Azure Fundamentals (AZ-900) — All Questions

Which cloud service model gives you the most control over the operating system, networking, and installed software, while the provider manages only the physical hardware?

• a.Function as a Service (FaaS)
• b.Software as a Service (SaaS)
• c.Infrastructure as a Service (IaaS)✓
• d.Platform as a Service (PaaS)

IaaS provides virtualized compute, storage, and networking, leaving the customer responsible for the operating system and everything above it. The provider only manages the underlying physical infrastructure. This gives the greatest flexibility but also the most administrative overhead.

In which cloud service model does the provider deliver a complete, ready-to-use application over the internet, such as a hosted email or CRM product?

• a.Infrastructure as a Service (IaaS)
• b.Platform as a Service (PaaS)
• c.Software as a Service (SaaS)✓
• d.Desktop as a Service (DaaS)

SaaS delivers finished software that users simply consume, usually through a web browser. The provider manages everything from the hardware up to the application itself. Customers only configure settings and manage their own data and users.

A development team wants to deploy code without managing the underlying servers, operating system patches, or runtime. Which model best fits this need?

• a.Infrastructure as a Service (IaaS)
• b.Colocation hosting
• c.Platform as a Service (PaaS)✓
• d.Software as a Service (SaaS)

PaaS provides a managed platform including the operating system, runtime, and middleware, so developers focus only on their application code and data. The provider handles patching and infrastructure maintenance. This accelerates development while reducing operational burden.

What is the primary financial benefit of the cloud's consumption-based (pay-as-you-go) pricing model?

• a.Hardware must be purchased upfront for the year
• b.You pay only for the resources you actually use, converting capital expense into operating expense✓
• c.You receive a fixed monthly bill regardless of usage
• d.Costs are hidden until an annual audit

Consumption-based pricing charges you only for the compute, storage, and services you consume. This shifts spending from large upfront capital expenditure (CapEx) to flexible operating expenditure (OpEx). It lets organizations avoid over-provisioning and align cost with demand.

Which cloud benefit describes the ability to quickly add or remove resources to match changing demand?

• a.Scalability and elasticity✓
• b.High latency
• c.Manual provisioning
• d.Vendor lock-in

Scalability lets you increase capacity as workloads grow, while elasticity automatically adds or removes resources in response to demand. Together they ensure applications perform well during spikes and save money during quiet periods. This responsiveness is a core advantage of cloud computing.

What does the term 'high availability' primarily refer to in cloud computing?

• a.Keeping applications running and accessible with minimal downtime✓
• b.Encrypting data at rest
• c.Reducing the number of servers to save money
• d.Storing data in a single location

High availability means designing systems so they remain operational even when individual components fail. Cloud platforms achieve this through redundancy, load balancing, and distribution across fault domains. The goal is to minimize service interruptions and meet uptime commitments.

In the shared responsibility model, which task is ALWAYS the customer's responsibility regardless of the service model used?

• a.Maintaining the physical datacenter security
• b.Securing the physical network cabling
• c.Replacing failed physical hard drives
• d.Managing the data, accounts, and access identities✓

The customer always retains responsibility for their own data, user accounts, and identity/access management no matter which service model is chosen. The provider is always responsible for the physical datacenter and hardware. Responsibilities in between shift depending on IaaS, PaaS, or SaaS.

Under the shared responsibility model for IaaS, who is responsible for patching the guest operating system on a virtual machine?

• a.No patching is required in the cloud
• b.The customer✓
• c.The hardware vendor
• d.The cloud provider

With IaaS, the customer manages the virtual machine's operating system, including applying security patches and updates. The provider only maintains the physical host and hypervisor. This division is central to understanding cloud security obligations.

Which type of cloud deployment combines on-premises infrastructure with public cloud resources, allowing data and applications to move between them?

• a.Private cloud only
• b.Community cloud
• c.Hybrid cloud✓
• d.Public cloud only

A hybrid cloud connects private, on-premises environments with public cloud services so workloads can span both. This lets organizations keep sensitive systems local while bursting to the public cloud for scale. It is popular for gradual migration and regulatory needs.

What is a defining characteristic of a public cloud deployment?

• a.Hardware is dedicated exclusively to one organization on-premises
• b.Resources are owned and operated by a third-party provider and shared among multiple organizations✓
• c.It cannot connect to the internet
• d.It requires the customer to own the datacenter

In a public cloud, a third-party provider owns the infrastructure and offers services to many customers over the internet. Resources are multi-tenant and delivered on demand. This model offers low upfront cost and virtually unlimited scale.

Which deployment model dedicates cloud infrastructure to a single organization, often for stricter control or compliance?

• a.Private cloud✓
• b.Public cloud
• c.Hybrid cloud
• d.Multi-tenant SaaS

A private cloud provides computing resources used exclusively by one organization, whether hosted on-premises or by a provider. It offers greater control and isolation, which helps meet strict security or regulatory requirements. The trade-off is typically higher cost and management effort.

What is meant by 'agility' as a benefit of cloud computing?

• a.The requirement to sign multi-year hardware contracts
• b.The ability to rapidly develop, test, and deploy applications✓
• c.The guarantee of zero cost
• d.The elimination of all security concerns

Agility refers to how quickly you can provision resources and bring solutions to market in the cloud. Instead of waiting weeks to procure hardware, teams spin up environments in minutes. This speed accelerates innovation and experimentation.

Which concept describes distributing resources across multiple physical datacenters so a single failure does not take down a service?

• a.Data sovereignty
• b.Consumption-based billing
• c.Fault tolerance and redundancy✓
• d.Vertical scaling

Fault tolerance uses redundant components and locations so the failure of one does not disrupt the overall service. Cloud providers replicate resources across isolated fault domains. This design keeps applications available during hardware or facility failures.

What distinguishes 'vertical scaling' from 'horizontal scaling'?

• a.They are identical terms
• b.Vertical scaling adds more instances, while horizontal scaling adds CPU/RAM
• c.Vertical scaling adds power (CPU/RAM) to an existing resource, while horizontal scaling adds more instances✓
• d.Vertical scaling only applies to storage

Vertical scaling (scaling up) increases the capacity of a single machine by adding CPU, memory, or disk. Horizontal scaling (scaling out) adds more machines or instances to share the load. Cloud platforms support both, but scaling out is often more resilient.

Which of the following is an example of an operating expense (OpEx) enabled by the cloud?

• a.A one-time purchase of physical servers
• b.Buying a datacenter building
• c.A monthly bill for the compute hours consumed✓
• d.Purchasing networking hardware upfront

OpEx refers to ongoing, usage-based spending such as a monthly cloud bill for consumed services. This contrasts with CapEx, which is a large upfront purchase of assets. The cloud's pay-as-you-go model favors OpEx, improving cash flow and flexibility.

What does 'disaster recovery' in the cloud primarily help an organization achieve?

• a.Restoring systems and data quickly after a major outage or failure✓
• b.Eliminating the need for backups
• c.Reducing the monthly subscription cost
• d.Increasing application latency

Disaster recovery is the practice of restoring IT systems and data after a significant disruptive event. Cloud services make this easier and more affordable by replicating data to other regions. This minimizes downtime and data loss during major incidents.

Which cloud characteristic allows many customers to share the same physical infrastructure while remaining logically isolated?

• a.Single-tenancy
• b.Multi-tenancy✓
• c.Colocation
• d.On-premises hosting

Multi-tenancy means multiple customers (tenants) share the same underlying physical resources while their data and workloads stay logically separated. This efficient use of hardware lowers costs for everyone. Providers enforce strong isolation to keep tenants secure from one another.

A company wants to avoid the cost and effort of maintaining physical servers. Which cloud advantage most directly addresses this?

• a.Longer procurement times
• b.Increased hardware ownership
• c.Reduced infrastructure management responsibility✓
• d.Higher capital expenditure

By moving to the cloud, organizations offload the purchase, maintenance, and refresh of physical hardware to the provider. This reduces the management burden and staffing needed for datacenters. Teams can then focus on applications and business value instead of infrastructure.

What is the main purpose of a service-level agreement (SLA) offered by a cloud provider?

• a.It lists the provider's employees
• b.It formally defines the expected performance and uptime guarantees for a service✓
• c.It encrypts customer data automatically
• d.It sets the price of physical hardware

An SLA is a formal commitment that specifies metrics such as guaranteed uptime and availability for a service. If the provider fails to meet these targets, customers may receive service credits. SLAs help organizations plan for reliability and set expectations.

Which of the following best describes 'elasticity' in cloud computing?

• a.Applications must be manually restarted daily
• b.Resources remain fixed regardless of load
• c.Storage is limited to a single disk
• d.Resources automatically expand or contract to match real-time demand✓

Elasticity is the automatic scaling of resources up or down in response to workload changes. During a traffic spike, more capacity is added; when demand falls, capacity is released. This keeps performance steady while avoiding payment for idle resources.

In the shared responsibility model for SaaS, which responsibility shifts almost entirely to the provider?

• a.Managing the application, runtime, and operating system✓
• b.Setting data-sharing permissions
• c.Choosing which users get accounts
• d.Managing user access and data classification

In SaaS, the provider manages nearly the entire stack including the application, runtime, and operating system. The customer's remaining duties center on their data, users, and access configuration. This makes SaaS the lowest-maintenance model for consumers.

Why is 'geographic distribution' of datacenters valuable to cloud customers?

• a.It increases the physical distance data must travel
• b.It forces all data into one country
• c.It lets applications serve users from nearby locations, reducing latency and improving resilience✓
• d.It removes the need for redundancy

Providers operate datacenters around the world so applications can run close to their users. This lowers latency and improves the user experience. Geographic spread also supports disaster recovery and compliance with data-residency requirements.

Which statement about capital expenditure (CapEx) is correct?

• a.It is a recurring monthly usage charge
• b.It only applies to cloud subscriptions
• c.It is a large upfront investment in physical assets like servers and datacenters✓
• d.It eliminates the need to own hardware

CapEx is spending on tangible assets, such as buying servers or building a datacenter, that are used over many years. Traditional on-premises IT relies heavily on CapEx. Cloud computing reduces CapEx by shifting toward pay-as-you-go OpEx.

What is a key reason organizations adopt cloud computing for 'reliability'?

• a.Built-in redundancy and backups keep services running and recoverable during failures✓
• b.It makes applications run offline permanently
• c.It guarantees the code has no bugs
• d.It removes the need for testing

Reliability in the cloud comes from redundant infrastructure, automated backups, and the ability to recover quickly from failures. Providers design their platforms to keep services available and data protected. This lets organizations meet uptime and continuity goals more easily.

A workload experiences predictable spikes every weekday morning. Which cloud capability lets it automatically add capacity during those spikes and remove it afterward?

• a.Data archiving
• b.Static provisioning
• c.Autoscaling✓
• d.Manual server purchasing

Autoscaling monitors demand and adjusts the number of running resources automatically. During predictable morning spikes it adds instances, then removes them when traffic subsides. This maintains performance while controlling cost, a hallmark of elastic cloud design.

Which of the following is generally NOT considered a benefit of moving to the public cloud?

• a.Full ownership and physical control of the underlying hardware✓
• b.Reduced upfront capital costs
• c.Scalability on demand
• d.Global reach and availability

Public cloud customers do not own or physically control the hardware; that stays with the provider. The recognized benefits include on-demand scalability, lower upfront costs, and global reach. Trading physical control for these advantages is the essence of the public cloud model.

In Azure, what is the primary purpose of a resource group?

• a.It is a billing currency
• b.It is a physical server rack
• c.It is a network firewall device
• d.It is a logical container that holds related Azure resources for management as a unit✓

A resource group is a logical container used to organize and manage related Azure resources together. Resources in a group typically share the same lifecycle, such as being deployed, updated, and deleted together. It also serves as a scope for applying permissions and policies.

What does an Azure region represent?

• a.A billing account
• b.A type of virtual machine
• c.A single physical server
• d.A set of datacenters deployed within a defined geographic area, connected by a low-latency network✓

An Azure region is a geographic area containing one or more datacenters networked together with low latency. Customers choose regions to place resources close to users and to meet data-residency needs. Region selection affects performance, cost, and available services.

What are Availability Zones within an Azure region designed to protect against?

• a.Incorrect billing charges
• b.Datacenter-level failures, by providing physically separate locations with independent power and networking✓
• c.Software bugs in your application
• d.Expired user passwords

Availability Zones are physically separate datacenters within a region, each with independent power, cooling, and networking. Distributing resources across zones protects applications from the failure of a single datacenter. This improves high availability within a single region.

Which Azure service provides on-demand, scalable virtual machines that you fully control at the operating system level?

• a.Azure App Service
• b.Azure Virtual Machines✓
• c.Azure Blob Storage
• d.Azure Functions

Azure Virtual Machines is an IaaS offering that lets you run and control full virtual servers in the cloud. You choose the OS, size, and installed software, and you manage patching and configuration. It suits workloads needing maximum control or custom environments.

Which Azure service is a fully managed platform for hosting web applications and APIs without managing the underlying servers?

• a.Azure App Service✓
• b.Azure Virtual Machines
• c.Azure Blob Storage
• d.Azure Virtual Network

Azure App Service is a PaaS offering for building and hosting web apps, REST APIs, and mobile backends. It manages the infrastructure, patching, and scaling so developers focus on code. It supports multiple languages and integrates with CI/CD pipelines.

Which Azure service lets you run small pieces of code (functions) without provisioning or managing servers, billed only while the code runs?

• a.Azure Functions✓
• b.Azure SQL Database
• c.Azure Kubernetes Service
• d.Azure Virtual Machines

Azure Functions is a serverless compute service that runs event-triggered code without managing infrastructure. You are billed based on executions and resource consumption while the function runs. It is ideal for lightweight, event-driven, or intermittent workloads.

Which Azure storage service is optimized for storing massive amounts of unstructured data such as images, videos, and backups?

• a.Azure SQL Database
• b.Azure Virtual Network
• c.Azure Blob Storage✓
• d.Azure Files

Azure Blob Storage is designed for large volumes of unstructured object data like media files, documents, and backups. It offers tiers (hot, cool, archive) to balance cost and access frequency. It is accessible over HTTP/HTTPS from anywhere.

Which Azure service provides fully managed file shares accessible over the SMB and NFS protocols?

• a.Azure Table Storage
• b.Azure Queue Storage
• c.Azure Files✓
• d.Azure Blob Storage

Azure Files offers managed cloud file shares that can be mounted by cloud or on-premises machines using SMB or NFS. It is useful for lift-and-shift scenarios and shared application data. Multiple systems can access the same files concurrently.

What is the primary function of an Azure Virtual Network (VNet)?

• a.It hosts serverless functions
• b.It provides an isolated, private network in Azure for resources to securely communicate✓
• c.It stores unstructured blobs
• d.It manages user identities

An Azure Virtual Network (VNet) is the fundamental building block for private networking in Azure. It lets resources such as VMs communicate securely with each other, the internet, and on-premises networks. VNets support subnets, routing, and network security controls.

Which service is Microsoft's cloud-based identity and access management solution used to sign in and access resources?

• a.Microsoft Entra ID✓
• b.Azure Virtual Machines
• c.Azure Monitor
• d.Azure Blob Storage

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity and access management service. It authenticates users and controls access to applications and Azure resources. It supports single sign-on, multifactor authentication, and conditional access.

Which Azure networking service acts as a load balancer that distributes incoming traffic across multiple backend resources?

• a.Azure Functions
• b.Azure Blob Storage
• c.Microsoft Entra ID
• d.Azure Load Balancer✓

Azure Load Balancer distributes inbound network traffic across a pool of backend resources such as virtual machines. This improves availability and scalability by preventing any single resource from being overwhelmed. It operates at the transport layer (Layer 4).

Which service securely connects an on-premises network to Azure over an encrypted tunnel across the public internet?

• a.Azure Functions
• b.Azure VPN Gateway✓
• c.Azure Blob Storage
• d.Azure Policy

Azure VPN Gateway establishes encrypted site-to-site or point-to-site connections between on-premises networks and Azure VNets over the internet. It secures traffic using IPsec/IKE tunnels. It is a common choice for hybrid connectivity when a private circuit is not required.

Which Azure service provides a dedicated, private connection from your on-premises network to Azure that does not traverse the public internet?

• a.Azure VPN Gateway
• b.Azure ExpressRoute✓
• c.Azure Blob Storage
• d.Azure DNS

Azure ExpressRoute creates a private, dedicated connection between on-premises infrastructure and Azure through a connectivity provider. Because traffic bypasses the public internet, it offers more reliability, consistent latency, and higher security. It suits large-scale or mission-critical hybrid workloads.

Which Azure service is a fully managed relational database based on the SQL Server engine?

• a.Azure Files
• b.Azure Blob Storage
• c.Azure Cosmos DB
• d.Azure SQL Database✓

Azure SQL Database is a fully managed PaaS relational database built on the SQL Server engine. Microsoft handles patching, backups, and high availability, reducing administrative work. It is ideal for applications needing a managed relational data store.

Which Azure service is a globally distributed, multi-model NoSQL database designed for low-latency access at planetary scale?

• a.Azure SQL Database
• b.Azure Blob Storage
• c.Azure Cosmos DB✓
• d.Azure Files

Azure Cosmos DB is a globally distributed NoSQL database offering low latency and elastic scalability. It supports multiple data models and APIs and can replicate data across regions. It is suited to globally responsive applications needing guaranteed performance.

What is the purpose of a subnet within an Azure Virtual Network?

• a.It segments the VNet's IP address space to organize and isolate groups of resources✓
• b.It manages user passwords
• c.It stores backup files
• d.It provides serverless compute

A subnet divides a VNet's address range into smaller segments, letting you group and isolate resources. Segmentation improves security and organization, for example separating web and database tiers. Network security rules can be applied at the subnet level.

Which Azure service provides a container orchestration platform for deploying and managing containerized applications at scale?

• a.Azure DNS
• b.Azure Kubernetes Service (AKS)✓
• c.Azure Blob Storage
• d.Azure SQL Database

Azure Kubernetes Service (AKS) is a managed Kubernetes offering for orchestrating containerized workloads. It automates cluster management tasks such as scaling and upgrades. It is used to run microservices and portable containerized applications efficiently.

Which Azure service lets you run individual containers quickly without managing virtual machines or orchestrators?

• a.Azure Blob Storage
• b.Azure Kubernetes Service
• c.Azure Container Instances (ACI)✓
• d.Azure Virtual Machines

Azure Container Instances (ACI) runs containers on demand without provisioning or managing underlying servers or orchestration. It is ideal for simple, short-lived, or burst workloads. You pay per second for the compute resources the container consumes.

What does a Network Security Group (NSG) do in Azure?

• a.It manages billing alerts
• b.It hosts web applications
• c.It stores relational data
• d.It filters inbound and outbound network traffic to resources using allow/deny rules✓

A Network Security Group contains security rules that allow or deny network traffic to and from Azure resources such as VMs and subnets. Rules are based on source, destination, port, and protocol. NSGs are a core tool for controlling network-level access.

Which Azure service provides scalable, name-resolution (DNS) hosting for your domains within Azure?

• a.Azure Blob Storage
• b.Azure Policy
• c.Azure Functions
• d.Azure DNS✓

Azure DNS hosts your domain's DNS records on Microsoft's global network of name servers. It provides fast, reliable name resolution using Azure's infrastructure. You manage DNS records with the same tools and credentials as other Azure resources.

What is the main benefit of using availability sets for virtual machines in Azure?

• a.They encrypt all stored data
• b.They provide serverless functions
• c.They reduce the cost of storage
• d.They distribute VMs across fault and update domains to reduce the impact of hardware failures and maintenance✓

Availability sets group VMs across multiple fault domains and update domains within a datacenter. This ensures that hardware failures or planned maintenance affect only a subset of the VMs. As a result, the application stays available during such events.

Which Azure storage redundancy option keeps multiple copies of your data within a single datacenter?

• a.Read-access geo-redundant storage (RA-GRS)
• b.Locally redundant storage (LRS)✓
• c.Geo-redundant storage (GRS)
• d.Zone-redundant storage (ZRS)

Locally redundant storage (LRS) replicates data three times within a single physical location in the primary region. It is the lowest-cost option but does not protect against a datacenter-wide outage. Higher redundancy tiers spread copies across zones or regions.

Which storage redundancy option replicates data to a secondary region hundreds of miles away for regional disaster protection?

• a.Locally redundant storage (LRS)
• b.Premium SSD
• c.Geo-redundant storage (GRS)✓
• d.Zone-redundant storage (ZRS)

Geo-redundant storage (GRS) copies data to a secondary region far from the primary one. This protects against a complete regional outage such as a natural disaster. It offers the highest durability among the standard redundancy options.

What is Azure Blob Storage's 'archive' access tier best suited for?

• a.Real-time streaming video
• b.Rarely accessed data that can tolerate retrieval latency, stored at the lowest cost✓
• c.Active database files
• d.Frequently accessed transactional data

The archive tier stores data offline at the lowest cost, intended for long-term retention of rarely accessed data. Retrieving archived data takes time (rehydration) and incurs higher access costs. It suits compliance archives and backups that are seldom read.

