Microsoft Azure Solutions Architect Expert AZ-305 AZ-305 Questions 76–150 | Page 2/3

MCQeasy

A company wants to store raw data from IoT devices, social media feeds, and transactional databases for analytics. They need a storage solution that supports a hierarchical namespace for organizing data into directories and allows fine-grained access control at the directory and file level. They also need to query the data using Azure Synapse Analytics in-place. Which Azure storage solution should they use?

A.A

B.B

C.C

D.D

AnswerB

Azure Data Lake Storage Gen2 is Azure Blob Storage with a hierarchical namespace, enabling directory-level ACLs that integrate with Microsoft Entra ID for fine-grained permission control. It is optimized for large-scale analytics workloads, supports POSIX-like permissions, and integrates natively with Azure Synapse Analytics for in-place querying without data movement. Its ability to organize data into directories and subdirectories while remaining accessible via both Blob and ADLS Gen2 APIs makes it the ideal landing zone for structured and unstructured IoT and social media data.

Why this answer

Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it provides a hierarchical namespace that organizes data into directories and subdirectories, supports POSIX-like fine-grained access control at the directory and file level via ACLs, and can be queried in-place by Azure Synapse Analytics using its built-in serverless SQL pool or dedicated SQL pool. This combination of hierarchical namespace, granular security, and direct analytics integration makes it ideal for the described raw data storage and analytics scenario.

Exam trap

The trap here is that candidates often confuse Azure Blob Storage (flat namespace, no directory ACLs) with ADLS Gen2 (hierarchical namespace, full ACL support) because both are built on the same underlying storage platform, but only ADLS Gen2 enables the directory-level organization and fine-grained access control required for enterprise analytics workloads.

How to eliminate wrong answers

Option A is wrong because Azure Blob Storage does not natively support a hierarchical namespace or fine-grained directory/file-level ACLs; it uses a flat namespace and container-level access policies, which cannot meet the directory organization and granular access control requirements. Option C is wrong because Azure Files provides SMB file shares with directory structure and ACLs, but it is not designed for in-place querying by Azure Synapse Analytics and lacks the scale-out performance and analytics integration needed for big data workloads. Option D is wrong because Azure Cosmos DB is a NoSQL database optimized for transactional and real-time workloads with its own query API (SQL, MongoDB, etc.), not a storage solution for raw data with a hierarchical namespace, and it cannot be queried in-place by Azure Synapse Analytics as a storage layer.

Full explanation →

MCQhard

Your company has a hybrid identity environment using Microsoft Entra ID (formerly Azure AD) and on-premises Active Directory. You need to design a solution that allows users to authenticate to Azure services using their on-premises credentials and enforce conditional access policies for sensitive applications. The solution must support multi-factor authentication (MFA) using the Microsoft Authenticator app. Which components should you include?

A.Microsoft Entra Connect Health, Microsoft Entra ID with cloud sync, and Azure AD Identity Protection.

B.Microsoft Entra Connect Sync, Microsoft Entra ID, and Conditional Access policies with MFA.

C.Active Directory Federation Services (AD FS), Web Application Proxy, and Azure AD Conditional Access.

D.Azure AD Pass-through Authentication, Azure AD Application Proxy, and Azure AD Identity Protection.

AnswerB

Connect Sync syncs identities; Entra ID provides authentication and conditional access can require MFA via Authenticator.

Why this answer

Microsoft Entra Connect Sync synchronizes on-premises Active Directory identities to Microsoft Entra ID, enabling users to authenticate with their on-premises credentials. Conditional Access policies in Microsoft Entra ID can then enforce MFA using the Microsoft Authenticator app for sensitive applications, meeting all requirements without additional infrastructure.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing on-premises federation (AD FS) or pass-through authentication, not realizing that Microsoft Entra Connect Sync with Conditional Access is the simplest and most scalable approach for hybrid identity with MFA enforcement.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Connect Health is a monitoring tool, not an authentication component, and cloud sync does not support the full identity synchronization needed for seamless on-premises credential authentication; it also lacks the Conditional Access enforcement required. Option C is wrong because AD FS and Web Application Proxy introduce an unnecessary on-premises federation server, adding complexity and single points of failure, while the requirement can be met with cloud-native Microsoft Entra ID and Conditional Access. Option D is wrong because Azure AD Pass-through Authentication requires on-premises agents and does not natively support Conditional Access policies with MFA enforcement in the same integrated way as Microsoft Entra ID; Azure AD Application Proxy is for publishing on-premises apps, not for authentication, and Identity Protection is a risk-detection service, not an authentication component.

Full explanation →

MCQmedium

A company uses Microsoft Entra ID and wants to enforce that all users must use multi-factor authentication (MFA) when accessing sensitive applications. However, they want to exclude users when connecting from the corporate office IP range and only allow access from devices that are compliant with Intune policies. Which Microsoft Entra ID feature should they use to create this policy?

A.Microsoft Entra ID Identity Protection

B.Microsoft Entra ID Privileged Identity Management

C.Microsoft Entra ID Conditional Access

D.Microsoft Entra ID Identity Governance

AnswerC

Conditional Access policies allow you to specify conditions (e.g., IP location, device compliance) and controls (e.g., require MFA, block access). This enables the described scenario: require MFA for sensitive apps, but exclude corporate IP range and require compliant device.

Why this answer

C is correct because Microsoft Entra ID Conditional Access is the feature specifically designed to enforce granular access policies based on conditions such as user, location, device compliance, and application sensitivity. By configuring a Conditional Access policy, you can require MFA for sensitive applications, exclude the corporate office IP range, and restrict access to Intune-compliant devices, all within a single policy.

Exam trap

The trap here is that candidates often confuse Conditional Access with Identity Protection, thinking risk-based policies can enforce location or device compliance, but Identity Protection only triggers actions based on risk scores, not static conditions like IP ranges or Intune compliance.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID Identity Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, sign-ins from anonymous IPs) and can trigger MFA based on risk level, but it cannot enforce device compliance or exclude specific IP ranges directly. Option B is wrong because Microsoft Entra ID Privileged Identity Management manages just-in-time privileged role activation and access reviews, not general user access policies for sensitive applications. Option D is wrong because Microsoft Entra ID Identity Governance handles access lifecycle, entitlement management, and certification campaigns, not real-time access enforcement based on location or device compliance.

Full explanation →

MCQeasy

A company wants to migrate its on-premises file server to Azure with minimal application changes. The application accesses files over the SMB protocol and requires identity-based access using the existing on-premises Active Directory Domain Services (AD DS). They need the solution to be fully managed with low latency. Which Azure storage solution should they choose?

A.Azure Files

B.Azure NetApp Files

C.Azure Blob Storage with NFS 3.0

D.Azure Disk Storage

AnswerA

Azure Files is the correct choice because it delivers fully managed SMB file shares natively in Azure, allowing the on-premises file server to be lifted and shifted without any application changes. It supports authentication with existing on-premises Active Directory Domain Services identity, so users and permissions map directly, and being a PaaS service, it requires no dedicated network infrastructure like delegated subnets or capacity pools to maintain.

Why this answer

Azure Files is the correct choice because it provides fully managed SMB file shares that can be accessed over the SMB protocol with identity-based authentication using on-premises AD DS via Azure Files AD DS integration. This allows the application to connect with minimal changes, as it continues to use SMB and existing domain credentials, while Azure Files offers low-latency access when deployed in the same region as the application.

Exam trap

The trap here is that candidates often confuse Azure NetApp Files with Azure Files, assuming that because NetApp Files supports SMB and AD DS, it is the best choice, but they overlook the 'fully managed' requirement and the fact that Azure Files is the simpler, more cost-effective PaaS solution for standard file server migrations.

How to eliminate wrong answers

Option B is wrong because Azure NetApp Files is a high-performance, enterprise-grade file service that supports SMB and AD DS, but it is not fully managed in the same sense as Azure Files (it requires provisioning of capacity pools and has a different pricing model); it also introduces unnecessary complexity for a standard file server migration. Option C is wrong because Azure Blob Storage with NFS 3.0 does not support the SMB protocol, and it lacks native identity-based access with on-premises AD DS, requiring different authentication mechanisms. Option D is wrong because Azure Disk Storage provides block-level storage attached to a VM, not a shared file service; it would require the application to be rewritten or run on a VM with a file server role, increasing management overhead and not meeting the fully managed requirement.

Full explanation →

MCQhard

A global e-commerce company deploys its web application on Azure Kubernetes Service (AKS) clusters in multiple Azure regions. They need a single global endpoint for users, with SSL offloading, web application firewall (WAF) protection, and URL path-based routing to the nearest healthy AKS cluster. Which Azure service should they use?

A.Azure Front Door

B.Azure Traffic Manager

C.Azure Application Gateway

D.Azure Load Balancer

AnswerA

Azure Front Door is correct because it operates at Layer 7 as a global entry point using Microsoft's edge network. It supports SSL offloading, web application firewall (WAF), and URL path-based routing, and it uses anycast to route users to the nearest healthy backend based on global health probes. This uniquely combines global distribution with HTTP-layer intelligence and security, making it ideal for a globally distributed e-commerce web application.

Why this answer

Azure Front Door is the correct choice because it provides a single global endpoint with SSL offloading, WAF protection, and URL path-based routing. It uses Anycast-based routing to direct traffic to the nearest healthy AKS cluster, ensuring low latency and high availability across multiple regions.

Exam trap

The trap here is that candidates often confuse Azure Traffic Manager (DNS-level) with Azure Front Door (application-layer), overlooking the need for SSL offloading, WAF, and path-based routing that only Front Door provides.

How to eliminate wrong answers

Option B (Azure Traffic Manager) is wrong because it operates at the DNS level and does not support SSL offloading, WAF, or URL path-based routing; it only provides DNS-based traffic distribution. Option C (Azure Application Gateway) is wrong because it is a regional load balancer that cannot provide a single global endpoint across multiple Azure regions; it lacks global Anycast routing. Option D (Azure Load Balancer) is wrong because it operates at Layer 4 (TCP/UDP) and does not support SSL offloading, WAF, or URL path-based routing; it is designed for regional traffic distribution within a single region.

Full explanation →

MCQeasy

A company deploys a stateless web application on Azure VMs in a single region. They need to distribute incoming HTTP traffic across multiple VMs and perform health checks. The solution should be highly available within the region. Which Azure load balancing solution should they use?

A.Azure Load Balancer (Standard) with HTTP health probe.

B.Azure Application Gateway v2.

C.Azure Traffic Manager.

D.Azure Front Door.

AnswerA

The Standard Load Balancer is a regional Layer 4 load balancer that distributes TCP/UDP traffic across backend VM instances. Its HTTP health probe periodically sends HTTP GET requests to the configured path and removes any VM that does not return a 2xx status, enabling automatic failover. Being zone-redundant, it provides high availability within a region, and because the app is stateless, no session persistence or Layer 7 routing is needed. This makes it the simplest, most cost-effective choice.

Why this answer

Azure Load Balancer (Standard) operates at Layer 4 (TCP/UDP) and can distribute HTTP traffic across VMs in a single region while performing health checks via HTTP health probes. It provides high availability within a region by distributing traffic across availability zones or availability sets, meeting the requirement for a stateless web application without needing Layer 7 features.

Exam trap

The trap here is that candidates often choose Azure Application Gateway v2 because they assume HTTP traffic requires a Layer 7 load balancer, but Azure Load Balancer can handle HTTP traffic at Layer 4 with HTTP health probes, making it the simpler and more cost-effective choice for a stateless web application within a single region.

How to eliminate wrong answers

Option B is wrong because Azure Application Gateway v2 is a Layer 7 load balancer with features like SSL termination, URL-based routing, and WAF, which are unnecessary for a stateless web application that only needs basic HTTP traffic distribution and health checks, adding cost and complexity. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic routing solution that operates across regions, not within a single region, and does not perform health checks on individual VMs or distribute incoming HTTP traffic directly. Option D is wrong because Azure Front Door is a global Layer 7 load balancer and CDN that routes traffic across regions, not within a single region, and includes features like SSL offload and WAF that are not required for this scenario.

Full explanation →

MCQhard

A company runs a mission-critical application on Azure VMs in West US. They need a disaster recovery plan with an RPO of 5 minutes and an RTO of 30 minutes. The application consists of multiple VMs that must be recovered in a specific order: the database VM first, then the front-end VMs. They also need to ensure that after failover, the IP addresses of the VMs are retained to avoid DNS propagation delays. The company wants to test the recovery process periodically without affecting production. Which Azure Site Recovery features should they use?

A.Use recovery plans with virtual machine group ordering and failover network settings to assign static IPs.

B.Use failover settings with retention IP and test failover.

C.Use recovery plans with custom scripts for ordering and Azure Traffic Manager for IP retention.

D.Use Azure Site Recovery with Application Consistent Snapshots and ignore IP retention.

AnswerA

Recovery plans allow you to create groups of VMs and specify the order of failover. Failover network settings enable you to assign static IP addresses to the recovered VMs. Test failover is supported for drills.

Why this answer

Azure Site Recovery recovery plans allow you to define the order of VM recovery using groups, and you can assign static IP addresses via failover network settings to retain IPs after failover. This meets the RPO of 5 minutes (via continuous replication) and RTO of 30 minutes (via orchestrated failover), while test failover can be performed without impacting production.

Exam trap

The trap here is that candidates often confuse Azure Traffic Manager (a DNS-based traffic routing service) with Site Recovery's built-in IP retention capabilities, or they assume that 'retention IP' is a standalone feature rather than a configuration within failover network settings.

How to eliminate wrong answers

Option B is wrong because 'retention IP' is not a valid Azure Site Recovery feature; IP retention is achieved through failover network settings, not a separate 'retention IP' option, and test failover alone does not address VM ordering. Option C is wrong because Azure Traffic Manager is used for global load balancing and DNS-based traffic routing, not for IP retention in Site Recovery; custom scripts in recovery plans can help with ordering but are not the primary feature for static IP assignment. Option D is wrong because ignoring IP retention would cause IP address changes after failover, leading to DNS propagation delays, which contradicts the requirement to avoid such delays; Application Consistent Snapshots address data consistency but not IP retention or VM ordering.

Full explanation →

MCQmedium

A financial services company runs a critical application on Azure VMs with SQL Server Always On availability groups. The primary region is East US, and the secondary region is West US. The business requires automatic failover with zero data loss in case of a regional disaster. Which configuration should you recommend for the availability group?

A.Use synchronous commit mode with manual failover

B.Use asynchronous commit mode with automatic failover

C.Use synchronous commit mode with automatic failover

D.Use asynchronous commit mode with manual failover

AnswerC

Synchronous commit ensures zero data loss; automatic failover meets RTO.

Why this answer

The requirement for automatic failover with zero data loss in a disaster recovery scenario necessitates synchronous commit mode, which ensures that transactions are committed on both the primary and secondary replicas before the primary acknowledges the commit. Automatic failover is only supported with synchronous commit mode when both replicas are in a healthy state, allowing the secondary to automatically become the primary without manual intervention. This configuration meets the business need for zero data loss (RPO=0) and minimal downtime (RTO) during a regional disaster.

Exam trap

The trap here is that candidates often confuse synchronous commit with automatic failover, mistakenly thinking that synchronous commit alone enables automatic failover, or they assume asynchronous commit can achieve zero data loss if the network is fast, but the exam strictly requires synchronous commit for zero data loss and automatic failover for the failover mode.

How to eliminate wrong answers

Option A is wrong because manual failover with synchronous commit mode would require human intervention to promote the secondary, which does not satisfy the automatic failover requirement. Option B is wrong because asynchronous commit mode does not guarantee zero data loss; transactions committed on the primary may not be replicated to the secondary before a disaster, resulting in potential data loss. Option D is wrong because asynchronous commit mode with manual failover combines the worst aspects: potential data loss from async mode and the need for manual intervention, failing both the zero data loss and automatic failover requirements.

Full explanation →

Multi-Selecthard

Your company plans to migrate a large number of on-premises virtual machines to Azure. You need to assess the current environment and migrate the workloads with minimal downtime. Which THREE Azure services or tools should you use? (Choose three.)

Select 3 answers

A.Azure App Service

B.Azure Import/Export Service

C.Azure Data Box

D.Azure Site Recovery

E.Azure Migrate

AnswersC, D, E

Azure Data Box is a physical appliance that Microsoft ships to your site, enabling secure, offline bulk transfer of up to 80 TB of data over a high-speed local copy path when network bandwidth is limited or non-existent. After you copy data onto the device, you return it, and Microsoft uploads the data to an Azure storage account. This makes Data Box ideal for large initial data loads, but it is not itself a continuous replication or live migration tool; it facilitates lifting and shifting data, which can then be attached to newly deployed VMs. For a migration involving a huge volume of on-premises data with constrained connectivity, Data Box provides the fastest and most cost-effective way to move the raw data into Azure.

Why this answer

Azure Data Box is correct because it enables large-scale offline data transfer for environments with limited network bandwidth, allowing you to migrate terabytes of VM data to Azure without relying on slow or unstable connections. This service is ideal for the initial bulk copy of on-premises VM disks, which can then be used with Azure Migrate for assessment and Azure Site Recovery for ongoing replication with minimal downtime.

Exam trap

The trap here is that candidates often confuse Azure Data Box with Azure Import/Export Service, but Data Box is the modern, recommended service for large-scale offline migration, while Import/Export is outdated and less integrated with Azure Migrate and Site Recovery.

Full explanation →

MCQhard

A company runs a critical application using Azure SQL Database in the West US region. They need a disaster recovery solution that automatically fails over to a secondary region (East US) with a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of 1 minute. The secondary region must also be able to serve read-only queries for reporting purposes. Which Azure SQL Database feature should they implement?

A.Azure SQL Database active geo-replication with auto-failover group

B.Azure SQL Database geo-restore

C.Azure SQL Database copy

D.Azure SQL Managed Instance failover group

AnswerA

For a critical application running on Azure SQL Database, active geo-replication with an auto-failover group provides the most suitable business continuity. The replication is asynchronous, keeping a second readable database in a different Azure region with an RPO of up to 5 seconds. The auto-failover group continuously monitors health and initiates automatic failover with a target RTO of 1 minute, minimizing downtime. This combination meets the strict RPO/RTO requirements while also allowing the secondary to serve read-only queries.

Why this answer

Active geo-replication with auto-failover groups is the correct choice because it provides automatic, synchronous failover to a secondary region with an RPO of 5 seconds and an RTO of 1 minute. Additionally, the secondary database can be used for read-only reporting by connecting with the 'ApplicationIntent=ReadOnly' connection string, meeting both the disaster recovery and reporting requirements.

Exam trap

The trap here is that candidates often confuse geo-restore (which is manual and has high RPO/RTO) with active geo-replication, or they mistakenly think that SQL Managed Instance failover groups support read-only secondaries for Azure SQL Database, when in fact they are for Managed Instance only.

