Courseiva

Microsoft Azure Fundamentals AZ-900 (AZ-900) — Questions 76–150

1031 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 1

Page 2 of 14

Page 3
76
MCQmedium

Which Azure service provides a high-performance computing environment for running scientific, financial, and engineering simulations?

A.Azure Functions
B.Azure Batch
C.Azure Container Instances
D.Azure App Service
AnswerB

Azure Batch provides HPC-grade job scheduling for parallel and scientific computing workloads.

Why this answer

Azure Batch is a cloud-based job scheduling and compute management service designed for large-scale parallel and high-performance computing (HPC) workloads. It automatically provisions and manages a pool of virtual machines, installs the required software, schedules tasks, and scales resources based on job demands, making it ideal for running scientific simulations, financial risk modeling, and engineering analysis.

Exam trap

The trap here is that candidates confuse Azure Batch with serverless or container services, mistakenly thinking Azure Functions or Container Instances can handle long-running HPC workloads, when in fact they lack the job scheduling, auto-scaling, and parallel execution capabilities that Batch provides.

How to eliminate wrong answers

Option A is wrong because Azure Functions is a serverless compute service for event-driven, short-lived code execution (typically under 10 minutes), not designed for long-running, resource-intensive HPC simulations. Option C is wrong because Azure Container Instances (ACI) provides simple, on-demand container execution without orchestration or job scheduling capabilities, lacking the automatic scaling and batch job management needed for complex simulations. Option D is wrong because Azure App Service is a platform-as-a-service (PaaS) for hosting web applications, REST APIs, and mobile backends, not intended for compute-intensive batch processing or HPC workloads.

Full explanation →
77
MCQmedium

A company is designing a disaster recovery solution for a multi-tier application hosted in Azure. They need to ensure that if an entire Azure region becomes unavailable, the application can fail over to another region. The application uses Azure SQL Database. Which Azure feature should they use to replicate the database across regions?

A.A) Azure SQL Database geo-replication
B.B) Azure SQL Database automatic failover groups
C.C) Azure Traffic Manager
D.D) Azure Site Recovery
AnswerB

Failover groups enable automatic, transparent failover of your SQL Database to a secondary region during a disaster.

Why this answer

Azure SQL Database automatic failover groups (Option B) are the correct choice because they provide automated, orchestrated failover of a group of databases across regions, ensuring the entire multi-tier application can fail over when an Azure region becomes unavailable. Unlike geo-replication, which only replicates data, failover groups manage the entire logical server and its databases, including updating the connection string endpoint to the secondary region, which is essential for application continuity.

Exam trap

The trap here is that candidates often confuse geo-replication (which only replicates data) with failover groups (which provide automated failover and connection management), leading them to choose Option A because they think replication alone is sufficient for disaster recovery.

How to eliminate wrong answers

Option A is wrong because Azure SQL Database geo-replication only provides asynchronous replication of a single database to a secondary region, but it does not automatically update the application's connection string or orchestrate failover of multiple databases as a group, requiring manual intervention or custom logic to redirect traffic. Option C is wrong because Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming traffic to different endpoints, but it does not replicate or failover the database itself; it can only redirect application traffic, leaving the database unreplicated and unavailable in the secondary region.

Full explanation →
78
MCQmedium

Which Azure service enables connecting Azure resources to on-premises systems using standardized industry protocols like SFTP or FTP?

A.Azure VPN Gateway
B.Azure Blob Storage SFTP support
C.Azure ExpressRoute
D.Azure Data Factory
AnswerB

Azure Blob Storage supports SFTP protocol, enabling standard SFTP clients to transfer files to blob storage.

Why this answer

Azure Blob Storage SFTP support enables secure file transfers to and from Azure Blob Storage using the SFTP protocol, which is a standardized industry protocol for secure file transfer. This allows on-premises systems to connect directly to Azure storage resources without needing a separate virtual machine or gateway, making it the correct choice for connecting Azure resources to on-premises systems via SFTP or FTP.

Exam trap

The trap here is that candidates often confuse Azure VPN Gateway or ExpressRoute as the solution for file transfer protocols, but those services provide network connectivity, not application-layer protocol support like SFTP or FTP.

How to eliminate wrong answers

Option A is wrong because Azure VPN Gateway provides site-to-site or point-to-site encrypted connectivity over the internet using IPsec/IKE protocols, not standardized file transfer protocols like SFTP or FTP. Option C is wrong because Azure ExpressRoute provides a dedicated private network connection to Azure, bypassing the internet, but it does not natively support SFTP or FTP protocols; it is a Layer 3 connectivity service, not a file transfer service. Option D is wrong because Azure Data Factory is a cloud-based ETL and data integration service that orchestrates data movement and transformation, but it does not directly expose SFTP or FTP endpoints for on-premises systems to connect to; it uses connectors to pull data from sources, not a direct protocol listener.