Which Azure service provides a global content delivery network (CDN) to cache content closer to users?

• a.Microsoft Entra ID
• b.Azure Functions
• c.Azure SQL Database
• d.Azure Content Delivery Network (CDN)✓

Azure CDN caches static content at edge locations around the world, delivering it from a point of presence near each user. This reduces latency and offloads traffic from the origin. It improves performance for websites, media, and downloads.

Which Azure networking service provides a Layer 7 (application layer) load balancer with features like URL-based routing and web application firewall?

• a.Azure Blob Storage
• b.Azure Load Balancer
• c.Azure DNS
• d.Azure Application Gateway✓

Azure Application Gateway is a web traffic load balancer operating at Layer 7 (the application layer). It supports URL-based routing, SSL termination, and an optional Web Application Firewall (WAF). This makes it suited to advanced HTTP/HTTPS routing scenarios.

What is the role of a management group in the Azure resource hierarchy?

• a.It hosts virtual machines
• b.It provides DNS resolution
• c.It organizes multiple subscriptions together so governance can be applied across them✓
• d.It stores blob data

A management group sits above subscriptions in the Azure hierarchy and groups them for unified governance. Policies and access assignments applied to a management group flow down to all subscriptions within it. This simplifies management for organizations with many subscriptions.

Which statement correctly orders the Azure resource hierarchy from broadest to narrowest scope?

• a.Management group, subscription, resource group, resource✓
• b.Resource, resource group, subscription, management group
• c.Subscription, management group, resource, resource group
• d.Resource group, resource, subscription, management group

The Azure hierarchy from broadest to narrowest is management group, then subscription, then resource group, then individual resource. Governance settings applied at a higher level are inherited by everything beneath. Understanding this order is essential for scoping policy and access.

Which Azure service provides secure storage and management of secrets, keys, and certificates?

• a.Azure DNS
• b.Azure Functions
• c.Azure Blob Storage
• d.Azure Key Vault✓

Azure Key Vault safeguards cryptographic keys, secrets such as passwords, and certificates. It centralizes secret management and controls access with policies and identities. This keeps sensitive values out of application code and configuration files.

What does Azure Virtual Network peering enable?

• a.Direct, low-latency connectivity between two virtual networks so resources can communicate as if on one network✓
• b.Serverless code execution
• c.Automatic cost reporting
• d.Encryption of blob storage

VNet peering connects two virtual networks so their resources can communicate directly over the Azure backbone. Traffic between peered VNets stays on Microsoft's private network with low latency. It is commonly used to link workloads across VNets or regions.

Which Azure compute option is best described as 'serverless,' where you focus on code and the platform handles scaling automatically?

• a.Azure ExpressRoute
• b.Azure Functions✓
• c.Azure Virtual Machines
• d.Azure availability sets

Azure Functions embodies serverless computing: you write event-triggered code and the platform automatically provisions and scales the compute. There are no servers for you to manage. Billing is tied to executions and resources consumed during runs.

Which Azure service would you use to queue messages between application components to decouple and scale them independently?

• a.Microsoft Entra ID
• b.Azure Queue Storage✓
• c.Azure DNS
• d.Azure Blob Storage

Azure Queue Storage stores large numbers of messages that components can add and retrieve asynchronously. This decouples producers from consumers, letting each scale independently and absorb load spikes. It improves resilience in distributed applications.

What is a key advantage of using PaaS services like Azure App Service over IaaS virtual machines for hosting a web app?

• a.The platform handles OS patching, scaling, and infrastructure so developers focus on the application✓
• b.You cannot deploy custom code
• c.You must manually patch the operating system
• d.You gain full control of the physical hardware

PaaS offerings such as Azure App Service manage the operating system, runtime, patching, and scaling for you. This reduces operational overhead compared to running and maintaining your own VMs. Developers can concentrate on building and deploying application features.

Which Azure service provides scalable big data analytics and data warehousing for large volumes of structured data?

• a.Azure DNS
• b.Azure Blob Storage
• c.Azure Key Vault
• d.Azure Synapse Analytics✓

Azure Synapse Analytics is an analytics service that combines data warehousing and big data processing. It can query large datasets using both serverless and provisioned resources. It supports enterprise reporting and advanced analytics at scale.

Which storage redundancy option replicates data synchronously across three availability zones in the primary region?

• a.Locally redundant storage (LRS)
• b.Geo-redundant storage (GRS)
• c.Zone-redundant storage (ZRS)✓
• d.Cool access tier

Zone-redundant storage (ZRS) writes copies of data across three separate availability zones within the primary region. This protects against the failure of a single datacenter/zone while keeping data in-region. It offers higher availability than LRS.

What best describes the purpose of Microsoft Entra ID single sign-on (SSO)?

• a.It hosts DNS zones
• b.It provisions virtual machines automatically
• c.It lets users sign in once and access multiple applications without re-entering credentials✓
• d.It encrypts data stored in blobs

Single sign-on (SSO) allows users to authenticate once with Microsoft Entra ID and then access many connected applications without repeated logins. This improves user experience and reduces password fatigue. It also strengthens security by centralizing authentication.

Which Azure service helps you migrate on-premises servers, databases, and applications to Azure with assessment and tracking tools?

• a.Azure Migrate✓
• b.Azure DNS
• c.Azure Blob Storage
• d.Azure Functions

Azure Migrate provides a central hub to discover, assess, and migrate on-premises workloads to Azure. It offers tools for server, database, and application migration along with readiness assessments. This streamlines planning and executing a cloud migration.

What is the primary function of a public IP address resource in Azure?

• a.It queues messages between apps
• b.It allows inbound and outbound communication between Azure resources and the internet✓
• c.It hosts static websites only
• d.It stores encryption keys

A public IP address enables Azure resources to communicate with the internet and public-facing services. It can be assigned to VMs, load balancers, and gateways. Without a public IP (or equivalent), a resource cannot be reached directly from the internet.

Which Azure feature lets a virtual machine authenticate to other Azure services without storing credentials in code?

• a.Storing passwords in the OS registry
• b.Emailing credentials to users
• c.Hardcoding keys in the application
• d.Managed identities in Microsoft Entra ID✓

Managed identities give Azure resources an automatically managed identity in Microsoft Entra ID. Resources use this identity to authenticate to services that support it, avoiding credentials in code. Azure handles the identity's lifecycle, improving security.

Which Azure service provides a fully managed, in-memory data cache to improve application performance?

• a.Azure DNS
• b.Azure Cache for Redis✓
• c.Azure Blob Storage
• d.Azure Migrate

Azure Cache for Redis is a managed in-memory data store based on the popular Redis engine. It speeds up applications by caching frequently accessed data close to compute. This reduces database load and improves response times.

What is the primary purpose of Microsoft Cost Management in Azure?

• a.To store unstructured data
• b.To monitor, analyze, and optimize spending across Azure resources✓
• c.To host web applications
• d.To deploy virtual machines

Microsoft Cost Management provides tools to track, analyze, and control Azure spending. It offers cost analysis, budgets, and recommendations to optimize usage. This helps organizations stay within budget and identify savings opportunities.

What is the main use of tags applied to Azure resources?

• a.To increase the resource's performance
• b.To attach metadata (key-value pairs) for organizing, tracking costs, and managing resources✓
• c.To physically label servers in the datacenter
• d.To encrypt the resource's data

Tags are key-value pairs you assign to resources to add descriptive metadata. They enable grouping and filtering for cost reporting, ownership, and environment tracking. For example, tagging by department lets you break down spending accurately.

What does Azure Policy help an organization enforce?

• a.Rules and standards that keep resources compliant, such as allowed regions or required tags✓
• b.The pricing of virtual machines
• c.The physical location of datacenters
• d.The color scheme of the portal

Azure Policy lets you define and enforce organizational rules for resources at scale. Policies can require certain configurations, restrict resource types or regions, and flag non-compliant resources. This drives consistent governance and regulatory compliance.

What does role-based access control (RBAC) in Azure allow you to do?

• a.Deploy virtual machines faster
• b.Reduce storage costs
• c.Grant users only the specific permissions they need, scoped to particular resources✓
• d.Encrypt all network traffic automatically

Role-based access control (RBAC) assigns permissions through roles at a chosen scope such as a subscription, resource group, or resource. This follows the principle of least privilege, granting only the access users need. It centralizes and simplifies permission management.

What is the purpose of a resource lock in Azure?

• a.To encrypt data at rest
• b.To lower the monthly bill
• c.To speed up resource deployment
• d.To prevent accidental deletion or modification of critical resources✓

Resource locks protect important resources from accidental changes or deletion. A 'CanNotDelete' lock allows edits but blocks deletion, while a 'ReadOnly' lock blocks both changes and deletion. Locks apply regardless of a user's RBAC permissions.

Which Azure service collects telemetry such as metrics and logs to help you observe the health and performance of resources?

• a.Azure Key Vault
• b.Azure Monitor✓
• c.Azure Blob Storage
• d.Azure DNS

Azure Monitor gathers metrics, logs, and other telemetry from Azure resources and applications. It enables visualization, alerting, and analysis of performance and availability. This visibility is essential for detecting and diagnosing issues.

Which two lock types are available for Azure resource locks?

• a.Encrypt and Decrypt
• b.CanNotDelete and ReadOnly✓
• c.Public and Private
• d.Hot and Cool

Azure supports two lock types: CanNotDelete, which permits reads and updates but prevents deletion, and ReadOnly, which prevents any modification or deletion. These locks override RBAC permissions to safeguard resources. They are applied at the resource, group, or subscription scope.

What is the benefit of setting a budget in Microsoft Cost Management?

• a.It tracks spending against a defined threshold and can trigger alerts when limits are approached✓
• b.It provisions new subscriptions
• c.It automatically doubles your resource capacity
• d.It encrypts all your resources

A budget in Cost Management sets a spending threshold for a scope such as a subscription or resource group. When actual or forecasted costs approach the limit, alerts notify stakeholders. This proactive control helps prevent unexpected overspending.

Which tool provides personalized recommendations to improve the cost, security, reliability, performance, and operational excellence of your Azure resources?

• a.Azure Functions
• b.Azure Blob Storage
• c.Azure Advisor✓
• d.Azure DNS

Azure Advisor analyzes your resource configuration and usage, then provides tailored recommendations. Its guidance spans cost optimization, security, reliability, performance, and operational excellence. Following its suggestions improves your environment's efficiency and posture.

How can Azure Policy remediate a resource that is created without a required tag?

• a.It increases the resource's size
• b.It encrypts the resource
• c.It can be configured to deny the deployment or automatically add the missing tag✓
• d.It deletes the entire subscription

Azure Policy supports effects such as 'deny,' which blocks non-compliant deployments, and 'modify' or 'append,' which can add a required tag. This ensures resources meet standards either by prevention or automatic correction. Remediation tasks can also fix existing non-compliant resources.

In RBAC, what does the 'scope' of a role assignment determine?

• a.The billing currency
• b.The physical datacenter used
• c.The set of resources to which the granted permissions apply✓
• d.The color of the resource icon

The scope defines where a role's permissions take effect, such as a management group, subscription, resource group, or individual resource. Assigning at a broad scope grants access to everything beneath it. Choosing the narrowest appropriate scope supports least-privilege access.

What is a primary advantage of using management groups for governance?

• a.They store application secrets
• b.Policies and access assigned at a management group are inherited by all subscriptions within it✓
• c.They provide serverless compute
• d.They cache web content

Management groups let you apply governance such as Azure Policy and RBAC across many subscriptions at once. Assignments made at the management group level are inherited by all contained subscriptions and resources. This ensures consistent policy across a large organization.

Which feature helps you understand where your Azure money is going by breaking down spending by resource, tag, or service?

• a.Cost analysis in Microsoft Cost Management✓
• b.Azure DNS
• c.Availability zones
• d.Network peering

Cost analysis provides interactive breakdowns of your Azure spending across dimensions such as service, resource group, and tag. It helps identify cost drivers and trends over time. These insights support budgeting and optimization decisions.

What is the purpose of an Azure alert in Azure Monitor?

• a.To encrypt stored data
• b.To create new subscriptions
• c.To provision virtual networks
• d.To notify you or trigger an action when a monitored condition or threshold is met✓

Alerts in Azure Monitor watch metrics or logs and fire when defined conditions are met, such as high CPU usage. They can send notifications or trigger automated responses through action groups. This enables proactive operations and faster incident response.

Which Azure governance tool would you use to package policies, role assignments, and resource templates as a repeatable, enforceable set?

• a.Azure Blob Storage
• b.Azure Cache for Redis
• c.Azure Blueprints✓
• d.Azure DNS

Azure Blueprints lets you define a repeatable set of governance artifacts including policies, RBAC role assignments, and resource templates. You can deploy these consistently to new environments to ensure they start compliant. This standardizes how subscriptions are set up.

What does the principle of 'least privilege' mean when assigning RBAC roles?

• a.Users are given only the minimum permissions necessary to perform their tasks✓
• b.Permissions are assigned randomly
• c.Every user gets full administrator rights
• d.No user is ever given any access

Least privilege means granting users just enough access to do their jobs and no more. This reduces the risk and potential impact of compromised or misused accounts. RBAC supports this by allowing precise, scoped role assignments.

Which built-in RBAC role grants full access to manage all resources, including assigning roles to others?

• a.Contributor
• b.Reader
• c.Billing Reader
• d.Owner✓

The Owner role provides full access to manage resources and, unlike Contributor, can also grant access to others by assigning roles. Contributor can manage resources but cannot assign roles, and Reader can only view. Choosing the right role enforces least privilege.

Which built-in RBAC role lets a user manage resources but NOT grant access to other users?

• a.Contributor✓
• b.Guest
• c.Owner
• d.Reader

The Contributor role allows creating and managing all types of resources but does not permit assigning roles to others. That role-assignment capability is reserved for Owner and User Access Administrator. This separation supports controlled delegation.

Which built-in RBAC role provides view-only access with no ability to make changes?

• a.User Access Administrator
• b.Owner
• c.Reader✓
• d.Contributor

The Reader role grants the ability to view resources but not to create, modify, or delete them. It is ideal for auditors or stakeholders who need visibility without change rights. It represents the least-privileged of the common built-in roles.

What is the main benefit of applying consistent tagging across your Azure resources?

• a.It increases network bandwidth
• b.It reduces the number of regions used
• c.It enables accurate cost allocation and reporting by department, project, or environment✓
• d.It automatically encrypts the resources

Consistent tags let you slice cost and usage data by meaningful categories such as department or project. This supports chargeback, showback, and accountability across teams. Tagging standards can even be enforced through Azure Policy.

Which service helps you improve your organization's security posture by providing a security score and recommendations?

• a.Azure DNS
• b.Azure Cache for Redis
• c.Azure Blob Storage
• d.Microsoft Defender for Cloud✓

Microsoft Defender for Cloud assesses your resources' security and provides a secure score along with actionable recommendations. It helps identify misconfigurations and threats across your environment. Acting on its guidance strengthens overall security.

What does an action group in Azure Monitor define?

• a.The set of notifications and automated actions to run when an alert fires✓
• b.The size of a virtual machine
• c.The redundancy level of storage
• d.The physical location of a datacenter

An action group is a reusable collection of notification targets and actions, such as emails, SMS, or webhooks. When an alert triggers, its associated action group carries out these responses. This lets you standardize how incidents are communicated and handled.

Which capability of Azure Policy shows how many of your resources currently meet defined standards?

• a.Compliance reporting✓
• b.DNS resolution
• c.Autoscaling
• d.Blob replication

Azure Policy provides compliance reporting that evaluates resources against assigned policies. It shows which resources are compliant or non-compliant, giving a clear governance overview. This helps organizations track and prove adherence to standards.

What is the purpose of the Azure Pricing Calculator?

• a.To estimate the cost of Azure services before deploying them✓
• b.To deploy resources into production
• c.To monitor live performance
• d.To encrypt stored data

The Azure Pricing Calculator lets you model and estimate the cost of Azure services based on your expected configuration and usage. It supports planning and budgeting before any resources are provisioned. This helps avoid surprises on the bill.

What does the Total Cost of Ownership (TCO) Calculator help organizations do?

• a.Configure DNS records
• b.Compare the cost of running workloads on-premises versus in Azure✓
• c.Encrypt data in transit
• d.Deploy virtual machines automatically

The TCO Calculator estimates the cost savings of migrating on-premises workloads to Azure. It compares current infrastructure expenses with projected Azure costs, including hardware, power, and staffing. This supports the business case for cloud migration.

Which of the following is a valid strategy to reduce Azure virtual machine costs for predictable, long-running workloads?

• a.Disabling monitoring entirely
• b.Running only during business hours without automation
• c.Deleting all backups
• d.Purchasing reserved instances for a one- or three-year term✓

Reserved instances let you commit to a VM for one or three years in exchange for a significant discount over pay-as-you-go pricing. They suit steady, predictable workloads that run continuously. This is a common cost-optimization technique in Azure.

What is Azure Spot pricing best suited for?

• a.Interruptible workloads that can tolerate being evicted when Azure needs the capacity back✓
• b.Mission-critical databases that must never stop
• c.Long-term reserved capacity
• d.Workloads requiring guaranteed uptime

Azure Spot pricing offers unused capacity at deep discounts, but Azure can reclaim (evict) it when demand rises. It is ideal for fault-tolerant, interruptible workloads like batch processing or testing. It should not be used for services that must run without interruption.

How does inheritance work when an Azure Policy is assigned at the subscription level?

• a.Only newly created resources in one region comply
• b.All resource groups and resources within that subscription inherit and must comply with the policy✓
• c.The policy applies to other subscriptions too
• d.Nothing inherits the policy

When a policy is assigned at the subscription scope, it applies to all resource groups and resources beneath it through inheritance. Lower scopes automatically fall under the higher-level assignment. This makes it efficient to enforce standards broadly.

What is the benefit of using Azure Monitor Log Analytics workspaces?

• a.They provision virtual machines
• b.They cache web content at the edge
• c.They host relational databases
• d.They collect and store log data so you can run queries and analyze it across resources✓

A Log Analytics workspace is a central repository where Azure Monitor stores log and performance data. You can query this data with a powerful language to investigate issues and build insights. Consolidating logs supports troubleshooting and reporting across your environment.

Which governance approach helps ensure resources are deployed only in approved geographic regions?

• a.Enabling zone-redundant storage
• b.Assigning the Reader RBAC role
• c.Applying a ReadOnly resource lock
• d.Using an Azure Policy that restricts allowed locations✓

A common Azure Policy restricts the regions in which resources may be deployed to an approved list. This supports data-residency and compliance requirements by preventing deployments elsewhere. Non-compliant deployment attempts are blocked or flagged.

What distinguishes RBAC from Azure Policy in governance?

• a.RBAC encrypts data and Policy provisions VMs
• b.RBAC controls who can do what to resources, while Azure Policy controls what configurations resources may have✓
• c.They are identical and interchangeable
• d.Azure Policy assigns user passwords

RBAC governs identity and access, determining which users or identities can perform which actions on resources. Azure Policy governs resource properties and configurations, enforcing standards regardless of who deploys. Used together, they provide comprehensive governance.

Which feature lets you group related alerts and manage the notification recipients and automated responses centrally?

• a.Availability zones
• b.Action groups✓
• c.Peering connections
• d.Blob tiers

Action groups centralize the recipients and actions that respond to alerts, such as notifying an on-call team or invoking automation. Reusing an action group across many alerts keeps notification logic consistent. This simplifies operations and incident handling.

What is a key reason to enable diagnostic settings on Azure resources?

• a.To reduce the resource's memory
• b.To physically relocate the datacenter
• c.To route resource logs and metrics to destinations like Log Analytics for analysis and retention✓
• d.To change the billing currency

Diagnostic settings specify where a resource's platform logs and metrics are sent, such as a Log Analytics workspace, storage account, or event hub. This enables long-term retention, analysis, and integration with monitoring tools. It is foundational to observability and auditing.

Which statement best describes how tags and Azure Policy can work together?

• a.Tags replace the need for RBAC
• b.Azure Policy deletes all tags on creation
• c.Tags disable all Azure Policies
• d.Azure Policy can require, add, or enforce specific tags on resources automatically✓

Azure Policy can mandate that resources carry certain tags, append missing tags, or inherit tags from their resource group. This automates and enforces tagging standards across the environment. Consistent tags then power accurate cost tracking and organization.

Which statement best defines a consumption-based (pay-as-you-go) pricing model?

• a.You must estimate and pay for peak capacity even when it sits completely idle
• b.You pay only for the resources you use, with no upfront commitment✓
• c.A fixed yearly fee is paid in advance regardless of how much you actually use
• d.Billing is based on the number of employees in the organization

Consumption-based pricing charges you only for the compute, storage, and services you actually consume. There is no large upfront commitment, so spending tracks real usage. This lets organizations avoid paying for idle, over-provisioned capacity.

Which spending shift best characterizes moving from an on-premises datacenter to a pay-as-you-go cloud model?

