CSLB General Building (B) — All Questions

Which cloud service model gives you the most control over the operating system, networking, and installed software, while the provider manages only the physical hardware?

• a.Infrastructure as a Service (IaaS)✓
• b.Platform as a Service (PaaS)
• c.Software as a Service (SaaS)
• d.Function as a Service (FaaS)

IaaS provides virtualized compute, storage, and networking, leaving the customer responsible for the operating system and everything above it. The provider only manages the underlying physical infrastructure. This gives the greatest flexibility but also the most administrative overhead.

In which cloud service model does the provider deliver a complete, ready-to-use application over the internet, such as a hosted email or CRM product?

• a.Infrastructure as a Service (IaaS)
• b.Software as a Service (SaaS)✓
• c.Platform as a Service (PaaS)
• d.Desktop as a Service (DaaS)

SaaS delivers finished software that users simply consume, usually through a web browser. The provider manages everything from the hardware up to the application itself. Customers only configure settings and manage their own data and users.

A development team wants to deploy code without managing the underlying servers, operating system patches, or runtime. Which model best fits this need?

• a.Infrastructure as a Service (IaaS)
• b.Software as a Service (SaaS)
• c.Platform as a Service (PaaS)✓
• d.Colocation hosting

PaaS provides a managed platform including the operating system, runtime, and middleware, so developers focus only on their application code and data. The provider handles patching and infrastructure maintenance. This accelerates development while reducing operational burden.

What is the primary financial benefit of the cloud's consumption-based (pay-as-you-go) pricing model?

• a.You receive a fixed monthly bill regardless of usage
• b.Hardware must be purchased upfront for the year
• c.Costs are hidden until an annual audit
• d.You pay only for the resources you actually use, converting capital expense into operating expense✓

Consumption-based pricing charges you only for the compute, storage, and services you consume. This shifts spending from large upfront capital expenditure (CapEx) to flexible operating expenditure (OpEx). It lets organizations avoid over-provisioning and align cost with demand.

Which cloud benefit describes the ability to quickly add or remove resources to match changing demand?

• a.Scalability and elasticity✓
• b.High latency
• c.Vendor lock-in
• d.Manual provisioning

Scalability lets you increase capacity as workloads grow, while elasticity automatically adds or removes resources in response to demand. Together they ensure applications perform well during spikes and save money during quiet periods. This responsiveness is a core advantage of cloud computing.

What does the term 'high availability' primarily refer to in cloud computing?

• a.Storing data in a single location
• b.Keeping applications running and accessible with minimal downtime✓
• c.Reducing the number of servers to save money
• d.Encrypting data at rest

High availability means designing systems so they remain operational even when individual components fail. Cloud platforms achieve this through redundancy, load balancing, and distribution across fault domains. The goal is to minimize service interruptions and meet uptime commitments.

In the shared responsibility model, which task is ALWAYS the customer's responsibility regardless of the service model used?

• a.Maintaining the physical datacenter security
• b.Replacing failed physical hard drives
• c.Managing the data, accounts, and access identities✓
• d.Securing the physical network cabling

The customer always retains responsibility for their own data, user accounts, and identity/access management no matter which service model is chosen. The provider is always responsible for the physical datacenter and hardware. Responsibilities in between shift depending on IaaS, PaaS, or SaaS.

Under the shared responsibility model for IaaS, who is responsible for patching the guest operating system on a virtual machine?

• a.The cloud provider
• b.The hardware vendor
• c.No patching is required in the cloud
• d.The customer✓

With IaaS, the customer manages the virtual machine's operating system, including applying security patches and updates. The provider only maintains the physical host and hypervisor. This division is central to understanding cloud security obligations.

Which type of cloud deployment combines on-premises infrastructure with public cloud resources, allowing data and applications to move between them?

• a.Hybrid cloud✓
• b.Public cloud only
• c.Private cloud only
• d.Community cloud

A hybrid cloud connects private, on-premises environments with public cloud services so workloads can span both. This lets organizations keep sensitive systems local while bursting to the public cloud for scale. It is popular for gradual migration and regulatory needs.

What is a defining characteristic of a public cloud deployment?

• a.Hardware is dedicated exclusively to one organization on-premises
• b.Resources are owned and operated by a third-party provider and shared among multiple organizations✓
• c.It cannot connect to the internet
• d.It requires the customer to own the datacenter

In a public cloud, a third-party provider owns the infrastructure and offers services to many customers over the internet. Resources are multi-tenant and delivered on demand. This model offers low upfront cost and virtually unlimited scale.

Which deployment model dedicates cloud infrastructure to a single organization, often for stricter control or compliance?

• a.Public cloud
• b.Hybrid cloud
• c.Private cloud✓
• d.Multi-tenant SaaS

A private cloud provides computing resources used exclusively by one organization, whether hosted on-premises or by a provider. It offers greater control and isolation, which helps meet strict security or regulatory requirements. The trade-off is typically higher cost and management effort.

What is meant by 'agility' as a benefit of cloud computing?

• a.The requirement to sign multi-year hardware contracts
• b.The elimination of all security concerns
• c.The guarantee of zero cost
• d.The ability to rapidly develop, test, and deploy applications✓

Agility refers to how quickly you can provision resources and bring solutions to market in the cloud. Instead of waiting weeks to procure hardware, teams spin up environments in minutes. This speed accelerates innovation and experimentation.