How to eliminate wrong answers

Option B (geo-restore) is wrong because it is a manual recovery process that restores a database from geo-replicated backups, resulting in an RPO of 1 hour and an RTO of several hours, far exceeding the required 5-second RPO and 1-minute RTO. Option C (copy) is wrong because it creates a point-in-time snapshot copy of the database, which is not a continuous replication solution and cannot provide automatic failover or meet the low RPO/RTO requirements. Option D (Azure SQL Managed Instance failover group) is wrong because it applies to Azure SQL Managed Instance, not Azure SQL Database, and while it supports auto-failover, it does not natively allow the secondary to serve read-only queries for reporting without additional configuration.

Full explanation →

MCQmedium

A company runs a stateless web application on Azure VMs. They need to ensure the application remains available in the event of an entire Azure datacenter failure. They want to achieve a 99.99% SLA. Which deployment option should they recommend?

A.A

B.B

C.C

D.D

AnswerB

Placing at least two VM instances across two or more Azure availability zones in the same region gives each zone independent power, cooling, and network paths, so a failure of one entire zone or datacenter leaves the other zone(s) serving traffic. This architecture satisfies the Azure Compute SLA of 99.99% connectivity to at least one instance during monthly uptime, and, because the application is stateless, traffic can be load-balanced between zones with no session-stickiness concerns.

Why this answer

To survive an entire Azure datacenter failure and achieve a 99.99% SLA, the stateless web application must be deployed across at least two Azure Availability Zones within a region. Availability Zones are physically separate datacenters within the same region, each with independent power, cooling, and networking. Deploying VMs in a zone-redundant configuration ensures that if one datacenter fails, the application continues running in another zone, meeting the 99.99% SLA (which requires a minimum of two zones).

Exam trap

The trap here is that candidates often confuse Availability Sets (which protect against rack failures) with Availability Zones (which protect against datacenter failures), leading them to choose an option that only provides 99.95% SLA instead of the required 99.99%.

How to eliminate wrong answers

Option A is wrong because deploying VMs in an Availability Set protects against rack-level failures within a single datacenter, not against an entire datacenter failure, and it offers only a 99.95% SLA. Option C is wrong because deploying VMs in a single Availability Zone still leaves the application vulnerable to a datacenter failure within that zone, and the SLA for a single zone is 99.95%. Option D is wrong because deploying VMs in a single region without zone redundancy does not protect against a full datacenter failure, and the SLA for a single VM is 99.9%.

Full explanation →

MCQmedium

Your company runs a mission-critical application on Azure Virtual Machines in a single region. You need to design a monitoring solution that provides proactive alerts for performance degradation and allows the operations team to analyze historical trends. The solution must minimize cost and operational overhead. You have an existing Log Analytics workspace. What should you include in the design?

A.Enable VM insights in Azure Monitor and use its live map and performance views for historical analysis.

B.Configure Azure Autoscale for the VMs based on CPU metrics and use Azure Monitor for logging.

C.Deploy Application Insights on each VM and use its built-in alerts for performance.

D.Enable Azure Monitor on all VMs using the Azure Monitor agent. Create metric alerts for high CPU and memory usage. Use Log Analytics to query and analyze historical performance data.

AnswerD

Enable the Azure Monitor agent on all VMs to collect guest OS performance counters (CPU, memory, disk) and forward them to a Log Analytics workspace. Metric alerts can then be configured on these performance counters for near-real-time proactive notification when thresholds are breached. The historical data in the workspace can be queried with Kusto Query Language to analyze long-term trends and capacity forecasting. This combination gives low-overhead, proactive alerting plus powerful historical analysis, and is the standard Azure Well-Architected approach for VM monitoring.

Why this answer

It uses the Azure Monitor agent to collect performance data from VMs, enabling metric alerts for proactive notification of high CPU and memory usage, while leveraging the existing Log Analytics workspace for cost-effective historical analysis. This approach minimizes operational overhead by using a single agent and native Azure Monitor features without additional services or complex configurations.

Exam trap

The trap here is that candidates may confuse VM insights (which offers rich visualizations but limited historical analysis) with the full monitoring solution required, or mistakenly think Application Insights is appropriate for VM-level performance monitoring when it is designed for application telemetry.

How to eliminate wrong answers

Option A is wrong because VM insights provides live map and performance views for real-time monitoring but is not designed for deep historical trend analysis, and its prebuilt performance charts have limited retention without Log Analytics. Option B is wrong because Azure Autoscale is for automatically scaling VM instances based on metrics, not for monitoring performance degradation or analyzing historical trends; it also does not address the requirement for proactive alerts and historical analysis. Option C is wrong because Application Insights is primarily for application-level monitoring (e.g., web apps, APIs) and requires instrumenting each application, which adds cost and complexity; it is not suitable for OS-level performance metrics like CPU and memory on VMs.

Full explanation →

MCQmedium

A company runs a critical application on Azure Kubernetes Service (AKS) in a single region. The application is stateless and uses an Azure SQL Database with active geo-replication for database DR. They need to ensure the AKS cluster can failover to a secondary region with an RTO of 15 minutes and an RPO of 5 seconds for the database. What should they recommend for the AKS cluster?

A.Deploy AKS clusters in two regions and use Azure Traffic Manager to route traffic.

B.Deploy a single AKS cluster with pods spread across availability zones within the region.

C.Use Azure Site Recovery to replicate the AKS cluster to another region.

D.Back up the AKS cluster configuration and container images to a geo-redundant storage account.

AnswerA

Traffic Manager provides DNS-based global load balancing. With AKS clusters in two regions, Traffic Manager can direct users to the healthy region, achieving the required RTO. The database DR is handled separately by active geo-replication.

Why this answer

Deploying AKS clusters in two regions with Azure Traffic Manager enables active-passive or active-active failover. Traffic Manager uses DNS-based routing to direct traffic to the secondary region when the primary fails, meeting the RTO of 15 minutes. The stateless application can be redeployed or scaled in the secondary cluster, while the Azure SQL Database with active geo-replication ensures an RPO of 5 seconds by continuously replicating transactions.

Exam trap

The trap here is that candidates often confuse Azure Site Recovery as a solution for AKS DR, but Site Recovery only supports IaaS VMs, not managed Kubernetes services, making multi-region AKS clusters with Traffic Manager the correct approach.

How to eliminate wrong answers

Option B is wrong because spreading pods across availability zones within a single region protects against zonal failures but not against a regional outage, which is required for cross-region DR. Option C is wrong because Azure Site Recovery does not support replicating AKS clusters; it is designed for IaaS VMs, not managed Kubernetes services. Option D is wrong because backing up cluster configuration and container images to geo-redundant storage provides data backup but does not enable automated failover or meet the RTO of 15 minutes, as manual restoration would be required.

Full explanation →

MCQmedium

A company plans to deploy multiple virtual machines (VMs) across two Azure regions for high availability. The VMs will host a stateless web application that must be accessible via a single DNS endpoint. The solution must automatically route traffic to the nearest region with available capacity and provide failover if a region becomes unhealthy. Which Azure service should they use to meet these requirements?

A.Azure Traffic Manager

B.Azure Front Door

C.Azure Load Balancer

D.Azure Application Gateway

AnswerA

Azure Traffic Manager is a DNS-based global load balancer that routes incoming DNS requests to the most appropriate regional endpoint based on routing methods such as performance, geographic, weighted, or priority. It continuously monitors endpoint health and can automatically redirect traffic away from failed or overloaded regions, ensuring high availability and capacity-aware distribution across multiple VMs in different regions.

Why this answer

Azure Traffic Manager is a DNS-based traffic load balancer that distributes traffic to the nearest region with available capacity using the Performance traffic-routing method, and it automatically fails over to the next healthy endpoint when a region becomes unhealthy. It operates at the DNS level, returning the appropriate endpoint IP based on the client's DNS resolver location and endpoint health probes, making it ideal for stateless web applications requiring a single DNS endpoint across regions.

Exam trap

The trap here is that candidates often confuse Azure Front Door (Layer 7, HTTP/HTTPS) with Traffic Manager (DNS-based, any protocol), but the requirement for a single DNS endpoint and region-level failover without specifying HTTP makes Traffic Manager the correct choice.

How to eliminate wrong answers

Option B (Azure Front Door) is wrong because it is an HTTP/HTTPS application delivery controller that provides global load balancing with SSL offload and path-based routing, but it operates at Layer 7 and requires HTTP traffic, whereas the question does not specify HTTP-only traffic and Traffic Manager works at DNS level for any protocol. Option C (Azure Load Balancer) is wrong because it operates at Layer 4 and distributes traffic only within a single region, not across multiple Azure regions. Option D (Azure Application Gateway) is wrong because it is a regional Layer 7 load balancer with HTTP/HTTPS features and cannot route traffic across multiple regions or provide global failover.

Full explanation →

MCQeasy

A company is deploying a multi-tier web application on Azure VMs. The web tier must be accessible from the internet, while the application and database tiers must be isolated within the virtual network. The solution must provide SSL termination, web application firewall (WAF) capabilities, and URL-based routing. Which Azure service should they use to expose the web tier?

A.Use an Azure Load Balancer and configure NSGs on each subnet.

B.Use Azure Firewall to inspect all traffic and allow internet traffic to the web tier.

C.Use Azure Application Gateway with WAF, and configure NSGs to restrict traffic between tiers.

D.Use Azure Front Door to expose the web tier and NSGs for internal isolation.

AnswerC

Azure Application Gateway is a Layer 7 regional load balancer that provides SSL termination, WAF, URL-based routing, and cookie-based session affinity, making it the appropriate entry point for the web tier. By enabling WAF, it actively blocks common web vulnerabilities such as SQL injection and cross-site scripting before they reach the backend. Complementing this with NSGs on each subnet enforces network-level isolation, ensuring that only the web tier can communicate with the app tier on specific ports (e.g., 8080/tcp) and that the app tier cannot initiate outbound connections to the internet. This combination of application-layer protection and subnet-level access control exactly matches the requirement to restrict traffic between tiers while securely exposing the web tier.

Why this answer

Azure Application Gateway is a Layer 7 load balancer that provides SSL termination, a web application firewall (WAF), and URL-based routing, making it ideal for exposing a web tier to the internet. By placing the gateway in front of the web tier and configuring network security groups (NSGs) on the application and database subnets, you can isolate internal tiers while meeting all stated requirements.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming a basic load balancer can handle SSL termination and WAF, when in fact those features require Layer 7 capabilities.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer operates at Layer 4 and cannot perform SSL termination, WAF inspection, or URL-based routing; it only distributes traffic based on IP and port. Option B is wrong because Azure Firewall is a stateful Layer 3/4 firewall that does not provide SSL termination or URL-based routing, and it is not designed to act as a reverse proxy for web tiers. Option D is wrong because Azure Front Door is a global Layer 7 service that excels at CDN and cross-region routing but does not natively support URL-based routing within a single virtual network; it is typically used for global load balancing, not for internal tier isolation with NSGs.

Full explanation →

MCQmedium

A company runs several Azure virtual machines (VMs) that host SQL Server databases. The databases are stored on data disks attached to the VMs. The company needs to back up the databases and VMs separately. They require application-consistent backups for SQL Server to ensure transactional integrity. Additionally, they need to retain backups for up to 7 years to meet compliance requirements. The solution must minimize administrative overhead and support long-term retention of database backups. Which Azure service or feature should they use for the database backups?

A.Azure Backup for Azure VMs with application-consistent snapshots

B.Azure Backup for SQL Server in Azure VMs

C.Azure Site Recovery

D.Azure Files

AnswerB

Azure Backup for SQL Server in Azure VMs is a SQL-aware backup solution that leverages SQL Server's VDI and VSS integration to deliver true application-consistent backups for each database. It orchestrates full, differential, and transaction log backups, enabling point-in-time restore to any second within the retention window. The service supports granular database-level restore, so you can recover one database without affecting others, and offers retention up to 10 years using the archive tier, comfortably exceeding the 7-year requirement. Its built-in management of backup schedules, retention ranges, and restore operations makes it the only option that fully satisfies the database-specific backup needs.

Why this answer

Azure Backup for SQL Server in Azure VMs is the correct choice because it provides native, application-consistent backups specifically for SQL Server databases running on Azure VMs. It integrates directly with SQL Server VSS writer to ensure transactional integrity, supports long-term retention up to 10 years (exceeding the 7-year requirement), and minimizes administrative overhead by automating backup scheduling, retention management, and point-in-time restore. This service is purpose-built for SQL Server database backups, separate from VM-level backups.

Exam trap

The trap here is that candidates often confuse 'application-consistent snapshots' at the VM level with true SQL Server–aware database backups, overlooking that VM-level backups do not guarantee SQL Server transactional integrity or support database-level restore and long-term retention policies.

How to eliminate wrong answers

Option A is wrong because Azure Backup for Azure VMs with application-consistent snapshots backs up the entire VM (including OS and data disks) but does not provide SQL Server–aware, database-level backup granularity or transactional integrity for SQL Server databases; it only ensures file-system consistency, not application consistency for SQL Server. Option C is wrong because Azure Site Recovery is a disaster recovery solution focused on replication and failover for business continuity, not a backup service for long-term retention or application-consistent database backups. Option D is wrong because Azure Files is a managed file share service for storing files, not a backup solution; it lacks SQL Server–aware backup capabilities, application-consistent snapshot support, and long-term retention policies for databases.

Full explanation →

Multi-Selectmedium

Which TWO of the following are valid strategies for achieving high availability for Azure SQL Database?

Select 2 answers

A.Deploy Azure SQL Database in a zone-redundant configuration within a single region.

B.Enable read scale-out to distribute read queries to a secondary replica.

C.Enable active geo-replication with a readable secondary in the same region.

D.Use Azure Backup to copy database backups to another region.

E.Configure auto-failover groups with a secondary in another region.

AnswersA, C

Zone-redundant configuration replicates across availability zones for HA.

Why this answer

Azure SQL Database's zone-redundant configuration automatically provisions a primary replica and multiple secondary replicas across different availability zones within the same region. This ensures that if one zone fails, the database automatically fails over to a secondary replica in another zone without data loss, providing an RPO of 0 and an RTO of typically under 60 seconds. Option C is correct because active geo-replication with a readable secondary in the same region creates a synchronous replica that can be used for both high availability and read-scale workloads, though it is more commonly used for cross-region scenarios; within the same region, it offers an additional layer of redundancy beyond the default local redundancy.

Exam trap

The trap here is that candidates confuse high availability (resilience within a region) with disaster recovery (resilience across regions), leading them to select cross-region options like auto-failover groups or backup replication as high-availability strategies.

Full explanation →

MCQmedium

Your organization uses Microsoft Entra ID. You need to enforce multifactor authentication (MFA) for all guest users accessing a specific SharePoint Online site. What is the most efficient way to achieve this?

A.Use SharePoint site permissions to require MFA.

B.Create a Conditional Access policy targeting guest users and the SharePoint Online app.

C.Enable MFA per-user for each guest account.

D.Configure Microsoft Entra Entitlement Management to require MFA.

AnswerB

Conditional Access can enforce MFA for guest users and specific apps.

Why this answer

Conditional Access policies in Microsoft Entra ID allow you to enforce MFA specifically for guest users when they access the SharePoint Online app. This is the most efficient approach as it targets the exact user group (guests) and the specific application (SharePoint Online) without requiring per-user configuration or additional licensing overhead.

Exam trap

The trap here is that candidates often confuse SharePoint site permissions with identity-level security controls, assuming that MFA can be enforced at the site level, when in fact MFA must be enforced through Entra ID Conditional Access policies.

How to eliminate wrong answers

Option A is wrong because SharePoint site permissions control access at the site level but cannot enforce MFA; MFA is an identity-level security requirement managed by Entra ID, not SharePoint. Option C is wrong because enabling MFA per-user for each guest account is inefficient, requires manual management, and does not scale; it also lacks the granularity to target only the specific SharePoint Online site. Option D is wrong because Microsoft Entra Entitlement Management manages access packages and approval workflows, not MFA enforcement; it can require MFA as part of an access package policy, but that is not the most efficient or direct method for enforcing MFA on a single SharePoint site.

Full explanation →

MCQmedium

A company has Azure virtual networks (VNets) in three different Azure regions and an on-premises data center connected via ExpressRoute. They need to connect all VNets to each other and to on-premises over the Microsoft global backbone. They also require centralized management of routing and the ability to enforce security policies such as forced tunneling for internet-bound traffic. Which Azure service should they use?

A.Azure Virtual Network Manager

B.Azure Virtual WAN

C.Azure Firewall

D.Azure Route Server

AnswerB

Azure Virtual WAN is Microsoft's global transit networking service that builds a hub-and-spoke architecture with virtual hubs deployed in each region. Each virtual hub contains integrated VPN, ExpressRoute, and (optionally) Azure Firewall components, and the hubs are interconnected via Microsoft's high-speed backbone, enabling VNet-to-VNet, branch-to-VNet, and remote-user-to-VNet connectivity. It automatically manages routing tables, supports forced tunneling, and provides centralized policy management, making it the correct choice when you need reliable global transit between VNets in three different regions and on-premises connectivity.

Why this answer

Azure Virtual WAN is the correct choice because it provides a hub-and-spoke architecture that connects VNets across regions and on-premises via the Microsoft global backbone, with built-in centralized routing management and the ability to enforce security policies like forced tunneling through integrated Azure Firewall or third-party NVAs. It meets all requirements: multi-region VNet connectivity, ExpressRoute integration, and centralized policy control.

Exam trap

The trap here is that candidates often confuse Azure Virtual Network Manager (a connectivity configuration tool) with Azure Virtual WAN (a full SD-WAN solution), overlooking that Virtual WAN provides the actual routing, global transit, and integrated security enforcement required for multi-region and hybrid connectivity.

How to eliminate wrong answers

Option A is wrong because Azure Virtual Network Manager manages network group membership and connectivity configurations (like mesh or hub-and-spoke) but does not provide built-in routing management, forced tunneling, or direct integration with ExpressRoute for global backbone connectivity. Option C is wrong because Azure Firewall is a stateful firewall service that enforces security policies and forced tunneling, but it does not provide the underlying connectivity between VNets and on-premises or centralized routing management across regions. Option D is wrong because Azure Route Server enables dynamic route exchange between NVAs and Azure VNets but does not provide the global connectivity fabric, centralized routing management, or forced tunneling enforcement required for multi-region and on-premises integration.

Full explanation →

MCQmedium

A company deploys a web application on Azure VMs across multiple availability zones in the East US region. They need to distribute incoming HTTPS traffic across the VMs, offload SSL termination, and ensure that client requests from the same user session are sent to the same backend VM (session persistence). Which Azure load balancing solution should they choose?