Full explanation →
79
MCQeasy

A hospital stores sensitive patient data in the cloud. They want to ensure that data remains secure and that the cloud provider has implemented strict physical security controls, such as biometric access and 24/7 surveillance at datacenters. Which aspect of the shared responsibility model does this describe?

A.Responsibility of the customer for network security
B.Responsibility of the cloud provider for physical security
C.Responsibility of the customer for data classification
D.Responsibility of the customer for identity and access management
AnswerB

The cloud provider is responsible for the physical security of datacenters, including access controls, surveillance, and environmental controls. This is a fundamental part of the shared responsibility model.

Why this answer

The shared responsibility model delineates that the cloud provider is responsible for the security 'of' the cloud, which includes physical infrastructure controls like biometric access and 24/7 surveillance at datacenters. This question specifically asks about physical security controls, which fall under the provider's domain regardless of the deployment model (IaaS, PaaS, or SaaS). Therefore, option B is correct because the provider must secure the physical premises housing the servers and storage.

Exam trap

The trap here is that candidates confuse 'physical security' with 'network security' or 'IAM,' assuming the customer must manage all security layers, but the shared responsibility model explicitly assigns physical controls to the provider.

How to eliminate wrong answers

Option A is wrong because network security is a shared responsibility where the provider secures the physical network infrastructure, but the customer is responsible for configuring network security groups, firewalls, and encryption in transit (e.g., TLS). Option C is wrong because data classification is entirely the customer's responsibility, as the customer determines sensitivity labels and access policies for their data, not the provider. Option D is wrong because identity and access management (IAM) is a customer responsibility for managing user identities, roles, and permissions (e.g., Azure AD), though the provider secures the underlying IAM service infrastructure.

Full explanation →
80
MCQmedium

A company has a critical Azure resource group that contains production resources. They want to ensure that no one can accidentally delete or modify the resources in this group, even if they have Contributor permissions. Which Azure feature should they use?

A.Azure Policy
B.Role-Based Access Control (RBAC)
C.Resource Locks
D.Management Groups
AnswerC

Resource Locks prevent any user, regardless of their RBAC role, from deleting or modifying resources (depending on lock type: Delete or ReadOnly).

Why this answer

Resource Locks are the correct choice because they provide a way to prevent accidental deletion or modification of critical Azure resources by applying a lock at the resource, resource group, or subscription level. Even users with Contributor or Owner permissions are blocked from performing delete or modify operations when a lock is set to 'CanNotDelete' or 'ReadOnly'. This ensures that production resources are protected beyond the permissions granted by RBAC.

Exam trap

The trap here is that candidates often confuse Azure Policy with Resource Locks, thinking Policy can prevent deletion, but Policy only audits or enforces configuration rules, not operational actions like delete or modify.

How to eliminate wrong answers

Option A is wrong because Azure Policy enforces organizational standards and compliance rules (e.g., restricting resource SKUs or locations) but does not prevent deletion or modification of existing resources by authorized users. Option B is wrong because Role-Based Access Control (RBAC) manages who can perform actions based on assigned roles, but a user with Contributor permissions can still delete or modify resources; RBAC alone cannot override those permissions to block accidental changes.

Full explanation →
81
MCQmedium

A company wants to run a containerized application in Azure without managing any virtual machines. They need automatic scaling, load balancing, and service discovery. Which Azure compute service should they choose?

A.Azure Kubernetes Service (AKS)
B.Azure Container Instances
C.Azure App Service
D.Azure Virtual Machines
AnswerA

AKS provides managed Kubernetes with built-in scaling and service discovery.

Why this answer

Azure Kubernetes Service (AKS) is the correct choice because it provides a fully managed Kubernetes orchestration platform that abstracts away the underlying virtual machines. AKS handles automatic scaling via the Horizontal Pod Autoscaler (HPA) and cluster autoscaler, built-in load balancing through Azure Load Balancer integration, and service discovery using Kubernetes DNS (CoreDNS). This meets the requirement of running containerized applications without managing VMs.

Exam trap

The trap here is that candidates often confuse Azure Container Instances (ACI) with AKS because both run containers without VMs, but ACI lacks orchestration features like automatic scaling and service discovery, making AKS the correct choice for this requirement.