Which concept describes distributing resources across multiple physical datacenters so a single failure does not take down a service?

• a.Fault tolerance and redundancy✓
• b.Consumption-based billing
• c.Vertical scaling
• d.Data sovereignty

Fault tolerance uses redundant components and locations so the failure of one does not disrupt the overall service. Cloud providers replicate resources across isolated fault domains. This design keeps applications available during hardware or facility failures.

What distinguishes 'vertical scaling' from 'horizontal scaling'?

• a.Vertical scaling adds more instances, while horizontal scaling adds CPU/RAM
• b.Vertical scaling adds power (CPU/RAM) to an existing resource, while horizontal scaling adds more instances✓
• c.They are identical terms
• d.Vertical scaling only applies to storage

Vertical scaling (scaling up) increases the capacity of a single machine by adding CPU, memory, or disk. Horizontal scaling (scaling out) adds more machines or instances to share the load. Cloud platforms support both, but scaling out is often more resilient.

Which of the following is an example of an operating expense (OpEx) enabled by the cloud?

• a.A one-time purchase of physical servers
• b.Buying a datacenter building
• c.A monthly bill for the compute hours consumed✓
• d.Purchasing networking hardware upfront

OpEx refers to ongoing, usage-based spending such as a monthly cloud bill for consumed services. This contrasts with CapEx, which is a large upfront purchase of assets. The cloud's pay-as-you-go model favors OpEx, improving cash flow and flexibility.

What does 'disaster recovery' in the cloud primarily help an organization achieve?

• a.Reducing the monthly subscription cost
• b.Increasing application latency
• c.Eliminating the need for backups
• d.Restoring systems and data quickly after a major outage or failure✓

Disaster recovery is the practice of restoring IT systems and data after a significant disruptive event. Cloud services make this easier and more affordable by replicating data to other regions. This minimizes downtime and data loss during major incidents.

Which cloud characteristic allows many customers to share the same physical infrastructure while remaining logically isolated?

• a.Multi-tenancy✓
• b.Single-tenancy
• c.Colocation
• d.On-premises hosting

Multi-tenancy means multiple customers (tenants) share the same underlying physical resources while their data and workloads stay logically separated. This efficient use of hardware lowers costs for everyone. Providers enforce strong isolation to keep tenants secure from one another.

A company wants to avoid the cost and effort of maintaining physical servers. Which cloud advantage most directly addresses this?

• a.Increased hardware ownership
• b.Reduced infrastructure management responsibility✓
• c.Longer procurement times
• d.Higher capital expenditure

By moving to the cloud, organizations offload the purchase, maintenance, and refresh of physical hardware to the provider. This reduces the management burden and staffing needed for datacenters. Teams can then focus on applications and business value instead of infrastructure.

What is the main purpose of a service-level agreement (SLA) offered by a cloud provider?

• a.It lists the provider's employees
• b.It sets the price of physical hardware
• c.It formally defines the expected performance and uptime guarantees for a service✓
• d.It encrypts customer data automatically

An SLA is a formal commitment that specifies metrics such as guaranteed uptime and availability for a service. If the provider fails to meet these targets, customers may receive service credits. SLAs help organizations plan for reliability and set expectations.

Which of the following best describes 'elasticity' in cloud computing?

• a.Resources remain fixed regardless of load
• b.Storage is limited to a single disk
• c.Applications must be manually restarted daily
• d.Resources automatically expand or contract to match real-time demand✓

Elasticity is the automatic scaling of resources up or down in response to workload changes. During a traffic spike, more capacity is added; when demand falls, capacity is released. This keeps performance steady while avoiding payment for idle resources.

In the shared responsibility model for SaaS, which responsibility shifts almost entirely to the provider?

• a.Managing the application, runtime, and operating system✓
• b.Managing user access and data classification
• c.Choosing which users get accounts
• d.Setting data-sharing permissions

In SaaS, the provider manages nearly the entire stack including the application, runtime, and operating system. The customer's remaining duties center on their data, users, and access configuration. This makes SaaS the lowest-maintenance model for consumers.

Why is 'geographic distribution' of datacenters valuable to cloud customers?

• a.It forces all data into one country
• b.It lets applications serve users from nearby locations, reducing latency and improving resilience✓
• c.It increases the physical distance data must travel
• d.It removes the need for redundancy

Providers operate datacenters around the world so applications can run close to their users. This lowers latency and improves the user experience. Geographic spread also supports disaster recovery and compliance with data-residency requirements.

Which statement about capital expenditure (CapEx) is correct?

• a.It is a recurring monthly usage charge
• b.It only applies to cloud subscriptions
• c.It is a large upfront investment in physical assets like servers and datacenters✓
• d.It eliminates the need to own hardware

CapEx is spending on tangible assets, such as buying servers or building a datacenter, that are used over many years. Traditional on-premises IT relies heavily on CapEx. Cloud computing reduces CapEx by shifting toward pay-as-you-go OpEx.

What is a key reason organizations adopt cloud computing for 'reliability'?

• a.It guarantees the code has no bugs
• b.It removes the need for testing
• c.It makes applications run offline permanently
• d.Built-in redundancy and backups keep services running and recoverable during failures✓

Reliability in the cloud comes from redundant infrastructure, automated backups, and the ability to recover quickly from failures. Providers design their platforms to keep services available and data protected. This lets organizations meet uptime and continuity goals more easily.