A.Azure Application Gateway v2 with cookie-based affinity

B.Azure Load Balancer Standard with source IP affinity

C.Azure Traffic Manager with performance routing

D.Azure Front Door with session affinity

AnswerA

Azure Application Gateway v2 is the correct choice because it operates at Layer 7, allowing it to terminate SSL/TLS and inspect HTTP headers and cookies. With cookie-based affinity, the gateway sets a session cookie to bind a client to the same backend VM for the duration of the session, which is essential for stateful web applications. Additionally, v2 supports zone-redundant deployment, enabling automatic distribution of traffic across VMs placed in different availability zones.

Why this answer

Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that can offload SSL termination, distribute HTTPS traffic, and support cookie-based session affinity (also known as sticky sessions). Cookie-based affinity ensures that all requests from the same user session are routed to the same backend VM by injecting an Application Gateway-managed cookie into the client's response. This meets all three requirements: HTTPS traffic distribution, SSL offloading, and session persistence.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming that 'session persistence' alone is enough, but they overlook the explicit requirement for SSL termination, which only a Layer 7 solution like Application Gateway can provide.

How to eliminate wrong answers

Option B is wrong because Azure Load Balancer Standard operates at Layer 4 (TCP/UDP) and cannot offload SSL termination; it also supports source IP affinity for session persistence, but that is not cookie-based and does not handle HTTPS termination. Option C is wrong because Azure Traffic Manager is a DNS-level traffic router that does not perform SSL termination or session persistence; it only directs traffic based on routing methods like performance, priority, or geographic, and does not inspect HTTP/HTTPS payloads. Option D is wrong because Azure Front Door does support session affinity and SSL offloading, but it is a global load balancer and CDN service designed for multi-region distribution, not for distributing traffic across VMs within a single Azure region (East US) across availability zones; it adds unnecessary latency and complexity for a regional-only deployment.

Full explanation →

MCQmedium

A company is migrating a MongoDB-compatible application to Azure. The application requires low-latency reads and writes globally. It needs to support multi-region writes so that updates can be made from any region with automatic conflict resolution. The data is JSON documents that can vary in schema. The company wants a fully managed database service with native support for MongoDB APIs. Which Azure data service should they choose?

A.Azure SQL Database

B.Azure Cosmos DB with the API for MongoDB

C.Azure Database for MongoDB

D.Azure Cache for Redis

AnswerB

Azure Cosmos DB with the API for MongoDB is a native implementation of the MongoDB wire protocol on a globally distributed, multi-model NoSQL database service. It enables existing MongoDB drivers to connect directly while gaining Cosmos DB's turnkey global distribution, multiple consistency levels, and SLA-backed performance. It supports both shared and dedicated throughput, and features like automatic indexing and conflict resolution for multi-region writes.

Why this answer

Azure Cosmos DB with the API for MongoDB is the correct choice because it provides a fully managed, globally distributed database service that natively supports the MongoDB wire protocol. It offers multi-region writes with automatic conflict resolution using last-writer-wins (LWW) or custom conflict resolution policies, ensuring low-latency reads and writes globally. Its schema-agnostic nature handles JSON documents with varying schemas, meeting all stated requirements.

Exam trap

The trap here is that candidates may confuse 'Azure Database for MongoDB' (which does not exist) with Azure Cosmos DB's API for MongoDB, or incorrectly assume that a relational database like Azure SQL Database can handle schema-flexible JSON documents with global multi-region writes.

How to eliminate wrong answers

Option A is wrong because Azure SQL Database is a relational database that does not support MongoDB APIs, JSON document storage with varying schemas, or multi-region writes with automatic conflict resolution. Option C is wrong because Azure Database for MongoDB does not exist as a native Azure service; the correct service is Azure Cosmos DB with the API for MongoDB, and this option represents a common misconception of a separate service. Option D is wrong because Azure Cache for Redis is an in-memory caching service, not a fully managed database for persistent JSON document storage, and it does not support MongoDB APIs or multi-region writes.

Full explanation →

MCQmedium

A financial services company runs a critical SQL Server database on Azure Virtual Machines. They require a disaster recovery solution with an RPO of less than 15 seconds and an RTO of less than 1 hour. Which technology should they implement?

A.Azure Site Recovery

B.SQL Server Always On Availability Groups

C.Azure Backup for SQL Server

D.Geo-redundant backups

AnswerB

SQL Server Always On Availability Groups is correct because, with synchronous-commit mode, every transaction committed on the primary replica is hardened on a secondary replica before acknowledgment, yielding an RPO of zero. The secondary is kept in a continuously recovered state, and automatic failover with a listener can be completed within seconds to minutes, comfortably satisfying both sub-15-second RPO and sub-1-hour RTO. This is a database-level, application-aware solution that maintains transaction consistency, unlike storage or VM-level alternatives.

Why this answer

SQL Server Always On Availability Groups provide synchronous data replication at the database level, enabling an RPO of less than 15 seconds by committing transactions on both primary and secondary replicas simultaneously. With automatic failover and a secondary replica in a different Azure region, the RTO can be under 1 hour, meeting the critical requirements for a SQL Server workload on Azure VMs.

Exam trap

The trap here is that candidates often confuse Azure Site Recovery's VM-level replication with database-level replication, assuming it can meet low RPO/RTO for SQL Server, but it cannot achieve sub-15-second RPO because it replicates at the hypervisor level with inherent lag.

How to eliminate wrong answers

Option A is wrong because Azure Site Recovery replicates entire VMs at the hypervisor level, not the database level, and its typical RPO is around 30 seconds to several minutes, failing to meet the sub-15-second requirement. Option C is wrong because Azure Backup for SQL Server is a backup solution, not a real-time replication or disaster recovery technology; it provides point-in-time restores with RPOs measured in minutes or hours, not seconds. Option D is wrong because geo-redundant backups (e.g., GRS) offer recovery points that are typically hours old (due to backup schedules and replication lag), and they require a full restore process, resulting in RTOs far exceeding 1 hour.

Full explanation →

MCQmedium

A company runs a critical SQL Server database on Azure Virtual Machines in a single region. They need a disaster recovery solution across regions with a recovery point objective (RPO) of zero. The database is update-intensive with frequent writes. Which configuration should they implement?

A.SQL Server Always On Availability Group with asynchronous commit.

B.SQL Server Always On Availability Group with synchronous commit across regions.

C.Azure Site Recovery to another region.

D.Deploy the VMs in a different availability zone within the same region.

AnswerB

Synchronous commit ensures all transactions are committed on both the primary and secondary replicas before acknowledging the commit to the application. If configured across regions, this provides zero data loss (RPO=0). But network latency can affect write performance.

Why this answer

SQL Server Always On Availability Group with synchronous commit across regions ensures zero data loss because transactions are committed on both the primary and secondary replicas before the primary acknowledges the commit. This meets the RPO of zero, even though it introduces latency due to cross-region synchronization. For an update-intensive workload, synchronous commit is the only option that guarantees no data loss at the cost of increased write latency.

Exam trap

The trap here is that candidates often choose asynchronous commit (Option A) thinking it is sufficient for DR, but the RPO of zero explicitly requires synchronous commit, despite the performance trade-off.

How to eliminate wrong answers

Option A is wrong because asynchronous commit does not guarantee zero data loss; it allows transactions to be committed on the primary without waiting for the secondary, so the secondary can lag behind, violating the RPO of zero. Option C is wrong because Azure Site Recovery replicates at the VM level using crash-consistent or app-consistent snapshots, which cannot achieve an RPO of zero for a high-write database due to replication intervals and potential data loss between snapshots. Option D is wrong because deploying in different availability zones within the same region does not provide cross-region disaster recovery; it only protects against zonal failures within the same region, not a regional outage.

Full explanation →

MCQeasy

A company deploys a web application on Azure VMs. They need to distribute incoming HTTP and HTTPS traffic based on the URL path: requests to /api/* go to one VM pool, requests to /images/* go to another pool. They also need to offload SSL/TLS termination. Which Azure load balancing solution should they use?

A.Azure Load Balancer

B.Azure Application Gateway

C.Azure Traffic Manager

D.Azure Front Door

AnswerB

Azure Application Gateway is a Layer 7 web traffic load balancer that provides advanced application-level features, including URL path-based routing, SSL/TLS termination, cookie-based session affinity, and an optional Web Application Firewall (WAF). It allows traffic to be routed to different backend pools based on URL patterns, which directly meets the stated requirement. This makes it the correct choice for regional Azure VM web applications needing path-based routing and SSL offload.

Why this answer

Azure Application Gateway is a layer-7 load balancer that can route traffic based on URL path (e.g., /api/* vs /images/*) and provides SSL/TLS termination at the gateway, offloading the decryption from the backend VMs. This matches both requirements exactly, whereas other solutions either lack layer-7 path-based routing or are designed for global traffic distribution.

Exam trap

The trap here is that candidates often confuse Azure Application Gateway (regional layer-7 routing) with Azure Front Door (global layer-7 routing) or Azure Load Balancer (layer-4), failing to recognize that only Application Gateway provides both URL path-based routing and SSL termination for a single-region deployment.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer operates at layer 4 (TCP/UDP) and cannot route based on URL path or perform SSL/TLS termination; it only distributes traffic by IP and port. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic load balancer that routes based on DNS queries, not URL paths, and does not offload SSL/TLS termination. Option D is wrong because Azure Front Door is a global layer-7 service that can route by URL path and offload SSL, but it is designed for global distribution across regions, not for routing within a single region to VM pools; Application Gateway is the correct regional solution for this scenario.

Full explanation →

100

MCQeasy

A company plans to deploy a web application on Azure virtual machines. They want to protect against a datacenter failure within a region. The VMs must be distributed across multiple physically separate locations with independent power, cooling, and networking. Which deployment option should they use?

A.Availability Set

B.Availability Zones

C.Virtual Machine Scale Set

D.Proximity Placement Group

AnswerB

Availability Zones are physically separate locations inside an Azure region, each with its own independent power, cooling, and networking, and each containing at least one datacenter. By placing VMs in different zones, you ensure that no single datacenter failure can bring down all instances, because the zones are designed as isolated failure domains with no shared infrastructure. This is why zone-redundant deployment is the direct answer to protecting against a full datacenter outage.

Why this answer

Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By deploying VMs across multiple zones, the application is protected against a single datacenter failure, meeting the requirement for fault isolation at the datacenter level.

Exam trap

The trap here is that candidates often confuse Availability Sets (which protect against rack-level failures within a single datacenter) with Availability Zones (which protect against entire datacenter failures), leading them to select the wrong option when the question explicitly requires physically separate locations with independent infrastructure.

How to eliminate wrong answers

Option A is wrong because an Availability Set protects against failures within a single datacenter (rack-level faults) by distributing VMs across update and fault domains, not across physically separate datacenters. Option C is wrong because a Virtual Machine Scale Set is primarily for auto-scaling and managing identical VMs; while it can use Availability Zones, the scale set itself is not a deployment option that guarantees distribution across physically separate locations without explicit zone configuration. Option D is wrong because a Proximity Placement Group is designed to reduce network latency by co-locating VMs close together, which is the opposite of distributing them across physically separate locations.

Full explanation →

101

MCQmedium

A company has two on-premises data centers and an Azure subscription. They need to connect each data center to Azure with a private, high-bandwidth, and reliable connection. They also want a low-cost backup connection for each data center in case the primary connection fails. Which combination of connectivity options should they recommend?

A.A

B.B

C.C

D.D

AnswerA

This is the correct design because each data center establishes its own dedicated ExpressRoute circuit as the primary path, ensuring predictable, high-bandwidth, and low-latency connectivity to Azure with an SLA-backed private link. The site-to-site VPN for each data center acts as an IPsec-based backup over the internet, providing a cost-effective failover path that automatically kicks in if the ExpressRoute circuit fails. This active/passive redundancy model is a best practice for hybrid networking, as it avoids a single point of failure while keeping operational costs reasonable.

Why this answer

Azure ExpressRoute provides a private, high-bandwidth, and reliable connection from on-premises data centers to Azure, bypassing the public internet. To meet the low-cost backup requirement, Azure VPN Gateway (Site-to-Site VPN) offers a secure, encrypted connection over the internet as a failover path, which is significantly cheaper than a second ExpressRoute circuit. This combination ensures primary connectivity via ExpressRoute and cost-effective redundancy via VPN.

Exam trap

The trap here is that candidates often assume two ExpressRoute circuits are needed for redundancy, overlooking the cost-effective VPN backup option that still meets the 'low-cost' requirement while providing private connectivity only for the primary link.

How to eliminate wrong answers

Option B is wrong because using two ExpressRoute circuits for primary and backup is not low-cost; it doubles the recurring expense and is unnecessary for a backup path. Option C is wrong because using two Site-to-Site VPN connections for both primary and backup does not provide the high-bandwidth, reliable, private connection required; VPNs are internet-based and subject to latency and bandwidth limitations. Option D is wrong because using a single ExpressRoute circuit without any backup fails the requirement for a backup connection in case of failure.

Full explanation →

102

MCQmedium

A company deploys a web application on Azure virtual machines (VMs) across multiple availability zones. The application needs to automatically distribute incoming HTTPS traffic, offload SSL/TLS termination, and provide session persistence. Additionally, the solution must include a Web Application Firewall (WAF) to protect against common web vulnerabilities. Which Azure load balancing solution should they use?

A.Azure Load Balancer

B.Azure Traffic Manager

C.Azure Application Gateway

D.Azure Front Door

AnswerC

Azure Application Gateway is a regional Layer 7 load balancer that routes HTTP/S traffic intelligently using URL paths, host headers, or other HTTP attributes, and it terminates SSL/TLS connections at the gateway to offload encryption from backend VMs. It provides cookie-based session affinity so a user's session sticks to the same server, and its built-in Web Application Firewall (WAF) blocks common exploits such as SQL injection and cross-site scripting. Autoscaling and availability-zone support make it a robust choice for production web workloads, delivering all the needed features in one regional service.

Why this answer

Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that can route HTTPS traffic, offload SSL/TLS termination, and provide session persistence (cookie-based affinity). It also natively integrates a Web Application Firewall (WAF) to protect against common web vulnerabilities like SQL injection and cross-site scripting.

Exam trap

The trap here is that candidates often confuse Azure Front Door with Application Gateway because both offer WAF and SSL offload, but Front Door is optimized for global multi-region traffic management, not for intra-region zone-resilient load balancing with session persistence, which is the specific requirement in this question.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and cannot perform SSL/TLS termination, session persistence based on application cookies, or provide a WAF. Option B is wrong because Azure Traffic Manager is a DNS-based traffic load balancer that routes traffic at the DNS level (Layer 3/4) and does not handle SSL/TLS termination, session persistence, or WAF capabilities. Option D is wrong because Azure Front Door is a global Layer 7 load balancer and CDN that can offload SSL and provide WAF, but it is designed for global HTTP(S) traffic distribution across regions, not for intra-region multi-zone distribution with session persistence; Application Gateway is the appropriate choice for regional, zone-resilient deployments.

Full explanation →

103

MCQeasy

A company runs a critical application on Azure virtual machines (VMs) in the West US region. They need a disaster recovery solution that replicates the VMs to East US with a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. The application consists of multiple VMs, and the company needs to be able to fail over a single VM without impacting others during an actual disaster. They also want to periodically test the recovery process without affecting the production environment. Which Azure Site Recovery feature should they use to enable non-disruptive testing?

A.Recovery Plans

B.Planned failover

C.Test failover

D.Network mapping

AnswerC

Test failover performs a full validation of replicated VM images by booting them in an isolated virtual network using a selectable recovery point, without disturbing ongoing replication or production traffic. It requires no source VM shutdown and can be run repeatedly for compliance and disaster-recovery drills. This isolated copy allows you to verify application startup and network dependencies exactly as they would behave in a real failover, making it the correct feature for non-disruptive testing.

Why this answer

Test failover (Option C) is the correct feature because it allows you to validate your disaster recovery process by creating an isolated copy of your replicated VMs in a separate test network, without impacting the ongoing replication or the production environment. This directly meets the requirement for periodic, non-disruptive testing while maintaining the RPO of 15 minutes and RTO of 2 hours.

Exam trap

The trap here is that candidates often confuse 'Test failover' with 'Planned failover' or 'Recovery Plans,' mistakenly thinking that any failover action must impact production, when in fact Test failover is specifically designed to be isolated and non-disruptive.

How to eliminate wrong answers

Option A is wrong because Recovery Plans are used to orchestrate the failover sequence of multiple VMs and run custom scripts, but they do not provide a mechanism for non-disruptive testing; they are executed during actual failover or test failover, not as a testing feature themselves. Option B is wrong because Planned failover is designed for zero-data-loss migration or maintenance scenarios where both sites are healthy and no data loss is tolerated, but it requires stopping production VMs and is not a testing mechanism—it disrupts production. Option D is wrong because Network mapping defines how source and target networks correspond for failover, but it is a configuration prerequisite, not a feature for executing a non-disruptive test.

Full explanation →

104

MCQmedium

A company deploys a web application on Azure VMs. The application stores session state and frequently accessed product data. They need a low-latency, in-memory cache to reduce database load and improve response times. The cache must be managed and support data persistence with replication across availability zones within the region. Which Azure service and tier should they choose?

A.Azure Cache for Redis (Premium tier)

B.Azure Cache for Redis (Basic tier)

C.Azure Cache for Redis (Standard tier)

D.Azure Cache for Redis (Enterprise tier)

AnswerA

Azure Cache for Redis Premium tier is the appropriate choice because it uniquely combines zone-redundant replication—spreading the primary and replica nodes across Azure availability zones—with built-in data persistence options (RDB snapshots and AOF append-only file). This gives you both high availability and durability of cached data, enabling you to survive an entire zone failure without losing data. Being fully managed, it also supports Redis clustering for scaling out beyond the memory limit of a single node, which is why it meets the production requirements.

Why this answer

Azure Cache for Redis Premium tier is the correct choice because it supports data persistence (RDB/AOF), replication across availability zones via zone redundancy, and provides low-latency, in-memory caching for session state and product data. The Basic tier lacks replication and persistence, Standard tier offers replication but not zone redundancy or persistence, and Enterprise tier is overkill for this scenario, adding unnecessary cost and complexity.

Exam trap

The trap here is that candidates often confuse the Standard tier's replication (which is within a single datacenter) with zone redundancy, or assume Enterprise tier is always better for persistence, when Premium tier specifically offers both persistence and zone redundancy at a lower cost.

How to eliminate wrong answers

Option B (Basic tier) is wrong because it provides no replication, no data persistence, and no SLA, making it unsuitable for high-availability or durable caching needs. Option C (Standard tier) is wrong because while it offers replication within a single datacenter, it does not support zone redundancy across availability zones or built-in data persistence (RDB/AOF). Option D (Enterprise tier) is wrong because it is designed for advanced scenarios like active geo-replication and Redis modules (RediSearch, RedisBloom), which are not required here, and it incurs higher cost without providing additional benefit for basic session state and product caching.

