Microsoft Azure Solutions Architect Expert AZ-305 AZ-305 Questions 151–212 | Page 3/3

151

MCQeasy

Your company uses Azure Policy to enforce compliance. You need to ensure that all storage accounts use HTTPS only. The policy should automatically remediate non-compliant storage accounts by enabling HTTPS-only. What policy effect should you use?

A.Deny

B.AuditIfNotExists

C.Append

D.DeployIfNotExists

AnswerD

DeployIfNotExists can deploy a template to set the storage account property to enable HTTPS-only.

Why this answer

The DeployIfNotExists effect is correct because it not only evaluates whether storage accounts have the 'HTTPS only' setting enabled but also automatically deploys a remediation task to enable it when non-compliance is detected. This ensures continuous compliance without manual intervention, which aligns with the requirement for automatic remediation.

Exam trap

The trap here is that candidates often confuse 'Deny' (which blocks non-compliant new resources) with 'DeployIfNotExists' (which remediates existing resources), missing the key requirement for automatic remediation of already deployed storage accounts.

How to eliminate wrong answers

Option A is wrong because Deny blocks the creation or update of a resource that doesn't meet the policy condition, but it does not remediate existing non-compliant storage accounts. Option B is wrong because AuditIfNotExists only audits whether a related resource (like a diagnostic setting) exists, not the property of the storage account itself, and it provides no remediation. Option C is wrong because Append adds fields to a resource during creation or update but cannot modify existing storage account properties like 'HTTPS only' after the resource is deployed.

Full explanation →

152

MCQmedium

A company runs a critical SQL Server database on an Azure virtual machine. They need a backup strategy that supports point-in-time restore down to the second and long-term retention of backups for 7 years to meet compliance. They want to offload backup management to Azure. Which backup solution should they use?

A.Azure Backup for SQL Server on Azure VM

B.Azure Site Recovery

C.SQL Server managed backup to Azure

D.Azure Disk Backup

AnswerA

Azure Backup for SQL Server on Azure VM is a fully managed backup service that integrates with the SQL Server IaaS Agent Extension, automating full, differential, and transaction log backups. It supports point-in-time restore with log backups taken every 15 minutes, and offers long-term retention policies for up to 10 years, meeting both operational recovery and compliance requirements. The centralized monitoring, alerting, and cross-subscription management capabilities make it the ideal choice for a critical SQL database.

Why this answer

Azure Backup for SQL Server on Azure VM provides native integration that supports point-in-time restore down to the second for SQL Server databases and allows configuring long-term retention (LTR) for up to 10 years, meeting the 7-year compliance requirement. It offloads backup management to Azure by automating backup schedules, retention policies, and restore operations without requiring manual scripting or third-party tools.

Exam trap

The trap here is that candidates often confuse Azure Site Recovery (disaster recovery) with backup, or assume SQL Server managed backup to Azure provides the same integrated point-in-time and long-term retention capabilities as Azure Backup, when in fact Azure Backup offers a fully managed, portal-integrated solution with native SQL Server awareness.

How to eliminate wrong answers

Option B is wrong because Azure Site Recovery is a disaster recovery solution that replicates entire VMs for failover, not a backup service; it does not support point-in-time restore for SQL Server databases or long-term retention for compliance. Option C is wrong because SQL Server managed backup to Azure is a feature that manages backups to Azure Blob storage but requires manual configuration of retention policies and does not offer native point-in-time restore down to the second or integrated long-term retention management within the Azure portal. Option D is wrong because Azure Disk Backup provides crash-consistent backups of managed disks at the VM level, not application-consistent backups for SQL Server, and cannot perform point-in-time restore for database transactions or log backups.

Full explanation →

153

MCQmedium

A company has an on-premises Hyper-V environment with 20 virtual machines running various workloads. They want to use Azure as a disaster recovery site. The required recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 2 hours. They want to automate failover and failback. Which Azure service should they use?

A.Azure Site Recovery

B.Azure Migrate

C.Azure Backup

D.Azure Recovery Services Vault

AnswerA

Azure Site Recovery is the only option that provides continuous, near-synchronous replication of Hyper-V VMs to Azure, with RPOs as low as 30 seconds and the ability to meet a 15-minute RPO. It uses the Azure Site Recovery Provider installed on the Hyper-V host and the Microsoft Recovery Services Agent, replicating VHDs to Azure storage while enabling orchestrated test failovers, planned/unplanned failovers, and failback. This is true disaster recovery, not backup or migration.

Why this answer

Azure Site Recovery (ASR) is the correct service because it provides orchestrated replication, failover, and failback for Hyper-V VMs to Azure as a DR site. It supports the required RPO of 15 minutes (using near-synchronous replication with change tracking) and RTO of 2 hours (via automated recovery plans), and it natively automates both failover and failback processes without additional scripting.

Exam trap

The trap here is that candidates confuse the Recovery Services Vault (a storage container) with the actual DR service (Azure Site Recovery), or they mistakenly think Azure Backup can meet low RPO/RTO requirements for disaster recovery when it is designed for backup, not replication with automated failover.

How to eliminate wrong answers

Option B (Azure Migrate) is wrong because it is designed for discovery, assessment, and migration of on-premises workloads to Azure, not for ongoing disaster recovery replication or automated failover/failback. Option C (Azure Backup) is wrong because it provides backup-based recovery with typical RPOs of 12-24 hours and RTOs measured in hours to days, and it does not support automated failover or failback orchestration. Option D (Azure Recovery Services Vault) is wrong because it is a storage container that holds backup data and replication settings, not a service that performs replication, failover, or failback; it is the underlying vault used by both Azure Backup and Azure Site Recovery, but the question asks for the service that automates DR, which is ASR.

Full explanation →

154

MCQmedium

A company stores JSON documents for a mobile app backend. The data needs to be accessible from multiple global regions with low latency writes from any region. The app uses a client-side library that supports automatic conflict resolution for concurrent updates. Which Azure data service should they choose?

A.Azure Cosmos DB

B.Azure SQL Database

C.Azure Database for PostgreSQL

D.Azure Table Storage

AnswerA

Azure Cosmos DB is the correct choice because it provides native multi-region writes, enabling the same JSON document to be written and updated from any Azure region with automatic conflict resolution to handle concurrent edits. Its flexible schema and JSON-native indexing make it purpose-built for storing and querying mobile app backend documents, and it offers well-defined consistency levels and an SLA for availability and latency.

Why this answer

Azure Cosmos DB is correct because it provides multi-region writes with automatic conflict resolution, which directly matches the requirement for low-latency writes from any global region. Its multi-master replication model allows any region to accept writes, and the client-side library can use last-writer-wins (LWW) or custom conflict resolution policies to handle concurrent updates seamlessly.

Exam trap

The trap here is that candidates often confuse Azure SQL Database or Azure Database for PostgreSQL's read replicas with write capability, failing to recognize that only Cosmos DB offers true multi-region writes with built-in conflict resolution.

How to eliminate wrong answers

Option B (Azure SQL Database) is wrong because it does not natively support multi-region writes; it relies on a single primary region for writes, and geo-replication is read-only, so it cannot achieve low-latency writes from multiple regions. Option C (Azure Database for PostgreSQL) is wrong because it also uses a single-writer primary architecture; while read replicas can be distributed, writes must go to the primary region, introducing latency for global writes. Option D (Azure Table Storage) is wrong because it does not support multi-region writes; it offers only a single write region with read-only geo-redundant storage, and it lacks built-in conflict resolution for concurrent updates.

Full explanation →

155

MCQmedium

A company needs to store sensor data from IoT devices. Each device sends a message every second. The data is time-series and will be queried for real-time dashboards and historical analysis. The solution must support high ingestion rates and low-latency queries on recent data. Which Azure service should they use?

A.Azure Blob Storage with Azure Data Lake Storage Gen2

B.Azure Cosmos DB with SQL API

C.Azure Event Hubs and Azure Data Explorer

D.Azure Table Storage

AnswerC

Azure Event Hubs and Azure Data Explorer form the native Azure pattern for IoT sensor data because Event Hubs offers high-throughput, low-latency event streaming with partitioning and auto-inflate, easily handling millions of sensor messages per second. Azure Data Explorer (ADX) is a purpose-built analytics engine for time-series and log data, using columnar storage and an optimized ingestion pipeline that can directly consume streams from Event Hubs. ADX's KQL query language delivers real-time aggregations over large temporal windows in sub-second latency, making it ideal for live dashboards. This combination decouples ingestion from analytics while providing end-to-end scalability and low operational overhead.

Why this answer

Azure Event Hubs is designed for high-throughput data ingestion from millions of IoT devices, capable of handling millions of events per second. Azure Data Explorer (ADX) is optimized for time-series data, providing sub-second query latency on recent data and efficient historical analysis. Together, they form a serverless pipeline that ingests sensor data via Event Hubs and stores it in ADX for real-time dashboards and long-term analytics.

Exam trap

The trap here is that candidates often choose Azure Cosmos DB (Option B) because they associate it with 'low latency' and 'IoT', but they overlook that Cosmos DB is not purpose-built for time-series data and lacks the ingestion throughput and query optimizations that Azure Data Explorer provides for this specific workload.

How to eliminate wrong answers

Option A is wrong because Azure Blob Storage with Data Lake Storage Gen2 is optimized for batch analytics and large file storage, not for high-frequency time-series ingestion or low-latency queries on recent data; it lacks native time-series indexing and real-time query capabilities. Option B is wrong because Azure Cosmos DB with SQL API is a multi-model NoSQL database designed for transactional workloads with flexible schemas, but it is not optimized for time-series data at high ingestion rates and can incur high RU costs for continuous writes; it also lacks native time-series functions like binning or retention policies. Option D is wrong because Azure Table Storage is a key-value store with limited query capabilities (only on partition and row keys), no support for time-series-specific operations, and high latency for range scans over timestamps, making it unsuitable for real-time dashboards and high-ingestion IoT workloads.

Full explanation →

156

MCQmedium

A company is designing a hybrid network solution connecting an on-premises data center to Azure. They require high availability with active-active routing and need to support up to 10 Gbps throughput. Which Azure service should they include in the design?

A.Site-to-Site VPN Gateway

B.Azure Virtual WAN

C.ExpressRoute FastPath

D.ExpressRoute Direct

AnswerD

ExpressRoute Direct provides a dedicated, private Layer-2 connection between your on-premises network and Microsoft's edge at a peering location, with port pairs available at 10 Gbps, 40 Gbps, or 100 Gbps. Since it delivers physical port-level bandwidth rather than a VPN gateway's aggregate limit, it easily satisfies the 10 Gbps throughput requirement. It also supports active-active routing by default through dual routers and BGP sessions, giving the required high availability with an SLA-backed redundant path.

Why this answer

ExpressRoute Direct provides dedicated, private connections from on-premises to Azure, supporting bandwidths up to 100 Gbps (10 Gbps easily). It enables active-active routing by using two circuits with BGP, meeting high availability and throughput requirements. ExpressRoute FastPath is a performance feature that reduces latency but is not a standalone service and does not itself provide active-active routing or guaranteed throughput; it requires an ExpressRoute circuit and does not replace the need for Direct when dedicated throughput is required.

Exam trap

A common mistake is assuming that ExpressRoute FastPath is a standalone service that can provide active-active routing and 10 Gbps throughput. In reality, FastPath is a feature that enhances performance but must be used with an existing ExpressRoute circuit. For dedicated bandwidth and native active-active routing, ExpressRoute Direct is the appropriate service.

How to eliminate wrong answers

Option A is wrong because Site-to-Site VPN Gateway is limited to a maximum throughput of approximately 1.25 Gbps per tunnel (aggregate up to 10 Gbps only with multiple tunnels and specific SKUs), and it relies on the public internet, which does not guarantee the consistent 10 Gbps throughput or the same SLA as a private connection. Option B is wrong because Azure Virtual WAN is a networking orchestration service that can aggregate multiple connection types, but it does not itself provide the high-throughput, dedicated private connectivity required; it would typically use ExpressRoute circuits underneath for such throughput, making it an architectural overlay rather than the direct service needed. Option D is wrong because ExpressRoute FastPath is a feature that improves network performance by bypassing the gateway for certain traffic flows, but it is not a standalone service; it must be enabled on an existing ExpressRoute circuit and does not itself provide the 10 Gbps throughput or active-active routing—it enhances performance after the circuit is in place.

Full explanation →

157

MCQmedium

A company has several Azure Virtual Machines running Windows Server with critical applications. They need to back up these VMs to a secondary Azure region to protect against regional disasters. The backup must be application-consistent and support file-level restore. Which solution should they implement?

A.Azure Backup with geo-redundant storage (GRS) in a Recovery Services vault

B.Azure Site Recovery

C.Azure Snapshot of managed disks stored in a different region

D.Azure Managed Disk with incremental snapshots and manual cross-region copy

AnswerA

Azure Backup offers VM-level application-consistent backups, supports GRS for cross-region durability, and allows file-level restore from recovery points.

Why this answer

Azure Backup with geo-redundant storage (GRS) in a Recovery Services vault is the correct solution because it provides application-consistent backups of Windows Server VMs using the Volume Shadow Copy Service (VSS) to ensure data integrity, and it supports file-level restore by allowing you to mount the backup as a drive to recover individual files. The GRS option replicates backup data to a paired secondary region, meeting the disaster recovery requirement without additional manual steps.

Exam trap

The trap here is that candidates confuse Azure Site Recovery (a replication/failover tool) with Azure Backup (a backup/restore tool), or assume that crash-consistent snapshots (Options C and D) are sufficient for application consistency and file-level restore, which they are not.

How to eliminate wrong answers

Option B (Azure Site Recovery) is wrong because it is designed for replication and failover of VMs for disaster recovery, not for backup—it does not support file-level restore from backup snapshots and is not a backup solution. Option C (Azure Snapshot of managed disks stored in a different region) is wrong because snapshots are crash-consistent, not application-consistent, and they do not support file-level restore natively; you would need to create a new disk from the snapshot to access files. Option D (Azure Managed Disk with incremental snapshots and manual cross-region copy) is wrong because incremental snapshots are also crash-consistent and require manual cross-region copy, which adds complexity and does not guarantee application consistency or built-in file-level restore capabilities.

Full explanation →

158

MCQhard

A company runs a critical application on Azure VMs in the West US region. They want to protect against a regional disaster by replicating VMs to East US using Azure Site Recovery. They have both managed and unmanaged disks. They need to ensure that after failover, the recovery VMs are automatically placed in a specific availability set to support the application's multi-tier architecture. Additionally, they want to minimize downtime during planned failover. Which configuration should they use?

A.Configure a recovery plan that includes the VMs and specifies the target availability set and failover order

B.Set the target availability set in each VM's replication settings individually without a recovery plan

C.Use Azure Traffic Manager to route traffic to the secondary region after manual failover

D.Enable consistency groups across the VMs using a replication policy

AnswerA

A recovery plan in Azure Site Recovery groups all VMs into a single orchestrated failover unit, letting you specify the target availability set in the secondary region and defining the exact failover order. You can add pre/post-action runbooks to automate scripted steps, which minimizes downtime and ensures application-consistent startup during planned failover. Setting availability sets and boot order individually in VM replication settings lacks this coordinated sequencing, so the recovery plan is the appropriate DR orchestration mechanism.

Why this answer

A recovery plan in Azure Site Recovery allows you to group VMs, specify the target availability set, and define the failover order. This ensures that after failover, the recovery VMs are automatically placed in the specified availability set, supporting the application's multi-tier architecture. Additionally, recovery plans enable you to automate and sequence failover steps, minimizing downtime during planned failover by orchestrating the process efficiently.