A workload experiences predictable spikes every weekday morning. Which cloud capability lets it automatically add capacity during those spikes and remove it afterward?

• a.Autoscaling✓
• b.Manual server purchasing
• c.Static provisioning
• d.Data archiving

Autoscaling monitors demand and adjusts the number of running resources automatically. During predictable morning spikes it adds instances, then removes them when traffic subsides. This maintains performance while controlling cost, a hallmark of elastic cloud design.

Which of the following is generally NOT considered a benefit of moving to the public cloud?

• a.Scalability on demand
• b.Full ownership and physical control of the underlying hardware✓
• c.Reduced upfront capital costs
• d.Global reach and availability

Public cloud customers do not own or physically control the hardware; that stays with the provider. The recognized benefits include on-demand scalability, lower upfront costs, and global reach. Trading physical control for these advantages is the essence of the public cloud model.

In Azure, what is the primary purpose of a resource group?

• a.It is a physical server rack
• b.It is a billing currency
• c.It is a logical container that holds related Azure resources for management as a unit✓
• d.It is a network firewall device

A resource group is a logical container used to organize and manage related Azure resources together. Resources in a group typically share the same lifecycle, such as being deployed, updated, and deleted together. It also serves as a scope for applying permissions and policies.

What does an Azure region represent?

• a.A single physical server
• b.A billing account
• c.A type of virtual machine
• d.A set of datacenters deployed within a defined geographic area, connected by a low-latency network✓

An Azure region is a geographic area containing one or more datacenters networked together with low latency. Customers choose regions to place resources close to users and to meet data-residency needs. Region selection affects performance, cost, and available services.

What are Availability Zones within an Azure region designed to protect against?

• a.Datacenter-level failures, by providing physically separate locations with independent power and networking✓
• b.Software bugs in your application
• c.Incorrect billing charges
• d.Expired user passwords

Availability Zones are physically separate datacenters within a region, each with independent power, cooling, and networking. Distributing resources across zones protects applications from the failure of a single datacenter. This improves high availability within a single region.

Which Azure service provides on-demand, scalable virtual machines that you fully control at the operating system level?

• a.Azure App Service
• b.Azure Virtual Machines✓
• c.Azure Functions
• d.Azure Blob Storage

Azure Virtual Machines is an IaaS offering that lets you run and control full virtual servers in the cloud. You choose the OS, size, and installed software, and you manage patching and configuration. It suits workloads needing maximum control or custom environments.

Which Azure service is a fully managed platform for hosting web applications and APIs without managing the underlying servers?

• a.Azure Virtual Machines
• b.Azure Blob Storage
• c.Azure App Service✓
• d.Azure Virtual Network

Azure App Service is a PaaS offering for building and hosting web apps, REST APIs, and mobile backends. It manages the infrastructure, patching, and scaling so developers focus on code. It supports multiple languages and integrates with CI/CD pipelines.

Which Azure service lets you run small pieces of code (functions) without provisioning or managing servers, billed only while the code runs?

• a.Azure Virtual Machines
• b.Azure Kubernetes Service
• c.Azure SQL Database
• d.Azure Functions✓

Azure Functions is a serverless compute service that runs event-triggered code without managing infrastructure. You are billed based on executions and resource consumption while the function runs. It is ideal for lightweight, event-driven, or intermittent workloads.

Which Azure storage service is optimized for storing massive amounts of unstructured data such as images, videos, and backups?

• a.Azure Blob Storage✓
• b.Azure SQL Database
• c.Azure Virtual Network
• d.Azure Files

Azure Blob Storage is designed for large volumes of unstructured object data like media files, documents, and backups. It offers tiers (hot, cool, archive) to balance cost and access frequency. It is accessible over HTTP/HTTPS from anywhere.

Which Azure service provides fully managed file shares accessible over the SMB and NFS protocols?

• a.Azure Blob Storage
• b.Azure Files✓
• c.Azure Queue Storage
• d.Azure Table Storage

Azure Files offers managed cloud file shares that can be mounted by cloud or on-premises machines using SMB or NFS. It is useful for lift-and-shift scenarios and shared application data. Multiple systems can access the same files concurrently.

What is the primary function of an Azure Virtual Network (VNet)?

• a.It stores unstructured blobs
• b.It hosts serverless functions
• c.It provides an isolated, private network in Azure for resources to securely communicate✓
• d.It manages user identities

An Azure Virtual Network (VNet) is the fundamental building block for private networking in Azure. It lets resources such as VMs communicate securely with each other, the internet, and on-premises networks. VNets support subnets, routing, and network security controls.

Which service is Microsoft's cloud-based identity and access management solution used to sign in and access resources?

• a.Azure Blob Storage
• b.Azure Virtual Machines
• c.Azure Monitor
• d.Microsoft Entra ID✓

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity and access management service. It authenticates users and controls access to applications and Azure resources. It supports single sign-on, multifactor authentication, and conditional access.

Which Azure networking service acts as a load balancer that distributes incoming traffic across multiple backend resources?

• a.Azure Load Balancer✓
• b.Azure Blob Storage
• c.Azure Functions
• d.Microsoft Entra ID

Azure Load Balancer distributes inbound network traffic across a pool of backend resources such as virtual machines. This improves availability and scalability by preventing any single resource from being overwhelmed. It operates at the transport layer (Layer 4).

