Courseiva

Microsoft Azure Solutions Architect Expert AZ-305 (AZ-305) — Questions 1–75

161 questions total · 3pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 3

Page 2
1
MCQmedium

A company runs a legacy on-premises application that relies on a SQL Server database. They want to use Azure as a disaster recovery site with a recovery point objective of less than 15 minutes. They need to be able to fail back to the on-premises environment after a disaster. Which Azure service should they use?

A.Azure Site Recovery
B.Azure Backup
C.Azure SQL Database
D.Azure Traffic Manager
AnswerA

Azure Site Recovery is the correct DR solution because it continuously replicates on-premises VMs and physical servers to Azure using asynchronous replication, typically achieving a recovery point objective (RPO) of 30 seconds or less. It provides orchestrated failover to Azure and failback to on-premises, enabling the legacy application to run on Azure during a disaster while maintaining application consistency through multi-VM consistency groups.

Why this answer

Azure Site Recovery (ASR) orchestrates replication, failover, and failback of on-premises SQL Server workloads to Azure, supporting a Recovery Point Objective (RPO) of less than 15 minutes through continuous replication. It enables failback to the original on-premises environment after a disaster, which is a critical requirement for this scenario.

Exam trap

The trap here is that candidates often confuse Azure Backup (which is for archival backups) with Azure Site Recovery (which is for replication and failover), leading them to select Azure Backup despite its inability to meet the sub-15-minute RPO or support failback.

How to eliminate wrong answers

Option B (Azure Backup) is wrong because it provides point-in-time backups with a typical RPO of hours or daily, not sub-15-minute continuous replication, and it does not support orchestrated failback to on-premises. Option C (Azure SQL Database) is wrong because it is a PaaS database service that cannot replicate an on-premises SQL Server instance for failback; it would require migrating the database schema and data, not providing disaster recovery replication. Option D (Azure Traffic Manager) is wrong because it is a DNS-based traffic load balancer that routes user traffic, not a replication or disaster recovery service for SQL Server databases.

Full explanation →
2
MCQeasy

A company uses Microsoft Entra ID for identity management. They need to automate the process of granting access to resources for employees and external partners, and require periodic access reviews to ensure compliance. Which Microsoft Entra ID feature should they use?

A.Microsoft Entra ID Privileged Identity Management (PIM)
B.Microsoft Entra ID Entitlement Management
C.Microsoft Entra ID Conditional Access
D.Microsoft Entra ID Identity Protection
AnswerB

Microsoft Entra ID Entitlement Management is the correct choice because it creates access packages that bundle resources—groups, apps, SharePoint sites, and Teams—and define policies for who can request, who must approve, when access expires, and which access reviews are required. It automates the end-to-end lifecycle of access assignments and lets external partners request time-limited access through the Microsoft Entra admin center or a custom portal, satisfying both automation and periodic recertification.

Why this answer

Microsoft Entra ID Entitlement Management is the correct feature because it enables automation of access request workflows for employees and external partners, including time-limited access packages and periodic access reviews to enforce compliance. This directly matches the requirement for granting access and ensuring ongoing governance through reviews.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with Entitlement Management because both involve access and reviews, but PIM is strictly for privileged roles, not for general resource access automation for employees and partners.

How to eliminate wrong answers

Option A is wrong because Privileged Identity Management (PIM) focuses on just-in-time privileged role activation and oversight for admin roles, not on automating general resource access for employees and partners or managing access reviews for non-privileged users. Option C is wrong because Conditional Access enforces real-time access policies based on signals like location or device compliance, but it does not automate the initial granting of access or provide periodic review capabilities. Option D is wrong because Identity Protection detects and remediates identity-based risks (e.g., leaked credentials, sign-in anomalies), but it does not handle access request workflows or compliance-driven access reviews.

Full explanation →
3
MCQeasy

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to automatically detect and respond to high-risk sign-in events, such as sign-ins from malware-linked IP addresses or leaked credentials. When such risks are detected, they want to require multi-factor authentication (MFA) or block the sign-in. They also need a dashboard to review risk events and generate reports. Which Microsoft Entra ID feature should they configure?

A.Microsoft Entra ID Privileged Identity Management (PIM)
B.Microsoft Entra ID Identity Protection
C.Microsoft Entra ID Conditional Access
D.Microsoft Entra ID Identity Governance
AnswerB

Identity Protection is the correct answer because it is Entra ID's risk detection engine, using signals like leaked credentials, anonymous IP addresses, impossible travel, malware-linked IPs, and unfamiliar sign-in properties to compute per-user and per-risk assignments. It provides an interactive risk dashboard, programmatic risk detection APIs, and supports risk-based Conditional Access policies, such as requiring MFA or blocking access when risk levels exceed a threshold, and can auto-remediate via self-service password reset for confirmed compromised users.

Why this answer

Microsoft Entra ID Identity Protection is the correct feature because it is specifically designed to automatically detect and respond to high-risk sign-in events, such as sign-ins from malware-linked IP addresses or leaked credentials. It provides risk-based conditional access policies that can require MFA or block sign-ins, and it includes a dashboard for reviewing risk events and generating reports. This aligns directly with the scenario's requirements for detection, automated response, and reporting.

Exam trap

The trap here is that candidates often confuse Conditional Access with Identity Protection, not realizing that Conditional Access is the enforcement mechanism while Identity Protection is the detection and risk-scoring engine that provides the necessary risk signals.

How to eliminate wrong answers

Option A is wrong because Privileged Identity Management (PIM) is focused on managing, controlling, and monitoring access to privileged roles, not on detecting or responding to sign-in risks like leaked credentials or malware-linked IPs. Option C is wrong because Conditional Access is a policy engine that enforces access controls (like MFA) based on conditions, but it does not itself detect risk events or provide a risk dashboard; it relies on Identity Protection to supply risk signals. Option D is wrong because Identity Governance handles access reviews, entitlement management, and lifecycle workflows, not real-time risk detection or automated response to high-risk sign-ins.

Full explanation →
4
MCQmedium

A company runs a mission-critical multi-tier application on Azure VMs in West US. The application consists of database VMs, application VMs, and web VMs. During a disaster, the VMs must be recovered in a specific order: database tier first, then application tier, then web tier. The recovery point objective (RPO) is 5 minutes and recovery time objective (RTO) is 15 minutes. The company wants to periodically test the recovery process without impacting production. After failover to East US, the VMs must retain their private IP addresses to avoid DNS propagation delays. Which combination of Azure Site Recovery features should they configure?

A.A recovery plan, planned failover, and network mapping
B.A recovery plan, test failover, and network mapping
C.A recovery plan, test failover, and static IP address assignment
D.A recovery plan, planned failover, and static IP address assignment
AnswerC

Recovery Plan defines the order of VM group failover and can incorporate Automation runbooks for post-failover customizations, such as updating DNS records. Test failover enables you to validate the entire recovery flow in an isolated test network safely, without any impact to the production source VMs. By explicitly assigning a static IP address to each VM in the target subnet, you guarantee the same IP is used after failover, which is crucial for applications with hard-coded IP dependencies. This combination fully meets the requirement: orchestrated, tested, and IP-preserving failover.

Why this answer

A recovery plan enforces the required startup order (database → application → web), test failover allows non-disruptive validation of the recovery process, and static IP address assignment ensures VMs retain their private IP addresses after failover to East US, avoiding DNS propagation delays. This combination meets the RPO of 5 minutes and RTO of 15 minutes while satisfying the requirement for periodic testing without impacting production.

Exam trap

The trap here is that candidates confuse network mapping (which only maps source to target networks) with static IP address assignment (which preserves the exact private IP), leading them to choose Option B instead of C.

How to eliminate wrong answers

Option A is wrong because planned failover is used for zero-data-loss migrations or planned downtime scenarios, not for disaster recovery testing, and it does not support non-disruptive validation of the recovery process. Option B is wrong because network mapping only maps source and target networks for IP address assignment but does not guarantee that VMs retain their exact private IP addresses after failover; static IP assignment is required for that. Option D is wrong because planned failover is not suitable for periodic testing of disaster recovery, as it assumes a controlled shutdown and can impact production if used incorrectly.

Full explanation →
5
MCQmedium

A company uses Microsoft Entra ID (Microsoft Entra ID). External partners need temporary access to an internal application. The process must be self-service: partners request access, the request goes through an approval workflow managed by a manager from the partner's organization, and access automatically expires after 30 days. The company also wants to send reminder emails 7 days before expiration. Which Microsoft Entra ID feature should they use?

A.Microsoft Entra ID Identity Governance - Access Reviews
B.Microsoft Entra ID Identity Governance - Entitlement Management
C.Microsoft Entra ID Privileged Identity Management (PIM)
D.Microsoft Entra ID Conditional Access
AnswerB

Entitlement Management provides access packages that external users can request. It includes approval workflows, automatic expiration after a defined duration, and email reminders before expiration. It is designed for managing external identities and time-limited access.

Why this answer

Microsoft Entra ID Identity Governance - Entitlement Management is specifically designed to manage access for external users through self-service access packages. It supports approval workflows with external managers, automatic time-bound access (e.g., 30-day expiration), and lifecycle notifications like reminder emails 7 days before expiry. This aligns perfectly with the requirement for partner-managed, temporary, self-service access.

Exam trap

The trap here is confusing Entitlement Management (designed for external user access lifecycle) with Access Reviews (which is for periodic recertification, not self-service provisioning) or PIM (which is for internal privileged roles, not application access for partners).

How to eliminate wrong answers

Option A is wrong because Access Reviews are used for periodic attestation of existing access, not for self-service request workflows with automatic expiration and reminders. Option C is wrong because Privileged Identity Management (PIM) is focused on just-in-time privileged role activation for internal administrators, not for granting temporary access to external partners for an application. Option D is wrong because Conditional Access enforces policies (e.g., MFA, location) during sign-in but does not provide self-service request, approval workflows, or automatic expiration management.

Full explanation →
6
MCQhard

A multinational corporation is designing a disaster recovery strategy for a critical application running on Azure VMs. The application must have a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The primary region is East US, and the secondary region is West US. The solution must minimize costs while meeting the requirements. What should you recommend?

A.Deploy an active-passive configuration with Azure Front Door and Traffic Manager
B.Implement Azure Site Recovery for the VMs
C.Configure the VMs in an availability zone across East US and West US
D.Use Azure Backup with cross-region restore for the VMs
AnswerB

Azure Site Recovery is the native DR service for IaaS VMs, continuously replicating VM storage to a paired secondary region with an RPO as low as 15 seconds and RTO in minutes. It handles orchestrated failover, failback, and recovery drills, offering a cost-effective, fully managed solution that meets the stringent DR objectives without extra infrastructure. This directly satisfies the requirement for cross-region VM protection.

Why this answer

Azure Site Recovery (ASR) provides orchestrated replication of Azure VMs from a primary to a secondary region with an RPO as low as 15 minutes (Premium SSD) and RTOs that can be met within 1 hour through planned failover. It is the native Azure service designed for disaster recovery of IaaS workloads, offering cost-effective replication without requiring always-on secondary VMs, as it only incurs storage costs for replicated disks until failover.

Exam trap

The trap here is that candidates confuse high-availability solutions (availability zones, load balancers) with disaster recovery solutions, or assume Azure Backup's cross-region restore can meet low RPOs, when in fact only Azure Site Recovery provides the sub-hour replication frequency required for a 15-minute RPO.

How to eliminate wrong answers

Option A is wrong because Azure Front Door and Traffic Manager are global load-balancing and traffic-routing services; they do not provide VM replication or failover orchestration, and an active-passive configuration alone cannot meet the RPO/RTO without a replication mechanism. Option C is wrong because availability zones are within a single Azure region (e.g., East US) and cannot span across East US and West US; they protect against datacenter failures within a region, not regional disasters. Option D is wrong because Azure Backup with cross-region restore has a default RPO of 24 hours (for daily backups) and cannot achieve a 15-minute RPO; it is designed for backup and long-term retention, not low-latency disaster recovery.

Full explanation →
7
MCQhard

You are a solutions architect for a financial services company. The company is deploying a new critical application on Azure that processes sensitive customer transactions. The application consists of an ASP.NET Core web app (Azure App Service), a REST API (Azure Kubernetes Service), and an Azure SQL Database. The requirements are: - All data at rest must be encrypted using customer-managed keys (CMK) stored in a managed HSM. - All network traffic between components must be encrypted and traverse the Microsoft backbone network. - The web app must be protected against common web attacks (SQL injection, XSS). - The solution must automatically scale the API based on CPU utilization. - All API calls must be authenticated using OAuth 2.0 with Microsoft Entra ID. - Logs from all components must be sent to a central Log Analytics workspace for analysis. - The solution must have a recovery time objective (RTO) of 1 hour and recovery point objective (RPO) of 5 minutes for the database. Which combination of Azure services should you recommend to meet ALL requirements?

A.Azure Front Door with WAF, Azure SQL Database point-in-time restore, Azure Key Vault Managed HSM, Azure App Service with private endpoint, AKS with HPA, Azure Log Analytics agent, Microsoft Entra ID
B.Azure Front Door with WAF, Azure SQL Database geo-replication, Azure Key Vault (Standard), Azure App Service with private endpoint, AKS with HPA, Azure Diagnostics extension, Microsoft Entra ID
C.Azure Application Gateway with WAF, Azure SQL Database active geo-replication, Azure Key Vault Managed HSM, Azure App Service with VNet integration, AKS with cluster autoscaler, Azure Monitor Agent, Microsoft Entra ID
D.Azure Application Gateway with WAF, Azure SQL Database failover groups, Azure Key Vault Managed HSM, Azure App Service with service endpoint, AKS with HPA, Azure Monitor Agent, Microsoft Entra ID
AnswerD

Correct. Failover groups meet RPO and RTO, Managed HSM meets key storage, service endpoint keeps traffic on Microsoft backbone, AKS with HPA scales based on CPU, Application Gateway WAF protects against attacks, Azure Monitor Agent collects logs, and Microsoft Entra ID authenticates API calls.

Why this answer

Meets all requirements: Azure Application Gateway with WAF protects against SQL injection and XSS; Azure SQL Database failover groups provide an RPO of 5 seconds and an RTO of 1 hour (auto-failover); Azure Key Vault Managed HSM stores customer-managed keys for encryption at rest; App Service with service endpoint ensures traffic to other Azure services stays on the Microsoft backbone network (combined with AKS in a VNet, internal traffic stays on backbone); AKS with Horizontal Pod Autoscaler (HPA) scales pods based on CPU utilization; Azure Monitor Agent sends logs to Log Analytics; Microsoft Entra ID authenticates API calls via OAuth 2.0. Option A uses point-in-time restore, which cannot guarantee RPO of 5 minutes and RTO of 1 hour. Option B uses Key Vault Standard instead of Managed HSM.

Option C uses cluster autoscaler, which scales nodes, not pods, failing the CPU-based scaling requirement.

Exam trap

The trap is confusing cluster autoscaler with Horizontal Pod Autoscaler (HPA). Cluster autoscaler scales the number of node VMs, not pod replicas, and does not respond to CPU utilization; it only responds to pending pods. HPA scales pod replicas based on CPU or memory metrics.

Also, service endpoints vs. private endpoints: both keep traffic on the Microsoft backbone, but private endpoints provide a private IP in the VNet for enhanced security.

How to eliminate wrong answers

Option A is wrong because Azure SQL Database point-in-time restore has an RPO of up to 1 hour (not 5 minutes) and does not meet the RPO requirement; also, Azure Log Analytics agent is deprecated in favor of Azure Monitor Agent. Option B is wrong because Azure Key Vault (Standard) does not support customer-managed keys stored in a managed HSM (requires Premium tier or Managed HSM), and Azure Diagnostics extension is legacy and not the recommended agent for Log Analytics. Option D is wrong because Azure App Service with service endpoint does not ensure traffic traverses the Microsoft backbone network (it uses public IPs with ACLs, not private IPs); also, AKS with HPA (Horizontal Pod Autoscaler) scales pods, not nodes, and the requirement is to scale the API based on CPU utilization, which is better handled by cluster autoscaler for node-level scaling or HPA for pod-level scaling, but the key issue is service endpoint not meeting the private network requirement.

Full explanation →
8
MCQhard

A company runs a high-performance computing (HPC) workload on Azure that requires extremely low latency (under 10 microseconds) between multiple VMs for MPI communication. The VMs are part of a single job and must be placed together to minimize network latency. Which VM deployment option should they use?

A.Azure Virtual Machine Scale Sets with a Proximity Placement Group
B.Azure Availability Sets
C.Azure Virtual Machine Scale Sets across Availability Zones
D.Azure Kubernetes Service (AKS)
AnswerA

Azure Virtual Machine Scale Sets with a Proximity Placement Group (PPG) is the correct choice for tightly coupled HPC workloads because a PPG co-locates all VM instances within the same Azure datacenter, minimizing network latency to the sub-10 microseconds required by MPI applications. VMSS integrates with PPG by allowing you to scale the compute cluster out while ensuring every new instance remains within the placement group, preserving low-latency inter-node communication. This combination also enables the use of high-throughput, low-latency networking such as InfiniBand on supported HPC VM SKUs, which is essential for parallel jobs that need frequent, low-latency message passing.

Why this answer

A Proximity Placement Group (PPG) within a Virtual Machine Scale Set ensures that all VMs are physically located as close as possible within an Azure datacenter, reducing network latency to under 10 microseconds for MPI communication. This is the only option that guarantees co-location of VMs for a single HPC job, as PPGs minimize inter-VM latency by placing VMs in the same rack or cluster.

Exam trap

The trap here is that candidates often confuse Availability Sets (which provide high availability) with Proximity Placement Groups (which provide low latency), or assume that Availability Zones offer sufficient performance for HPC, ignoring the significant latency penalty of inter-zone communication.

How to eliminate wrong answers

Option B is wrong because Availability Sets only protect against failures by distributing VMs across fault and update domains, but they do not guarantee low latency or co-location; in fact, they may spread VMs across different racks, increasing latency. Option C is wrong because Virtual Machine Scale Sets across Availability Zones place VMs in physically separate datacenters within a region, which introduces network latency far exceeding the 10-microsecond requirement due to inter-zone communication. Option D is wrong because Azure Kubernetes Service (AKS) abstracts VM placement and does not provide native mechanisms to enforce co-location of pods for low-latency MPI communication; it relies on underlying node placement, which is not guaranteed to be within a single rack.

Full explanation →
9
MCQhard

Contoso Ltd. is a global e-commerce company running its online store on Azure. The application consists of: - Frontend: Azure App Service (Windows) in West US. - Backend: Azure Kubernetes Service (AKS) cluster in West US. - Database: Azure SQL Database (General Purpose, S2) in West US. - Cache: Azure Cache for Redis (Standard C1) in West US. - Storage: Azure Blob Storage (LRS) for product images. Business continuity requirements: - RPO: 5 minutes for the database. - RTO: 1 hour for the entire application. - The solution must survive a complete West US region outage. - Budget is limited; minimize additional costs. What should you recommend as the primary DR strategy?