Exam trap

The trap here is that candidates often confuse replication settings (like target availability set per VM) with recovery plans, not realizing that only recovery plans can enforce failover order and group-level placement, which is critical for multi-tier applications.

How to eliminate wrong answers

Option B is wrong because setting the target availability set in each VM's replication settings individually does not allow you to define a failover order or group VMs into a recovery plan, which is necessary for multi-tier application consistency and minimizing downtime. Option C is wrong because Azure Traffic Manager is a DNS-based traffic routing service that does not handle VM placement into availability sets or orchestrate failover sequencing; it only redirects traffic after failover is manually completed. Option D is wrong because consistency groups (multi-VM consistency) ensure crash-consistent or app-consistent recovery points across VMs but do not control target availability set placement or failover order; they are a replication policy feature, not a recovery plan substitute.

Full explanation →

159

MCQhard

Refer to the exhibit. You deploy this ARM template to create a storage account in the West US region. The business continuity requirement states that if the primary region becomes unavailable, the storage account must be readable within 1 hour. What is the most important limitation of this configuration?

A.The storage account does not support read access in the secondary region, so manual failover is required, which may exceed the 1-hour RTO

B.The storage account uses GRS, which replicates data only to a secondary region within the same geography, not to a different region

C.The storage account only supports HTTPS traffic, which blocks replication

D.The storage account is configured with the Hot access tier, which prevents failover

AnswerA

This is correct because the ARM template likely creates an Azure Storage account with GRS (Geo-Redundant Storage), which does not provide read access to the secondary region—that capability requires RA-GRS (Read-Access Geo-Redundant Storage). GRS only asynchronously replicates data to the paired secondary region, so you must perform a manual account failover to promote the secondary to primary. This manual failover can take several hours (often 2–3+ hours) depending on Azure's workload, exceeding the 1-hour RTO specified. Since the secondary is not readable before failover, you cannot meet recovery objectives without a separate, active second-region copy.

Why this answer

The ARM template configures GRS (Geo-Redundant Storage), which replicates data to a secondary region but does not provide read access to that data unless a manual failover is initiated. Without read-access geo-redundant storage (RA-GRS), the storage account cannot be read in the secondary region within 1 hour of a primary region outage, as manual failover requires user intervention and may take longer than the RTO. The business continuity requirement demands readability within 1 hour, which is not guaranteed with standard GRS.

Exam trap

The trap here is that candidates often confuse GRS with RA-GRS, assuming that geo-redundant replication automatically provides read access to the secondary region, when in fact only RA-GRS offers that capability without manual failover.

How to eliminate wrong answers

Option B is wrong because GRS does replicate data to a secondary region within the same geography (e.g., paired region), which is a different region from the primary (West US), so this statement is factually incorrect. Option C is wrong because HTTPS traffic does not block replication; Azure Storage replication uses HTTPS for secure data transfer, and this setting is unrelated to replication functionality. Option D is wrong because the Hot access tier does not prevent failover; access tiers (Hot, Cool, Archive) affect storage costs and retrieval latency, not the ability to perform a failover or read from the secondary region.

Full explanation →

160

MCQhard

Refer to the exhibit. An administrator runs the PowerShell script to enable replication for a VM. The script fails with an error that the VM is not found. What is the most likely cause?

A.The Recovery Services vault does not exist.

B.The protection container is not available.

C.The replication policy is not valid.

D.The Azure PowerShell context is not set to the subscription that contains the VM.

AnswerD

The script uses Get-AzVM to locate the virtual machine, and this cmdlet depends on the active Azure context — the subscription set by Set-AzContext or Select-AzSubscription. If the context points to a different subscription than the one holding the target VM, Get-AzVM returns no matching VM, causing the backup protection command to fail with 'VM not found' even though the vault, container, and policy are all visible in the current context. The solution is to explicitly set the context (e.g., Set-AzContext -SubscriptionId '...') before running the script.

Why this answer

The PowerShell script uses `Get-AzRecoveryServicesBackupItem` and `Enable-AzRecoveryServicesBackupProtection` to enable replication for a VM. If the Azure PowerShell context (set via `Set-AzContext` or `Connect-AzAccount`) is not targeting the subscription containing the VM, the cmdlets will not find the VM resource, resulting in a 'VM not found' error. This is the most likely cause because the script otherwise references a valid vault, container, and policy.

Exam trap

The trap here is that candidates may assume the error is due to a missing vault or policy, but the 'VM not found' error specifically points to a subscription context mismatch, not a resource existence issue.

How to eliminate wrong answers

Option A is wrong because if the Recovery Services vault did not exist, the error would be 'vault not found' or a resource-not-found exception, not 'VM not found'. Option B is wrong because the protection container is derived from the vault and VM discovery; if it were unavailable, the error would indicate container retrieval failure, not a missing VM. Option C is wrong because the replication policy is validated when enabling protection; an invalid policy would produce a policy-specific error, not a 'VM not found' error.

Full explanation →

161

MCQmedium

A company runs a critical line-of-business application on Azure VMs within a single region. The application tier is deployed across multiple VMs. They need to protect against a failure of an entire Azure datacenter within that region. The solution should automatically distribute the VMs across physically separate locations with independent power, cooling, and networking. The company also requires the lowest possible latency between application and database tiers within the same location. Which deployment strategy should they use?

A.Deploy the VMs across multiple availability zones

B.Deploy the VMs in an availability set

C.Use Azure Site Recovery to replicate VMs to a paired region

D.Use Azure Proximity Placement Groups

AnswerA

Availability zones provide datacenter-level redundancy within a region. By placing VMs in different zones, the application can survive a single datacenter failure. This also allows low latency within the same zone for the database tier.

Why this answer

Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying the application tier VMs across multiple zones protects against an entire datacenter failure while keeping all resources within the same region, ensuring the lowest possible latency between application and database tiers when they are placed in the same zone.

Exam trap

The trap here is that candidates often confuse availability sets (which protect against rack failures) with availability zones (which protect against datacenter failures), or they incorrectly assume that cross-region replication via Site Recovery is the only way to achieve datacenter fault tolerance, ignoring the lower-latency option of multiple zones within the same region.

How to eliminate wrong answers

Option B is wrong because an availability set only protects against rack-level failures within a single datacenter, not against the failure of an entire datacenter. Option C is wrong because Azure Site Recovery to a paired region introduces cross-region latency, which does not meet the requirement for the lowest possible latency within the same location. Option D is wrong because Proximity Placement Groups are designed to reduce latency by co-locating VMs, but they do not provide protection against a full datacenter failure.

Full explanation →

162

MCQmedium

A company needs a fully managed NoSQL database for a JSON document-oriented application that requires low latency (single-digit milliseconds) for reads and writes at any scale. The application will run globally and needs multi-region writes with automatic failover. Which Azure data store should they use?

A.Azure Cosmos DB

B.Azure Table Storage

C.Azure SQL Database

D.Azure Cache for Redis

AnswerA

Azure Cosmos DB is the correct choice because it is a fully managed, multi-model NoSQL database with native JSON document support, schema-agnostic indexing, and an SQL-like query engine. It uniquely delivers multi-region writes with automatic failover, elastic horizontal partitioning and tunable consistency, backed by an industry-leading SLA of 99.999% availability and single-digit millisecond read/write latency at the 99th percentile. These capabilities are purpose-built for globally distributed JSON workloads requiring both durability and low-latency access.

Why this answer

Azure Cosmos DB is the correct choice because it is a fully managed NoSQL database that natively supports JSON documents, offers single-digit millisecond latency for reads and writes at any scale, and provides multi-region writes with automatic failover through its multi-master replication capability. Its global distribution model allows you to configure multiple write regions, ensuring high availability and low latency worldwide.

Exam trap

The trap here is that candidates often confuse Azure Table Storage (a simple key-value store) with a fully managed NoSQL database, overlooking that it lacks native JSON support, multi-region writes, and automatic failover capabilities required for global, low-latency applications.

How to eliminate wrong answers

Option B (Azure Table Storage) is wrong because it is a key-value store that does not natively support JSON documents or multi-region writes with automatic failover; it offers only eventual consistency and lacks the global distribution features required. Option C (Azure SQL Database) is wrong because it is a relational database that does not support JSON as a native document model and cannot provide multi-region writes with automatic failover; it is not a NoSQL solution. Option D (Azure Cache for Redis) is wrong because it is an in-memory cache, not a fully managed NoSQL database; it does not persist JSON documents durably and lacks multi-region write capabilities with automatic failover.

Full explanation →

163

MCQhard

A company uses Microsoft Entra ID B2B to collaborate with external vendors. They want to enforce that external users must use multi-factor authentication (MFA) and access company resources only from compliant devices (e.g., managed by Intune). They also want to require a session timeout of 1 hour. Which combination of Microsoft Entra ID features should they use?

A.A

B.B

C.C

D.D

AnswerB

Microsoft Entra ID Conditional Access is the comprehensive policy engine that can enforce all the stated requirements during sign-in. A Conditional Access policy can require multi-factor authentication for external B2B users, require the device to be marked as compliant by integrating with Intune, and apply session controls that set sign-in frequency to force periodic reauthentication. These policies can be targeted to guest and external users specifically, making Conditional Access the right tool for controlling access in B2B collaboration scenarios.

Why this answer

It combines Conditional Access policies with session controls to enforce MFA, device compliance (via Intune), and a 1-hour session timeout. Conditional Access policies evaluate sign-in risk and require MFA and compliant devices, while the session control 'Sign-in frequency' can be set to 1 hour to enforce reauthentication. This meets all three requirements without relying on deprecated or separate features.

Exam trap

The trap here is that candidates often confuse Conditional Access session controls with token lifetime policies or think that Identity Protection alone can enforce device compliance, but only Conditional Access policies can combine MFA, device compliance, and session timeout in a single policy.

How to eliminate wrong answers

Option A is wrong because it uses Azure AD Identity Protection, which is designed for risk-based policies (e.g., risky sign-ins) but does not natively enforce device compliance or session timeout; it lacks the session control for a 1-hour timeout. Option C is wrong because it relies on Azure AD Privileged Identity Management (PIM), which manages just-in-time privileged access and does not enforce MFA or device compliance for external users accessing general resources. Option D is wrong because it uses Azure AD Terms of Use, which only requires acceptance of a policy document and cannot enforce MFA, device compliance, or session timeout.

Full explanation →

164

MCQmedium

You are an Azure administrator. The above Azure Policy definition is assigned to a subscription. A developer tries to deploy a Virtual Machine with SKU Standard_DS2_v2. What will happen?

A.The deployment is denied and an error message is returned.

B.The deployment succeeds with a warning logged.

C.The VM is created but the SKU is changed to a different series.

D.The deployment succeeds because the policy only audits.

AnswerA

The policy definition's effect is Deny, so Azure Resource Manager evaluates the VM SKU against the condition before the resource provider accepts the request. When the condition matches, the create or update call is blocked, the deployment status is Failed, and the response contains the policy violation, including the policy name and assignment ID. Because evaluation happens during the PUT request, no VM is ever created or partially provisioned.

Why this answer

The Azure Policy definition assigned to the subscription includes a 'deny' effect for VM SKUs that are not in the allowed list. Since Standard_DS2_v2 is not an allowed SKU, the deployment is denied and an error message is returned to the developer, preventing the VM from being created.

Exam trap

The trap here is that candidates often confuse the 'deny' effect with 'audit' or 'modify' effects, assuming a policy only logs non-compliance or automatically corrects the resource, rather than understanding that 'deny' actively blocks the deployment.

How to eliminate wrong answers

Option B is wrong because a policy with a 'deny' effect does not allow the deployment to succeed with a warning; it actively blocks the deployment. Option C is wrong because Azure Policy does not automatically change the SKU to a different series; it either allows or denies the deployment based on the defined effect. Option D is wrong because the policy uses a 'deny' effect, not an 'audit' effect; an audit effect would log compliance but still allow the deployment to succeed.

Full explanation →

165

MCQhard

A company is designing a disaster recovery strategy for a mission-critical Azure SQL Database. They require a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of 1 hour. Which replication option should they use?

A.Zone-redundant deployment

B.Failover groups with active geo-replication

C.Auto-failover groups with active geo-replication

D.Geo-restore

AnswerB

Meets RPO of 5 seconds and RTO of 1 hour.

Why this answer

Failover groups with active geo-replication provide the lowest RPO (typically 5 seconds or less) and RTO (under 1 hour) for Azure SQL Database. Active geo-replication asynchronously replicates transactions to a secondary region, and failover groups orchestrate a coordinated, application-transparent failover that meets the stringent RTO requirement.

Exam trap

The trap here is that candidates confuse 'failover groups' with 'auto-failover groups' (which is not an official Azure term) and may incorrectly choose option C, or they underestimate the RPO/RTO of geo-restore and pick option D, not realizing that geo-restore is a backup-based solution with much higher latency.

How to eliminate wrong answers

Option A is wrong because zone-redundant deployment protects against datacenter failures within a single region, not against regional outages, and its RPO/RTO are not as low as required. Option C is wrong because 'Auto-failover groups with active geo-replication' is essentially the same as option B but with an incorrect name—Azure's feature is called 'failover groups' and does not include 'auto' in its official name; the automatic failover capability is part of failover groups, not a separate option. Option D is wrong because geo-restore uses point-in-time restore from geo-replicated backups, which has an RPO of 1 hour and RTO of 12+ hours, far exceeding the required 5-second RPO and 1-hour RTO.

Full explanation →

166

MCQmedium

A company runs a critical application on Azure VMs in the West US region. They need to protect against a regional disaster using Azure Site Recovery. The VMs use unmanaged disks. The recovery point objective (RPO) must be 15 minutes and the recovery time objective (RTO) must be 1 hour. Additionally, they must be able to perform quarterly disaster recovery drills that do not affect the production environment. Which configuration should they use in Azure Site Recovery?

A.Set up replication with a 15-minute snapshot frequency and perform test failover for drills.

B.Use Azure Backup for VM replication and perform restore drills.

C.Configure a recovery plan with a pre-script to take a snapshot every 15 minutes.

D.Enable multi-VM consistency group with a 15-minute consistency frequency.

AnswerA

Azure Site Recovery's replication policy allows configuring a recovery point objective (RPO) of 15 minutes by setting the snapshot frequency, so you can cap data loss at 15 minutes. The built-in test failover feature launches your replicated VMs in an isolated Azure network, letting you run non-disruptive failover drills without affecting production or incurring downtime. This is the only option that directly delivers both the required RPO and a documented, low-risk drill methodology.

Why this answer

Azure Site Recovery supports replication of Azure VMs with unmanaged disks, and a 15-minute snapshot frequency meets the RPO requirement. Test failover allows quarterly disaster recovery drills without impacting the production environment, as it creates isolated copies of VMs in a separate network for validation.

Exam trap

The trap here is confusing Azure Backup (long-term backup) with Azure Site Recovery (replication for disaster recovery), as both can restore VMs but only Site Recovery supports low RPOs and non-disruptive test failovers.

How to eliminate wrong answers

Option B is wrong because Azure Backup is designed for long-term backup retention and restore, not for low-RPO replication (typically 1-2 snapshots per day) and does not support the 15-minute RPO or test failover drills without affecting production. Option C is wrong because recovery plans with pre-scripts cannot take snapshots at a fixed frequency; snapshot frequency is configured at the replication policy level, not via scripts in a recovery plan. Option D is wrong because multi-VM consistency groups ensure crash-consistent or app-consistent snapshots across multiple VMs, but they do not directly set the snapshot frequency; the consistency frequency is separate from the replication frequency, and this option does not address the drill requirement.