Full explanation →

105

MCQeasy

A company deploys a web application on Azure VMs across availability zones. They need to distribute HTTPS traffic, offload SSL termination, and maintain session persistence. They do not require traffic inspection. Which Azure load balancing solution should they use?

A.Azure Application Gateway v2.

B.Azure Load Balancer (Standard).

C.Azure Traffic Manager.

D.Azure Front Door.

AnswerA

Azure Application Gateway v2 is the correct choice because it operates as a regional Layer 7 load balancer, directly supporting HTTPS termination, cookie-based session persistence (affinity), and HTTP health probes for backend VMs. Its v2 SKU is designed to span availability zones, enabling zone-redundant deployment across VM sets within a single region. Unlike global services, it stays in the region, minimizing latency while providing all required web-layer capabilities.

Why this answer

Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that supports HTTPS traffic distribution, SSL termination (offloading the decryption burden from backend VMs), and session persistence via cookie-based affinity. It meets all requirements without needing traffic inspection, which is optional and can be disabled.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming any load balancer can handle SSL termination, but only Layer 7 solutions like Application Gateway or Front Door can offload SSL and maintain session persistence at the application layer.

How to eliminate wrong answers

Option B (Azure Load Balancer Standard) is wrong because it operates at Layer 4 (TCP/UDP) and cannot perform SSL termination or application-layer session persistence; it only distributes traffic based on IP and port. Option C (Azure Traffic Manager) is wrong because it is a DNS-based global traffic router that does not handle HTTPS traffic directly, SSL termination, or session persistence at the application layer. Option D (Azure Front Door) is wrong because it is a global Layer 7 service with built-in WAF and traffic inspection capabilities, which is unnecessary here and adds complexity; it also requires a custom domain for SSL termination, whereas Application Gateway v2 is a regional solution better suited for this scenario.

Full explanation →

106

MCQmedium

You are designing a disaster recovery solution for an Azure IaaS workload. The application runs on Azure VMs in a single region and requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 4 hours. Which of the following is the most cost-effective approach to meet these requirements?

A.Configure geo-redundant storage (GRS) for the VM disks and manually attach them to new VMs in the secondary region.

B.Use Azure Front Door with a back-end pool containing VMs in both regions, and configure health probes to route traffic on failure.

C.Deploy Azure Site Recovery to replicate VMs to the secondary region with a replication policy that meets the RPO and RTO.

D.Use Azure Backup to back up VMs to a Recovery Services vault in the secondary region and perform restore during failover.

AnswerC

Azure Site Recovery offers continuous replication with RPO as low as 30 seconds and automated failover minutes, meeting both requirements cost-effectively.

Why this answer

Azure Site Recovery (ASR) provides orchestrated replication of Azure VMs to a secondary region with configurable RPO (as low as 30 seconds) and supports automated failover, meeting the 15-minute RPO and 4-hour RTO requirements. It is the most cost-effective because it replicates only changed blocks and does not require running standby VMs, unlike multi-region active deployments.

Exam trap

The trap here is that candidates confuse Azure Backup (which is for archival and long-term recovery) with Azure Site Recovery (which is for replication and rapid failover), leading them to choose Option D despite its inadequate RPO and RTO for disaster recovery scenarios.

How to eliminate wrong answers

Option A is wrong because manually attaching GRS-based disks to new VMs in the secondary region cannot guarantee a 15-minute RPO (GRS replication is asynchronous with a typical lag of hours) and the manual process would exceed the 4-hour RTO. Option B is wrong because Azure Front Door is a global load balancer for web traffic, not a disaster recovery replication tool; it does not replicate VM state or data, so it cannot meet RPO/RTO for IaaS workloads. Option D is wrong because Azure Backup is designed for long-term retention and point-in-time restores, with typical RPO of 24 hours for daily backups and restore times that can exceed 4 hours, making it unsuitable for the required 15-minute RPO and 4-hour RTO.

Full explanation →

107

MCQeasy

A company deploys a web application on multiple Azure virtual machines (VMs) in a single region. The application receives HTTP and HTTPS traffic. They need to distribute the traffic across the VMs, offload SSL/TLS termination, and ensure that client requests from the same user session are always sent to the same backend VM (session persistence). Additionally, they need to route requests based on URL paths (e.g., /api/* to one pool, /images/* to another). Which Azure load balancing solution should they use?

A.Azure Load Balancer

B.Azure Application Gateway

C.Azure Front Door

D.Azure Traffic Manager

AnswerB

Azure Application Gateway is a layer-7 load balancer specifically designed for HTTP(S) traffic. It supports SSL termination (and end-to-end SSL), cookie-based session affinity, URL path-based routing to different backend pools, and integrates with the Web Application Firewall (WAF). This makes it the correct choice for the company's stated requirements, as it directly handles application-level routing and persistence without the complexity of a global service.

Why this answer

Azure Application Gateway is the correct choice because it is a layer-7 load balancer that supports SSL/TLS termination, URL path-based routing, and session persistence (sticky sessions) via cookies. These features directly match the requirements for distributing HTTP/HTTPS traffic, offloading SSL, routing requests based on URL paths, and maintaining user session affinity to the same backend VM.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (layer 4) with Application Gateway (layer 7), assuming any load balancer can handle SSL termination and URL routing, but only layer-7 solutions like Application Gateway provide these application-level features.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer operates at layer 4 (TCP/UDP) and cannot perform SSL/TLS termination, URL path-based routing, or session persistence based on HTTP cookies. Option C is wrong because Azure Front Door is a global layer-7 load balancer and CDN designed for multi-region traffic distribution, not for routing within a single region, and it does not support URL path-based routing to separate backend pools in the same region. Option D is wrong because Azure Traffic Manager is a DNS-based traffic load balancer that operates at layer 3/4 and cannot offload SSL/TLS, route based on URL paths, or provide session persistence.

Full explanation →

108

MCQhard

A company uses Microsoft Entra ID (Microsoft Entra ID) Premium P2. They need to automatically detect users whose credentials have been leaked and require them to reset their password at their next sign-in. Additionally, they want to block sign-ins from anonymous IP addresses (e.g., Tor network). Which combination of Microsoft Entra ID features should they enable to meet both requirements?

A.Conditional Access with MFA policy and Identity Protection sign-in risk policy

B.Identity Protection user risk policy and sign-in risk policy

C.Privileged Identity Management and Conditional Access

D.Microsoft Entra ID Connect Health and Identity Protection

AnswerB

Identity Protection's user risk policy evaluates signals such as leaked credentials and, when the user risk score is elevated, automatically requires the user to perform a secure password change during sign-in. Its sign-in risk policy independently assesses real-time signals, including anonymous IP addresses, and can block the sign-in. Together, these two policies directly and automatically enforce both stated requirements, making this the correct answer.

Why this answer

Identity Protection user risk policy can automatically detect leaked credentials and force a password reset at next sign-in, while the sign-in risk policy can block sign-ins from anonymous IP addresses (e.g., Tor). These two policies together address both requirements without needing additional Conditional Access or MFA policies.

Exam trap

The trap here is that candidates confuse Conditional Access with Identity Protection risk policies, not realizing that leaked credential detection and anonymous IP blocking are native Identity Protection risk policies, not Conditional Access controls.

How to eliminate wrong answers

Option A is wrong because Conditional Access with MFA policy does not detect leaked credentials or block anonymous IPs; it only enforces MFA based on conditions, not risk. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time privileged access and does not detect leaked credentials or block anonymous IPs; Conditional Access alone cannot detect leaked credentials without Identity Protection. Option D is wrong because Microsoft Entra ID Connect Health monitors synchronization health and does not provide user risk or sign-in risk policies for leaked credentials or anonymous IP blocking.

Full explanation →

109

MCQhard

Contoso Ltd. runs a mission-critical application on Azure VMs in the West US region. They require an RPO of 15 minutes and an RTO of 1 hour in case of a regional disaster. They plan to use Azure Site Recovery. The application stores data on managed disks and uses a Premium SSD v2 disk for the database. The application also uses Azure SQL Database for some transactional data. What should Contoso do to meet the recovery objectives for the entire solution?

A.Configure Azure Site Recovery for the VMs with Premium SSD v2 disks and configure active geo-replication with auto-failover groups for Azure SQL Database.

B.Use Azure Backup for the VMs and configure long-term retention for the Azure SQL Database backups.

C.Configure Azure Site Recovery for the VMs and also for the Azure SQL Database by adding it to the replication group.

D.Deploy the application across two Azure regions using Azure Front Door and active geo-replication for Azure SQL Database.

AnswerA

ASR supports Premium SSD v2 disks; Azure SQL Database active geo-replication with auto-failover groups meets the RPO/RTO.

Why this answer

Azure Site Recovery (ASR) supports Premium SSD v2 disks for VM replication, enabling an RPO of 15 minutes and RTO of 1 hour for the VMs. For Azure SQL Database, active geo-replication with auto-failover groups provides a regional disaster recovery solution with an RPO of seconds and RTO of about 1 hour, meeting the stated objectives. This combination covers both the managed disk data and the transactional data in Azure SQL Database.

Exam trap

The trap here is that candidates may assume Azure Site Recovery can replicate Azure SQL Database (a PaaS service) or that Azure Backup provides low enough RPO/RTO for mission-critical workloads, but ASR only works for IaaS VMs, and Backup is designed for long-term retention, not rapid recovery.

How to eliminate wrong answers

Option B is wrong because Azure Backup provides point-in-time recovery with longer RPOs (typically 1 hour or more) and RTOs that can exceed 1 hour, not meeting the 15-minute RPO and 1-hour RTO requirements. Option C is wrong because Azure Site Recovery cannot replicate Azure SQL Database; it is designed for VMs and physical servers, not PaaS databases. Option D is wrong because deploying across two regions with Azure Front Door and active geo-replication does not inherently provide the specific RPO of 15 minutes and RTO of 1 hour for the VMs; it focuses on global load balancing and database replication, not VM-level disaster recovery with ASR.

Full explanation →

110

MCQeasy

A company wants to collect metrics and logs from all Azure resources in their subscription, including custom metrics from their applications, and create dashboards and alerts. Which Azure service should they use as the primary monitoring platform?

A.Azure Monitor

B.Azure Log Analytics

C.Azure Application Insights

D.Azure Service Health

AnswerA

Azure Monitor is the comprehensive, unified monitoring service that acts as the single pipeline for collecting platform metrics, activity logs, resource logs, and custom telemetry across all Azure resources. It stores metric data in a time-series database and log data in Log Analytics workspaces, then provides a unified query experience, dashboards, and alerting actions. This centralization is what makes it the correct answer for collecting both metrics and logs from every resource in an Azure environment.

Why this answer

Azure Monitor is the correct primary monitoring platform because it serves as the single, unified ingestion and analysis service for all metrics and logs across Azure resources, including custom metrics from applications via the Application Insights SDK or the custom metrics API. It provides a consolidated workspace for creating dashboards, setting alerts, and querying data, making it the foundational service for observability in Azure.

Exam trap

The trap here is that candidates often confuse Azure Monitor with its sub-services like Log Analytics or Application Insights, failing to recognize that Azure Monitor is the umbrella service that encompasses both metrics and logs, while the others are specialized components within it.

How to eliminate wrong answers

Option B (Azure Log Analytics) is wrong because it is a component within Azure Monitor that stores and queries log data, not the overarching monitoring platform; it lacks native support for metrics and dashboards without Azure Monitor as the parent. Option C (Azure Application Insights) is wrong because it is a subset of Azure Monitor focused specifically on application performance monitoring (APM) for live web apps, not a platform for collecting infrastructure metrics or logs from all Azure resources. Option D (Azure Service Health) is wrong because it only provides personalized alerts and guidance for Azure service issues and planned maintenance, not the collection of metrics, logs, or custom application data.

Full explanation →

111

MCQmedium

A company stores large amounts of log data in Azure Blob Storage. Logs are accessed frequently for the first 30 days, then rarely accessed afterward, but must be retained for 7 years for compliance. The company wants to minimize storage costs. They need to configure automatic data movement and retention policies. Which combination of Azure Blob Storage access tiers and lifecycle management policy should they use?

A.Use Hot tier for 30 days, then use Cool tier for 7 years, with a lifecycle rule to delete after 7 years.

B.Use Hot tier for 30 days, then use Archive tier for the remaining period, with a lifecycle rule to delete after 7 years.

C.Use Cool tier for 30 days, then use Archive tier for 7 years, no lifecycle rule needed.

D.Use Archive tier immediately, with a lifecycle rule to delete after 7 years.

AnswerB

Hot tier provides low-latency access during the frequent access period. Archive tier provides the lowest storage cost for data that is rarely accessed. A lifecycle policy can automatically move data from Hot to Archive after 30 days and delete it after 7 years.

Why this answer

It uses the Hot tier for the first 30 days to handle frequent access, then automatically moves data to the Archive tier via a lifecycle management rule to minimize costs for rarely accessed data, and finally deletes the blobs after 7 years to meet compliance retention requirements. The Archive tier offers the lowest storage cost for long-term retention, making it ideal for logs that are rarely accessed after the initial period.

Exam trap

The trap here is that candidates often choose the Cool tier for long-term retention because they underestimate the cost savings of the Archive tier for data that is rarely accessed over many years, or they forget that a lifecycle rule is necessary to enforce deletion after the compliance period.

How to eliminate wrong answers

Option A is wrong because moving data to the Cool tier after 30 days does not minimize storage costs as effectively as the Archive tier for 7 years of rare access; the Cool tier has higher storage costs than Archive and is intended for data accessed less frequently but still with some latency requirements, not for long-term archival. Option C is wrong because starting with the Cool tier for the first 30 days is suboptimal since logs are accessed frequently during that period, and the Hot tier is more cost-effective for frequent access; additionally, a lifecycle rule is required to delete data after 7 years to enforce compliance retention. Option D is wrong because placing data directly into the Archive tier from the start incurs high retrieval costs and latency for the first 30 days when logs are accessed frequently, violating the requirement to minimize costs and access performance.

Full explanation →

112

MCQeasy

A company has an on-premises data center and wants to connect it to Azure with a dedicated, private network connection that is not routed over the public internet. They also need a higher service-level agreement (SLA) compared to VPN-based connections. Which Azure service should they use?

A.Azure VPN Gateway

B.Azure ExpressRoute

C.Azure Bastion

D.Azure Virtual WAN

AnswerB

Azure ExpressRoute establishes a logical private connection to Azure through a connectivity provider or direct peering, with traffic that never traverses the public internet. It uses BGP sessions over dedicated or co-located circuits, offering enterprise-grade reliability, high bandwidth (up to 100 Gbps), and native geographic redundancy across peering locations. The 99.95% SLA for dedicated circuits plus predictable latency make it the correct choice for a dedicated, private hybrid connection.

Why this answer

Azure ExpressRoute provides a dedicated, private connection from on-premises to Azure that bypasses the public internet, ensuring lower latency, higher reliability, and a 99.95% SLA (for dedicated circuits) compared to VPN-based connections. This meets the requirement for a private network connection with a higher SLA than VPN Gateway, which relies on internet-based IPSec tunnels with a 99.9% SLA.

Exam trap

The trap here is that candidates often confuse Azure Virtual WAN as a direct replacement for ExpressRoute, but Virtual WAN is a management overlay that still requires ExpressRoute or VPN as the underlying transport, not a dedicated private connection itself.

How to eliminate wrong answers

Option A (Azure VPN Gateway) is wrong because it uses IPSec tunnels over the public internet, which does not provide a dedicated private connection and has a lower SLA (99.9%) than ExpressRoute. Option C (Azure Bastion) is wrong because it is a PaaS service for secure RDP/SSH access to Azure VMs via the browser, not a hybrid connectivity solution between on-premises and Azure. Option D (Azure Virtual WAN) is wrong because it is a networking service that aggregates branch connectivity, but it still requires an underlying connectivity method (VPN or ExpressRoute) to provide the dedicated private link; by itself, it does not offer a dedicated private connection or the higher SLA specified.

Full explanation →

113

MCQeasy

A company plans to deploy a stateless web application on Azure virtual machines. They want to ensure that the application remains available in the event of a hardware failure within a single Azure datacenter. The VMs must be placed in a way that ensures they are on different physical servers and racks, but are still within the same datacenter. Which deployment strategy should they use?

A.Deploy the VMs in an Availability Set.

B.Deploy the VMs in different Availability Zones.

C.Deploy the VMs in a single Virtual Machine Scale Set with a large instance count.

D.Deploy each VM in a separate resource group.

AnswerA

An Availability Set logically groups VMs so Azure distributes them across multiple fault domains (racks with independent power and network) and update domains (groups that are rebooted sequentially during planned maintenance). This contains hardware failures and maintenance events to a subset of the VMs, keeping your stateless web app reachable. It is the correct choice because the requirement is to protect against hardware failure within a single Azure datacenter.

Why this answer

An Availability Set ensures that VMs are distributed across multiple fault domains (different physical servers, racks, and network switches) and update domains within a single Azure datacenter. This protects against hardware failures in that datacenter by guaranteeing that not all VMs are affected by the same local failure, while keeping them in the same datacenter for low-latency communication.

Exam trap

The trap here is that candidates often confuse Availability Zones (which span multiple datacenters) with Availability Sets (which operate within a single datacenter), leading them to select the zone-based option when the question explicitly requires staying within the same datacenter.

How to eliminate wrong answers

Option B is wrong because Availability Zones place VMs in physically separate datacenters within a region, not within the same datacenter, which adds cross-datacenter latency and is not required for the stated goal of surviving a single datacenter hardware failure. Option C is wrong because a single Virtual Machine Scale Set with a large instance count does not by itself enforce distribution across different physical servers and racks unless it is configured with an Availability Set or Availability Zones; a scale set without such placement constraints can place many VMs on the same physical host. Option D is wrong because deploying each VM in a separate resource group has no impact on physical placement or fault domain isolation; resource groups are logical containers for management and RBAC, not for infrastructure redundancy.

Full explanation →

114

MCQeasy

Your company uses Azure Policy to enforce compliance. You need to ensure that all storage accounts use HTTPS only. The policy should automatically remediate non-compliant storage accounts by enabling HTTPS-only. What policy effect should you use?

A.Deny

B.AuditIfNotExists

C.Append

D.DeployIfNotExists

AnswerD

DeployIfNotExists can deploy a template to set the storage account property to enable HTTPS-only.

Why this answer

The DeployIfNotExists effect is correct because it not only evaluates whether storage accounts have the 'HTTPS only' setting enabled but also automatically deploys a remediation task to enable it when non-compliance is detected. This ensures continuous compliance without manual intervention, which aligns with the requirement for automatic remediation.

Exam trap

The trap here is that candidates often confuse 'Deny' (which blocks non-compliant new resources) with 'DeployIfNotExists' (which remediates existing resources), missing the key requirement for automatic remediation of already deployed storage accounts.