Which service securely connects an on-premises network to Azure over an encrypted tunnel across the public internet?

• a.Azure Blob Storage
• b.Azure VPN Gateway✓
• c.Azure Functions
• d.Azure Policy

Azure VPN Gateway establishes encrypted site-to-site or point-to-site connections between on-premises networks and Azure VNets over the internet. It secures traffic using IPsec/IKE tunnels. It is a common choice for hybrid connectivity when a private circuit is not required.

Which Azure service provides a dedicated, private connection from your on-premises network to Azure that does not traverse the public internet?

• a.Azure VPN Gateway
• b.Azure Blob Storage
• c.Azure ExpressRoute✓
• d.Azure DNS

Azure ExpressRoute creates a private, dedicated connection between on-premises infrastructure and Azure through a connectivity provider. Because traffic bypasses the public internet, it offers more reliability, consistent latency, and higher security. It suits large-scale or mission-critical hybrid workloads.

Which Azure service is a fully managed relational database based on the SQL Server engine?

• a.Azure Blob Storage
• b.Azure Cosmos DB
• c.Azure Files
• d.Azure SQL Database✓

Azure SQL Database is a fully managed PaaS relational database built on the SQL Server engine. Microsoft handles patching, backups, and high availability, reducing administrative work. It is ideal for applications needing a managed relational data store.

Which Azure service is a globally distributed, multi-model NoSQL database designed for low-latency access at planetary scale?

• a.Azure Cosmos DB✓
• b.Azure SQL Database
• c.Azure Blob Storage
• d.Azure Files

Azure Cosmos DB is a globally distributed NoSQL database offering low latency and elastic scalability. It supports multiple data models and APIs and can replicate data across regions. It is suited to globally responsive applications needing guaranteed performance.

What is the purpose of a subnet within an Azure Virtual Network?

• a.It stores backup files
• b.It segments the VNet's IP address space to organize and isolate groups of resources✓
• c.It manages user passwords
• d.It provides serverless compute

A subnet divides a VNet's address range into smaller segments, letting you group and isolate resources. Segmentation improves security and organization, for example separating web and database tiers. Network security rules can be applied at the subnet level.

Which Azure service provides a container orchestration platform for deploying and managing containerized applications at scale?

• a.Azure Blob Storage
• b.Azure SQL Database
• c.Azure Kubernetes Service (AKS)✓
• d.Azure DNS

Azure Kubernetes Service (AKS) is a managed Kubernetes offering for orchestrating containerized workloads. It automates cluster management tasks such as scaling and upgrades. It is used to run microservices and portable containerized applications efficiently.

Which Azure service lets you run individual containers quickly without managing virtual machines or orchestrators?

• a.Azure Kubernetes Service
• b.Azure Virtual Machines
• c.Azure Blob Storage
• d.Azure Container Instances (ACI)✓

Azure Container Instances (ACI) runs containers on demand without provisioning or managing underlying servers or orchestration. It is ideal for simple, short-lived, or burst workloads. You pay per second for the compute resources the container consumes.

What does a Network Security Group (NSG) do in Azure?

• a.It filters inbound and outbound network traffic to resources using allow/deny rules✓
• b.It stores relational data
• c.It manages billing alerts
• d.It hosts web applications

A Network Security Group contains security rules that allow or deny network traffic to and from Azure resources such as VMs and subnets. Rules are based on source, destination, port, and protocol. NSGs are a core tool for controlling network-level access.

Which Azure service provides scalable, name-resolution (DNS) hosting for your domains within Azure?

• a.Azure Blob Storage
• b.Azure DNS✓
• c.Azure Functions
• d.Azure Policy

Azure DNS hosts your domain's DNS records on Microsoft's global network of name servers. It provides fast, reliable name resolution using Azure's infrastructure. You manage DNS records with the same tools and credentials as other Azure resources.

What is the main benefit of using availability sets for virtual machines in Azure?

• a.They encrypt all stored data
• b.They reduce the cost of storage
• c.They distribute VMs across fault and update domains to reduce the impact of hardware failures and maintenance✓
• d.They provide serverless functions

Availability sets group VMs across multiple fault domains and update domains within a datacenter. This ensures that hardware failures or planned maintenance affect only a subset of the VMs. As a result, the application stays available during such events.

Which Azure storage redundancy option keeps multiple copies of your data within a single datacenter?

• a.Geo-redundant storage (GRS)
• b.Zone-redundant storage (ZRS)
• c.Read-access geo-redundant storage (RA-GRS)
• d.Locally redundant storage (LRS)✓

Locally redundant storage (LRS) replicates data three times within a single physical location in the primary region. It is the lowest-cost option but does not protect against a datacenter-wide outage. Higher redundancy tiers spread copies across zones or regions.

Which storage redundancy option replicates data to a secondary region hundreds of miles away for regional disaster protection?

• a.Geo-redundant storage (GRS)✓
• b.Locally redundant storage (LRS)
• c.Zone-redundant storage (ZRS)
• d.Premium SSD

Geo-redundant storage (GRS) copies data to a secondary region far from the primary one. This protects against a complete regional outage such as a natural disaster. It offers the highest durability among the standard redundancy options.

What is Azure Blob Storage's 'archive' access tier best suited for?

