

• a.Yes, but only the very first tag on the resource group is ever inherited by its resources
• b.Yes, every tag on a resource group is copied to its resources automatically
• c.No, and tags cannot be enforced in any way
• d.No; tags are not inherited by default, though Azure Policy can be used to enforce them✓

By default a resource does not pick up its resource group's tags automatically. To standardize tagging you can use Azure Policy effects such as Modify or Append to add required tags.

Azure Blueprints can lock the resources it deploys in order to do what?

• a.Reduce the cost of the deployed resources
• b.Automatically translate the resources to another language
• c.Prevent tampering or unauthorized changes to the governed resources✓
• d.Speeding up query performance on all of the databases within the group

Blueprint locking protects deployed resources so that even privileged users cannot alter or delete them, preserving the governed baseline. This enforces the intended configuration after deployment.

What is the purpose of a remediation task in Azure Policy?

• a.To delete the policy definition permanently
• b.To bring existing non-compliant resources into compliance with a policy✓
• c.To generate an invoice for policy usage
• d.To create an entirely new subscription and resource group within the tenant

Remediation tasks apply corrective effects (like Modify or DeployIfNotExists) to resources that already exist and are non-compliant. This fixes drift without recreating the resources.

The regulatory compliance dashboard in Microsoft Defender for Cloud maps your security posture against what?

• a.Industry and regulatory standards such as ISO 27001 or PCI DSS✓
• b.The current number of descriptive tags applied to each individual resource
• c.The current price of your subscription
• d.The physical distance between datacenters

Defender for Cloud can assess your environment against built-in regulatory standards and show where you fall short. This helps demonstrate and improve compliance against frameworks you must meet.

Even a user with the Owner role cannot delete a resource in which situation?

• a.When the resource is in a different region
• b.When a CanNotDelete lock is applied to the resource✓
• c.When the targeted resource has more than five tags applied to it
• d.When the subscription has a budget defined

Resource locks override RBAC permissions, so a CanNotDelete lock blocks deletion regardless of a user's role. The lock must be removed first, which itself requires appropriate permissions.

Which Azure Policy effect can automatically deploy a related resource when it is found to be missing?

• a.Deny
• b.Audit
• c.DeployIfNotExists✓
• d.Disabled

DeployIfNotExists triggers a deployment to add a required companion resource (for example, a diagnostic setting) when it is absent. It enforces standards by provisioning the missing piece rather than just blocking.

Azure provides many ready-made policy definitions so you do not have to write your own. These are called what?

• a.Deprecated policy definitions
• b.Built-in policy definitions✓
• c.Locked policy definitions
• d.Custom policy definitions

Built-in policies cover common governance needs, such as allowed locations or required tags, and can be assigned directly. Custom definitions are only needed when built-ins do not cover a specific requirement.

What does a tag applied to an Azure resource consist of?

• a.A name (key) paired with a value✓
• b.A single number assigned by Azure automatically
• c.A physical barcode on the server
• d.An encryption certificate

Each tag is a key-value pair, such as environment=production, that adds descriptive metadata. Consistent key-value tagging powers cost reporting, organization, and policy enforcement.

What is the primary benefit of organizing subscriptions into a management group hierarchy?

• a.It physically relocates the datacenters closer together
• b.Governance such as policy and access can be applied once and inherited by all subscriptions beneath it✓
• c.It automatically doubles the compute capacity
• d.It completely removes the need to use resource groups or subscriptions anywhere in the entire organization

Management groups let you assign Azure Policy and RBAC at a higher level so every subscription under them inherits the settings. This provides consistent governance across a large, multi-subscription organization.

At which scopes can an Azure Policy assignment be applied?

• a.Only on storage accounts created within the subscription
• b.Only at the level of an individual user account
• c.Management group, subscription, or resource group✓
• d.Only at the global Azure level for all customers

Policy can be assigned at a management group, subscription, or resource group, and it applies to everything within that scope. Broader scopes are inherited downward, enabling wide or targeted enforcement.

What is the Purview data map?

• a.A foundation that captures metadata about an organization's data assets across sources✓
• b.A network diagram of Azure regions
• c.A pricing sheet for storage services
• d.A prioritized list of recommended virtual machine sizes and pricing tiers for each workload

The data map is the underlying inventory in Purview that records metadata about scanned data assets. It enables discovery, lineage, and classification across the data estate.

Who primarily benefits from the documents available in the Service Trust Portal?

• a.End users trying to reset their passwords
• b.Customers estimating the price of a service
• c.Developers who are actively deploying and configuring a new virtual machine in the portal
• d.Auditors and compliance teams who need Microsoft's audit reports and certifications✓

The Service Trust Portal serves compliance, risk, and audit professionals verifying Microsoft's controls. It centralizes the evidence organizations need to satisfy their own regulators.

What does publishing a blueprint definition allow you to do?

• a.Assign a specific, versioned copy of the blueprint to a subscription✓
• b.Delete all existing subscriptions automatically
• c.To disable all Azure Policy enforcement across the entire organization's tenant
• d.Convert the blueprint into a virtual machine

Publishing creates a versioned blueprint that can then be assigned to subscriptions, deploying its artifacts consistently. Versioning lets you evolve the governance package over time in a controlled way.

Why would an organization group several policies into a single initiative?

• a.To automatically convert existing policy definitions into equivalent RBAC role assignments for users
• b.To simplify assignment and get one combined compliance view for a set of related policies✓
• c.To make each policy cost less to run
• d.To hide non-compliant resources from reporting

Grouping policies into an initiative means you assign and monitor them together, which is far easier for a broad standard than managing dozens of separate policies. Compliance is then reported at the initiative level.