How to eliminate wrong answers

Option A is wrong because Deny blocks the creation or update of a resource that doesn't meet the policy condition, but it does not remediate existing non-compliant storage accounts. Option B is wrong because AuditIfNotExists only audits whether a related resource (like a diagnostic setting) exists, not the property of the storage account itself, and it provides no remediation. Option C is wrong because Append adds fields to a resource during creation or update but cannot modify existing storage account properties like 'HTTPS only' after the resource is deployed.

Full explanation →

115

MCQmedium

A company runs a critical SQL Server database on an Azure virtual machine. They need a backup strategy that supports point-in-time restore down to the second and long-term retention of backups for 7 years to meet compliance. They want to offload backup management to Azure. Which backup solution should they use?

A.Azure Backup for SQL Server on Azure VM

B.Azure Site Recovery

C.SQL Server managed backup to Azure

D.Azure Disk Backup

AnswerA

Azure Backup for SQL Server on Azure VM is a fully managed backup service that integrates with the SQL Server IaaS Agent Extension, automating full, differential, and transaction log backups. It supports point-in-time restore with log backups taken every 15 minutes, and offers long-term retention policies for up to 10 years, meeting both operational recovery and compliance requirements. The centralized monitoring, alerting, and cross-subscription management capabilities make it the ideal choice for a critical SQL database.

Why this answer

Azure Backup for SQL Server on Azure VM provides native integration that supports point-in-time restore down to the second for SQL Server databases and allows configuring long-term retention (LTR) for up to 10 years, meeting the 7-year compliance requirement. It offloads backup management to Azure by automating backup schedules, retention policies, and restore operations without requiring manual scripting or third-party tools.

Exam trap

The trap here is that candidates often confuse Azure Site Recovery (disaster recovery) with backup, or assume SQL Server managed backup to Azure provides the same integrated point-in-time and long-term retention capabilities as Azure Backup, when in fact Azure Backup offers a fully managed, portal-integrated solution with native SQL Server awareness.

How to eliminate wrong answers

Option B is wrong because Azure Site Recovery is a disaster recovery solution that replicates entire VMs for failover, not a backup service; it does not support point-in-time restore for SQL Server databases or long-term retention for compliance. Option C is wrong because SQL Server managed backup to Azure is a feature that manages backups to Azure Blob storage but requires manual configuration of retention policies and does not offer native point-in-time restore down to the second or integrated long-term retention management within the Azure portal. Option D is wrong because Azure Disk Backup provides crash-consistent backups of managed disks at the VM level, not application-consistent backups for SQL Server, and cannot perform point-in-time restore for database transactions or log backups.

Full explanation →

116

MCQmedium

A company has an on-premises Hyper-V environment with 20 virtual machines running various workloads. They want to use Azure as a disaster recovery site. The required recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 2 hours. They want to automate failover and failback. Which Azure service should they use?

A.Azure Site Recovery

B.Azure Migrate

C.Azure Backup

D.Azure Recovery Services Vault

AnswerA

Azure Site Recovery is the only option that provides continuous, near-synchronous replication of Hyper-V VMs to Azure, with RPOs as low as 30 seconds and the ability to meet a 15-minute RPO. It uses the Azure Site Recovery Provider installed on the Hyper-V host and the Microsoft Recovery Services Agent, replicating VHDs to Azure storage while enabling orchestrated test failovers, planned/unplanned failovers, and failback. This is true disaster recovery, not backup or migration.

Why this answer

Azure Site Recovery (ASR) is the correct service because it provides orchestrated replication, failover, and failback for Hyper-V VMs to Azure as a DR site. It supports the required RPO of 15 minutes (using near-synchronous replication with change tracking) and RTO of 2 hours (via automated recovery plans), and it natively automates both failover and failback processes without additional scripting.

Exam trap

The trap here is that candidates confuse the Recovery Services Vault (a storage container) with the actual DR service (Azure Site Recovery), or they mistakenly think Azure Backup can meet low RPO/RTO requirements for disaster recovery when it is designed for backup, not replication with automated failover.

How to eliminate wrong answers

Option B (Azure Migrate) is wrong because it is designed for discovery, assessment, and migration of on-premises workloads to Azure, not for ongoing disaster recovery replication or automated failover/failback. Option C (Azure Backup) is wrong because it provides backup-based recovery with typical RPOs of 12-24 hours and RTOs measured in hours to days, and it does not support automated failover or failback orchestration. Option D (Azure Recovery Services Vault) is wrong because it is a storage container that holds backup data and replication settings, not a service that performs replication, failover, or failback; it is the underlying vault used by both Azure Backup and Azure Site Recovery, but the question asks for the service that automates DR, which is ASR.

Full explanation →

117

MCQmedium

A company stores JSON documents for a mobile app backend. The data needs to be accessible from multiple global regions with low latency writes from any region. The app uses a client-side library that supports automatic conflict resolution for concurrent updates. Which Azure data service should they choose?

A.Azure Cosmos DB

B.Azure SQL Database

C.Azure Database for PostgreSQL

D.Azure Table Storage

AnswerA

Azure Cosmos DB is the correct choice because it provides native multi-region writes, enabling the same JSON document to be written and updated from any Azure region with automatic conflict resolution to handle concurrent edits. Its flexible schema and JSON-native indexing make it purpose-built for storing and querying mobile app backend documents, and it offers well-defined consistency levels and an SLA for availability and latency.

Why this answer

Azure Cosmos DB is correct because it provides multi-region writes with automatic conflict resolution, which directly matches the requirement for low-latency writes from any global region. Its multi-master replication model allows any region to accept writes, and the client-side library can use last-writer-wins (LWW) or custom conflict resolution policies to handle concurrent updates seamlessly.

Exam trap

The trap here is that candidates often confuse Azure SQL Database or Azure Database for PostgreSQL's read replicas with write capability, failing to recognize that only Cosmos DB offers true multi-region writes with built-in conflict resolution.

How to eliminate wrong answers

Option B (Azure SQL Database) is wrong because it does not natively support multi-region writes; it relies on a single primary region for writes, and geo-replication is read-only, so it cannot achieve low-latency writes from multiple regions. Option C (Azure Database for PostgreSQL) is wrong because it also uses a single-writer primary architecture; while read replicas can be distributed, writes must go to the primary region, introducing latency for global writes. Option D (Azure Table Storage) is wrong because it does not support multi-region writes; it offers only a single write region with read-only geo-redundant storage, and it lacks built-in conflict resolution for concurrent updates.

Full explanation →

118

MCQmedium

A company needs to store sensor data from IoT devices. Each device sends a message every second. The data is time-series and will be queried for real-time dashboards and historical analysis. The solution must support high ingestion rates and low-latency queries on recent data. Which Azure service should they use?

A.Azure Blob Storage with Azure Data Lake Storage Gen2

B.Azure Cosmos DB with SQL API

C.Azure Event Hubs and Azure Data Explorer

D.Azure Table Storage

AnswerC

Azure Event Hubs and Azure Data Explorer form the native Azure pattern for IoT sensor data because Event Hubs offers high-throughput, low-latency event streaming with partitioning and auto-inflate, easily handling millions of sensor messages per second. Azure Data Explorer (ADX) is a purpose-built analytics engine for time-series and log data, using columnar storage and an optimized ingestion pipeline that can directly consume streams from Event Hubs. ADX's KQL query language delivers real-time aggregations over large temporal windows in sub-second latency, making it ideal for live dashboards. This combination decouples ingestion from analytics while providing end-to-end scalability and low operational overhead.

Why this answer

Azure Event Hubs is designed for high-throughput data ingestion from millions of IoT devices, capable of handling millions of events per second. Azure Data Explorer (ADX) is optimized for time-series data, providing sub-second query latency on recent data and efficient historical analysis. Together, they form a serverless pipeline that ingests sensor data via Event Hubs and stores it in ADX for real-time dashboards and long-term analytics.

Exam trap

The trap here is that candidates often choose Azure Cosmos DB (Option B) because they associate it with 'low latency' and 'IoT', but they overlook that Cosmos DB is not purpose-built for time-series data and lacks the ingestion throughput and query optimizations that Azure Data Explorer provides for this specific workload.

How to eliminate wrong answers

Option A is wrong because Azure Blob Storage with Data Lake Storage Gen2 is optimized for batch analytics and large file storage, not for high-frequency time-series ingestion or low-latency queries on recent data; it lacks native time-series indexing and real-time query capabilities. Option B is wrong because Azure Cosmos DB with SQL API is a multi-model NoSQL database designed for transactional workloads with flexible schemas, but it is not optimized for time-series data at high ingestion rates and can incur high RU costs for continuous writes; it also lacks native time-series functions like binning or retention policies. Option D is wrong because Azure Table Storage is a key-value store with limited query capabilities (only on partition and row keys), no support for time-series-specific operations, and high latency for range scans over timestamps, making it unsuitable for real-time dashboards and high-ingestion IoT workloads.

Full explanation →

119

MCQmedium

A company is designing a hybrid network solution connecting an on-premises data center to Azure. They require high availability with active-active routing and need to support up to 10 Gbps throughput. Which Azure service should they include in the design?

A.Site-to-Site VPN Gateway

B.Azure Virtual WAN

C.ExpressRoute FastPath

D.ExpressRoute Direct

AnswerD

ExpressRoute Direct provides a dedicated, private Layer-2 connection between your on-premises network and Microsoft's edge at a peering location, with port pairs available at 10 Gbps, 40 Gbps, or 100 Gbps. Since it delivers physical port-level bandwidth rather than a VPN gateway's aggregate limit, it easily satisfies the 10 Gbps throughput requirement. It also supports active-active routing by default through dual routers and BGP sessions, giving the required high availability with an SLA-backed redundant path.

Why this answer

ExpressRoute Direct provides dedicated, private connections from on-premises to Azure, supporting bandwidths up to 100 Gbps (10 Gbps easily). It enables active-active routing by using two circuits with BGP, meeting high availability and throughput requirements. ExpressRoute FastPath is a performance feature that reduces latency but is not a standalone service and does not itself provide active-active routing or guaranteed throughput; it requires an ExpressRoute circuit and does not replace the need for Direct when dedicated throughput is required.

Exam trap

A common mistake is assuming that ExpressRoute FastPath is a standalone service that can provide active-active routing and 10 Gbps throughput. In reality, FastPath is a feature that enhances performance but must be used with an existing ExpressRoute circuit. For dedicated bandwidth and native active-active routing, ExpressRoute Direct is the appropriate service.

How to eliminate wrong answers

Option A is wrong because Site-to-Site VPN Gateway is limited to a maximum throughput of approximately 1.25 Gbps per tunnel (aggregate up to 10 Gbps only with multiple tunnels and specific SKUs), and it relies on the public internet, which does not guarantee the consistent 10 Gbps throughput or the same SLA as a private connection. Option B is wrong because Azure Virtual WAN is a networking orchestration service that can aggregate multiple connection types, but it does not itself provide the high-throughput, dedicated private connectivity required; it would typically use ExpressRoute circuits underneath for such throughput, making it an architectural overlay rather than the direct service needed. Option D is wrong because ExpressRoute FastPath is a feature that improves network performance by bypassing the gateway for certain traffic flows, but it is not a standalone service; it must be enabled on an existing ExpressRoute circuit and does not itself provide the 10 Gbps throughput or active-active routing—it enhances performance after the circuit is in place.

Full explanation →

120

MCQmedium

A company has several Azure Virtual Machines running Windows Server with critical applications. They need to back up these VMs to a secondary Azure region to protect against regional disasters. The backup must be application-consistent and support file-level restore. Which solution should they implement?

A.Azure Backup with geo-redundant storage (GRS) in a Recovery Services vault

B.Azure Site Recovery

C.Azure Snapshot of managed disks stored in a different region

D.Azure Managed Disk with incremental snapshots and manual cross-region copy

AnswerA

Azure Backup offers VM-level application-consistent backups, supports GRS for cross-region durability, and allows file-level restore from recovery points.

Why this answer

Azure Backup with geo-redundant storage (GRS) in a Recovery Services vault is the correct solution because it provides application-consistent backups of Windows Server VMs using the Volume Shadow Copy Service (VSS) to ensure data integrity, and it supports file-level restore by allowing you to mount the backup as a drive to recover individual files. The GRS option replicates backup data to a paired secondary region, meeting the disaster recovery requirement without additional manual steps.

Exam trap

The trap here is that candidates confuse Azure Site Recovery (a replication/failover tool) with Azure Backup (a backup/restore tool), or assume that crash-consistent snapshots (Options C and D) are sufficient for application consistency and file-level restore, which they are not.

How to eliminate wrong answers

Option B (Azure Site Recovery) is wrong because it is designed for replication and failover of VMs for disaster recovery, not for backup—it does not support file-level restore from backup snapshots and is not a backup solution. Option C (Azure Snapshot of managed disks stored in a different region) is wrong because snapshots are crash-consistent, not application-consistent, and they do not support file-level restore natively; you would need to create a new disk from the snapshot to access files. Option D (Azure Managed Disk with incremental snapshots and manual cross-region copy) is wrong because incremental snapshots are also crash-consistent and require manual cross-region copy, which adds complexity and does not guarantee application consistency or built-in file-level restore capabilities.

Full explanation →

121

MCQhard

A company runs a critical application on Azure VMs in the West US region. They want to protect against a regional disaster by replicating VMs to East US using Azure Site Recovery. They have both managed and unmanaged disks. They need to ensure that after failover, the recovery VMs are automatically placed in a specific availability set to support the application's multi-tier architecture. Additionally, they want to minimize downtime during planned failover. Which configuration should they use?

A.Configure a recovery plan that includes the VMs and specifies the target availability set and failover order

B.Set the target availability set in each VM's replication settings individually without a recovery plan

C.Use Azure Traffic Manager to route traffic to the secondary region after manual failover

D.Enable consistency groups across the VMs using a replication policy

AnswerA

A recovery plan in Azure Site Recovery groups all VMs into a single orchestrated failover unit, letting you specify the target availability set in the secondary region and defining the exact failover order. You can add pre/post-action runbooks to automate scripted steps, which minimizes downtime and ensures application-consistent startup during planned failover. Setting availability sets and boot order individually in VM replication settings lacks this coordinated sequencing, so the recovery plan is the appropriate DR orchestration mechanism.

Why this answer

A recovery plan in Azure Site Recovery allows you to group VMs, specify the target availability set, and define the failover order. This ensures that after failover, the recovery VMs are automatically placed in the specified availability set, supporting the application's multi-tier architecture. Additionally, recovery plans enable you to automate and sequence failover steps, minimizing downtime during planned failover by orchestrating the process efficiently.

Exam trap

The trap here is that candidates often confuse replication settings (like target availability set per VM) with recovery plans, not realizing that only recovery plans can enforce failover order and group-level placement, which is critical for multi-tier applications.

How to eliminate wrong answers

Option B is wrong because setting the target availability set in each VM's replication settings individually does not allow you to define a failover order or group VMs into a recovery plan, which is necessary for multi-tier application consistency and minimizing downtime. Option C is wrong because Azure Traffic Manager is a DNS-based traffic routing service that does not handle VM placement into availability sets or orchestrate failover sequencing; it only redirects traffic after failover is manually completed. Option D is wrong because consistency groups (multi-VM consistency) ensure crash-consistent or app-consistent recovery points across VMs but do not control target availability set placement or failover order; they are a replication policy feature, not a recovery plan substitute.

Full explanation →

122

MCQmedium

A company runs a critical line-of-business application on Azure VMs within a single region. The application tier is deployed across multiple VMs. They need to protect against a failure of an entire Azure datacenter within that region. The solution should automatically distribute the VMs across physically separate locations with independent power, cooling, and networking. The company also requires the lowest possible latency between application and database tiers within the same location. Which deployment strategy should they use?

A.Deploy the VMs across multiple availability zones

B.Deploy the VMs in an availability set

C.Use Azure Site Recovery to replicate VMs to a paired region

D.Use Azure Proximity Placement Groups

AnswerA

Availability zones provide datacenter-level redundancy within a region. By placing VMs in different zones, the application can survive a single datacenter failure. This also allows low latency within the same zone for the database tier.

Why this answer

Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying the application tier VMs across multiple zones protects against an entire datacenter failure while keeping all resources within the same region, ensuring the lowest possible latency between application and database tiers when they are placed in the same zone.

Exam trap

The trap here is that candidates often confuse availability sets (which protect against rack failures) with availability zones (which protect against datacenter failures), or they incorrectly assume that cross-region replication via Site Recovery is the only way to achieve datacenter fault tolerance, ignoring the lower-latency option of multiple zones within the same region.

How to eliminate wrong answers

Option B is wrong because an availability set only protects against rack-level failures within a single datacenter, not against the failure of an entire datacenter. Option C is wrong because Azure Site Recovery to a paired region introduces cross-region latency, which does not meet the requirement for the lowest possible latency within the same location. Option D is wrong because Proximity Placement Groups are designed to reduce latency by co-locating VMs, but they do not provide protection against a full datacenter failure.

Full explanation →

123

MCQmedium

A company needs a fully managed NoSQL database for a JSON document-oriented application that requires low latency (single-digit milliseconds) for reads and writes at any scale. The application will run globally and needs multi-region writes with automatic failover. Which Azure data store should they use?

A.Azure Cosmos DB

B.Azure Table Storage

C.Azure SQL Database

D.Azure Cache for Redis

AnswerA

Azure Cosmos DB is the correct choice because it is a fully managed, multi-model NoSQL database with native JSON document support, schema-agnostic indexing, and an SQL-like query engine. It uniquely delivers multi-region writes with automatic failover, elastic horizontal partitioning and tunable consistency, backed by an industry-leading SLA of 99.999% availability and single-digit millisecond read/write latency at the 99th percentile. These capabilities are purpose-built for globally distributed JSON workloads requiring both durability and low-latency access.

Why this answer

Azure Cosmos DB is the correct choice because it is a fully managed NoSQL database that natively supports JSON documents, offers single-digit millisecond latency for reads and writes at any scale, and provides multi-region writes with automatic failover through its multi-master replication capability. Its global distribution model allows you to configure multiple write regions, ensuring high availability and low latency worldwide.

Exam trap

The trap here is that candidates often confuse Azure Table Storage (a simple key-value store) with a fully managed NoSQL database, overlooking that it lacks native JSON support, multi-region writes, and automatic failover capabilities required for global, low-latency applications.

How to eliminate wrong answers

Option B (Azure Table Storage) is wrong because it is a key-value store that does not natively support JSON documents or multi-region writes with automatic failover; it offers only eventual consistency and lacks the global distribution features required. Option C (Azure SQL Database) is wrong because it is a relational database that does not support JSON as a native document model and cannot provide multi-region writes with automatic failover; it is not a NoSQL solution. Option D (Azure Cache for Redis) is wrong because it is an in-memory cache, not a fully managed NoSQL database; it does not persist JSON documents durably and lacks multi-region write capabilities with automatic failover.