A.Deploy a secondary region (East US) with a passive AKS cluster (minimal node count), a standby App Service plan (same tier), and a secondary Azure SQL Database in an auto-failover group. Use Azure Traffic Manager for frontend and configure Azure Cache for Redis with geo-replication. For Blob Storage, enable geo-redundant storage (GRS).
B.Use Azure Backup for the database with 5-minute log backup frequency. For the app, use Azure App Service backup with frequency to a secondary region. For AKS, back up persistent volumes using Azure Backup. Restore everything in a secondary region during disaster.
C.Deploy the entire application across two Azure Availability Zones within West US. Use zone-redundant storage for blobs, zone-redundant App Service plan, and zone-redundant AKS. For SQL Database, use a zone-redundant configuration. For Redis, use Enterprise tier with zone redundancy.
D.Use Azure Site Recovery to replicate all VMs (including AKS nodes) to a secondary region. For the database, use Azure SQL Database active geo-replication. For Azure Cache for Redis, replicate data via geo-replication. Use Azure Traffic Manager for frontend traffic routing.
AnswerA

This meets the RPO/RTO with minimal cost by using a passive standby.

Why this answer

It meets the RPO of 5 minutes for the database using an auto-failover group with a secondary Azure SQL Database in East US, which provides continuous data synchronization with minimal data loss. The passive AKS cluster (minimal node count) and standby App Service plan minimize costs while ensuring RTO of 1 hour by allowing rapid scaling during failover. Azure Traffic Manager routes frontend traffic to the secondary region, and geo-replication for Redis Cache and GRS for Blob Storage provide data durability across regions, satisfying the requirement to survive a complete West US region outage.

Exam trap

The trap here is that candidates often choose zone-redundant options (Option C) thinking they provide regional resilience, but they only protect against zone failures within a region, not a complete region outage, which is explicitly required in the question.

How to eliminate wrong answers

Option B is wrong because Azure Backup with 5-minute log backup frequency can achieve an RPO of 5 minutes, but restoring the entire application in a secondary region during a disaster would likely exceed the 1-hour RTO due to the time required to restore App Service backups, AKS persistent volumes, and database backups, and it does not provide automated failover or pre-provisioned infrastructure. Option C is wrong because deploying across Availability Zones within West US cannot survive a complete region outage, as all zones are in the same region; this violates the requirement to survive a full West US region outage. Option D is wrong because Azure Site Recovery replicates VMs, but AKS nodes are typically managed and ephemeral; replicating them adds complexity and cost, and the solution does not address the App Service frontend or Blob Storage replication efficiently, while active geo-replication for SQL Database is more expensive than an auto-failover group with a secondary database in the same tier.

Full explanation →
10
MCQhard

You are designing a backup strategy for Azure virtual machines. The solution must support application-consistent backups for SQL Server databases running on the VMs. You need to ensure that backups are taken every 4 hours and retained for 30 days. What should you configure in Azure Backup?

A.Configure Azure SQL Backup for the SQL Server databases.
B.Configure a VM backup policy with 4-hour frequency and 30-day retention using the default backup extension.
C.Configure Azure Site Recovery replication policy with 4-hour frequency.
D.Configure Azure Backup for SAP HANA on the VM.
AnswerB

VM backup policy supports application-consistent backups and custom schedules.

Why this answer

Azure Backup's default VM backup extension (VMSnapshot) can achieve application-consistent backups for SQL Server by using Windows Volume Shadow Copy Service (VSS) to quiesce the database writes. You configure a VM backup policy with a 4-hour frequency and 30-day retention to meet the stated requirements, as this policy applies to the entire VM and ensures SQL Server databases are backed up consistently.

Exam trap

The trap here is that candidates often confuse Azure SQL Backup (PaaS) with VM backup for SQL Server on IaaS, or they mistakenly think Azure Site Recovery can serve as a backup solution with retention, when it is only for replication and failover.

How to eliminate wrong answers

Option A is wrong because Azure SQL Backup is a separate service for Azure SQL Database (PaaS), not for SQL Server running on Azure VMs (IaaS). Option C is wrong because Azure Site Recovery replication policy is designed for disaster recovery (replication and failover), not for scheduled backups with retention; it does not support 4-hour frequency for backup retention. Option D is wrong because Azure Backup for SAP HANA is a specialized solution for SAP HANA databases, not for SQL Server databases.

Full explanation →
11
MCQeasy

A company runs a line-of-business application on Azure VMs that requires a highly available, low-latency SMB file share with support for active-active access from multiple VMs. The application requires high IOPS and throughput, and the file share must be mountable on both Linux and Windows VMs. Which Azure file storage solution should they recommend?

A.A
B.B
C.C
D.D
AnswerB

Azure NetApp Files is a high-performance, enterprise-grade file storage service that supports SMB (both Windows and Linux) and can deliver thousands of IOPS with low latency.

Why this answer

Azure NetApp Files provides a fully managed, high-performance file share service that supports both SMB and NFS protocols. It offers low-latency, high IOPS and throughput, and enables active-active access from multiple VMs. It can be mounted on both Linux and Windows VMs, meeting all stated requirements.

While Azure Files Premium also provides SMB shares, Azure NetApp Files is better suited for demanding, low-latency workloads requiring high performance.

Exam trap

The trap here is that candidates often confuse Azure Blob Storage (which is object storage) with file shares, or incorrectly assume that Azure Disk Shared Disks provide an SMB mountable share, when in fact they are block-level and require cluster-aware applications.

How to eliminate wrong answers

Option A is wrong because Azure Blob Storage (including Premium Blob) does not support SMB protocol natively; it uses REST/API access and cannot be mounted as an SMB file share for active-active access from VMs. Option C is wrong because Azure NetApp Files uses NFS or SMB but is a third-party service with higher cost and complexity, and it is not the native Azure file storage solution for SMB shares. Option D is wrong because Azure Disk Storage (managed disks) can only be attached to a single VM at a time (except for shared disks with SCSI-3 Persistent Reservations, which are not SMB-based and have limited OS support), and it does not provide a file share mountable over SMB.

Full explanation →
12
MCQhard

A company ingests millions of IoT events per second from sensors around the world. Each event is a JSON message with timestamp, device ID, and readings. They need to support real-time analytics dashboards and also store all raw data for long-term historical analysis. They want to minimize operational overhead. Which Azure data storage solution should they recommend?

A.Azure Data Lake Storage Gen2 for all data.
B.Azure Event Hubs with Capture to Azure Data Lake Storage.
C.Azure Cosmos DB for both real-time and historical data.
D.Azure Time Series Insights (TSI) Standard.
AnswerB

Event Hubs can handle millions of events per second. The Capture feature automatically writes ingested events to Data Lake Storage in Avro format (or JSON). For real-time dashboards, you can use Stream Analytics to query the Event Hubs stream. This provides a seamless, low-operational-overhead solution.

Why this answer

Azure Event Hubs is designed for high-throughput data ingestion, capable of handling millions of events per second. By enabling the Capture feature, data is automatically and durably persisted to Azure Data Lake Storage in Avro format, providing a serverless, low-latency pipeline for real-time dashboards while storing raw data for long-term analytics. This minimizes operational overhead by eliminating the need to manage separate ingestion and storage infrastructure.

Exam trap

The trap here is that candidates often confuse Azure Data Lake Storage as a complete solution for both ingestion and storage, overlooking the need for a dedicated event ingestion service like Event Hubs to handle high-throughput streaming data before persisting it to the lake.

How to eliminate wrong answers

Option A is wrong because Azure Data Lake Storage Gen2 is a scalable storage service but lacks native real-time ingestion capabilities; it would require an additional service like Event Hubs to handle the high-velocity IoT stream, adding complexity. Option C is wrong because Azure Cosmos DB is a NoSQL database optimized for low-latency reads/writes and transactional workloads, not for ingesting millions of events per second as a streaming buffer; using it for both real-time and historical data would incur high costs and operational overhead for raw event storage. Option D is wrong because Azure Time Series Insights (TSI) Standard is purpose-built for time-series data visualization and analysis, but it has limited throughput and retention compared to Event Hubs with Capture, and it is not designed to store raw JSON events for long-term historical analysis at this scale.

Full explanation →
13
MCQmedium

A global e-commerce platform uses Azure Cosmos DB for its product catalog. The application requires multi-region writes to provide low-latency updates from any geographic location. Two users may update the same product item concurrently, so the solution must automatically resolve conflicts. For real-time inventory checks, reads must be strongly consistent, while product description reads can be eventually consistent. Which Cosmos DB configuration should they choose?

A.SQL API with multi-region writes, last-writer-wins conflict resolution, and per-request strong consistency
B.MongoDB API with multi-region writes and automatic conflict resolution
C.Table API with multi-region writes and strong consistency
D.Cassandra API with multi-region writes and strong consistency
AnswerA

SQL API supports multi-master writes, customizable conflict resolution, and the ability to set strong consistency on a per-request basis.

Why this answer

The SQL API in Cosmos DB supports multi-region writes with last-writer-wins (LWW) conflict resolution using a timestamp or custom property, which automatically resolves concurrent updates to the same product item. Per-request strong consistency allows inventory reads to achieve linearizability by setting the consistency level at the request level, while product description reads can use the default session or eventual consistency for performance. This combination meets all requirements: multi-region writes, automatic conflict resolution, and the ability to mix strong and eventual consistency on a per-request basis.

Exam trap

The trap here is that candidates assume all Cosmos DB APIs support multi-region writes and per-request strong consistency equally, but only the SQL API (and the Table API with specific limitations) offers the full flexibility to mix consistency levels per request, while the MongoDB, Cassandra, and Table APIs have fixed account-level consistency or lack multi-region write support entirely.

How to eliminate wrong answers

Option B is wrong because the MongoDB API in Cosmos DB does not support per-request strong consistency; it only offers a fixed set of consistency levels at the account level, and its automatic conflict resolution is limited to LWW without the flexibility to mix consistency levels per request. Option C is wrong because the Table API does not support multi-region writes; it is designed for single-region writes with read-only replicas, and it lacks per-request strong consistency. Option D is wrong because the Cassandra API does not support multi-region writes in Cosmos DB; it is limited to single-region writes, and its consistency model is based on Cassandra's tunable consistency (e.g., QUORUM) rather than Cosmos DB's per-request strong consistency.

Full explanation →
14
Multi-Selecteasy

Your company uses Microsoft Entra ID for identity management. You need to implement a solution that automatically blocks sign-ins from risky users and requires multi-factor authentication (MFA) when a sign-in risk is detected. Which TWO services should you use? (Choose two.)

Select 2 answers
A.Microsoft Purview
B.Microsoft Entra ID Protection
C.Microsoft Defender XDR
D.Microsoft Intune
E.Conditional Access policies
AnswersB, E

Microsoft Entra ID Protection is the dedicated identity risk engine that continuously analyzes user and sign-in behavior using signals such as leaked credentials, impossible travel, anomalous token usage, and unfamiliar properties. It calculates user risk and sign-in risk levels and automatically remediates or responds to these risks by requiring MFA or password change, or by blocking access via Conditional Access policies. This makes it the correct service for detecting risky users and risky sign-ins in a Microsoft Entra ID environment.

Why this answer

Microsoft Entra ID Protection (B) is the service that detects sign-in risks (e.g., anonymous IP, atypical travel) and labels users or sign-ins as risky. Conditional Access policies (E) then enforce automated responses, such as blocking the sign-in or requiring MFA, based on the risk level from Entra ID Protection. Together, they provide the detection and enforcement mechanism described in the requirement.

Exam trap

The trap here is that candidates often confuse Microsoft Defender XDR (which includes identity threat detection) with the policy enforcement layer, but only Conditional Access policies can apply the automated MFA or block action based on risk from Entra ID Protection.

Full explanation →
15
MCQmedium

A company uses Microsoft Entra ID. They want to grant a user temporary access to the Global Administrator role for a specific task. The access must require approval from a manager and automatically expire after 4 hours. Which Microsoft Entra ID feature should they use?

A.Microsoft Entra ID Conditional Access
B.Microsoft Entra ID Identity Protection
C.Microsoft Entra ID Privileged Identity Management (PIM)
D.Microsoft Entra ID Access Reviews
AnswerC

Microsoft Entra ID Privileged Identity Management (PIM) is the correct service because it enables just-in-time, time-bound activation of privileged Entra ID roles. With PIM, you can make a user eligible for a role, and the user can activate it for a configured maximum duration, optionally requiring business justification and approval from designated approvers. Once the activation time expires, the role is automatically deactivated, so the user no longer has the elevated permissions. PIM also provides audit logs and access reviews, but its core value is exactly the time-limited, approval-based elevation scenario described in the requirement.

Why this answer

Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access, allowing users to activate roles like Global Administrator for a limited time. It supports approval workflows (manager approval) and configurable activation duration (e.g., 4 hours), making it the correct choice for temporary, approved, time-bound role elevation.

Exam trap

The trap here is confusing PIM's JIT activation with Conditional Access policies, which control access to applications but not role elevation, or with Access Reviews, which are for periodic recertification rather than temporary activation.

How to eliminate wrong answers

Option A is wrong because Conditional Access enforces policies based on signals like location or device state to control access to resources, but it does not provide time-bound role activation or approval workflows for privileged roles. Option B is wrong because Identity Protection detects and remediates identity-based risks (e.g., leaked credentials, sign-in anomalies) and does not manage role activation or approval. Option D is wrong because Access Reviews automate periodic attestation of group memberships or role assignments but do not support on-demand, temporary activation with approval and automatic expiration.

Full explanation →
16
MCQhard

Refer to the exhibit. An administrator configured Azure Site Recovery for a VM. The replication is ongoing but the health shows a warning. What is the most likely cause?

A.The recovery point retention is set to 5 days, causing storage issues.
B.The replication provisioning state failed.
C.The Azure Site Recovery service does not have sufficient permissions to access the source VM or storage account.
D.The replication interval is set to 15 minutes, exceeding the required RPO.
AnswerC

Error 0x80070005 is an access denied error, indicating a permissions issue.

Why this answer

Error code 0x80070005 indicates an access denied error, meaning the Azure Site Recovery service does not have sufficient permissions to access the source VM or storage account. Option A is wrong because the recovery point retention is set to 1440 minutes (24 hours), not 5 days. Option B is wrong because the provisioning state is Succeeded, so there is no provisioning failure.

Option D is wrong because the replication frequency is set to 300 seconds, which means a 5-minute RPO, not 15 minutes.

Full explanation →
17
MCQmedium

Refer to the exhibit. The JSON shows role assignments for user1. The role definition IDs are: b24988ac-6180-42a0-ab88-20f7382dd24c = Key Vault Secrets User, 8e3af657-a8ff-443c-a75c-2fe8c4bcb635 = Reader. User1 reports being unable to list secrets in the key vault 'vault-prod' using Azure CLI. What is the most likely cause?

A.User1 does not have any role assignment on the key vault
B.The Key Vault Secrets User role does not include the ability to list secrets
C.User1 must have the Contributor role on the key vault
D.The Reader role at resource group scope overrides the vault role
AnswerB

The role only allows reading secret values, not listing.

Why this answer

The Key Vault Secrets User role (b24988ac-6180-42a0-ab88-20f7382dd24c) grants permissions only to read secret values and metadata, but it does not include the 'list' action on secrets. To list secrets in a key vault, a role such as Key Vault Secrets Officer or a custom role with Microsoft.KeyVault/vaults/secrets/read action is required. Since User1 only has the Key Vault Secrets User role on the vault, they cannot execute the 'az keyvault secret list' command.

Exam trap

The trap here is that candidates assume the Key Vault Secrets User role can list secrets because it can read secret values, but Azure RBAC distinguishes between reading a specific secret and enumerating all secrets in a vault.

How to eliminate wrong answers

Option A is wrong because User1 does have a role assignment on the key vault (Key Vault Secrets User at vault scope), as shown in the JSON exhibit. Option C is wrong because the Contributor role is not required; a role with the 'list' permission on secrets, such as Key Vault Secrets Officer, would suffice. Option D is wrong because the Reader role at resource group scope does not override the vault-specific role; Azure RBAC uses additive permissions, and the Reader role at a higher scope does not remove permissions granted at a lower scope.

Full explanation →
18
MCQeasy

A company uses Microsoft Entra ID. They need to grant external partners access to an internal application for a limited time (30 days). The access must be approved by a manager from the partner's organization. After the period ends, access should automatically be removed. The company also wants to send email reminders 7 days before expiration. Which Microsoft Entra ID feature should they use?

A.Microsoft Entra ID Access Reviews
B.Microsoft Entra ID Entitlement Management
C.Microsoft Entra ID Conditional Access
D.Microsoft Entra ID Identity Protection
AnswerB

Entitlement Management provides access packages that can define time-limited access, require approval from specified managers, automatically expire, and send email notifications before expiration.

Why this answer

Microsoft Entra ID Entitlement Management is the correct feature because it provides automated access lifecycle management for external users, including time-limited access packages, approval workflows (including external manager approval), and automatic expiration with email notifications. This directly matches the requirement for 30-day access with partner manager approval and 7-day reminder emails.

Exam trap

The trap here is confusing Entitlement Management (which handles the full lifecycle of external access with expiration and approvals) with Access Reviews (which is a periodic review tool, not an automated expiration mechanism).

How to eliminate wrong answers

Option A is wrong because Access Reviews are a periodic attestation mechanism that requires manual or semi-automated review cycles, not a one-time 30-day expiration with automatic removal and email reminders. Option C is wrong because Conditional Access enforces access policies (e.g., MFA, device compliance) in real time but does not manage access expiration, approval workflows, or automated email reminders. Option D is wrong because Identity Protection focuses on detecting and remediating identity-based risks (e.g., leaked credentials, sign-in anomalies) and does not handle external partner access lifecycle or time-bound approvals.

Full explanation →
19
Multi-Selectmedium

A company is designing a solution for storing sensitive financial records that must be retained for 7 years. The solution must meet the following requirements: - Data must be immutable during the retention period. - After the retention period, data must be automatically deleted. - The solution must minimize storage costs. Which two Azure services should the company use? (Choose two.)

Select 2 answers
A.Microsoft Purview Data Map
B.Azure Blob Storage lifecycle management
C.Azure NetApp Files with replication
D.Azure Blob Storage with immutable storage policy
E.Azure Files with snapshots
AnswersB, D

Azure Blob Storage lifecycle management automatically transitions blobs to Cool, Cold, or Archive tiers and executes user-defined deletion rules based on blob age, last modification, or index tags. For sensitive financial records that must be purged after a regulatory retention window, a lifecycle rule with an 'expire' action removes the blobs at the exact scheduled time, providing a cost-effective, fully managed deletion mechanism without manual cleanup.

Why this answer

Azure Blob Storage lifecycle management (B) is correct because it allows you to define rules to automatically delete blobs after a specified period, such as 7 years, minimizing storage costs by tiering or expiring data. Azure Blob Storage with immutable storage policy (D) is correct because it enforces WORM (Write Once, Read Many) immutability, preventing data modification or deletion during the retention period, which is essential for sensitive financial records.

Exam trap

The trap here is that candidates may think a single service like immutable storage alone handles deletion, but they overlook that immutability prevents deletion unless explicitly combined with lifecycle management to trigger automatic removal after the retention period ends.