How to eliminate wrong answers

Option B (Azure Container Instances) is wrong because while it runs containers without managing VMs, it lacks built-in automatic scaling, load balancing, and service discovery—these require additional Azure services like Container Groups and Azure Load Balancer, and it does not offer orchestration features like Kubernetes. Option C (Azure App Service) is wrong because it is designed for web applications and APIs, not for running arbitrary containerized workloads with full orchestration; it supports containers but does not provide native Kubernetes-level service discovery or automatic scaling based on container metrics. Option D (Azure Virtual Machines) is wrong because it requires explicit management of VMs, including patching, scaling, and load balancing setup, directly contradicting the requirement to avoid managing virtual machines.

Full explanation →
82
MCQmedium

A company needs to store database connection strings and API keys securely, ensuring only authorized applications can access them. Which Azure service is designed for this?

A.Azure Storage with encryption
B.Azure Key Vault
C.Azure Active Directory
D.Azure Policy
AnswerB

Key Vault is specifically designed for securely storing secrets, keys, and certificates with Azure AD-based access control.

Why this answer

Azure Key Vault is the correct service because it is specifically designed to securely store and manage secrets such as database connection strings, API keys, and certificates. It provides fine-grained access control via Azure RBAC and access policies, ensuring only authorized applications and users can retrieve secrets. This aligns directly with the requirement for secure, authorized access to sensitive configuration data.

Exam trap

The trap here is that candidates often confuse Azure Key Vault with Azure Storage encryption, assuming that encrypting a storage account is sufficient for managing secrets, but Key Vault is the only service that provides centralized secret management with access policies and audit logging.

How to eliminate wrong answers

Option A is wrong because Azure Storage with encryption only protects data at rest and in transit but does not provide granular access control for secrets or prevent unauthorized applications from accessing stored connection strings or API keys. Option C is wrong because Azure Active Directory is an identity and access management service for authentication and authorization, not a secret store; it cannot natively store or manage database connection strings or API keys. Option D is wrong because Azure Policy is a governance tool used to enforce compliance rules and resource configurations, not a service for storing or managing secrets.

Full explanation →
83
MCQmedium

Which cloud service model gives customers the most control over the underlying infrastructure, including the operating system and networking?

A.Software as a Service (SaaS)
B.Platform as a Service (PaaS)
C.Infrastructure as a Service (IaaS)
D.Function as a Service (FaaS)
AnswerC

IaaS gives the most control — customers manage OS, networking, and applications on cloud-provided virtual machines.

Why this answer

Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet, giving customers direct control over the operating system, storage, and networking components such as virtual networks and firewalls. Unlike higher-level service models, IaaS allows users to manage and configure the underlying infrastructure without physical hardware access, making it the model with the most customer control.

Exam trap

The trap here is that candidates often confuse PaaS with IaaS because both involve virtual machines, but PaaS hides the OS and networking configuration, whereas IaaS grants full administrative access to those layers.

How to eliminate wrong answers

Option A is wrong because Software as a Service (SaaS) delivers fully managed applications where the customer only controls application-specific settings, not the underlying OS or network. Option B is wrong because Platform as a Service (PaaS) abstracts the OS and runtime environment, limiting customer control to application code and data while the provider manages the infrastructure. Option D is wrong because Function as a Service (FaaS) is a serverless compute model where the customer only provides code functions and has no control over the OS, networking, or execution environment.

Full explanation →
84
MCQmedium

Which Azure service provides a virtual private network gateway for connecting on-premises networks to Azure virtual networks over the internet?

A.Azure ExpressRoute
B.Azure Virtual Network
C.Azure VPN Gateway
D.Azure Bastion
AnswerC

VPN Gateway provides encrypted site-to-site and point-to-site connectivity between on-premises and Azure over the internet.

Why this answer

Azure VPN Gateway is the correct service because it provides a dedicated virtual private network (VPN) gateway that enables secure site-to-site (S2S) or point-to-site (P2S) connectivity between on-premises networks and Azure virtual networks over the public internet using IPsec/IKE protocols. It creates an encrypted tunnel across the internet, making it the appropriate choice for internet-based hybrid connectivity.

Exam trap

The trap here is that candidates often confuse Azure Virtual Network (the container for networking resources) with the VPN Gateway service itself, forgetting that a VPN gateway is a separate resource type that must be deployed inside a virtual network to enable encrypted internet-based connectivity.