• a.Frequently accessed transactional data
• b.Rarely accessed data that can tolerate retrieval latency, stored at the lowest cost✓
• c.Real-time streaming video
• d.Active database files

The archive tier stores data offline at the lowest cost, intended for long-term retention of rarely accessed data. Retrieving archived data takes time (rehydration) and incurs higher access costs. It suits compliance archives and backups that are seldom read.

Which Azure service provides a global content delivery network (CDN) to cache content closer to users?

• a.Azure SQL Database
• b.Azure Functions
• c.Azure Content Delivery Network (CDN)✓
• d.Microsoft Entra ID

Azure CDN caches static content at edge locations around the world, delivering it from a point of presence near each user. This reduces latency and offloads traffic from the origin. It improves performance for websites, media, and downloads.

Which Azure networking service provides a Layer 7 (application layer) load balancer with features like URL-based routing and web application firewall?

• a.Azure Load Balancer
• b.Azure DNS
• c.Azure Blob Storage
• d.Azure Application Gateway✓

Azure Application Gateway is a web traffic load balancer operating at Layer 7 (the application layer). It supports URL-based routing, SSL termination, and an optional Web Application Firewall (WAF). This makes it suited to advanced HTTP/HTTPS routing scenarios.

What is the role of a management group in the Azure resource hierarchy?

• a.It organizes multiple subscriptions together so governance can be applied across them✓
• b.It stores blob data
• c.It hosts virtual machines
• d.It provides DNS resolution

A management group sits above subscriptions in the Azure hierarchy and groups them for unified governance. Policies and access assignments applied to a management group flow down to all subscriptions within it. This simplifies management for organizations with many subscriptions.

Which statement correctly orders the Azure resource hierarchy from broadest to narrowest scope?

• a.Resource, resource group, subscription, management group
• b.Management group, subscription, resource group, resource✓
• c.Subscription, management group, resource, resource group
• d.Resource group, resource, subscription, management group

The Azure hierarchy from broadest to narrowest is management group, then subscription, then resource group, then individual resource. Governance settings applied at a higher level are inherited by everything beneath. Understanding this order is essential for scoping policy and access.

Which Azure service provides secure storage and management of secrets, keys, and certificates?

• a.Azure Blob Storage
• b.Azure Functions
• c.Azure Key Vault✓
• d.Azure DNS

Azure Key Vault safeguards cryptographic keys, secrets such as passwords, and certificates. It centralizes secret management and controls access with policies and identities. This keeps sensitive values out of application code and configuration files.

What does Azure Virtual Network peering enable?

• a.Encryption of blob storage
• b.Serverless code execution
• c.Automatic cost reporting
• d.Direct, low-latency connectivity between two virtual networks so resources can communicate as if on one network✓

VNet peering connects two virtual networks so their resources can communicate directly over the Azure backbone. Traffic between peered VNets stays on Microsoft's private network with low latency. It is commonly used to link workloads across VNets or regions.

Which Azure compute option is best described as 'serverless,' where you focus on code and the platform handles scaling automatically?

• a.Azure Functions✓
• b.Azure Virtual Machines
• c.Azure availability sets
• d.Azure ExpressRoute

Azure Functions embodies serverless computing: you write event-triggered code and the platform automatically provisions and scales the compute. There are no servers for you to manage. Billing is tied to executions and resources consumed during runs.

Which Azure service would you use to queue messages between application components to decouple and scale them independently?

• a.Azure Blob Storage
• b.Azure Queue Storage✓
• c.Azure DNS
• d.Microsoft Entra ID

Azure Queue Storage stores large numbers of messages that components can add and retrieve asynchronously. This decouples producers from consumers, letting each scale independently and absorb load spikes. It improves resilience in distributed applications.

What is a key advantage of using PaaS services like Azure App Service over IaaS virtual machines for hosting a web app?

• a.You gain full control of the physical hardware
• b.You must manually patch the operating system
• c.The platform handles OS patching, scaling, and infrastructure so developers focus on the application✓
• d.You cannot deploy custom code

PaaS offerings such as Azure App Service manage the operating system, runtime, patching, and scaling for you. This reduces operational overhead compared to running and maintaining your own VMs. Developers can concentrate on building and deploying application features.

Which Azure service provides scalable big data analytics and data warehousing for large volumes of structured data?

• a.Azure Blob Storage
• b.Azure DNS
• c.Azure Key Vault
• d.Azure Synapse Analytics✓

Azure Synapse Analytics is an analytics service that combines data warehousing and big data processing. It can query large datasets using both serverless and provisioned resources. It supports enterprise reporting and advanced analytics at scale.

Which storage redundancy option replicates data synchronously across three availability zones in the primary region?

• a.Zone-redundant storage (ZRS)✓
• b.Locally redundant storage (LRS)
• c.Geo-redundant storage (GRS)
• d.Cool access tier

Zone-redundant storage (ZRS) writes copies of data across three separate availability zones within the primary region. This protects against the failure of a single datacenter/zone while keeping data in-region. It offers higher availability than LRS.

What best describes the purpose of Microsoft Entra ID single sign-on (SSO)?

• a.It encrypts data stored in blobs
• b.It lets users sign in once and access multiple applications without re-entering credentials✓
• c.It provisions virtual machines automatically
• d.It hosts DNS zones

Single sign-on (SSO) allows users to authenticate once with Microsoft Entra ID and then access many connected applications without repeated logins. This improves user experience and reduces password fatigue. It also strengthens security by centralizing authentication.