Where can a custom Azure Policy definition be stored so it can be reused across scopes?

• a.Only inside a single virtual machine's disk
• b.Only inside a single public GitHub source-code repository shared with the community
• c.At a management group or subscription, so it can be assigned to child scopes✓
• d.Only within a Network Security Group

Custom policy definitions are saved at a management group or subscription scope, from which they can be assigned to that scope and everything beneath it. Storing at a management group maximizes reuse across many subscriptions.

Microsoft Entra ID was previously known by what name?

• a.Azure Resource Manager
• b.Azure Key Vault
• c.Windows Server Active Directory only
• d.Azure Active Directory (Azure AD)✓

Microsoft rebranded Azure Active Directory as Microsoft Entra ID. It remains Microsoft's cloud identity and access management service for signing in and securing access to resources.

In identity and access management, what does 'authentication' establish?

• a.How much a user's activity will cost
• b.What actions a user is permitted to perform
• c.Who a user is, by verifying their identity✓
• d.Which region a user's data is stored in

Authentication (AuthN) confirms identity, typically through credentials or factors like a password plus a phone prompt. It answers 'who are you?' before any access decision is made.

What does 'authorization' determine after a user has signed in?

• a.What resources and actions the authenticated user is allowed to access✓
• b.Whether the user's password is spelled correctly
• c.Which datacenter the user physically visited
• d.How fast the user's home internet network connection currently happens to be

Authorization (AuthZ) decides what an already-authenticated identity may do, such as read a file or manage a VM. In Azure, RBAC is the primary mechanism for authorization.

In an access request, which process happens first?

• a.Authentication happens first, then authorization✓
• b.Neither is required if the user is inside the corporate network
• c.They always happen at exactly the same instant with no order
• d.Authorization happens first, then authentication

You must first prove who you are (authentication) before the system can decide what you may do (authorization). Getting this order right is fundamental to secure access.

What does multifactor authentication (MFA) require from a user?

• a.Two or more verification factors of different types✓
• b.Only the user's email address
• c.A single password that is simply very long and complex
• d.Two passwords that are exactly the same

MFA combines factors from different categories, such as something you know plus something you have or are. Requiring multiple factors greatly reduces the risk from a stolen password.

Which of the following is an example of the 'something you have' authentication factor?

• a.A fingerprint scan or other biometric reading taken from the user
• b.A security question answer
• c.A code from a phone authenticator app or a hardware token✓
• d.A memorized password

'Something you have' refers to a possession like a phone, authenticator app, or hardware key. A password is 'something you know' and a fingerprint is 'something you are.'

What threat does multifactor authentication most directly protect against?

• a.Accidental overspending against a defined subscription cost budget
• b.High network latency between regions
• c.Physical damage to the datacenter
• d.Unauthorized access when a password has been compromised✓

Even if an attacker steals a password, MFA blocks them because they lack the second factor. This makes MFA one of the most effective single controls against account takeover.

What does Conditional Access in Microsoft Entra ID let an organization do?

• a.Estimate the cost of future deployments
• b.Provision virtual machines automatically
• c.Store and serve large amounts of unstructured object and blob data across many regions
• d.Enforce access controls based on signals such as user, location, device, and risk✓

Conditional Access evaluates signals at sign-in and then applies controls, like requiring MFA or a compliant device. It brings access decisions in line with real-world risk.

Which is a realistic example of a Conditional Access policy?

• a.Changing the portal theme based on the time of day
• b.Automatically deleting a user's files after each login
• c.Requiring MFA when a user signs in from an unfamiliar or untrusted location✓
• d.Automatically doubling the storage redundancy tier each time a user signs into the app

A typical Conditional Access rule strengthens verification for risky conditions, such as sign-ins from unexpected locations. This lets low-risk access stay frictionless while high-risk access is challenged.

How do Azure RBAC roles and Microsoft Entra ID roles differ in what they control?

• a.They are completely identical, fully interchangeable features that control exactly the same scope of access across Azure
• b.Azure RBAC roles control access to Azure resources, while Entra ID roles control identity and directory tasks✓
• c.Entra ID roles control network bandwidth while RBAC controls encryption
• d.RBAC controls billing while Entra roles control storage tiers

Azure RBAC governs actions on resources like VMs and storage, whereas Entra ID (directory) roles govern tasks like managing users and groups. Understanding the split prevents over- or under-granting access.

Which of the following is an example of passwordless authentication?

• a.Signing in with Windows Hello, a FIDO2 security key, or the Microsoft Authenticator app✓
• b.Emailing your current account password to yourself so you can retrieve it later for safekeeping
• c.Writing the password on a sticky note
• d.Typing a long password followed by a PIN

Passwordless methods verify identity without a typed password, using biometrics, a security key, or an app approval. They improve both security and user experience by removing the weakest link.

What is a core guiding principle of the Zero Trust security model?

• a.Grant every user administrator access by default
• b.Never trust, always verify each request explicitly✓
• c.Disable authentication for internal applications
• d.Trust any request that originates inside the corporate network

Zero Trust assumes no implicit trust based on network location and verifies every request. It combines explicit verification, least-privilege access, and an assume-breach mindset.

Which set of ideas represents the guiding principles of Zero Trust?

• a.Granting broad standing access, disabling MFA, and hiding all of the alerts
• b.Encrypt nothing, allow legacy protocols, and trust every device
• c.Trust the network, share all credentials, and skip logging
• d.Verify explicitly, use least-privilege access, and assume breach✓

Zero Trust rests on verifying every request, granting only the minimum access needed, and designing as though a breach has already happened. These principles reduce both the likelihood and impact of compromise.

What does a defense-in-depth security strategy rely on?