• a.From variable usage-based costs to fixed hardware purchases
• b.From subscription billing to one-time perpetual software licenses
• c.From capital expenditure (CapEx) to operating expenditure (OpEx)✓
• d.From operating expenditure (OpEx) to capital expenditure (CapEx)

On-premises IT relies on CapEx: large upfront purchases of servers and facilities. The cloud shifts spending to OpEx, an ongoing usage-based cost. This improves cash flow and removes the need to buy assets years ahead of demand.

Which of the following is the clearest example of Software as a Service (SaaS)?

• a.A managed database platform where you still deploy your own schema and application code
• b.A bare-metal server hosted in a colocation facility that you fully manage
• c.A ready-to-use, web-based email service accessed through a browser✓
• d.Renting a virtual machine on which you install and maintain your own applications yourself

SaaS delivers a finished application that users simply consume, usually through a browser. The provider manages everything from hardware up to the application. Hosted email or CRM products are classic SaaS examples.

A company wants full control of the operating system and installed software but does not want to buy or maintain physical servers. Which model fits?

• a.Platform as a Service (PaaS)
• b.Infrastructure as a Service (IaaS)✓
• c.Software as a Service (SaaS)
• d.A fully managed, ready-to-use application delivered over the internet

IaaS provides virtualized compute, storage, and networking while the provider maintains the physical hardware. The customer controls the OS and everything above it. This offers maximum flexibility without owning servers.

In the cloud shared responsibility model, which item is ALWAYS the provider's responsibility across every service model?

• a.The configuration of user access permissions
• b.The classification and protection of the customer's data
• c.The management of user accounts and identities
• d.The physical security of the datacenters and hardware✓

No matter the service model, the provider always secures the physical datacenter and hardware. Data, identities, and access remain the customer's responsibility. Layers in between shift depending on IaaS, PaaS, or SaaS.

How does consumption-based pricing help organizations avoid wasted spending?

• a.You pay only for what you use, avoiding over-provisioning for peak demand✓
• b.It charges a flat fee that never changes regardless of how much you use
• c.It bills based on the number of datacenters the provider operates worldwide
• d.It requires you to buy three years of capacity in advance for every workload

Because you pay only for what you consume, you no longer buy hardware sized for peak load that sits idle most of the time. Costs scale up and down with demand. This eliminates the waste of traditional over-provisioning.

Which statement is TRUE of the public cloud deployment model?

• a.It can only be used by a single organization inside its own building
• b.A third-party provider owns the infrastructure and offers it to many customers✓
• c.The customer owns, maintains, and refreshes all of the underlying physical hardware
• d.It cannot scale beyond a small fixed amount of capacity

In a public cloud, a third-party provider owns and operates the infrastructure and offers it to many tenants over the internet. Resources are shared and delivered on demand. This gives low upfront cost and vast scale.

An organization needs computing resources used exclusively by itself for compliance reasons, hosted either on-premises or by a provider. Which model is this?

• a.Community cloud shared by several agencies
• b.Private cloud✓
• c.Multi-tenant SaaS
• d.Public cloud

A private cloud dedicates infrastructure to a single organization, whether hosted internally or by a provider. This isolation supports strict security and compliance needs. The trade-off is usually higher cost and management effort.

What is a key advantage of a hybrid cloud approach?

• a.It forces all data to remain permanently in a single datacenter
• b.It eliminates the ability to use any public cloud services
• c.It lets sensitive workloads stay on-premises while bursting to the public cloud for scale✓
• d.It completely removes the need for any form of internet connectivity between sites

Hybrid cloud links private, on-premises environments with public cloud services. Sensitive systems can stay local while workloads burst to the cloud for extra capacity. It suits gradual migration and regulatory requirements.

Which description best matches elasticity rather than plain scalability?

• a.Storage is limited to one physical disk per server
• b.Resources automatically grow and shrink in near real time as demand changes✓
• c.An administrator manually places an order for additional servers whenever demand rises
• d.Capacity is fixed at deployment and never changes afterward

Elasticity is the automatic, demand-driven expansion and contraction of resources. Scalability is the broader ability to grow capacity, which can be manual. Elasticity specifically implies near real-time, hands-off adjustment.

Which design choice most directly increases the high availability of an application?

• a.Running the application on a single server with no backups at all
• b.Storing every copy of the data on one disk in one datacenter
• c.Deploying redundant instances across multiple fault domains✓
• d.Disabling monitoring and health checks to reduce operating cost

High availability comes from redundancy so that no single failure takes the service down. Spreading instances across fault domains keeps the app running during hardware faults. Monitoring and backups support, but do not by themselves create, availability.

A startup can launch a new test environment in minutes instead of waiting weeks for hardware. Which cloud benefit does this illustrate?

• a.Multi-tenancy
• b.Agility✓
• c.Data sovereignty
• d.Vendor lock-in

Agility is the ability to provision resources and deliver solutions quickly. Instead of long hardware procurement, environments spin up in minutes. This speeds experimentation and time to market.

Which practice best supports disaster recovery for a cloud-hosted application?

• a.Turning off all backups permanently to reduce monthly cost
• b.Replicating data and workloads to a geographically separate region✓
• c.Relying on users to email themselves copies of important files
• d.Keeping only one single copy of all production data in one primary region

Disaster recovery restores systems and data after a major outage. Replicating to a separate region protects against a whole-region failure such as a natural disaster. This minimizes downtime and data loss.

Which of the following is an example of a capital expenditure (CapEx)?

• a.A one-time purchase of physical servers for a datacenter✓
• b.A per-second charge for a running container instance
• c.A usage-based fee for outbound data transfer
• d.A recurring monthly invoice for the cloud compute hours actually consumed

CapEx is an upfront purchase of long-lived assets such as servers or datacenter equipment. It is depreciated over years. The cloud reduces CapEx by replacing it with usage-based OpEx.

Which characteristic describes operating expenditure (OpEx) in a cloud context?

• a.Ongoing, usage-based costs that scale with consumption✓
• b.A large upfront purchase of hardware assets
• c.A fixed asset that is depreciated over several years
• d.A one-time perpetual software license bought outright

OpEx is ongoing spending that rises and falls with usage, like a monthly cloud bill. It contrasts with CapEx, a big upfront asset purchase. The pay-as-you-go cloud model favors OpEx.

Under PaaS, which responsibility typically remains with the customer?

• a.Managing their application code and data✓
• b.Maintaining the physical network hardware in the datacenter
• c.Patching the underlying host operating system
• d.Replacing failed physical disks in the datacenter

With PaaS the provider manages the OS, runtime, and infrastructure. The customer focuses on their application code and data. This reduces operational overhead while keeping control of the app.

Adding more identical web server instances behind a load balancer to handle more users is an example of what?

• a.Archiving cold data to lower tiers
• b.Horizontal scaling (scaling out)✓
• c.Reducing redundancy across the system
• d.Vertical scaling (scaling up)

Horizontal scaling, or scaling out, adds more instances to share the load. Vertical scaling instead adds CPU or memory to a single machine. Scaling out is often more resilient and elastic.

How does fault tolerance differ from disaster recovery?

• a.Disaster recovery prevents any failure from ever happening at all
• b.Fault tolerance only applies to monthly billing calculations
• c.Fault tolerance keeps a system running through component failures; disaster recovery restores it after a major outage✓
• d.They are exactly the same concept and are fully interchangeable in every single situation

Fault tolerance uses redundancy so individual component failures do not stop the service. Disaster recovery is about restoring service and data after a large disruptive event. They are complementary reliability strategies.

If a cloud service offers a higher composite SLA, what does that generally indicate?

• a.It consumes less electricity in the datacenter
• b.It offers a stronger guarantee of uptime and availability✓
• c.It costs nothing at all to run each month
• d.It is far more likely to contain unpatched security vulnerabilities over time

An SLA is the provider's formal commitment to a level of uptime and availability. A higher SLA means a stronger guarantee and less allowed downtime. Failing to meet it can entitle customers to service credits.

Why does multi-tenancy help lower costs in the public cloud?

• a.Because it removes the need for any security controls whatsoever
• b.Because each and every customer is given fully dedicated physical hardware of their own
• c.Because it stores all data on the customer's own premises
• d.Because many customers share the same underlying infrastructure efficiently✓

Multi-tenancy lets many customers share pooled physical resources while staying logically isolated. This high utilization spreads cost across tenants. Providers enforce strong isolation to keep tenants secure from one another.

Cloud providers can often offer lower per-unit prices than a single company running its own datacenter. Why?

• a.Because they never invest in any new hardware at all
• b.Economies of scale from operating massive, shared datacenters✓
• c.Because customers must pay for all unused capacity upfront
• d.Because they avoid every electricity and cooling cost entirely

Providers operate at enormous scale, buying and running hardware far more efficiently than a single firm. These economies of scale lower the per-unit cost. Savings are passed on through competitive pricing.

A team wants to build and deploy a web app while letting the provider handle OS patching, runtime, and scaling. Which model should they choose?

• a.Infrastructure as a Service (IaaS)
• b.On-premises bare metal
• c.Colocation hosting
• d.Platform as a Service (PaaS)✓

PaaS provides a managed platform including OS, runtime, and scaling. Developers deploy code without managing servers. This accelerates delivery and cuts operational work.

With a SaaS product, what does the customer still control?

• a.The physical servers running the service
• b.The operating system patching schedule and the maintenance windows for the servers
• c.The application's underlying source code
• d.Their own data and which users have accounts✓

In SaaS the provider manages almost the entire stack. The customer's remaining responsibilities center on their data, users, and access settings. This makes SaaS the lowest-maintenance model for consumers.

Which billing behavior is characteristic of many serverless and consumption-based cloud services?

• a.A single flat annual license fee that applies regardless of how much you actually use
• b.Charges that accrue per execution or per second of actual use✓
• c.Charges that occur only when you buy new physical hardware
• d.A single fixed fee for truly unlimited usage forever

Serverless and consumption services bill on granular actual usage, such as per execution or per second. There is no charge when nothing runs. This tightly aligns cost with real demand.

A hospital must keep certain patient records on infrastructure it fully controls but wants cloud scale for its public website. Which model fits both needs?

• a.SaaS only
• b.Public cloud only
• c.Hybrid cloud✓
• d.A single private cloud with no internet access at all

A hybrid cloud lets the hospital keep sensitive records on controlled infrastructure while using public cloud scale for the website. Data and apps can move between the two. This balances compliance with flexibility.

How does deploying to multiple global regions improve the user experience?

• a.It increases the distance data must travel to users
• b.It removes the need for any redundancy in the design
• c.It forces all traffic through one single country
• d.It places resources closer to users, lowering latency✓

Running resources in regions near users reduces network latency. It also supports resilience and data-residency compliance. Global reach is a core advantage of large cloud platforms.

In a traditional on-premises datacenter (not cloud), who is responsible for the physical security of the servers?

• a.No one is responsible for it in that model
• b.The external cloud provider that hosts the organization's other workloads
• c.The internet service provider that supplies connectivity
• d.The organization that owns the datacenter✓

On-premises, the owning organization is fully responsible for physical security, hardware, and everything else. Moving to the cloud shifts physical security to the provider. This is a key difference in the shared responsibility model.

During off-peak hours, an elastic system automatically removes unused instances. What is the main benefit?

• a.Lower cost by not paying for idle capacity✓
• b.A guarantee that the customer owns the physical hardware
• c.Permanently fixed capacity that never changes
• d.Consistently higher latency and slower response times for all end users

Elasticity releases resources when demand falls so you stop paying for idle capacity. Capacity returns automatically when demand rises. This keeps performance steady while controlling cost.

Which cloud capability most improves reliability during a hardware failure?

• a.Turning off all health monitoring to save money
• b.Deleting older backups on a regular schedule to conserve storage space
• c.Automatic failover to redundant resources✓
• d.Using only a single availability zone for all resources

Reliability during failures depends on redundancy and automatic failover. When one component fails, traffic shifts to healthy resources. This keeps the service available with minimal disruption.

What does 'scalability' primarily describe?

• a.The ability to increase capacity to handle growing workloads✓
• b.The ability to encrypt data both at rest and in transit automatically
• c.The ability to physically own the underlying servers
• d.The ability to disable all logging across the system

Scalability is the capacity to grow resources to meet increasing demand. It can be achieved by scaling up or scaling out. It ensures applications keep performing as workloads expand.

Why might a growing startup prefer the cloud's OpEx model over large CapEx purchases?

• a.It locks them into rigid ten-year hardware purchase and maintenance contracts
• b.It requires buying a full datacenter building first before any deployment
• c.It preserves cash by avoiding large upfront hardware investments✓
• d.It guarantees the software they build will contain no bugs

The OpEx model spreads cost over time as usage-based charges. This preserves cash and avoids risky upfront hardware bets. Startups can scale spending gradually as they grow.

You deploy a virtual machine using IaaS. Who applies security updates to the guest operating system?

• a.The hardware manufacturer handles it automatically
• b.The provider does it silently on your behalf
• c.No operating system updates are ever needed in IaaS
• d.You, the customer✓

With IaaS the customer manages the guest OS, including patching. The provider only maintains the physical host and hypervisor. This division is central to cloud security responsibilities.

An enterprise gradually moving workloads to the cloud over several years, keeping some systems on-premises meanwhile, is using which approach?

• a.A hybrid cloud migration✓
• b.Colocation hosting only
• c.SaaS used exclusively for everything
• d.Pure public cloud adopted from day one

Running some systems on-premises while others move to the cloud is a hybrid approach. It supports phased migration and reduces risk. Workloads can be shifted as they are ready.

In disaster recovery planning, what does the Recovery Time Objective (RTO) represent?

• a.The target time to restore a system after an outage✓
• b.The total number of users on the system
• c.The total amount of storage the system uses
• d.The total monthly cost of the service including data transfer charges

RTO is the maximum acceptable time to restore service after a disruption. It guides how fast recovery mechanisms must work. A related metric, RPO, defines acceptable data loss.

Compared with pay-as-you-go, what do you trade for a discount when you reserve capacity for one or three years?

• a.You automatically lose all technical support entitlements
• b.You must immediately move to a competing cloud provider
• c.You commit to a term in exchange for lower rates✓
• d.You receive noticeably worse performance for the same reserved workloads

Reservations give a discount in return for committing to a one- or three-year term. They suit steady, predictable workloads. The trade-off is reduced flexibility, not reduced performance.

Which of the following is NOT typically a benefit of public cloud computing?

• a.Reduced upfront capital cost through a pay-as-you-go consumption model
• b.Global reach across many regions
• c.On-demand scalability of resources
• d.Full physical control over the underlying hardware✓

Public cloud customers give up physical control of hardware to the provider. The recognized benefits include scalability, lower upfront cost, and global reach. Trading physical control for these advantages defines the model.

Regardless of using IaaS, PaaS, or SaaS, which security duty stays with the customer?

• a.Securing the physical building and its entrances
• b.Cooling and powering the physical datacenter
• c.Replacing failed network switches and other hardware in the server racks
• d.Managing their own user identities and access✓

Across every model the customer remains responsible for their data, identities, and access. The provider always handles the physical facility and hardware. Understanding this boundary is essential to cloud security.

An online retailer's site automatically adds capacity on a busy shopping holiday and releases it afterward. This is a direct example of what?

• a.Fixed, static provisioning of resources
• b.Data residency requirements
• c.Elasticity✓
• d.Vendor lock-in to a single provider

Automatically adding and removing capacity in response to demand is elasticity. It keeps the site fast during spikes and cheap during lulls. This is a hallmark of well-designed cloud systems.

What is a common trade-off of choosing a private cloud over the public cloud?

• a.It cannot enforce any security controls at all
• b.It usually costs more and requires more management effort✓
• c.It always provides completely unlimited capacity at no additional cost whatsoever
• d.It removes the ability to control who has access

Private clouds offer greater control and isolation but typically cost more and demand more management. Capacity is limited by what the organization provisions. The benefit is control; the cost is effort and expense.

How does cloud agility support innovation?

• a.By locking teams into one fixed design permanently
• b.By letting teams quickly spin up and tear down environments to experiment✓
• c.By actively preventing any experimentation by teams
• d.By requiring long hardware procurement cycles before any new idea can be tested

Agility lets teams create and discard environments in minutes. Cheap, fast experimentation lowers the cost of trying new ideas. This accelerates innovation and learning.

How do high availability and disaster recovery differ?

• a.High availability only relates to monthly billing
• b.They are two identical concepts that mean exactly the same thing in every practical case
• c.High availability minimizes downtime day to day; disaster recovery restores service after a major event✓
• d.Disaster recovery guarantees that downtime can never occur

High availability keeps services running through routine failures with minimal downtime. Disaster recovery focuses on restoring service after a major, often regional, disruption. Robust designs use both.

When comparing on-premises to cloud, which cost is often overlooked but included in a true total cost of ownership?

• a.The particular color and finish chosen for the server chassis
• b.Power, cooling, and datacenter staffing✓
• c.The brand of coffee in the office kitchen
• d.The number of company holidays each year

Total cost of ownership includes hidden operational costs like electricity, cooling, and staff. These are easy to overlook when comparing to cloud pricing. Accounting for them gives a fairer comparison.

What is one risk of the consumption-based model if usage is not monitored?

• a.Physical theft of hardware directly from the provider's secured datacenter
• b.Unexpectedly high bills from unmonitored usage✓
• c.Guaranteed perfectly fixed bills every month
• d.A complete inability for costs to change at all

Because charges scale with usage, unmonitored growth can lead to surprise bills. Cost controls, budgets, and alerts help prevent this. Monitoring spending is a key cloud discipline.

Several government agencies with shared compliance needs pool infrastructure used only among themselves. This is best described as what?

• a.A pure public cloud open to everyone
• b.A SaaS application
• c.A community cloud✓
• d.A strictly single-tenant private cloud for one agency

A community cloud is shared by several organizations with common requirements, such as compliance. It sits between private and public models. Costs and governance are shared among the members.

What distinguishes autoscaling from manual scaling?

• a.Autoscaling requires placing a phone call to the provider's support team each time
• b.Manual scaling needs no human action whatsoever
• c.Autoscaling adjusts capacity automatically based on defined rules✓
• d.Autoscaling can only reduce capacity and never increase it

Autoscaling changes capacity automatically according to metrics or schedules. Manual scaling requires a person to act. Autoscaling supports elasticity with minimal operational effort.

Automated, regular backups in the cloud primarily support which goal?

• a.Data durability and recoverability✓
• b.Reduced font sizes in applications
• c.Faster graphics rendering for video editing workloads on the desktop
• d.Lower physical screen brightness on monitors

Regular backups protect against data loss and enable recovery after failures or mistakes. They underpin reliability and disaster recovery. Cloud platforms make backups easy to automate.

Shifting IT spending from CapEx to OpEx can improve which business measure?

• a.The total square footage of the company's physical office building space
• b.Cash flow and financial flexibility✓
• c.The design of the company logo
• d.The number of parking spaces available to staff

Replacing large upfront purchases with pay-as-you-go spending improves cash flow. Money is not tied up in depreciating hardware. This flexibility helps organizations adapt to change.

As you move from IaaS to PaaS to SaaS, how does the customer's share of responsibility generally change?

• a.It increases steadily at each step
• b.It only becomes the provider's responsibility after a continuous ten-year period
• c.It decreases as more is managed by the provider✓
• d.It stays exactly the same across all three models

Moving from IaaS toward SaaS, the provider manages more of the stack. The customer's responsibilities shrink accordingly. SaaS leaves the customer mainly responsible for data and access.

Which term specifically implies automatic, demand-driven adjustment rather than a one-time capacity increase?

• a.Colocation of servers
• b.Vertical scaling of a single machine
• c.Capital expenditure on new hardware
• d.Elasticity✓

Elasticity means resources automatically expand and contract with demand. A one-time capacity increase is scaling, not necessarily elastic. Elasticity is the automatic, real-time form.

A common way to describe the agility benefit of cloud is improved…

• a.datacenter floor tiling and paint
• b.time to market for new solutions✓
• c.network cable color coding standards
• d.physical server weight and the total rack loading in the facility

Agility shortens the time from idea to deployed solution. Fast provisioning removes long hardware delays. This improved time to market is a central cloud advantage.

Which feature most directly enables recovery of data after a regional disaster?

• a.Disabling geo-replication to reduce complexity
• b.Storing exactly one single copy of the data in the local datacenter only
• c.Cross-region replication of data✓
• d.Turning off all scheduled backups permanently

Replicating data across regions ensures a copy survives a whole-region failure. This underpins disaster recovery. Keeping only a single local copy leaves data vulnerable.

In a public cloud IaaS scenario, which task does the provider handle?

• a.Maintaining the physical host servers✓
• b.Configuring your virtual firewall and network security rules
• c.Managing your users' passwords and sign-in
• d.Applying patches and updates to your own custom application code

In IaaS the provider maintains the physical hosts, hypervisor, and facility. The customer handles the OS, applications, network config, and identities. Knowing the split clarifies who does what.

Which capability is essential to make a hybrid cloud function as one environment?