Full explanation →

167

MCQhard

A large enterprise is designing a data lake solution for its analytics platform. The data lake will store petabytes of structured and unstructured data from various sources, including IoT devices, logs, and transactional databases. The solution must support: - Multi-protocol access (ABFS, REST, and NFS 3.0) - Hierarchical namespace for folder-level permissions - Optimized for analytical workloads (Parquet format) - Cost-effective storage for cold data that is accessed less than once a year. Which Azure storage solution should the enterprise recommend for the data lake?

A.Azure NetApp Files Ultra tier

B.Azure Files Premium tier

C.Azure Data Lake Storage Gen2 with Archive tier for cold data

D.Azure Blob Storage with hierarchical namespace enabled

AnswerC

Supports all required protocols and hierarchical namespace.

Why this answer

Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct foundation because it natively supports the required multi-protocol access (ABFS, REST, and NFS 3.0), a hierarchical namespace for folder-level permissions, and is optimized for analytical workloads using Parquet format. The Archive tier for cold data provides the lowest storage cost for data accessed less than once a year, meeting the cost-effectiveness requirement while retaining the ADLS Gen2 capabilities.

Exam trap

The trap here is that candidates may choose Option D (Azure Blob Storage with hierarchical namespace) thinking it is sufficient, but they overlook the explicit requirement for cost-effective cold data storage, which requires the Archive tier—a feature that is not automatically enabled with hierarchical namespace and must be selected as part of the ADLS Gen2 solution.

How to eliminate wrong answers

Option A is wrong because Azure NetApp Files Ultra tier is a high-performance file share for NFS/SMB workloads, not a data lake solution; it lacks native ABFS and REST protocol support, does not provide a hierarchical namespace for folder-level permissions, and its Ultra tier is expensive, not cost-effective for cold data. Option B is wrong because Azure Files Premium tier is a fully managed file share for SMB/NFS, not designed for data lake analytics; it does not support ABFS or REST protocols, lacks a hierarchical namespace, and its Premium tier is high-cost, unsuitable for cold data. Option D is wrong because Azure Blob Storage with hierarchical namespace enabled is essentially ADLS Gen2, but it does not include the Archive tier for cold data by default; the Archive tier is a separate access tier that must be explicitly selected to meet the cost-effective cold data requirement, making this option incomplete.

Full explanation →

168

MCQhard

A company is building a petabyte-scale data lake for analytics. The workload includes Apache Spark and Hive jobs that read and write large files. The storage solution must support a hierarchical namespace for efficient directory operations, POSIX-like access control lists (ACLs) for fine-grained permissions, and must be accessible via the Azure Blob Storage API for compatibility with existing tools. Furthermore, the solution should be optimized for analytics workloads with high throughput. Which Azure data service should they choose?

A.Azure Data Lake Storage Gen2

B.Azure Data Lake Storage Gen1

C.Azure Blob Storage

D.Azure Files

AnswerA

Azure Data Lake Storage Gen2 is correct because it layers a hierarchical namespace onto Blob Storage, providing POSIX ACLs, atomic directory renaming, and a Hadoop-compatible `abfs://` filesystem that Spark, Hive, and Presto can use directly. It also fully supports the Blob API and Azure SDKs, so existing tooling works unchanged, while delivering the scale, encryption, and lifecycle policies needed to run petabyte-scale analytics workloads.

Why this answer

Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with POSIX-like ACLs and is accessible via the Azure Blob Storage API. This service is specifically optimized for analytics workloads like Apache Spark and Hive, providing high throughput for petabyte-scale data lakes. The hierarchical namespace enables efficient directory operations, while the Blob Storage API ensures compatibility with existing tools.

Exam trap

The trap here is that candidates may confuse Azure Data Lake Storage Gen1 with Gen2, overlooking that Gen1 lacks Blob Storage API compatibility, or they may assume Azure Blob Storage with hierarchical namespace enabled is a separate service, but ADLS Gen2 is the specific offering that combines all required features.

How to eliminate wrong answers

Option B (Azure Data Lake Storage Gen1) is wrong because it uses its own REST API, not the Azure Blob Storage API, breaking compatibility with existing tools that rely on Blob Storage APIs. Option C (Azure Blob Storage) is wrong because it does not support a hierarchical namespace by default (only flat namespace) and lacks POSIX-like ACLs, making it unsuitable for efficient directory operations and fine-grained permissions. Option D (Azure Files) is wrong because it is designed for SMB file shares and shared file access, not for petabyte-scale analytics workloads with high throughput, and it does not support the Blob Storage API or a hierarchical namespace optimized for Spark/Hive.

Full explanation →

169

MCQmedium

You are a solutions architect for a large healthcare organization that uses Microsoft 365 and Azure. The organization has a Microsoft Entra ID tenant with 15,000 users. The security team requires that all users use multi-factor authentication (MFA) when accessing cloud applications. Currently, only 60% of users have registered for MFA. The organization wants to enforce MFA registration for all users within 30 days. The solution must minimize user disruption and allow users to register their MFA methods during their normal work hours. The organization uses Microsoft Intune for mobile device management and has a conditional access policy that requires MFA for all cloud apps. You need to design a solution to enforce MFA registration. What should you do?

A.Modify the existing conditional access policy to require MFA for all cloud apps and block access if MFA is not registered.

B.Deploy an Intune compliance policy that requires MFA enrollment on mobile devices.

C.Configure a Microsoft Entra ID MFA registration campaign to target all users and require registration within 14 days.

D.Use Microsoft Entra ID password reset policy to force users to register MFA during password reset.

AnswerC

The Microsoft Entra ID MFA registration campaign is the purpose-built feature to drive adoption by targeting all users, setting a required registration deadline (e.g., 14 days), and gradually reminding them to register without immediately blocking access. Users can snooze or delay the prompt for a limited time, which avoids disruption while still moving the entire tenant toward MFA readiness. This campaign works alongside conditional access policies and is the recommended first step before enforcing MFA for all cloud apps.

Why this answer

A Microsoft Entra ID MFA registration campaign is specifically designed to nudge users to register for MFA with a configurable deadline (up to 14 days) without immediately blocking access. This minimizes disruption by allowing users to register during normal work hours, and it integrates with existing Conditional Access policies that require MFA for cloud apps.

Exam trap

The trap here is confusing enforcement of MFA at sign-in (Conditional Access) with the proactive registration workflow (MFA registration campaign), leading candidates to choose Option A which would cause immediate disruption instead of a phased, user-friendly registration process.

How to eliminate wrong answers

Option A is wrong because modifying the existing Conditional Access policy to block access if MFA is not registered would immediately lock out the 40% of users who haven't registered, causing massive disruption and violating the requirement to minimize user disruption. Option B is wrong because an Intune compliance policy that requires MFA enrollment on mobile devices only applies to mobile devices managed by Intune, not to all 15,000 users accessing cloud apps from any device, and it does not enforce registration within 30 days. Option D is wrong because using the Microsoft Entra ID password reset policy to force MFA registration during password reset only applies when users initiate a password reset, which is not a guaranteed event within 30 days for all users, and it does not proactively enforce registration for all users.

Full explanation →

170

Multi-Selecteasy

Which TWO of the following are benefits of using Azure Policy? (Choose two.)

Select 2 answers

A.Assess compliance of resources against defined policies

B.Enforce tagging conventions on resources

C.Manage access control for resources

D.Create new Azure resources based on a template

E.Automatically remediate non-compliant resources without manual intervention

AnswersA, B

Azure Policy continuously evaluates existing and newly deployed resources against policy definitions and initiatives, aggregating the results into a compliance dashboard that shows per-policy and per-resource compliance states. This assessment process covers properties like resource types, locations, and configuration settings, enabling organizations to identify drift from corporate standards even after enrollment.

Why this answer

Azure Policy is a service that enables you to create, assign, and manage policies that enforce rules and effects over your Azure resources. Option A is correct because one of its primary benefits is the ability to assess the compliance state of existing and newly deployed resources against defined policy definitions, providing a clear compliance dashboard and reports. This assessment is continuous and can be viewed at the subscription, management group, or resource group level.

Exam trap

The trap here is that candidates often confuse Azure Policy's ability to enforce rules (like tagging) with automatic remediation, but automatic remediation requires explicit configuration of the 'deployIfNotExists' or 'modify' effect and a remediation task, making it not a direct benefit of simply using Azure Policy.

Full explanation →

171

MCQmedium

A company deploys a web application on Azure virtual machines (VMs) across multiple availability zones in the East US region. The application receives HTTPS traffic. They need to distribute incoming traffic across the VMs, offload SSL/TLS termination, and ensure that client requests from the same user session are always sent to the same backend VM (session persistence). Which Azure load balancing solution should they choose?

A.Azure Load Balancer

B.Azure Application Gateway

C.Azure Traffic Manager

D.Azure Front Door

AnswerB

Azure Application Gateway is a regional Layer-7 load balancer that terminates SSL and decrypts incoming HTTPS requests, enabling it to inspect HTTP headers and route based on URL paths. It natively provides cookie-based session affinity using the Application Gateway Affinity cookie, which reliably pins a client session to the same backend VM across availability zones. With additional features like URL path-based routing, WebSocket support, and optional WAF integration, it is the appropriate choice for distributing HTTPS traffic to VMs within a single region.

Why this answer

Azure Application Gateway is the correct choice because it is a Layer 7 load balancer that supports SSL/TLS termination, cookie-based session persistence (affinity), and can distribute HTTPS traffic across VMs in multiple availability zones. These features directly match all three requirements: SSL offloading, session persistence, and cross-zone traffic distribution.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming any load balancer can handle SSL termination and session persistence, but only Layer 7 solutions like Application Gateway or Front Door provide cookie-based affinity and SSL offload.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and does not support SSL/TLS termination or application-layer session persistence; it can only maintain session affinity using source IP hashing, which is not cookie-based and less reliable for HTTPS. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic router that does not perform SSL termination or session persistence; it directs clients to regional endpoints based on DNS resolution, not per-request load balancing. Option D is wrong because Azure Front Door is a global Layer 7 service that supports SSL termination and session affinity, but it is designed for global distribution across regions, not for distributing traffic within a single region across availability zones; it adds unnecessary latency and complexity for a regional-only workload.

Full explanation →

172

MCQhard

A company is designing a hub-spoke network topology in Azure. The hub contains a third-party network virtual appliance (NVA) for inspection. Spokes need to communicate with each other, and all inter-spoke traffic must be routed through the NVA in the hub. Which configuration should they use?

A.Set route tables on spoke subnets with a 0.0.0.0/0 route to the Internet

B.Configure Azure Firewall in the hub with forced tunneling to on-premises

C.Create user-defined routes (UDRs) in each spoke subnet that force traffic to go through the hub NVA

D.Use VNet peering with gateway transit enabled

AnswerC

The correct approach is to create user-defined routes on each spoke subnet with a route for the other spoke's address space and the next hop set to the private IP address of the hub NVA. Because VNet peering is non-transitive, spoke-to-spoke traffic will not automatically flow through the hub; the UDR overrides the system route to force that path. You must also enable IP forwarding on the NVA network interface and ensure the NVA is in a hub subnet so return traffic takes a symmetric path. This gives precise, deterministic control of inter-spoke inspection and is the standard hub-spoke design pattern.

Why this answer

User-defined routes (UDRs) allow you to explicitly override Azure's default system routes. By adding a route in each spoke subnet with the hub NVA's private IP as the next hop for inter-spoke traffic (e.g., 10.1.0.0/16 -> 10.0.0.4), all traffic between spokes is forced through the NVA for inspection. This ensures the hub-spoke topology meets the requirement without relying on Azure Firewall or Internet routing.

Exam trap

The trap here is that candidates often confuse VNet peering's built-in transitive routing (which is disabled by default) with the ability to force traffic through an NVA, mistakenly thinking peering alone or gateway transit can achieve the required inspection without explicit UDRs.

How to eliminate wrong answers

Option A is wrong because a 0.0.0.0/0 route to the Internet would send all outbound traffic to the Internet, not through the hub NVA, and would not route inter-spoke traffic correctly. Option B is wrong because Azure Firewall with forced tunneling to on-premises would route traffic to on-premises, not through the hub NVA, and does not satisfy the requirement for inter-spoke inspection within Azure. Option D is wrong because VNet peering with gateway transit enables spokes to use a VPN gateway in the hub, but it does not force inter-spoke traffic through an NVA; it only provides transitive routing via the gateway, not custom inspection.

Full explanation →

173

MCQmedium

A company has an on-premises application running on physical servers with various operating systems. They want to use Azure as a disaster recovery site with an RPO of less than 1 hour and an RTO of less than 4 hours. They need to replicate the servers to Azure and support failover and failback. Which Azure service should they use?

A.Azure Site Recovery

B.Azure Backup (MARS agent)

C.Azure Migrate

D.Azure File Sync

AnswerA

Azure Site Recovery (ASR) replicates physical servers to Azure using the Mobility service, which continuously writes data to a cache storage account and then to Azure-managed disks, achieving RPO as low as 30 seconds. It supports both crash-consistent and app-consistent snapshots for Windows and Linux, and enables orchestrated failover via recovery plans. With RTOs in hours, ASR meets the DR requirement for rapid recovery and offers failback to the original on-premises physical server or VMware VM.

Why this answer

Azure Site Recovery (ASR) orchestrates replication, failover, and failback for physical servers and VMs to Azure, meeting the RPO of <1 hour and RTO of <4 hours. It supports heterogeneous operating systems on physical servers and provides continuous replication with recovery points as low as 30 seconds, enabling both planned and unplanned failover with full failback capability.

Exam trap

The trap here is that candidates confuse Azure Backup (which provides long-term archival backups) with Azure Site Recovery (which provides near-continuous replication and orchestrated failover), failing to recognize that the RPO and RTO requirements demand a replication-based DR solution, not a backup service.

How to eliminate wrong answers

Option B (Azure Backup with MARS agent) is wrong because it is designed for file/folder and system state backup with a minimum RPO of 1 day (daily backup), not sub-hourly replication, and it does not support orchestrated failover or failback of entire servers. Option C (Azure Migrate) is wrong because it is a discovery, assessment, and migration tool, not a disaster recovery service; it does not provide ongoing replication or failover/failback capabilities. Option D (Azure File Sync) is wrong because it only syncs file shares between on-premises and Azure, not entire server workloads, and lacks failover/failback orchestration for disaster recovery.

Full explanation →

174

MCQeasy

A company is designing a virtual network architecture for a three-tier application (web, application, database). They want network isolation between tiers and secure access from the internet to the web tier only. Which Azure networking solution should they use?

A.Azure Virtual Network with subnets for each tier and Network Security Groups.

B.Azure Virtual Network with a single subnet and application security groups.

C.Azure Virtual Network with subnets and Azure Firewall.

D.Azure Virtual Network with subnets and a network virtual appliance (NVA).

AnswerA

This approach uses separate subnets for the web, application, and data tiers, establishing Layer-3 network boundaries within the virtual network. Network Security Groups (NSGs) are stateful, built-in filters that you associate with each subnet to enforce inbound and outbound rules, such as allowing internet traffic only to the web tier on ports 80/443 and permitting the web subnet to talk to the app subnet on a specific application port. Because NSGs are natively supported and incur no extra cost, this is the most efficient and standard method for isolating tiers and controlling east-west traffic without introducing additional appliances or routing complexity.

Why this answer

Deploying each tier in its own subnet within an Azure Virtual Network and applying Network Security Groups (NSGs) allows granular inbound/outbound rule enforcement. NSGs can restrict traffic so that only the web tier is reachable from the internet (via a public IP or Azure Load Balancer), while the application and database tiers are isolated from direct internet access and can only communicate with the adjacent tier as defined by NSG rules.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing Azure Firewall or an NVA for basic isolation, not realizing that NSGs with subnets are the native, cost-effective, and fully supported method for network segmentation within a single Azure VNet.