Full explanation →
20
MCQhard

A company runs a mission-critical application on Azure virtual machines (VMs) in the West US region. The application consists of multiple VMs that must be recovered in a specific order during a disaster: database VM first, then application VMs, then web VMs. They also require that after failover to East US, the VMs retain their private IP addresses to avoid DNS updates. The recovery point objective (RPO) is 5 minutes and recovery time objective (RTO) is 30 minutes. The company needs to perform quarterly disaster recovery tests without impacting production. Which combination of Azure Site Recovery features should they configure?

A.Use crash-consistent replication, recovery plans with manual ordering, and target network with same IP address range
B.Use app-consistent replication, recovery plans with pre/post scripts for ordering, and static IP address assignment in failover settings
C.Use multi-VM consistency groups, recovery plans with automation runbooks, and Azure Traffic Manager to redirect traffic
D.Use application-consistent replication, recovery plans with pre/post scripts for ordering, and target network with different IP address range and DNS updates
AnswerB

App-consistent replication uses VSS on Windows or equivalent application quiescing on Linux to flush memory and pending I/O, producing a recovery point that is both VM-consistent and application-consistent, which is essential for a mission-critical database and supports an RPO of seconds. Recovery plans with pre/post scripts automate the ordering of failover steps, such as starting dependent applications or running validation scripts, eliminating manual sequencing delays. Static IP address assignment in the failover settings republishes the original private IPs on the target subnet, satisfying the explicit IP-retention requirement without DNS changes. This combination delivers the required data integrity, automated orchestration, and network continuity.

Why this answer

The requirement for an RPO of 5 minutes and RTO of 30 minutes necessitates application-consistent replication, which ensures database and application integrity. The need to recover VMs in a specific order is met by recovery plans with pre/post scripts, which allow custom actions (e.g., starting the database VM first, then application, then web). Static IP address assignment in failover settings ensures that VMs retain their private IP addresses after failover to East US, avoiding DNS updates.

Exam trap

The trap here is that candidates often confuse crash-consistent replication (which is faster but not application-safe) with application-consistent replication, or they assume that manual ordering in recovery plans is sufficient without realizing that pre/post scripts are required for complex multi-tier dependencies and that static IP assignment is needed to retain IP addresses across regions.

How to eliminate wrong answers

Option A is wrong because crash-consistent replication cannot achieve a 5-minute RPO for a mission-critical application with database VMs, as it does not guarantee application consistency; also, manual ordering in recovery plans is not sufficient for complex multi-tier recovery sequences. Option C is wrong because multi-VM consistency groups ensure crash consistency across VMs but do not provide the application-consistent replication needed for the 5-minute RPO, and Azure Traffic Manager is for traffic routing, not for retaining private IP addresses or ordering recovery. Option D is wrong because using a target network with a different IP address range and DNS updates contradicts the requirement to retain private IP addresses to avoid DNS updates.

Full explanation →
21
MCQmedium

A gaming company is developing a multiplayer online game that requires a low-latency data store for player profiles, inventory, and session state. The data is accessed globally, and the solution must support millions of concurrent players. The company expects write-heavy workloads with occasional reads. The solution must provide single-digit millisecond latency for reads and writes. The company also needs to run analytics on the data to understand player behavior, but analytics queries can tolerate higher latency (minutes). Which Azure data storage solution should the company recommend for the transactional data?

A.Azure SQL Database with active geo-replication
B.Azure Redis Cache with persistence
C.Azure Cosmos DB with multiple write regions
D.Azure Table Storage with geo-redundancy
AnswerC

Azure Cosmos DB with multiple write regions (multi-master) enables every region to accept writes, and each write is replicated asynchronously to all other regions with conflict resolution policies (e.g., last-writer-wins, custom). This delivers single-digit-millisecond read and write latencies at the 99th percentile anywhere in the world because the client can target the nearest region for both reads and writes. The service provides 99.999% availability with SLAs, automatic failover, and a choice of consistency levels, making it the correct fit for globally distributed, always-on multiplayer game state.

Why this answer

Azure Cosmos DB with multiple write regions is the correct choice because it provides global distribution with multi-master writes, delivering single-digit millisecond latency for both reads and writes at any scale. It supports millions of concurrent players via automatic and elastic scaling, and its change feed enables analytics with higher latency tolerance by streaming data to Azure Synapse or HDInsight without impacting transactional performance.

Exam trap

The trap here is that candidates often choose Azure Redis Cache (Option B) because of its low latency, but they overlook that it is a cache, not a durable transactional store, and cannot serve as the primary data store for player profiles and inventory with global write-heavy workloads.

How to eliminate wrong answers

Option A is wrong because Azure SQL Database with active geo-replication supports only a single writable primary, creating a bottleneck for write-heavy global workloads, and its latency for writes can exceed single-digit milliseconds due to synchronous replication overhead. Option B is wrong because Azure Redis Cache with persistence is an in-memory cache, not a durable transactional data store; it lacks native support for complex queries, indexing, and global multi-write replication, and its persistence model can introduce data loss or higher latency under write-heavy loads. Option D is wrong because Azure Table Storage with geo-redundancy offers eventual consistency and higher latency (typically 10-50 ms) for writes, lacks native multi-region write support, and does not provide the single-digit millisecond latency required for real-time player interactions.

Full explanation →
22
MCQhard

A company has multiple Azure virtual networks (VNets) in different regions and an on-premises data center connected via ExpressRoute. They need to implement a hub-and-spoke topology where a hub VNet hosts shared network virtual appliances (NVAs) for traffic inspection. All traffic between spokes and between spokes and on-premises must be routed through the hub. The company wants to minimize the administrative overhead of configuring and maintaining routing. Which Azure solution should they implement?

A.Use Azure Virtual WAN with a secured virtual hub.
B.Use VNet peering with user-defined routes (UDRs) in each spoke and Azure Route Server.
C.Create a single large VNet and use network security groups (NSGs) to isolate traffic.
D.Use Azure Firewall in the hub VNet and configure forced tunneling via custom routes.
AnswerA

Azure Virtual WAN provides a managed hub-and-spoke architecture with automatic routing. A secured virtual hub can integrate NVAs or Azure Firewall, and it handles transitive routing between spokes and on-premises without manual route tables or UDRs.

Why this answer

Azure Virtual WAN with a secured virtual hub is the correct choice because it provides a managed hub-and-spoke topology with built-in routing, eliminating the need for manual user-defined routes (UDRs) and route tables. The secured virtual hub includes Azure Firewall for traffic inspection, and all inter-spoke and on-premises traffic is automatically routed through the hub via the Virtual WAN routing engine, which uses the Border Gateway Protocol (BGP) to propagate routes dynamically. This minimizes administrative overhead by centralizing routing and security management.

Exam trap

The trap here is that candidates often choose VNet peering with UDRs (Option B) because it is a familiar pattern for hub-and-spoke, but they overlook that Azure Virtual WAN is the managed service designed to eliminate the administrative overhead of manual routing, especially when multiple regions and on-premises connectivity are involved.

How to eliminate wrong answers

Option B is wrong because using VNet peering with UDRs in each spoke and Azure Route Server still requires manual configuration and maintenance of UDRs for each spoke to force traffic through the hub NVAs, which increases administrative overhead and does not provide a fully managed routing solution. Option C is wrong because creating a single large VNet and using NSGs to isolate traffic violates the hub-and-spoke requirement for traffic inspection through NVAs; NSGs are stateless or stateful filters that do not route traffic through a central inspection point, and a single VNet cannot span multiple regions natively without additional complexity. Option D is wrong because using Azure Firewall in the hub VNet with forced tunneling via custom routes still requires manual UDR configuration on each spoke subnet to direct traffic to the firewall, and it does not provide the automated, scalable routing that Azure Virtual WAN offers for multi-region and on-premises connectivity.

Full explanation →
23
MCQmedium

A global e-commerce company runs a web application in multiple Azure regions. They need to distribute incoming HTTPS traffic across regional deployments to provide low latency and high availability. The solution must support SSL offloading, Web Application Firewall (WAF) policies, and content caching to reduce backend load. They also need to route users to the nearest healthy backend region. Which Azure service should they use?

A.Azure Traffic Manager
B.Azure Front Door
C.Azure Application Gateway
D.Azure Content Delivery Network (CDN)
AnswerB

Azure Front Door is the correct choice because it is a true global layer 7 load balancer that terminates TLS at its edge points of presence, offloading encryption processing from the origin web servers. It includes an integrated web application firewall (WAF) capable of inspecting requests before they reach backend applications, and it offers edge caching for static and dynamic content. Additionally, Front Door uses Anycast and intelligent routing to direct each user's request to the nearest available and healthy regional backend, providing automatic global failover and path-based routing that satisfy all requirements of a multi-region e-commerce deployment.

Why this answer

Azure Front Door is the correct choice because it is a global, scalable entry point that provides HTTPS traffic distribution across multiple Azure regions with low latency, SSL offloading, WAF policies, and content caching. It uses Anycast-based routing to direct users to the nearest healthy backend region, meeting all the requirements for high availability and performance.

Exam trap

The trap here is that candidates often confuse Azure Traffic Manager (DNS-level routing) with Azure Front Door (HTTP/HTTPS-level routing), overlooking the need for SSL offloading, WAF, and content caching, which Traffic Manager cannot provide.

How to eliminate wrong answers

Option A (Azure Traffic Manager) is wrong because it operates at the DNS level and does not support SSL offloading, WAF policies, or content caching; it only routes traffic based on DNS responses without inspecting the HTTP/HTTPS payload. Option C (Azure Application Gateway) is wrong because it is a regional load balancer that provides SSL offloading and WAF, but it cannot distribute traffic across multiple regions or route users to the nearest healthy backend region globally. Option D (Azure Content Delivery Network (CDN)) is wrong because it focuses on caching static content at edge locations and does not provide SSL offloading, WAF, or intelligent routing to the nearest healthy backend region for dynamic traffic.

Full explanation →
24
MCQmedium

A company runs a critical SQL Server database on an Azure virtual machine in the West US region. They need a disaster recovery solution that replicates the database to a secondary region (East US) with a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. The solution must also support non-disruptive disaster recovery drills. The company currently uses SQL Server Standard Edition. Which Azure service should they implement?

A.Azure Site Recovery
B.SQL Server Always On Availability Groups
C.Azure Backup with cross-region restore
D.Azure SQL Database geo-replication
AnswerA

Azure Site Recovery replicates the entire Azure VM at the block level to a secondary region, achieving an RPO as low as 30 seconds for SQL Server when app-consistent snapshots are enabled through the SQL Server VSS writer. It provides a dedicated test failover capability that provisions the replica in an isolated VNet without any impact on production, fully satisfying the non-disruptive drill requirement. ASR works with SQL Server Standard Edition on IaaS and supports orchestrated recovery plans for multi-tier failover, making it the only option here that meets all stated RPO/RTO criteria with minimal operational overhead.

Why this answer

Azure Site Recovery (ASR) replicates the entire VM, including the SQL Server database, to the secondary region with an RPO as low as 15 minutes and an RTO of 2 hours when using a recovery plan. It supports non-disruptive disaster recovery drills by allowing test failovers that run in an isolated network without impacting the production environment. This makes ASR the correct choice for a SQL Server Standard Edition VM requiring cross-region DR with drills.

Exam trap

The trap here is that candidates often choose SQL Server Always On Availability Groups without realizing that Standard Edition lacks the necessary features (e.g., readable secondaries, multi-database support) to meet the RPO/RTO and drill requirements, or they mistakenly think Azure SQL Database geo-replication can be applied to a SQL Server VM.

How to eliminate wrong answers

Option B is wrong because SQL Server Always On Availability Groups requires SQL Server Enterprise Edition for the advanced features needed to meet the RPO/RTO, and Standard Edition only supports basic availability groups with a single database and no readable secondaries, which cannot achieve the required 15-minute RPO or support non-disruptive drills. Option C is wrong because Azure Backup with cross-region restore provides point-in-time backups with an RPO of typically 12-24 hours (not 15 minutes) and an RTO that can exceed 2 hours due to restore time, plus it does not support live, non-disruptive disaster recovery drills. Option D is wrong because Azure SQL Database geo-replication is a PaaS feature that cannot be applied to a SQL Server running on an Azure VM (IaaS); it only works with Azure SQL Database managed instances or single databases.

Full explanation →
25
MCQhard

You are designing a disaster recovery strategy for an Azure virtual machine running a SQL Server Always On availability group. The primary region is East US, and the secondary region is West US. You need to ensure minimal data loss and automatic failover. Which Azure service should you use for cross-region replication of the managed disks?

A.Azure Traffic Manager
B.Azure Site Recovery
C.Azure Backup
D.Azure Storage Geo-Redundant Storage (GRS)
AnswerB

Azure Site Recovery replicates Azure VMs and supports automatic failover with low RPO.

Why this answer

Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs across regions. For a SQL Server Always On availability group, ASR can replicate the managed disks at the VM level, enabling automatic failover to the West US region with minimal data loss by using crash-consistent or app-consistent recovery points. This meets the requirement for cross-region replication with automatic failover, unlike storage-level replication which does not provide orchestrated failover.

Exam trap

The trap here is that candidates often confuse Azure Site Recovery with Azure Backup or geo-redundant storage, assuming that storage-level replication (GRS) provides automatic VM failover, when in fact GRS only replicates blobs asynchronously and does not orchestrate compute or application failover.

How to eliminate wrong answers

Option A is wrong because Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming traffic based on routing methods (e.g., priority, performance), but it does not replicate data or disks; it cannot provide disaster recovery for managed disks. Option C is wrong because Azure Backup provides backup and restore capabilities for VMs and disks, but it is not designed for continuous replication or automatic failover; it requires manual restore and does not meet the minimal data loss and automatic failover requirements. Option D is wrong because Azure Storage Geo-Redundant Storage (GRS) replicates storage accounts to a paired region asynchronously, but it operates at the storage account level, not at the managed disk level for a VM, and it does not provide orchestrated failover of the VM or the SQL Server availability group.

Full explanation →
26
MCQmedium

A company runs critical Azure VMs. They want to protect against accidental deletion or corruption of data by implementing a retention policy for Azure Backup. They need to keep daily backups for 30 days, weekly backups for 12 weeks, and monthly backups for 12 months. Which Azure Backup feature should they configure?

A.Immutable vault
B.Backup policy with long-term retention
C.Backup tiering
D.Soft delete
AnswerB

A backup policy in Azure Backup is the mechanism that defines both the backup frequency (when recovery points are created) and the retention rules that govern how long each recovery point is kept. By specifying a daily backup with 30 days retention, a weekly backup with 12 weeks retention, and a monthly backup with 12 months retention, the policy can create and automatically prune recovery points according to these exact schedules. This directly satisfies the stated requirement for different retention durations across daily, weekly, and monthly recovery points.

Why this answer

A backup policy with long-term retention (LTR) in Azure Backup allows you to define granular retention rules for daily, weekly, monthly, and yearly backup points. This directly meets the requirement to keep daily backups for 30 days, weekly for 12 weeks, and monthly for 12 months by configuring the retention duration for each frequency in the backup policy.

Exam trap

The trap here is that candidates confuse Immutable vault or Soft delete with retention policies, but those features address data protection from deletion or tampering, not the ability to specify granular retention durations for different backup frequencies.

How to eliminate wrong answers

Option A is wrong because Immutable vault protects backup data from being deleted or overwritten before its retention period expires, but it does not provide the ability to configure different retention durations for daily, weekly, and monthly backups. Option C is wrong because Backup tiering moves older recovery points to a lower-cost storage tier (e.g., from hot to cold or archive), but it does not define or enforce retention durations; it is a cost-optimization feature, not a retention policy. Option D is wrong because Soft delete provides a safety net by retaining deleted backup data for a default period (14 days) to allow recovery from accidental deletion, but it does not allow you to specify custom retention periods like 30 days daily, 12 weeks weekly, or 12 months monthly.

Full explanation →
27
MCQmedium

A company has multiple on-premises sites and Azure VNets in different regions. They need to connect all networks with a single mesh topology, ensuring that any network can communicate with any other network directly. They also want to minimize administrative overhead. Which Azure service should they use?

A.Azure Virtual WAN
B.Azure VPN Gateway
C.Azure ExpressRoute
D.Azure Peering Service
AnswerA

Azure Virtual WAN is the correct choice because it provides a cloud-native mesh connectivity solution built on a hub-and-spoke architecture with regional hubs. It automates the creation of any-to-any connections between branch offices, remote users, and VNets, with integrated routing that eliminates the need to manually configure individual VPN tunnels or peer each VNet. Virtual WAN uses the Microsoft backbone for transit, ensuring consistent low-latency routing across regions and on-premises sites, and supports both Site-to-Site VPN and ExpressRoute in a single managed topology.

Why this answer

Azure Virtual WAN is the correct choice because it provides a managed, global mesh network that automatically connects on-premises sites and Azure VNets across regions using a hub-and-spoke architecture with built-in transitive routing. This eliminates the need to manually configure individual VPN gateways or ExpressRoute circuits for each pair of networks, directly supporting the requirement for any-to-any direct communication with minimal administrative overhead.

Exam trap

The trap here is that candidates often confuse Azure VPN Gateway's ability to create multiple site-to-site connections with a true mesh topology, overlooking that VPN Gateway lacks automatic transitive routing and requires manual configuration for any-to-any connectivity, whereas Virtual WAN provides this natively.

How to eliminate wrong answers

Option B (Azure VPN Gateway) is wrong because it only creates point-to-site or site-to-site connections between individual networks; it does not natively support a full mesh topology without complex, manual configuration of multiple VPN tunnels and route tables, which increases administrative overhead. Option C (Azure ExpressRoute) is wrong because it provides private, dedicated connectivity between on-premises sites and Azure, but it does not inherently create a mesh between multiple on-premises sites or VNets; additional routing and gateway configurations are required to achieve transitive connectivity. Option D (Azure Peering Service) is wrong because it is designed to optimize connectivity to Microsoft cloud services over the internet, not to create a mesh network between customer-owned on-premises sites and Azure VNets.

Full explanation →
28
MCQmedium

A multinational company stores large amounts of unstructured data (documents, images) that must be read with low latency from multiple global regions. Data is written primarily in one region but read globally. Cost optimization is a key requirement. Which Azure storage replication option should they use?

A.Azure Blob Storage with geo-redundant storage (GRS)
B.Azure Blob Storage with read-access geo-redundant storage (RA-GRS)
C.Azure Files with premium shares
D.Azure NetApp Files
AnswerB

RA-GRS extends GRS by providing a read-only endpoint at the secondary region, so clients can retrieve data directly from the geo-replicated copy without waiting for a failover. This lets the storage account serve low-latency reads in both the primary and the paired secondary regions while still using standard, cost-effective blob storage rather than premium tiers. Note that the secondary is eventually consistent, and there can be a slight replication delay, but for most unstructured content such as documents and media this is an acceptable trade-off.

Why this answer

B is correct because RA-GRS provides geo-redundant storage with read access to the secondary region, enabling low-latency reads from multiple global regions while maintaining cost efficiency. The data is written primarily in one region, but RA-GRS allows read requests to be served from the secondary region without additional compute costs, meeting the global read requirement.