• a.Avoiding the internet entirely at all times
• b.Permanently deleting all of the organization's existing on-premises systems first
• c.Using only paper-based records for data
• d.Secure network connectivity between on-premises and cloud✓

A hybrid cloud needs secure, reliable connectivity linking on-premises and cloud resources. This lets workloads and data move between them. Without it, the two environments cannot act as one.

Which pricing behavior best reflects 'pay for what you use'?

• a.Paying the full three-year cost upfront in advance
• b.A fixed flat fee that applies no matter how much or how little you actually use
• c.A flat one-time perpetual license bought outright
• d.Being charged for the gigabytes of storage actually consumed each month✓

Paying for the gigabytes actually consumed is consumption-based pricing. Cost tracks real usage rather than a fixed fee. This is a defining trait of cloud economics.

If a service promises 99.9% availability, roughly how much downtime does that allow per year?

• a.Zero downtime is guaranteed
• b.About 8.76 hours per year✓
• c.About 3.65 days per year
• d.About 87 days per year

99.9% (three nines) allows roughly 8.76 hours of downtime per year. Each added nine reduces allowed downtime by about tenfold. Higher SLAs mean tighter downtime limits.

Which pairing correctly matches a service model to an example?

• a.PaaS is a managed app-hosting platform for your code✓
• b.IaaS is a ready-to-use webmail application accessed in a browser
• c.SaaS is a raw virtual machine with no operating system installed
• d.PaaS is a bare-metal server you rack and cable yourself

PaaS provides a managed platform where you deploy your code. Webmail is SaaS, and a raw VM is IaaS. Matching examples to models is a common exam skill.

Who is responsible for classifying data as sensitive or public in any cloud model?

• a.No data classification is ever needed in the cloud
• b.The internet service provider classifies it
• c.The provider always classifies it for you
• d.The customer✓

Data classification and protection always remain the customer's responsibility. The provider secures infrastructure but does not know your data's sensitivity. This holds true across IaaS, PaaS, and SaaS.

By offloading infrastructure management to a cloud provider, an IT team can focus more on what?

• a.Cooling and powering the datacenter facility
• b.Rewiring the server racks in the datacenter
• c.Replacing failed hard drives and other spare parts inside the servers
• d.Delivering business value and applications✓

When the provider handles hardware and facilities, IT teams spend less time on maintenance. They can focus on applications and business outcomes. This shift in focus is a major cloud benefit.

Why should disaster recovery plans be tested periodically?

• a.To intentionally increase the organization's monthly electricity and cooling bills
• b.To confirm systems can actually be restored within the expected time✓
• c.To reduce the amount of available storage on purpose
• d.To deliberately slow down the corporate network

Testing verifies that recovery procedures work and meet the RTO. Untested plans often fail during real incidents. Regular drills build confidence and reveal gaps.

A purchased physical server is treated in accounting as what?

• a.A recurring monthly usage charge that appears on every cloud invoice
• b.A consumable expense billed each hour of use
• c.A per-second billing line item
• d.A capital asset that depreciates over time✓

A bought server is a capital asset that is depreciated across its useful life. That is CapEx. Cloud usage, by contrast, is expensed as OpEx as it is consumed.

Elasticity works best for workloads that have what characteristic?

• a.No users and no activity of any kind
• b.A demand level that never varies even slightly
• c.Variable or unpredictable demand✓
• d.Perfectly constant, completely unchanging demand at all hours

Elasticity shines when demand fluctuates, adding capacity for spikes and removing it during lulls. Perfectly steady workloads gain less from it. Variable demand is where elasticity saves the most.

The main reason an organization chooses a private cloud is usually greater…

• a.control and isolation✓
• b.electricity usage in the datacenter
• c.vendor lock-in to a single supplier
• d.font selection in applications

Private clouds provide dedicated resources with greater control and isolation. This helps meet strict security and compliance needs. The trade-off is typically higher cost and effort.

Because cloud environments can be created and deleted quickly, failed experiments cost less. This reflects which benefit?

• a.Encryption of stored data
• b.Data residency compliance
• c.Multi-tenancy of shared hardware
• d.Agility✓

Fast, disposable environments make experimentation cheap and low-risk. This is a direct expression of cloud agility. Teams can try, learn, and discard quickly.

Which is the core principle behind high availability?

• a.Using exactly one single server to handle every workload in the environment
• b.Removing all backups to save storage space
• c.Eliminating single points of failure through redundancy✓
• d.Disabling automatic failover mechanisms

High availability removes single points of failure by adding redundancy. If one component fails, another takes over. This keeps services accessible with minimal downtime.

A major advantage of aligning cost with actual usage is that you…

• a.only pay for resources while they are running✓
• b.always pay a single fixed maximum amount regardless of real consumption levels
• c.pay continuously for idle servers running overnight
• d.must buy all hardware upfront before use

Paying only for running resources ties cost to real demand. Idle resources can be stopped to save money. This usage alignment is central to cloud cost efficiency.

Which deployment model description is correct?

• a.Community cloud: dedicated to a single company only
• b.Private cloud: infrastructure shared freely and openly with the general public
• c.Hybrid cloud: environments that have no connection between them
• d.Public cloud: shared, provider-owned infrastructure over the internet✓

Public cloud is provider-owned, shared, and delivered over the internet. Private is dedicated to one organization, hybrid connects both, and community is shared by a group. Only the public cloud description here is accurate.

For a SaaS email product, which layer does the provider manage?

• a.The application, runtime, OS, and infrastructure✓
• b.Only the customer's data and none of the underlying application components
• c.Nothing at all in the stack
• d.Only the list of end users

In SaaS the provider manages nearly the whole stack: application, runtime, OS, and infrastructure. The customer manages data, users, and access. This makes SaaS the most hands-off model.

Cloud providers publish SLAs primarily so customers can…

• a.plan around guaranteed levels of uptime and support✓
• b.learn the provider's corporate home mailing address
• c.review the confidential architectural blueprints of the physical datacenter
• d.choose the color of the physical servers

An SLA communicates the provider's uptime and support commitments. Customers use it to plan for reliability and set expectations. Composite SLAs help estimate an overall solution's availability.

How does elasticity reduce the need for traditional capacity planning?

• a.You must still purchase enough hardware for the highest peak every single year
• b.Resources adjust automatically, so you need not provision for peak in advance✓
• c.It forces manual resizing of every server daily
• d.It requires large fixed hardware orders each quarter

Elasticity adds capacity on demand, so you do not have to size for peak ahead of time. This lessens the guesswork of capacity planning. You avoid both shortages and costly over-provisioning.

Which best summarizes why many organizations adopt the cloud economically?

• a.To increase their upfront capital spending significantly
• b.To convert large upfront costs into flexible, usage-based spending✓
• c.To deliberately lengthen the hardware procurement and approval cycles across teams
• d.To buy and operate more physical datacenters of their own

A core economic driver is turning big CapEx into flexible OpEx. Spending then tracks actual usage instead of upfront bets. This improves cash flow and agility.

What is an Azure region pair?

• a.Two regions in the same geography paired for replication and recovery✓
• b.Two subscriptions that are billed together on one invoice
• c.Two identical storage accounts inside one datacenter
• d.Two virtual machines placed within the very same server rack for performance

A region pair links two regions within the same geography for platform resilience. Azure staggers updates and prioritizes recovery across the pair. Some services replicate data to the paired region automatically.

In a region that supports Availability Zones, at minimum how many physically separate zones are provided?

• a.Three zones✓
• b.Ten zones
• c.One zone
• d.Twenty zones

Availability Zone-enabled regions provide at least three physically separate zones. Each zone has independent power, cooling, and networking. Spreading resources across zones protects against a datacenter-level failure.

Which statement about Azure resource groups is TRUE?

• a.Resource groups are physical server racks in a datacenter
• b.Each resource belongs to exactly one resource group✓
• c.Resource groups are not allowed to contain any resources
• d.A single resource can belong to many different resource groups simultaneously

Every Azure resource lives in exactly one resource group. The group is a logical container for related resources. It also serves as a scope for permissions and policies.

What is an Azure subscription primarily used for?

• a.A billing and management boundary for Azure resources✓
• b.A single DNS record entry
• c.A single physical fiber-optic cable running between two datacenters
• d.A single virtual machine instance

A subscription is a logical container that acts as a billing and management boundary. Resources are deployed into subscriptions, which link to an Entra tenant. Organizations often use several subscriptions to separate workloads.

Where do management groups sit in the Azure hierarchy?

• a.Inside a single resource group as a child object
• b.Directly below subscriptions in every case
• c.Below individual resources, nested inside each deployed resource itself
• d.Above subscriptions, to organize and govern them✓

Management groups sit above subscriptions and can be nested. Policies and access assigned to a management group flow down to all contained subscriptions. This enables governance at scale.

What is Azure Resource Manager (ARM)?

• a.The deployment and management layer for creating and managing Azure resources✓
• b.A specialized storage tier designed for infrequently accessed archival data sets
• c.A low-level physical networking protocol
• d.A particular family of virtual machine sizes

Azure Resource Manager is the control plane that handles requests to create, update, and delete resources. All portal, CLI, and API calls go through ARM. It provides consistent management, access control, and tagging.

What is the main purpose of an ARM template (or Bicep file)?

• a.To store large volumes of unstructured blob data cheaply
• b.To assign user roles and permissions only
• c.To define infrastructure as code for repeatable deployments✓
• d.To continuously monitor the CPU and memory usage of running virtual machines

ARM templates and Bicep files declare infrastructure as code. They enable consistent, repeatable, and automated deployments. Because they are declarative, applying the same file yields the same result.

Choosing a larger VM size with more vCPUs and memory is an example of what?

• a.Reducing overall redundancy in the system
• b.Scaling out horizontally to more instances
• c.Geo-replication of stored data
• d.Scaling up vertically✓

Increasing a single machine's CPU and memory is vertical scaling, or scaling up. Adding more instances instead is scaling out. Both approaches are supported in Azure.

Which Azure feature automatically maintains and scales a group of identical load-balanced VMs?

• a.Azure Key Vault for secrets and certificates
• b.Virtual Machine Scale Sets✓
• c.Azure DNS name resolution service for hosting your public domains
• d.Azure Blob Storage for object data

Virtual Machine Scale Sets manage a group of identical VMs behind a load balancer. They can automatically scale the instance count based on demand. This supports large, elastic, highly available workloads.

In Azure App Service, what does the App Service plan define?

• a.The compute resources and pricing tier that host your app✓
• b.The redundancy level of your blob storage
• c.The operating system patch schedule for your VMs
• d.The DNS records and name-server settings for your organization's public domain

The App Service plan defines the underlying compute (size, tier, and instance count) that runs your apps. Multiple apps can share a plan. The chosen tier affects features, scale, and cost.

Azure Functions code typically runs in response to what?

• a.Events or triggers such as an HTTP request or new queue message✓
• b.The physical replacement of a failed disk
• c.A single fixed daily reboot of the underlying host operating system only
• d.Manual patching of servers by an administrator

Azure Functions is event-driven: code runs when a trigger fires, such as an HTTP request, timer, or queue message. You do not manage servers. Billing in the Consumption plan is based on executions and resources used.

Which scenario best fits Azure Container Instances?

• a.Orchestrating hundreds of interdependent microservices with complex scaling and self-healing
• b.Providing global DNS resolution for domains
• c.Hosting a full multi-node relational database cluster
• d.Running a short-lived container quickly without managing servers✓

Azure Container Instances runs containers on demand without provisioning VMs or orchestrators. It suits simple, short-lived, or bursty tasks. For complex orchestration, AKS is more appropriate.

What does Azure Kubernetes Service (AKS) primarily provide?

• a.A fully managed relational database engine based on SQL Server technology
• b.A managed secrets and certificate vault
• c.Managed orchestration of containerized workloads✓
• d.A global content delivery network for cached media

AKS is a managed Kubernetes service for orchestrating containers at scale. It automates cluster operations like scaling, upgrades, and self-healing. It is ideal for microservices architectures.

When you create a VNet, what must you define?

• a.A virtual machine operating system image
• b.A domain registrar account for the network
• c.A blob storage access tier such as hot, cool, or archive for objects
• d.A private IP address space (address range)✓

A virtual network requires a private IP address space, which you divide into subnets. Resources placed in the VNet receive addresses from these ranges. The VNet is the foundation for private networking in Azure.

Which Azure service provides secure RDP/SSH access to VMs in the portal without exposing public IP addresses?

• a.Azure Advisor
• b.Azure Bastion✓
• c.Azure DNS
• d.Azure Blob Storage

Azure Bastion gives secure browser-based RDP and SSH to VMs without assigning them public IPs. Connectivity happens over TLS within the portal. This reduces exposure to the public internet.

At what levels can a Network Security Group be associated?

• a.To a subnet or a network interface✓
• b.Only to an entire subscription and never to anything smaller than that
• c.To a single blob container
• d.Only to a management group at the top of the hierarchy

An NSG can be associated with a subnet or with a VM's network interface. Its rules allow or deny traffic by source, destination, port, and protocol. This controls network access at those levels.

A remote employee connects their laptop securely to Azure resources. Which VPN Gateway configuration fits?

• a.Site-to-site VPN between two fixed networks
• b.Point-to-site VPN✓
• c.A dedicated ExpressRoute private circuit provided through a connectivity partner
• d.Blob storage geo-replication

A point-to-site VPN connects an individual device to an Azure VNet over an encrypted tunnel. Site-to-site instead links whole networks. Point-to-site suits remote or mobile users.

Which is a defining characteristic of Azure ExpressRoute?

• a.It stores large amounts of unstructured object data
• b.It is a serverless event-driven compute option
• c.It always routes all of its traffic across the shared public internet backbone
• d.It provides a private connection that bypasses the public internet✓

ExpressRoute creates a private, dedicated connection between on-premises and Azure via a connectivity provider. Traffic does not traverse the public internet. This offers more consistent latency and higher reliability.

Azure DNS is used to host what?

• a.DNS records for your domain names✓
• b.Virtual machine operating-system disks and their attached data volumes
• c.Relational database tables
• d.Container images for deployment

Azure DNS hosts your domain's DNS records on Microsoft's global name-server network. It provides fast, reliable name resolution. You manage records with the same tools as other Azure resources.

At which network layer does Azure Load Balancer operate?

• a.Layer 1 (physical)
• b.Layer 2 (data link)
• c.Layer 4 (transport)✓
• d.Layer 7 (application)

Azure Load Balancer works at Layer 4, distributing TCP/UDP traffic across backend resources. For Layer 7 HTTP features like URL routing, Application Gateway is used. Layer 4 balancing is fast and protocol-agnostic.

Which capability is unique to Azure Application Gateway compared with a basic Layer 4 load balancer?

• a.It only forwards raw TCP packets blindly without any awareness of content
• b.It stores blob objects for websites
• c.URL-based routing and an optional Web Application Firewall✓
• d.It cannot inspect HTTP traffic at all

Application Gateway is a Layer 7 load balancer offering URL-based routing, SSL termination, and an optional WAF. These application-aware features go beyond Layer 4 balancing. It suits advanced HTTP/HTTPS scenarios.

Which blob access tier is optimized for data that is accessed frequently?

• a.Cold tier
• b.Archive tier
• c.Cool tier
• d.Hot tier✓

The hot tier is optimized for data accessed often, with the lowest access costs and higher storage cost. Cool and cold suit infrequently accessed data. Archive is the cheapest to store but slowest to retrieve.

Which access tier suits data that is infrequently accessed and stored for at least 30 days?

• a.Hot tier for active data
• b.Premium block blob tier
• c.Archive tier for rarely read data
• d.Cool tier✓

The cool tier targets infrequently accessed data kept for at least 30 days. It has lower storage cost but higher access cost than hot. Archive is for rarely accessed, long-retention data.

Which Azure managed disk type generally offers the highest performance for I/O-intensive workloads?

• a.Standard HDD for infrequent access
• b.Premium SSD✓
• c.Archive blob tier
• d.Cool blob tier

Premium SSD (and Ultra Disk) deliver high IOPS and low latency for demanding workloads. Standard HDD is cheaper but slower. Blob tiers are for object storage, not VM disks.

What problem does Azure Queue Storage help solve in an application architecture?

• a.Resolving domain names for the network
• b.Encrypting virtual machine operating-system disks and data disks at rest
• c.Decoupling components so they process work asynchronously✓
• d.Serving a public marketing website directly to users

Queue Storage holds messages that components add and retrieve asynchronously. This decouples producers from consumers so each can scale independently. It improves resilience and smooths load spikes.

Azure Table Storage is best described as what?

• a.A fully relational SQL database that supports complex joins and transactions
• b.A global content delivery network for caching media
• c.A NoSQL key-value store for structured, non-relational data✓
• d.A registry for storing container images

Azure Table Storage is a NoSQL key-value store for large amounts of structured, non-relational data. It scales cheaply for simple lookups. It does not support relational joins like a SQL database.

Which redundancy option combines zone redundancy in the primary region with replication to a secondary region?

• a.LRS, which stays within one datacenter
• b.ZRS, which stays within one region
• c.Premium solid-state disks provisioned for high-throughput database workloads
• d.GZRS (geo-zone-redundant storage)✓

GZRS writes data across availability zones in the primary region and also replicates to a secondary region. It combines zone and geo resilience. This provides very high durability and availability.

What does read-access geo-redundant storage (RA-GRS) add over standard GRS?

• a.Read access to the data in the secondary region✓
• b.Nothing at all, because the two options are completely identical in every way
• c.It automatically deletes older data to save space
• d.It removes the secondary copy of the data entirely

RA-GRS adds the ability to read from the secondary region even when the primary is available. Standard GRS keeps a secondary copy but normally does not allow reads from it unless a failover occurs. RA-GRS improves read availability.

Which is TRUE of Azure SQL Database as a PaaS offering?

• a.You must patch the guest operating system yourself
• b.It is only ever available as an on-premises installation inside your datacenter
• c.You manage the underlying physical servers directly
• d.Microsoft manages patching, backups, and high availability✓

Azure SQL Database is a fully managed PaaS relational database. Microsoft handles patching, backups, and high availability. You focus on the database schema, data, and queries.

Which capability is a hallmark of Azure Cosmos DB?

• a.It cannot scale its throughput up or down
• b.It exclusively supports the traditional Microsoft SQL Server relational engine
• c.Turnkey global distribution with low-latency reads and writes✓
• d.It runs only in a single region at a time

Cosmos DB offers turnkey global distribution with low-latency access and elastic scale. It supports multiple data models and APIs. This makes it ideal for globally responsive applications.

A team wants a managed open-source relational database. Which Azure option fits?

• a.Azure Database for PostgreSQL✓
• b.Azure DNS for domain name resolution
• c.Azure Blob Storage for large unstructured object and media data sets
• d.Azure Bastion for secure VM access

Azure Database for PostgreSQL (and MySQL/MariaDB) are managed open-source relational databases. Microsoft handles maintenance, backups, and scaling. They suit teams standardizing on open-source engines.

Why might an organization use multiple Azure subscriptions?

• a.To physically separate the server racks inside each of the provider's datacenters
• b.To completely disable Azure across the company
• c.To change the fundamental laws of physics for their workloads
• d.To separate environments, billing, or teams and manage limits✓

Multiple subscriptions help separate environments (dev/test/prod), teams, or billing. They also help work around per-subscription service limits. Management groups can then govern them together.

What happens to the resources inside a resource group when the group is deleted?

• a.They are all deleted along with the group✓
• b.They are automatically moved to another subscription for safekeeping
• c.They are converted into blob objects
• d.They become permanently read-only forever

Deleting a resource group deletes all resources it contains. This makes groups useful for managing the lifecycle of related resources together. Resource locks can prevent accidental deletion.

Which factor is LEAST relevant when choosing an Azure region for a deployment?

• a.The favorite color of the IT manager✓
• b.Data residency and compliance requirements
• c.Whether the needed services and features are available there
• d.Proximity to your users to reduce latency

Region choice should consider compliance, latency, cost, and service availability. Personal preferences like a favorite color are irrelevant. Sound region selection balances the meaningful technical and legal factors.

How do Availability Zones differ from availability sets?

• a.Availability zones are primarily designed to protect against application-level software bugs
• b.Availability sets replicate data to entirely different regions
• c.Zones use separate datacenters; sets spread VMs within a single datacenter✓
• d.They are identical and interchangeable concepts

Availability Zones are separate datacenters within a region, protecting against a datacenter failure. Availability sets spread VMs across fault and update domains inside one datacenter. Zones offer stronger, cross-datacenter resilience.

A workload runs briefly only when a file is uploaded, a few times a day. Which compute option is most cost-effective?

• a.A 24/7 AKS cluster with many always-running nodes
• b.A dedicated bare-metal server
• c.A large always-on virtual machine
• d.Azure Functions✓

Azure Functions on the Consumption plan bills only while code runs. For sporadic, event-driven tasks this is very cost-effective. Always-on VMs or clusters would cost far more for the same rare workload.

What is the benefit of deployment slots in Azure App Service?

• a.They store archived blob objects at the lowest possible long-term storage cost
• b.They let you stage and swap app versions with minimal downtime✓
• c.They resolve DNS records faster for the app
• d.They encrypt the connected database automatically

Deployment slots host different versions of an app, such as staging and production. You can validate in staging and then swap with production nearly instantly. This enables safe releases with minimal downtime.