• a.Trusting all internal traffic without inspection
• b.Removing all authentication requirements in order to simplify user access
• c.A single strong firewall as the only protection
• d.Multiple layers of controls so no single failure exposes everything✓

Defense in depth stacks independent controls, so if one layer is bypassed, others still protect the asset. Each layer slows or stops an attacker, buying time to detect and respond.

Which of the following represents a layer in the defense-in-depth model?

• a.The identity and access layer✓
• b.The portal color-theme layer
• c.The invoice generation layer
• d.The resource naming and tagging layer

Defense in depth includes layers such as physical, identity/access, perimeter, network, compute, application, and data. Identity is a critical layer, often called the modern security perimeter.

What does the Secure Score in Microsoft Defender for Cloud help you do?

• a.Encrypt data automatically without configuration
• b.Calculate the exact monthly bill for compute
• c.Automatically choosing whichever Azure region has the lowest network latency
• d.Measure your current security posture and track improvements over time✓

Secure Score summarizes how well your environment follows security best practices and rises as you remediate recommendations. It gives teams a clear, trackable target for hardening.

Conditional Access is a capability of which Microsoft Entra ID licensing level?

• a.A tier that is exclusive to on-premises Active Directory
• b.The free tier available to everyone
• c.A premium tier (Entra ID P1 or P2)✓
• d.A tier included only with virtual machines

Conditional Access requires an Entra ID premium license rather than the free tier. Organizations that need risk-based access controls plan for the appropriate licensing.

What does Microsoft Entra B2B collaboration enable?

• a.Migrating virtual machines between regions
• b.Automatically encrypting all blob storage data while it is at rest in every region
• c.Automatically lowering your Azure bill
• d.Inviting external guest users to securely access your organization's resources✓

Entra B2B lets you invite partners and vendors as guest identities so they can access shared apps and resources without a separate account in your systems. You control what those guests can reach.

What is Microsoft Entra External ID (formerly Azure AD B2C) primarily used for?

• a.Managing identity and sign-in for customer-facing (consumer) applications✓
• b.Provisioning Azure virtual networks
• c.Managing internal employee payroll
• d.Storing and serving very large media, image, and video files for applications

External ID / B2C provides customizable sign-up and sign-in experiences for the customers of an app. It keeps consumer identities separate from an organization's internal workforce directory.

In Microsoft Entra ID, what does a 'tenant' represent?

• a.A single virtual machine running the directory
• b.A monthly billing invoice generated for identity and directory services
• c.A physical rack of servers in one datacenter
• d.A dedicated, isolated instance of the directory for an organization✓

A tenant is an organization's own isolated directory instance, containing its users, groups, and app registrations. Each tenant is logically separated from every other organization's directory.

What does Privileged Identity Management (PIM) in Microsoft Entra ID provide?

• a.Free virtual machines for administrators
• b.The automatic scheduled deletion of all inactive guest user accounts each month
• c.Just-in-time, time-bound privileged access that can require approval✓
• d.Permanent administrator rights for all users

PIM reduces standing privilege by granting elevated roles only when needed, for a limited time, often with approval and auditing. This shrinks the window in which powerful permissions can be misused.

What do Microsoft Entra ID security defaults primarily do?

• a.Move all of the organization's data into one single centralized region
• b.Enforce baseline protections, such as requiring MFA for users✓
• c.Disable all sign-in requirements for convenience
• d.Automatically buy reservations to save money

Security defaults turn on a set of preconfigured, sensible protections like MFA and blocking legacy authentication. They give organizations a strong baseline without building custom policies.

In cloud security, identity is frequently described as the new what?

• a.Billing boundary
• b.The archived cool storage tier layer
• c.Security perimeter✓
• d.Physical firewall

Because users and services connect from anywhere, controlling identity has become the primary boundary rather than the network edge. This shift underpins Zero Trust thinking.

What is an advantage of assigning an Azure role to a group rather than to individual users?

• a.It completely removes the need for any form of user authentication entirely
• b.It automatically encrypts all resources
• c.It makes each user's access completely invisible
• d.It simplifies access management and scales better as membership changes✓

Assigning roles to groups means you manage access by adding or removing members rather than editing many individual assignments. This reduces errors and administrative effort at scale.

The lifecycle of a system-assigned managed identity is tied to what?

• a.A password stored in the application code
• b.The Azure resource on which it is enabled✓
• c.The region's availability zones
• d.The billing account's payment method

A system-assigned managed identity is created with its resource and deleted when that resource is deleted. This tight lifecycle removes the burden of managing credentials separately.

Which signal can a Conditional Access policy evaluate when deciding whether to allow access?

• a.Sign-in risk, device state, location, or the application being accessed✓
• b.The individual user's personally preferred favorite color and portal theme
• c.The number of tags on a resource group
• d.The current price of a virtual machine

Conditional Access weighs signals like user and sign-in risk, device compliance, location, and the target app. Based on those, it can allow, block, or require additional controls such as MFA.

How do single sign-on (SSO) and multifactor authentication (MFA) complement each other?

• a.SSO encrypts data while MFA provisions servers
• b.They are exactly the same feature simply offered under two different marketing names with no real difference
• c.SSO reduces the number of logins for convenience, while MFA adds verification factors for security✓
• d.MFA removes the need to ever authenticate again

SSO improves usability by letting one authentication grant access to many apps, and MFA strengthens that single authentication with extra factors. Used together, they balance convenience and strong security.

What does cloud security posture management (CSPM) in Microsoft Defender for Cloud focus on?