How to eliminate wrong answers

Option A is wrong because Azure ExpressRoute provides a dedicated private connection from on-premises to Azure that bypasses the public internet entirely, using MPLS or similar carrier-grade networks, not a VPN gateway over the internet. Option B is wrong because Azure Virtual Network is the fundamental networking building block that defines the IP address space and subnets, but it does not include a VPN gateway component; a VPN gateway must be explicitly deployed within a virtual network to provide encrypted internet-based connectivity. Option D is wrong because Azure Bastion is a fully managed PaaS service that provides secure RDP/SSH access to virtual machines directly from the Azure portal over TLS, without exposing public IP addresses, and it does not function as a VPN gateway for site-to-site or point-to-site connectivity.

Full explanation →
85
MCQmedium

Which Azure service provides fully managed Apache Cassandra NoSQL database with automatic scaling and multi-region writes?

A.Azure Cosmos DB for Apache Cassandra
B.Azure Managed Instance for Apache Cassandra
C.Azure Table Storage with Cassandra drivers
D.Azure HDInsight with Cassandra
AnswerB

Azure Managed Instance for Apache Cassandra provides fully managed native Cassandra with multi-region write support.

Why this answer

Azure Managed Instance for Apache Cassandra is the correct answer because it is a fully managed service that automates deployment, scaling, and operations of Apache Cassandra clusters, including support for multi-region writes. It provides native Cassandra API compatibility, automatic scaling, and managed multi-region replication, which aligns precisely with the question's requirements.

Exam trap

The trap here is that candidates often confuse Azure Cosmos DB for Apache Cassandra (a compatibility layer) with a true managed Cassandra instance, assuming the 'for Apache Cassandra' label means it runs the actual Cassandra engine, when in fact it is a Cosmos DB API that lacks native Cassandra internals like compaction strategies and repair operations.

How to eliminate wrong answers

Option A is wrong because Azure Cosmos DB for Apache Cassandra is a compatibility layer that emulates the Cassandra wire protocol (CQL) on top of Cosmos DB's proprietary backend, not a fully managed Apache Cassandra instance; it lacks native Cassandra internals like gossip protocol and hinted handoff. Option C is wrong because Azure Table Storage is a key-value store with a different API (REST/JSON), and using Cassandra drivers would require a translation layer that does not provide native Cassandra features or multi-region writes. Option D is wrong because Azure HDInsight with Cassandra is a PaaS offering for big data analytics that requires manual configuration for scaling and multi-region writes, and it is not a fully managed Cassandra database service.

Full explanation →
86
MCQmedium

What is the key difference between an Azure 'region' and an Azure 'geography'?

A.A region contains multiple geographies; a geography contains a single region
B.A geography is a discrete market containing multiple Azure regions for data residency purposes
C.A geography and a region are identical concepts in Azure
D.A geography refers to the physical datacenter building; a region is the city it's in
AnswerB

Geography = broad market (US, Europe); Region = specific location within the geography (East US, West Europe).

Why this answer

Option B is correct because an Azure geography is a discrete market (e.g., United States, Europe) that contains at least one Azure region, and it is designed to preserve data residency and compliance boundaries. A region is a set of datacenters deployed within a latency-defined perimeter, connected through a dedicated regional low-latency network. Geographies ensure that customer data stays within the specified boundary for legal and regulatory requirements, even if a region fails.

Exam trap

The trap here is confusing the hierarchical relationship: candidates often think a region contains geographies (Option A) or that the terms are interchangeable (Option C), but Azure explicitly defines geographies as the top-level boundary for data residency, containing one or more regions.

How to eliminate wrong answers

Option A is wrong because a geography contains multiple regions, not the other way around; a region does not contain geographies. Option C is wrong because a region and a geography are distinct concepts: a region is a physical location with datacenters, while a geography is a sovereign boundary for data residency. Option D is wrong because a geography is not a physical datacenter building; it is a larger geopolitical or market boundary, and a region is not merely a city but a specific set of datacenters within that area.

Full explanation →
87
MCQmedium

A company is building a mobile app backend that handles HTTP requests from thousands of users. The traffic pattern is highly unpredictable: there can be sudden spikes to hundreds of requests per second followed by long periods of no activity. The development team wants a solution that automatically scales from zero to hundreds of instances based on demand, and they want to pay only for the compute time consumed when the code is actually executing. They do not want to manage any underlying infrastructure, such as virtual machines or containers. Which Azure compute service should they choose?

A.Azure Functions
B.Azure App Service
C.Azure Kubernetes Service (AKS)
D.Azure Virtual Machines
AnswerA

Correct. Azure Functions is a serverless compute service that automatically scales based on demand and charges only for execution time. It can scale to zero when idle, exactly matching the requirements.