Which statement about a single Azure Virtual Network is correct?

• a.A VNet is a physical hardware device
• b.A VNet can exist without belonging to any subscription
• c.A VNet is scoped to a single region✓
• d.A VNet spans multiple regions automatically by default

A VNet is scoped to one region and one subscription. To connect VNets across regions, you use peering or gateways. Understanding this scope is important for network design.

To connect two VNets over Microsoft's private backbone with low latency, you would use…

• a.the shared public internet with an encrypted tunnel between the two networks
• b.VNet peering✓
• c.the Azure DNS resolution service
• d.a single blob storage container

VNet peering links two virtual networks over Microsoft's backbone with low latency. Traffic stays on the private network, not the public internet. It is commonly used to connect workloads across VNets or regions.

Which feature lets you access a PaaS service like a storage account over a private IP inside your VNet?

• a.Azure Private Link / private endpoint✓
• b.An availability set for the VMs
• c.A ReadOnly resource lock on the account
• d.A publicly routable IP address exposed directly to the open internet at large

Azure Private Link exposes a PaaS service through a private endpoint with a private IP in your VNet. Traffic avoids the public internet. This improves security and simplifies network design.

Azure Blob, File, Queue, and Table services are all offered through what?

• a.An availability set of servers
• b.An Azure storage account✓
• c.A DNS zone resource
• d.A single dedicated virtual machine

These four data services are provided within an Azure storage account. The account defines settings like performance tier and redundancy. It is the top-level container for Azure Storage.

What is a snapshot of an Azure managed disk used for?

• a.Distributing incoming requests across many servers
• b.Resolving domain names for the network
• c.Directly serving high-volume public web traffic to end users worldwide
• d.A point-in-time copy for backup or creating new disks✓

A snapshot captures a disk at a point in time. It can be used for backup or to create new identical disks. Snapshots support recovery and duplication scenarios.

Azure File Sync is primarily used to…

• a.cache Azure file shares on local Windows servers✓
• b.encrypt individual blob objects using customer-managed encryption keys
• c.orchestrate large fleets of containers
• d.route and balance network traffic across regions

Azure File Sync caches Azure file shares on on-premises Windows servers. This gives fast local access while centralizing data in Azure. It supports hybrid file-sharing scenarios.

Azure Cosmos DB supports multiple APIs. Which is one of them?

• a.NoSQL (Core) and MongoDB API✓
• b.An SMB file-sharing protocol API
• c.An RDP remote desktop protocol API
• d.A dedicated SMTP email-sending API for outbound mail delivery

Cosmos DB offers several APIs, including NoSQL (Core), MongoDB, Cassandra, Gremlin, and Table. This lets teams use familiar tools and models. It is a multi-model, globally distributed database.

What does an Azure SQL Database elastic pool allow?

• a.Hosting and orchestrating containers at scale
• b.Performing faster DNS lookups for applications
• c.Storing large unstructured blob objects at the lowest available archive cost
• d.Multiple databases to share a set of resources cost-effectively✓

An elastic pool lets several databases share a common set of resources. Databases with varying, unpredictable usage benefit as capacity is pooled. This can lower cost compared with provisioning each database separately.

Every Microsoft Entra (Azure AD) tenant has a single top-level management group called what?

• a.The root management group✓
• b.The primary billing subscription
• c.The default resource group that is created automatically in each region
• d.The tenant blob container

Each tenant has one root management group at the top of the hierarchy. All other management groups and subscriptions descend from it. Policies applied there can affect the entire tenant.

A benefit of deploying with ARM/Bicep templates is that they are declarative and idempotent, meaning…

• a.they can only ever be run one single time
• b.each separate run randomly changes the resulting configuration in unpredictable ways
• c.they delete all existing resources on every run
• d.applying the same template repeatedly yields the same end state✓

Declarative templates describe the desired end state, not step-by-step commands. Idempotency means running them repeatedly converges to that same state. This makes deployments predictable and repeatable.

To achieve the highest single-region VM availability SLA, you should deploy VMs across what?

• a.One subnet only, without redundancy
• b.One single server placed inside one rack in one datacenter room
• c.Multiple Availability Zones✓
• d.One managed disk shared by all instances

Spreading VMs across multiple Availability Zones protects against a datacenter failure and earns the highest single-region VM SLA. A single server offers no redundancy. Zones provide independent power, cooling, and networking.

Under the Azure Functions Consumption plan, you are billed based on…

• a.the number of executions and resources used while running✓
• b.the color theme selected in the portal
• c.a single flat monthly fee that applies regardless of how much you actually use
• d.the number of DNS records you host

The Consumption plan bills on the number of executions and the resources consumed during each run. When nothing runs, you pay nothing (aside from minor storage). This aligns cost with actual activity.

Which Azure service stores and manages container images?

• a.Azure DNS, which hosts your public domain name records globally
• b.Azure Container Registry✓
• c.Azure Bastion for secure VM access
• d.Azure Key Vault for secrets and certificates

Azure Container Registry stores and manages container images and related artifacts. Services like AKS and ACI pull images from it. It supports private, secure image distribution.

Which Azure service uses DNS to route users to the best endpoint across multiple regions?

• a.Azure Bastion, which provides secure browser-based access to virtual machines
• b.Azure Files for managed file shares
• c.Azure Key Vault for storing secrets
• d.Azure Traffic Manager✓

Azure Traffic Manager is a DNS-based traffic router. It directs users to the most appropriate regional endpoint using routing methods like performance or priority. It improves availability and responsiveness across regions.

Which service provides global HTTP load balancing, acceleration, and a WAF at the network edge?

• a.Azure Queue Storage for asynchronous messaging between application components
• b.Azure DNS for name resolution
• c.Azure Table Storage for NoSQL key-value data
• d.Azure Front Door✓

Azure Front Door provides global HTTP/HTTPS load balancing, acceleration, SSL offload, and an optional WAF at the edge. It routes users to the fastest healthy backend. It is used for global, high-performance web delivery.

How are Network Security Group rules evaluated?

• a.By priority number, with the lowest number processed first✓
• b.In a completely random order that changes on every network connection attempt
• c.Strictly alphabetically by the rule name
• d.Only inbound rules are ever considered

NSG rules are processed in priority order, lowest number first, and the first match applies. Both inbound and outbound rule sets exist. Careful priority ordering ensures the intended allow/deny behavior.

In every Azure subnet, a small number of IP addresses are…

• a.permanently unusable for the life of the subscription
• b.always assigned as publicly routable addresses reachable from the internet
• c.reserved by Azure for internal use✓
• d.assigned exclusively to DNS servers

Azure reserves a few addresses in each subnet (for the network address, gateway, DNS mapping, and broadcast). These cannot be assigned to your resources. You must account for them when sizing subnets.

What does a shared access signature (SAS) provide for Azure Storage?

• a.Completely free storage with no charges
• b.Permanent and unrestricted access to every resource in the storage account forever
• c.A convenient way to delete the entire storage account
• d.Delegated, time-limited access to specific resources✓

A SAS grants delegated, time-bound access to specific storage resources with defined permissions. It avoids sharing the account keys directly. This supports secure, scoped access for clients.

Blob lifecycle management policies help you…

• a.automatically move or delete blobs based on their age✓
• b.encrypt the whole virtual network and all of its attached subnets automatically
• c.resolve domain names more quickly for applications
• d.assign RBAC roles to users at scale

Lifecycle management policies automatically transition blobs to cooler tiers or delete them based on rules like age. This optimizes storage cost over time. It reduces manual data-management work.

Compared with Standard HDD, Premium SSD managed disks offer…

• a.higher performance at a higher cost✓
• b.noticeably lower cost together with noticeably lower input/output performance
• c.no meaningful difference of any kind
• d.the exact same performance for a lower monthly price

Premium SSD delivers higher IOPS and throughput than Standard HDD, at a higher price. You choose disk type based on performance needs and budget. High-performance workloads justify the premium tier.

Azure SQL Managed Instance is best suited for customers who want…

• a.near-full SQL Server compatibility with managed infrastructure✓
• b.a globally distributed NoSQL database with turnkey multi-region replication
• c.a managed container orchestration platform
• d.a global DNS hosting service

SQL Managed Instance offers high compatibility with on-premises SQL Server while Microsoft manages the infrastructure. It eases lift-and-shift migrations that need instance-level features. It bridges IaaS control and PaaS convenience.

Azure Cosmos DB lets you choose among several…

• a.DNS record types for name resolution
• b.consistency levels ranging from strong to eventual✓
• c.virtual machine size families
• d.blob storage access tiers only, such as hot, cool, cold, and archive

Cosmos DB provides tunable consistency levels from strong to eventual. This lets you balance latency, availability, and data freshness. Choosing the right level suits your application's needs.

Before using a service type in a subscription, ARM may require you to register the corresponding…

• a.resource provider✓
• b.DNS zone that hosts the public name records for the organization's domain
• c.blob storage container for objects
• d.availability set for virtual machines

Resource providers supply Azure services (for example, Microsoft.Compute). A provider may need to be registered in a subscription before its resources can be created. ARM manages this registration.

Which statement about moving Azure resources between resource groups is TRUE?

• a.Many resources can be moved, though some have restrictions✓
• b.It permanently deletes the resource being moved
• c.It always changes the region the resource runs in
• d.It is completely impossible for any type of Azure resource under all conditions

Many resources can be moved between resource groups or subscriptions, but some services have limitations. Moving does not change the resource's region. Always check move support before relying on it.

Azure Dedicated Host provides…

• a.a managed NoSQL database for global apps
• b.physical servers dedicated to a single customer's VMs✓
• c.global DNS-based traffic routing
• d.serverless event-driven functions that scale automatically with incoming demand

Azure Dedicated Host gives you physical servers dedicated to your organization's VMs. This supports compliance, licensing, and isolation requirements. You gain visibility and control over the underlying hardware.

Azure App Service can host web apps built in…

• a.only low-level assembly language compiled directly for the host processor
• b.no programming languages at all
• c.multiple languages such as .NET, Java, Node.js, Python, and PHP✓
• d.only the COBOL programming language

App Service supports many popular languages and frameworks, including .NET, Java, Node.js, Python, and PHP. It manages the hosting platform for you. This flexibility suits diverse web workloads.

To deploy a VPN or ExpressRoute gateway, a VNet needs a special subnet called…

• a.DefaultSubnet
• b.PublicSubnet
• c.BlobSubnet
• d.GatewaySubnet✓

A gateway requires a dedicated subnet named GatewaySubnet. Azure places the gateway resources there. Using the exact name is required for the gateway to deploy correctly.

Azure Private DNS zones are used to…

• a.store container images for deployment
• b.resolve names privately for resources inside your virtual networks✓
• c.assign RBAC roles to users
• d.host only public-facing marketing websites that anyone on the internet can reach

Private DNS zones provide name resolution within and between VNets without exposing records publicly. They support custom domain names for internal resources. This keeps internal naming private and manageable.

Which blob storage feature helps meet compliance by preventing data from being modified or deleted for a set period?

• a.Automatic autoscaling of the storage account
• b.Virtual network peering between two networks
• c.The hot access tier, which is optimized for frequently accessed active data
• d.Immutable (WORM) storage policies✓

Immutable, write-once-read-many (WORM) policies prevent blobs from being changed or deleted for a defined period. This helps meet regulatory retention requirements. It protects critical records from tampering.

A benefit of Azure managed disks over manually managing storage accounts for VM disks is…

• a.you must manually create and manage all of the underlying storage accounts yourself
• b.Azure handles the underlying storage accounts for you✓
• c.disks cannot be resized after creation
• d.no redundancy options are available for them

Managed disks let Azure handle the underlying storage accounts, simplifying management. You just specify disk type and size. They also improve reliability and scaling compared with unmanaged disks.

What is the relationship between a Microsoft Entra tenant and Azure subscriptions?

• a.A tenant can be associated with many subscriptions, but each subscription trusts one tenant✓
• b.Each tenant is permitted to have only one single subscription associated with it, ever
• c.Subscriptions and tenants are exactly the same thing
• d.Tenants are physical servers in a datacenter

A Microsoft Entra tenant is an identity boundary that can hold many subscriptions. Each subscription trusts exactly one tenant for authentication. This separates identity from billing and resource management.

Which ordering reflects increasing abstraction (less infrastructure to manage) for compute?

• a.Virtual machines are the most abstracted option
• b.VMs, then App Service, then Functions✓
• c.Azure Functions first, then App Service, and finally virtual machines at the end
• d.App Service is less abstracted than virtual machines

VMs (IaaS) require the most management, App Service (PaaS) less, and Functions (serverless) the least. Moving along this order, you manage less infrastructure. Choosing the right level balances control and simplicity.

To protect stored data against a complete regional outage, which redundancy level is the minimum needed?

• a.ZRS, which keeps copies within one region
• b.GRS or GZRS (geo-redundant)✓
• c.LRS, which keeps copies in one datacenter
• d.Premium solid-state disks configured for the highest possible database throughput

Protecting against a full regional outage requires geo-redundant storage (GRS or GZRS), which replicates to a second region. LRS and ZRS stay within one region. Geo-redundancy adds cross-region durability.

In Azure Cosmos DB, provisioned throughput is measured in…

• a.gigabytes transferred per second across the global replication network
• b.Request Units per second (RU/s)✓
• c.the number of DNS queries answered
• d.the count of virtual CPUs assigned

Cosmos DB measures throughput in Request Units per second (RU/s). RUs abstract the CPU, memory, and IOPS needed for operations. You provision or autoscale RU/s to match workload demand.

How can Azure App Service handle increased web traffic automatically?

• a.By deleting the app to reduce the load on servers
• b.By reducing available memory down to zero
• c.By turning off the connected database to conserve resources during peak traffic
• d.By scaling out to more instances based on rules✓

App Service can scale out automatically, adding instances when rules or metrics indicate higher demand. It scales back in when demand falls. This keeps performance steady while managing cost.

Which service provides outbound-only internet connectivity with a stable public IP for resources in a subnet?

• a.Azure Key Vault for secrets and certificates
• b.Azure NAT Gateway✓
• c.Azure DNS for resolving domain names
• d.Azure Bastion, providing secure browser-based RDP and SSH into virtual machines

Azure NAT Gateway provides scalable outbound internet connectivity with a consistent public IP. Resources initiate outbound traffic without needing individual public IPs. Inbound connections are not allowed through it.

How can you restrict a storage account so only specific networks can reach it?

• a.Add several additional DNS records
• b.Move all blobs to the archive access tier
• c.Configure storage firewall and virtual network rules✓
• d.Delete the entire storage account and recreate it in a different Azure region

Storage account firewalls and virtual network rules restrict access to selected networks or IP ranges. Combined with private endpoints, they limit exposure. This strengthens the security of stored data.

By default, data in Azure managed disks and Storage is protected with…

• a.encryption applied only to blob objects and never to any virtual machine disks
• b.encryption only if you purchase a separate add-on
• c.encryption at rest using Storage Service Encryption✓
• d.no encryption of any kind

Azure encrypts data at rest by default using Storage Service Encryption. This applies to Storage and managed disks without extra configuration. You can also use customer-managed keys for more control.

What is an Azure geography?

• a.A billing currency used on invoices
• b.A discrete market, often a country, containing one or more regions for data residency✓
• c.A single physical server installed within one specific rack inside a datacenter room
• d.A particular virtual machine size family

An Azure geography is a discrete market, typically aligning with a country, that contains one or more regions. Geographies preserve data residency and compliance boundaries. Region pairs stay within the same geography.

Can a resource group in one region contain resources located in other regions?

• a.Yes, resources in a group can reside in different regions✓
• b.Only when the resources are in the same server rack
• c.Only if all of the resources involved happen to be blob storage objects specifically
• d.No, this is never possible under any circumstances

A resource group has its own metadata location, but the resources it contains can live in different regions. The group is a logical, not physical, boundary. This gives flexibility in organizing resources.

Which App Service tier provides a fully isolated, dedicated environment for high scale and security?

• a.The Free tier for small test apps
• b.The cool storage tier for infrequent data
• c.The Isolated (App Service Environment) tier✓
• d.The archive access tier used for rarely accessed long-term storage of blob data

The Isolated tier, using an App Service Environment, runs apps in a dedicated, network-isolated environment. It supports high scale and stricter security. It suits workloads with demanding compliance needs.

For running many interdependent microservices with automated scaling and self-healing, which is most appropriate?

• a.One standalone Azure Container Instance
• b.A single Azure Function triggered occasionally by an incoming HTTP request only
• c.A single static blob in storage
• d.Azure Kubernetes Service (AKS)✓

AKS orchestrates many containers with automated scaling, rolling upgrades, and self-healing. It suits complex microservices architectures. ACI or a single Function is better for simpler, isolated tasks.

An Azure VM typically has an OS disk, optional data disks, and a…

• a.queue disk for messages
• b.blob disk for object storage
• c.DNS disk used specifically for hosting the machine's public domain records
• d.temporary disk✓

An Azure VM has an OS disk, optional data disks, and a temporary disk for short-lived data like a page file. The temporary disk is not persistent and can be lost on deallocation. Persistent data belongs on managed disks.

Why might an enterprise choose ExpressRoute over a site-to-site VPN?

• a.It runs entirely over the shared public internet
• b.It offers more predictable latency and higher reliability over a private link✓
• c.It requires no connectivity provider at all
• d.It is always the cheapest possible connectivity option in every single scenario

ExpressRoute uses a private connection with more predictable latency and higher reliability than an internet VPN. It suits mission-critical or high-bandwidth hybrid workloads. It does require a connectivity provider and typically costs more.

Azure Storage accounts come in performance tiers named…

• a.Fast and Slow
• b.Bronze and Gold
• c.Hot and Cold
• d.Standard and Premium✓

Storage account performance comes in Standard and Premium tiers. Premium uses SSDs for low latency and high throughput. Standard is cost-effective for general-purpose data.

Which Cosmos DB option automatically scales throughput within a range based on usage?

• a.Autoscale (autoscale throughput)✓
• b.Only fixed, manually provisioned throughput that never changes automatically at all
• c.No scaling of any kind is possible
• d.DNS-based scaling of the database

Cosmos DB autoscale adjusts provisioned throughput automatically within a set maximum range. It handles variable workloads without manual tuning. You pay for the throughput actually used within that range.

Do Azure resources automatically inherit tags from their resource group?

• a.Tags cannot exist on individual resources
• b.No, tags are not inherited by default, though policy can add them✓
• c.Only blob objects inherit tags automatically
• d.Yes, every resource always automatically inherits every tag from its resource group

Resources do not inherit resource group tags by default. Azure Policy can enforce or append tags to achieve consistency. Tags support cost tracking and organization.

By default, resources in a VNet use which DNS unless you configure custom servers?

• a.No DNS resolution at all
• b.Only their own local host file with statically defined name-to-address mappings
• c.A random public resolver chosen each time
• d.Azure-provided DNS✓

By default, VNet resources use Azure-provided DNS for name resolution. You can configure custom DNS servers or Private DNS zones if needed. This default handles basic resolution automatically.

Azure App Service lets you add a custom domain and secure it with…

• a.a blob storage container
• b.no security controls at all
• c.only manually generated self-signed certificates that browsers do not trust
• d.a TLS/SSL certificate✓

App Service supports custom domains secured with TLS/SSL certificates, including managed certificates. This enables HTTPS on your own domain name. It protects traffic between users and the app.

Which storage service would you use to store large media files served to a website?

• a.Azure Blob Storage✓
• b.Azure Table Storage for key-value data
• c.Azure Queue Storage for messages
• d.Azure SQL Database for relational data

Blob Storage is designed for large unstructured objects like images and video. It integrates with CDN for fast delivery. It is the natural choice for website media assets.

Virtual Machine Scale Sets can automatically add or remove VM instances based on…

• a.nothing at all, because the number of instances always remains completely fixed
• b.only the current time zone name of the region
• c.the color assigned to the virtual machine
• d.metrics such as CPU usage or a defined schedule✓

Scale sets autoscale by adding or removing instances based on metrics like CPU or on a schedule. This matches capacity to demand automatically. It supports elastic, highly available workloads.

Virtual Network service endpoints allow…

• a.faster DNS resolution only
• b.the automatic deletion of a virtual network
• c.a subnet to reach specific Azure services over the backbone✓
• d.the full public internet exposure of every single resource in the subscription

Service endpoints extend a subnet's identity to selected Azure services over the Microsoft backbone. This keeps traffic off the public internet and can restrict service access to the VNet. It improves security for PaaS connectivity.

Which pairing correctly matches the database to its type?

• a.Azure SQL Database is a NoSQL store while Azure Cosmos DB is a relational engine
• b.Both Azure SQL Database and Cosmos DB are container registries
• c.Azure SQL Database is relational; Azure Cosmos DB is NoSQL✓
• d.Both Azure SQL Database and Cosmos DB are file shares

Azure SQL Database is a relational (SQL) database, while Cosmos DB is a globally distributed NoSQL database. Choosing between them depends on data model and scale needs. Matching workloads to the right type is a key skill.