• a.Provisioning and configuring brand-new virtual networks and their subnets automatically
• b.Translating documentation into other languages
• c.Reducing the price of storage accounts
• d.Finding misconfigurations and continuously improving your security posture✓

CSPM continuously assesses resources for weaknesses and misconfigurations and recommends fixes, feeding the Secure Score. It helps prevent breaches by closing gaps before they are exploited.

How does the Zero Trust model differ from the traditional 'castle-and-moat' network approach?

• a.It only applies to physical building security
• b.It trusts all internal and external traffic equally without checks
• c.It does not automatically trust a request just because it originates inside the network✓
• d.It completely removes the need for any user accounts or sign-in credentials across the organization

The old model trusted anything inside the perimeter; Zero Trust verifies every request regardless of origin. This reflects modern reality where users and threats can be anywhere.

How does just-in-time (JIT) VM access in Microsoft Defender for Cloud reduce risk?

• a.It automatically doubles the virtual machine's compute and memory capacity each time a session opens
• b.It permanently opens all ports for convenience
• c.It opens management ports only when needed, for a limited time, instead of leaving them always open✓
• d.It deletes the virtual machine after each session

JIT access keeps management ports closed until a user requests time-limited access, shrinking the attack surface. Leaving RDP or SSH always open is a common source of compromise that JIT mitigates.

Which of the following is a valid Microsoft Entra ID authentication method?

• a.A blob storage tier
• b.An availability zone
• c.A resource lock applied to a resource group
• d.The Microsoft Authenticator app✓

Entra ID supports methods like passwords, the Authenticator app, FIDO2 keys, and Windows Hello. Offering multiple methods enables MFA and passwordless sign-in.

A Conditional Access policy can be set to grant access only if which condition is met?

• a.The resource group has fewer than ten resources
• b.The device is compliant or marked as managed✓
• c.The subscription has a budget configured
• d.The user has been active for over a year

Grant controls in Conditional Access can require conditions such as a compliant device, MFA, or an approved client app. This ties access to the security state of the device and user.

What does self-service password reset (SSPR) in Microsoft Entra ID allow users to do?

• a.Reset their own passwords securely without contacting the help desk✓
• b.The ability to delete other users' accounts and reset their passwords
• c.Change the region of a subscription
• d.Grant themselves administrator roles

SSPR lets users recover access on their own after verifying identity, reducing help-desk load and downtime. It is typically paired with registered authentication methods for security.

What does identity federation allow?

• a.The purchase of reservations on the user's behalf
• b.The encryption of all network traffic by default
• c.A trust relationship so users authenticated by one identity provider can access another system✓
• d.The automatic scheduled deletion of unused and orphaned resources across the whole environment

Federation establishes trust between identity providers so a user can sign in once with their home provider and access federated apps. It underpins many single sign-on scenarios across organizations.

Encrypting data at rest is a control that operates at which defense-in-depth layer?

• a.The identity layer
• b.The perimeter layer
• c.The data layer✓
• d.The physical layer

Protecting stored data with encryption is a control at the innermost data layer. If outer layers are breached, encryption still helps keep the underlying data unreadable.

A distributed denial-of-service (DDoS) protection service operates primarily at which defense-in-depth layer?

• a.The data layer
• b.The application code layer
• c.The identity layer
• d.The perimeter layer✓

DDoS protection defends the network edge where traffic first enters, making it a perimeter-layer control. It absorbs or filters volumetric attacks before they reach internal resources.

Restricting communication between resources using Network Security Groups is a control at which defense-in-depth layer?

• a.The network layer✓
• b.The data layer
• c.The physical layer
• d.The application layer

NSGs filter traffic between subnets and resources, placing them at the network layer of defense in depth. Segmenting the network limits how far an attacker can move if they get in.

How does Microsoft Entra ID differ from traditional Windows Server Active Directory?

• a.It is a legacy service that is completely unable to authenticate any users or applications at all in the cloud
• b.It only manages printers and file shares
• c.It is a cloud identity service that uses modern web protocols rather than domains, OUs, and group policy✓
• d.It is simply Active Directory installed on a local server

Entra ID is a cloud-native identity provider built around protocols like OAuth, OpenID Connect, and SAML, not the on-premises constructs of Windows Server AD. The two can be integrated but are not the same product.

An external user invited to your directory through Entra B2B appears as which type of account?

• a.A service principal owner
• b.A guest user✓
• c.A billing account holder
• d.A global administrator

B2B invitations create guest identities in your tenant, which you can then authorize for specific resources. Guests remain distinct from your internal member users.

A common Conditional Access baseline recommendation is to do what?

• a.Require users to share passwords with the help desk
• b.Allow all sign-ins without any verification
• c.Disabling the logging of all user sign-in and directory audit events
• d.Block legacy authentication protocols that do not support MFA✓

Legacy authentication protocols cannot enforce MFA and are frequently abused in attacks, so blocking them is a standard hardening step. Conditional Access can enforce this across the organization.

What happens when you act on the recommendations behind your Secure Score in Defender for Cloud?

• a.Your subscription's billing currency is silently changed
• b.Your data is moved to a random region
• c.Your subscription is automatically deleted
• d.Your score rises and your overall risk is reduced✓

Each remediated recommendation improves your posture and increases the Secure Score. The score is a practical, trackable way to prioritize security work.

What is a break-glass (emergency access) account and why is it used?

• a.A temporary guest account for external vendors
• b.A standard, closely monitored read-only account that is used only for routine daily status reporting to management teams
• c.A shared account whose password is posted publicly
• d.A highly privileged account, safeguarded and usually excluded from normal Conditional Access, kept for emergencies✓

Break-glass accounts ensure administrators can still sign in if MFA or Conditional Access services fail or lock everyone out. They are tightly controlled, closely monitored, and used only in emergencies.