Why this answer

Azure Functions is the correct choice because it is a serverless compute service that automatically scales from zero to hundreds of instances based on incoming HTTP requests, and you pay only for the compute time consumed when your code executes. It handles unpredictable traffic patterns with sudden spikes and idle periods without requiring any infrastructure management, as it runs on a consumption plan that provides dynamic scaling.

Exam trap

The trap here is that candidates often confuse Azure Functions with Azure App Service, assuming both can scale to zero, but App Service requires always-on resources and cannot scale down to zero instances, whereas Functions on a consumption plan can.

How to eliminate wrong answers

Option B (Azure App Service) is wrong because it runs on a dedicated or reserved set of virtual machines that must be pre-provisioned and scaled manually or with autoscale rules; it cannot scale to zero instances and you pay for the allocated resources even when no requests are being processed. Option C (Azure Kubernetes Service) is wrong because it requires you to manage and configure a cluster of virtual machines, including node pools and container orchestration, and you pay for the underlying VMs even when no pods are running; it does not provide a true zero-to-scale serverless model without additional overhead.

Full explanation →
88
MCQhard

A company has a management group hierarchy: Root → UK → Production. They assign a policy at the Root level that allows only certain VM sizes. Later, they assign another policy at the UK level that denies all resources. What is the effective effect on the Production subscription?

A.Only the Root policy applies because it is at the highest level.
B.Only the UK policy applies because it is more specific.
C.Both policies apply, and the order of evaluation could cause a conflict.
D.Both policies apply, and the most restrictive (Deny) takes precedence.
AnswerD

Correct. Deny overrides any other effect, so the UK-level Deny prevents all resource creation.

Why this answer

D is correct because Azure Policy is inherited and cumulative down the management group hierarchy. The Root-level policy (allow only certain VM sizes) and the UK-level policy (deny all resources) both apply to the Production subscription. When a deny policy conflicts with an allow policy, the deny effect always takes precedence, making the most restrictive policy effective.

Exam trap

The trap here is that candidates mistakenly apply a 'closest match' or 'most specific wins' logic from networking or RBAC to Azure Policy, whereas Azure Policy uses cumulative inheritance with deny overriding allow.

How to eliminate wrong answers

Option A is wrong because Azure Policy inheritance is not limited to the highest level; policies assigned at any parent management group are inherited by child subscriptions, so the UK policy also applies. Option B is wrong because Azure Policy does not use a 'more specific' override model; all inherited policies are evaluated, and the deny effect overrides allow effects regardless of assignment level. Option C is wrong because Azure Policy evaluation is deterministic and does not depend on order; the deny effect always wins over allow, so there is no conflict—the result is a clear deny.

Full explanation →
89
MCQmedium

An IT team manages a customer relationship management (CRM) application hosted on a single Azure virtual machine. As the number of users grows, the CPU and memory usage on the VM consistently exceed 90%. The team decides to increase the VM size from Standard_D2s_v3 (2 vCPUs, 8 GB RAM) to Standard_D8s_v3 (8 vCPUs, 32 GB RAM) to handle the increased load. The application is not designed to run on multiple servers simultaneously. This approach represents which type of scaling in the cloud?

A.Horizontal scaling
B.Vertical scaling
C.Diagonal scaling
D.Auto-scaling
AnswerB

Vertical scaling (scaling up) increases the capacity of a single resource by upgrading its specifications (e.g., more vCPUs, RAM). This matches the action of resizing the VM to a larger SKU.

Why this answer

Increasing the VM size from Standard_D2s_v3 to Standard_D8s_v3 adds more vCPUs and RAM to the same virtual machine, which is the definition of vertical scaling (scaling up). This approach is appropriate because the application cannot run on multiple servers simultaneously, so adding resources to the existing single VM is the only viable option to handle the increased load.

Exam trap

The trap here is that candidates often confuse vertical scaling with auto-scaling, but auto-scaling is an automated process that can scale either vertically or horizontally based on rules, whereas this question describes a manual, one-time resizing without any automation.

How to eliminate wrong answers

Option A is wrong because horizontal scaling (scaling out) involves adding more VM instances to distribute the load, but the application is not designed to run on multiple servers simultaneously, making this approach incompatible. Option C is wrong because diagonal scaling is not a recognized cloud scaling term; it is a fabricated distractor that combines aspects of horizontal and vertical scaling but has no official definition in Azure or cloud computing. Option D is wrong because auto-scaling is a mechanism that automatically adjusts resources based on demand, but the question describes a manual, one-time resizing of the VM, not an automated policy-driven adjustment.

Full explanation →
90
MCQmedium

Which tool allows you to automate the creation and management of Azure resources using declarative JSON or Bicep templates?