Exam trap

The trap here is that candidates often confuse GRS with RA-GRS, assuming geo-redundancy alone provides read access to the secondary region, but GRS requires a manual failover to enable reads, while RA-GRS allows reads from the secondary region at all times.

How to eliminate wrong answers

Option A is wrong because GRS provides geo-redundant storage but does not allow read access to the secondary region, so reads from other regions would still be served from the primary region, increasing latency. Option C is wrong because Azure Files with premium shares is designed for high-performance file shares with low latency but uses locally redundant storage (LRS) or zone-redundant storage (ZRS), not geo-replication, and is cost-prohibitive for large-scale unstructured data. Option D is wrong because Azure NetApp Files is a high-performance file service for enterprise workloads (e.g., SAP, HPC) with NFS/SMB protocols, not optimized for cost-effective global read access of unstructured data, and uses LRS or ZRS by default.

Full explanation →
29
MCQmedium

Your company runs a critical workload on Azure Virtual Machines in a single region. You need to design a disaster recovery solution that meets a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. The solution should minimize cost. What should you recommend?

A.Configure Azure Backup with geo-redundant storage.
B.Deploy an active-passive pair of VMs using SQL Server Always On availability groups.
C.Use Azure Storage with read-access geo-redundant storage (RA-GRS) and failover the VMs.
D.Implement Azure Site Recovery with replication to a secondary region.
AnswerD

Azure Site Recovery (ASR) is purpose-built for disaster recovery of Azure VMs, replicating the entire VM to a secondary region with an RPO that can be as low as 15 seconds and typically well under the required 15 minutes. It provides crash-consistent and app-consistent snapshot replication, automated failover, failback, and recovery plans, enabling predictable RTO. This makes ASR the correct, cost-effective option that fully satisfies the stated 15-minute RPO requirement.

Why this answer

Azure Site Recovery (ASR) provides continuous replication of Azure VMs to a secondary region, enabling failover within minutes. With replication intervals as low as 30 seconds for crash-consistent and 5 minutes for app-consistent snapshots, it comfortably meets the 15-minute RPO, and the orchestrated failover process can achieve the 1-hour RTO. ASR is the native Azure service designed for this exact scenario, minimizing cost by only charging for replication traffic and storage in the secondary region.

Exam trap

The trap here is that candidates confuse Azure Backup (which is for backup/restore) with Azure Site Recovery (which is for disaster recovery/failover), assuming that geo-redundant storage alone can provide VM-level DR, when in fact it only protects storage data, not compute or application state.

How to eliminate wrong answers

Option A is wrong because Azure Backup is designed for long-term retention and point-in-time restore, not for rapid failover; its RTO is typically measured in hours or days, not 1 hour, and it does not provide continuous replication to meet a 15-minute RPO. Option B is wrong because SQL Server Always On availability groups are a database-level HA/DR solution that only protects SQL Server workloads, not the entire VM or other applications, and it requires significant licensing and infrastructure costs. Option C is wrong because RA-GRS is a storage redundancy option that provides read-only access to data in a secondary region; it does not replicate the VM configuration, operating system, or application state, and failover of VMs is not supported by this service.

Full explanation →
30
MCQeasy

A software company runs 50 small Azure SQL databases for different clients. Each database has low average usage but unpredictable spikes. The company wants to minimize cost while providing resources for peak loads and easily adding new databases without manual sizing. Which Azure data service should they use?

A.Azure SQL Database single databases
B.Azure SQL Database elastic pool
C.Azure SQL Managed Instance
D.SQL Server on Azure Virtual Machines
AnswerB

Azure SQL Database elastic pools distribute a shared pool of eDTUs or vCores across many databases, allowing each database to burst beyond its guaranteed minimum without a dedicated allocation. This statistical multiplexing is ideal for 50 small databases with variable, low average utilization because you pay only for the pooled resources actually needed, not the sum of individual peak demands. By configuring per-database min and max limits, you protect individual tenants while maximizing overall cost efficiency.

Why this answer

Azure SQL Database elastic pool is ideal for multiple databases with low average usage and unpredictable spikes because it allows them to share a fixed set of resources (eDTUs or vCores). This pooling model minimizes cost by only paying for the aggregate peak usage across all databases, not each database's individual peak, and automatically handles resource allocation without manual sizing for new databases.

Exam trap

The trap here is that candidates often choose single databases (Option A) thinking they can scale individually for spikes, but they overlook the cost inefficiency of provisioning each database for its peak load versus sharing resources in an elastic pool.

How to eliminate wrong answers

Option A is wrong because Azure SQL Database single databases would require each database to be sized for its own peak load, leading to over-provisioning and higher costs for 50 low-usage databases with spikes. Option C is wrong because Azure SQL Managed Instance is a fully managed instance of SQL Server with fixed resources, designed for lift-and-shift migrations, not for cost-efficient multi-tenant scenarios with variable loads. Option D is wrong because SQL Server on Azure Virtual Machines requires manual VM sizing, patching, and management, increasing operational overhead and cost, and does not provide the automatic resource sharing needed for unpredictable spikes.

Full explanation →
31
MCQmedium

A startup is building a social media analytics platform that processes streaming data. They need a data store for time-series events with high write throughput and fast timestamp-based range queries. Which Azure data store is most suitable for this workload?

A.Azure Cosmos DB with SQL API
B.Azure SQL Database with columnstore index
C.Azure Table Storage
D.Azure Data Lake Storage Gen2
AnswerC

Azure Table Storage is a schema-less key-value store where data is addressed by PartitionKey and RowKey, making it a natural fit for IoT-style time-series data. Using a partition key such as device ID and a row key such as inverted timestamp allows efficient range scans for a given device over a time window, while inserts are cheap and highly parallel across partitions. This design delivers low latency at very low cost without the operational complexity of a SQL-based service, which is why it is the correct recommendation.

Why this answer

Azure Table Storage is a NoSQL key-value store that supports high-volume, low-latency writes and efficient range queries on the PartitionKey and RowKey, which can be structured as a timestamp for time-series data. Its schema-less design and ability to scale to massive throughput without sharding overhead make it ideal for streaming event ingestion and timestamp-based retrieval.

Exam trap

The trap here is that candidates often choose Cosmos DB for its flexibility and global distribution, but for a simple, high-throughput time-series workload with timestamp-based queries, Azure Table Storage is the most cost-effective and performant choice, as Cosmos DB adds unnecessary complexity and cost.

How to eliminate wrong answers

Option A is wrong because Azure Cosmos DB with SQL API, while supporting time-series patterns, introduces higher latency and cost for simple key-value workloads compared to Table Storage, and its throughput is provisioned per container, requiring careful RU management that adds complexity for high-write streaming. Option B is wrong because Azure SQL Database with columnstore index is optimized for analytical queries on large datasets, not for high-write throughput of individual streaming events; its transactional overhead and indexing costs make it unsuitable for real-time ingestion. Option D is wrong because Azure Data Lake Storage Gen2 is a hierarchical file system designed for big data analytics and batch processing, not for low-latency point writes or timestamp-based range queries on individual events.

Full explanation →
32
MCQmedium

A company runs a critical OLTP application on Azure SQL Database in the West US region. They need to ensure business continuity if a regional outage occurs. The solution must have a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of less than 1 hour. They also want to use the secondary region for read-only query offloading. Which Azure SQL Database feature should they enable?

A.Active geo-replication with automatic failover group
B.Geo-restore
C.Azure Site Recovery
D.Read scale-out with manual regional failover
AnswerA

Active geo-replication continuously pushes transactions to a readable secondary in a paired region, achieving a recovery point objective (RPO) of about 5 seconds and an RTO under one hour. When paired with an auto-failover group, outage detection and promotion of the secondary are automated, so the critical OLTP workload can resume without manual intervention and the secondary can also serve read-only queries during normal operation. This combination directly satisfies both the low data-loss and fast-recovery requirements.

Why this answer

Active geo-replication with automatic failover groups is the correct choice because it provides continuous asynchronous data replication to a secondary Azure SQL Database in a paired region, achieving an RPO of 5 seconds and an RTO of under 1 hour. The automatic failover group enables coordinated failover of multiple databases and allows the secondary region to be used for read-only query offloading by connecting with ApplicationIntent=ReadOnly.

Exam trap

The trap here is that candidates confuse geo-restore (backup-based) with active geo-replication (continuous replication), or assume read scale-out can span regions, when in fact it only works within the same Azure region.

How to eliminate wrong answers

Option B (Geo-restore) is wrong because it restores a database from geo-replicated backups with an RPO of 1 hour and an RTO of 12+ hours, failing the 5-second RPO and 1-hour RTO requirements. Option C (Azure Site Recovery) is wrong because it is designed for IaaS VM replication, not for PaaS Azure SQL Database, and cannot meet the 5-second RPO or provide read-only query offloading. Option D (Read scale-out with manual regional failover) is wrong because read scale-out only offloads read-only queries using a readable secondary replica within the same region, not in a secondary region, and manual failover does not meet the automated RTO of under 1 hour.

Full explanation →
33
MCQeasy

A company deploys a web application on multiple Azure VMs. They need to distribute incoming HTTP traffic across the VMs, offload SSL/TLS termination, and maintain session persistence (sticky sessions) so that all requests from a user session go to the same backend VM. Which Azure load balancing solution should they use?

A.Azure Application Gateway
B.Azure Load Balancer
C.Azure Traffic Manager
D.Azure Front Door
AnswerA

Azure Application Gateway is a dedicated layer-7 (HTTP/HTTPS) load balancer that offers SSL offloading by terminating client SSL connections and re-encrypting traffic to backends if needed. It provides cookie-based session affinity, which ensures a user's requests are consistently routed to the same backend VM—a critical requirement for stateful web applications. Additionally, it supports URL path-based routing and an integrated Web Application Firewall, making it the correct choice for a web application deployed on multiple VMs within a single Azure region.

Why this answer

Azure Application Gateway is a Layer 7 load balancer that can route HTTP/HTTPS traffic, offload SSL/TLS termination, and support session persistence using cookie-based affinity. This makes it the correct choice for distributing incoming HTTP traffic across multiple VMs while maintaining sticky sessions and handling SSL termination at the gateway.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), forgetting that SSL termination and cookie-based sticky sessions require Layer 7 capabilities, not just Layer 4 load balancing.

How to eliminate wrong answers

Option B is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and cannot perform SSL/TLS termination or HTTP-level session persistence; it only supports source IP affinity, which is not cookie-based sticky sessions. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic router that does not handle SSL termination or session persistence; it directs traffic at the DNS level, not at the application layer. Option D is wrong because Azure Front Door is a global Layer 7 load balancer and CDN that can offload SSL and provide session affinity, but it is designed for global distribution across regions, not for distributing traffic within a single region to multiple VMs; using it for regional load balancing would introduce unnecessary latency and complexity.

Full explanation →
34
MCQhard

You run the above PowerShell script to upload a blob to Azure Storage. The script fails with an error: 'The specified container does not exist.' What should you do first to resolve the issue?

A.Create the container using New-AzStorageContainer.
B.Use a different connection string with a SAS token.
C.Grant the storage account key access to the user.
D.Change the -StandardBlobTier parameter to Cool.
AnswerA

The script fails because the target container is not present in the storage account. Azure Blob Storage enforces a strict hierarchy: every blob must reside inside an existing container. The Set-AzStorageBlobContent cmdlet (or equivalent upload command) returns a 404 ContainerNotFound error when the container is missing. Running New-AzStorageContainer with the same storage context and container name creates the required namespace, allowing the upload to succeed.

Why this answer

The error 'The specified container does not exist' indicates that the target container has not been created in the Azure Storage account. The PowerShell script uses the `Set-AzStorageBlobContent` cmdlet, which requires an existing container as the destination. Therefore, the first corrective action is to create the container using `New-AzStorageContainer` before uploading the blob.

Exam trap

The trap here is that candidates may confuse authentication/authorization issues (SAS tokens, key access) with the fundamental prerequisite of container existence, leading them to select options that address permissions rather than the missing resource.

How to eliminate wrong answers

Option B is wrong because using a different connection string with a SAS token does not create the missing container; it only changes authentication, and the container still does not exist. Option C is wrong because granting storage account key access to the user addresses permissions, not the absence of the container; the container must exist regardless of access level. Option D is wrong because changing the -StandardBlobTier parameter to Cool affects the blob's access tier, not the existence of the container; the container must be present before any blob can be uploaded.

Full explanation →
35
MCQeasy

A company deploys a web application across multiple Azure VMs in a single region. They want to distribute incoming HTTP traffic evenly across the VMs, offload SSL encryption, and provide a fixed public IP address for clients. Which Azure load balancing solution should they use?

A.Azure Application Gateway
B.Azure Load Balancer
C.Azure Traffic Manager
D.Azure Front Door
AnswerA

Azure Application Gateway is a regional, layer 7 (HTTP/HTTPS) load balancer that terminates client SSL/TLS connections at the gateway, eliminating backend SSL overhead and enabling centralized certificate management. It exposes a single, fixed public VIP for all incoming web traffic, supports cookie-based session affinity, URL-path-based routing, and WebSocket forwarding, making it the natural choice for an HTTP workload spread across multiple VMs in one Azure region. Unlike layer 4 devices, it inspects HTTP headers and can redirect traffic based on host names or paths, so it fully satisfies the requirement for SSL offloading and a stable public IP for the web application.

Why this answer

Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that supports HTTP/HTTPS traffic, SSL termination, and cookie-based session affinity. It can distribute incoming HTTP traffic evenly across VMs, offload SSL encryption to reduce backend processing, and provide a fixed public IP address (VIP) for client access. This aligns with all three requirements: load balancing, SSL offload, and a static public IP.

Exam trap

The trap here is confusing Layer 4 (Azure Load Balancer) with Layer 7 (Application Gateway) capabilities, leading candidates to pick Azure Load Balancer because it is the default choice for distributing traffic across VMs, but it cannot offload SSL or handle HTTP-specific features like session affinity.

How to eliminate wrong answers

Option B (Azure Load Balancer) is wrong because it operates at Layer 4 (TCP/UDP) and cannot perform SSL termination or inspect HTTP traffic; it only forwards packets without understanding application-layer protocols. Option C (Azure Traffic Manager) is wrong because it is a DNS-based traffic router that distributes traffic across regions, not within a single region, and it does not provide a fixed public IP for clients (it uses DNS names) nor offloads SSL. Option D (Azure Front Door) is wrong because it is a global Layer 7 service designed for multi-region scenarios with advanced WAF and acceleration features; it does not provide a fixed public IP for clients (it uses a dynamic anycast IP) and is overkill for a single-region deployment.

Full explanation →
36
MCQmedium

A company is designing a disaster recovery solution for a critical application that runs on Azure VMs in a single region. The RTO is 4 hours, and the RPO is 1 hour. The application uses Azure SQL Database. The company wants to minimize the cost of the disaster recovery solution while meeting the RTO and RPO. You need to recommend a solution. What should you recommend?

A.Use Azure SQL Database active geo-replication for the database and Azure Backup for VMs.
B.Use Azure Backup to back up VMs and Azure SQL Database to a secondary region.
C.Use Azure Traffic Manager to distribute traffic to VMs in multiple regions and Azure SQL Database failover groups.
D.Use Azure Site Recovery to replicate VMs to a secondary region and Azure SQL Database geo-replication for the database.
AnswerD

Azure Site Recovery continuously replicates managed disks of Azure VMs to the paired region with an RPO typically measured in seconds to a few minutes, and it supports automated, testable failover, so the compute tier comfortably meets the 1-hour RPO. Azure SQL Database geo-replication (or failover groups) asynchronously replays committed transactions to a secondary database, providing an RPO of seconds and enabling simple failover for the data tier. This combination covers both compute and data with continuous replication rather than backup or traffic routing, making it the correct DR architecture.

Why this answer

Azure Site Recovery provides orchestrated replication and failover for Azure VMs, meeting the 4-hour RTO with automated recovery plans. Azure SQL Database active geo-replication (or failover groups) enables continuous data synchronization with an RPO of 1 hour. This combination minimizes cost by using only the necessary replication services without over-provisioning resources.

Exam trap

The trap here is that candidates often confuse Azure Backup (long-term backup) with Azure Site Recovery (disaster recovery replication), leading them to choose a backup-only solution that cannot meet the RTO/RPO for rapid failover.

How to eliminate wrong answers

Option A is wrong because Azure Backup for VMs is designed for long-term retention and point-in-time restore, not for rapid failover to a secondary region; its RTO typically exceeds 4 hours for full VM recovery. Option B is wrong because Azure Backup for Azure SQL Database backs up to a secondary region as a backup copy, not as a continuously synchronized replica, so it cannot achieve a 1-hour RPO for disaster recovery failover. Option C is wrong because Azure Traffic Manager handles DNS-level traffic distribution but does not replicate VMs or databases; it requires pre-existing multi-region deployments, which contradicts the single-region design and would increase costs unnecessarily.

Full explanation →
37
MCQeasy

A multinational company uses Microsoft Entra ID. The company has regional IT teams that need to manage users and groups within their respective regions. Each region has a distinct set of users in specific organizational units. The company wants to assign the User Administrator role to regional IT staff, but limit their scope to only the users in their region. Which Microsoft Entra ID feature should they use?

A.Administrative Units
B.Dynamic Groups
C.Microsoft Entra ID B2B
D.Microsoft Entra ID Identity Protection
AnswerA

Administrative Units are the correct approach because they partition a tenant's users, groups, and devices into explicit management boundaries. An administrator can assign a built-in or custom role such as User Administrator or Helpdesk Administrator scoped to a specific Administrative Unit, so regional IT staff see and manage only the objects in their local unit. This gives the desired delegated administration while preventing tenant-wide access.

Why this answer

Administrative Units in Microsoft Entra ID allow you to delegate administrative roles, such as User Administrator, to a specific subset of users and groups defined by organizational boundaries (e.g., region). By creating an Administrative Unit for each region and adding the regional users and groups to it, you can assign the User Administrator role scoped to that unit, ensuring regional IT staff can only manage their own region's identities.

Exam trap

The trap here is that candidates often confuse Administrative Units with Dynamic Groups, thinking that group-based membership scoping is equivalent to role-based administrative scoping, but Dynamic Groups only control group membership, not administrative permissions.

How to eliminate wrong answers

Option B is wrong because Dynamic Groups automatically manage group membership based on user attributes (e.g., department), but they do not provide role-based access control scoping; they cannot restrict administrative permissions to a subset of users. Option C is wrong because Microsoft Entra ID B2B is designed for external collaboration with guest users from partner organizations, not for delegating administrative control over internal users within the same tenant. Option D is wrong because Microsoft Entra ID Identity Protection is a security feature that detects and responds to identity risks (e.g., compromised credentials), and it does not offer any capability to scope administrative roles to specific users or regions.

Full explanation →
38
MCQmedium

A company runs a critical application on Azure Virtual Machines in a single availability set. They want to protect against an entire Azure region failure. They need a recovery time objective (RTO) of 30 minutes and a recovery point objective (RPO) of 15 minutes. Which solution should they use?