Risk-based Conditional Access and Privileged Identity Management require which Microsoft Entra ID license?

• a.The free tier
• b.A Windows Server license
• c.Entra ID P2✓
• d.No license at all

Advanced identity protection features like PIM and risk-based Conditional Access are part of the Entra ID P2 tier. Organizations needing these plan their licensing accordingly.

From where can Azure Monitor collect telemetry?

• a.From Azure resources, applications, and even on-premises or other-cloud sources✓
• b.Only from resources located in one region
• c.Only from a single virtual machine at a time
• d.Only from storage accounts that are located within a single Azure region at a time

Azure Monitor is a broad observability platform that ingests metrics and logs from Azure, apps, and hybrid or multi-cloud environments. This unified view helps detect and diagnose issues anywhere.

What are Azure Monitor metrics?

• a.Numeric values collected at regular intervals as time-series data✓
• b.Encryption keys used to secure resources
• c.Static images and other files that are stored in blob storage containers
• d.Free-form text notes written by administrators

Metrics are lightweight, time-stamped numeric measurements (like CPU percentage) sampled at intervals. Their time-series nature makes them ideal for near-real-time charts and threshold alerts.

What are Azure Monitor Logs (Log Analytics) best described as?

• a.A place to store virtual machine disks
• b.A billing report for network egress
• c.Records of varied data queried with the Kusto Query Language (KQL)✓
• d.A network firewall service that inspects and blocks inbound traffic

Logs hold richer, structured, and text data that you analyze using KQL in a Log Analytics workspace. They support deep investigation, correlation, and reporting across many sources.

What is Application Insights used for?

• a.Monitoring the performance, usage, and failures of applications (application performance management)✓
• b.Provisioning virtual networks
• c.Automatically encrypting all sensitive data while it is at rest across every storage service in the environment
• d.Managing user passwords

Application Insights is the APM feature of Azure Monitor, tracking request rates, response times, exceptions, and dependencies. Developers use it to find and fix performance and reliability problems.

Which of the following does Application Insights track for a web application?

• a.The physical temperature of the server room
• b.Request rates, response times, failure rates, and dependency calls✓
• c.The billing currency that is configured for the entire subscription
• d.The number of resource groups in a subscription

Application Insights instruments an app to capture telemetry such as request timing, failures, and external dependency behavior. This visibility helps pinpoint bottlenecks and errors in code.

What does Azure Service Health notify you about?

• a.The single most optimal virtual machine size and pricing tier recommended for your specific workload
• b.Azure service issues, planned maintenance, and health advisories that may affect your resources✓
• c.The number of tags applied to each resource
• d.The remaining balance on your credit card

Service Health provides a personalized view of Azure incidents, maintenance, and advisories relevant to the services and regions you use. It helps you understand whether a problem is on Azure's side.

What does Azure Resource Health report?

• a.The current health status of a specific resource instance✓
• b.The overall compliance state of every assigned policy definition
• c.The overall price of the subscription
• d.The list of users with access to a resource

Resource Health drills down to whether an individual resource is available and, if not, whether the cause is platform- or user-related. It complements the broader Service Health view.

How does the personalized Azure Service Health differ from the public Azure status page?

• a.Service Health only ever shows subscription billing and payment information to the customer
• b.The public status page updates only once per year
• c.The public status page is only visible to Microsoft employees
• d.Service Health is tailored to the specific resources and subscriptions you use✓

The public status page shows broad, global service status, while Service Health filters and personalizes information to your environment. That focus makes Service Health more actionable for your workloads.

An Azure Monitor metric alert fires under what condition?

• a.When any resource within the resource group is renamed by a user
• b.When a new user signs into the portal
• c.When a tag is added to a resource
• d.When a monitored metric crosses a threshold you have defined✓

Metric alerts continuously evaluate a metric against your threshold and trigger when the condition is met, such as CPU above 80 percent. They enable fast, automated response to performance problems.

What is a log (search) alert in Azure Monitor based on?

• a.The color of the portal dashboard
• b.The chosen display name of the parent resource group container
• c.The number of availability zones in a region
• d.The results of a log query run against collected log data✓

Log alerts run a KQL query on a schedule and fire when the results meet a condition, like a certain number of errors appearing. They catch patterns that simple metric thresholds cannot express.

What do Azure dashboards let you do?

• a.It can completely replace the need for any user authentication across services
• b.Automatically write application code
• c.Pin and visualize metrics and resources together in one customizable view✓
• d.Physically rewire the datacenter network

Dashboards provide a personalized canvas where you can pin charts, resource tiles, and query results for at-a-glance monitoring. Teams tailor them to the signals they care about most.

What do Azure Monitor Workbooks provide?

• a.A managed network firewall service for inbound and outbound traffic
• b.Interactive reports that combine data, text, and visualizations✓
• c.A storage tier for archived blobs
• d.A way to buy reserved instances

Workbooks let you build rich, interactive reports mixing queries, parameters, charts, and narrative text. They are ideal for shareable investigations and operational dashboards.

Which query language is used to analyze data in Azure Monitor Log Analytics?

• a.Kusto Query Language (KQL)✓
• b.Structured Query Language for relational tables only
• c.The Bicep domain-specific language
• d.HyperText Markup Language

KQL is the read-only query language for exploring logs and other data in Log Analytics. Its expressive filtering and aggregation make it central to Azure observability.

What do Azure Monitor 'insights' (such as VM insights or Container insights) provide?

• a.A convenient built-in way to bypass user authentication for administrators
• b.Automatic price reductions for those resources
• c.Physical relocation of the resources
• d.Curated, ready-made monitoring experiences for specific resource types✓

Insights are pre-built monitoring solutions tuned to particular services, offering relevant dashboards and health views out of the box. They save you from assembling common monitoring from scratch.