Which Azure service helps you migrate on-premises servers, databases, and applications to Azure with assessment and tracking tools?

• a.Azure Blob Storage
• b.Azure Functions
• c.Azure Migrate✓
• d.Azure DNS

Azure Migrate provides a central hub to discover, assess, and migrate on-premises workloads to Azure. It offers tools for server, database, and application migration along with readiness assessments. This streamlines planning and executing a cloud migration.

What is the primary function of a public IP address resource in Azure?

• a.It stores encryption keys
• b.It queues messages between apps
• c.It hosts static websites only
• d.It allows inbound and outbound communication between Azure resources and the internet✓

A public IP address enables Azure resources to communicate with the internet and public-facing services. It can be assigned to VMs, load balancers, and gateways. Without a public IP (or equivalent), a resource cannot be reached directly from the internet.

Which Azure feature lets a virtual machine authenticate to other Azure services without storing credentials in code?

• a.Managed identities in Microsoft Entra ID✓
• b.Storing passwords in the OS registry
• c.Hardcoding keys in the application
• d.Emailing credentials to users

Managed identities give Azure resources an automatically managed identity in Microsoft Entra ID. Resources use this identity to authenticate to services that support it, avoiding credentials in code. Azure handles the identity's lifecycle, improving security.

Which Azure service provides a fully managed, in-memory data cache to improve application performance?

• a.Azure Blob Storage
• b.Azure Cache for Redis✓
• c.Azure DNS
• d.Azure Migrate

Azure Cache for Redis is a managed in-memory data store based on the popular Redis engine. It speeds up applications by caching frequently accessed data close to compute. This reduces database load and improves response times.

What is the primary purpose of Microsoft Cost Management in Azure?

• a.To deploy virtual machines
• b.To host web applications
• c.To monitor, analyze, and optimize spending across Azure resources✓
• d.To store unstructured data

Microsoft Cost Management provides tools to track, analyze, and control Azure spending. It offers cost analysis, budgets, and recommendations to optimize usage. This helps organizations stay within budget and identify savings opportunities.

What is the main use of tags applied to Azure resources?

• a.To physically label servers in the datacenter
• b.To encrypt the resource's data
• c.To increase the resource's performance
• d.To attach metadata (key-value pairs) for organizing, tracking costs, and managing resources✓

Tags are key-value pairs you assign to resources to add descriptive metadata. They enable grouping and filtering for cost reporting, ownership, and environment tracking. For example, tagging by department lets you break down spending accurately.

What does Azure Policy help an organization enforce?

• a.Rules and standards that keep resources compliant, such as allowed regions or required tags✓
• b.The physical location of datacenters
• c.The pricing of virtual machines
• d.The color scheme of the portal

Azure Policy lets you define and enforce organizational rules for resources at scale. Policies can require certain configurations, restrict resource types or regions, and flag non-compliant resources. This drives consistent governance and regulatory compliance.

What does role-based access control (RBAC) in Azure allow you to do?

• a.Encrypt all network traffic automatically
• b.Grant users only the specific permissions they need, scoped to particular resources✓
• c.Deploy virtual machines faster
• d.Reduce storage costs

Role-based access control (RBAC) assigns permissions through roles at a chosen scope such as a subscription, resource group, or resource. This follows the principle of least privilege, granting only the access users need. It centralizes and simplifies permission management.

What is the purpose of a resource lock in Azure?

• a.To encrypt data at rest
• b.To speed up resource deployment
• c.To prevent accidental deletion or modification of critical resources✓
• d.To lower the monthly bill

Resource locks protect important resources from accidental changes or deletion. A 'CanNotDelete' lock allows edits but blocks deletion, while a 'ReadOnly' lock blocks both changes and deletion. Locks apply regardless of a user's RBAC permissions.

Which Azure service collects telemetry such as metrics and logs to help you observe the health and performance of resources?

• a.Azure Blob Storage
• b.Azure Key Vault
• c.Azure DNS
• d.Azure Monitor✓

Azure Monitor gathers metrics, logs, and other telemetry from Azure resources and applications. It enables visualization, alerting, and analysis of performance and availability. This visibility is essential for detecting and diagnosing issues.

Which two lock types are available for Azure resource locks?

• a.CanNotDelete and ReadOnly✓
• b.Encrypt and Decrypt
• c.Public and Private
• d.Hot and Cool

Azure supports two lock types: CanNotDelete, which permits reads and updates but prevents deletion, and ReadOnly, which prevents any modification or deletion. These locks override RBAC permissions to safeguard resources. They are applied at the resource, group, or subscription scope.

What is the benefit of setting a budget in Microsoft Cost Management?

• a.It automatically doubles your resource capacity
• b.It tracks spending against a defined threshold and can trigger alerts when limits are approached✓
• c.It encrypts all your resources
• d.It provisions new subscriptions

A budget in Cost Management sets a spending threshold for a scope such as a subscription or resource group. When actual or forecasted costs approach the limit, alerts notify stakeholders. This proactive control helps prevent unexpected overspending.

Which tool provides personalized recommendations to improve the cost, security, reliability, performance, and operational excellence of your Azure resources?