A.Azure Backup for VMs with geo-redundant backup storage.
B.Azure Site Recovery to another region.
C.Deploy VMs in an availability zone within the same region.
D.Use Azure managed disks with geo-replication (LRS to GRS).
AnswerB

Azure Site Recovery replicates VMs continuously to a secondary region. It can achieve RPO as low as 15 seconds (with app-consistent snapshots) and RTO of minutes (30 minutes is typical). It supports planned and unplanned failover.

Why this answer

Azure Site Recovery (ASR) provides orchestrated replication, failover, and failback of Azure VMs to a secondary region, enabling a recovery time objective (RTO) of 30 minutes and a recovery point objective (RPO) of 15 minutes as required. ASR replicates VM disks continuously to the target region, and in a regional failure, you can initiate a planned or unplanned failover to bring up the application within the specified RTO/RPO. This is the only option that offers both cross-region disaster recovery and the granular recovery objectives stated.

Exam trap

The trap here is that candidates often confuse Azure Backup (which provides long-term retention with geo-redundancy) with Azure Site Recovery (which provides near-synchronous replication and automated failover), leading them to select Option A despite its inability to meet the strict RTO/RPO requirements.

How to eliminate wrong answers

Option A is wrong because Azure Backup with geo-redundant storage (GRS) is designed for long-term backup and restore, not for rapid failover; its typical RTO is hours or days, not 30 minutes, and it does not support orchestrated cross-region failover. Option C is wrong because deploying VMs in an availability zone within the same region protects against datacenter failures, not an entire Azure region failure, and thus does not meet the requirement for cross-region disaster recovery. Option D is wrong because Azure managed disks with geo-replication (LRS to GRS) is not a supported feature—managed disks use locally redundant storage (LRS) by default and cannot be directly geo-replicated; the misconception is that GRS applies to disks, but it applies only to storage accounts, and even then it does not provide the orchestrated failover or RTO/RPO guarantees of Azure Site Recovery.

Full explanation →
39
MCQmedium

A company uses Microsoft Entra ID B2B collaboration for external partners. They want to enforce that external users must use multi-factor authentication (MFA) and access company resources only from devices that are compliant with Intune policies. Additionally, they need to require a session timeout of 1 hour. Which combination of Microsoft Entra ID features should they use?

A.Configure cross-tenant access settings to trust MFA and device compliance from external organizations, and then create a Conditional Access policy that requires MFA, compliant device, and a session sign-in frequency of 1 hour.
B.Create a Conditional Access policy for external users that requires MFA and compliant device, and set session controls for sign-in frequency. Trusting MFA from external tenants is automatic.
C.Use Microsoft Entra ID Identity Protection to detect risky sessions for external users and require MFA only when risk is high. This will also enforce device compliance automatically.
D.Configure Microsoft Entra ID Privileged Identity Management (PIM) for external users to activate MFA and require compliant device. PIM is for role activation, not for external user access policies.
AnswerA

Cross-tenant access settings in Microsoft Entra ID let you explicitly trust MFA, compliant device, and hybrid Azure AD joined device claims that external organizations assert about their own users. After configuring that inbound trust for the partner tenant, you must create a Conditional Access policy that targets external users and grants access only when MFA is satisfied, a compliant device is reported, and the session sign-in frequency does not exceed one hour. This two-step approach is mandatory because the trust settings establish which claims are honored, while the Conditional Access policy defines the conditions and session controls that are actually enforced at the resource tenant.

Why this answer

Cross-tenant access settings in Microsoft Entra ID allow you to trust MFA and device compliance claims from external organizations, which is necessary when external users bring their own devices. Then, a Conditional Access policy targeting external users can enforce MFA, require compliant device, and set a session sign-in frequency of 1 hour using session controls. This combination ensures that the company's security requirements are met without relying on the external tenant's policies.

Exam trap

The trap here is that candidates assume MFA and device compliance from external users are automatically trusted or can be enforced solely through Conditional Access, forgetting that cross-tenant trust settings must be explicitly configured to accept those claims from the external organization.

How to eliminate wrong answers

Option B is wrong because trusting MFA from external tenants is not automatic; it must be explicitly configured in cross-tenant access settings, otherwise the Conditional Access policy cannot rely on MFA claims from the external user's home tenant. Option C is wrong because Identity Protection detects risk but does not enforce device compliance automatically; it can require MFA based on risk level but cannot mandate compliant device or session timeout. Option D is wrong because Privileged Identity Management (PIM) is designed for just-in-time role activation, not for enforcing MFA, device compliance, or session controls for external user access to resources.

Full explanation →
40
MCQhard

A company has multiple Azure virtual networks (VNets) spread across three Azure regions (West US, East US, and West Europe). They also have an on-premises network connected to East US via ExpressRoute. They need to connect all VNets to each other and to the on-premises network. They require centralized management of routing and the ability to enforce security policies such as forcing all internet-bound traffic from any VNet to pass through a central firewall in East US. Which Azure solution should they implement?

A.VNet peering between all VNets and use route tables for forced tunneling.
B.Azure Virtual WAN with a secured hub in East US.
C.ExpressRoute Global Reach with VNet peering to connect all VNets.
D.VPN gateways with BGP to connect all VNets.
AnswerB

Azure Virtual WAN provides a scalable hub-and-spoke architecture with centralized routing. A secured hub can include a firewall to enforce forced tunneling and security policies. All VNets and on-premises connect to the hub(s), simplifying management.

Why this answer

Azure Virtual WAN with a secured hub in East US provides a centralized hub-and-spoke architecture that connects all VNets and the on-premises network via ExpressRoute. The secured hub includes Azure Firewall, enabling forced tunneling of all internet-bound traffic from any VNet through the central firewall in East US, while Virtual WAN automatically manages routing between all spokes and the on-premises network.

Exam trap

The trap here is that candidates often assume VNet peering with route tables (Option A) is sufficient for centralized security, but they overlook the operational complexity and lack of built-in forced tunneling enforcement across multiple regions, which Virtual WAN's secured hub solves natively.

How to eliminate wrong answers

Option A is wrong because VNet peering alone creates a full mesh that lacks centralized routing management and cannot enforce forced tunneling through a single firewall without complex route table configurations that become unmanageable across multiple regions. Option C is wrong because ExpressRoute Global Reach only connects on-premises networks to Azure and does not provide inter-VNet connectivity or centralized security policy enforcement; VNet peering would still be needed but without centralized routing. Option D is wrong because VPN gateways with BGP can connect VNets but require a full mesh of VPN tunnels and do not natively support forced tunneling of all internet traffic through a central firewall without additional complex routing and gateway configurations.

Full explanation →
41
MCQmedium

You are designing a connectivity solution for a hybrid network. The company has an on-premises network connected to an Azure virtual network via ExpressRoute. They also have a site-to-site VPN to the same Azure virtual network as a backup. When the ExpressRoute connection fails, traffic should automatically fail over to the VPN. How should you configure the routes to ensure automatic failover?

A.Configure Azure Traffic Manager with a priority routing method to direct traffic to ExpressRoute first.
B.Ensure the ExpressRoute connection has a lower BGP metric than the VPN connection; Azure automatically prefers lower metric.
C.Set the BGP metrics (local preference) on the ExpressRoute connection to be higher than the VPN connection.
D.Configure Azure Route Server to propagate routes with a lower metric for the VPN connection.
AnswerB

ExpressRoute and VPN gateway BGP peering allow Azure to choose between the two paths by comparing BGP attributes; a lower BGP metric (such as MED) on the ExpressRoute connection makes it the preferred route because Azure selects the path with the lowest metric. When the ExpressRoute circuit fails, its route is withdrawn and the VPN route with the higher metric becomes the only available path, enabling automatic failover. This is the standard, supported coexistence design for resilient hybrid networking, and no additional traffic-management or routing services are required.

Why this answer

B is correct because when both ExpressRoute and VPN connections use BGP to advertise routes to Azure, Azure automatically selects the route with the lowest BGP metric (MED). By configuring the ExpressRoute connection with a lower BGP metric than the VPN connection, Azure will prefer the ExpressRoute path under normal conditions. If the ExpressRoute fails, its routes are withdrawn, and Azure falls back to the VPN routes, providing automatic failover.

Exam trap

The trap here is confusing BGP metrics (MED) with local preference; local preference is used for outbound path selection within an AS, while MED influences inbound path selection from a neighbor AS, and Azure uses MED for route preference in hybrid connectivity.

How to eliminate wrong answers

Option A is wrong because Azure Traffic Manager operates at the DNS level and cannot influence routing within a hybrid network; it directs user traffic to endpoints based on DNS resolution, not IP-level path selection for existing connections. Option C is wrong because setting a higher BGP local preference on the ExpressRoute connection would make it less preferred (Azure prefers higher local preference), which would cause the VPN to be used as the primary path, not the backup. Option D is wrong because Azure Route Server is used to exchange routes between virtual network gateways and network virtual appliances (NVAs), not to set metrics for failover between ExpressRoute and VPN; lowering the metric for the VPN connection would make it preferred over ExpressRoute, defeating the failover purpose.

Full explanation →
42
MCQhard

A company runs large-scale analytics workloads using Apache Hadoop and Spark. They need a cloud storage solution that is fully compatible with the Hadoop Distributed File System (HDFS) and provides unlimited storage with high throughput for parallel processing. They also want to take advantage of tiered storage to reduce costs for older data. Which Azure data service should they use?

A.Azure Blob Storage
B.Azure Data Lake Storage Gen2
C.Azure Files
D.Azure Disk Storage
AnswerB

Azure Data Lake Storage Gen2 is the correct choice because it merges Blob Storage's durable object storage with a hierarchical namespace and native HDFS support via the ABFS driver. It provides unlimited storage, POSIX-like permissions, atomic directory renames, and high throughput, enabling Spark and Hadoop jobs to run at scale without a dedicated HDFS cluster. Lifecycle tiering further reduces costs while retaining analytics performance.

Why this answer

Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with Azure Blob Storage, providing full HDFS compatibility. This allows Apache Hadoop and Spark workloads to use the `wasbs://` or `abfss://` driver for unlimited storage and high throughput parallel processing, while also supporting tiered storage (hot, cool, archive) to reduce costs for older data.

Exam trap

The trap here is that candidates often confuse Azure Blob Storage (which is object storage without a hierarchical namespace) with ADLS Gen2, assuming both are equally HDFS-compatible, but only ADLS Gen2 provides the required HDFS semantics and the `abfss://` driver for native Hadoop/Spark integration.

How to eliminate wrong answers

Option A is wrong because Azure Blob Storage lacks a hierarchical namespace by default, making it incompatible with HDFS semantics (e.g., atomic directory operations) required by Hadoop/Spark; it also does not support the `abfss://` driver natively. Option C is wrong because Azure Files uses the SMB protocol and is designed for file shares, not for HDFS-compatible distributed storage; it cannot handle the massive throughput and parallel processing demands of large-scale analytics. Option D is wrong because Azure Disk Storage provides block-level storage attached to VMs, which is limited in capacity, not natively HDFS-compatible, and does not offer tiered storage for cost optimization of older data.

Full explanation →
43
Matchingmedium

Match each Azure governance tool to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Enforce rules and compliance for resources

Define repeatable set of Azure resources and policies

Hierarchical structure for managing access and policies

Query and explore Azure resources across subscriptions

Monitor, allocate, and optimize cloud costs

Why these pairings

Azure Policy enforces rules; Azure Blueprints provides repeatable templates; Management Groups organize subscriptions; RBAC controls access. Confusions often arise between policy enforcement and access control, or between blueprints and management groups.

Full explanation →
44
MCQhard

A company runs an SAP HANA database on Azure large instances (HLI) in the West US region. The database is critical for business operations. They need a disaster recovery solution with a recovery point objective (RPO) of near zero (seconds) and a recovery time objective (RTO) of less than 30 minutes in the event of a region-wide outage. The solution must automatically replicate data to a secondary region (East US) and support automated failover. Which design should they implement?

A.Configure HANA System Replication (async) between the primary and secondary site, and use a Pacemaker cluster with Azure Load Balancer to enable automated failover
B.Use Azure Site Recovery to replicate the HANA large instance VMs with a replication frequency of 30 seconds and enable auto-failover
C.Schedule HANA database backups every 5 minutes to Azure Blob Storage with geo-redundant storage (GRS), and restore in the secondary region on demand
D.Set up HANA System Replication with synchronous mode to the secondary region
AnswerA

HANA System Replication with asynchronous mode provides near-zero RPO. Combined with Pacemaker and Azure Load Balancer, you can achieve automatic failover within the required RTO. This is the recommended approach for SAP HANA DR on Azure.

Why this answer

HANA System Replication (async) provides near-zero RPO by continuously replicating log changes to the secondary region, while a Pacemaker cluster with Azure Load Balancer enables automated failover within the required 30-minute RTO. This combination meets the strict RPO/RTO requirements for SAP HANA on Azure Large Instances, as Azure Site Recovery does not support HLI and synchronous replication would introduce unacceptable latency over the West US to East US distance.

Exam trap

The trap here is that candidates confuse Azure Site Recovery as a viable option for HLI, not realizing it only supports standard Azure VMs, or they assume synchronous replication is always better without considering the latency penalty over inter-region distances.

How to eliminate wrong answers

Option B is wrong because Azure Site Recovery does not support Azure Large Instances (HLI) — it only works with standard Azure VMs, and its 30-second replication frequency cannot achieve near-zero RPO (seconds). Option C is wrong because scheduling backups every 5 minutes cannot achieve near-zero RPO (seconds), and manual restore in the secondary region would far exceed the 30-minute RTO. Option D is wrong because synchronous HANA System Replication over the long distance between West US and East US would introduce high network latency, causing unacceptable performance impact on the primary database and potentially violating the RTO due to transaction stalls.

Full explanation →
45
MCQmedium

A company runs a custom analytics application that reads data using the NFS 3.0 protocol. The data consists of large files organized in a directory structure. The application also requires POSIX-like access control lists (ACLs) for fine-grained permissions. The solution must be fully managed and support high throughput for parallel reads. Which Azure data service should they use?

A.Azure Blob Storage
B.Azure Files
C.Azure NetApp Files
D.Azure Data Lake Storage Gen2
AnswerD

Azure Data Lake Storage Gen2 is the correct answer because it combines the massive scalability of Azure Blob Storage with a hierarchical namespace, enabling true directory structures and atomic, directory-level rename/delete operations that analytics applications require. It exposes POSIX-compliant access control lists (ACLs) and supports NFS 3.0 endpoints, so an NFS 3.0-based custom application can connect directly while also benefiting from the ABFS driver for Spark, Hadoop, and other analytic frameworks. This unique fusion of hierarchical namespace, POSIX ACLs, NFS 3.0 interoperability, and blob-storage economics makes ADLS Gen2 the only option that fully satisfies all the stated requirements for a cloud-scale analytics data lake.

Why this answer

Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with POSIX-like ACLs and supports the NFS 3.0 protocol for high-throughput parallel reads. It is fully managed and designed for big data analytics workloads that require fine-grained permissions and directory structure management.

Exam trap

The trap here is that candidates often confuse Azure Files (which supports NFS but only version 4.1) with the NFS 3.0 requirement, or they overlook that Azure NetApp Files, while technically capable, is not the fully managed, high-throughput parallel read solution optimized for analytics that ADLS Gen2 provides.

How to eliminate wrong answers

Option A is wrong because Azure Blob Storage does not natively support NFS 3.0 (it requires a preview feature or workaround) and lacks a true hierarchical namespace and POSIX ACLs, relying instead on flat storage and Azure RBAC. Option B is wrong because Azure Files supports SMB and NFS 4.1, not NFS 3.0, and its ACLs are based on Windows NTFS permissions, not POSIX-like ACLs. Option C is wrong because Azure NetApp Files is a fully managed file share service that supports NFS 3.0 and POSIX ACLs, but it is not the best fit for high-throughput parallel reads in a custom analytics application; it is more suited for enterprise workloads requiring low-latency access and is not as optimized for big data analytics as ADLS Gen2.

Full explanation →
46
MCQmedium

A company uses Microsoft Entra ID (Microsoft Entra ID) for identity management. They want to automatically detect sign-in risks such as sign-ins from unfamiliar locations, anonymous IP addresses, or leaked credentials. Based on the risk level, they want to apply different controls: for low-risk sign-ins, show a message but allow access; for medium-risk sign-ins, require multi-factor authentication (MFA); for high-risk sign-ins, block the sign-in. They also need to receive a weekly summary report of risk events. Which Microsoft Entra ID feature should they configure?

A.Microsoft Entra ID Identity Protection policies
B.Microsoft Entra ID Conditional Access policies with sign-in risk conditions
C.Microsoft Entra ID Access Reviews
D.Microsoft Entra ID Privileged Identity Management (PIM)
AnswerB

Conditional Access policies can evaluate sign-in risk levels (low, medium, high) from Identity Protection and apply granular controls such as block, require MFA, or session controls. Combined with Identity Protection reports, you get the weekly summary.

Why this answer

Microsoft Entra ID Conditional Access policies can integrate sign-in risk conditions from Identity Protection to enforce granular controls based on risk levels. This allows you to configure actions such as showing a message for low risk, requiring MFA for medium risk, and blocking access for high risk, while Identity Protection provides the weekly summary report of risk events.

Exam trap

The trap here is that candidates often confuse Identity Protection (the detection engine) with Conditional Access (the enforcement engine), assuming Identity Protection alone can apply the per-risk-level controls, when in reality Conditional Access policies are required to map risk levels to specific actions like MFA or block.

How to eliminate wrong answers

Option A is wrong because Identity Protection policies alone detect risks and can trigger automated responses, but they do not natively support the granular per-risk-level controls (e.g., show message for low, MFA for medium, block for high) that Conditional Access policies provide; Conditional Access is the enforcement layer. Option C is wrong because Access Reviews are used for periodic attestation of group memberships or application access, not for real-time risk-based sign-in controls or risk event reporting. Option D is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and approval workflows, not sign-in risk detection or conditional access based on risk levels.

Full explanation →
47
MCQhard

Your company, Fabrikam Inc., operates a global Software-as-a-Service (SaaS) application that provides real-time analytics. The application runs on Azure Kubernetes Service (AKS) with a microservices architecture. The data tier uses Azure Cosmos DB (Core SQL API) with multi-region writes. The application also uses Azure Event Hubs for event ingestion. The business requires a Recovery Time Objective (RTO) of 10 seconds and a Recovery Point Objective (RPO) of 0 for the entire platform. The solution must support active-active configuration across multiple Azure regions. You have been asked to recommend the disaster recovery design. Which option should you recommend?