What does Metrics Explorer in Azure Monitor let you do?

• a.Chart and analyze metric data over time interactively✓
• b.The ability to assign RBAC roles directly to application users
• c.Create blob storage containers
• d.Deploy new virtual machines

Metrics Explorer is the tool for plotting and slicing metric time-series, applying filters and splitting by dimensions. It is the go-to place to investigate performance trends.

What can Application Insights availability tests do?

• a.Regularly send requests to your web app from multiple locations to check its uptime and responsiveness✓
• b.Reduce the app's licensing cost
• c.Automatically encrypting the application's entire source code repository while it is stored at rest in the cloud
• d.Assign roles to application users

Availability tests probe your endpoint from various global points and alert you if it becomes slow or unreachable. This provides early warning of outages before users report them.

What does the Azure Activity Log record?

• a.The current hourly list price of each individual Azure service being used across the region today
• b.The contents of files stored in blob storage
• c.Subscription-level control-plane events, such as who created, modified, or deleted a resource✓
• d.The keystrokes typed inside a virtual machine

The Activity Log captures management operations against resources, providing an audit trail of what changed, when, and by whom. It is distinct from resource-level diagnostic logs that capture data-plane activity.

What is an important reason to assign a severity level to an Azure Monitor alert?

• a.To change how much the alert costs to store
• b.To decide which region the alert runs in
• c.To indicate the importance and urgency of the alert so teams can prioritize✓
• d.To encrypt the alert's notification message contents before they are delivered

Alert severity (from critical down to informational) helps operations teams triage and respond to the most urgent issues first. Consistent severities make on-call response more effective.

What is the Azure portal?

• a.A physical device shipped to your datacenter
• b.A command-line tool installed on a local computer
• c.A fully managed relational database engine and query service for hosting applications at scale
• d.A web-based graphical interface, accessed in a browser, for managing Azure resources✓

The Azure portal is the browser-based console where you can create, configure, and monitor resources visually. It suits interactive management and learning, complementing scripting tools.

What is the Azure CLI?

• a.A graphical dashboard for viewing metrics
• b.A global content delivery network for caching static files at edge locations
• c.A managed relational database
• d.A cross-platform command-line tool that uses commands beginning with 'az'✓

The Azure CLI lets you manage Azure from a terminal on Windows, macOS, or Linux using 'az' commands. It is well suited to automation and scripting of repeatable tasks.

How does Azure PowerShell manage Azure resources?

• a.By editing the physical server BIOS
• b.Through cmdlets provided by the Az module✓
• c.By sending emails to Microsoft support
• d.Through a graphical drag-and-drop designer only

Azure PowerShell uses cmdlets in the Az module to script and automate resource management. It appeals to teams already comfortable with PowerShell on Windows and beyond.

What is Azure Cloud Shell?

• a.A physical terminal located in an Azure datacenter
• b.A browser-based shell, offering Bash or PowerShell, that is authenticated and ready inside the portal✓
• c.A tool that only runs on Windows desktops
• d.A fully managed relational database service that automatically stores and queries structured data for you

Cloud Shell gives you a preconfigured command-line environment in the browser with the Azure tools already installed and signed in. It removes the need to install and update tooling locally.

What is a key benefit of using Azure Cloud Shell?

• a.No local installation is needed because the tools are preinstalled and kept up to date✓
• b.It permanently stores files without any storage account
• c.It only works while you are completely offline and disconnected from the internet entirely
• d.It runs without any Azure authentication

Cloud Shell comes with the CLI, PowerShell, and common tools ready to use, so you avoid local setup and maintenance. You can manage Azure from virtually any device with a browser.

ARM templates are authored in which format?

• a.Declarative JSON files✓
• b.Compiled binary executables
• c.Spreadsheet workbooks
• d.Plain-text email messages

ARM templates use JSON to declaratively describe the resources to deploy and their configuration. Storing infrastructure as these files enables repeatable, version-controlled deployments.

What is Bicep?

• a.A managed network load balancer that distributes incoming traffic across many backend resources automatically
• b.A managed NoSQL database
• c.A monitoring agent installed on virtual machines
• d.A domain-specific language that simplifies authoring infrastructure as code, transpiling to ARM JSON✓

Bicep offers a cleaner, more readable syntax than raw ARM JSON and compiles down to the same ARM templates. It makes infrastructure-as-code easier to write and maintain on Azure.

What does 'infrastructure as code' (IaC) mean?

• a.Writing application business logic in a database
• b.Manually clicking through the portal for each deployment
• c.Defining infrastructure in declarative files so deployments are repeatable and consistent✓
• d.Storing plaintext passwords and secrets directly inside the application's source code files

IaC captures the desired infrastructure in code (such as ARM or Bicep) that can be versioned, reviewed, and redeployed reliably. This reduces configuration drift and manual error.

ARM and Bicep templates are 'declarative,' meaning you specify what?

• a.The marketing copy for the application
• b.Each individual command in the exact order to run
• c.The desired end state of the infrastructure, not the step-by-step commands to build it✓
• d.The exact physical wiring and network cabling installed inside the datacenter facility racks

Declarative templates describe the target configuration, and Azure figures out how to reach it. This differs from imperative scripting, where you list each action explicitly.

What is true about both the Azure CLI and Azure PowerShell?

• a.They can perform the same management tasks, so the choice is largely preference and platform✓
• b.They can only be used inside the portal
• c.Neither can be used in automation scripts
• d.Only one of the two tools is actually able to create and manage resources across Azure services

Both tools expose the full breadth of Azure management, so teams pick based on familiarity and existing scripts. Each can be scripted for automation across platforms.