A.Azure PowerShell
B.Azure CLI
C.ARM templates / Bicep
D.Azure Cloud Shell
AnswerC

ARM templates (JSON) and Bicep are declarative IaC tools for defining desired Azure resource state.

Why this answer

ARM templates and Bicep are declarative Infrastructure as Code (IaC) tools that allow you to define Azure resources in JSON or Bicep syntax. They enable repeatable, idempotent deployments by describing the desired state of resources, which Azure Resource Manager then orchestrates to create or update resources accordingly.

Exam trap

The trap here is that candidates confuse the interactive scripting tools (PowerShell, CLI) with declarative template languages, or mistake the hosting environment (Cloud Shell) for the automation tool itself.

How to eliminate wrong answers

Option A is wrong because Azure PowerShell is an imperative scripting tool that uses cmdlets to manage Azure resources step-by-step, not declarative templates. Option B is wrong because Azure CLI is also an imperative command-line tool that executes commands sequentially, not a declarative template format. Option D is wrong because Azure Cloud Shell is an interactive browser-based shell environment that provides access to Azure PowerShell and Azure CLI, but it is not a template or automation tool itself.

Full explanation →
91
MCQmedium

Which Azure service provides object storage with a hierarchical namespace optimized for big data and analytics workloads?

A.Azure Files
B.Azure Data Lake Storage Gen2
C.Azure Blob Storage (flat namespace)
D.Azure Queue Storage
AnswerB

ADLS Gen2 provides hierarchical namespace, fine-grained ACLs, and Hadoop-compatible filesystem for analytics.

Why this answer

Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct answer because it combines Blob Storage’s scalable object storage with a hierarchical namespace, enabling POSIX-like directory structures and fine-grained access control lists (ACLs). This architecture is specifically optimized for big data and analytics workloads, such as those running Apache Spark, Hive, or Azure Databricks, where efficient directory-level operations and high throughput are critical.

Exam trap

The trap here is that candidates confuse Azure Blob Storage’s flat namespace with the hierarchical namespace required for big data analytics, mistakenly thinking Blob Storage alone can handle directory structures, when in fact ADLS Gen2 is the only service that combines object storage with a true hierarchical namespace.

How to eliminate wrong answers

Option A is wrong because Azure Files provides fully managed file shares using the SMB protocol, designed for lift-and-shift file server migrations or shared storage for VMs, not for big data analytics with a hierarchical namespace. Option C is wrong because Azure Blob Storage uses a flat namespace, meaning all objects exist at a single level without true directory hierarchy, making it inefficient for big data workloads that require atomic directory rename or delete operations. Option D is wrong because Azure Queue Storage is a messaging service for decoupling application components, not a storage service for object or file data, and it lacks any namespace or hierarchical structure.

Full explanation →
92
MCQmedium

Which Azure IoT service provides end-to-end IoT solutions with pre-built industry templates and no-code/low-code configuration?

A.Azure IoT Hub
B.Azure IoT Central
C.Azure Digital Twins
D.Azure Sphere
AnswerB

IoT Central provides pre-built industry templates and no-code configuration for end-to-end IoT solutions.

Why this answer

Azure IoT Central is correct because it is a fully managed IoT application platform that provides end-to-end IoT solutions with pre-built industry templates (e.g., for retail, healthcare, energy) and a no-code/low-code configuration interface. Unlike Azure IoT Hub, which is a lower-level messaging service, IoT Central abstracts the underlying infrastructure and offers built-in dashboards, device management, and analytics, enabling rapid deployment without custom development.

Exam trap

The trap here is that candidates confuse Azure IoT Hub (a low-level building block) with Azure IoT Central (a managed application platform), assuming IoT Hub also provides pre-built templates and low-code configuration, but IoT Hub requires custom development for those features.

How to eliminate wrong answers

Option A is wrong because Azure IoT Hub is a managed service for bi-directional communication between IoT devices and the cloud, but it does not provide pre-built industry templates or a no-code/low-code configuration interface; it requires custom development for dashboards and business logic. Option C is wrong because Azure Digital Twins is a modeling service for creating digital replicas of physical environments, not an end-to-end IoT solution with pre-built templates or low-code configuration. Option D is wrong because Azure Sphere is a secured microcontroller platform with custom Linux OS and hardware for device-level security, not a full IoT solution with templates or low-code tools.

Full explanation →
93
MCQmedium

Which Azure service acts as a reverse proxy to protect, accelerate, and deliver web applications with SSL termination and layer 7 load balancing?