A.Deploy AKS in three regions with Azure Traffic Manager. Use Azure Cosmos DB with multi-region writes. Use Azure Event Hubs with geo-disaster recovery. Use Azure Cache for Redis Enterprise with active geo-replication.
B.Deploy AKS in two regions with Azure Front Door. Use Azure Cosmos DB with single write region and auto-failover. Use Azure Service Bus with geo-disaster recovery. Use Azure Cache for Redis Enterprise with active geo-replication.
C.Deploy AKS in three regions with Azure Front Door. Use Azure Cosmos DB with multi-region writes. Use Azure Event Hubs with geo-disaster recovery and active-active pattern. Use Azure Cache for Redis Enterprise with active geo-replication.
D.Deploy AKS in two regions with Azure Front Door. Use Azure SQL Database with auto-failover groups. Use Azure Event Hubs with geo-disaster recovery. Use Azure Cache for Redis Enterprise with active geo-replication.
AnswerC

This solution meets all stated requirements through active-active replication at every layer. Azure Front Door uses anycast-based global load balancing and continuous health probes, enabling failover in less than the 10-second RTO. Azure Cosmos DB with multi-region writes accepts writes in any region, providing RPO=0 and continuous availability. Azure Event Hubs with geo-disaster recovery and an active-active pattern uses paired namespaces with client-side failover/producer logic to keep event flow uninterrupted. Azure Cache for Redis Enterprise with active geo-replication lets all regions read and write the same cache data with automatic conflict resolution, completing the zero-downtime architecture.

Why this answer

It meets the strict RTO of 10 seconds and RPO of 0 by using Azure Front Door for global load balancing with health probes, Azure Cosmos DB multi-region writes for zero data loss, Azure Event Hubs with geo-disaster recovery and active-active pattern for continuous event ingestion, and Azure Cache for Redis Enterprise with active geo-replication for synchronized caching across regions. This combination ensures that all components support active-active configuration and can fail over instantly without data loss.

Exam trap

The trap here is that candidates often assume Azure Traffic Manager or Azure SQL Database can meet sub-10-second RTO and zero RPO, but they overlook the DNS propagation delays in Traffic Manager and the inherent replication lag in SQL Database auto-failover groups.

How to eliminate wrong answers

Option A is wrong because Azure Traffic Manager does not support active-active configuration with sub-10-second failover; it relies on DNS-based routing with TTL delays, making it unsuitable for the required RTO. Option B is wrong because Azure Cosmos DB with single write region and auto-failover has a non-zero RPO (typically up to 5 seconds) and does not support active-active writes, violating the RPO of 0 requirement. Option D is wrong because Azure SQL Database with auto-failover groups has a typical RTO of 30-60 seconds and RPO of up to 5 seconds, failing both the RTO of 10 seconds and RPO of 0; additionally, it does not support active-active writes across regions.

Full explanation →
48
MCQmedium

A company needs a data storage solution for a global application that frequently accesses recent data and less frequently older data. Data is unstructured blobs. They want to automatically move blobs to cool storage after 30 days and to archive storage after 90 days. Additionally, blobs must be retained for 7 years and cannot be deleted or modified during that period. Which Azure Blob Storage features should they combine?

A.Use blob lifecycle management policies and legal hold (immutable blobs).
B.Use blob lifecycle management policies and time-based retention policies.
C.Use Azure Storage Analytics and immutability policies.
D.Use Azure File Sync and lifecycle management.
AnswerB

Blob lifecycle management policies automate cost-efficient data tiering, moving blobs from hot to cool to archive tiers based on age or last modification, thereby reducing storage costs as data ages. Time-based retention policies, a form of immutable blob storage with a fixed retention interval, prevent blobs from being modified or deleted for a specified period—here, 7 years—which satisfies regulatory compliance. Together they meet the global application's need for both automated tiering and fixed-duration write-once-read-many (WORM) protection, whereas a legal hold would leave retention indefinite and untethered to a specific deadline.

Why this answer

Blob lifecycle management policies automatically transition blobs from hot to cool after 30 days and to archive after 90 days, while time-based retention policies enforce immutability for a fixed period (7 years), preventing deletion or modification. This combination meets both the tiering and retention requirements without manual intervention.

Exam trap

The trap here is confusing legal hold (which is indefinite and manually managed) with time-based retention (which has a fixed expiry), leading candidates to choose Option A when they need a defined retention period.

How to eliminate wrong answers

Option A is wrong because legal hold (immutable blobs) has no expiration date and must be manually cleared, making it unsuitable for a fixed 7-year retention period; it also does not support automatic tiering. Option C is wrong because Azure Storage Analytics provides metrics and logging, not lifecycle management or immutability policies. Option D is wrong because Azure File Sync is for syncing on-premises file shares with Azure Files, not for managing blob tiering or retention.

Full explanation →
49
Multi-Selecthard

A company runs a critical application on Azure VMs. They need a backup strategy that meets the following requirements: - Daily backups retained for 35 days - Weekly backups retained for 12 weeks - Monthly backups retained for 36 months - Yearly backups retained for 10 years - Backups must be stored in a geo-redundant storage account Which THREE items must be configured? (Choose three.)

Select 3 answers
A.A simple daily backup policy
B.A backup policy with GFS retention
C.Geo-redundant storage (GRS) for the vault
D.A Recovery Services vault in the paired region
E.A Recovery Services vault in the same region as the VMs
AnswersB, C, E

GFS policy can retain daily, weekly, monthly, yearly.

Why this answer

The Grandfather-Father-Son (GFS) retention policy in Azure Backup allows you to define multiple retention points for daily, weekly, monthly, and yearly backups, exactly matching the requirements. The GFS policy enables you to specify retention durations for each frequency, such as 35 days for daily, 12 weeks for weekly, 36 months for monthly, and 10 years for yearly, which a simple daily policy cannot achieve.

Exam trap

The trap here is that candidates often confuse the need for a Recovery Services vault in the paired region (Option D) with geo-redundant storage, but Azure Backup achieves geo-redundancy by configuring GRS on the vault's storage, not by deploying a second vault.

Full explanation →
50
MCQhard

A company needs to store large amounts of unstructured data (log files) for analytics. The data is accessed frequently for the first 30 days, then occasionally for the next 90 days, and rarely after that but must be retained for 7 years for compliance. The data must not be modified or deleted during the retention period, and administrative access must not be able to bypass this restriction. They want to minimize storage costs. Which combination of Azure Blob Storage features should they configure?

A.Configure a lifecycle management policy to move blobs to Cool tier after 30 days and to Archive tier after 120 days. Apply a time-based retention policy with a retention period of 2,555 days and lock it.
B.Enable soft delete and versioning on the storage account, and use a custom script to delete blobs after 7 years. Manually move blobs to Cool and Archive tiers using Azure PowerShell.
C.Set each blob's access tier to Cool on upload, then manually change to Archive after 30 days. Enable Azure Backup on the storage account for retention.
D.Apply a legal hold on the container to prevent deletion, and configure a lifecycle policy to move blobs to Archive after 30 days.
AnswerA

A locked time-based retention policy on the container ensures that blobs cannot be deleted or overwritten for the specified duration (7 years = 2555 days). Lifecycle management moves blobs to cost-efficient tiers. Locking prevents bypass.

Why this answer

It combines a lifecycle management policy to automatically transition blobs from Hot to Cool after 30 days and to Archive after 120 days, minimizing storage costs. The time-based retention policy with a locked retention period of 2,555 days (7 years) ensures that blobs cannot be modified or deleted during the retention period, and locking the policy prevents administrative bypass, meeting the compliance requirement.

Exam trap

The trap here is that candidates often confuse soft delete or legal hold with immutable retention policies, not realizing that only a locked time-based retention policy provides true WORM protection that cannot be bypassed by administrators.

How to eliminate wrong answers

Option B is wrong because soft delete and versioning allow data recovery but do not prevent deletion or modification during the retention period; a custom script to delete blobs after 7 years violates the requirement that data must not be deleted during retention, and manual tier changes are not automated or cost-efficient. Option C is wrong because manually setting access tiers and using Azure Backup does not enforce a write-once-read-many (WORM) policy; Azure Backup retains backups but does not prevent modification or deletion of the original blobs, and manual operations are error-prone and do not meet the compliance requirement for immutability. Option D is wrong because a legal hold prevents deletion but does not prevent modification of blobs, and moving blobs to Archive after 30 days ignores the occasional access requirement for the next 90 days, leading to higher retrieval costs and potential access delays.

Full explanation →
51
MCQmedium

A company wants to monitor sign-in activity for their Microsoft Entra ID-integrated applications. They need to detect risky sign-ins, such as sign-ins from anonymous IP addresses or unfamiliar locations, and automatically block or require multi-factor authentication. They also need a dashboard showing risk events and the ability to investigate and remediate. Which Microsoft Entra ID feature should they use?

A.Microsoft Entra ID Identity Protection
B.Microsoft Entra ID Privileged Identity Management (PIM)
C.Microsoft Entra ID Access Reviews
D.Microsoft Entra ID Self-Service Password Reset (SSPR)
AnswerA

Identity Protection detects risky sign-ins and user behavior, provides a risk dashboard, and integrates with Conditional Access to enforce policies like blocking or requiring MFA.

Why this answer

Microsoft Entra ID Identity Protection is the correct feature because it specifically detects and responds to risky sign-ins, such as those from anonymous IP addresses or unfamiliar locations, by automatically blocking access or requiring multi-factor authentication. It provides a dashboard of risk events (e.g., leaked credentials, impossible travel) and supports investigation and remediation workflows, directly matching the requirements for monitoring sign-in activity and enforcing conditional access policies.

Exam trap

The trap here is that candidates often confuse Privileged Identity Management (PIM) with Identity Protection because both involve 'risk' and 'security,' but PIM is solely for privileged role governance, not for detecting risky sign-ins from anonymous IPs or unfamiliar locations.

How to eliminate wrong answers

Option B (Privileged Identity Management) is wrong because it focuses on managing, controlling, and monitoring access to privileged roles (e.g., global administrator) through just-in-time activation and approval workflows, not on detecting risky sign-ins or enforcing MFA for general users. Option C (Access Reviews) is wrong because it automates periodic attestation of group memberships or application access to ensure only the right users have access, but it does not detect or respond to risky sign-in events in real time. Option D (Self-Service Password Reset) is wrong because it allows users to reset their own passwords without help desk intervention, addressing password management, not risk-based sign-in detection or conditional access enforcement.

Full explanation →
52
Multi-Selectmedium

Your company is designing a hybrid network architecture that connects multiple on-premises sites to Azure. You need to ensure high availability and redundancy for the connection. Which TWO solutions should you recommend? (Choose two.)

Select 2 answers
A.Deploy two ExpressRoute circuits in active-passive mode
B.Implement Azure DNS Private Resolver for resolution
C.Use Azure VPN Gateway in active-active mode
D.Use a single VPN gateway with active-standby mode
E.Use a single ExpressRoute circuit with a VPN gateway as failover
AnswersA, C

Deploying two ExpressRoute circuits in active-passive mode is correct because each circuit represents a physically distinct path, ideally from different providers and peering locations, to Microsoft's edge, eliminating a single point of failure in the private network. BGP determines the primary path through route preference mechanisms such as local preference or AS path prepend, and on failure the secondary circuit automatically takes over without any configuration change. This architecture satisfies a high-availability hybrid networking requirement and enables the ExpressRoute service-level agreement.

Why this answer

Deploying two ExpressRoute circuits in active-passive mode provides redundancy for the on-premises-to-Azure connection. If the primary circuit fails, traffic automatically fails over to the passive circuit, ensuring high availability. Option C is correct because an Azure VPN Gateway in active-active mode uses two active tunnels to provide redundancy and load balancing, which is essential for a highly available hybrid network.

Exam trap

The trap here is that candidates often confuse redundancy at the gateway level (active-active vs. active-standby) with redundancy at the circuit level, and may incorrectly select a single ExpressRoute circuit with a VPN failover, which still has a single point of failure for the circuit itself.

Full explanation →
53
MCQmedium

A company ingests IoT sensor data into Azure Blob Storage. Data is written frequently and is accessed rarely after the first 24 hours. The company must retain the data for exactly 90 days for compliance. They want to minimize storage costs by automatically moving data to the cheapest possible storage tier as soon as possible. Which Azure Blob Storage lifecycle management policy should they implement?

A.Move to Cool tier after 1 day, delete after 90 days
B.Move to Archive tier after 1 day, delete after 90 days
C.Move to Cool tier after 30 days, delete after 90 days
D.Move to Archive tier after 30 days, delete after 90 days
AnswerA

Moving the sensor data to the Cool tier after just one day aligns lifecycle costs with actual access patterns, since IoT telemetry is typically queried only briefly after ingestion. Cool tier provides significantly lower per-GB storage costs than Hot, and because the retention period of 90 days exceeds Cool's 30-day minimum commitment, no early deletion penalty is incurred. This policy satisfies the compliance requirement to delete after 90 days while minimizing the cost of storing data that is rarely read after the first 24 hours.

Why this answer

The data is rarely accessed after 24 hours, so moving it to Cool tier after 1 day minimizes cost while still allowing low-latency access. The 90-day deletion aligns with the compliance retention requirement. Cool tier is the cheapest online tier, and moving data there as soon as possible (after 1 day) reduces costs without incurring the early deletion penalty or retrieval latency of Archive tier.

Exam trap

The trap here is that candidates often choose Archive tier thinking it is the cheapest, but they overlook the 180-day early deletion penalty and the fact that Cool tier is sufficient for 90-day retention with no penalty, making it the true cheapest option for this exact retention window.

How to eliminate wrong answers

Option B is wrong because moving data to Archive tier after 1 day would make it inaccessible for immediate use (Archive has a retrieval latency of up to 15 hours) and incurs a higher cost for early deletion if deleted before 180 days. Option C is wrong because waiting 30 days to move to Cool tier leaves data in the Hot tier for 29 extra days, incurring unnecessary storage costs when it could have been moved after 1 day. Option D is wrong because moving to Archive tier after 30 days still incurs the early deletion penalty (Archive requires a minimum 180-day retention) and the data is rarely accessed, but Cool tier after 1 day is cheaper and more appropriate.

Full explanation →
54
MCQmedium

A company deploys a web application across multiple Azure VMs in a single region. They need to distribute incoming HTTP traffic, offload SSL termination, and perform URL-based routing to different backend pools (e.g., /images to one pool, /api to another). Which Azure load balancing solution should they use?

A.Azure Application Gateway
B.Azure Load Balancer
C.Azure Traffic Manager
D.Azure Front Door
AnswerA

Azure Application Gateway is the correct choice because it operates at Layer 7 (HTTP/HTTPS), enabling URL path-based routing to distribute traffic to backend Azure VM pools based on request paths. It also provides SSL termination at the gateway, reducing the backend VMs' TLS processing overhead, and supports features like cookie-based session affinity, Web Application Firewall (WAF), and autoscaling—all within a single Azure region, which directly matches the deployment architecture.

Why this answer

Azure Application Gateway is a Layer 7 load balancer that can distribute HTTP traffic, offload SSL termination, and perform URL-based routing to different backend pools. This directly matches the requirements for routing /images and /api traffic to separate pools while handling SSL termination at the gateway.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming all load balancers can handle HTTP routing and SSL termination, but only Layer 7 solutions like Application Gateway or Front Door can perform URL-based routing and SSL offloading.

How to eliminate wrong answers

Option B is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and cannot perform SSL termination or URL-based routing, which are Layer 7 features. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic router that directs traffic based on DNS resolution, not HTTP-level routing or SSL termination. Option D is wrong because Azure Front Door is a global Layer 7 service designed for multi-region scenarios with CDN capabilities, but the question specifies a single-region deployment, making Application Gateway the more appropriate and cost-effective choice.

Full explanation →
55
Multi-Selectmedium

A company is designing a network architecture for a three-tier application hosted on Azure VMs. The web tier must be accessible from the internet, while the application and database tiers must not have direct internet access. They also need to encrypt traffic between tiers. Which TWO solutions should they implement?

Select 2 answers
A.Use Azure Application Gateway with WAF
B.Deploy a network virtual appliance (NVA) as a reverse proxy for the web tier
C.Use Azure Private Link for the database tier
D.Use Azure Front Door
E.Use VNet peering to connect the tiers
AnswersB, C

NVA can restrict access and encrypt traffic.

Why this answer

Deploying a network virtual appliance (NVA) as a reverse proxy for the web tier allows the web tier to be exposed to the internet while the application and database tiers remain isolated without direct internet access. The NVA can terminate inbound traffic and forward it to the web tier, and it can also enforce encryption (e.g., TLS) between tiers by acting as a secure gateway, meeting the requirement to encrypt traffic between tiers.

Exam trap

The trap here is that candidates often assume Azure Application Gateway or Front Door can handle inter-tier encryption, but these services are designed for inbound internet traffic and do not natively encrypt traffic between internal tiers without additional configuration or third-party tools.

Full explanation →
56
MCQeasy

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to allow external business partners to access an internal web application using their own organizational identities. The solution must support self-service sign-up and enforce multi-factor authentication for partner users. Which Microsoft Entra ID feature should they configure?

A.Microsoft Entra ID B2B collaboration
B.Microsoft Entra ID B2C
C.Microsoft Entra ID Domain Services
D.Microsoft Entra ID Connect
AnswerA

Microsoft Entra ID B2B collaboration is the correct solution because it lets you invite employees from partner organizations as guest users, granting them access to your internal business apps while they authenticate using their own employer-issued Entra ID or other federated credentials. It natively supports conditional access policies such as MFA and allows self-service sign-up for external partners, making it purpose-built for B2B sharing without duplicating identities.

Why this answer

Microsoft Entra ID B2B collaboration is the correct feature because it allows external business partners to access internal applications using their own organizational identities (home directory credentials) without requiring them to have a separate account in your tenant. It supports self-service sign-up through entitlement management and can enforce multi-factor authentication (MFA) via Conditional Access policies that evaluate the partner user's session, even if the partner's home tenant does not enforce MFA.

Exam trap

The trap here is that candidates often confuse B2B collaboration (for business partners with existing organizational identities) with B2C (for customers using social or local accounts), leading them to select B2C when the requirement explicitly states 'business partners' and 'their own organizational identities.'

How to eliminate wrong answers

Option B (Microsoft Entra ID B2C) is wrong because B2C is designed for customer-facing applications where users sign up with social or local identities, not for business partner access with existing organizational identities. Option C (Microsoft Entra ID Domain Services) is wrong because it provides managed domain services (e.g., LDAP, Kerberos) for legacy applications, not external identity federation or self-service sign-up. Option D (Microsoft Entra ID Connect) is wrong because it synchronizes on-premises Active Directory objects to Entra ID for internal users, not for inviting external partners or enforcing MFA on guest users.

Full explanation →
57
MCQmedium

Your organization has multiple Azure subscriptions managed through Azure Management Groups. You need to enforce a policy that requires all resources to have a 'CostCenter' tag. If a resource is created without the tag, the deployment should be denied. Additionally, you need to ensure that existing non-compliant resources are automatically remediated. Which combination of actions should you take?

A.Create a policy with DeployIfNotExists effect only, and rely on periodic evaluation.
B.Create a policy with Modify effect to add the tag, and assign it at the management group level.
C.Create a policy with Deny effect for new resources, and create a remediation task using a DeployIfNotExists policy for existing resources.
D.Create a policy with Deny effect only, and run a script to tag existing resources.
AnswerC

Deny blocks new; remediation fixes existing.