Full explanation →

124

MCQhard

A company uses Microsoft Entra ID B2B to collaborate with external vendors. They want to enforce that external users must use multi-factor authentication (MFA) and access company resources only from compliant devices (e.g., managed by Intune). They also want to require a session timeout of 1 hour. Which combination of Microsoft Entra ID features should they use?

A.A

B.B

C.C

D.D

AnswerB

Microsoft Entra ID Conditional Access is the comprehensive policy engine that can enforce all the stated requirements during sign-in. A Conditional Access policy can require multi-factor authentication for external B2B users, require the device to be marked as compliant by integrating with Intune, and apply session controls that set sign-in frequency to force periodic reauthentication. These policies can be targeted to guest and external users specifically, making Conditional Access the right tool for controlling access in B2B collaboration scenarios.

Why this answer

It combines Conditional Access policies with session controls to enforce MFA, device compliance (via Intune), and a 1-hour session timeout. Conditional Access policies evaluate sign-in risk and require MFA and compliant devices, while the session control 'Sign-in frequency' can be set to 1 hour to enforce reauthentication. This meets all three requirements without relying on deprecated or separate features.

Exam trap

The trap here is that candidates often confuse Conditional Access session controls with token lifetime policies or think that Identity Protection alone can enforce device compliance, but only Conditional Access policies can combine MFA, device compliance, and session timeout in a single policy.

How to eliminate wrong answers

Option A is wrong because it uses Azure AD Identity Protection, which is designed for risk-based policies (e.g., risky sign-ins) but does not natively enforce device compliance or session timeout; it lacks the session control for a 1-hour timeout. Option C is wrong because it relies on Azure AD Privileged Identity Management (PIM), which manages just-in-time privileged access and does not enforce MFA or device compliance for external users accessing general resources. Option D is wrong because it uses Azure AD Terms of Use, which only requires acceptance of a policy document and cannot enforce MFA, device compliance, or session timeout.

Full explanation →

125

MCQhard

A company is designing a disaster recovery strategy for a mission-critical Azure SQL Database. They require a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of 1 hour. Which replication option should they use?

A.Zone-redundant deployment

B.Failover groups with active geo-replication

C.Auto-failover groups with active geo-replication

D.Geo-restore

AnswerB

Meets RPO of 5 seconds and RTO of 1 hour.

Why this answer

Failover groups with active geo-replication provide the lowest RPO (typically 5 seconds or less) and RTO (under 1 hour) for Azure SQL Database. Active geo-replication asynchronously replicates transactions to a secondary region, and failover groups orchestrate a coordinated, application-transparent failover that meets the stringent RTO requirement.

Exam trap

The trap here is that candidates confuse 'failover groups' with 'auto-failover groups' (which is not an official Azure term) and may incorrectly choose option C, or they underestimate the RPO/RTO of geo-restore and pick option D, not realizing that geo-restore is a backup-based solution with much higher latency.

How to eliminate wrong answers

Option A is wrong because zone-redundant deployment protects against datacenter failures within a single region, not against regional outages, and its RPO/RTO are not as low as required. Option C is wrong because 'Auto-failover groups with active geo-replication' is essentially the same as option B but with an incorrect name—Azure's feature is called 'failover groups' and does not include 'auto' in its official name; the automatic failover capability is part of failover groups, not a separate option. Option D is wrong because geo-restore uses point-in-time restore from geo-replicated backups, which has an RPO of 1 hour and RTO of 12+ hours, far exceeding the required 5-second RPO and 1-hour RTO.

Full explanation →

126

MCQmedium

A company runs a critical application on Azure VMs in the West US region. They need to protect against a regional disaster using Azure Site Recovery. The VMs use unmanaged disks. The recovery point objective (RPO) must be 15 minutes and the recovery time objective (RTO) must be 1 hour. Additionally, they must be able to perform quarterly disaster recovery drills that do not affect the production environment. Which configuration should they use in Azure Site Recovery?

A.Set up replication with a 15-minute snapshot frequency and perform test failover for drills.

B.Use Azure Backup for VM replication and perform restore drills.

C.Configure a recovery plan with a pre-script to take a snapshot every 15 minutes.

D.Enable multi-VM consistency group with a 15-minute consistency frequency.

AnswerA

Azure Site Recovery's replication policy allows configuring a recovery point objective (RPO) of 15 minutes by setting the snapshot frequency, so you can cap data loss at 15 minutes. The built-in test failover feature launches your replicated VMs in an isolated Azure network, letting you run non-disruptive failover drills without affecting production or incurring downtime. This is the only option that directly delivers both the required RPO and a documented, low-risk drill methodology.

Why this answer

Azure Site Recovery supports replication of Azure VMs with unmanaged disks, and a 15-minute snapshot frequency meets the RPO requirement. Test failover allows quarterly disaster recovery drills without impacting the production environment, as it creates isolated copies of VMs in a separate network for validation.

Exam trap

The trap here is confusing Azure Backup (long-term backup) with Azure Site Recovery (replication for disaster recovery), as both can restore VMs but only Site Recovery supports low RPOs and non-disruptive test failovers.

How to eliminate wrong answers

Option B is wrong because Azure Backup is designed for long-term backup retention and restore, not for low-RPO replication (typically 1-2 snapshots per day) and does not support the 15-minute RPO or test failover drills without affecting production. Option C is wrong because recovery plans with pre-scripts cannot take snapshots at a fixed frequency; snapshot frequency is configured at the replication policy level, not via scripts in a recovery plan. Option D is wrong because multi-VM consistency groups ensure crash-consistent or app-consistent snapshots across multiple VMs, but they do not directly set the snapshot frequency; the consistency frequency is separate from the replication frequency, and this option does not address the drill requirement.

Full explanation →

127

MCQhard

A large enterprise is designing a data lake solution for its analytics platform. The data lake will store petabytes of structured and unstructured data from various sources, including IoT devices, logs, and transactional databases. The solution must support: - Multi-protocol access (ABFS, REST, and NFS 3.0) - Hierarchical namespace for folder-level permissions - Optimized for analytical workloads (Parquet format) - Cost-effective storage for cold data that is accessed less than once a year. Which Azure storage solution should the enterprise recommend for the data lake?

A.Azure NetApp Files Ultra tier

B.Azure Files Premium tier

C.Azure Data Lake Storage Gen2 with Archive tier for cold data

D.Azure Blob Storage with hierarchical namespace enabled

AnswerC

Supports all required protocols and hierarchical namespace.

Why this answer

Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct foundation because it natively supports the required multi-protocol access (ABFS, REST, and NFS 3.0), a hierarchical namespace for folder-level permissions, and is optimized for analytical workloads using Parquet format. The Archive tier for cold data provides the lowest storage cost for data accessed less than once a year, meeting the cost-effectiveness requirement while retaining the ADLS Gen2 capabilities.

Exam trap

The trap here is that candidates may choose Option D (Azure Blob Storage with hierarchical namespace) thinking it is sufficient, but they overlook the explicit requirement for cost-effective cold data storage, which requires the Archive tier—a feature that is not automatically enabled with hierarchical namespace and must be selected as part of the ADLS Gen2 solution.

How to eliminate wrong answers

Option A is wrong because Azure NetApp Files Ultra tier is a high-performance file share for NFS/SMB workloads, not a data lake solution; it lacks native ABFS and REST protocol support, does not provide a hierarchical namespace for folder-level permissions, and its Ultra tier is expensive, not cost-effective for cold data. Option B is wrong because Azure Files Premium tier is a fully managed file share for SMB/NFS, not designed for data lake analytics; it does not support ABFS or REST protocols, lacks a hierarchical namespace, and its Premium tier is high-cost, unsuitable for cold data. Option D is wrong because Azure Blob Storage with hierarchical namespace enabled is essentially ADLS Gen2, but it does not include the Archive tier for cold data by default; the Archive tier is a separate access tier that must be explicitly selected to meet the cost-effective cold data requirement, making this option incomplete.

Full explanation →

128

MCQhard

A company is building a petabyte-scale data lake for analytics. The workload includes Apache Spark and Hive jobs that read and write large files. The storage solution must support a hierarchical namespace for efficient directory operations, POSIX-like access control lists (ACLs) for fine-grained permissions, and must be accessible via the Azure Blob Storage API for compatibility with existing tools. Furthermore, the solution should be optimized for analytics workloads with high throughput. Which Azure data service should they choose?

A.Azure Data Lake Storage Gen2

B.Azure Data Lake Storage Gen1

C.Azure Blob Storage

D.Azure Files

AnswerA

Azure Data Lake Storage Gen2 is correct because it layers a hierarchical namespace onto Blob Storage, providing POSIX ACLs, atomic directory renaming, and a Hadoop-compatible `abfs://` filesystem that Spark, Hive, and Presto can use directly. It also fully supports the Blob API and Azure SDKs, so existing tooling works unchanged, while delivering the scale, encryption, and lifecycle policies needed to run petabyte-scale analytics workloads.

Why this answer

Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with POSIX-like ACLs and is accessible via the Azure Blob Storage API. This service is specifically optimized for analytics workloads like Apache Spark and Hive, providing high throughput for petabyte-scale data lakes. The hierarchical namespace enables efficient directory operations, while the Blob Storage API ensures compatibility with existing tools.

Exam trap

The trap here is that candidates may confuse Azure Data Lake Storage Gen1 with Gen2, overlooking that Gen1 lacks Blob Storage API compatibility, or they may assume Azure Blob Storage with hierarchical namespace enabled is a separate service, but ADLS Gen2 is the specific offering that combines all required features.

How to eliminate wrong answers

Option B (Azure Data Lake Storage Gen1) is wrong because it uses its own REST API, not the Azure Blob Storage API, breaking compatibility with existing tools that rely on Blob Storage APIs. Option C (Azure Blob Storage) is wrong because it does not support a hierarchical namespace by default (only flat namespace) and lacks POSIX-like ACLs, making it unsuitable for efficient directory operations and fine-grained permissions. Option D (Azure Files) is wrong because it is designed for SMB file shares and shared file access, not for petabyte-scale analytics workloads with high throughput, and it does not support the Blob Storage API or a hierarchical namespace optimized for Spark/Hive.

Full explanation →

129

MCQmedium

A company deploys a web application on Azure virtual machines (VMs) across multiple availability zones in the East US region. The application receives HTTPS traffic. They need to distribute incoming traffic across the VMs, offload SSL/TLS termination, and ensure that client requests from the same user session are always sent to the same backend VM (session persistence). Which Azure load balancing solution should they choose?

A.Azure Load Balancer

B.Azure Application Gateway

C.Azure Traffic Manager

D.Azure Front Door

AnswerB

Azure Application Gateway is a regional Layer-7 load balancer that terminates SSL and decrypts incoming HTTPS requests, enabling it to inspect HTTP headers and route based on URL paths. It natively provides cookie-based session affinity using the Application Gateway Affinity cookie, which reliably pins a client session to the same backend VM across availability zones. With additional features like URL path-based routing, WebSocket support, and optional WAF integration, it is the appropriate choice for distributing HTTPS traffic to VMs within a single region.

Why this answer

Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that supports SSL/TLS termination, cookie-based session persistence (affinity), and can distribute HTTPS traffic across VMs in multiple availability zones. These features directly match all three requirements: SSL offloading, session persistence, and cross-zone traffic distribution.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming any load balancer can handle SSL termination and session persistence, but only Layer 7 solutions like Application Gateway or Front Door provide cookie-based affinity and SSL offload.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and does not support SSL/TLS termination or application-layer session persistence; it can only maintain session affinity using source IP hashing, which is not cookie-based and less reliable for HTTPS. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic router that does not perform SSL termination or session persistence; it directs clients to regional endpoints based on DNS resolution, not per-request load balancing. Option D is wrong because Azure Front Door is a global Layer 7 service that supports SSL termination and session affinity, but it is designed for global distribution across regions, not for distributing traffic within a single region across availability zones; it adds unnecessary latency and complexity for a regional-only workload.

Full explanation →

130

MCQhard

A company is designing a hub-spoke network topology in Azure. The hub contains a third-party network virtual appliance (NVA) for inspection. Spokes need to communicate with each other, and all inter-spoke traffic must be routed through the NVA in the hub. Which configuration should they use?

A.Set route tables on spoke subnets with a 0.0.0.0/0 route to the Internet

B.Configure Azure Firewall in the hub with forced tunneling to on-premises

C.Create user-defined routes (UDRs) in each spoke subnet that force traffic to go through the hub NVA

D.Use VNet peering with gateway transit enabled

AnswerC

The correct approach is to create user-defined routes on each spoke subnet with a route for the other spoke's address space and the next hop set to the private IP address of the hub NVA. Because VNet peering is non-transitive, spoke-to-spoke traffic will not automatically flow through the hub; the UDR overrides the system route to force that path. You must also enable IP forwarding on the NVA network interface and ensure the NVA is in a hub subnet so return traffic takes a symmetric path. This gives precise, deterministic control of inter-spoke inspection and is the standard hub-spoke design pattern.

Why this answer

User-defined routes (UDRs) allow you to explicitly override Azure's default system routes. By adding a route in each spoke subnet with the hub NVA's private IP as the next hop for inter-spoke traffic (e.g., 10.1.0.0/16 -> 10.0.0.4), all traffic between spokes is forced through the NVA for inspection. This ensures the hub-spoke topology meets the requirement without relying on Azure Firewall or Internet routing.

Exam trap

The trap here is that candidates often confuse VNet peering's built-in transitive routing (which is disabled by default) with the ability to force traffic through an NVA, mistakenly thinking peering alone or gateway transit can achieve the required inspection without explicit UDRs.

How to eliminate wrong answers

Option A is wrong because a 0.0.0.0/0 route to the Internet would send all outbound traffic to the Internet, not through the hub NVA, and would not route inter-spoke traffic correctly. Option B is wrong because Azure Firewall with forced tunneling to on-premises would route traffic to on-premises, not through the hub NVA, and does not satisfy the requirement for inter-spoke inspection within Azure. Option D is wrong because VNet peering with gateway transit enables spokes to use a VPN gateway in the hub, but it does not force inter-spoke traffic through an NVA; it only provides transitive routing via the gateway, not custom inspection.

Full explanation →

131

MCQmedium

A company has an on-premises application running on physical servers with various operating systems. They want to use Azure as a disaster recovery site with an RPO of less than 1 hour and an RTO of less than 4 hours. They need to replicate the servers to Azure and support failover and failback. Which Azure service should they use?

A.Azure Site Recovery

B.Azure Backup (MARS agent)

C.Azure Migrate

D.Azure File Sync

AnswerA

Azure Site Recovery (ASR) replicates physical servers to Azure using the Mobility service, which continuously writes data to a cache storage account and then to Azure-managed disks, achieving RPO as low as 30 seconds. It supports both crash-consistent and app-consistent snapshots for Windows and Linux, and enables orchestrated failover via recovery plans. With RTOs in hours, ASR meets the DR requirement for rapid recovery and offers failback to the original on-premises physical server or VMware VM.

Why this answer

Azure Site Recovery (ASR) orchestrates replication, failover, and failback for physical servers and VMs to Azure, meeting the RPO of <1 hour and RTO of <4 hours. It supports heterogeneous operating systems on physical servers and provides continuous replication with recovery points as low as 30 seconds, enabling both planned and unplanned failover with full failback capability.

Exam trap

The trap here is that candidates confuse Azure Backup (which provides long-term archival backups) with Azure Site Recovery (which provides near-continuous replication and orchestrated failover), failing to recognize that the RPO and RTO requirements demand a replication-based DR solution, not a backup service.

How to eliminate wrong answers

Option B (Azure Backup with MARS agent) is wrong because it is designed for file/folder and system state backup with a minimum RPO of 1 day (daily backup), not sub-hourly replication, and it does not support orchestrated failover or failback of entire servers. Option C (Azure Migrate) is wrong because it is a discovery, assessment, and migration tool, not a disaster recovery service; it does not provide ongoing replication or failover/failback capabilities. Option D (Azure File Sync) is wrong because it only syncs file shares between on-premises and Azure, not entire server workloads, and lacks failover/failback orchestration for disaster recovery.

Full explanation →

132

MCQeasy

A company is designing a virtual network architecture for a three-tier application (web, application, database). They want network isolation between tiers and secure access from the internet to the web tier only. Which Azure networking solution should they use?

A.Azure Virtual Network with subnets for each tier and Network Security Groups.

B.Azure Virtual Network with a single subnet and application security groups.

C.Azure Virtual Network with subnets and Azure Firewall.

D.Azure Virtual Network with subnets and a network virtual appliance (NVA).

AnswerA

This approach uses separate subnets for the web, application, and data tiers, establishing Layer-3 network boundaries within the virtual network. Network Security Groups (NSGs) are stateful, built-in filters that you associate with each subnet to enforce inbound and outbound rules, such as allowing internet traffic only to the web tier on ports 80/443 and permitting the web subnet to talk to the app subnet on a specific application port. Because NSGs are natively supported and incur no extra cost, this is the most efficient and standard method for isolating tiers and controlling east-west traffic without introducing additional appliances or routing complexity.

Why this answer

Deploying each tier in its own subnet within an Azure Virtual Network and applying Network Security Groups (NSGs) allows granular inbound/outbound rule enforcement. NSGs can restrict traffic so that only the web tier is reachable from the internet (via a public IP or Azure Load Balancer), while the application and database tiers are isolated from direct internet access and can only communicate with the adjacent tier as defined by NSG rules.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing Azure Firewall or an NVA for basic isolation, not realizing that NSGs with subnets are the native, cost-effective, and fully supported method for network segmentation within a single Azure VNet.

How to eliminate wrong answers

Option B is wrong because a single subnet with Application Security Groups (ASGs) still places all VMs in the same broadcast domain and does not provide network-level isolation between tiers; ASGs only group VMs logically for NSG rule application, but they do not prevent lateral traffic within the subnet without explicit NSG rules, and a single subnet cannot enforce separate routing or address spaces. Option C is wrong because Azure Firewall is a managed, stateful firewall service used for centralized inspection and logging across VNets or hybrid networks, but it is overkill and not the simplest solution for basic tier isolation within a single VNet; NSGs alone provide sufficient subnet-level filtering without the cost and complexity of a firewall. Option D is wrong because a Network Virtual Appliance (NVA) is typically used for advanced traffic inspection, routing, or security functions (e.g., third-party firewalls, WAN optimization) and is unnecessary for simple tier isolation; it adds operational overhead and cost when NSGs can achieve the same isolation with less complexity.

Full explanation →

133

MCQmedium

A company runs a file server on an Azure VM in the East US region. They want to back up the file shares to Azure and be able to restore individual files if accidentally deleted. They also need to be able to restore the entire file share to a secondary region (West US) in case of a regional disaster. The solution should automatically protect the file shares and provide versioning for up to 30 days. Which Azure service and configuration should they recommend?