Which factor most directly increases the monthly cost of an Azure virtual machine?

• a.The number of tags applied to the resource
• b.The VM size (its number of vCPUs and amount of memory)✓
• c.The number of descriptive metadata tags and key-value labels attached to the resource
• d.The color theme selected in the Azure portal

Compute cost scales with the VM size you select, because larger SKUs allocate more vCPUs and memory. Tags, names, and portal themes are metadata or cosmetic and have no effect on price.

How is network bandwidth generally billed in Azure?

• a.Outbound data transfer leaving Azure is typically charged, while most inbound data is free✓
• b.All inbound and outbound data transfer is billed at the same flat rate
• c.Network bandwidth is always included at no cost in every service
• d.Only the inbound data transferred into the Azure datacenter is metered and billed to the customer

Azure generally charges for egress (data flowing out of its datacenters) while ingress is usually free. This is why moving large volumes of data out of a region is a common, sometimes overlooked, cost driver.

Why might the exact same virtual machine size cost a different amount in two different Azure regions?

• a.Regions located farther from the equator always charge a premium because of higher cooling demands
• b.Pricing varies by region because the cost to operate each datacenter differs✓
• c.Region has no effect on price; all regions charge identical rates
• d.Only the primary region can host virtual machines at full price

Azure prices services per region, reflecting differences in local energy, land, labor, and taxes. Choosing a lower-cost region for latency-tolerant workloads is a legitimate optimization technique.

Azure Reservations require the customer to make what kind of commitment in exchange for a discount?

• a.A commitment to never resize the reserved resource
• b.A month-to-month commitment that can be canceled anytime for free
• c.A one-year or three-year commitment to a specific resource✓
• d.A commitment to keep the resource in a single availability zone

Reservations trade a 1-year or 3-year usage commitment for pricing well below pay-as-you-go. They fit steady, predictable workloads because you are effectively pre-paying for capacity you know you will use.

What does the Azure Hybrid Benefit allow an organization to do?

• a.Run Azure services for free for the first three years of a subscription
• b.Combine two separate Azure regions into a single shared billing zone with one blended rate
• c.Reuse existing on-premises Windows Server or SQL Server licenses with Software Assurance to lower Azure costs✓
• d.Automatically move on-premises servers into Azure without any migration tools

Azure Hybrid Benefit lets you apply eligible licenses you already own to Azure workloads, avoiding paying again for the software portion. It can be combined with Reservations for even deeper savings.

What can happen to an Azure Spot Virtual Machine when Azure needs the underlying capacity back?

• a.It is automatically upgraded to a reserved instance at no charge
• b.It continues running with a guaranteed service-level agreement
• c.It is migrated live to another region with guaranteed uptime
• d.It can be evicted (deallocated) with little notice✓

Spot VMs use Azure's surplus capacity at steep discounts, but Azure can reclaim that capacity at any time by evicting the VM. They are therefore appropriate only for interruptible, fault-tolerant work.

Azure Dev/Test pricing offers what advantage to eligible subscriptions?

• a.The automatic promotion and conversion of finished dev/test environments straight into production
• b.Guaranteed higher performance than standard subscriptions
• c.Reduced rates on certain services for non-production development and testing workloads✓
• d.A permanently free production environment for any workload

Dev/Test offers discounted rates on select services for teams building and testing, provided the resources are not used in production. It helps lower the cost of non-critical environments.

A budget alert in Microsoft Cost Management notifies stakeholders based on what?

• a.The number of resources deployed regardless of their cost
• b.Whether a resource has been assigned the correct tags
• c.The ambient physical temperature reported by sensors inside the datacenter facility
• d.Actual or forecasted spending crossing a defined threshold✓

Budgets track spend for a chosen scope and fire alerts when actual or forecasted costs approach the limit you set. This gives teams advance warning before overspending occurs.

Which action is an example of 'right-sizing' to reduce Azure costs?

• a.Moving every workload to the most expensive region
• b.Permanently deleting all diagnostic and activity logs in order to free up storage space
• c.Adding more tags to each resource to trigger discounts
• d.Resizing a consistently underutilized virtual machine to a smaller SKU✓

Right-sizing matches a resource's capacity to its real demand, so an over-provisioned VM is scaled down to a cheaper SKU. Azure Advisor frequently surfaces right-sizing opportunities.

What is the billing effect of stopping (deallocating) an Azure virtual machine?

• a.All storage and networking charges are eliminated immediately
• b.You are charged the same as when the VM is running
• c.The virtual machine is permanently deleted along with all of its attached data disks
• d.You stop paying for its compute while deallocated, though you still pay for attached disks✓

Deallocating releases the compute resources so you no longer pay for vCPU/memory time, but persistent disks and reserved IPs still incur charges. Fully stopped-deallocated is different from merely shutting down the guest OS.

How does autoscaling help control cost?

• a.It removes capacity when demand falls, so you avoid paying for idle resources✓
• b.It disables resource monitoring so that fewer metrics are collected and billed each month
• c.It applies a flat discount to every resource in the subscription
• d.It permanently locks capacity at the maximum size to avoid outages

Autoscaling adds instances during spikes and removes them when load drops, aligning spend with real demand. Paying only for what you actively use is a core cloud cost principle.

Moving rarely accessed blob data to the cool or archive access tier has what effect?

• a.It increases the redundancy to geo-redundant automatically
• b.It speeds up frequent read operations on that data
• c.It lowers storage cost for infrequently accessed data✓
• d.It converts the data into a relational database

Cooler tiers charge less for storage in exchange for higher access costs and, for archive, retrieval latency. Placing seldom-read data in the right tier is a simple, effective saving.

You want to estimate the monthly price of a new architecture before you deploy anything. Which tool should you use?

• a.Microsoft Defender for Cloud
• b.The Total Cost of Ownership (TCO) Calculator
• c.The Azure Pricing Calculator✓
• d.Azure Service Health

The Pricing Calculator models the cost of a configuration you plan to build in Azure. The TCO Calculator, by contrast, compares existing on-premises costs against Azure.

Your finance team wants to compare the cost of your current on-premises datacenter against running the same workloads in Azure. Which tool fits best?

• a.The Total Cost of Ownership (TCO) Calculator tool for migrations
• b.The Total Cost of Ownership (TCO) Calculator✓
• c.The Azure Pricing Calculator
• d.Azure Monitor

The TCO Calculator estimates the savings of migrating existing infrastructure to Azure, factoring in hardware, power, and staffing. It is aimed at building the business case for migration.

Which of the following is a genuine factor that affects the cost of an Azure service?

• a.The type of resource and the settings you choose for it✓
• b.The web browser used to access the portal
• c.How many users are viewing the Azure portal
• d.The number of characters in the resource's display name

Cost depends on the resource type, its configuration (size, tier, redundancy), and its region. Cosmetic factors like names or the browser used have no bearing on billing.

At which scopes can you analyze spending in Microsoft Cost Management?

• a.Management group, subscription, and resource group✓
• b.Only at the scope of one individual resource at a time
• c.Only for resources tagged as production
• d.Only across the entire Azure global cloud

Cost Management lets you view and filter costs at management group, subscription, and resource-group scopes. This flexibility supports both organization-wide and team-level financial visibility.

What does a 'free tier' offered by some Azure services provide?

• a.Unlimited use of the service forever at no charge
• b.A discount that applies to every other Azure service
• c.A limited amount of the service that you can use at no charge✓
• d.Brand-new physical server hardware shipped directly to your office

Many services include a free tier or free monthly allotment up to a defined limit, after which normal charges apply. It lets you evaluate or run small workloads without cost.

What does consumption-based (metered) billing mean in Azure?

• a.You are billed only once per year with no usage tracking
• b.You pay a single fixed fee regardless of how much you use
• c.You must purchase and rack physical server hardware before using any of the service
• d.You are charged per unit of usage, such as per GB stored or per compute hour✓

Metered billing charges for the actual quantity of a resource consumed, like gigabytes or vCPU-hours. This pay-for-what-you-use model is central to cloud economics.

Azure Reservations deliver the best value for which kind of workload?

• a.Workloads that can tolerate being evicted from their capacity at any moment
• b.Experimental workloads whose usage is completely unknown
• c.Short-lived batch jobs that run for only a few minutes
• d.Steady-state, predictable workloads that run consistently✓

Because a reservation is a 1- or 3-year commitment, it pays off when a resource runs consistently over that period. Unpredictable or interruptible workloads are better served by pay-as-you-go or Spot.

A cost alert in Microsoft Cost Management is primarily used to do what?

• a.Encrypt all of the subscription's billing data for regulatory compliance
• b.Notify the right people when spending reaches a defined threshold✓
• c.Increase the resource limits of the subscription
• d.Automatically shut down every resource in the subscription

Cost alerts watch spend against budgets or thresholds and send notifications so teams can react before overspending. They are informational triggers, not automatic resource controls.

To attribute cloud spend to a specific project for internal chargeback, what is the recommended approach?

• a.Assign each project its own physical datacenter
• b.Apply a consistent tag to the project's resources and filter cost analysis by that tag✓
• c.Provision a separate, dedicated Azure region exclusively for each individual project
• d.Rename every resource to include the project name in the resource ID

Consistent tagging lets Cost Management group and report spend by project, department, or environment. Filtering cost analysis on the tag produces accurate chargeback or showback figures.

An Azure savings plan for compute provides a discount in exchange for what commitment?

• a.Committing to never scale the workload up or down
• b.Committing to a fixed hourly spend on compute for a one- or three-year term✓
• c.Committing to use only a single availability zone
• d.Committing to delete all existing pay-as-you-go resources before the discount applies

A savings plan discounts compute usage up to a chosen hourly dollar commitment over 1 or 3 years, offering more flexibility than a reservation tied to a specific SKU. Usage above the commitment is billed at pay-as-you-go rates.

How is data transfer between two different Azure regions generally treated for billing?

• a.It is always free regardless of volume
• b.It is billed only if the regions are in different continents at a premium rate only
• c.It is charged the same as data written to local disk
• d.It is typically charged as inter-region (egress) bandwidth✓

Moving data across regions incurs egress bandwidth charges, unlike much traffic that stays within a region. Architects weigh this when deciding where to replicate or process data.

Which products can benefit from Azure Hybrid Benefit licensing savings?

• a.Only open-source database engines running inside Linux containers
• b.Only services that have no on-premises equivalent
• c.Windows Server and SQL Server (and certain Linux subscriptions)✓
• d.Any third-party software installed on a virtual machine

Azure Hybrid Benefit applies to eligible Windows Server and SQL Server licenses with Software Assurance, plus some Linux subscriptions. It reduces the software portion of the cost for those specific products.

Why are Azure Spot Virtual Machines offered at a large discount?

• a.They run on Azure's spare, unused capacity that can be reclaimed when needed✓
• b.They come with a stronger uptime guarantee than standard VMs
• c.They store data on slower disks that never change price
• d.They are permanently limited to only the very smallest available virtual machine sizes

Spot pricing monetizes idle capacity, so the discount reflects the risk that Azure may evict the VM to serve paying, on-demand customers. That trade-off makes Spot ideal for interruptible workloads.

A common, often-overlooked source of unnecessary Azure spend is which of the following?

• a.Applying additional descriptive tags and labels to every resource in the subscription
• b.Following Azure Advisor cost recommendations
• c.Over-provisioned or idle resources that continue to run without being used✓
• d.Reviewing the cost analysis dashboard regularly

Idle VMs, oversized SKUs, and orphaned disks keep billing while delivering no value. Regularly identifying and removing or resizing them is a primary optimization activity.

Azure Advisor's cost recommendations might suggest which of the following?

• a.Turning off all security monitoring to save money
• b.Buying reservations or resizing and shutting down underused virtual machines✓
• c.Moving all data to the most expensive storage tier
• d.Deleting your entire production subscription and all of the resources it contains

Advisor analyzes usage and recommends actions such as purchasing reservations or right-sizing idle VMs to cut cost. Its guidance is tailored to your actual resource utilization.

What is the role of an Azure billing account?

• a.It securely stores the encryption keys and certificates for all resources
• b.It defines which regions a subscription may deploy to
• c.It hosts the virtual machines used for billing calculations
• d.It manages invoices and payment for one or more subscriptions✓

A billing account is the top-level construct for managing invoices, payment methods, and the subscriptions grouped under it. It separates financial administration from technical resource management.

What does the cost forecast feature in Microsoft Cost Management help you do?

• a.Automatically purchase reservations on your behalf
• b.Guarantee that costs will never exceed a set amount
• c.Predict likely future spending based on historical usage patterns✓
• d.Encrypt and archive historical billing records for long-term retention

Forecasting projects future costs from past trends so teams can plan budgets and spot looming overruns. It is a planning aid, not an automatic spending control.

What is the scope flexibility of an Azure Reservation?

• a.It is limited to resources created after the reservation is purchased
• b.It can only ever be applied to one individual virtual machine at a time within the subscription
• c.It must be applied to every region simultaneously
• d.It can apply to a single subscription or be shared across all subscriptions in the billing account✓

Reservation scope can be set to a specific subscription or shared, letting the discount apply wherever matching usage occurs. Shared scope maximizes utilization of the commitment across an organization.

What is an Azure Policy initiative (also called a policy set)?

• a.A tool that encrypts resources that violate policy
• b.A group of related policy definitions managed and assigned together as a single unit✓
• c.A billing report that itemizes the monthly cost of every policy assignment you have made
• d.A single policy that can only ever contain one rule

An initiative bundles multiple policy definitions so you can assign and track them as one, with a unified compliance view. This simplifies enforcing a whole standard, such as a security baseline.

Which Azure Policy effect blocks a non-compliant resource from being created or updated?

• a.Append
• b.Deny✓
• c.Disabled
• d.Audit

The Deny effect stops a deployment that would violate the policy from ever succeeding. Audit only records non-compliance, while Append and Modify adjust the resource instead of blocking it.

Which Azure Policy effect records non-compliant resources without preventing their deployment?

• a.Audit✓
• b.Encrypt
• c.Delete
• d.Deny

The Audit effect logs a compliance warning but still allows the resource to be created. It is useful for measuring compliance before you enforce a stricter Deny.

What is the purpose of an Azure Policy exemption?

• a.To increase the compliance score artificially for all resources
• b.To exclude a specific resource or scope from evaluation of a policy or initiative✓
• c.To automatically and permanently delete any resource that is found to be non-compliant
• d.To grant a user administrative access to a subscription

An exemption formally excuses a resource or scope from a policy assignment, often for a documented business reason. It keeps compliance reporting honest by marking the exclusion rather than hiding it.

If you apply a CanNotDelete lock at the resource group level, what happens to the resources inside that group?

• a.The lock applies only to the resource group's name, not its contents
• b.They are immediately deleted to enforce the lock
• c.Only resources created after the lock are affected
• d.They inherit the lock and cannot be deleted until it is removed✓

Locks applied at a parent scope are inherited by child resources, so a CanNotDelete lock on a group protects every resource within it. The lock must be removed before those resources can be deleted.

A ReadOnly resource lock permits which operations on the locked resource?

• a.Deleting the resource, but without being able to read any of its properties
• b.All operations, with a warning message
• c.Reading the resource only; no create, update, or delete actions✓
• d.Reading and updating, but not deleting

A ReadOnly lock is the stricter of the two lock types, blocking any modification or deletion while still allowing the resource to be viewed. CanNotDelete is the less restrictive option that allows updates.

How do Azure Blueprints differ from a plain ARM template?

• a.Blueprints package templates together with policies and role assignments and keep a relationship to what was deployed✓
• b.Blueprints are used solely to estimate the projected monthly cost of a planned deployment before any resources are actually created
• c.Blueprints replace the need for subscriptions entirely
• d.Blueprints can only deploy a single virtual machine at a time

A blueprint orchestrates multiple artifacts (ARM templates, policy assignments, and RBAC) as a repeatable package and maintains a connection to the deployed environment. A standalone template only defines resources without that governance bundle.

What is Microsoft Purview primarily used for?

• a.Delivering content from edge locations
• b.Provisioning virtual machines at scale
• c.Hosting and serving relational databases for transactional applications across many regions worldwide
• d.Unified data governance: discovering, classifying, and managing data across an organization's estate✓

Microsoft Purview helps organizations map, classify, and govern data wherever it lives, on-premises and in the cloud. It supports compliance by making sensitive data discoverable and manageable.

What does the Microsoft Service Trust Portal provide?

• a.Live performance metrics for your own resources
• b.A tool whose sole purpose is to author and validate custom Azure Policy definitions written in JSON format
• c.Audit reports, compliance certifications, and security documentation about Microsoft's cloud services✓
• d.A place to deploy and manage your virtual machines

The Service Trust Portal is where you access Microsoft's independent audit reports (such as ISO and SOC) and compliance materials. Auditors and compliance teams use it to verify Microsoft's controls.

Azure Advisor groups its recommendations into which set of categories?

• a.Public, private, hybrid, and community
• b.Bronze, silver, gold, and platinum support tiers for each resource
• c.Compute, storage, networking, and databases
• d.Cost, security, reliability, operational excellence, and performance✓

Advisor aligns its guidance to five pillars: cost, security, reliability, operational excellence, and performance. This mirrors the well-architected approach to running healthy workloads.

Where can you review Microsoft's independent compliance certifications, such as ISO 27001 or SOC reports?

• a.A Network Security Group
• b.The Service Trust Portal (Microsoft's Trust Center)✓
• c.The Azure Pricing Calculator
• d.The Azure mobile app installed on phones and tablets

The Service Trust Portal and Trust Center publish Microsoft's certifications and audit documentation for customers and auditors. They demonstrate the compliance foundation Microsoft provides.

Microsoft Purview can automatically apply what to help protect sensitive information?

• a.Redundant availability zones inside a single region
• b.Network security group rules
• c.Virtual machine scale sets
• d.Data classifications and sensitivity labels✓

Purview scans data sources and can classify content and apply sensitivity labels, making it easier to govern and protect regulated data. Classification is the basis for downstream policies and reporting.

Every Microsoft Entra tenant in Azure has a single top-level management group known as what?

• a.The default resource group
• b.The root management group (Tenant Root Group)✓
• c.The global administrator account
• d.The organization's primary billing subscription

All management groups roll up to one built-in root management group at the top of the hierarchy. Policies or access assigned there can be inherited by every subscription in the tenant.

When does Azure Policy evaluate resources for compliance?

• a.Only when a user manually deletes a resource
• b.Only once, on the day the policy is written
• c.When a resource is created or updated, and again during periodic compliance scans✓
• d.Only once per month, at the moment the monthly invoice for the subscription is generated

Policy evaluates at resource creation/update and on a recurring schedule so existing resources are also assessed. This keeps the compliance picture current as your environment changes.

In cloud governance, what is the overarching goal?

• a.Making every resource publicly accessible
• b.Ensuring resources are used consistently, securely, and in line with organizational standards✓
• c.Guaranteeing that no resource is ever deleted
• d.Eliminating the need for any ongoing monitoring, logging, or auditing across the entire environment

Governance is about maintaining control, consistency, and compliance as an environment grows. Tools like Policy, RBAC, locks, and Blueprints implement that control at scale.

Do Azure resources automatically inherit tags from their parent resource group?

• a.Yes, but only the very first tag on the resource group is ever inherited by its resources
• b.Yes, every tag on a resource group is copied to its resources automatically
• c.No, and tags cannot be enforced in any way
• d.No; tags are not inherited by default, though Azure Policy can be used to enforce them✓

By default a resource does not pick up its resource group's tags automatically. To standardize tagging you can use Azure Policy effects such as Modify or Append to add required tags.

Azure Blueprints can lock the resources it deploys in order to do what?

• a.Reduce the cost of the deployed resources
• b.Automatically translate the resources to another language
• c.Prevent tampering or unauthorized changes to the governed resources✓
• d.Speeding up query performance on all of the databases within the group

Blueprint locking protects deployed resources so that even privileged users cannot alter or delete them, preserving the governed baseline. This enforces the intended configuration after deployment.

What is the purpose of a remediation task in Azure Policy?

• a.To delete the policy definition permanently
• b.To bring existing non-compliant resources into compliance with a policy✓
• c.To generate an invoice for policy usage
• d.To create an entirely new subscription and resource group within the tenant

Remediation tasks apply corrective effects (like Modify or DeployIfNotExists) to resources that already exist and are non-compliant. This fixes drift without recreating the resources.

The regulatory compliance dashboard in Microsoft Defender for Cloud maps your security posture against what?

• a.Industry and regulatory standards such as ISO 27001 or PCI DSS✓
• b.The current number of descriptive tags applied to each individual resource
• c.The current price of your subscription
• d.The physical distance between datacenters

Defender for Cloud can assess your environment against built-in regulatory standards and show where you fall short. This helps demonstrate and improve compliance against frameworks you must meet.

Even a user with the Owner role cannot delete a resource in which situation?

• a.When the resource is in a different region
• b.When a CanNotDelete lock is applied to the resource✓
• c.When the targeted resource has more than five tags applied to it
• d.When the subscription has a budget defined

Resource locks override RBAC permissions, so a CanNotDelete lock blocks deletion regardless of a user's role. The lock must be removed first, which itself requires appropriate permissions.