How to eliminate wrong answers

Option B is wrong because a single subnet with Application Security Groups (ASGs) still places all VMs in the same broadcast domain and does not provide network-level isolation between tiers; ASGs only group VMs logically for NSG rule application, but they do not prevent lateral traffic within the subnet without explicit NSG rules, and a single subnet cannot enforce separate routing or address spaces. Option C is wrong because Azure Firewall is a managed, stateful firewall service used for centralized inspection and logging across VNets or hybrid networks, but it is overkill and not the simplest solution for basic tier isolation within a single VNet; NSGs alone provide sufficient subnet-level filtering without the cost and complexity of a firewall. Option D is wrong because a Network Virtual Appliance (NVA) is typically used for advanced traffic inspection, routing, or security functions (e.g., third-party firewalls, WAN optimization) and is unnecessary for simple tier isolation; it adds operational overhead and cost when NSGs can achieve the same isolation with less complexity.

Full explanation →

175

MCQmedium

A company runs a file server on an Azure VM in the East US region. They want to back up the file shares to Azure and be able to restore individual files if accidentally deleted. They also need to be able to restore the entire file share to a secondary region (West US) in case of a regional disaster. The solution should automatically protect the file shares and provide versioning for up to 30 days. Which Azure service and configuration should they recommend?

A.Configure Azure Backup on the Azure file share using a Recovery Services vault with geo-redundant storage (GRS). Enable cross-region restore on the vault.

B.Use Azure File Sync to sync the file share to an on-premises server, and then back up the on-premises server using Azure Backup.

C.Enable soft delete and versioning on the storage account, and configure replication to a secondary region using RA-GRS.

D.Create a scheduled Azure Automation runbook that takes snapshots of the file share every day and copy them to a storage account in West US.

AnswerA

Azure Backup for Azure Files is the native managed backup service that takes scheduled snapshots of the file share and stores recovery points in a Recovery Services vault. By selecting GRS for the vault and enabling cross-region restore, you gain the ability to restore the entire share to the paired region (East US to West US) if a regional disaster occurs. The service also supports granular item-level restore, allows you to specify backup frequency and retention, and automatically manages the snapshot lifecycle, making it the only option here that meets both backup and DR requirements.

Why this answer

Azure Backup for Azure file shares uses a Recovery Services vault and can be configured with geo-redundant storage (GRS) to replicate backup data to a paired secondary region. Enabling cross-region restore on the vault allows restoring the entire file share to the secondary region (West US) during a regional disaster. Azure Backup automatically protects the file share with scheduled backups and provides up to 30 days of retention for point-in-time restores of individual files or the entire share.

Exam trap

The trap here is that candidates often confuse storage account replication (RA-GRS) with backup and restore capabilities, thinking that replication alone provides disaster recovery restore functionality, but it does not support point-in-time file-level restore or cross-region restore of backups without Azure Backup's cross-region restore feature.

How to eliminate wrong answers

Option B is wrong because Azure File Sync is designed for hybrid sync and tiering, not for backup; it does not provide native cross-region disaster recovery or versioning for up to 30 days, and backing up an on-premises server adds unnecessary complexity and does not directly meet the requirement to restore to a secondary Azure region. Option C is wrong because soft delete and versioning on the storage account provide protection against accidental deletion and overwrites, but they do not offer a backup solution with scheduled backups, cross-region restore capability, or the ability to restore the entire file share to a secondary region in a disaster scenario; RA-GRS replication is for storage account data redundancy, not for backup restore. Option D is wrong because a scheduled Azure Automation runbook that takes snapshots and copies them to another region is a custom, non-native solution that lacks the automated backup scheduling, versioning, and cross-region restore capabilities provided by Azure Backup; it also introduces operational overhead and does not guarantee the 30-day versioning requirement.

Full explanation →

176

MCQeasy

Your company uses Microsoft Entra ID and has recently deployed Microsoft Sentinel. You need to design a monitoring solution to detect brute-force attacks against user accounts. The solution should use built-in analytics rules where possible and must trigger an automated response to temporarily disable the affected account. What should you include in the design?

A.Use the built-in 'Brute force attack against an Entra ID account' analytics rule in Microsoft Sentinel and connect a playbook to disable the user.

B.Use Microsoft Entra Identity Protection to detect brute-force and configure a conditional access policy to block sign-ins.

C.Stream sign-in logs to Log Analytics and create a scheduled query that alerts on multiple failures, then manually disable accounts.

D.Create a custom KQL query in Microsoft Sentinel and configure an automation rule to disable the account.

AnswerA

The Microsoft Sentinel built-in analytics rule 'Brute force attack against an Entra ID account' already contains the KQL detection logic needed to identify repeated failed sign-ins and other brute-force indicators in Entra ID sign-in logs. By triggering an automation rule on the alert, you can invoke a Microsoft Sentinel playbook—an Azure Logic Apps workflow—that automatically disables the compromised user account. This provides both automated detection and automated response, satisfying the requirement to use built-in rules whenever possible.

Why this answer

Microsoft Sentinel includes a built-in analytics rule specifically for detecting brute-force attacks against Microsoft Entra ID accounts. By connecting a playbook to this rule, you can automate the response to temporarily disable the affected user account, meeting the requirement for an automated response without custom development.

Exam trap

The trap here is that candidates may confuse Microsoft Entra Identity Protection's ability to block sign-ins with the requirement to disable the user account, or they may overlook the 'use built-in analytics rules where possible' constraint and opt for a custom KQL query.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra Identity Protection detects risk events like brute-force but uses Conditional Access policies to block sign-ins, not to disable user accounts; disabling accounts requires a different mechanism. Option C is wrong because it relies on manually disabling accounts, which does not meet the requirement for an automated response. Option D is wrong because it suggests creating a custom KQL query and automation rule, but the question specifies using built-in analytics rules where possible, making a custom query unnecessary and less efficient.

Full explanation →

177

MCQeasy

A company wants to allow remote users to access an internal web application hosted on-premises without opening inbound firewall ports. They need seamless single sign-on (SSO) using Microsoft Entra ID credentials. Which Azure service should they use?

A.Microsoft Entra ID Application Proxy

B.Microsoft Entra ID B2C

C.Microsoft Entra ID Domain Services

D.Microsoft Entra ID Connect

AnswerA

Microsoft Entra ID Application Proxy is a reverse proxy that securely publishes on-premises web applications to remote users through the Microsoft Entra ID service. It uses a lightweight connector on the internal network that initiates outbound connections, eliminating the need for inbound firewall ports or VPN. This enables seamless single sign-on and integration with Conditional Access policies, making it the ideal solution for internal app access.

Why this answer

Microsoft Entra ID Application Proxy provides secure remote access to on-premises web applications without requiring inbound firewall ports. It works by establishing an outbound connection from the on-premises Application Proxy connector to the Entra ID service, then routing user traffic through that tunnel. It integrates with Entra ID for pre-authentication and supports seamless SSO using the user's existing Entra ID credentials via Kerberos constrained delegation (KCD) or header-based authentication.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID Application Proxy with a VPN or DirectAccess solution, but the key differentiator is that Application Proxy requires no inbound firewall rules and uses outbound-only connectivity, which is a common exam scenario for secure remote access.

How to eliminate wrong answers

Option B (Microsoft Entra ID B2C) is wrong because it is designed for customer-facing identity management with social or local accounts, not for providing secure remote access to internal on-premises applications. Option C (Microsoft Entra ID Domain Services) is wrong because it provides managed domain services (e.g., LDAP, Kerberos) for Azure VMs but does not offer a reverse proxy or remote access capability for on-premises apps. Option D (Microsoft Entra ID Connect) is wrong because it is a synchronization tool that syncs on-premises AD objects to Entra ID; it does not provide any application proxy or remote access functionality.

Full explanation →

178

MCQmedium

A company runs a critical application on Azure virtual machines in the West US region. They need a disaster recovery solution that replicates VMs to East US with a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 2 hours. They also need to perform non-disruptive disaster recovery drills. Which Azure service should they use?

A.Azure Backup

B.Azure Site Recovery

C.Azure Traffic Manager

D.Azure Front Door

AnswerB

Azure Site Recovery directly addresses the DR requirement by continuously replicating Azure VMs to a secondary Azure region, with a recovery point objective (RPO) as low as 15 minutes for supported disk types. It enables orchestrated failover and failback, and crucially allows test failover using isolated networks so you can validate end-to-end recovery without impacting production or incurring downtime. Recovery plans can sequence multi-tier application startup, making it the correct choice for this critical workload.

Why this answer

Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs between regions. It supports RPOs as low as 15 minutes (continuous replication with crash-consistent or app-consistent snapshots) and RTOs of 2 hours or less, and it enables non-disruptive disaster recovery drills via test failover that isolates replicated VMs in a separate virtual network without impacting production.

Exam trap

The trap here is that candidates confuse Azure Backup (which is for backup/restore with longer RPOs) with Azure Site Recovery (which is for replication and failover with low RPO/RTO), or they mistakenly think a traffic-routing service like Traffic Manager or Front Door can provide disaster recovery replication without actually moving or copying VM data.

How to eliminate wrong answers

Option A is wrong because Azure Backup is designed for long-term retention and point-in-time restore of VM data (typically with a minimum RPO of 1 hour for disk snapshots), not for continuous replication with sub-15-minute RPO or orchestrated failover with a 2-hour RTO; it also does not support non-disruptive drills. Option C is wrong because Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming traffic to healthy endpoints, but it does not replicate VM data or provide any disaster recovery replication, RPO/RTO guarantees, or drill capabilities. Option D is wrong because Azure Front Door is a global application delivery network with HTTP/S load balancing and acceleration, but it does not handle VM-level replication, failover orchestration, or recovery point objectives; it only redirects traffic based on backend health.

Full explanation →

179

MCQhard

A global company is deploying a microservices application on AKS clusters in multiple Azure regions. They need to provide a single endpoint for users worldwide with SSL offloading, web application firewall, and URL path-based routing to the nearest healthy AKS cluster. They also need global load balancing with automatic failover. Which Azure service should they use?

A.Azure Front Door

B.Azure Application Gateway

C.Azure Traffic Manager

D.Azure Load Balancer

AnswerA

Azure Front Door is a global application delivery controller that operates at Layer 7, using Anycast to terminate connections at the nearest point of presence. It directly satisfies the multi-region AKS requirement by performing SSL offloading, applying a web application firewall, and routing requests to different AKS clusters based on URL paths. Its global health probes and failover are distinct from DNS-based or regional approaches, making it the only listed service that can steer user traffic across the globe while preserving HTTP semantics.

Why this answer

Azure Front Door is the correct choice because it provides global HTTP/HTTPS load balancing with SSL offloading, web application firewall (WAF) integration, and URL path-based routing. It uses Anycast-based routing to direct users to the nearest healthy AKS cluster, ensuring low latency and automatic failover across regions.

Exam trap

The trap here is that candidates often confuse Azure Front Door with Azure Traffic Manager, but Traffic Manager only provides DNS-level routing without application-layer features like SSL offloading, WAF, or path-based routing.

How to eliminate wrong answers

Option B is wrong because Azure Application Gateway is a regional load balancer that operates within a single Azure region and cannot provide global load balancing or cross-region failover. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic router that does not support SSL offloading, WAF, or URL path-based routing at the application layer. Option D is wrong because Azure Load Balancer is a Layer 4 (TCP/UDP) load balancer that operates regionally and lacks application-layer features like SSL termination, WAF, and path-based routing.

Full explanation →

180

MCQmedium

A company manages a fleet of millions of IoT devices that send telemetry data every minute. The data must be stored for 10 years to meet compliance requirements. For the first 30 days, data is accessed frequently for real-time dashboards and alerting. After 30 days, data is only accessed occasionally for historical analysis and reporting. The solution must be cost-effective and support high ingestion rates. Which Azure service should the company use to store and query this data?

A.Azure Blob Storage with Azure Data Lake Storage Gen2

B.Azure Data Explorer

C.Azure SQL Database

D.Azure Cosmos DB with SQL API

AnswerB

Azure Data Explorer is the only service here built specifically for high-fidelity time-series analytics: its columnar engine ingests millions of events per second, automatically creates inverted indexes, and uses a hot/cold cache with data tiering to balance performance and cost. KQL natively supports time-based operations such as bin(), summarize, anomaly detection, and lag/lead calculations, which can run on both streaming and historical data. This makes it the appropriate choice for a fleet of millions of devices where real-time visibility and long-term retention are required.

Why this answer

Azure Data Explorer (ADX) is designed for high-ingestion, time-series telemetry data and supports real-time dashboards and alerting on fresh data, while also providing cost-effective long-term storage for historical queries. Its columnar storage and indexing enable fast analytics on billions of records, making it ideal for IoT scenarios with millions of devices sending data every minute and a 10-year retention requirement.

Exam trap

The trap here is that candidates often choose Azure Blob Storage or Cosmos DB because they associate them with 'storage' or 'IoT,' but they fail to recognize that Azure Data Explorer is the only service purpose-built for high-velocity time-series analytics with built-in hot/cold tiering and native support for real-time alerting and long-term retention at scale.

How to eliminate wrong answers

Option A is wrong because Azure Blob Storage with Azure Data Lake Storage Gen2 is optimized for batch analytics and large file storage, not for real-time querying and alerting on high-velocity telemetry data; it lacks native time-series indexing and low-latency query capabilities. Option C is wrong because Azure SQL Database is a relational OLTP system that cannot cost-effectively handle the ingestion rate of millions of events per minute or the 10-year retention of massive telemetry volumes without significant performance degradation and high costs. Option D is wrong because Azure Cosmos DB with SQL API is a globally distributed NoSQL database designed for low-latency reads/writes on operational data, but it is not optimized for high-throughput time-series ingestion and analytical queries over long retention periods, and its cost would be prohibitive for storing billions of telemetry records for 10 years.

Full explanation →

181

MCQeasy

A company needs to implement a hybrid identity solution that allows users to access both on-premises applications and Microsoft 365 using a single identity. The company has on-premises Active Directory Domain Services (AD DS). They want to synchronize identities to the cloud while also enabling password writeback for self-service password reset. Which Azure service should they use?

A.Microsoft Entra ID

B.Microsoft Entra Connect Health

C.Microsoft Entra Connect

D.Microsoft Entra Domain Services

AnswerC

Microsoft Entra Connect is the correct on-premises synchronization tool that bridges on-premises Active Directory and Microsoft Entra ID, performing password hash sync, pass-through authentication, and, when properly configured with the required Microsoft Entra ID Premium license, password writeback. When a user resets a password in the cloud, Entra Connect receives that reset securely, encrypts it, and updates the on-premises AD password, ensuring the new credential works immediately for both on-premises and cloud authentication.

Why this answer

Microsoft Entra Connect (formerly Azure AD Connect) is the correct tool for synchronizing on-premises AD DS identities to Microsoft Entra ID while enabling password writeback for self-service password reset (SSPR). It supports the required hybrid identity scenarios, including password hash synchronization or pass-through authentication, and can be configured to write passwords back to on-premises AD DS via the SSPR writeback feature.

Exam trap

The trap here is that candidates often confuse Microsoft Entra Connect (the sync tool) with Microsoft Entra ID (the cloud directory) or Microsoft Entra Domain Services (a managed domain service), leading them to select the wrong service for hybrid identity synchronization and password writeback.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID is the cloud-based identity and access management service itself, not the synchronization tool; it does not directly perform identity sync or password writeback. Option B is wrong because Microsoft Entra Connect Health provides monitoring and diagnostics for the sync infrastructure but does not perform identity synchronization or password writeback. Option D is wrong because Microsoft Entra Domain Services provides managed domain services (e.g., LDAP, Kerberos) for cloud VMs, not identity synchronization or password writeback to on-premises AD DS.