A.Configure Azure Backup on the Azure file share using a Recovery Services vault with geo-redundant storage (GRS). Enable cross-region restore on the vault.

B.Use Azure File Sync to sync the file share to an on-premises server, and then back up the on-premises server using Azure Backup.

C.Enable soft delete and versioning on the storage account, and configure replication to a secondary region using RA-GRS.

D.Create a scheduled Azure Automation runbook that takes snapshots of the file share every day and copy them to a storage account in West US.

AnswerA

Azure Backup for Azure Files is the native managed backup service that takes scheduled snapshots of the file share and stores recovery points in a Recovery Services vault. By selecting GRS for the vault and enabling cross-region restore, you gain the ability to restore the entire share to the paired region (East US to West US) if a regional disaster occurs. The service also supports granular item-level restore, allows you to specify backup frequency and retention, and automatically manages the snapshot lifecycle, making it the only option here that meets both backup and DR requirements.

Why this answer

Azure Backup for Azure file shares uses a Recovery Services vault and can be configured with geo-redundant storage (GRS) to replicate backup data to a paired secondary region. Enabling cross-region restore on the vault allows restoring the entire file share to the secondary region (West US) during a regional disaster. Azure Backup automatically protects the file share with scheduled backups and provides up to 30 days of retention for point-in-time restores of individual files or the entire share.

Exam trap

The trap here is that candidates often confuse storage account replication (RA-GRS) with backup and restore capabilities, thinking that replication alone provides disaster recovery restore functionality, but it does not support point-in-time file-level restore or cross-region restore of backups without Azure Backup's cross-region restore feature.

How to eliminate wrong answers

Option B is wrong because Azure File Sync is designed for hybrid sync and tiering, not for backup; it does not provide native cross-region disaster recovery or versioning for up to 30 days, and backing up an on-premises server adds unnecessary complexity and does not directly meet the requirement to restore to a secondary Azure region. Option C is wrong because soft delete and versioning on the storage account provide protection against accidental deletion and overwrites, but they do not offer a backup solution with scheduled backups, cross-region restore capability, or the ability to restore the entire file share to a secondary region in a disaster scenario; RA-GRS replication is for storage account data redundancy, not for backup restore. Option D is wrong because a scheduled Azure Automation runbook that takes snapshots and copies them to another region is a custom, non-native solution that lacks the automated backup scheduling, versioning, and cross-region restore capabilities provided by Azure Backup; it also introduces operational overhead and does not guarantee the 30-day versioning requirement.

Full explanation →

134

MCQeasy

Your company uses Microsoft Entra ID and has recently deployed Microsoft Sentinel. You need to design a monitoring solution to detect brute-force attacks against user accounts. The solution should use built-in analytics rules where possible and must trigger an automated response to temporarily disable the affected account. What should you include in the design?

A.Use the built-in 'Brute force attack against an Entra ID account' analytics rule in Microsoft Sentinel and connect a playbook to disable the user.

B.Use Microsoft Entra Identity Protection to detect brute-force and configure a conditional access policy to block sign-ins.

C.Stream sign-in logs to Log Analytics and create a scheduled query that alerts on multiple failures, then manually disable accounts.

D.Create a custom KQL query in Microsoft Sentinel and configure an automation rule to disable the account.

AnswerA

The Microsoft Sentinel built-in analytics rule 'Brute force attack against an Entra ID account' already contains the KQL detection logic needed to identify repeated failed sign-ins and other brute-force indicators in Entra ID sign-in logs. By triggering an automation rule on the alert, you can invoke a Microsoft Sentinel playbook—an Azure Logic Apps workflow—that automatically disables the compromised user account. This provides both automated detection and automated response, satisfying the requirement to use built-in rules whenever possible.

Why this answer

Microsoft Sentinel includes a built-in analytics rule specifically for detecting brute-force attacks against Microsoft Entra ID accounts. By connecting a playbook to this rule, you can automate the response to temporarily disable the affected user account, meeting the requirement for an automated response without custom development.

Exam trap

The trap here is that candidates may confuse Microsoft Entra Identity Protection's ability to block sign-ins with the requirement to disable the user account, or they may overlook the 'use built-in analytics rules where possible' constraint and opt for a custom KQL query.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Identity Protection detects risk events like brute-force but uses Conditional Access policies to block sign-ins, not to disable user accounts; disabling accounts requires a different mechanism. Option C is wrong because it relies on manually disabling accounts, which does not meet the requirement for an automated response. Option D is wrong because it suggests creating a custom KQL query and automation rule, but the question specifies using built-in analytics rules where possible, making a custom query unnecessary and less efficient.

Full explanation →

135

MCQeasy

A company wants to allow remote users to access an internal web application hosted on-premises without opening inbound firewall ports. They need seamless single sign-on (SSO) using Microsoft Entra ID credentials. Which Azure service should they use?

A.Microsoft Entra ID Application Proxy

B.Microsoft Entra ID B2C

C.Microsoft Entra ID Domain Services

D.Microsoft Entra ID Connect

AnswerA

Microsoft Entra ID Application Proxy is a reverse proxy that securely publishes on-premises web applications to remote users through the Microsoft Entra ID service. It uses a lightweight connector on the internal network that initiates outbound connections, eliminating the need for inbound firewall ports or VPN. This enables seamless single sign-on and integration with Conditional Access policies, making it the ideal solution for internal app access.

Why this answer

Microsoft Entra ID Application Proxy provides secure remote access to on-premises web applications without requiring inbound firewall ports. It works by establishing an outbound connection from the on-premises Application Proxy connector to the Entra ID service, then routing user traffic through that tunnel. It integrates with Entra ID for pre-authentication and supports seamless SSO using the user's existing Entra ID credentials via Kerberos constrained delegation (KCD) or header-based authentication.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID Application Proxy with a VPN or DirectAccess solution, but the key differentiator is that Application Proxy requires no inbound firewall rules and uses outbound-only connectivity, which is a common exam scenario for secure remote access.

How to eliminate wrong answers

Option B (Microsoft Entra ID B2C) is wrong because it is designed for customer-facing identity management with social or local accounts, not for providing secure remote access to internal on-premises applications. Option C (Microsoft Entra ID Domain Services) is wrong because it provides managed domain services (e.g., LDAP, Kerberos) for Azure VMs but does not offer a reverse proxy or remote access capability for on-premises apps. Option D (Microsoft Entra ID Connect) is wrong because it is a synchronization tool that syncs on-premises AD objects to Entra ID; it does not provide any application proxy or remote access functionality.

Full explanation →

136

MCQmedium

A company runs a critical application on Azure virtual machines in the West US region. They need a disaster recovery solution that replicates VMs to East US with a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. They also need to perform non-disruptive disaster recovery drills. Which Azure service should they use?

A.Azure Backup

B.Azure Site Recovery

C.Azure Traffic Manager

D.Azure Front Door

AnswerB

Azure Site Recovery directly addresses the DR requirement by continuously replicating Azure VMs to a secondary Azure region, with a recovery point objective (RPO) as low as 15 minutes for supported disk types. It enables orchestrated failover and failback, and crucially allows test failover using isolated networks so you can validate end-to-end recovery without impacting production or incurring downtime. Recovery plans can sequence multi-tier application startup, making it the correct choice for this critical workload.

Why this answer

Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs between regions. It supports RPOs as low as 15 minutes (continuous replication with crash-consistent or app-consistent snapshots) and RTOs of 2 hours or less, and it enables non-disruptive disaster recovery drills via test failover that isolates replicated VMs in a separate virtual network without impacting production.

Exam trap

The trap here is that candidates confuse Azure Backup (which is for backup/restore with longer RPOs) with Azure Site Recovery (which is for replication and failover with low RPO/RTO), or they mistakenly think a traffic-routing service like Traffic Manager or Front Door can provide disaster recovery replication without actually moving or copying VM data.

How to eliminate wrong answers

Option A is wrong because Azure Backup is designed for long-term retention and point-in-time restore of VM data (typically with a minimum RPO of 1 hour for disk snapshots), not for continuous replication with sub-15-minute RPO or orchestrated failover with a 2-hour RTO; it also does not support non-disruptive drills. Option C is wrong because Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming traffic to healthy endpoints, but it does not replicate VM data or provide any disaster recovery replication, RPO/RTO guarantees, or drill capabilities. Option D is wrong because Azure Front Door is a global application delivery network with HTTP/S load balancing and acceleration, but it does not handle VM-level replication, failover orchestration, or recovery point objectives; it only redirects traffic based on backend health.

Full explanation →

137

MCQhard

A global company is deploying a microservices application on AKS clusters in multiple Azure regions. They need to provide a single endpoint for users worldwide with SSL offloading, web application firewall, and URL path-based routing to the nearest healthy AKS cluster. They also need global load balancing with automatic failover. Which Azure service should they use?

A.Azure Front Door

B.Azure Application Gateway

C.Azure Traffic Manager

D.Azure Load Balancer

AnswerA

Azure Front Door is a global application delivery controller that operates at Layer 7, using Anycast to terminate connections at the nearest point of presence. It directly satisfies the multi-region AKS requirement by performing SSL offloading, applying a web application firewall, and routing requests to different AKS clusters based on URL paths. Its global health probes and failover are distinct from DNS-based or regional approaches, making it the only listed service that can steer user traffic across the globe while preserving HTTP semantics.

Why this answer

Azure Front Door is the correct choice because it provides global HTTP/HTTPS load balancing with SSL offloading, web application firewall (WAF) integration, and URL path-based routing. It uses Anycast-based routing to direct users to the nearest healthy AKS cluster, ensuring low latency and automatic failover across regions.

Exam trap

The trap here is that candidates often confuse Azure Front Door with Azure Traffic Manager, but Traffic Manager only provides DNS-level routing without application-layer features like SSL offloading, WAF, or path-based routing.

How to eliminate wrong answers

Option B is wrong because Azure Application Gateway is a regional load balancer that operates within a single Azure region and cannot provide global load balancing or cross-region failover. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic router that does not support SSL offloading, WAF, or URL path-based routing at the application layer. Option D is wrong because Azure Load Balancer is a Layer 4 (TCP/UDP) load balancer that operates regionally and lacks application-layer features like SSL termination, WAF, and path-based routing.

Full explanation →

138

MCQmedium

A company manages a fleet of millions of IoT devices that send telemetry data every minute. The data must be stored for 10 years to meet compliance requirements. For the first 30 days, data is accessed frequently for real-time dashboards and alerting. After 30 days, data is only accessed occasionally for historical analysis and reporting. The solution must be cost-effective and support high ingestion rates. Which Azure service should the company use to store and query this data?

A.Azure Blob Storage with Azure Data Lake Storage Gen2

B.Azure Data Explorer

C.Azure SQL Database

D.Azure Cosmos DB with SQL API

AnswerB

Azure Data Explorer is the only service here built specifically for high-fidelity time-series analytics: its columnar engine ingests millions of events per second, automatically creates inverted indexes, and uses a hot/cold cache with data tiering to balance performance and cost. KQL natively supports time-based operations such as bin(), summarize, anomaly detection, and lag/lead calculations, which can run on both streaming and historical data. This makes it the appropriate choice for a fleet of millions of devices where real-time visibility and long-term retention are required.

Why this answer

Azure Data Explorer (ADX) is designed for high-ingestion, time-series telemetry data and supports real-time dashboards and alerting on fresh data, while also providing cost-effective long-term storage for historical queries. Its columnar storage and indexing enable fast analytics on billions of records, making it ideal for IoT scenarios with millions of devices sending data every minute and a 10-year retention requirement.

Exam trap

The trap here is that candidates often choose Azure Blob Storage or Cosmos DB because they associate them with 'storage' or 'IoT,' but they fail to recognize that Azure Data Explorer is the only service purpose-built for high-velocity time-series analytics with built-in hot/cold tiering and native support for real-time alerting and long-term retention at scale.

How to eliminate wrong answers

Option A is wrong because Azure Blob Storage with Azure Data Lake Storage Gen2 is optimized for batch analytics and large file storage, not for real-time querying and alerting on high-velocity telemetry data; it lacks native time-series indexing and low-latency query capabilities. Option C is wrong because Azure SQL Database is a relational OLTP system that cannot cost-effectively handle the ingestion rate of millions of events per minute or the 10-year retention of massive telemetry volumes without significant performance degradation and high costs. Option D is wrong because Azure Cosmos DB with SQL API is a globally distributed NoSQL database designed for low-latency reads/writes on operational data, but it is not optimized for high-throughput time-series ingestion and analytical queries over long retention periods, and its cost would be prohibitive for storing billions of telemetry records for 10 years.

Full explanation →

139

MCQmedium

A company wants to deploy a web application on Azure virtual machines (VMs). The application experiences variable traffic patterns, so the company needs to automatically add or remove VM instances based on CPU utilization. They also want the application to remain highly available even if an Azure datacenter fails. Which combination of Azure services should they use?

A.Virtual Machine Scale Sets configured with autoscale rules based on CPU and distributed across availability zones

B.Azure App Service with autoscale rules and deployment slots

C.Azure Load Balancer with a backend pool of VMs and autoscale rules applied to individual VMSS

D.Azure Traffic Manager with endpoints in separate regions and Manual scaling of VMs

AnswerA

Virtual Machine Scale Sets are the only compute option listed that runs your workload on IaaS VMs while natively supporting horizontal autoscale: you define a scale condition (e.g., scale out by one instance when CPU percentage exceeds 75%, scale in when below 25%) and Azure applies it to the entire set. Deploying the VMSS across multiple availability zones places instance replicas in physically separate datacenters within the region, so a zone outage does not take down the entire web tier. This combination directly satisfies both the CPU-based automatic scaling and the zone-failure protection requirement.

Why this answer

Virtual Machine Scale Sets (VMSS) with autoscale rules based on CPU utilization automatically add or remove VM instances to match variable traffic patterns. Distributing the VMSS across availability zones ensures the application remains highly available even if an entire Azure datacenter fails, because availability zones are physically separate datacenters within a region.

Exam trap

The trap here is that candidates often confuse Azure App Service (PaaS) with IaaS VM solutions, or assume that a load balancer alone can handle autoscaling, when in fact autoscale rules must be configured directly on the VMSS resource.

How to eliminate wrong answers

Option B is wrong because Azure App Service is a Platform-as-a-Service (PaaS) offering, not a VM-based solution, and the question explicitly requires deployment on Azure virtual machines. Option C is wrong because Azure Load Balancer distributes traffic but does not itself perform autoscaling; autoscale rules must be applied directly to the VMSS, not to individual VMs, and the phrase 'applied to individual VMSS' is redundant and misstates the architecture. Option D is wrong because Traffic Manager provides global DNS-based traffic routing across regions, but manual scaling of VMs does not meet the requirement for automatic scaling based on CPU utilization.

Full explanation →

140

MCQeasy

A company has multiple branch offices and needs to connect them to Azure and to each other using a scalable, managed solution that simplifies network architecture. The solution should support automatic routing and integration with ExpressRoute and VPN. Which Azure service should they use?

A.Azure Virtual Network

B.Azure Virtual WAN

C.Azure ExpressRoute

D.Azure VPN Gateway

AnswerB

Azure Virtual WAN is a managed networking service that creates a hub-and-spoke architecture with integrated routing, automatically interconnecting branches, Azure VNets, and on-premises locations. It natively supports Site-to-Site VPN, Point-to-Site VPN, and ExpressRoute, and it performs automatic route table generation and propagation across all spokes. Virtual WAN also enables branch-to-branch connectivity without manual peering, making it the only option here that delivers a scalable, zero-touch global transit network.

Why this answer

Azure Virtual WAN is a managed networking service that aggregates branch, VPN, and ExpressRoute connectivity into a single hub-and-spoke architecture. It automatically handles routing between branches and Azure, supports any-to-any connectivity, and integrates natively with ExpressRoute and VPN gateways, making it the correct choice for a scalable, managed solution that simplifies network architecture.

Exam trap

The trap here is that candidates often confuse Azure Virtual WAN with Azure Virtual Network, thinking that a simple VNet with VPN gateways can scale to interconnect multiple branches, but they overlook the managed, automatic routing and aggregation capabilities that Virtual WAN provides for multi-site topologies.

How to eliminate wrong answers

Option A is wrong because Azure Virtual Network is a fundamental building block for creating isolated networks in Azure, but it does not provide managed, automatic routing between multiple branch offices or native integration with ExpressRoute and VPN at scale; it requires manual configuration of peering, gateways, and routing. Option C is wrong because Azure ExpressRoute is a dedicated private connection from on-premises to Azure, but it does not connect multiple branch offices to each other or provide automatic routing between them; it is a connectivity option, not a managed WAN service. Option D is wrong because Azure VPN Gateway provides site-to-site VPN connectivity from a single branch to Azure, but it does not offer a managed, scalable hub for interconnecting multiple branches or automatic routing between them; it requires additional configuration and does not aggregate multiple connections into a single managed topology.

Full explanation →

141

Multi-Selectmedium

Which TWO actions should you take to implement a least-privilege identity strategy for Azure resources?

Select 2 answers

A.Assign Global Administrator role to all cloud architects

B.Store service principal passwords in Azure Key Vault and retrieve at runtime

C.Enable self-service password reset for all users

D.Use managed identities for Azure resources instead of service principals

E.Use Privileged Identity Management (PIM) to activate roles just-in-time

AnswersD, E

Managed identities remove the need to manage secrets.

Why this answer

Managed identities for Azure resources eliminate the need to store and manage credentials. Azure automatically rotates the identity's principal in Azure AD, and the resource can obtain an access token directly from the Azure Instance Metadata Service (IMDS) endpoint without any secrets. This aligns with the least-privilege principle by removing static, long-lived credentials and reducing the attack surface.

Exam trap

The trap here is that candidates often confuse storing secrets securely (Option B) with eliminating secrets entirely (Option D), or they overlook that PIM (Option E) is a core least-privilege tool for role activation, not just a monitoring feature.

Full explanation →

142

MCQmedium

A company stores log data in Azure Blob Storage. The logs are accessed frequently for the first 30 days, then only occasionally for up to 1 year, and after that must be retained for 7 years for compliance purposes. The company wants to minimize storage costs by automatically moving data to cheaper tiers. Which Azure Blob Storage lifecycle management policy should they implement?

A.Move to Cool tier after 30 days, move to Archive tier after 365 days, delete after 2555 days

B.Move to Cool tier after 30 days, move to Archive tier after 365 days, delete after 7 years

C.Move to Cool tier after 30 days, move to Archive tier after 30 days, delete after 2555 days

D.Move to Archive tier after 30 days, keep in Archive until deletion after 2555 days

AnswerA

This policy correctly matches the log usage lifecycle: for the first 30 days data remains Hot for frequent queries; from day 30 to day 365 it is moved to Cool because access becomes occasional but still needed; after 365 days it is moved to Archive for long-term compliance while deletion occurs after 2555 days (exactly 7 years). That transition sequence minimizes cost: Hot for active use, Cool for sporadic retrieval with no rehydration fee, and Archive for rarely accessed records, with deletion eliminating any further storage charges. The rule uses numeric day values as Azure requires.