Which Azure Policy effect can automatically deploy a related resource when it is found to be missing?

• a.Deny
• b.Audit
• c.DeployIfNotExists✓
• d.Disabled

DeployIfNotExists triggers a deployment to add a required companion resource (for example, a diagnostic setting) when it is absent. It enforces standards by provisioning the missing piece rather than just blocking.

Azure provides many ready-made policy definitions so you do not have to write your own. These are called what?

• a.Deprecated policy definitions
• b.Built-in policy definitions✓
• c.Locked policy definitions
• d.Custom policy definitions

Built-in policies cover common governance needs, such as allowed locations or required tags, and can be assigned directly. Custom definitions are only needed when built-ins do not cover a specific requirement.

What does a tag applied to an Azure resource consist of?

• a.A name (key) paired with a value✓
• b.A single number assigned by Azure automatically
• c.A physical barcode on the server
• d.An encryption certificate

Each tag is a key-value pair, such as environment=production, that adds descriptive metadata. Consistent key-value tagging powers cost reporting, organization, and policy enforcement.

What is the primary benefit of organizing subscriptions into a management group hierarchy?

• a.It physically relocates the datacenters closer together
• b.Governance such as policy and access can be applied once and inherited by all subscriptions beneath it✓
• c.It automatically doubles the compute capacity
• d.It completely removes the need to use resource groups or subscriptions anywhere in the entire organization

Management groups let you assign Azure Policy and RBAC at a higher level so every subscription under them inherits the settings. This provides consistent governance across a large, multi-subscription organization.

At which scopes can an Azure Policy assignment be applied?

• a.Only on storage accounts created within the subscription
• b.Only at the level of an individual user account
• c.Management group, subscription, or resource group✓
• d.Only at the global Azure level for all customers

Policy can be assigned at a management group, subscription, or resource group, and it applies to everything within that scope. Broader scopes are inherited downward, enabling wide or targeted enforcement.

What is the Purview data map?

• a.A foundation that captures metadata about an organization's data assets across sources✓
• b.A network diagram of Azure regions
• c.A pricing sheet for storage services
• d.A prioritized list of recommended virtual machine sizes and pricing tiers for each workload

The data map is the underlying inventory in Purview that records metadata about scanned data assets. It enables discovery, lineage, and classification across the data estate.

Who primarily benefits from the documents available in the Service Trust Portal?

• a.End users trying to reset their passwords
• b.Customers estimating the price of a service
• c.Developers who are actively deploying and configuring a new virtual machine in the portal
• d.Auditors and compliance teams who need Microsoft's audit reports and certifications✓

The Service Trust Portal serves compliance, risk, and audit professionals verifying Microsoft's controls. It centralizes the evidence organizations need to satisfy their own regulators.

What does publishing a blueprint definition allow you to do?

• a.Assign a specific, versioned copy of the blueprint to a subscription✓
• b.Delete all existing subscriptions automatically
• c.To disable all Azure Policy enforcement across the entire organization's tenant
• d.Convert the blueprint into a virtual machine

Publishing creates a versioned blueprint that can then be assigned to subscriptions, deploying its artifacts consistently. Versioning lets you evolve the governance package over time in a controlled way.

Why would an organization group several policies into a single initiative?

• a.To automatically convert existing policy definitions into equivalent RBAC role assignments for users
• b.To simplify assignment and get one combined compliance view for a set of related policies✓
• c.To make each policy cost less to run
• d.To hide non-compliant resources from reporting

Grouping policies into an initiative means you assign and monitor them together, which is far easier for a broad standard than managing dozens of separate policies. Compliance is then reported at the initiative level.

Where can a custom Azure Policy definition be stored so it can be reused across scopes?

• a.Only inside a single virtual machine's disk
• b.Only inside a single public GitHub source-code repository shared with the community
• c.At a management group or subscription, so it can be assigned to child scopes✓
• d.Only within a Network Security Group

Custom policy definitions are saved at a management group or subscription scope, from which they can be assigned to that scope and everything beneath it. Storing at a management group maximizes reuse across many subscriptions.

Microsoft Entra ID was previously known by what name?

• a.Azure Resource Manager
• b.Azure Key Vault
• c.Windows Server Active Directory only
• d.Azure Active Directory (Azure AD)✓

Microsoft rebranded Azure Active Directory as Microsoft Entra ID. It remains Microsoft's cloud identity and access management service for signing in and securing access to resources.

In identity and access management, what does 'authentication' establish?

• a.How much a user's activity will cost
• b.What actions a user is permitted to perform
• c.Who a user is, by verifying their identity✓
• d.Which region a user's data is stored in

Authentication (AuthN) confirms identity, typically through credentials or factors like a password plus a phone prompt. It answers 'who are you?' before any access decision is made.

What does 'authorization' determine after a user has signed in?

• a.What resources and actions the authenticated user is allowed to access✓
• b.Whether the user's password is spelled correctly
• c.Which datacenter the user physically visited
• d.How fast the user's home internet network connection currently happens to be

Authorization (AuthZ) decides what an already-authenticated identity may do, such as read a file or manage a VM. In Azure, RBAC is the primary mechanism for authorization.

In an access request, which process happens first?

• a.Authentication happens first, then authorization✓
• b.Neither is required if the user is inside the corporate network
• c.They always happen at exactly the same instant with no order
• d.Authorization happens first, then authentication

You must first prove who you are (authentication) before the system can decide what you may do (authorization). Getting this order right is fundamental to secure access.

What does multifactor authentication (MFA) require from a user?

• a.Two or more verification factors of different types✓
• b.Only the user's email address
• c.A single password that is simply very long and complex
• d.Two passwords that are exactly the same

MFA combines factors from different categories, such as something you know plus something you have or are. Requiring multiple factors greatly reduces the risk from a stolen password.

Which of the following is an example of the 'something you have' authentication factor?

• a.A fingerprint scan or other biometric reading taken from the user
• b.A security question answer
• c.A code from a phone authenticator app or a hardware token✓
• d.A memorized password

'Something you have' refers to a possession like a phone, authenticator app, or hardware key. A password is 'something you know' and a fingerprint is 'something you are.'

What threat does multifactor authentication most directly protect against?

• a.Accidental overspending against a defined subscription cost budget
• b.High network latency between regions
• c.Physical damage to the datacenter
• d.Unauthorized access when a password has been compromised✓

Even if an attacker steals a password, MFA blocks them because they lack the second factor. This makes MFA one of the most effective single controls against account takeover.

What does Conditional Access in Microsoft Entra ID let an organization do?

• a.Estimate the cost of future deployments
• b.Provision virtual machines automatically
• c.Store and serve large amounts of unstructured object and blob data across many regions
• d.Enforce access controls based on signals such as user, location, device, and risk✓

Conditional Access evaluates signals at sign-in and then applies controls, like requiring MFA or a compliant device. It brings access decisions in line with real-world risk.

Which is a realistic example of a Conditional Access policy?

• a.Changing the portal theme based on the time of day
• b.Automatically deleting a user's files after each login
• c.Requiring MFA when a user signs in from an unfamiliar or untrusted location✓
• d.Automatically doubling the storage redundancy tier each time a user signs into the app

A typical Conditional Access rule strengthens verification for risky conditions, such as sign-ins from unexpected locations. This lets low-risk access stay frictionless while high-risk access is challenged.

How do Azure RBAC roles and Microsoft Entra ID roles differ in what they control?

• a.They are completely identical, fully interchangeable features that control exactly the same scope of access across Azure
• b.Azure RBAC roles control access to Azure resources, while Entra ID roles control identity and directory tasks✓
• c.Entra ID roles control network bandwidth while RBAC controls encryption
• d.RBAC controls billing while Entra roles control storage tiers

Azure RBAC governs actions on resources like VMs and storage, whereas Entra ID (directory) roles govern tasks like managing users and groups. Understanding the split prevents over- or under-granting access.

Which of the following is an example of passwordless authentication?

• a.Signing in with Windows Hello, a FIDO2 security key, or the Microsoft Authenticator app✓
• b.Emailing your current account password to yourself so you can retrieve it later for safekeeping
• c.Writing the password on a sticky note
• d.Typing a long password followed by a PIN

Passwordless methods verify identity without a typed password, using biometrics, a security key, or an app approval. They improve both security and user experience by removing the weakest link.

What is a core guiding principle of the Zero Trust security model?

• a.Grant every user administrator access by default
• b.Never trust, always verify each request explicitly✓
• c.Disable authentication for internal applications
• d.Trust any request that originates inside the corporate network

Zero Trust assumes no implicit trust based on network location and verifies every request. It combines explicit verification, least-privilege access, and an assume-breach mindset.

Which set of ideas represents the guiding principles of Zero Trust?

• a.Granting broad standing access, disabling MFA, and hiding all of the alerts
• b.Encrypt nothing, allow legacy protocols, and trust every device
• c.Trust the network, share all credentials, and skip logging
• d.Verify explicitly, use least-privilege access, and assume breach✓

Zero Trust rests on verifying every request, granting only the minimum access needed, and designing as though a breach has already happened. These principles reduce both the likelihood and impact of compromise.

What does a defense-in-depth security strategy rely on?

• a.Trusting all internal traffic without inspection
• b.Removing all authentication requirements in order to simplify user access
• c.A single strong firewall as the only protection
• d.Multiple layers of controls so no single failure exposes everything✓

Defense in depth stacks independent controls, so if one layer is bypassed, others still protect the asset. Each layer slows or stops an attacker, buying time to detect and respond.

Which of the following represents a layer in the defense-in-depth model?

• a.The identity and access layer✓
• b.The portal color-theme layer
• c.The invoice generation layer
• d.The resource naming and tagging layer

Defense in depth includes layers such as physical, identity/access, perimeter, network, compute, application, and data. Identity is a critical layer, often called the modern security perimeter.

What does the Secure Score in Microsoft Defender for Cloud help you do?

• a.Encrypt data automatically without configuration
• b.Calculate the exact monthly bill for compute
• c.Automatically choosing whichever Azure region has the lowest network latency
• d.Measure your current security posture and track improvements over time✓

Secure Score summarizes how well your environment follows security best practices and rises as you remediate recommendations. It gives teams a clear, trackable target for hardening.

Conditional Access is a capability of which Microsoft Entra ID licensing level?

• a.A tier that is exclusive to on-premises Active Directory
• b.The free tier available to everyone
• c.A premium tier (Entra ID P1 or P2)✓
• d.A tier included only with virtual machines

Conditional Access requires an Entra ID premium license rather than the free tier. Organizations that need risk-based access controls plan for the appropriate licensing.

What does Microsoft Entra B2B collaboration enable?

• a.Migrating virtual machines between regions
• b.Automatically encrypting all blob storage data while it is at rest in every region
• c.Automatically lowering your Azure bill
• d.Inviting external guest users to securely access your organization's resources✓

Entra B2B lets you invite partners and vendors as guest identities so they can access shared apps and resources without a separate account in your systems. You control what those guests can reach.

What is Microsoft Entra External ID (formerly Azure AD B2C) primarily used for?

• a.Managing identity and sign-in for customer-facing (consumer) applications✓
• b.Provisioning Azure virtual networks
• c.Managing internal employee payroll
• d.Storing and serving very large media, image, and video files for applications

External ID / B2C provides customizable sign-up and sign-in experiences for the customers of an app. It keeps consumer identities separate from an organization's internal workforce directory.

In Microsoft Entra ID, what does a 'tenant' represent?

• a.A single virtual machine running the directory
• b.A monthly billing invoice generated for identity and directory services
• c.A physical rack of servers in one datacenter
• d.A dedicated, isolated instance of the directory for an organization✓

A tenant is an organization's own isolated directory instance, containing its users, groups, and app registrations. Each tenant is logically separated from every other organization's directory.

What does Privileged Identity Management (PIM) in Microsoft Entra ID provide?

• a.Free virtual machines for administrators
• b.The automatic scheduled deletion of all inactive guest user accounts each month
• c.Just-in-time, time-bound privileged access that can require approval✓
• d.Permanent administrator rights for all users

PIM reduces standing privilege by granting elevated roles only when needed, for a limited time, often with approval and auditing. This shrinks the window in which powerful permissions can be misused.

What do Microsoft Entra ID security defaults primarily do?

• a.Move all of the organization's data into one single centralized region
• b.Enforce baseline protections, such as requiring MFA for users✓
• c.Disable all sign-in requirements for convenience
• d.Automatically buy reservations to save money

Security defaults turn on a set of preconfigured, sensible protections like MFA and blocking legacy authentication. They give organizations a strong baseline without building custom policies.

In cloud security, identity is frequently described as the new what?

• a.Billing boundary
• b.The archived cool storage tier layer
• c.Security perimeter✓
• d.Physical firewall

Because users and services connect from anywhere, controlling identity has become the primary boundary rather than the network edge. This shift underpins Zero Trust thinking.

What is an advantage of assigning an Azure role to a group rather than to individual users?

• a.It completely removes the need for any form of user authentication entirely
• b.It automatically encrypts all resources
• c.It makes each user's access completely invisible
• d.It simplifies access management and scales better as membership changes✓

Assigning roles to groups means you manage access by adding or removing members rather than editing many individual assignments. This reduces errors and administrative effort at scale.

The lifecycle of a system-assigned managed identity is tied to what?

• a.A password stored in the application code
• b.The Azure resource on which it is enabled✓
• c.The region's availability zones
• d.The billing account's payment method

A system-assigned managed identity is created with its resource and deleted when that resource is deleted. This tight lifecycle removes the burden of managing credentials separately.

Which signal can a Conditional Access policy evaluate when deciding whether to allow access?

• a.Sign-in risk, device state, location, or the application being accessed✓
• b.The individual user's personally preferred favorite color and portal theme
• c.The number of tags on a resource group
• d.The current price of a virtual machine

Conditional Access weighs signals like user and sign-in risk, device compliance, location, and the target app. Based on those, it can allow, block, or require additional controls such as MFA.

How do single sign-on (SSO) and multifactor authentication (MFA) complement each other?

• a.SSO encrypts data while MFA provisions servers
• b.They are exactly the same feature simply offered under two different marketing names with no real difference
• c.SSO reduces the number of logins for convenience, while MFA adds verification factors for security✓
• d.MFA removes the need to ever authenticate again

SSO improves usability by letting one authentication grant access to many apps, and MFA strengthens that single authentication with extra factors. Used together, they balance convenience and strong security.

What does cloud security posture management (CSPM) in Microsoft Defender for Cloud focus on?

• a.Provisioning and configuring brand-new virtual networks and their subnets automatically
• b.Translating documentation into other languages
• c.Reducing the price of storage accounts
• d.Finding misconfigurations and continuously improving your security posture✓

CSPM continuously assesses resources for weaknesses and misconfigurations and recommends fixes, feeding the Secure Score. It helps prevent breaches by closing gaps before they are exploited.

How does the Zero Trust model differ from the traditional 'castle-and-moat' network approach?

• a.It only applies to physical building security
• b.It trusts all internal and external traffic equally without checks
• c.It does not automatically trust a request just because it originates inside the network✓
• d.It completely removes the need for any user accounts or sign-in credentials across the organization

The old model trusted anything inside the perimeter; Zero Trust verifies every request regardless of origin. This reflects modern reality where users and threats can be anywhere.

How does just-in-time (JIT) VM access in Microsoft Defender for Cloud reduce risk?

• a.It automatically doubles the virtual machine's compute and memory capacity each time a session opens
• b.It permanently opens all ports for convenience
• c.It opens management ports only when needed, for a limited time, instead of leaving them always open✓
• d.It deletes the virtual machine after each session

JIT access keeps management ports closed until a user requests time-limited access, shrinking the attack surface. Leaving RDP or SSH always open is a common source of compromise that JIT mitigates.

Which of the following is a valid Microsoft Entra ID authentication method?

• a.A blob storage tier
• b.An availability zone
• c.A resource lock applied to a resource group
• d.The Microsoft Authenticator app✓

Entra ID supports methods like passwords, the Authenticator app, FIDO2 keys, and Windows Hello. Offering multiple methods enables MFA and passwordless sign-in.

A Conditional Access policy can be set to grant access only if which condition is met?

• a.The resource group has fewer than ten resources
• b.The device is compliant or marked as managed✓
• c.The subscription has a budget configured
• d.The user has been active for over a year

Grant controls in Conditional Access can require conditions such as a compliant device, MFA, or an approved client app. This ties access to the security state of the device and user.

What does self-service password reset (SSPR) in Microsoft Entra ID allow users to do?

• a.Reset their own passwords securely without contacting the help desk✓
• b.The ability to delete other users' accounts and reset their passwords
• c.Change the region of a subscription
• d.Grant themselves administrator roles

SSPR lets users recover access on their own after verifying identity, reducing help-desk load and downtime. It is typically paired with registered authentication methods for security.

What does identity federation allow?

• a.The purchase of reservations on the user's behalf
• b.The encryption of all network traffic by default
• c.A trust relationship so users authenticated by one identity provider can access another system✓
• d.The automatic scheduled deletion of unused and orphaned resources across the whole environment

Federation establishes trust between identity providers so a user can sign in once with their home provider and access federated apps. It underpins many single sign-on scenarios across organizations.

Encrypting data at rest is a control that operates at which defense-in-depth layer?

• a.The identity layer
• b.The perimeter layer
• c.The data layer✓
• d.The physical layer

Protecting stored data with encryption is a control at the innermost data layer. If outer layers are breached, encryption still helps keep the underlying data unreadable.

A distributed denial-of-service (DDoS) protection service operates primarily at which defense-in-depth layer?

• a.The data layer
• b.The application code layer
• c.The identity layer
• d.The perimeter layer✓

DDoS protection defends the network edge where traffic first enters, making it a perimeter-layer control. It absorbs or filters volumetric attacks before they reach internal resources.

Restricting communication between resources using Network Security Groups is a control at which defense-in-depth layer?

• a.The network layer✓
• b.The data layer
• c.The physical layer
• d.The application layer

NSGs filter traffic between subnets and resources, placing them at the network layer of defense in depth. Segmenting the network limits how far an attacker can move if they get in.

How does Microsoft Entra ID differ from traditional Windows Server Active Directory?

• a.It is a legacy service that is completely unable to authenticate any users or applications at all in the cloud
• b.It only manages printers and file shares
• c.It is a cloud identity service that uses modern web protocols rather than domains, OUs, and group policy✓
• d.It is simply Active Directory installed on a local server

Entra ID is a cloud-native identity provider built around protocols like OAuth, OpenID Connect, and SAML, not the on-premises constructs of Windows Server AD. The two can be integrated but are not the same product.

An external user invited to your directory through Entra B2B appears as which type of account?

• a.A service principal owner
• b.A guest user✓
• c.A billing account holder
• d.A global administrator

B2B invitations create guest identities in your tenant, which you can then authorize for specific resources. Guests remain distinct from your internal member users.

A common Conditional Access baseline recommendation is to do what?

• a.Require users to share passwords with the help desk
• b.Allow all sign-ins without any verification
• c.Disabling the logging of all user sign-in and directory audit events
• d.Block legacy authentication protocols that do not support MFA✓

Legacy authentication protocols cannot enforce MFA and are frequently abused in attacks, so blocking them is a standard hardening step. Conditional Access can enforce this across the organization.

What happens when you act on the recommendations behind your Secure Score in Defender for Cloud?

• a.Your subscription's billing currency is silently changed
• b.Your data is moved to a random region
• c.Your subscription is automatically deleted
• d.Your score rises and your overall risk is reduced✓

Each remediated recommendation improves your posture and increases the Secure Score. The score is a practical, trackable way to prioritize security work.

What is a break-glass (emergency access) account and why is it used?

• a.A temporary guest account for external vendors
• b.A standard, closely monitored read-only account that is used only for routine daily status reporting to management teams
• c.A shared account whose password is posted publicly
• d.A highly privileged account, safeguarded and usually excluded from normal Conditional Access, kept for emergencies✓

Break-glass accounts ensure administrators can still sign in if MFA or Conditional Access services fail or lock everyone out. They are tightly controlled, closely monitored, and used only in emergencies.

Risk-based Conditional Access and Privileged Identity Management require which Microsoft Entra ID license?

• a.The free tier
• b.A Windows Server license
• c.Entra ID P2✓
• d.No license at all

Advanced identity protection features like PIM and risk-based Conditional Access are part of the Entra ID P2 tier. Organizations needing these plan their licensing accordingly.

From where can Azure Monitor collect telemetry?

• a.From Azure resources, applications, and even on-premises or other-cloud sources✓
• b.Only from resources located in one region
• c.Only from a single virtual machine at a time
• d.Only from storage accounts that are located within a single Azure region at a time

Azure Monitor is a broad observability platform that ingests metrics and logs from Azure, apps, and hybrid or multi-cloud environments. This unified view helps detect and diagnose issues anywhere.

What are Azure Monitor metrics?