Full explanation →

182

MCQmedium

A company wants to deploy a web application on Azure virtual machines (VMs). The application experiences variable traffic patterns, so the company needs to automatically add or remove VM instances based on CPU utilization. They also want the application to remain highly available even if an Azure datacenter fails. Which combination of Azure services should they use?

A.Virtual Machine Scale Sets configured with autoscale rules based on CPU and distributed across availability zones

B.Azure App Service with autoscale rules and deployment slots

C.Azure Load Balancer with a backend pool of VMs and autoscale rules applied to individual VMSS

D.Azure Traffic Manager with endpoints in separate regions and Manual scaling of VMs

AnswerA

Virtual Machine Scale Sets are the only compute option listed that runs your workload on IaaS VMs while natively supporting horizontal autoscale: you define a scale condition (e.g., scale out by one instance when CPU percentage exceeds 75%, scale in when below 25%) and Azure applies it to the entire set. Deploying the VMSS across multiple availability zones places instance replicas in physically separate datacenters within the region, so a zone outage does not take down the entire web tier. This combination directly satisfies both the CPU-based automatic scaling and the zone-failure protection requirement.

Why this answer

Virtual Machine Scale Sets (VMSS) with autoscale rules based on CPU utilization automatically add or remove VM instances to match variable traffic patterns. Distributing the VMSS across availability zones ensures the application remains highly available even if an entire Azure datacenter fails, because availability zones are physically separate datacenters within a region.

Exam trap

The trap here is that candidates often confuse Azure App Service (PaaS) with IaaS VM solutions, or assume that a load balancer alone can handle autoscaling, when in fact autoscale rules must be configured directly on the VMSS resource.

How to eliminate wrong answers

Option B is wrong because Azure App Service is a Platform-as-a-Service (PaaS) offering, not a VM-based solution, and the question explicitly requires deployment on Azure virtual machines. Option C is wrong because Azure Load Balancer distributes traffic but does not itself perform autoscaling; autoscale rules must be applied directly to the VMSS, not to individual VMs, and the phrase 'applied to individual VMSS' is redundant and misstates the architecture. Option D is wrong because Traffic Manager provides global DNS-based traffic routing across regions, but manual scaling of VMs does not meet the requirement for automatic scaling based on CPU utilization.

Full explanation →

183

MCQeasy

A company has multiple branch offices and needs to connect them to Azure and to each other using a scalable, managed solution that simplifies network architecture. The solution should support automatic routing and integration with ExpressRoute and VPN. Which Azure service should they use?

A.Azure Virtual Network

B.Azure Virtual WAN

C.Azure ExpressRoute

D.Azure VPN Gateway

AnswerB

Azure Virtual WAN is a managed networking service that creates a hub-and-spoke architecture with integrated routing, automatically interconnecting branches, Azure VNets, and on-premises locations. It natively supports Site-to-Site VPN, Point-to-Site VPN, and ExpressRoute, and it performs automatic route table generation and propagation across all spokes. Virtual WAN also enables branch-to-branch connectivity without manual peering, making it the only option here that delivers a scalable, zero-touch global transit network.

Why this answer

Azure Virtual WAN is a managed networking service that aggregates branch, VPN, and ExpressRoute connectivity into a single hub-and-spoke architecture. It automatically handles routing between branches and Azure, supports any-to-any connectivity, and integrates natively with ExpressRoute and VPN gateways, making it the correct choice for a scalable, managed solution that simplifies network architecture.

Exam trap

The trap here is that candidates often confuse Azure Virtual WAN with Azure Virtual Network, thinking that a simple VNet with VPN gateways can scale to interconnect multiple branches, but they overlook the managed, automatic routing and aggregation capabilities that Virtual WAN provides for multi-site topologies.

How to eliminate wrong answers

Option A is wrong because Azure Virtual Network is a fundamental building block for creating isolated networks in Azure, but it does not provide managed, automatic routing between multiple branch offices or native integration with ExpressRoute and VPN at scale; it requires manual configuration of peering, gateways, and routing. Option C is wrong because Azure ExpressRoute is a dedicated private connection from on-premises to Azure, but it does not connect multiple branch offices to each other or provide automatic routing between them; it is a connectivity option, not a managed WAN service. Option D is wrong because Azure VPN Gateway provides site-to-site VPN connectivity from a single branch to Azure, but it does not offer a managed, scalable hub for interconnecting multiple branches or automatic routing between them; it requires additional configuration and does not aggregate multiple connections into a single managed topology.

Full explanation →

184

Multi-Selectmedium

Which TWO actions should you take to implement a least-privilege identity strategy for Azure resources?

Select 2 answers

A.Assign Global Administrator role to all cloud architects

B.Store service principal passwords in Azure Key Vault and retrieve at runtime

C.Enable self-service password reset for all users

D.Use managed identities for Azure resources instead of service principals

E.Use Privileged Identity Management (PIM) to activate roles just-in-time

AnswersD, E

Managed identities remove the need to manage secrets.

Why this answer

Managed identities for Azure resources eliminate the need to store and manage credentials. Azure automatically rotates the identity's principal in Azure AD, and the resource can obtain an access token directly from the Azure Instance Metadata Service (IMDS) endpoint without any secrets. This aligns with the least-privilege principle by removing static, long-lived credentials and reducing the attack surface.

Exam trap

The trap here is that candidates often confuse storing secrets securely (Option B) with eliminating secrets entirely (Option D), or they overlook that PIM (Option E) is a core least-privilege tool for role activation, not just a monitoring feature.

Full explanation →

185

MCQmedium

A company stores log data in Azure Blob Storage. The logs are accessed frequently for the first 30 days, then only occasionally for up to 1 year, and after that must be retained for 7 years for compliance purposes. The company wants to minimize storage costs by automatically moving data to cheaper tiers. Which Azure Blob Storage lifecycle management policy should they implement?

A.Move to Cool tier after 30 days, move to Archive tier after 365 days, delete after 2555 days

B.Move to Cool tier after 30 days, move to Archive tier after 365 days, delete after 7 years

C.Move to Cool tier after 30 days, move to Archive tier after 30 days, delete after 2555 days

D.Move to Archive tier after 30 days, keep in Archive until deletion after 2555 days

AnswerA

This policy correctly matches the log usage lifecycle: for the first 30 days data remains Hot for frequent queries; from day 30 to day 365 it is moved to Cool because access becomes occasional but still needed; after 365 days it is moved to Archive for long-term compliance while deletion occurs after 2555 days (exactly 7 years). That transition sequence minimizes cost: Hot for active use, Cool for sporadic retrieval with no rehydration fee, and Archive for rarely accessed records, with deletion eliminating any further storage charges. The rule uses numeric day values as Azure requires.

Why this answer

It aligns with the access patterns: move to Cool tier after 30 days (frequent access period), move to Archive tier after 365 days (occasional access period ends), and delete after 2555 days (7 years retention). This minimizes costs by transitioning data to progressively cheaper storage tiers and automatically deleting it when compliance retention expires.

Exam trap

The trap here is that candidates may choose Option B thinking '7 years' is acceptable in the policy, but Azure requires the 'delete after' action to be specified in days (2555), not years, and they may overlook the early deletion penalty of the Archive tier when moving data too soon.

How to eliminate wrong answers

Option B is wrong because it specifies 'delete after 7 years' without converting to days; Azure lifecycle management policies require the 'delete after' action to be defined in days, not years, and 7 years equals 2555 days, not a literal '7 years' string. Option C is wrong because it moves data to Archive tier after only 30 days, which would incur early deletion fees and retrieval costs since logs are still accessed occasionally for up to a year; Archive tier is for rarely accessed data and has a 180-day minimum storage charge. Option D is wrong because it moves data directly to Archive tier after 30 days, ignoring the Cool tier entirely, which increases costs due to early deletion penalties and higher retrieval costs for the occasional access period up to 365 days.

Full explanation →

186

MCQeasy

A company needs a fully managed NoSQL database for a new application with a key-value and document data model. They require single-digit millisecond latency at any scale, multi-region writes with automatic conflict resolution, and a serverless capacity option to handle unpredictable traffic. Which Azure data service should they use?

A.Azure Table Storage

B.Azure Cosmos DB

C.Azure Cache for Redis

D.Azure SQL Database

AnswerB

Azure Cosmos DB is the correct choice because it is a fully managed, multi-model NoSQL database that guarantees single-digit millisecond latency for reads and writes at the 99th percentile. Its multi-region writes capability lets you write to any region with automatic conflict resolution policies and a health-based failover, while the serverless mode adds throughput and storage per request, making it ideal for spiky or unpredictable workloads.

Why this answer

Azure Cosmos DB is the correct choice because it is a fully managed NoSQL database that supports both key-value and document data models natively. It guarantees single-digit millisecond latency at any scale, offers multi-region writes with automatic conflict resolution via its multi-master replication, and provides a serverless capacity mode that automatically scales based on demand, making it ideal for unpredictable traffic.

Exam trap

The trap here is that candidates often confuse Azure Table Storage as a NoSQL database that supports multi-region writes, but it lacks document support and automatic conflict resolution, making Cosmos DB the only option that meets all requirements.

How to eliminate wrong answers

Option A is wrong because Azure Table Storage is a key-value store but does not support a document data model, lacks multi-region writes with automatic conflict resolution, and does not offer a serverless capacity option (it uses provisioned throughput). Option C is wrong because Azure Cache for Redis is an in-memory caching service, not a fully managed NoSQL database; it does not natively support document data models or multi-region writes with conflict resolution. Option D is wrong because Azure SQL Database is a relational database (SQL-based), not a NoSQL database, and does not support key-value or document data models natively, nor does it offer multi-region writes with automatic conflict resolution.

Full explanation →

187

Multi-Selectmedium

You are designing an identity lifecycle management solution for a multinational company. Employees frequently change departments, and you need to automate the assignment and removal of application access based on their current department. Which THREE Microsoft Entra features should you use?

Select 3 answers

A.Dynamic membership groups

B.Microsoft Entra Privileged Identity Management

C.Microsoft Entra access reviews

D.Microsoft Entra entitlement management

E.Microsoft Entra self-service password reset

AnswersA, C, D

Dynamic membership groups in Microsoft Entra ID automatically add and remove user accounts based on rule expressions evaluated against attributes like department, jobTitle, or country. Because membership is recalculated whenever an attribute changes or a user signs in, access to the group's linked applications is granted or revoked immediately without manual intervention. For an identity lifecycle solution centered on automating access based on organizational attributes, dynamic groups are the most direct choice.

Why this answer

Dynamic membership groups (A) are correct because they automatically add or remove users based on attribute values like 'department'. When an employee changes departments, their department attribute is updated, and the group membership is recalculated, granting or revoking access to applications assigned to that group. This is the core mechanism for automating access changes based on user attributes.

Exam trap

The trap here is confusing Privileged Identity Management (PIM) with lifecycle management—PIM handles temporary elevation for admin roles, not the ongoing assignment of application access based on user attribute changes.

Full explanation →

188

MCQmedium

Your company runs a Windows-based application on Azure Virtual Machines in the Brazil South region. The application uses Azure Files for shared storage and Azure SQL Database (Hyperscale tier) for the database. The business requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 30 minutes for the entire application. The solution must be cost-effective and leverage Azure-native services. You have been asked to design the disaster recovery strategy. Which option should you recommend?

A.Use Azure Site Recovery to replicate the VMs to a secondary region. Configure geo-redundant storage (GRS) for Azure Files. For Azure SQL Database Hyperscale, enable geo-restore and test restore procedures.

B.Deploy a second set of VMs in a secondary region. Use Azure File Sync to keep Azure Files in sync. Use Azure SQL Database failover groups with a readable secondary.

C.Back up the VMs using Azure Backup with a 15-minute frequency. Use Azure File Sync to replicate Azure Files to a secondary region. Use Azure SQL Database backup with point-in-time restore.

D.Use Azure Site Recovery for VMs. Use Azure File Sync for Azure Files. Use active geo-replication for Azure SQL Database.

AnswerA

Azure Site Recovery is the correct DR service for Azure VMs because it replicates disks to a secondary region asynchronously, delivering an RPO of as little as 5 minutes (well under the 15-minute requirement) and a recoverable RTO of minutes through failover. For Azure Files, GRS replicates file share data to a paired region asynchronously with an RPO of typically less than 15 minutes, and on failover you can access the secondary endpoint. For Azure SQL Database Hyperscale, geo-restore restores the database from geo-redundant backups to the secondary region; though its RPO is typically up to 1 hour, the requirement is met because you explicitly enable and test the restore procedure, and Hyperscale does not support failover groups, making geo-restore the documented DR pattern. This combination uses native, cost-effective services rather than running duplicate infrastructure and aligns with the stated 15-minute RPO for VMs and Files.

Why this answer

Azure Site Recovery provides VM replication with RPOs as low as 15 minutes and RTOs of minutes, meeting the 15-minute RPO and 30-minute RTO. Geo-redundant storage (GRS) for Azure Files ensures data is replicated to a paired secondary region with an RPO of 15 minutes (typically), and Azure SQL Database Hyperscale’s geo-restore allows restoring from geo-replicated backups, which can achieve the required RPO/RTO when tested and automated. This combination is cost-effective as it uses native Azure services without requiring a pre-provisioned secondary environment.

Exam trap

The trap here is that candidates may assume active geo-replication or failover groups are always available for Azure SQL Database, but the Hyperscale tier does not support these features, requiring geo-restore instead.

How to eliminate wrong answers

Option B is wrong because deploying a second set of VMs in a secondary region incurs ongoing compute costs, which is not cost-effective, and Azure File Sync does not provide the 15-minute RPO for Azure Files (sync intervals are configurable but typically longer). Option C is wrong because Azure Backup with a 15-minute frequency is not supported for Azure VMs (minimum frequency is 4 hours for application-consistent backups), and point-in-time restore for Azure SQL Database does not meet the 15-minute RPO for cross-region DR. Option D is wrong because active geo-replication for Azure SQL Database is not available for the Hyperscale tier; Hyperscale uses named replicas and geo-restore instead of failover groups or active geo-replication.

Full explanation →

189

MCQmedium

A media company stores large video files that are accessed once a month for audits. When needed, they must be available for download immediately (within seconds). The company wants to minimize storage costs. Which Azure Blob Storage access tier should they use?

A.Hot tier

B.Cool tier

C.Cold tier

D.Archive tier

AnswerB

Cool tier offers a low per-GB storage price with a modest per-GB retrieval fee and a 30-day minimum retention period, which aligns perfectly with monthly access. Retrieval is immediate because objects remain in the online tier, so the media company can read or stream the video without waiting for rehydration. For large files read once per month, Cool delivers the lowest total cost among tiers that still provide on-demand access, making it the correct choice.

Why this answer

The Cool tier is optimal for this scenario because it balances low storage cost with high availability and low latency access. Video files accessed once a month for audits require immediate download (within seconds), which Cool tier supports with the same millisecond latency as Hot tier, but at a lower storage price. Archive tier would introduce a multi-hour rehydration delay, making it unsuitable for on-demand access within seconds.

Exam trap

The trap here is that candidates often choose Archive tier for infrequent access without realizing that the multi-hour rehydration latency makes it impossible to meet the 'within seconds' availability requirement, or they choose Hot tier out of habit for any access speed requirement, ignoring the cost-minimization goal.

How to eliminate wrong answers

Option A (Hot tier) is wrong because it has the highest storage cost, which contradicts the goal of minimizing storage costs for infrequently accessed data. Option C (Cold tier) is wrong because although it offers lower storage cost than Cool, it has a higher minimum storage duration (90 days vs 30 days) and a higher early deletion fee, making it more expensive for data accessed only once a month. Option D (Archive tier) is wrong because it requires a rehydration process that takes up to 15 hours, making it impossible to provide download within seconds on demand.