Why this answer

It combines two policy effects to address both requirements: the Deny effect blocks creation of new resources without the 'CostCenter' tag, while a separate DeployIfNotExists policy with a remediation task automatically adds the tag to existing non-compliant resources. This dual approach ensures enforcement for new deployments and automated remediation for existing resources, which is necessary because a single policy effect cannot both deny and remediate simultaneously.

Exam trap

The trap here is that candidates often think a single policy effect (like Modify or DeployIfNotExists) can both deny new non-compliant resources and remediate existing ones, but Azure Policy requires separate effects for denial and remediation, and Modify does not deny—it silently changes the resource, which may not meet strict governance requirements.

How to eliminate wrong answers

Option A is wrong because DeployIfNotExists only remediates existing resources and does not deny creation of new non-compliant resources, leaving a gap in enforcement. Option B is wrong because the Modify effect can add tags during creation or update but does not deny deployments; it modifies the resource to comply, which may not be acceptable if the requirement is to deny creation without the tag. Option D is wrong because a Deny-only policy blocks new non-compliant resources but provides no automated remediation for existing resources, requiring manual scripting which violates the 'automatically remediated' requirement.

Full explanation →
58
MCQmedium

A software company hosts multiple small databases for different clients on Azure SQL Database. Each database has low average usage but experiences unpredictable spikes. The company wants to minimize cost by pooling resources across databases while allowing each database to consume resources up to a set limit during spikes. They also need the ability to easily add new databases without manual sizing. Which Azure SQL Database deployment option should they choose?

A.Azure SQL Database elastic pool
B.Azure SQL Database single database with reserved capacity
C.Azure SQL Managed Instance
D.SQL Server on Azure Virtual Machines
AnswerA

An Azure SQL Database elastic pool allocates a shared set of eDTUs or vCores across multiple databases, allowing each database to burst beyond its guaranteed minimum during demand spikes while keeping baseline usage low. You pay for the pool's aggregate compute and storage, not per-database sizing, which dramatically lowers cost when workloads have low average utilization but unpredictable peaks. Adding a new database to the pool requires no additional compute provisioning, and per-database settings like max/min eDTUs let you control resource sharing efficiently.

Why this answer

Azure SQL Database elastic pool is the correct choice because it allows multiple databases to share a fixed pool of resources (eDTUs or vCores), which minimizes cost by pooling resources across databases with low average usage and unpredictable spikes. Each database can automatically burst up to a configurable per-database resource limit (e.g., max eDTU per database) during spikes, and new databases can be added to the pool without manual sizing, as they simply consume from the shared pool.

Exam trap

The trap here is that candidates may choose single database with reserved capacity (Option B) thinking it offers cost savings, but they overlook that reserved capacity applies to a single database and does not provide resource pooling or automatic bursting across multiple databases, making it more expensive for the described workload.

How to eliminate wrong answers

Option B is wrong because Azure SQL Database single database with reserved capacity reserves compute resources for a single database, which does not pool resources across multiple databases and would be cost-inefficient for low-average-usage databases with spikes. Option C is wrong because Azure SQL Managed Instance is a fully managed instance of SQL Server with fixed resource limits per instance, not designed for pooling resources across many small databases with unpredictable spikes, and it requires manual sizing for each new database. Option D is wrong because SQL Server on Azure Virtual Machines requires manual management of VM resources, does not provide built-in resource pooling or automatic bursting across databases, and incurs higher operational overhead and cost for many small databases.

Full explanation →
59
MCQmedium

A company is building a global real-time collaboration platform. The application data is stored as JSON documents and needs to be available for low-latency reads and writes from multiple geographic regions. The application must support multi-region writes so that users can update data from any region with automatic conflict resolution. The company wants a fully managed database service with a guaranteed SLA for availability and throughput. Which Azure data service should they choose?

A.Azure Cosmos DB with SQL API and multiple write regions
B.Azure SQL Database with active geo-replication
C.Azure Table Storage
D.Azure Cache for Redis
AnswerA

Azure Cosmos DB with the SQL API and multiple write regions is the only option that enables true multi-region writes, allowing every regional replica to accept write operations simultaneously. This is essential for a global real-time collaboration platform because users in different parts of the world experience low-latency writes without being forced to a single primary. Cosmos DB automatically handles conflict resolution using policies such as last-writer-wins or custom merge procedures, and its turnkey global distribution provides high availability (99.999% SLA) and multiple well-defined consistency levels, making it the ideal underlying data store for such a workload.

Why this answer

Azure Cosmos DB with SQL API and multiple write regions is the correct choice because it is a fully managed, globally distributed NoSQL database that natively supports multi-region writes with automatic conflict resolution. It provides low-latency reads and writes from any region, a guaranteed SLA for availability (99.999% for multi-region writes) and throughput, and is optimized for JSON document storage, making it ideal for a real-time collaboration platform.

Exam trap

The trap here is that candidates often confuse active geo-replication in Azure SQL Database (which supports only single-region writes) with true multi-region write support, leading them to choose Option B despite its read-only secondary regions.

How to eliminate wrong answers

Option B is wrong because Azure SQL Database with active geo-replication supports only a single writable primary region; secondary regions are read-only, which does not meet the requirement for multi-region writes. Option C is wrong because Azure Table Storage is a key-value store that does not support multi-region writes with automatic conflict resolution and lacks a guaranteed throughput SLA. Option D is wrong because Azure Cache for Redis is an in-memory cache, not a fully managed database service; it does not provide durable storage or native multi-region write capabilities with conflict resolution.

Full explanation →
60
MCQhard

A company is designing a solution to store and analyze petabytes of IoT sensor data. The data is written once, rarely accessed, and must be retained for 10 years for compliance. The data must be queryable using SQL. Which combination of Azure services would be MOST cost-effective?

A.Azure Cosmos DB with analytical store
B.Azure SQL Database with Hyperscale tier
C.Azure Data Lake Storage Gen2 with Azure Synapse Serverless SQL
D.Azure Databricks with Delta Lake
AnswerC

Cost-effective storage and SQL querying.

Why this answer

Azure Data Lake Storage Gen2 (ADLS Gen2) provides cost-effective, scalable storage for petabytes of data at low cost, while Azure Synapse Serverless SQL enables on-demand SQL querying directly over the data in ADLS Gen2 without provisioning dedicated compute. This combination meets the write-once, rare-access, 10-year retention, and SQL queryability requirements at the lowest cost because storage is cheap and compute is only billed per query executed.

Exam trap

The trap here is that candidates often choose Azure SQL Database or Cosmos DB because they associate SQL queryability with traditional databases, overlooking that serverless SQL engines over cheap blob storage can provide the same query capability at a fraction of the cost for cold data.

How to eliminate wrong answers

Option A is wrong because Azure Cosmos DB with analytical store is designed for globally distributed, low-latency transactional workloads with high throughput, not for petabyte-scale archival data; its storage cost is significantly higher than ADLS Gen2 for rarely accessed data. Option B is wrong because Azure SQL Database Hyperscale tier is optimized for high-performance OLTP and large databases but incurs ongoing compute and storage costs that are prohibitive for petabytes of write-once, rarely accessed data retained for 10 years. Option D is wrong because Azure Databricks with Delta Lake is a powerful analytics and machine learning platform, but it requires provisioned clusters and incurs continuous compute costs even when idle, making it far more expensive than serverless SQL for occasional querying of archival data.

Full explanation →
61
MCQhard

Refer to the exhibit. You deploy this Azure Network Watcher connection monitor to test TCP connectivity on port 443 between two VMs. The test consistently shows 'Unreachable' status. Both VMs are running and have correct NSG rules allowing inbound port 443 from the source VM's IP. What is the most likely cause?

A.The source VM does not have the Network Watcher Agent installed.
B.The destination VM's NSG is blocking the traffic despite the rule.
C.The destination VM's private IP address is incorrect.
D.A firewall on the destination VM is blocking TCP port 443.
AnswerA

Connection Monitor relies on the Network Watcher Agent (AzureNetworkWatcherExtension) installed in the source VM's guest OS to originate synthetic probe traffic. Without that agent, the monitor cannot even send TCP 443 tests to the destination, so the probe results will show 'unreachable' regardless of how permissive the NSGs or route tables are. The exhibit confirms all NSG rules are correct, so a missing source agent is the definitive root cause.

Why this answer

Azure Network Watcher connection monitor relies on the Network Watcher Agent extension installed on both source and destination VMs to collect and report connectivity data. Without the agent on the source VM, the test cannot initiate the TCP probes, resulting in a persistent 'Unreachable' status regardless of NSG rules or VM health.

Exam trap

The trap here is that candidates often assume NSG rules are the sole cause of connectivity failures, overlooking the prerequisite that the Network Watcher Agent must be installed on both VMs for connection monitor to function.

How to eliminate wrong answers

Option B is wrong because the question states that correct NSG rules allowing inbound port 443 from the source VM's IP are in place, so the NSG is not blocking traffic. Option C is wrong because an incorrect private IP address would cause a different error (e.g., 'Invalid endpoint' or failure to resolve), not a consistent 'Unreachable' status in a connection monitor test that already references the correct VM. Option D is wrong because while a guest OS firewall could block port 443, the question specifies that the test consistently shows 'Unreachable' and both VMs are running with correct NSG rules; the most likely cause given the dependency on the Network Watcher Agent is its absence, not a firewall misconfiguration.

Full explanation →
62
MCQhard

A company has multiple Azure VNets deployed in a hub-spoke topology. They want to inspect all outbound internet traffic from spoke VMs using a central firewall and ensure that traffic from all VNets goes through the firewall before reaching the internet. They also need to log all outbound connections. Which architecture should they implement?

A.Deploy network virtual appliances (NVAs) in each spoke VNet and configure user-defined routes (UDRs) to route internet traffic to the NVAs
B.Deploy Azure Firewall in the hub VNet and configure a default route (0.0.0.0/0) in each spoke's route table pointing to Azure Firewall as the next hop
C.Use Azure Application Gateway with Web Application Firewall (WAF) in the hub VNet to inspect all traffic
D.Deploy Azure Firewall in each spoke VNet and use Azure Monitor to aggregate logs
AnswerB

In this design, Azure Firewall is deployed into a dedicated AzureFirewallSubnet in the hub, and each spoke's route table contains a 0.0.0.0/0 UDR with the firewall's private IP as the next hop. Because Azure Firewall performs destination NAT and source network address translation (SNAT), all spoke egress emerges from the hub with a single public IP while every connection is logged and inspectable. This creates a true central enforcement point for outbound traffic, supports policy consistency, and is the standard hub-spoke egress pattern.

Why this answer

Azure Firewall is a managed, stateful firewall-as-a-service that can centrally inspect and log outbound internet traffic. By deploying Azure Firewall in the hub VNet and configuring a default route (0.0.0.0/0) in each spoke's route table with the Azure Firewall private IP as the next hop, all outbound traffic from spoke VMs is forced through the firewall before reaching the internet. This satisfies both the inspection and logging requirements, as Azure Firewall provides built-in outbound connection logging via diagnostic settings.

Exam trap

The trap here is that candidates often confuse Azure Firewall with Azure Application Gateway, mistakenly thinking WAF can inspect outbound traffic, or they assume deploying NVAs per spoke is acceptable for central inspection, missing the requirement for a single central firewall in the hub.

How to eliminate wrong answers

Option A is wrong because deploying NVAs in each spoke VNet violates the central inspection requirement and introduces management overhead; it also does not ensure traffic from all VNets goes through a single central firewall. Option C is wrong because Azure Application Gateway with WAF is a Layer 7 load balancer designed for inbound HTTP/S traffic inspection, not for routing or inspecting all outbound internet traffic (including non-HTTP protocols). Option D is wrong because deploying Azure Firewall in each spoke VNet creates a decentralized model that fails the central inspection requirement, and Azure Monitor alone does not enforce routing—it only aggregates logs without controlling traffic flow.

Full explanation →
63
MCQhard

Your company runs a mission-critical application on Azure Virtual Machines that requires a Recovery Time Objective (RTO) of 5 minutes and a Recovery Point Objective (RPO) of 1 minute. The application uses a single VM with a managed disk. You need to design a disaster recovery solution that meets these requirements with minimal cost. What should you recommend?

A.Configure Azure Backup for the VM with a 1-minute backup frequency.
B.Store the managed disk in geo-redundant storage and use Azure Resource Manager templates to redeploy.
C.Use Azure Site Recovery to replicate the VM to a secondary region with a recovery plan.
D.Deploy a second VM in a secondary region and use continuous replication with Azure Migrate.
AnswerC

Azure Site Recovery replicates Azure VM disks continuously to a secondary region and can achieve an RPO as low as 5 seconds and an RTO of minutes, especially when you use recovery plans to sequence failover and runbook steps. Replica VMs are not continuously powered on, so you pay only for replicated storage and compute during test failovers rather than for a full standby VM. This natively meets the 5-minute RPO/RTO requirement and is the cost-effective DR service purpose-built for this scenario.

Why this answer

Azure Site Recovery (ASR) provides continuous replication with RPO as low as 30 seconds and RTO of minutes when using a recovery plan, meeting the 5-minute RTO and 1-minute RPO requirements. ASR replicates the VM to a secondary region and allows orchestrated failover with minimal cost compared to running a standby VM. This is the only option that satisfies both the RTO and RPO targets for a mission-critical application.

Exam trap

The trap here is that candidates confuse Azure Backup (designed for long-term retention with hourly/daily backups) with Azure Site Recovery (designed for replication and rapid failover), and mistakenly think backup frequency can be set to 1 minute, which is technically impossible with Azure Backup's architecture.

How to eliminate wrong answers

Option A is wrong because Azure Backup supports a minimum backup frequency of 4 hours for VM backups (or 12 hours for enhanced policy), far exceeding the 1-minute RPO requirement, and RTO is typically hours due to restore time. Option B is wrong because geo-redundant storage (GRS) for managed disks provides asynchronous replication with an RPO of typically 15 minutes or more, and redeploying via ARM templates does not guarantee a 5-minute RTO due to provisioning delays and lack of pre-staged resources. Option D is wrong because Azure Migrate is a discovery and migration tool, not a disaster recovery replication service; it does not provide continuous replication for DR, and deploying a second VM with manual replication would be costly and fail to meet RTO/RPO without orchestration.

Full explanation →
64
MCQmedium

A company runs SQL Server on Azure VMs using SQL Server Standard Edition. They need a disaster recovery solution that replicates the database to a secondary Azure region with a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. They cannot use Always On Availability Groups due to licensing constraints. They also need to perform non-disruptive disaster recovery drills. Which Azure service should they implement?

A.Azure Backup for SQL Server
B.Azure Site Recovery
C.SQL Server Log Shipping to an Azure VM
D.Geo-replication for Azure SQL Database
AnswerB

Azure Site Recovery continuously replicates Azure VM disks using snapshot technology and can create application-consistent recovery points for SQL Server workloads. It provides automatic failover and, crucially, non-disruptive test failover so you can validate DR readiness without touching production. With properly configured replication frequency and timeouts, ASR can achieve recovery point objectives around 15 minutes and recovery time objectives within 2 hours, meeting the stated requirement.

Why this answer

Azure Site Recovery (ASR) replicates entire SQL Server VMs (including their databases) to a secondary Azure region, supporting RPOs as low as 30 seconds and RTOs of 2 hours or less. It allows non-disruptive disaster recovery drills by performing test failovers in an isolated network without affecting the production environment. This solution avoids the licensing constraints of Always On Availability Groups and works with SQL Server Standard Edition.

Exam trap

The trap here is that candidates often confuse Azure Site Recovery (VM-level replication) with Azure Backup (file/volume-level backup) or assume that log shipping can meet the drill requirement, but ASR is the only option that provides automated, non-disruptive test failovers for IaaS SQL Server VMs.

How to eliminate wrong answers

Option A is wrong because Azure Backup for SQL Server is designed for long-term retention and point-in-time restore, not for continuous replication to a secondary region with a 15-minute RPO or for performing non-disruptive DR drills. Option C is wrong because SQL Server Log Shipping to an Azure VM requires manual failover and does not support automated, non-disruptive DR drills; it also has higher RTO and RPO variability compared to ASR. Option D is wrong because Geo-replication for Azure SQL Database applies only to Azure SQL Database (PaaS), not to SQL Server running on Azure VMs (IaaS).

Full explanation →
65
MCQeasy

A company uses Microsoft Entra ID. They want to automatically detect sign-ins from anonymous IP addresses, sign-ins from unfamiliar locations, and other risky activities. When such a risk is detected, they want to block the sign-in or require multi-factor authentication. They also need a dashboard to review risk events. Which Microsoft Entra ID feature should they use?

A.Microsoft Entra ID Conditional Access
B.Microsoft Entra ID Identity Protection
C.Microsoft Entra ID Privileged Identity Management (PIM)
D.Microsoft Entra ID Access Reviews
AnswerB

Identity Protection detects risky sign-ins, provides a risk dashboard, and allows automated remediation actions like blocking or requiring MFA when combined with Conditional Access.

Why this answer

Microsoft Entra ID Identity Protection is the correct feature because it is specifically designed to detect and respond to identity-based risks such as sign-ins from anonymous IP addresses, unfamiliar locations, and other risky activities. It provides a risk-based conditional access policy that can automatically block sign-ins or require multi-factor authentication (MFA) when a risk is detected, and it includes a dashboard for reviewing risk events and reports.

Exam trap

The trap here is that candidates often confuse Conditional Access (which enforces policies) with Identity Protection (which provides the risk detection signals), leading them to select Conditional Access as the answer when the question explicitly asks for the feature that detects risks and provides a dashboard.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Conditional Access is a policy engine that enforces access controls based on conditions (e.g., location, device state), but it does not itself detect risky sign-ins or provide a risk dashboard; it relies on Identity Protection to supply risk signals. Option C is wrong because Privileged Identity Management (PIM) focuses on just-in-time privileged role activation, approval workflows, and access reviews for administrative roles, not on detecting anonymous IP addresses or unfamiliar location sign-ins. Option D is wrong because Access Reviews are used for periodic recertification of group memberships or application access, not for real-time risk detection or automated blocking of risky sign-ins.

Full explanation →
66
MCQmedium

A media company needs to store large volumes of video files that are processed by an application. The files are accessed via REST APIs and are rarely accessed after the first few days. The company wants to minimize storage costs by automatically moving older files to a cheaper storage tier without any manual intervention. Which Azure storage solution should they use, and which feature should they configure?

A.Azure Blob Storage with lifecycle management policies
B.Azure Files with tiering
C.Azure NetApp Files with capacity pools
D.Azure Disk Storage with managed disks
AnswerA

Azure Blob Storage is the correct choice because it provides REST API access for direct HTTP/HTTPS retrieval of video files, and its lifecycle management policies can automatically move blobs through hot, cool, and archive tiers based on age. This allows a media company to store large volumes of video files cost-effectively, with older content automatically transitioned to cheaper archive storage while still being retrievable on demand. Unlike file or disk storage, Blob Storage scales horizontally for massive unstructured data and integrates with CDNs for streaming.

Why this answer

Azure Blob Storage with lifecycle management policies is the correct solution because it allows you to define rules that automatically move blobs to cooler tiers (e.g., from Hot to Cool to Archive) based on age or last modification time, minimizing storage costs without manual intervention. The REST API access requirement is natively supported by Blob Storage via HTTPS, and the large video file workload fits well within its object storage capabilities.