What does the Azure mobile app let you do?

• a.Running large-scale data-warehouse analytical queries across regions
• b.Replace the need for Azure Resource Manager
• c.Monitor and manage your Azure resources from a phone or tablet✓
• d.Physically install hardware in the datacenter

The Azure mobile app provides on-the-go access to check resource health, view alerts, and perform basic management. It is handy for responding to issues away from a desk.

What can you customize in the Azure portal to speed up your work?

• a.The global pricing of Azure services
• b.The underlying hardware of virtual machines
• c.Dashboards and a list of favorite services✓
• d.The physical location of Azure datacenters

You can build custom dashboards and mark frequently used services as favorites for quick navigation. Personalizing the portal makes routine management faster.

What does Azure Cloud Shell require in order to persist your files between sessions?

• a.An associated Azure Files share (backed by a storage account)✓
• b.A dedicated physical hard drive at your desk
• c.A public IP address assigned to your laptop
• d.A separate, paid Azure support plan and premium subscription add-on

Cloud Shell mounts an Azure Files share so your scripts and files survive across sessions. Without it, the environment would be ephemeral each time you connect.

You want to run the command 'az group create'. Which tool are you using?

• a.The Azure CLI✓
• b.Azure PowerShell
• c.Azure Monitor
• d.The Azure portal

Commands that start with 'az' belong to the Azure CLI. Azure PowerShell instead uses verb-noun cmdlets such as New-AzResourceGroup.

Redeploying the same ARM or Bicep template is described as idempotent. What does that mean?

• a.It produces the same end result without creating duplicate resources✓
• b.It can only ever be run a single time before it must be fully recreated
• c.It doubles the resources with each deployment
• d.It deletes everything and starts over each time

Idempotent deployments converge to the declared state, so running the template again does not create duplicates or unexpected changes. This makes redeployment safe and predictable.

Besides the portal, CLI, and PowerShell, how else can Azure be managed programmatically?

• a.Only by editing the datacenter hardware directly
• b.There is no other way to manage Azure
• c.Through REST APIs and language-specific SDKs✓
• d.Only by mailing a request form to Microsoft

Developers can call Azure's REST APIs directly or use SDKs for languages like Python, .NET, and Java. All of these ultimately route through Azure Resource Manager.

What is a benefit of using ARM or Bicep templates instead of clicking through the portal for deployments?

• a.Consistent, repeatable, and version-controlled deployments✓
• b.A firm guarantee that the resources will always cost nothing
• c.The inability to review changes before applying them
• d.Slower deployments that require more manual steps

Templates let you standardize environments, track changes in source control, and redeploy reliably. This is far more consistent than manual portal configuration for anything beyond a one-off.

When you use the portal, CLI, or PowerShell to make a change, the request ultimately goes through what?

• a.A single virtual machine you own
• b.Azure Resource Manager✓
• c.The Azure Pricing Calculator
• d.A Network Security Group

All management tools funnel their requests through Azure Resource Manager, which enforces authentication, authorization, and consistent handling. This is why behavior is uniform regardless of the tool you choose.

What does Azure Arc allow you to do?

• a.Physically ship Azure servers to your office
• b.Extend Azure management and governance to on-premises and other clouds' resources✓
• c.A firm guarantee that every workload you deploy will always run completely for free
• d.Replace the need for identity management

Azure Arc projects Azure's management plane onto servers, Kubernetes clusters, and services running outside Azure. This lets you apply policy, tagging, and monitoring consistently across hybrid and multi-cloud estates.

An Azure service-level agreement of 99.9% uptime permits roughly how much downtime per month?

• a.About 43 minutes✓
• b.About 3 days
• c.About 4 hours
• d.Zero minutes, since 99.9% means no downtime

A 99.9% monthly SLA allows roughly 43 minutes of downtime, while 99.99% allows only about 4 minutes. Understanding these figures helps set realistic availability expectations.

When you combine several Azure services in a single application, what typically happens to the overall (composite) SLA?

• a.It increases with each additional service
• b.It always stays fixed at exactly 100% no matter how many services are added
• c.It generally decreases as more services are chained together✓
• d.It becomes irrelevant once services are combined

Because each dependent service can independently fail, chaining them multiplies their individual SLAs, lowering the composite figure. Architects add redundancy to offset this effect.

If Azure fails to meet a service's SLA, what may a customer be entitled to receive?

• a.A full refund of all past invoices automatically
• b.Service credits applied to their bill✓
• c.Guaranteed prevention of all future outages
• d.Free physical servers

SLAs are financially backed by service credits, which compensate customers when uptime commitments are missed. Credits typically must be requested and scale with the shortfall.

What is generally true about Azure services that are still in preview?

• a.They always carry a stronger SLA than released services
• b.They are typically not covered by a service-level agreement✓
• c.They are only available to Microsoft employees
• d.They are firmly guaranteed to never change at all before their release

Preview features are provided for evaluation and usually lack SLA guarantees and full support. They may change or be removed before reaching general availability.

What does 'general availability' (GA) mean for an Azure service?

• a.It is a signal that the service will very soon be deprecated and retired from Azure entirely
• b.The service is available only to a small invited group
• c.The service is fully released, supported for production use, and backed by an SLA✓
• d.The service is free of charge forever

GA marks a service as production-ready with full support and SLA coverage. Organizations generally wait for GA before running critical workloads on a feature.

What characterizes an Azure feature that is in private preview?