• a.Azure Blob Storage
• b.Azure DNS
• c.Azure Advisor✓
• d.Azure Functions

Azure Advisor analyzes your resource configuration and usage, then provides tailored recommendations. Its guidance spans cost optimization, security, reliability, performance, and operational excellence. Following its suggestions improves your environment's efficiency and posture.

How can Azure Policy remediate a resource that is created without a required tag?

• a.It deletes the entire subscription
• b.It encrypts the resource
• c.It increases the resource's size
• d.It can be configured to deny the deployment or automatically add the missing tag✓

Azure Policy supports effects such as 'deny,' which blocks non-compliant deployments, and 'modify' or 'append,' which can add a required tag. This ensures resources meet standards either by prevention or automatic correction. Remediation tasks can also fix existing non-compliant resources.

In RBAC, what does the 'scope' of a role assignment determine?

• a.The set of resources to which the granted permissions apply✓
• b.The color of the resource icon
• c.The physical datacenter used
• d.The billing currency

The scope defines where a role's permissions take effect, such as a management group, subscription, resource group, or individual resource. Assigning at a broad scope grants access to everything beneath it. Choosing the narrowest appropriate scope supports least-privilege access.

What is a primary advantage of using management groups for governance?

• a.They store application secrets
• b.Policies and access assigned at a management group are inherited by all subscriptions within it✓
• c.They provide serverless compute
• d.They cache web content

Management groups let you apply governance such as Azure Policy and RBAC across many subscriptions at once. Assignments made at the management group level are inherited by all contained subscriptions and resources. This ensures consistent policy across a large organization.

Which feature helps you understand where your Azure money is going by breaking down spending by resource, tag, or service?

• a.Azure DNS
• b.Availability zones
• c.Cost analysis in Microsoft Cost Management✓
• d.Network peering

Cost analysis provides interactive breakdowns of your Azure spending across dimensions such as service, resource group, and tag. It helps identify cost drivers and trends over time. These insights support budgeting and optimization decisions.

What is the purpose of an Azure alert in Azure Monitor?

• a.To encrypt stored data
• b.To create new subscriptions
• c.To provision virtual networks
• d.To notify you or trigger an action when a monitored condition or threshold is met✓

Alerts in Azure Monitor watch metrics or logs and fire when defined conditions are met, such as high CPU usage. They can send notifications or trigger automated responses through action groups. This enables proactive operations and faster incident response.

Which Azure governance tool would you use to package policies, role assignments, and resource templates as a repeatable, enforceable set?

• a.Azure Blueprints✓
• b.Azure Blob Storage
• c.Azure Cache for Redis
• d.Azure DNS

Azure Blueprints lets you define a repeatable set of governance artifacts including policies, RBAC role assignments, and resource templates. You can deploy these consistently to new environments to ensure they start compliant. This standardizes how subscriptions are set up.

What does the principle of 'least privilege' mean when assigning RBAC roles?

• a.Every user gets full administrator rights
• b.Users are given only the minimum permissions necessary to perform their tasks✓
• c.No user is ever given any access
• d.Permissions are assigned randomly

Least privilege means granting users just enough access to do their jobs and no more. This reduces the risk and potential impact of compromised or misused accounts. RBAC supports this by allowing precise, scoped role assignments.

Which built-in RBAC role grants full access to manage all resources, including assigning roles to others?

• a.Reader
• b.Contributor
• c.Owner✓
• d.Billing Reader

The Owner role provides full access to manage resources and, unlike Contributor, can also grant access to others by assigning roles. Contributor can manage resources but cannot assign roles, and Reader can only view. Choosing the right role enforces least privilege.

Which built-in RBAC role lets a user manage resources but NOT grant access to other users?

• a.Owner
• b.Reader
• c.Guest
• d.Contributor✓

The Contributor role allows creating and managing all types of resources but does not permit assigning roles to others. That role-assignment capability is reserved for Owner and User Access Administrator. This separation supports controlled delegation.

Which built-in RBAC role provides view-only access with no ability to make changes?

• a.Reader✓
• b.Owner
• c.Contributor
• d.User Access Administrator

The Reader role grants the ability to view resources but not to create, modify, or delete them. It is ideal for auditors or stakeholders who need visibility without change rights. It represents the least-privileged of the common built-in roles.

What is the main benefit of applying consistent tagging across your Azure resources?

• a.It automatically encrypts the resources
• b.It enables accurate cost allocation and reporting by department, project, or environment✓
• c.It increases network bandwidth
• d.It reduces the number of regions used

Consistent tags let you slice cost and usage data by meaningful categories such as department or project. This supports chargeback, showback, and accountability across teams. Tagging standards can even be enforced through Azure Policy.

Which service helps you improve your organization's security posture by providing a security score and recommendations?

• a.Azure Blob Storage
• b.Azure DNS
• c.Microsoft Defender for Cloud✓
• d.Azure Cache for Redis

Microsoft Defender for Cloud assesses your resources' security and provides a secure score along with actionable recommendations. It helps identify misconfigurations and threats across your environment. Acting on its guidance strengthens overall security.

What does an action group in Azure Monitor define?

• a.The physical location of a datacenter
• b.The redundancy level of storage
• c.The size of a virtual machine
• d.The set of notifications and automated actions to run when an alert fires✓

An action group is a reusable collection of notification targets and actions, such as emails, SMS, or webhooks. When an alert triggers, its associated action group carries out these responses. This lets you standardize how incidents are communicated and handled.