Full explanation →

190

MCQhard

Contoso Ltd. runs a mission-critical application on Azure Virtual Machines in the East US region. The application uses Azure SQL Database (Business Critical tier) and stores files in Azure Blob Storage (hot tier). The business requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 5 minutes for the application. For SQL Database, they need the ability to fail over to a secondary region with no data loss. For Blob Storage, they need to maintain read access to data even if the primary region fails. The solution must be cost-optimized and not exceed the RTO/RPO. Which combination of services should you recommend?

A.Configure Azure SQL Database failover groups with automatic failover, and use geo-redundant storage (GRS) for Blob Storage.

B.Deploy Azure Site Recovery for VMs, configure Azure SQL Database failover groups, and use geo-zone-redundant storage (GZRS) for Blob Storage.

C.Configure Azure SQL Database geo-restore for the database, and use zone-redundant storage (ZRS) for Blob Storage.

D.Configure Azure SQL Database active geo-replication with a secondary in a paired region, and use read-access geo-redundant storage (RA-GRS) for Blob Storage.

AnswerD

Active geo-replication provides synchronous replication for zero data loss, and RA-GRS allows read access during a regional outage, meeting RTO/RPO.

Why this answer

Active geo-replication for Azure SQL Database supports an RPO of 5 minutes with no data loss during failover to a secondary paired region, meeting the business-critical requirement. Read-access geo-redundant storage (RA-GRS) provides read access to data in the secondary region even if the primary fails, satisfying the Blob Storage requirement. This combination is cost-optimized as it avoids unnecessary services like Site Recovery for VMs, which are not required for the stated RTO/RPO.

Exam trap

The trap here is that candidates often confuse geo-redundant storage (GRS) with read-access geo-redundant storage (RA-GRS), assuming GRS provides read access during a failure, when in fact it only allows a write failover that requires a manual process and does not maintain continuous read access.

How to eliminate wrong answers

Option A is wrong because geo-redundant storage (GRS) does not provide read access to the secondary region during a primary failure; it only allows failover for write access, failing the requirement to maintain read access. Option B is wrong because Azure Site Recovery for VMs is unnecessary overhead; the application's RTO of 15 minutes and RPO of 5 minutes can be met without it, and geo-zone-redundant storage (GZRS) does not guarantee read access during a regional failure (it requires a manual failover). Option C is wrong because geo-restore for Azure SQL Database has an RPO of up to 1 hour (not 5 minutes) and does not support automatic failover with no data loss, and zone-redundant storage (ZRS) only protects within a single region, not against a full regional failure.

Full explanation →

191

MCQmedium

A company runs a SQL Server database on an Azure VM in West Europe. They need to back up the database daily and retain backups for 7 years for compliance. They also require the ability to restore the database to a secondary Azure region (North Europe) if the primary region fails. They want to minimize operational overhead and costs. Which Azure Backup configuration should they use?

A.A

B.B

C.C

D.D

AnswerA

Azure Backup for SQL Server in an Azure VM securely stores full, differential, and transaction log backups in a Recovery Services vault. You can configure the vault in West Europe as the primary region and enable the Cross-Region Restore (CRR) feature, which replicates the backup data to the paired North Europe region using geo-redundant storage (GRS). This design provides automated SQL-aware backup management, point-in-time restore capability, and the ability to restore databases in North Europe without deploying any additional backup infrastructure or vaults, making it the optimized, cost-effective approach.

Why this answer

Azure Backup's built-in cross-region restore (CRR) for Azure VMs allows you to restore SQL Server databases hosted on Azure VMs to a paired secondary region (North Europe) in the event of a disaster, while retaining backups for up to 10 years (covering the 7-year compliance requirement). This configuration minimizes operational overhead by using Azure Backup's native policy-based scheduling and storage management, and it is cost-effective as it uses geo-redundant storage (GRS) for the Recovery Services vault without needing a separate backup infrastructure.

Exam trap

The trap here is that candidates often confuse Azure Site Recovery (ASR) with Azure Backup, thinking ASR can handle long-term backup retention, when in fact ASR is for replication and failover, not for point-in-time restores with multi-year retention, and they may overlook the need to explicitly enable cross-region restore (CRR) on the Recovery Services vault to meet the secondary region recovery requirement.

How to eliminate wrong answers

Option B is wrong because it suggests using Azure Site Recovery (ASR) for database backup, but ASR is designed for replication and failover of entire VMs, not for point-in-time database restore with long-term retention; it also incurs higher costs for continuous replication and does not natively support 7-year backup retention. Option C is wrong because it proposes backing up the SQL Server database to Azure Blob Storage using manual scripts or third-party tools, which increases operational overhead and does not integrate with Azure Backup's native cross-region restore or long-term retention policies. Option D is wrong because it recommends using Azure Backup for SQL Server on Azure VM but without enabling cross-region restore (CRR), which means backups are stored only in the primary region (West Europe) and cannot be restored to North Europe if the primary region fails, failing the disaster recovery requirement.

Full explanation →

192

MCQeasy

A company runs a critical Azure SQL Database in the West US region. They need a disaster recovery solution that automatically fails over to a secondary region (East US) with a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of less than 1 hour. Additionally, they want to offload read-only workloads to the secondary database during normal operations. Which Azure SQL Database feature should they enable?

A.Active geo-replication with failover groups

B.Point-in-time restore

C.Long-term backup retention

D.Always On availability groups (self-managed)

AnswerA

Failover groups provide automatic failover to a readable secondary database. Active geo-replication synchronizes data with an RPO of 5 seconds and supports readable secondaries. The failover group ensures automatic failover with an RTO of typically less than 1 hour.

Why this answer

Active geo-replication with failover groups is the correct choice because it provides automatic, asynchronous replication of an Azure SQL Database to a secondary region (East US) with an RPO of up to 5 seconds and an RTO of less than 1 hour. Additionally, it supports readable secondary replicas, allowing read-only workloads to be offloaded to the secondary database during normal operations, meeting all stated requirements.

Exam trap

The trap here is that candidates often confuse active geo-replication with failover groups (which supports readable secondaries and automatic failover) with standard active geo-replication (which requires manual failover and does not provide a single endpoint), or they mistakenly think Always On availability groups applies to Azure SQL Database instead of SQL Server on VMs.

How to eliminate wrong answers

Option B is wrong because point-in-time restore (PITR) only recovers the database to a specific point in time within the same region (retention up to 35 days) and does not provide cross-region failover or a readable secondary for offloading read workloads. Option C is wrong because long-term backup retention (LTR) stores backups for up to 10 years for compliance, but it does not enable automatic failover to a secondary region or support readable secondaries for read offloading. Option D is wrong because Always On availability groups (self-managed) is a feature for SQL Server on Azure Virtual Machines, not for Azure SQL Database managed service, and it requires manual configuration and management, not automatic failover with the specified RPO/RTO.

Full explanation →

193

MCQmedium

A company wants to deploy containerized microservices on Azure without managing virtual machines. The solution must support automatic scaling based on demand, built-in load balancing, rolling updates for zero-downtime deployments, and a fully managed platform. Which Azure compute service should they choose?

A.Azure Container Apps

B.Azure Container Instances

C.Azure Batch

D.Azure Functions

AnswerA

Azure Container Apps is a serverless platform for running containers. It provides automatic scaling based on HTTP traffic or events, built-in load balancing, and supports rolling updates via revisions. It abstracts away underlying infrastructure, so no VMs to manage.

Why this answer

Azure Container Apps is the correct choice because it provides a fully managed, serverless platform for running containerized microservices without managing virtual machines. It supports automatic scaling based on HTTP traffic or events, built-in load balancing via Envoy, and rolling updates with revision management to ensure zero-downtime deployments. This aligns perfectly with the requirement for a fully managed platform that abstracts away infrastructure.

Exam trap

The trap here is that candidates often confuse Azure Container Instances (ACI) with a managed orchestration solution, but ACI lacks the automatic scaling, load balancing, and rolling update capabilities that Container Apps provides for microservices.

How to eliminate wrong answers

Option B (Azure Container Instances) is wrong because it is designed for running individual containers on demand without built-in orchestration, automatic scaling, or rolling update capabilities—it lacks the microservice management features required. Option C (Azure Batch) is wrong because it is a job-scheduling service for high-performance computing (HPC) and parallel workloads, not for deploying containerized microservices with load balancing and rolling updates. Option D (Azure Functions) is wrong because it is a serverless compute service for event-driven code (functions), not for running containerized microservices; it does not support container orchestration or rolling updates for containers.

Full explanation →

194

MCQeasy

A company is deploying a web application that must be accessible from the internet. The application is hosted on Azure virtual machines in a virtual network. The solution must provide SSL termination, web application firewall (WAF) protection, and URL path-based routing (e.g., /api/* to one backend pool, /app/* to another). The web tier must not be directly exposed to the internet. Which Azure load balancing solution should they use?

A.Azure Application Gateway v2

B.Azure Front Door

C.Azure Load Balancer

D.Azure Traffic Manager

AnswerA

Azure Application Gateway v2 is a regional Layer 7 reverse proxy that performs SSL termination, web application firewall (WAF) inspection, and URL path-based or multi-site routing. It can be configured with a public front-end IP and a backend pool containing VMs with only private IPs, making it ideal for protecting an internet-facing web tier. The v2 SKU adds auto-scaling and zone redundancy, with the WAF policy enforcing OWASP rule sets at the HTTP edge.

Why this answer

Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that provides SSL termination, a web application firewall (WAF), and URL path-based routing. It can route traffic to different backend pools based on URL paths (e.g., /api/* and /app/*) while keeping the web tier isolated within the virtual network, as the gateway itself is exposed to the internet.

Exam trap

The trap here is that candidates often confuse Azure Front Door with Application Gateway, but Front Door is designed for global, multi-region scenarios and cannot provide direct VNet integration for a single-region app without exposing backend public IPs, whereas Application Gateway is the correct Layer 7 solution for a single-region VNet deployment.

How to eliminate wrong answers

Option B (Azure Front Door) is wrong because it is a global, multi-region load balancer and application delivery network that operates at the edge, not within a single virtual network; it cannot provide direct SSL termination and WAF for a single-region VNet-hosted app without exposing the backend to the internet via public endpoints. Option C (Azure Load Balancer) is wrong because it operates at Layer 4 (TCP/UDP) and cannot perform SSL termination, WAF inspection, or URL path-based routing. Option D (Azure Traffic Manager) is wrong because it is a DNS-based traffic router that only directs clients to endpoints based on DNS resolution, not a proxy that can terminate SSL, apply WAF rules, or route based on URL paths.

Full explanation →

195

MCQeasy

Refer to the exhibit. You deploy this ARM template to a resource group in the East US region. You specify the parameter storageAccountType as 'Standard_GRS'. Which of the following is true about the deployed storage account?

A.The storage account name will be 'storage' followed by a random string.

B.The storage account will be deployed in the same region as specified by the parameter.

C.The storage account is zone-redundant and replicates data across availability zones.

D.The storage account is geo-redundant and replicates data to a paired region.

AnswerD

The sku.name value Standard_GRS explicitly designates Geo-Redundant Storage. This tier writes data to three copies in the primary region and then asynchronously copies it to a Microsoft-chosen paired secondary region. Therefore, the storage account is indeed geo-redundant and replicates its contents across a regional pair, which matches the statement exactly.

Why this answer

The parameter 'storageAccountType' is set to 'Standard_GRS', which specifies geo-redundant storage (GRS). GRS replicates your data synchronously three times within a single region using LRS, then asynchronously replicates to a paired secondary region, ensuring durability even during a regional outage.

Exam trap

The trap here is that candidates confuse 'Standard_GRS' with zone-redundant storage (ZRS) or assume the parameter controls the region, when in fact the region is determined by the resource group's location and the replication type is explicitly defined by the storage account SKU.

How to eliminate wrong answers

Option A is wrong because the ARM template uses the 'uniqueString' function with the resource group ID to generate a deterministic name, not a random string; the name will be 'storage' concatenated with a unique hash. Option B is wrong because the 'location' property is set to '[resourceGroup().location]', which deploys the storage account in the same region as the resource group (East US), not as specified by the parameter. Option C is wrong because 'Standard_GRS' is geo-redundant, not zone-redundant; zone-redundant storage (ZRS) uses 'Standard_ZRS' or 'Premium_ZRS' and replicates across availability zones within a single region.

Full explanation →

196

MCQmedium

A company uses Microsoft Entra ID. They want to allow external business partners to request access to a specific internal application. The access must be time-limited and require approval from a manager within the partner's organization. Additionally, access should automatically expire after the defined period. Which Microsoft Entra ID feature should they use?

A.Microsoft Entra ID Entitlement Management

B.Microsoft Entra ID B2B Collaboration

C.Microsoft Entra ID Identity Governance

D.Microsoft Entra ID Privileged Identity Management (PIM)

AnswerA

Microsoft Entra ID Entitlement Management enables you to create access packages that external users can request. You can configure approval workflows, set time limits, and auto-expire access. It is part of Microsoft Entra ID Identity Governance.

Why this answer

Microsoft Entra ID Entitlement Management enables organizations to manage access requests for internal and external users through access packages. It supports time-limited access with automatic expiration and allows delegation of approval to a manager within the partner's organization via connected organizations. This directly meets the requirement for external partner self-service access with time-bound, approved access.

Exam trap

The trap here is that candidates often confuse Entitlement Management with B2B Collaboration, thinking B2B alone provides access control and expiration, when in fact B2B only handles identity creation and invitation, while Entitlement Management adds the governance layer for time-limited, approved access.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra ID B2B Collaboration provides the underlying invitation and redemption mechanism for external users but does not include built-in time-limited access, approval workflows, or automatic expiration; it requires additional configuration with Entitlement Management or other features. Option C is wrong because Microsoft Entra ID Identity Governance is an overarching category that includes Entitlement Management, access reviews, and lifecycle workflows, but it is not a specific feature that directly handles external partner access requests with time limits and manager approval. Option D is wrong because Microsoft Entra ID Privileged Identity Management (PIM) is designed for managing, controlling, and monitoring privileged roles within an organization, not for granting time-limited access to applications for external business partners.

Full explanation →

197

MCQeasy

A startup is building a new mobile app backend. They need a fully managed relational database service with built-in high availability, automatic backups, and built-in intelligence to optimize performance. They want to minimize administrative overhead for tasks like patching and scaling. Which Azure service should they use?

A.Azure SQL Database

B.SQL Server on Azure Virtual Machines

C.Azure Database for MySQL

D.Azure Cosmos DB

AnswerA

Azure SQL Database is the correct choice because it is a fully managed Platform-as-a-Service relational database that eliminates patching, backups, and high-availability configuration. Its built-in intelligent query optimization, automatic tuning, and geo-replication capabilities align directly with the requirement for a fully managed backend. You simply provision the logical server and database, and Azure handles infrastructure redundancy, automated backups with point-in-time restore, and a 99.99% SLA, freeing your team to focus on application development.

Why this answer

Azure SQL Database is a fully managed Platform-as-a-Service (PaaS) relational database that includes built-in high availability (99.99% SLA), automatic backups with point-in-time restore, and built-in intelligence features like automatic tuning, adaptive query processing, and intelligent insights. This minimizes administrative overhead for patching, scaling, and performance optimization, making it ideal for a startup that wants to focus on app development rather than database management.

Exam trap

The trap here is that candidates often confuse 'fully managed' with 'IaaS' or pick Azure Database for MySQL because it is also fully managed, but they overlook the specific requirement for 'built-in intelligence to optimize performance,' which is a hallmark of Azure SQL Database's automatic tuning features, not available in Azure Database for MySQL.