Why this answer

It aligns with the access patterns: move to Cool tier after 30 days (frequent access period), move to Archive tier after 365 days (occasional access period ends), and delete after 2555 days (7 years retention). This minimizes costs by transitioning data to progressively cheaper storage tiers and automatically deleting it when compliance retention expires.

Exam trap

The trap here is that candidates may choose Option B thinking '7 years' is acceptable in the policy, but Azure requires the 'delete after' action to be specified in days (2555), not years, and they may overlook the early deletion penalty of the Archive tier when moving data too soon.

How to eliminate wrong answers

Option B is wrong because it specifies 'delete after 7 years' without converting to days; Azure lifecycle management policies require the 'delete after' action to be defined in days, not years, and 7 years equals 2555 days, not a literal '7 years' string. Option C is wrong because it moves data to Archive tier after only 30 days, which would incur early deletion fees and retrieval costs since logs are still accessed occasionally for up to a year; Archive tier is for rarely accessed data and has a 180-day minimum storage charge. Option D is wrong because it moves data directly to Archive tier after 30 days, ignoring the Cool tier entirely, which increases costs due to early deletion penalties and higher retrieval costs for the occasional access period up to 365 days.

Full explanation →

143

MCQeasy

A company needs a fully managed NoSQL database for a new application with a key-value and document data model. They require single-digit millisecond latency at any scale, multi-region writes with automatic conflict resolution, and a serverless capacity option to handle unpredictable traffic. Which Azure data service should they use?

A.Azure Table Storage

B.Azure Cosmos DB

C.Azure Cache for Redis

D.Azure SQL Database

AnswerB

Azure Cosmos DB is the correct choice because it is a fully managed, multi-model NoSQL database that guarantees single-digit millisecond latency for reads and writes at the 99th percentile. Its multi-region writes capability lets you write to any region with automatic conflict resolution policies and a health-based failover, while the serverless mode adds throughput and storage per request, making it ideal for spiky or unpredictable workloads.

Why this answer

Azure Cosmos DB is the correct choice because it is a fully managed NoSQL database that supports both key-value and document data models natively. It guarantees single-digit millisecond latency at any scale, offers multi-region writes with automatic conflict resolution via its multi-master replication, and provides a serverless capacity mode that automatically scales based on demand, making it ideal for unpredictable traffic.

Exam trap

The trap here is that candidates often confuse Azure Table Storage as a NoSQL database that supports multi-region writes, but it lacks document support and automatic conflict resolution, making Cosmos DB the only option that meets all requirements.

How to eliminate wrong answers

Option A is wrong because Azure Table Storage is a key-value store but does not support a document data model, lacks multi-region writes with automatic conflict resolution, and does not offer a serverless capacity option (it uses provisioned throughput). Option C is wrong because Azure Cache for Redis is an in-memory caching service, not a fully managed NoSQL database; it does not natively support document data models or multi-region writes with conflict resolution. Option D is wrong because Azure SQL Database is a relational database (SQL-based), not a NoSQL database, and does not support key-value or document data models natively, nor does it offer multi-region writes with automatic conflict resolution.

Full explanation →

144

MCQmedium

Your company runs a Windows-based application on Azure Virtual Machines in the Brazil South region. The application uses Azure Files for shared storage and Azure SQL Database (Hyperscale tier) for the database. The business requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 30 minutes for the entire application. The solution must be cost-effective and leverage Azure-native services. You have been asked to design the disaster recovery strategy. Which option should you recommend?

A.Use Azure Site Recovery to replicate the VMs to a secondary region. Configure geo-redundant storage (GRS) for Azure Files. For Azure SQL Database Hyperscale, enable geo-restore and test restore procedures.

B.Deploy a second set of VMs in a secondary region. Use Azure File Sync to keep Azure Files in sync. Use Azure SQL Database failover groups with a readable secondary.

C.Back up the VMs using Azure Backup with a 15-minute frequency. Use Azure File Sync to replicate Azure Files to a secondary region. Use Azure SQL Database backup with point-in-time restore.

D.Use Azure Site Recovery for VMs. Use Azure File Sync for Azure Files. Use active geo-replication for Azure SQL Database.

AnswerA

Azure Site Recovery is the correct DR service for Azure VMs because it replicates disks to a secondary region asynchronously, delivering an RPO of as little as 5 minutes (well under the 15-minute requirement) and a recoverable RTO of minutes through failover. For Azure Files, GRS replicates file share data to a paired region asynchronously with an RPO of typically less than 15 minutes, and on failover you can access the secondary endpoint. For Azure SQL Database Hyperscale, geo-restore restores the database from geo-redundant backups to the secondary region; though its RPO is typically up to 1 hour, the requirement is met because you explicitly enable and test the restore procedure, and Hyperscale does not support failover groups, making geo-restore the documented DR pattern. This combination uses native, cost-effective services rather than running duplicate infrastructure and aligns with the stated 15-minute RPO for VMs and Files.

Why this answer

Azure Site Recovery provides VM replication with RPOs as low as 15 minutes and RTOs of minutes, meeting the 15-minute RPO and 30-minute RTO. Geo-redundant storage (GRS) for Azure Files ensures data is replicated to a paired secondary region with an RPO of 15 minutes (typically), and Azure SQL Database Hyperscale’s geo-restore allows restoring from geo-replicated backups, which can achieve the required RPO/RTO when tested and automated. This combination is cost-effective as it uses native Azure services without requiring a pre-provisioned secondary environment.

Exam trap

The trap here is that candidates may assume active geo-replication or failover groups are always available for Azure SQL Database, but the Hyperscale tier does not support these features, requiring geo-restore instead.

How to eliminate wrong answers

Option B is wrong because deploying a second set of VMs in a secondary region incurs ongoing compute costs, which is not cost-effective, and Azure File Sync does not provide the 15-minute RPO for Azure Files (sync intervals are configurable but typically longer). Option C is wrong because Azure Backup with a 15-minute frequency is not supported for Azure VMs (minimum frequency is 4 hours for application-consistent backups), and point-in-time restore for Azure SQL Database does not meet the 15-minute RPO for cross-region DR. Option D is wrong because active geo-replication for Azure SQL Database is not available for the Hyperscale tier; Hyperscale uses named replicas and geo-restore instead of failover groups or active geo-replication.

Full explanation →

145

MCQmedium

A media company stores large video files that are accessed once a month for audits. When needed, they must be available for download immediately (within seconds). The company wants to minimize storage costs. Which Azure Blob Storage access tier should they use?

A.Hot tier

B.Cool tier

C.Cold tier

D.Archive tier

AnswerB

Cool tier offers a low per-GB storage price with a modest per-GB retrieval fee and a 30-day minimum retention period, which aligns perfectly with monthly access. Retrieval is immediate because objects remain in the online tier, so the media company can read or stream the video without waiting for rehydration. For large files read once per month, Cool delivers the lowest total cost among tiers that still provide on-demand access, making it the correct choice.

Why this answer

The Cool tier is optimal for this scenario because it balances low storage cost with high availability and low latency access. Video files accessed once a month for audits require immediate download (within seconds), which Cool tier supports with the same millisecond latency as Hot tier, but at a lower storage price. Archive tier would introduce a multi-hour rehydration delay, making it unsuitable for on-demand access within seconds.

Exam trap

The trap here is that candidates often choose Archive tier for infrequent access without realizing that the multi-hour rehydration latency makes it impossible to meet the 'within seconds' availability requirement, or they choose Hot tier out of habit for any access speed requirement, ignoring the cost-minimization goal.

How to eliminate wrong answers

Option A (Hot tier) is wrong because it has the highest storage cost, which contradicts the goal of minimizing storage costs for infrequently accessed data. Option C (Cold tier) is wrong because although it offers lower storage cost than Cool, it has a higher minimum storage duration (90 days vs 30 days) and a higher early deletion fee, making it more expensive for data accessed only once a month. Option D (Archive tier) is wrong because it requires a rehydration process that takes up to 15 hours, making it impossible to provide download within seconds on demand.

Full explanation →

146

MCQhard

Contoso Ltd. runs a mission-critical application on Azure Virtual Machines in the East US region. The application uses Azure SQL Database (Business Critical tier) and stores files in Azure Blob Storage (hot tier). The business requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes for the application. For SQL Database, they need the ability to fail over to a secondary region with no data loss. For Blob Storage, they need to maintain read access to data even if the primary region fails. The solution must be cost-optimized and not exceed the RTO/RPO. Which combination of services should you recommend?

A.Configure Azure SQL Database failover groups with automatic failover, and use geo-redundant storage (GRS) for Blob Storage.

B.Deploy Azure Site Recovery for VMs, configure Azure SQL Database failover groups, and use geo-zone-redundant storage (GZRS) for Blob Storage.

C.Configure Azure SQL Database geo-restore for the database, and use zone-redundant storage (ZRS) for Blob Storage.

D.Configure Azure SQL Database active geo-replication with a secondary in a paired region, and use read-access geo-redundant storage (RA-GRS) for Blob Storage.

AnswerD

Active geo-replication provides synchronous replication for zero data loss, and RA-GRS allows read access during a regional outage, meeting RTO/RPO.

Why this answer

Active geo-replication for Azure SQL Database supports an RPO of 5 minutes with no data loss during failover to a secondary paired region, meeting the business-critical requirement. Read-access geo-redundant storage (RA-GRS) provides read access to data in the secondary region even if the primary fails, satisfying the Blob Storage requirement. This combination is cost-optimized as it avoids unnecessary services like Site Recovery for VMs, which are not required for the stated RTO/RPO.

Exam trap

The trap here is that candidates often confuse geo-redundant storage (GRS) with read-access geo-redundant storage (RA-GRS), assuming GRS provides read access during a failure, when in fact it only allows a write failover that requires a manual process and does not maintain continuous read access.

How to eliminate wrong answers

Option A is wrong because geo-redundant storage (GRS) does not provide read access to the secondary region during a primary failure; it only allows failover for write access, failing the requirement to maintain read access. Option B is wrong because Azure Site Recovery for VMs is unnecessary overhead; the application's RTO of 15 minutes and RPO of 5 minutes can be met without it, and geo-zone-redundant storage (GZRS) does not guarantee read access during a regional failure (it requires a manual failover). Option C is wrong because geo-restore for Azure SQL Database has an RPO of up to 1 hour (not 5 minutes) and does not support automatic failover with no data loss, and zone-redundant storage (ZRS) only protects within a single region, not against a full regional failure.

Full explanation →

147

MCQmedium

A company runs a SQL Server database on an Azure VM in West Europe. They need to back up the database daily and retain backups for 7 years for compliance. They also require the ability to restore the database to a secondary Azure region (North Europe) if the primary region fails. They want to minimize operational overhead and costs. Which Azure Backup configuration should they use?

A.A

B.B

C.C

D.D

AnswerA

Azure Backup for SQL Server in an Azure VM securely stores full, differential, and transaction log backups in a Recovery Services vault. You can configure the vault in West Europe as the primary region and enable the Cross-Region Restore (CRR) feature, which replicates the backup data to the paired North Europe region using geo-redundant storage (GRS). This design provides automated SQL-aware backup management, point-in-time restore capability, and the ability to restore databases in North Europe without deploying any additional backup infrastructure or vaults, making it the optimized, cost-effective approach.

Why this answer

Azure Backup's built-in cross-region restore (CRR) for Azure VMs allows you to restore SQL Server databases hosted on Azure VMs to a paired secondary region (North Europe) in the event of a disaster, while retaining backups for up to 10 years (covering the 7-year compliance requirement). This configuration minimizes operational overhead by using Azure Backup's native policy-based scheduling and storage management, and it is cost-effective as it uses geo-redundant storage (GRS) for the Recovery Services vault without needing a separate backup infrastructure.

Exam trap

The trap here is that candidates often confuse Azure Site Recovery (ASR) with Azure Backup, thinking ASR can handle long-term backup retention, when in fact ASR is for replication and failover, not for point-in-time restores with multi-year retention, and they may overlook the need to explicitly enable cross-region restore (CRR) on the Recovery Services vault to meet the secondary region recovery requirement.

How to eliminate wrong answers

Option B is wrong because it suggests using Azure Site Recovery (ASR) for database backup, but ASR is designed for replication and failover of entire VMs, not for point-in-time database restore with long-term retention; it also incurs higher costs for continuous replication and does not natively support 7-year backup retention. Option C is wrong because it proposes backing up the SQL Server database to Azure Blob Storage using manual scripts or third-party tools, which increases operational overhead and does not integrate with Azure Backup's native cross-region restore or long-term retention policies. Option D is wrong because it recommends using Azure Backup for SQL Server on Azure VM but without enabling cross-region restore (CRR), which means backups are stored only in the primary region (West Europe) and cannot be restored to North Europe if the primary region fails, failing the disaster recovery requirement.

Full explanation →

148

MCQeasy

A company runs a critical Azure SQL Database in the West US region. They need a disaster recovery solution that automatically fails over to a secondary region (East US) with a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of less than 1 hour. Additionally, they want to offload read-only workloads to the secondary database during normal operations. Which Azure SQL Database feature should they enable?

A.Active geo-replication with failover groups

B.Point-in-time restore

C.Long-term backup retention

D.Always On availability groups (self-managed)

AnswerA

Failover groups provide automatic failover to a readable secondary database. Active geo-replication synchronizes data with an RPO of 5 seconds and supports readable secondaries. The failover group ensures automatic failover with an RTO of typically less than 1 hour.

Why this answer

Active geo-replication with failover groups is the correct choice because it provides automatic, asynchronous replication of an Azure SQL Database to a secondary region (East US) with an RPO of up to 5 seconds and an RTO of less than 1 hour. Additionally, it supports readable secondary replicas, allowing read-only workloads to be offloaded to the secondary database during normal operations, meeting all stated requirements.

Exam trap

The trap here is that candidates often confuse active geo-replication with failover groups (which supports readable secondaries and automatic failover) with standard active geo-replication (which requires manual failover and does not provide a single endpoint), or they mistakenly think Always On availability groups applies to Azure SQL Database instead of SQL Server on VMs.

How to eliminate wrong answers

Option B is wrong because point-in-time restore (PITR) only recovers the database to a specific point in time within the same region (retention up to 35 days) and does not provide cross-region failover or a readable secondary for offloading read workloads. Option C is wrong because long-term backup retention (LTR) stores backups for up to 10 years for compliance, but it does not enable automatic failover to a secondary region or support readable secondaries for read offloading. Option D is wrong because Always On availability groups (self-managed) is a feature for SQL Server on Azure Virtual Machines, not for Azure SQL Database managed service, and it requires manual configuration and management, not automatic failover with the specified RPO/RTO.

Full explanation →

149

MCQmedium

A company wants to deploy containerized microservices on Azure without managing virtual machines. The solution must support automatic scaling based on demand, built-in load balancing, rolling updates for zero-downtime deployments, and a fully managed platform. Which Azure compute service should they choose?

A.Azure Container Apps

B.Azure Container Instances

C.Azure Batch

D.Azure Functions

AnswerA

Azure Container Apps is a serverless platform for running containers. It provides automatic scaling based on HTTP traffic or events, built-in load balancing, and supports rolling updates via revisions. It abstracts away underlying infrastructure, so no VMs to manage.

Why this answer

Azure Container Apps is the correct choice because it provides a fully managed, serverless platform for running containerized microservices without managing virtual machines. It supports automatic scaling based on HTTP traffic or events, built-in load balancing via Envoy, and rolling updates with revision management to ensure zero-downtime deployments. This aligns perfectly with the requirement for a fully managed platform that abstracts away infrastructure.

Exam trap

The trap here is that candidates often confuse Azure Container Instances (ACI) with a managed orchestration solution, but ACI lacks the automatic scaling, load balancing, and rolling update capabilities that Container Apps provides for microservices.

How to eliminate wrong answers

Option B (Azure Container Instances) is wrong because it is designed for running individual containers on demand without built-in orchestration, automatic scaling, or rolling update capabilities—it lacks the microservice management features required. Option C (Azure Batch) is wrong because it is a job-scheduling service for high-performance computing (HPC) and parallel workloads, not for deploying containerized microservices with load balancing and rolling updates. Option D (Azure Functions) is wrong because it is a serverless compute service for event-driven code (functions), not for running containerized microservices; it does not support container orchestration or rolling updates for containers.

Full explanation →

150

MCQeasy

A company is deploying a web application that must be accessible from the internet. The application is hosted on Azure virtual machines in a virtual network. The solution must provide SSL termination, web application firewall (WAF) protection, and URL path-based routing (e.g., /api/* to one backend pool, /app/* to another). The web tier must not be directly exposed to the internet. Which Azure load balancing solution should they use?

A.Azure Application Gateway v2

B.Azure Front Door

C.Azure Load Balancer

D.Azure Traffic Manager

AnswerA

Azure Application Gateway v2 is a regional Layer 7 reverse proxy that performs SSL termination, web application firewall (WAF) inspection, and URL path-based or multi-site routing. It can be configured with a public front-end IP and a backend pool containing VMs with only private IPs, making it ideal for protecting an internet-facing web tier. The v2 SKU adds auto-scaling and zone redundancy, with the WAF policy enforcing OWASP rule sets at the HTTP edge.

Why this answer

Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that provides SSL termination, a web application firewall (WAF), and URL path-based routing. It can route traffic to different backend pools based on URL paths (e.g., /api/* and /app/*) while keeping the web tier isolated within the virtual network, as the gateway itself is exposed to the internet.

Exam trap

The trap here is that candidates often confuse Azure Front Door with Application Gateway, but Front Door is designed for global, multi-region scenarios and cannot provide direct VNet integration for a single-region app without exposing backend public IPs, whereas Application Gateway is the correct Layer 7 solution for a single-region VNet deployment.

How to eliminate wrong answers

Option B (Azure Front Door) is wrong because it is a global, multi-region load balancer and application delivery network that operates at the edge, not within a single virtual network; it cannot provide direct SSL termination and WAF for a single-region VNet-hosted app without exposing the backend to the internet via public endpoints. Option C (Azure Load Balancer) is wrong because it operates at Layer 4 (TCP/UDP) and cannot perform SSL termination, WAF inspection, or URL path-based routing. Option D (Azure Traffic Manager) is wrong because it is a DNS-based traffic router that only directs clients to endpoints based on DNS resolution, not a proxy that can terminate SSL, apply WAF rules, or route based on URL paths.

Full explanation →

Microsoft Azure Solutions Architect Expert AZ-305 (AZ-305) — Questions 76–150