A.Azure Load Balancer
B.Azure Application Gateway
C.Azure Front Door
D.Azure Traffic Manager
AnswerB

Application Gateway provides layer 7 load balancing with SSL termination, URL routing, and WAF for web apps.

Why this answer

Azure Application Gateway is a web traffic load balancer that operates at Layer 7 (HTTP/HTTPS). It provides SSL termination, URL-based routing, and Web Application Firewall (WAF) capabilities, making it the correct choice for a reverse proxy that protects, accelerates, and delivers web applications.

Exam trap

The trap here is that candidates often confuse Azure Application Gateway (Layer 7 reverse proxy) with Azure Load Balancer (Layer 4) or Azure Front Door (global multi-region), but the question specifically requires SSL termination and Layer 7 load balancing, which only Application Gateway provides among the options.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and does not provide SSL termination, URL-based routing, or Layer 7 load balancing. Option C is wrong because Azure Front Door is a global, multi-region load balancer that uses Anycast and HTTP/HTTPS routing, but it is not a reverse proxy focused on a single region; it is designed for global distribution and acceleration. Option D is wrong because Azure Traffic Manager is a DNS-based traffic router that operates at Layer 3/4 and does not perform SSL termination or Layer 7 load balancing.

Full explanation →
94
MCQmedium

A company uses Azure and wants to ensure that their IT team receives alerts when virtual machines are deallocated unexpectedly. Which Azure service should they use to create a rule that triggers an action when a VM is deallocated?

A.Azure Service Health
B.Azure Monitor
C.Azure Advisor
D.Azure Policy
AnswerB

Azure Monitor with Activity Log alerts can notify you when VMs are deallocated.

Why this answer

Azure Monitor is the correct service because it provides a unified platform for collecting, analyzing, and acting on telemetry from Azure resources. By creating an alert rule in Azure Monitor with a signal type of 'Administrative' (Azure Activity Log), you can trigger an action group (e.g., email, SMS, webhook) specifically when a virtual machine is deallocated, as this event is logged as an administrative operation in the Activity Log.

Exam trap

The trap here is that candidates often confuse Azure Service Health (which monitors Azure platform health) with Azure Monitor (which monitors resource-level events), leading them to choose Option A for operational alerts like VM deallocation.

How to eliminate wrong answers

Option A is wrong because Azure Service Health provides personalized alerts about service issues, planned maintenance, and health advisories affecting Azure services, but it does not monitor resource-level operational events like VM deallocation. Option C is wrong because Azure Advisor is a personalized recommendation engine that analyzes resource configurations and usage to suggest best practices for cost, security, reliability, and performance; it cannot create alert rules or trigger actions based on specific events. Option D is wrong because Azure Policy is used to enforce organizational standards and assess compliance by applying rules to resource configurations (e.g., requiring a specific VM size), but it does not monitor runtime events or send alerts when a VM is deallocated.

Full explanation →
95
MCQeasy

Which Azure cloud benefit means organizations don't need to predict future resource needs exactly when planning infrastructure?

A.Economies of scale
B.Stop guessing capacity requirements
C.Increased speed and agility
D.Go global in minutes
AnswerB

Cloud eliminates upfront capacity guessing by allowing on-demand scaling to actual demand.

Why this answer

The 'Stop guessing capacity requirements' benefit, often referred to as 'Capacity Planning' in the Azure Well-Architected Framework, directly addresses the challenge of over-provisioning or under-provisioning infrastructure. Azure's elastic scaling model allows organizations to provision resources on demand and pay only for what they use, eliminating the need to predict future workloads precisely. This is a core advantage of the consumption-based model in cloud computing, where resources can be scaled up or down automatically based on real-time metrics.

Exam trap

The trap here is that candidates often confuse 'Stop guessing capacity requirements' with 'Economies of scale' because both relate to cost savings, but the former is specifically about eliminating the need for upfront capacity forecasting, while the latter is about lower unit costs from provider-scale operations.

How to eliminate wrong answers

Option A is wrong because 'Economies of scale' refers to the cost advantages that cloud providers achieve through massive infrastructure aggregation, which they pass on to customers as lower pay-as-you-go prices—it does not address the need to predict future capacity requirements. Option C is wrong because 'Increased speed and agility' describes how cloud resources can be provisioned quickly (e.g., in minutes via ARM templates or Azure CLI), but this benefit is about rapid deployment, not about eliminating the need for capacity forecasting. Option D is wrong because 'Go global in minutes' refers to Azure's ability to deploy resources across multiple regions worldwide using Azure Traffic Manager or Azure Front Door, which is about geographic reach, not about removing the burden of capacity prediction.