Exam trap

The trap here is that candidates may confuse Azure Files tiering (which is for hybrid caching with Azure File Sync) with Blob Storage lifecycle management, or assume that any storage service with 'tiering' in its name provides automated cost-optimized tiering for REST-accessible data.

How to eliminate wrong answers

Option B is wrong because Azure Files uses the SMB protocol and does not support REST API access for video file processing; its tiering feature (Azure File Sync cloud tiering) is designed for on-premises caching, not automated cost-optimized tiering of rarely accessed files. Option C is wrong because Azure NetApp Files provides NFS/SMB volumes with capacity pools for high-performance workloads, but it lacks built-in automated lifecycle tiering to cheaper storage and is overkill for rarely accessed video files. Option D is wrong because Azure Disk Storage provides block-level managed disks for VMs, not REST API-accessible object storage, and has no lifecycle management feature to automatically move data to cheaper tiers.

Full explanation →
67
MCQhard

A company is building a petabyte-scale data lake for analytics. They need a storage solution that supports a hierarchical namespace, POSIX-like permissions (ACLs), and is optimized for big data analytics workloads using Apache Spark and Hive. The data must be accessible over the Azure Blob Storage API. Which Azure data service should they use?

A.Azure Blob Storage (with flat namespace)
B.Azure Data Lake Storage Gen2
C.Azure NetApp Files
D.Azure HPC Cache
AnswerB

Azure Data Lake Storage Gen2 is the correct choice because it provides a hierarchical namespace atop Blob Storage, enabling POSIX-like ACLs and directory-level operations that Apache Spark and Hive require for efficient metadata-heavy workloads. It offers Hadoop-compatible access (ABFS driver) natively, supports petabyte-scale analytics, and retains Blob Storage API compatibility for existing applications. Unlike a flat namespace, the hierarchical namespace allows atomic, rename-based directory operations and fine-grained security, which are critical for high-throughput analytics pipelines exploring partition pruning and O(1) directory scans.

Why this answer

Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with POSIX-like ACLs and is natively optimized for big data analytics workloads like Apache Spark and Hive. It exposes data through the Azure Blob Storage API, meeting all stated requirements for petabyte-scale analytics.

Exam trap

The trap here is that candidates often confuse Azure Blob Storage (which is object storage with a flat namespace) with ADLS Gen2, not realizing that the hierarchical namespace and POSIX ACLs are exclusive to ADLS Gen2 and critical for big data analytics engines like Spark and Hive.

How to eliminate wrong answers

Option A is wrong because Azure Blob Storage with a flat namespace lacks a hierarchical namespace and POSIX-like ACLs, making it unsuitable for Hive and Spark workloads that rely on directory structures and fine-grained permissions. Option C is wrong because Azure NetApp Files provides NFS/SMB access with POSIX permissions but does not support the Azure Blob Storage API, which is a stated requirement. Option D is wrong because Azure HPC Cache is a caching layer for high-performance computing, not a persistent data lake storage service, and it does not provide a hierarchical namespace or native Blob API access.

Full explanation →
68
MCQeasy

A small business is migrating its on-premises file server to Azure. The file server contains 2 TB of data that is accessed infrequently. The business wants to minimize costs and only pay for storage used. The solution must support SMB protocol and allow for on-premises caching to reduce latency. Which Azure storage solution should the business recommend?

A.Azure Files Standard tier with Azure File Sync
B.Azure Disk Storage Standard HDD with shared disks
C.Azure NetApp Files Standard tier with cross-region replication
D.Azure Blob Storage Cool tier with Azure Storage Explorer
AnswerA

Azure Files Standard tier with Azure File Sync is the correct replacement for an on-premises file server because it provides fully managed SMB 3.0 file shares that support NTFS ACLs, Active Directory identity-based authentication, and Windows-native access semantics. Azure File Sync goes further by keeping a local cache of the most frequently used files on the existing server, providing low-latency access for on-premises clients while transparently tiering older data to Azure. This delivers the exact file-sharing behavior and caching benefits a small business needs without requiring custom infrastructure or expensive enterprise storage.

Why this answer

Azure Files Standard tier with Azure File Sync is correct because it provides fully managed SMB file shares in the cloud, supports the required SMB protocol, and Azure File Sync enables on-premises caching to reduce latency. The Standard tier is cost-effective for infrequently accessed data, and the pay-as-you-go model minimizes costs by charging only for actual storage used.

Exam trap

The trap here is that candidates often confuse Azure Blob Storage with file storage, overlooking that Blob Storage does not support SMB protocol natively, and they may incorrectly choose it for cost savings without considering protocol requirements.

How to eliminate wrong answers

Option B is wrong because Azure Disk Storage Standard HDD with shared disks does not natively support the SMB protocol; it provides block-level storage that requires a VM to host a file server, adding management overhead and cost. Option C is wrong because Azure NetApp Files Standard tier is a premium, high-performance solution that is significantly more expensive than Azure Files, and cross-region replication is unnecessary for a small business with infrequently accessed data. Option D is wrong because Azure Blob Storage Cool tier does not support the SMB protocol natively; it is object storage accessed via REST APIs or tools like Azure Storage Explorer, not a file share solution.

Full explanation →
69
MCQeasy

A company wants to store log data from multiple applications for up to 30 days for analysis. The data is append-only, and queries are infrequent but need to be fast when run. Which Azure data storage solution should you recommend?

A.Azure Log Analytics Workspace
B.Azure Table Storage
C.Azure Data Lake Storage Gen2
D.Azure Blob Storage (archive tier)
AnswerA

Log Analytics is built for log data, fast queries, and configurable retention.

Why this answer

Azure Log Analytics Workspace is the correct choice because it is purpose-built for ingesting, storing, and querying log data from multiple sources. It supports append-only log ingestion, retains data for up to 30 days in its interactive retention tier (configurable), and provides fast Kusto Query Language (KQL) queries for infrequent analysis. The workspace integrates natively with Azure Monitor and other services, making it ideal for centralized log analysis.

Exam trap

The trap here is that candidates often choose Azure Blob Storage (archive tier) for cost savings, overlooking the explicit requirement for fast query performance, which the archive tier cannot provide due to its multi-hour rehydration latency.

How to eliminate wrong answers

Option B is wrong because Azure Table Storage is a NoSQL key-value store designed for structured, transactional data, not for log analytics; it lacks native query capabilities for time-series log data and does not support fast, ad-hoc queries across multiple log sources. Option C is wrong because Azure Data Lake Storage Gen2 is optimized for big data analytics on large volumes of unstructured or semi-structured data, not for low-latency, infrequent queries on append-only logs; it is better suited for batch processing and data lakes. Option D is wrong because Azure Blob Storage (archive tier) is designed for long-term, cold storage with high retrieval latency (hours), not for fast queries on recent log data; it is cost-effective for archival but violates the requirement for fast query performance.

Full explanation →
70
MCQeasy

A company uses Azure Backup to protect on-premises Windows servers. The backup data is stored in a Recovery Services vault. They want to ensure that backup data is protected even if the entire Azure region fails. What should they configure?

A.Configure backup replication across two Recovery Services vaults in different regions.
B.Enable geo-redundant storage (GRS) for the Recovery Services vault.
C.Use zone-redundant storage (ZRS) for the Recovery Services vault.
D.Enable Cross-region restore (CRR) for the Recovery Services vault.
AnswerD

Cross-region restore allows restoring backup data in a paired region during a regional outage.

Why this answer

Cross-region restore (CRR) is the correct feature to protect backup data against an entire Azure region failure. When enabled on a Recovery Services vault with geo-redundant storage (GRS), CRR allows you to restore backup data to a paired secondary Azure region even if the primary region is unavailable. This ensures business continuity by providing a secondary restore point in a different region.

Exam trap

The trap here is that candidates often confuse geo-redundant storage (GRS) with the ability to restore from the secondary region, but GRS alone does not enable cross-region restore; you must explicitly enable the Cross-region restore (CRR) feature on the Recovery Services vault.

How to eliminate wrong answers

Option A is wrong because Azure Backup does not support replicating backup data across two separate Recovery Services vaults in different regions; you cannot configure cross-vault replication. Option B is wrong because geo-redundant storage (GRS) alone only replicates the backup data to a paired region at the storage level, but without Cross-region restore (CRR) enabled, you cannot initiate a restore from the secondary region during a regional outage. Option C is wrong because zone-redundant storage (ZRS) protects against a single availability zone failure within the same region, not against an entire region failure.

Full explanation →
71
MCQmedium

A company is deploying a web application on Azure App Service. They need to guarantee that all traffic from the internet goes through a Web Application Firewall (WAF) before reaching the app. The solution must be cost-effective for a single application. Which Azure service should they place in front of the App Service?

A.Azure Application Gateway with WAF.
B.Azure Front Door with WAF policy.
C.Azure Firewall with application rules.
D.Azure Traffic Manager.
AnswerA

Application Gateway is a regional Layer 7 load balancer that integrates WAF. It can be placed directly in front of App Service to inspect all incoming traffic. This is a cost-effective solution for a single-region application.

Why this answer

Azure Application Gateway with WAF is the correct choice because it provides a regional, layer-7 load balancer with built-in Web Application Firewall capabilities, designed to protect web applications from common exploits and vulnerabilities. For a single application, it is more cost-effective than Azure Front Door, which is a global service with higher minimum costs and additional features not required here. Application Gateway can be deployed directly in front of App Service to inspect and filter all internet traffic before it reaches the app.

Exam trap

The trap here is that candidates often confuse Azure Front Door with Application Gateway, assuming Front Door is always the better choice for WAF, but the question's emphasis on cost-effectiveness for a single application points to the regional, lower-cost Application Gateway instead.

How to eliminate wrong answers

Option B is wrong because Azure Front Door is a global, multi-region load balancer and application delivery network; while it supports WAF policies, it is designed for multi-region deployments and incurs higher costs, making it less cost-effective for a single application. Option C is wrong because Azure Firewall is a network-layer firewall that filters traffic based on IP addresses, ports, and protocols, not at the application layer (HTTP/HTTPS), so it cannot provide Web Application Firewall capabilities to inspect and block web application attacks like SQL injection or cross-site scripting. Option D is wrong because Azure Traffic Manager is a DNS-based traffic load balancer that routes traffic based on routing methods (e.g., performance, priority) but does not include any WAF or application-layer inspection capabilities.

Full explanation →
72
MCQmedium

Your company is migrating a legacy on-premises application to Azure. The application requires persistent storage for configuration files that must be accessible from multiple virtual machines in a virtual network. The storage must be accessible only from within the virtual network and should not be exposed to the internet. Which Azure storage solution should you use?

A.Azure Disk Storage with shared disks
B.Azure NetApp Files with network security groups
C.Azure Blob Storage with a service endpoint
D.Azure Files with a private endpoint
AnswerD

Azure Files provides fully managed SMB file shares (also supports NFS for premium tiers) that can be mounted concurrently by multiple VMs, making it the most direct migration target for a legacy on-premises file-based application. By configuring a private endpoint, the file share is assigned a private IP address within your Azure virtual network, eliminating exposure to the public internet and ensuring traffic stays on the Microsoft backbone. Private endpoints also integrate with NSGs, private DNS zones, and Azure Active Directory authentication, giving you fine-grained access control and meeting security requirements without sacrificing the native file-protocol compatibility that legacy applications rely on.

Why this answer

Azure Files with a private endpoint is the correct choice because it provides fully managed file shares accessible via SMB or NFS protocols, supports persistent storage for configuration files, and ensures the storage is accessible only from within the virtual network by assigning a private IP address from the VNet, eliminating internet exposure. This meets the requirement for multi-VM access with network isolation.

Exam trap

The trap here is that candidates often confuse service endpoints (which still expose the storage to the internet at the endpoint level) with private endpoints (which fully isolate the resource within the VNet), and they may overlook that Azure Files supports SMB for shared file access while Blob Storage does not.

How to eliminate wrong answers

Option A is wrong because Azure Disk Storage with shared disks is a block-level storage solution designed for clustered applications (e.g., SQL Server FCI) and does not natively support file-level access or SMB/NFS protocols required for configuration files; it also cannot be easily accessed from multiple VMs without complex clustering. Option B is wrong because Azure NetApp Files is a high-performance file service that can use network security groups, but it is overkill for simple configuration files and incurs higher cost and complexity; more critically, NSGs alone do not guarantee complete internet isolation—a private endpoint is the proper method for VNet-only access. Option C is wrong because Azure Blob Storage with a service endpoint still exposes the storage account to the public internet (though restricted to the VNet), and Blob Storage is object storage not designed for file-sharing protocols like SMB, making it unsuitable for configuration files that need to be mounted as a drive.

Full explanation →
73
MCQeasy

A company uses Microsoft Entra ID and wants to allow users to sign in using their existing personal Microsoft accounts, Google, and Facebook identities. They also need custom sign-up and sign-in flows with collection of specific user attributes. Which Microsoft Entra ID feature should they use?

A.Microsoft Entra ID B2B
B.Microsoft Entra ID B2C
C.Microsoft Entra ID Identity Protection
D.Microsoft Entra ID Conditional Access
AnswerB

Microsoft Entra ID B2C is the correct solution because it is a Customer Identity and Access Management (CIAM) service built specifically to handle consumer identities at scale. It natively supports multiple identity providers, including Microsoft, Google, and Facebook, and provides self-service sign-up/sign-in user flows. With the Identity Experience Framework, you can define custom policies that collect custom attributes, perform API-based validation, and create fully branded, tailored registration journeys for customers, which is exactly what this company needs.

Why this answer

Microsoft Entra ID B2C (Business-to-Consumer) is the correct choice because it is specifically designed to support external identity providers like personal Microsoft accounts, Google, and Facebook, and it provides a customizable policy framework (user flows) for sign-up and sign-in that can collect custom user attributes. Unlike B2B, which focuses on business partner collaboration, B2C allows you to define attribute collection during registration via built-in or custom policies.

Exam trap

The trap here is that candidates often confuse Entra ID B2B with B2C, assuming B2B can handle consumer identities and custom sign-up flows, but B2B is strictly for business partner collaboration and lacks the user flow customization and social identity provider support that B2C provides.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID B2B is intended for business-to-business collaboration, allowing external users from partner organizations to access your apps using their work or school accounts, not personal Microsoft accounts, Google, or Facebook identities, and it does not support custom sign-up flows with attribute collection. Option C is wrong because Microsoft Entra ID Identity Protection is a security feature that detects and responds to identity-based risks (e.g., leaked credentials, sign-in anomalies) and does not provide federation with external identity providers or custom sign-up flows. Option D is wrong because Microsoft Entra ID Conditional Access is a policy engine that enforces access controls (e.g., MFA, device compliance) based on conditions like user, location, or risk, but it cannot configure external identity providers or custom sign-up/attribute collection.

Full explanation →
74
MCQhard

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to implement a solution that automatically detects identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. They want to generate reports summarizing risk events and integrate the risk data with their existing Security Information and Event Management (SIEM) system via API. Which Microsoft Entra ID feature should they use?

A.Microsoft Entra ID Conditional Access
B.Microsoft Entra ID Identity Protection
C.Microsoft Entra ID Privileged Identity Management (PIM)
D.Microsoft Entra ID Entitlement Management
AnswerB

Microsoft Entra ID Identity Protection is the correct service because it continuously detects a broad range of identity risks—including leaked credentials, impossible travel, unfamiliar sign-in properties, and anomalous user activity—and stores each detection as a rich risk event. It provides detailed risk reports in the portal and, importantly, exposes these risk events through Microsoft Graph API endpoints (e.g., riskDetection and riskyUser), enabling direct integration with a SIEM. This combination of detection, reporting, and API access makes it the only option that meets the stated requirement.

Why this answer

Microsoft Entra ID Identity Protection is the correct feature because it is specifically designed to automatically detect identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. It provides risk event reports and integrates with SIEM systems via the Microsoft Graph API, enabling automated risk data export for centralized monitoring.

Exam trap

The trap here is that candidates often confuse Conditional Access (which enforces policies) with Identity Protection (which detects risks), but Conditional Access relies on Identity Protection's risk signals and cannot generate risk events on its own.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Conditional Access is a policy engine that enforces access controls based on signals (e.g., risk level from Identity Protection), but it does not detect or generate risk events itself. Option C is wrong because Privileged Identity Management (PIM) focuses on just-in-time privileged role activation and access reviews, not on detecting identity risks like leaked credentials or impossible travel. Option D is wrong because Entitlement Management handles access packages and lifecycle management for external users and groups, not risk detection or SIEM integration.

Full explanation →
75
MCQmedium

A company uses Microsoft Entra ID (Microsoft Entra ID). They need to grant specific IT administrators just-in-time (JIT) access to Azure virtual machines for troubleshooting. The access must be time-bound, require approval from a senior manager, and be automatically revoked after the granted time period. The company also needs an audit log of all access requests and assignments. Which Azure service or feature should they use?

A.Azure Bastion
B.Microsoft Entra ID Privileged Identity Management (PIM) for Azure resources
C.Just-in-Time VM access (Microsoft Defender for Cloud)
D.Microsoft Entra ID Application Proxy
AnswerB

Microsoft Entra ID Privileged Identity Management (PIM) for Azure resources is the correct choice because it activates RBAC roles, such as Virtual Machine Administrator Login or Contributor, just-in-time with a configurable maximum duration (typically 1–8 hours). Activation can require justification, multi-factor authentication, and an explicit approval from a designated manager or approver, and the role is automatically deactivated when the time window expires. Every activation and action is logged in the Microsoft Entra audit log, providing a complete and auditable record of who accessed what, when, and for how long.

Why this answer

Microsoft Entra ID Privileged Identity Management (PIM) for Azure resources provides just-in-time (JIT) access with time-bound activation, approval workflows, and automatic revocation. It also includes full audit logging of all requests and assignments, meeting all the specified requirements for granting temporary access to Azure VMs.

Exam trap

The trap here is that candidates confuse Just-in-Time VM access in Microsoft Defender for Cloud (which is network-level JIT) with PIM for Azure resources (which is role-level JIT), but only PIM supports the required approval workflow and audit logging for role assignments.

How to eliminate wrong answers

Option A is wrong because Azure Bastion provides secure RDP/SSH connectivity to VMs over TLS without public IPs, but it does not offer time-bound JIT access, approval workflows, or automatic revocation. Option C is wrong because Just-in-Time VM access in Microsoft Defender for Cloud provides time-bound network-level access (NSG rules) to VMs, but it lacks the built-in approval workflow from a senior manager and does not integrate with Entra ID PIM for role-based access control. Option D is wrong because Microsoft Entra ID Application Proxy enables secure remote access to on-premises web applications via pre-authentication, not to Azure VMs, and it does not provide JIT access, approval workflows, or automatic revocation.

Full explanation →

Page 1 of 3

Page 2

All pages

123

Practice AZ-305 by domain

Target a specific domain to shore up weak areas.

Design identity, governance, and monitoring solutionsDesign data storage solutionsDesign business continuity solutionsDesign infrastructure solutions
See all domains with question counts →