• a.It carries the very highest availability SLA of any released Azure service
• b.It is available to a limited, invited set of customers for early testing✓
• c.It is open to every Azure customer without restriction
• d.It is fully supported for production workloads

Private preview limits access to selected customers who provide feedback before wider release. Such features are experimental and not intended for production.

What characterizes an Azure feature that is in public preview?

• a.It can never be changed or updated in any way before it finally reaches its release date
• b.It is open for any customer to try but is not recommended for production workloads✓
• c.It carries the same SLA as a GA service
• d.It is restricted to a handful of invited testers

Public preview lets all customers evaluate a feature, but without full SLA or support, so it is unsuitable for production. Feedback during this stage shapes the final release.

To increase the effective availability of a virtual machine workload, what can you do?

• a.Deleting all of the workload's backups in order to save on storage costs
• b.Remove all monitoring to lower overhead
• c.Deploy it across availability zones or run multiple instances✓
• d.Reduce it to a single instance in one datacenter

Spreading instances across availability zones or using multiple VMs raises the composite availability above a single instance's SLA. Redundancy is the primary way to exceed a single component's guarantee.

An Azure SLA provides a financially backed uptime commitment, but what does it NOT guarantee?

• a.That outages will never occur✓
• b.That credits are available if targets are missed
• c.That the commitment is measured over time
• d.That a defined uptime percentage is targeted

An SLA promises a target and compensation if it is missed, not that failures will never happen. Designing for resilience remains the customer's responsibility.

Achieving a higher overall availability than a single Azure service's SLA usually requires what?

• a.Applying more tags to the resource
• b.Turning off all diagnostic and activity logging on the resource
• c.Using a smaller virtual machine size
• d.Building redundancy across availability zones or regions✓

You raise availability by removing single points of failure through redundancy across zones or regions. This architectural effort, not configuration tweaks, drives higher composite SLAs.

How does Microsoft typically communicate that an Azure service or feature will be retired?

• a.By deleting it without any warning
• b.By changing the portal's color scheme
• c.Through advance notifications and published announcements✓
• d.Only quietly through the customer's regular monthly invoice

Microsoft provides advance notice of deprecations and retirements so customers can plan migrations. Staying aware of these announcements is part of managing the service lifecycle.

What should you expect from features that are in preview?

• a.They may change or be removed before reaching general availability✓
• b.They are permanently locked and can never be altered or updated again
• c.They are supported for mission-critical production use
• d.They always have a higher SLA than GA features

Preview features are still evolving, so their behavior, APIs, or availability can change before GA. This is why they are not recommended for production workloads.

What does a higher SLA percentage, such as 99.99% compared with 99.9%, indicate?

• a.More allowed downtime and lower availability
• b.That the service is still in private preview
• c.Less allowed downtime and therefore higher availability✓
• d.An automatically lower monthly subscription cost overall

Each additional nine reduces the permitted downtime substantially, so 99.99% is stricter than 99.9%. Higher targets usually demand more redundant, and costlier, designs.

Designing an architecture to achieve very high availability usually comes with what trade-off?

• a.Guaranteed lower cost than a single instance
• b.A reduction in the number of nines in the SLA
• c.Higher cost and greater complexity✓
• d.Complete elimination of all monitoring needs

Redundancy across zones or regions increases resource count and design complexity, which raises cost. Teams balance the value of extra availability against this added expense.

A single-instance Azure virtual machine using premium SSD disks is offered with an SLA of approximately what?

• a.About 99.9% availability✓
• b.About 50% availability
• c.Exactly 100% availability with no downtime
• d.No SLA at all under any configuration

A single VM with premium storage carries roughly a 99.9% SLA, whereas spreading VMs across availability zones raises the guarantee. The storage type and deployment topology both influence the committed figure.

You need daily Azure cost data delivered automatically to a storage account for external analysis. What should you configure?

• a.A ReadOnly role assignment placed on the subscription's monthly invoice records
• b.A scheduled export in Microsoft Cost Management✓
• c.A resource lock that freezes all further charges on the billing account permanently
• d.A Network Security Group rule that forwards the billing data outward to storage

Cost Management supports scheduled exports that push cost and usage data to a storage account on a recurring basis. This enables downstream reporting and integration with external analytics tools.

Which Microsoft Entra ID feature governs the ways users can prove their identity, such as the Authenticator app or a FIDO2 key?

• a.Authentication methods✓
• b.A network firewall that inspects all sign-in traffic before it reaches the directory
• c.A collection of resource locks that stop users from changing their own passwords
• d.A billing feature that charges the tenant a small fee per successful sign-in event

Authentication methods define how users verify identity, including passwords, the Authenticator app, FIDO2 keys, and Windows Hello. Administrators enable and manage these methods to support MFA and passwordless sign-in.

You want an alert to automatically trigger a webhook or Logic App when it fires. What must the alert reference?

• a.A Log Analytics workspace that permanently stores the notification templates used
• b.A resource lock configured to prevent the alert from ever being modified again
• c.A budget threshold defined in Microsoft Cost Management for the whole subscription
• d.An action group✓

An action group is the reusable set of notifications and automated actions (email, SMS, webhook, Logic App, function) that an alert invokes when it fires. Referencing one lets alerts drive automated responses.

Your organization must ensure new storage accounts are always created with a required 'CostCenter' tag. Which tool enforces this at creation time?

• a.An Azure Advisor recommendation that periodically suggests adding the missing tag
• b.Azure Policy✓
• c.A CanNotDelete resource lock applied automatically to each new storage account created
• d.A custom RBAC role that grants tagging permissions to every user across the tenant

Azure Policy can require a specific tag at deployment, denying non-compliant creations or appending the tag automatically. RBAC controls who can act, and Advisor only recommends, so neither enforces configuration standards.