How to eliminate wrong answers

Option B is wrong because SQL Server on Azure Virtual Machines is an Infrastructure-as-a-Service (IaaS) offering that requires you to manage patching, backups, high availability setup (e.g., Always On Availability Groups), and scaling manually, increasing administrative overhead. Option C is wrong because Azure Database for MySQL is a fully managed relational database, but it lacks the built-in intelligence features (e.g., automatic tuning, intelligent insights) that Azure SQL Database provides, and the question specifically asks for 'built-in intelligence to optimize performance.' Option D is wrong because Azure Cosmos DB is a NoSQL database (supporting document, key-value, graph, and column-family models), not a relational database, and it does not use SQL as its primary query language (though it has a SQL API, it is not a relational database engine).

Full explanation →

198

Multi-Selectmedium

Which TWO of the following are requirements for using Azure Site Recovery to protect Azure VMs? (Choose two.)

Select 2 answers

A.VMs must use unmanaged disks

B.VMs must be using managed disks

C.VMs must be connected to a virtual network that has a VPN gateway to the target region

D.The source region must be a supported Azure region

E.VMs must be at least Standard_D2s_v3 size

AnswersB, D

Managed disks are a hard prerequisite for Azure Site Recovery of Azure IaaS VMs. ASR performs crash-consistent and app-consistent snapshots of these disks and replays them onto replica managed disks in the target region. Without managed disks, the replication engine has no supported configuration to process.

Why this answer

Azure Site Recovery for Azure VMs requires that the VMs use managed disks. Unmanaged disks are not supported because Site Recovery relies on the managed disk snapshot and replication capabilities to enable consistent, application-aware replication across regions. Managed disks also provide better performance, reliability, and integration with Azure's recovery services.

Exam trap

The trap here is that candidates often assume a VPN gateway is required for cross-region replication, but Azure Site Recovery uses the Azure internal network or public endpoints by default, and a VPN gateway is only needed if you choose private endpoint connectivity for security isolation.

Full explanation →

199

Multi-Selecteasy

Which TWO Azure services can be used to provide cross-region disaster recovery for Azure App Service web applications with a custom domain? (Select TWO.)

Select 2 answers

A.Azure DNS

B.Azure Front Door

C.Azure CDN

D.Azure Application Gateway

E.Azure Traffic Manager

AnswersB, E

Azure Front Door is a global, cloud-native entry point that uses anycast with the Microsoft global edge network to route HTTP/HTTPS traffic to the nearest healthy origin. It performs global load balancing, automatic failover, TLS termination, URL-based routing, and health probes at the application layer (L7). Its ability to monitor multiple regional backends and shift traffic instantly in response to health checks makes it a correct answer for providing cross-region resiliency.

Why this answer

Azure Front Door (B) provides global load balancing and traffic routing based on latency or priority, enabling cross-region failover for App Service web applications. It supports custom domains with TLS termination and health probes to automatically redirect traffic to a secondary region during a disaster. Azure Traffic Manager (E) also offers DNS-based traffic routing with priority or performance profiles, allowing failover to a secondary App Service instance in another region, and works with custom domains via CNAME records.

Exam trap

The trap here is that candidates often confuse Azure DNS (a domain registration and resolution service) with Traffic Manager (a DNS-based traffic routing service), or assume Azure Application Gateway can route cross-region traffic when it is strictly regional.

Full explanation →

200

MCQmedium

A company runs a critical application on Azure VMs in a single region. The application writes data to Azure SQL Database (PaaS) and Azure Blob Storage. The company needs a disaster recovery plan with an RPO of less than 5 minutes for the database and less than 15 minutes for the blob storage, and an RTO of less than 1 hour for the entire solution. What should they recommend?

A.Use Azure Site Recovery for VMs, geo-replication for Azure SQL Database, and geo-redundant storage (GRS) for Blob Storage.

B.Use Azure Backup for VMs, geo-redundant storage for SQL Database backups, and geo-redundant storage for Blob Storage.

C.Use Azure Site Recovery for VMs, active geo-replication for Azure SQL Database, and read-access geo-redundant storage (RA-GRS) for Blob Storage.

D.Use Azure Front Door with multi-region deployment of VMs and Azure Cosmos DB for the database.

AnswerC

ASR replicates VMs with minutes RPO. Active geo-replication for Azure SQL Database provides a readable secondary with RPO seconds. RA-GRS provides a readable copy in the secondary region with ~15 minute RPO, meeting the blob requirement.

Why this answer

Azure Site Recovery provides the VM replication needed to meet the RTO of under 1 hour, active geo-replication for Azure SQL Database offers a configurable RPO of as low as 5 seconds (well under the 5-minute requirement), and RA-GRS for Blob Storage provides read-access to a secondary region with an RPO typically under 15 minutes, enabling fast failover and read access during a disaster.

Exam trap

The trap here is that candidates often confuse geo-redundant storage (GRS) with read-access geo-redundant storage (RA-GRS), not realizing that GRS requires a storage account failover to access the secondary region, which can take up to an hour and thus fails the RTO requirement.

How to eliminate wrong answers

Option A is wrong because geo-redundant storage (GRS) for Blob Storage does not provide read access to the secondary region during a disaster; you must initiate a failover to read data, which can exceed the RTO of 1 hour. Option B is wrong because Azure Backup for VMs is a backup solution, not a replication solution, and cannot achieve an RTO of under 1 hour for full VM failover; additionally, geo-redundant storage for SQL Database backups does not provide the sub-5-minute RPO required, as backups are typically taken every 5–10 minutes. Option D is wrong because Azure Front Door with multi-region VMs and Cosmos DB does not address the existing Azure SQL Database and Blob Storage requirements; it changes the architecture entirely and does not meet the stated RPO/RTO for the current services.

Full explanation →

201

MCQhard

A global e-commerce company uses Azure Cosmos DB to store its product catalog. The catalog is read-heavy, with users worldwide expecting consistent reads with a 99th percentile latency under 10 ms. Writes to the catalog are performed by a central admin team in one region. The company needs to minimize write latency and cost while ensuring that users always see the same data within a single session. Which Cosmos DB configuration should the company choose?

A.Single-master write region with Strong consistency and multiple read regions

B.Multi-master write with Eventual consistency and all regions enabled for writes

C.Single-master write region with Session consistency and multiple read regions

D.Multi-master write with Strong consistency and two regions

AnswerC

Session consistency deployed with a single-master write region and multiple read regions is the optimal balance: all writes are sent to one regional endpoint, minimizing write latency and avoiding cross-region conflict resolution. The Cosmos DB SDK manages session tokens to ensure that within the same user session, reads are served from any read region yet still reflect the most recent writes performed in that session, satisfying the requirement for session consistency. This design provides low-latency reads globally for the e-commerce workload, where users access the application from various geographic regions, without the cost or complexity of multi-master writes.

Why this answer

Session consistency provides the required 'read your own writes' guarantee within a single session, which ensures users always see the same data during their session without the latency and cost penalties of Strong consistency. Single-master writes minimize write latency by directing all writes to one region (the central admin team's region), while multiple read regions allow global users to read from the nearest region with sub-10 ms latency. This configuration balances cost, performance, and consistency needs for a read-heavy catalog with centralized writes.

Exam trap

The trap here is that candidates often confuse 'strong consistency' with 'always correct' and overlook that Session consistency is sufficient for per-session guarantees, while Strong consistency adds unnecessary latency and cost for a read-heavy catalog with centralized writes.

How to eliminate wrong answers

Option A is wrong because Strong consistency with multiple read regions requires all replicas to acknowledge reads, which increases read latency and cost, and does not minimize write latency as writes must still propagate synchronously to all read regions. Option B is wrong because Multi-master writes with Eventual consistency would allow writes from any region, but the central admin team writes from one region, and eventual consistency does not guarantee that users see their own writes within a session, violating the 'same data within a single session' requirement. Option D is wrong because Multi-master writes with Strong consistency across two regions would introduce high write latency (due to synchronous replication) and increased cost, while the scenario only needs single-master writes from one admin region.

Full explanation →

202

MCQmedium

A multinational company plans to deploy a new application on Azure. The application must comply with GDPR and requires data residency in the EU. The solution should minimize latency for users in Europe and provide disaster recovery across regions. Which Azure architecture should the company implement?

A.Deploy the application in two EU regions with Azure Front Door and Azure SQL Database geo-replication.

B.Deploy the application in a single Azure region in Ireland with Azure Site Recovery for DR.

C.Deploy the application in two EU regions with Azure Traffic Manager and Azure Cosmos DB multi-region writes.

D.Deploy the application in a single EU region with Azure Site Recovery and Azure Redis Cache.

AnswerC

This option correctly satisfies both the low-latency and EU-data-residency requirements. Azure Traffic Manager performs DNS-based traffic routing to the nearest available regional endpoint, so users are directed to the closest of the two EU-deployed regions, reducing network round-trip time, while Azure Cosmos DB in multi-region write mode allows the application to write and read in either EU region with replication confined to the configured EU geography. Because Cosmos DB multi-region writes provide active-active replication with automatic failover and 99.999% availability, the solution achieves resilience across two EU regions without requiring cross-region data egress. Traffic Manager and Cosmos DB together give both geo-routing and globally distributed data plane behavior, but when all regions are within the EU, data stays inside EU boundaries.

Why this answer

It meets all requirements: deploying in two EU regions ensures data residency within the EU, Azure Traffic Manager provides low-latency routing for European users via DNS-based traffic distribution, and Azure Cosmos DB multi-region writes enable active-active disaster recovery with automatic failover and no data loss, minimizing latency for writes across regions.

Exam trap

The trap here is that candidates often confuse Azure Front Door (HTTP/HTTPS layer 7) with Azure Traffic Manager (DNS layer 4) and assume SQL Database geo-replication provides zero data loss, but Cosmos DB multi-region writes are the only option that guarantees RPO=0 for active-active DR across EU regions.

How to eliminate wrong answers

Option A is wrong because Azure SQL Database geo-replication is asynchronous, which can lead to data loss during a disaster (RPO > 0), and Azure Front Door is primarily an HTTP/HTTPS load balancer with global anycast, not optimized for DNS-based regional failover as required for disaster recovery across two EU regions. Option B is wrong because deploying in a single region violates the disaster recovery requirement; Azure Site Recovery alone cannot provide cross-region DR without a secondary region, and a single region cannot ensure low latency for all European users. Option D is wrong because a single EU region fails to meet the disaster recovery requirement, and Azure Redis Cache is an in-memory cache that does not provide data persistence or geo-replication for DR, nor does it address multi-region latency.

Full explanation →

203

MCQhard

You are designing a governance strategy for an Azure environment that includes multiple subscriptions. The security team requires that all storage accounts must have HTTPS traffic only. Any non-compliant storage account must be automatically remediated. What is the most efficient solution?

A.Create an Azure Blueprint that includes a policy initiative

B.Assign a custom RBAC role that denies creation of storage accounts without HTTPS

C.Use Azure Policy with a DeployIfNotExists effect to enable HTTPS-only traffic

D.Configure Azure Monitor alerts to notify the security team

AnswerC

Azure Policy with the DeployIfNotExists effect evaluates every existing resource against the definition and automatically triggers a remediation task to deploy the required configuration — in this case, setting the 'supportsHttpsTrafficOnly' property to true. This effect uses a managed identity to apply the change, and it can be run on-demand via a remediation task or on a schedule, ensuring all non-compliant storage accounts are brought into compliance without manual intervention. This is the only option that provides automated, continuous enforcement and correction for resources already in the subscription.

Why this answer

Azure Policy with a DeployIfNotExists effect can automatically remediate non-compliant storage accounts by enabling the 'HTTPS traffic only' property. This approach ensures continuous compliance without manual intervention, meeting the security team's requirement for automatic remediation.

Exam trap

The trap here is that candidates often confuse Azure Policy's DeployIfNotExists effect with Azure Blueprints, assuming Blueprints can also remediate, but Blueprints only enforce initial compliance and do not provide ongoing automatic remediation for existing resources.

How to eliminate wrong answers

Option A is wrong because Azure Blueprints are used to orchestrate the deployment of resource groups, policies, role assignments, and ARM templates, but they do not automatically remediate non-compliant resources after deployment; they only enforce initial compliance. Option B is wrong because a custom RBAC role that denies creation of storage accounts without HTTPS would only prevent new non-compliant accounts from being created, but it would not remediate existing non-compliant storage accounts. Option D is wrong because Azure Monitor alerts only notify the security team of non-compliance; they do not automatically remediate the issue, which is a core requirement of the question.

Full explanation →

204

MCQmedium

A company uses Microsoft Entra ID (Microsoft Entra ID) Premium P2. They need to automatically block sign-ins from anonymous IP addresses (e.g., Tor) and force users from risky sign-ins to reset their password. They want to minimize administrative effort and use built-in features. Which Microsoft Entra ID feature should they enable?

A.Microsoft Entra ID Identity Protection risk policies (sign-in risk and user risk).

B.Conditional Access policies with locations and grant controls.

C.Microsoft Entra ID Privileged Identity Management (PIM).

D.Microsoft Entra ID Access Reviews.

AnswerA

Identity Protection includes built-in policies that automatically detect sign-in risks (including anonymous IP addresses) and user risks (e.g., leaked credentials). The sign-in risk policy can block the sign-in, and the user risk policy can require a password reset. This minimizes manual configuration.

Why this answer

Microsoft Entra ID Identity Protection provides built-in risk policies that automatically detect and block sign-ins from anonymous IP addresses (e.g., Tor) via the sign-in risk policy, and force password reset for users flagged with high user risk via the user risk policy. These policies operate without manual intervention, minimizing administrative effort while leveraging Premium P2 capabilities.

Exam trap

The trap here is that candidates often confuse Conditional Access policies with Identity Protection risk policies, assuming that location-based blocking can replace dynamic risk detection, but Conditional Access lacks the built-in anonymous IP detection and automated password reset triggers that Identity Protection provides.

How to eliminate wrong answers

Option B is wrong because Conditional Access policies with locations and grant controls can block IP ranges or require MFA, but they cannot natively detect anonymous IP addresses like Tor or automatically trigger password resets based on risk; they rely on static location definitions rather than dynamic risk signals. Option C is wrong because Privileged Identity Management (PIM) manages just-in-time privileged role activation and access reviews, not sign-in risk detection or password reset enforcement. Option D is wrong because Access Reviews are used for periodic attestation of group memberships or role assignments, not for real-time blocking of anonymous IPs or risk-based password resets.

Full explanation →

205

MCQeasy

Your company is deploying a new application on Azure Kubernetes Service (AKS). You need to monitor the health and performance of the cluster, including container logs, metrics, and request rates. Which Azure service should you enable?

A.Azure Service Health

B.Azure Monitor for VMs

C.Azure Application Insights

D.Azure Monitor Container Insights

AnswerD

Microsoft Azure Monitor Container Insights is the purpose-built monitoring solution for Azure Kubernetes Service (AKS). It deploys a containerized Log Analytics agent to your cluster that scrapes node, pod, and container metrics (CPU, memory, disk, network), collects container stdout/stderr logs, and captures Kubernetes inventory and health status. This gives you a unified view of cluster infrastructure, plus integration with Azure Monitor alerts, workbooks, and Log Analytics queries for root-cause analysis—capabilities no other listed option provides.

Why this answer

Azure Monitor Container Insights is the correct service because it is specifically designed to monitor the health and performance of Azure Kubernetes Service (AKS) clusters. It collects container logs, metrics (such as CPU/memory usage), and request rates from the cluster via a containerized Log Analytics agent, providing visibility into the performance of workloads running on AKS.

Exam trap

The trap here is that candidates often confuse Azure Application Insights (which monitors application-level telemetry like requests and exceptions) with Container Insights (which monitors cluster-level health and container logs), leading them to choose C instead of D.