• a.Numeric values collected at regular intervals as time-series data✓
• b.Encryption keys used to secure resources
• c.Static images and other files that are stored in blob storage containers
• d.Free-form text notes written by administrators

Metrics are lightweight, time-stamped numeric measurements (like CPU percentage) sampled at intervals. Their time-series nature makes them ideal for near-real-time charts and threshold alerts.

What are Azure Monitor Logs (Log Analytics) best described as?

• a.A place to store virtual machine disks
• b.A billing report for network egress
• c.Records of varied data queried with the Kusto Query Language (KQL)✓
• d.A network firewall service that inspects and blocks inbound traffic

Logs hold richer, structured, and text data that you analyze using KQL in a Log Analytics workspace. They support deep investigation, correlation, and reporting across many sources.

What is Application Insights used for?

• a.Monitoring the performance, usage, and failures of applications (application performance management)✓
• b.Provisioning virtual networks
• c.Automatically encrypting all sensitive data while it is at rest across every storage service in the environment
• d.Managing user passwords

Application Insights is the APM feature of Azure Monitor, tracking request rates, response times, exceptions, and dependencies. Developers use it to find and fix performance and reliability problems.

Which of the following does Application Insights track for a web application?

• a.The physical temperature of the server room
• b.Request rates, response times, failure rates, and dependency calls✓
• c.The billing currency that is configured for the entire subscription
• d.The number of resource groups in a subscription

Application Insights instruments an app to capture telemetry such as request timing, failures, and external dependency behavior. This visibility helps pinpoint bottlenecks and errors in code.

What does Azure Service Health notify you about?

• a.The single most optimal virtual machine size and pricing tier recommended for your specific workload
• b.Azure service issues, planned maintenance, and health advisories that may affect your resources✓
• c.The number of tags applied to each resource
• d.The remaining balance on your credit card

Service Health provides a personalized view of Azure incidents, maintenance, and advisories relevant to the services and regions you use. It helps you understand whether a problem is on Azure's side.

What does Azure Resource Health report?

• a.The current health status of a specific resource instance✓
• b.The overall compliance state of every assigned policy definition
• c.The overall price of the subscription
• d.The list of users with access to a resource

Resource Health drills down to whether an individual resource is available and, if not, whether the cause is platform- or user-related. It complements the broader Service Health view.

How does the personalized Azure Service Health differ from the public Azure status page?

• a.Service Health only ever shows subscription billing and payment information to the customer
• b.The public status page updates only once per year
• c.The public status page is only visible to Microsoft employees
• d.Service Health is tailored to the specific resources and subscriptions you use✓

The public status page shows broad, global service status, while Service Health filters and personalizes information to your environment. That focus makes Service Health more actionable for your workloads.

An Azure Monitor metric alert fires under what condition?

• a.When any resource within the resource group is renamed by a user
• b.When a new user signs into the portal
• c.When a tag is added to a resource
• d.When a monitored metric crosses a threshold you have defined✓

Metric alerts continuously evaluate a metric against your threshold and trigger when the condition is met, such as CPU above 80 percent. They enable fast, automated response to performance problems.

What is a log (search) alert in Azure Monitor based on?

• a.The color of the portal dashboard
• b.The chosen display name of the parent resource group container
• c.The number of availability zones in a region
• d.The results of a log query run against collected log data✓

Log alerts run a KQL query on a schedule and fire when the results meet a condition, like a certain number of errors appearing. They catch patterns that simple metric thresholds cannot express.

What do Azure dashboards let you do?

• a.It can completely replace the need for any user authentication across services
• b.Automatically write application code
• c.Pin and visualize metrics and resources together in one customizable view✓
• d.Physically rewire the datacenter network

Dashboards provide a personalized canvas where you can pin charts, resource tiles, and query results for at-a-glance monitoring. Teams tailor them to the signals they care about most.

What do Azure Monitor Workbooks provide?

• a.A managed network firewall service for inbound and outbound traffic
• b.Interactive reports that combine data, text, and visualizations✓
• c.A storage tier for archived blobs
• d.A way to buy reserved instances

Workbooks let you build rich, interactive reports mixing queries, parameters, charts, and narrative text. They are ideal for shareable investigations and operational dashboards.

Which query language is used to analyze data in Azure Monitor Log Analytics?

• a.Kusto Query Language (KQL)✓
• b.Structured Query Language for relational tables only
• c.The Bicep domain-specific language
• d.HyperText Markup Language

KQL is the read-only query language for exploring logs and other data in Log Analytics. Its expressive filtering and aggregation make it central to Azure observability.

What do Azure Monitor 'insights' (such as VM insights or Container insights) provide?

• a.A convenient built-in way to bypass user authentication for administrators
• b.Automatic price reductions for those resources
• c.Physical relocation of the resources
• d.Curated, ready-made monitoring experiences for specific resource types✓

Insights are pre-built monitoring solutions tuned to particular services, offering relevant dashboards and health views out of the box. They save you from assembling common monitoring from scratch.

What does Metrics Explorer in Azure Monitor let you do?

• a.Chart and analyze metric data over time interactively✓
• b.The ability to assign RBAC roles directly to application users
• c.Create blob storage containers
• d.Deploy new virtual machines

Metrics Explorer is the tool for plotting and slicing metric time-series, applying filters and splitting by dimensions. It is the go-to place to investigate performance trends.

What can Application Insights availability tests do?

• a.Regularly send requests to your web app from multiple locations to check its uptime and responsiveness✓
• b.Reduce the app's licensing cost
• c.Automatically encrypting the application's entire source code repository while it is stored at rest in the cloud
• d.Assign roles to application users

Availability tests probe your endpoint from various global points and alert you if it becomes slow or unreachable. This provides early warning of outages before users report them.

What does the Azure Activity Log record?

• a.The current hourly list price of each individual Azure service being used across the region today
• b.The contents of files stored in blob storage
• c.Subscription-level control-plane events, such as who created, modified, or deleted a resource✓
• d.The keystrokes typed inside a virtual machine

The Activity Log captures management operations against resources, providing an audit trail of what changed, when, and by whom. It is distinct from resource-level diagnostic logs that capture data-plane activity.

What is an important reason to assign a severity level to an Azure Monitor alert?

• a.To change how much the alert costs to store
• b.To decide which region the alert runs in
• c.To indicate the importance and urgency of the alert so teams can prioritize✓
• d.To encrypt the alert's notification message contents before they are delivered

Alert severity (from critical down to informational) helps operations teams triage and respond to the most urgent issues first. Consistent severities make on-call response more effective.

What is the Azure portal?

• a.A physical device shipped to your datacenter
• b.A command-line tool installed on a local computer
• c.A fully managed relational database engine and query service for hosting applications at scale
• d.A web-based graphical interface, accessed in a browser, for managing Azure resources✓

The Azure portal is the browser-based console where you can create, configure, and monitor resources visually. It suits interactive management and learning, complementing scripting tools.

What is the Azure CLI?

• a.A graphical dashboard for viewing metrics
• b.A global content delivery network for caching static files at edge locations
• c.A managed relational database
• d.A cross-platform command-line tool that uses commands beginning with 'az'✓

The Azure CLI lets you manage Azure from a terminal on Windows, macOS, or Linux using 'az' commands. It is well suited to automation and scripting of repeatable tasks.

How does Azure PowerShell manage Azure resources?

• a.By editing the physical server BIOS
• b.Through cmdlets provided by the Az module✓
• c.By sending emails to Microsoft support
• d.Through a graphical drag-and-drop designer only

Azure PowerShell uses cmdlets in the Az module to script and automate resource management. It appeals to teams already comfortable with PowerShell on Windows and beyond.

What is Azure Cloud Shell?

• a.A physical terminal located in an Azure datacenter
• b.A browser-based shell, offering Bash or PowerShell, that is authenticated and ready inside the portal✓
• c.A tool that only runs on Windows desktops
• d.A fully managed relational database service that automatically stores and queries structured data for you

Cloud Shell gives you a preconfigured command-line environment in the browser with the Azure tools already installed and signed in. It removes the need to install and update tooling locally.

What is a key benefit of using Azure Cloud Shell?

• a.No local installation is needed because the tools are preinstalled and kept up to date✓
• b.It permanently stores files without any storage account
• c.It only works while you are completely offline and disconnected from the internet entirely
• d.It runs without any Azure authentication

Cloud Shell comes with the CLI, PowerShell, and common tools ready to use, so you avoid local setup and maintenance. You can manage Azure from virtually any device with a browser.

ARM templates are authored in which format?

• a.Declarative JSON files✓
• b.Compiled binary executables
• c.Spreadsheet workbooks
• d.Plain-text email messages

ARM templates use JSON to declaratively describe the resources to deploy and their configuration. Storing infrastructure as these files enables repeatable, version-controlled deployments.

What is Bicep?

• a.A managed network load balancer that distributes incoming traffic across many backend resources automatically
• b.A managed NoSQL database
• c.A monitoring agent installed on virtual machines
• d.A domain-specific language that simplifies authoring infrastructure as code, transpiling to ARM JSON✓

Bicep offers a cleaner, more readable syntax than raw ARM JSON and compiles down to the same ARM templates. It makes infrastructure-as-code easier to write and maintain on Azure.

What does 'infrastructure as code' (IaC) mean?

• a.Writing application business logic in a database
• b.Manually clicking through the portal for each deployment
• c.Defining infrastructure in declarative files so deployments are repeatable and consistent✓
• d.Storing plaintext passwords and secrets directly inside the application's source code files

IaC captures the desired infrastructure in code (such as ARM or Bicep) that can be versioned, reviewed, and redeployed reliably. This reduces configuration drift and manual error.

ARM and Bicep templates are 'declarative,' meaning you specify what?

• a.The marketing copy for the application
• b.Each individual command in the exact order to run
• c.The desired end state of the infrastructure, not the step-by-step commands to build it✓
• d.The exact physical wiring and network cabling installed inside the datacenter facility racks

Declarative templates describe the target configuration, and Azure figures out how to reach it. This differs from imperative scripting, where you list each action explicitly.

What is true about both the Azure CLI and Azure PowerShell?

• a.They can perform the same management tasks, so the choice is largely preference and platform✓
• b.They can only be used inside the portal
• c.Neither can be used in automation scripts
• d.Only one of the two tools is actually able to create and manage resources across Azure services

Both tools expose the full breadth of Azure management, so teams pick based on familiarity and existing scripts. Each can be scripted for automation across platforms.

What does the Azure mobile app let you do?

• a.Running large-scale data-warehouse analytical queries across regions
• b.Replace the need for Azure Resource Manager
• c.Monitor and manage your Azure resources from a phone or tablet✓
• d.Physically install hardware in the datacenter

The Azure mobile app provides on-the-go access to check resource health, view alerts, and perform basic management. It is handy for responding to issues away from a desk.

What can you customize in the Azure portal to speed up your work?

• a.The global pricing of Azure services
• b.The underlying hardware of virtual machines
• c.Dashboards and a list of favorite services✓
• d.The physical location of Azure datacenters

You can build custom dashboards and mark frequently used services as favorites for quick navigation. Personalizing the portal makes routine management faster.

What does Azure Cloud Shell require in order to persist your files between sessions?

• a.An associated Azure Files share (backed by a storage account)✓
• b.A dedicated physical hard drive at your desk
• c.A public IP address assigned to your laptop
• d.A separate, paid Azure support plan and premium subscription add-on

Cloud Shell mounts an Azure Files share so your scripts and files survive across sessions. Without it, the environment would be ephemeral each time you connect.

You want to run the command 'az group create'. Which tool are you using?

• a.The Azure CLI✓
• b.Azure PowerShell
• c.Azure Monitor
• d.The Azure portal

Commands that start with 'az' belong to the Azure CLI. Azure PowerShell instead uses verb-noun cmdlets such as New-AzResourceGroup.

Redeploying the same ARM or Bicep template is described as idempotent. What does that mean?

• a.It produces the same end result without creating duplicate resources✓
• b.It can only ever be run a single time before it must be fully recreated
• c.It doubles the resources with each deployment
• d.It deletes everything and starts over each time

Idempotent deployments converge to the declared state, so running the template again does not create duplicates or unexpected changes. This makes redeployment safe and predictable.

Besides the portal, CLI, and PowerShell, how else can Azure be managed programmatically?

• a.Only by editing the datacenter hardware directly
• b.There is no other way to manage Azure
• c.Through REST APIs and language-specific SDKs✓
• d.Only by mailing a request form to Microsoft

Developers can call Azure's REST APIs directly or use SDKs for languages like Python, .NET, and Java. All of these ultimately route through Azure Resource Manager.

What is a benefit of using ARM or Bicep templates instead of clicking through the portal for deployments?

• a.Consistent, repeatable, and version-controlled deployments✓
• b.A firm guarantee that the resources will always cost nothing
• c.The inability to review changes before applying them
• d.Slower deployments that require more manual steps

Templates let you standardize environments, track changes in source control, and redeploy reliably. This is far more consistent than manual portal configuration for anything beyond a one-off.

When you use the portal, CLI, or PowerShell to make a change, the request ultimately goes through what?

• a.A single virtual machine you own
• b.Azure Resource Manager✓
• c.The Azure Pricing Calculator
• d.A Network Security Group

All management tools funnel their requests through Azure Resource Manager, which enforces authentication, authorization, and consistent handling. This is why behavior is uniform regardless of the tool you choose.

What does Azure Arc allow you to do?

• a.Physically ship Azure servers to your office
• b.Extend Azure management and governance to on-premises and other clouds' resources✓
• c.A firm guarantee that every workload you deploy will always run completely for free
• d.Replace the need for identity management

Azure Arc projects Azure's management plane onto servers, Kubernetes clusters, and services running outside Azure. This lets you apply policy, tagging, and monitoring consistently across hybrid and multi-cloud estates.

An Azure service-level agreement of 99.9% uptime permits roughly how much downtime per month?

• a.About 43 minutes✓
• b.About 3 days
• c.About 4 hours
• d.Zero minutes, since 99.9% means no downtime

A 99.9% monthly SLA allows roughly 43 minutes of downtime, while 99.99% allows only about 4 minutes. Understanding these figures helps set realistic availability expectations.

When you combine several Azure services in a single application, what typically happens to the overall (composite) SLA?

• a.It increases with each additional service
• b.It always stays fixed at exactly 100% no matter how many services are added
• c.It generally decreases as more services are chained together✓
• d.It becomes irrelevant once services are combined

Because each dependent service can independently fail, chaining them multiplies their individual SLAs, lowering the composite figure. Architects add redundancy to offset this effect.

If Azure fails to meet a service's SLA, what may a customer be entitled to receive?

• a.A full refund of all past invoices automatically
• b.Service credits applied to their bill✓
• c.Guaranteed prevention of all future outages
• d.Free physical servers

SLAs are financially backed by service credits, which compensate customers when uptime commitments are missed. Credits typically must be requested and scale with the shortfall.

What is generally true about Azure services that are still in preview?

• a.They always carry a stronger SLA than released services
• b.They are typically not covered by a service-level agreement✓
• c.They are only available to Microsoft employees
• d.They are firmly guaranteed to never change at all before their release

Preview features are provided for evaluation and usually lack SLA guarantees and full support. They may change or be removed before reaching general availability.

What does 'general availability' (GA) mean for an Azure service?

• a.It is a signal that the service will very soon be deprecated and retired from Azure entirely
• b.The service is available only to a small invited group
• c.The service is fully released, supported for production use, and backed by an SLA✓
• d.The service is free of charge forever

GA marks a service as production-ready with full support and SLA coverage. Organizations generally wait for GA before running critical workloads on a feature.

What characterizes an Azure feature that is in private preview?

• a.It carries the very highest availability SLA of any released Azure service
• b.It is available to a limited, invited set of customers for early testing✓
• c.It is open to every Azure customer without restriction
• d.It is fully supported for production workloads

Private preview limits access to selected customers who provide feedback before wider release. Such features are experimental and not intended for production.

What characterizes an Azure feature that is in public preview?

• a.It can never be changed or updated in any way before it finally reaches its release date
• b.It is open for any customer to try but is not recommended for production workloads✓
• c.It carries the same SLA as a GA service
• d.It is restricted to a handful of invited testers

Public preview lets all customers evaluate a feature, but without full SLA or support, so it is unsuitable for production. Feedback during this stage shapes the final release.

To increase the effective availability of a virtual machine workload, what can you do?

• a.Deleting all of the workload's backups in order to save on storage costs
• b.Remove all monitoring to lower overhead
• c.Deploy it across availability zones or run multiple instances✓
• d.Reduce it to a single instance in one datacenter

Spreading instances across availability zones or using multiple VMs raises the composite availability above a single instance's SLA. Redundancy is the primary way to exceed a single component's guarantee.

An Azure SLA provides a financially backed uptime commitment, but what does it NOT guarantee?

• a.That outages will never occur✓
• b.That credits are available if targets are missed
• c.That the commitment is measured over time
• d.That a defined uptime percentage is targeted

An SLA promises a target and compensation if it is missed, not that failures will never happen. Designing for resilience remains the customer's responsibility.

Achieving a higher overall availability than a single Azure service's SLA usually requires what?

• a.Applying more tags to the resource
• b.Turning off all diagnostic and activity logging on the resource
• c.Using a smaller virtual machine size
• d.Building redundancy across availability zones or regions✓

You raise availability by removing single points of failure through redundancy across zones or regions. This architectural effort, not configuration tweaks, drives higher composite SLAs.

How does Microsoft typically communicate that an Azure service or feature will be retired?

• a.By deleting it without any warning
• b.By changing the portal's color scheme
• c.Through advance notifications and published announcements✓
• d.Only quietly through the customer's regular monthly invoice

Microsoft provides advance notice of deprecations and retirements so customers can plan migrations. Staying aware of these announcements is part of managing the service lifecycle.

What should you expect from features that are in preview?

• a.They may change or be removed before reaching general availability✓
• b.They are permanently locked and can never be altered or updated again
• c.They are supported for mission-critical production use
• d.They always have a higher SLA than GA features

Preview features are still evolving, so their behavior, APIs, or availability can change before GA. This is why they are not recommended for production workloads.

What does a higher SLA percentage, such as 99.99% compared with 99.9%, indicate?

• a.More allowed downtime and lower availability
• b.That the service is still in private preview
• c.Less allowed downtime and therefore higher availability✓
• d.An automatically lower monthly subscription cost overall

Each additional nine reduces the permitted downtime substantially, so 99.99% is stricter than 99.9%. Higher targets usually demand more redundant, and costlier, designs.

Designing an architecture to achieve very high availability usually comes with what trade-off?

• a.Guaranteed lower cost than a single instance
• b.A reduction in the number of nines in the SLA
• c.Higher cost and greater complexity✓
• d.Complete elimination of all monitoring needs

Redundancy across zones or regions increases resource count and design complexity, which raises cost. Teams balance the value of extra availability against this added expense.

A single-instance Azure virtual machine using premium SSD disks is offered with an SLA of approximately what?

• a.About 99.9% availability✓
• b.About 50% availability
• c.Exactly 100% availability with no downtime
• d.No SLA at all under any configuration

A single VM with premium storage carries roughly a 99.9% SLA, whereas spreading VMs across availability zones raises the guarantee. The storage type and deployment topology both influence the committed figure.

You need daily Azure cost data delivered automatically to a storage account for external analysis. What should you configure?

• a.A ReadOnly role assignment placed on the subscription's monthly invoice records
• b.A scheduled export in Microsoft Cost Management✓
• c.A resource lock that freezes all further charges on the billing account permanently
• d.A Network Security Group rule that forwards the billing data outward to storage

Cost Management supports scheduled exports that push cost and usage data to a storage account on a recurring basis. This enables downstream reporting and integration with external analytics tools.

Which Microsoft Entra ID feature governs the ways users can prove their identity, such as the Authenticator app or a FIDO2 key?

• a.Authentication methods✓
• b.A network firewall that inspects all sign-in traffic before it reaches the directory
• c.A collection of resource locks that stop users from changing their own passwords
• d.A billing feature that charges the tenant a small fee per successful sign-in event

Authentication methods define how users verify identity, including passwords, the Authenticator app, FIDO2 keys, and Windows Hello. Administrators enable and manage these methods to support MFA and passwordless sign-in.

You want an alert to automatically trigger a webhook or Logic App when it fires. What must the alert reference?

• a.A Log Analytics workspace that permanently stores the notification templates used
• b.A resource lock configured to prevent the alert from ever being modified again
• c.A budget threshold defined in Microsoft Cost Management for the whole subscription
• d.An action group✓

An action group is the reusable set of notifications and automated actions (email, SMS, webhook, Logic App, function) that an alert invokes when it fires. Referencing one lets alerts drive automated responses.

Your organization must ensure new storage accounts are always created with a required 'CostCenter' tag. Which tool enforces this at creation time?

• a.An Azure Advisor recommendation that periodically suggests adding the missing tag
• b.Azure Policy✓
• c.A CanNotDelete resource lock applied automatically to each new storage account created
• d.A custom RBAC role that grants tagging permissions to every user across the tenant

Azure Policy can require a specific tag at deployment, denying non-compliant creations or appending the tag automatically. RBAC controls who can act, and Advisor only recommends, so neither enforces configuration standards.