Which capability of Azure Policy shows how many of your resources currently meet defined standards?

• a.Compliance reporting✓
• b.Blob replication
• c.DNS resolution
• d.Autoscaling

Azure Policy provides compliance reporting that evaluates resources against assigned policies. It shows which resources are compliant or non-compliant, giving a clear governance overview. This helps organizations track and prove adherence to standards.

What is the purpose of the Azure Pricing Calculator?

• a.To deploy resources into production
• b.To estimate the cost of Azure services before deploying them✓
• c.To encrypt stored data
• d.To monitor live performance

The Azure Pricing Calculator lets you model and estimate the cost of Azure services based on your expected configuration and usage. It supports planning and budgeting before any resources are provisioned. This helps avoid surprises on the bill.

What does the Total Cost of Ownership (TCO) Calculator help organizations do?

• a.Deploy virtual machines automatically
• b.Encrypt data in transit
• c.Compare the cost of running workloads on-premises versus in Azure✓
• d.Configure DNS records

The TCO Calculator estimates the cost savings of migrating on-premises workloads to Azure. It compares current infrastructure expenses with projected Azure costs, including hardware, power, and staffing. This supports the business case for cloud migration.

Which of the following is a valid strategy to reduce Azure virtual machine costs for predictable, long-running workloads?

• a.Deleting all backups
• b.Disabling monitoring entirely
• c.Running only during business hours without automation
• d.Purchasing reserved instances for a one- or three-year term✓

Reserved instances let you commit to a VM for one or three years in exchange for a significant discount over pay-as-you-go pricing. They suit steady, predictable workloads that run continuously. This is a common cost-optimization technique in Azure.

What is Azure Spot pricing best suited for?

• a.Interruptible workloads that can tolerate being evicted when Azure needs the capacity back✓
• b.Mission-critical databases that must never stop
• c.Workloads requiring guaranteed uptime
• d.Long-term reserved capacity

Azure Spot pricing offers unused capacity at deep discounts, but Azure can reclaim (evict) it when demand rises. It is ideal for fault-tolerant, interruptible workloads like batch processing or testing. It should not be used for services that must run without interruption.

How does inheritance work when an Azure Policy is assigned at the subscription level?

• a.Only newly created resources in one region comply
• b.All resource groups and resources within that subscription inherit and must comply with the policy✓
• c.The policy applies to other subscriptions too
• d.Nothing inherits the policy

When a policy is assigned at the subscription scope, it applies to all resource groups and resources beneath it through inheritance. Lower scopes automatically fall under the higher-level assignment. This makes it efficient to enforce standards broadly.

What is the benefit of using Azure Monitor Log Analytics workspaces?

• a.They provision virtual machines
• b.They cache web content at the edge
• c.They collect and store log data so you can run queries and analyze it across resources✓
• d.They host relational databases

A Log Analytics workspace is a central repository where Azure Monitor stores log and performance data. You can query this data with a powerful language to investigate issues and build insights. Consolidating logs supports troubleshooting and reporting across your environment.

Which governance approach helps ensure resources are deployed only in approved geographic regions?

• a.Applying a ReadOnly resource lock
• b.Assigning the Reader RBAC role
• c.Enabling zone-redundant storage
• d.Using an Azure Policy that restricts allowed locations✓

A common Azure Policy restricts the regions in which resources may be deployed to an approved list. This supports data-residency and compliance requirements by preventing deployments elsewhere. Non-compliant deployment attempts are blocked or flagged.

What distinguishes RBAC from Azure Policy in governance?

• a.RBAC controls who can do what to resources, while Azure Policy controls what configurations resources may have✓
• b.They are identical and interchangeable
• c.RBAC encrypts data and Policy provisions VMs
• d.Azure Policy assigns user passwords

RBAC governs identity and access, determining which users or identities can perform which actions on resources. Azure Policy governs resource properties and configurations, enforcing standards regardless of who deploys. Used together, they provide comprehensive governance.

Which feature lets you group related alerts and manage the notification recipients and automated responses centrally?

• a.Availability zones
• b.Action groups✓
• c.Blob tiers
• d.Peering connections

Action groups centralize the recipients and actions that respond to alerts, such as notifying an on-call team or invoking automation. Reusing an action group across many alerts keeps notification logic consistent. This simplifies operations and incident handling.

What is a key reason to enable diagnostic settings on Azure resources?

• a.To physically relocate the datacenter
• b.To reduce the resource's memory
• c.To route resource logs and metrics to destinations like Log Analytics for analysis and retention✓
• d.To change the billing currency

Diagnostic settings specify where a resource's platform logs and metrics are sent, such as a Log Analytics workspace, storage account, or event hub. This enables long-term retention, analysis, and integration with monitoring tools. It is foundational to observability and auditing.

Which statement best describes how tags and Azure Policy can work together?

• a.Tags disable all Azure Policies
• b.Azure Policy deletes all tags on creation
• c.Tags replace the need for RBAC
• d.Azure Policy can require, add, or enforce specific tags on resources automatically✓

Azure Policy can mandate that resources carry certain tags, append missing tags, or inherit tags from their resource group. This automates and enforces tagging standards across the environment. Consistent tags then power accurate cost tracking and organization.