How to eliminate wrong answers

Option A is wrong because Azure Service Health provides a personalized dashboard of service issues, planned maintenance, and health advisories for Azure services, but it does not monitor the performance or logs of individual AKS clusters. Option B is wrong because Azure Monitor for VMs monitors the health and performance of virtual machines, not containerized workloads on AKS; it cannot collect container logs or request rates from Kubernetes pods. Option C is wrong because Azure Application Insights is an application performance management (APM) service for monitoring live web applications, not for collecting cluster-level metrics, container logs, or request rates from AKS infrastructure.

Full explanation →

206

MCQeasy

A company stores log data in Azure Blob Storage. Logs are accessed frequently for the first 30 days, then rarely accessed but must be retained for 7 years for compliance. They want to minimize storage costs. Which storage tier and lifecycle management rule should they use?

A.Use the Cool tier for initial storage, and a lifecycle rule to move to Archive after 30 days.

B.Use the Hot tier for initial storage, and a lifecycle rule to move to the Cool tier after 30 days, then to Archive after 7 years.

C.Use the Hot tier for initial storage, and a lifecycle rule to move to Archive after 30 days.

D.Use the Archive tier for initial storage, and a lifecycle rule to move to Hot for the first 30 days.

AnswerC

Hot tier optimizes for frequent access during the first 30 days. Moving directly to Archive after 30 days minimizes storage cost during the long retention period, as Archive has the lowest storage cost for rarely accessed data.

Why this answer

The Hot tier is optimal for frequent access during the first 30 days, and a lifecycle rule moving directly to Archive after 30 days minimizes costs by immediately transitioning to the lowest-cost storage tier for long-term retention. The Archive tier is the most cost-effective for data that is rarely accessed and must be retained for 7 years, as it offers the lowest storage cost but higher retrieval latency and cost.

Exam trap

The trap here is that candidates may overcomplicate by adding an intermediate Cool tier (Option B) or incorrectly assume Archive can be used for initial storage (Option D), failing to recognize that direct transition to Archive after the hot period is the most cost-effective for long-term retention with minimal access.

How to eliminate wrong answers

Option A is wrong because using the Cool tier for initial storage is not cost-effective for frequently accessed logs; the Hot tier has lower access costs for frequent reads/writes, making it more economical for the first 30 days. Option B is wrong because moving to Cool after 30 days and then to Archive after 7 years incurs unnecessary transition costs and storage costs in Cool for 7 years, whereas direct transition to Archive after 30 days is cheaper for long-term retention. Option D is wrong because storing data initially in the Archive tier is impractical for frequent access; Archive has high retrieval latency (up to 15 hours) and high access costs, making it unsuitable for data accessed frequently in the first 30 days.

Full explanation →

207

MCQeasy

A company plans to migrate a legacy web application to Azure. The application runs on multiple Windows virtual machines (VMs) in an availability set. The VMs must be exposed to the internet via a single endpoint that performs SSL termination and health checks. The load-balancing solution must preserve the original client IP address for logging purposes. Which Azure service should the company use?

A.Azure Load Balancer (Standard)

B.Azure Application Gateway v2

C.Azure Traffic Manager

D.Azure Front Door

AnswerB

Azure Application Gateway v2 is the appropriate choice because it is a regional layer-7 reverse proxy that terminates SSL/TLS at the gateway, offloading certificate management from the web servers. It supports cookie-based session affinity, URL-based routing, and a built-in web application firewall (WAF), while preserving the original client IP via the X-Forwarded-For request header. The v2 SKU also provides autoscaling, high availability, and a resilient static VIP, aligning well with a single-region legacy web application migration.

Why this answer

Azure Application Gateway v2 is the correct choice because it is a Layer 7 load balancer that supports SSL termination, health probes, and provides a single public endpoint. It preserves the original client IP address by inserting the X-Forwarded-For header in the HTTP request, which the backend VMs can read for logging. This meets all requirements: single internet-facing endpoint, SSL offload, health checks, and client IP preservation.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Application Gateway (Layer 7), assuming that any load balancer can terminate SSL and preserve client IP, but only Layer 7 services can inspect HTTP headers and perform SSL offload natively.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer (Standard) operates at Layer 4 (TCP/UDP) and does not support SSL termination or HTTP-level health checks; it also preserves client IP only via Direct Server Return (DSR) mode, which is not suitable for SSL termination and adds complexity. Option C is wrong because Azure Traffic Manager is a DNS-based global traffic router that does not perform SSL termination or health checks at the application layer; it only directs traffic based on DNS resolution and cannot preserve the original client IP in the HTTP headers. Option D is wrong because Azure Front Door is a global Layer 7 service that does support SSL termination and health checks, but it is designed for global distribution and CDN scenarios, not for a single regional endpoint; it also modifies the client IP by default (inserting X-Forwarded-For but also adding its own IP), which can complicate logging if only a single regional endpoint is needed.

Full explanation →

208

MCQhard

A company has a hub-spoke network topology in Azure. They have multiple spoke VNets connected to a hub VNet via peering. They need to ensure that all east-west traffic between spoke VNets goes through a network virtual appliance (NVA) in the hub for inspection. Additionally, all outbound internet traffic from spoke VMs must use a single public IP address. What should they configure?

A.Configure spoke VNets with a default route to the NVA IP, and deploy a NAT gateway in the hub for outbound traffic.

B.Configure a route table in each spoke with a route to the hub NVA for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet traffic.

C.Enable 'Allow gateway transit' on the hub VNet and 'Use remote gateways' on the spoke VNets for the NVA.

D.Configure VNet peering with 'Allow forwarded traffic' enabled, add user-defined routes in each spoke pointing to the NVA IP for inter-spoke traffic, and use Azure Firewall in the hub for outbound internet with a default route in spokes.

AnswerD

This is the correct design because the hub NVA is placed as a next-hop for inter-spoke traffic via user-defined routes (UDRs) in each spoke route table, and enabling 'Allow forwarded traffic' on the peering lets the NVA accept and route packets between the connected VNets. For outbound internet access, Azure Firewall in the hub provides centralized egress, and a default route (0.0.0.0/0) in the spoke UDRs sends internet-bound traffic to the firewall's private IP. This combination cleanly separates east-west (NVA) and north-south (firewall) traffic while meeting the requirement for a single public IP and controlled routing.

Why this answer

It combines two critical configurations: user-defined routes (UDRs) in each spoke VNet force inter-spoke traffic through the NVA in the hub by specifying the NVA's IP as the next hop, and 'Allow forwarded traffic' on the VNet peering enables the hub NVA to forward packets between spokes. For outbound internet traffic, Azure Firewall in the hub provides a single public IP, and a default route (0.0.0.0/0) in the spoke UDRs directs all internet-bound traffic to the Azure Firewall's private IP, ensuring centralized inspection and egress.

Exam trap

The trap here is that candidates often forget to enable 'Allow forwarded traffic' on the VNet peering, assuming UDRs alone are sufficient for transitive routing through an NVA, or they confuse 'Allow gateway transit' with NVA forwarding, which is a common misstep in hub-spoke design questions.

How to eliminate wrong answers

Option A is wrong because a NAT gateway in the hub does not inspect traffic; it only provides source network address translation (SNAT) for outbound connections, failing the inspection requirement. Option B is wrong because while it correctly uses Azure Firewall for outbound traffic, it omits the critical 'Allow forwarded traffic' setting on the VNet peering, without which the hub NVA cannot forward packets between spoke VNets even with UDRs in place. Option C is wrong because 'Allow gateway transit' and 'Use remote gateways' are used for VPN/ExpressRoute gateway sharing, not for routing traffic through an NVA; these settings do not force inter-spoke traffic through the NVA.

Full explanation →

209

MCQeasy

A company uses Microsoft Entra ID (Microsoft Entra ID). They want to require multi-factor authentication (MFA) for all users accessing the Azure portal, but do not want MFA to be required for other applications like Office 365. Which Microsoft Entra ID feature should they configure?

A.Microsoft Entra ID Security defaults

B.Microsoft Entra ID Conditional Access

C.Microsoft Entra ID Identity Protection

D.Microsoft Entra ID Privileged Identity Management (PIM)

AnswerB

Conditional Access lets an administrator create a policy that targets the 'Microsoft Azure Management' cloud app, which is the service principal behind the Azure portal, and applies the 'Require MFA' grant control to assigned users or groups. This scopes MFA enforcement to Azure portal sign-ins only, leaving other applications with their own separate access policies. It is the appropriate mechanism because it directly maps the exact resource (Azure portal) to the required control (MFA) while allowing granular exclusions and conditions.

Why this answer

Conditional Access in Microsoft Entra ID allows granular control over authentication requirements based on conditions such as application, user, location, or device state. By creating a Conditional Access policy targeting the Azure Portal application and requiring MFA, the company can enforce MFA specifically for Azure Portal access without affecting other applications like Office 365, which can be excluded from the policy.

Exam trap

The trap here is that candidates often confuse Security defaults (which enforces MFA broadly) with Conditional Access (which provides granular application-specific control), leading them to choose Security defaults when the question explicitly requires selective enforcement.

How to eliminate wrong answers

Option A is wrong because Security defaults enforces MFA for all users across all applications, including Office 365, which does not meet the requirement to restrict MFA only to the Azure portal. Option C is wrong because Identity Protection is a risk-based detection and remediation service that can trigger MFA based on user or sign-in risk, but it cannot be configured to require MFA for a specific application like the Azure portal while excluding others. Option D is wrong because Privileged Identity Management (PIM) provides just-in-time privileged access and approval workflows, not the ability to enforce MFA selectively per application.

Full explanation →

210

MCQeasy

A company has Azure virtual networks (VNets) in three different Azure regions (West US, East US, and West Europe). They also have an on-premises data center connected to the East US region via ExpressRoute. They need to connect all VNets to each other and to the on-premises network. The solution must support transitive routing between all sites and provide centralized management of connectivity and routing policies. Which Azure service should they use?

A.VNet peering

B.Azure Virtual WAN

C.VPN Gateway

D.ExpressRoute Direct

AnswerB

Azure Virtual WAN is the correct architectural solution because it creates regional hubs connected in an any-to-any mesh, and each hub contains a fully managed virtual router with built-in VPN/ExpressRoute gateways. It provides transitive routing between VNets attached to different hubs as well as between VNets and on-premises sites, using a single, centrally managed route table and route propagation via BGP. This eliminates the need to build a full mesh of VNet peerings and gives centralized monitoring, routing, and security policy management across all regions.

Why this answer

Azure Virtual WAN is correct because it provides a hub-and-spoke architecture with built-in transitive routing between all VNets and on-premises sites. It supports automatic connectivity through Virtual Hub routers, which use BGP to propagate routes across all spokes and branches, meeting the requirement for centralized management of connectivity and routing policies.

Exam trap

The trap here is that candidates often assume VNet peering can be chained to achieve transitive routing, but Azure explicitly blocks transitive routing through peered VNets unless a network virtual appliance or Azure Virtual WAN is used.

How to eliminate wrong answers

Option A is wrong because VNet peering does not support transitive routing; peered VNets cannot route traffic through each other to reach a third VNet or on-premises network without additional user-defined routes and network virtual appliances. Option C is wrong because a VPN Gateway only provides site-to-site or point-to-site connectivity to a single VNet and does not inherently enable transitive routing between multiple VNets or centralized policy management across regions. Option D is wrong because ExpressRoute Direct is a physical port offering for dedicated private connections to Azure, not a service that provides transitive routing or centralized connectivity management between multiple VNets and on-premises networks.

Full explanation →

211

MCQeasy

You need to design a solution to store configuration data for a cloud-native application. The configuration must be centrally managed, versioned, and accessible to multiple services without hard-coding values. Which Azure service should you use?

A.Azure App Configuration

B.Azure Cosmos DB

C.Azure Blob Storage

D.Azure Key Vault

AnswerA

Azure App Configuration is the correct choice because it is a purpose-built managed service for centrally storing and managing application configuration settings such as key-value pairs, hierarchical labels, feature flags, and dynamic refresh. It supports versioning, rollback, and composition with services like Azure Kubernetes Service, so workload configuration can be updated without redeploying. Unlike a general NoSQL store, it provides a simple configuration model and SDK integration to watch for changes and apply them at runtime.

Why this answer

Azure App Configuration is the correct choice because it is a fully managed service specifically designed for central management of application configuration and feature flags. It supports versioning of configuration key-values, provides instant access to multiple services via SDKs or REST API, and eliminates the need to hard-code values by allowing dynamic updates without redeployment.

Exam trap

The trap here is that candidates often confuse Azure Key Vault (for secrets) with Azure App Configuration (for non-secret configuration), or assume a general-purpose database like Cosmos DB can serve as a configuration store, overlooking the specialized versioning and dynamic refresh capabilities of App Configuration.

How to eliminate wrong answers

Option B (Azure Cosmos DB) is wrong because it is a NoSQL database for storing transactional or operational data, not a configuration store; it lacks built-in versioning for configuration and adds unnecessary complexity and cost. Option C (Azure Blob Storage) is wrong because it is an object storage service for unstructured data like files and backups, not designed for fine-grained, versioned configuration key-values with low-latency access from multiple services. Option D (Azure Key Vault) is wrong because it is a secrets management service for storing sensitive items like passwords and certificates, not for general configuration data; it does not support versioning of configuration values in a way that is easily consumable by application code.

Full explanation →

212

MCQhard

A company runs a mission-critical SQL Server database on an Azure virtual machine using SQL Server Standard Edition. They need a disaster recovery solution that replicates the database to a secondary Azure region with a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 1 hour. The solution must support non-disruptive disaster recovery drills. The company cannot modify the SQL Server configuration or use Always On features due to licensing constraints. Which Azure service should they use?

A.Azure Site Recovery

B.SQL Server log shipping to a VM in the secondary region

C.Azure Backup with cross-region restore

D.Azure SQL Database geo-replication

AnswerA

Azure Site Recovery is the only listed option that provides full IaaS disaster recovery by continuously replicating the entire VM (disk-level) to the secondary region, with app-consistent recovery points every 15 minutes. It supports non-disruptive test failovers that run in parallel with production, satisfying the DR drill requirement without downtime, and a coordinated failover can restore the mission-critical SQL Server VM well within the 1-hour RTO.

Why this answer

Azure Site Recovery (ASR) replicates the entire VM (including the SQL Server database) to a secondary Azure region, meeting the RPO of 15 minutes and RTO of 1 hour. It supports non-disruptive disaster recovery drills by allowing test failovers in an isolated network without affecting the production environment. ASR does not require any changes to SQL Server configuration or licensing, as it operates at the hypervisor level using continuous replication.

Exam trap

The trap here is that candidates often choose Azure Backup (Option C) thinking it provides cross-region restore with low RPO, but they overlook that Backup's cross-region restore is designed for long-term retention and compliance, not for sub-hour RPOs, and it does not support non-disruptive drills.

How to eliminate wrong answers

Option B is wrong because SQL Server log shipping requires modifying the SQL Server configuration (setting up backup, copy, and restore jobs) and uses Always On features that are not available in Standard Edition without additional licensing; it also does not support non-disruptive drills without breaking the log chain. Option C is wrong because Azure Backup with cross-region restore provides only point-in-time snapshots with a typical RPO of 24 hours (or longer for cross-region), far exceeding the 15-minute requirement, and does not support non-disruptive drills. Option D is wrong because Azure SQL Database geo-replication is a PaaS feature that cannot be used with a SQL Server running on an Azure VM (IaaS); it requires migrating to Azure SQL Database, which is not the scenario described.

Full explanation →

Microsoft Azure Solutions Architect Expert AZ-305 (AZ-305) — Questions 151–212