Full explanation →
96
Matchingmedium

Match each Azure compute option to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Manage and scale groups of VMs

Platform for web and mobile apps

Managed Kubernetes cluster

Run containers without managing servers

Large-scale parallel and batch compute

Why these pairings

Each compute service targets different deployment scenarios.

Full explanation →
97
MCQmedium

A company runs a global e-commerce platform. During a flash sale, demand surges from 10,000 users to 500,000 users in minutes. The platform automatically provisions additional servers to handle the load and deprovisions them after the sale. Which cloud characteristic is most directly demonstrated?

A.Elasticity
B.High availability
C.Fault tolerance
D.Geographic distribution
AnswerA

Correct. Elasticity allows resources to be automatically adjusted to accommodate variable workloads.

Why this answer

Elasticity is the ability of a cloud system to automatically scale resources up or down based on demand. In this scenario, the platform provisions additional servers during the flash sale and deprovisions them afterward, directly demonstrating elasticity. This contrasts with other characteristics like high availability, which focuses on uptime, not dynamic scaling.

Exam trap

The trap here is that candidates often confuse elasticity with high availability, thinking that automatically adding servers during a surge is about keeping the system available, but high availability is about fault tolerance and redundancy, not dynamic scaling.

How to eliminate wrong answers

Option B (High availability) is wrong because it refers to ensuring the system remains operational and accessible despite failures, typically through redundancy across availability zones, not the dynamic scaling of resources. Option C (Fault tolerance) is wrong because it describes the system's ability to continue operating without interruption when a component fails, often via built-in redundancy, not the automatic provisioning and deprovisioning of servers. Option D (Geographic distribution) is wrong because it involves deploying resources across multiple geographic regions to reduce latency or meet compliance, not the automatic scaling of resources based on load.

Full explanation →
98
MCQmedium

Which Azure service provides a unified security management system that strengthens the security posture of data centers and cloud workloads?

A.Azure Firewall
B.Microsoft Defender for Cloud
C.Azure DDoS Protection
D.Azure Key Vault
AnswerB

Defender for Cloud provides unified security management, threat protection, and compliance monitoring across cloud and hybrid environments.

Why this answer

Microsoft Defender for Cloud (formerly Azure Security Center) is a unified security management system that provides continuous assessment, security recommendations, and threat protection across hybrid cloud workloads. It strengthens the security posture of data centers and cloud workloads by offering features like secure score, regulatory compliance dashboards, and just-in-time VM access, making it the correct answer.

Exam trap

The trap here is that candidates often confuse a specific security tool (like Azure Firewall or DDoS Protection) with a unified security management platform, overlooking that Defender for Cloud is the overarching service for posture management and threat protection.

How to eliminate wrong answers

Option A (Azure Firewall) is wrong because it is a managed, cloud-based network security service that filters traffic based on rules, not a unified security management system for posture improvement. Option C (Azure DDoS Protection) is wrong because it specifically defends against distributed denial-of-service attacks at the network layer, not a broad security posture management tool. Option D (Azure Key Vault) is wrong because it is a secrets management service for storing cryptographic keys, certificates, and passwords, not a system for assessing and improving overall security posture.

Full explanation →
99
MCQmedium

A global consulting firm has offices in New York, London, and Tokyo. They deployed a document management system on Azure App Service. Consultants need to access the system from any location worldwide using laptops or smartphones over public Wi-Fi or cellular networks, without needing a VPN connection. After deployment, all consultants can successfully log in and use the application from any internet-connected device. Which characteristic of cloud computing does this scenario best illustrate?

A.High availability
B.Broad network access
C.Resource pooling
D.Rapid elasticity
AnswerB

Broad network access means resources can be accessed over the network from a wide range of devices and locations using standard protocols, which is exactly what the consultants experience.

Why this answer

This scenario best illustrates broad network access because the document management system is accessible over the internet from any location using laptops or smartphones without requiring a VPN. Broad network access means resources can be accessed via standard network protocols (e.g., HTTPS) from a wide range of devices, including mobile phones and laptops, over public networks like Wi-Fi or cellular. The consultants' ability to log in and use the application from any internet-connected device directly demonstrates this characteristic.

Exam trap

The trap here is that candidates confuse 'broad network access' with 'high availability' because both involve being 'accessible from anywhere,' but high availability focuses on uptime and fault tolerance, not the variety of devices and network types used for access.

How to eliminate wrong answers

Option A is wrong because high availability refers to the ability of a system to remain operational and accessible for a high percentage of time (e.g., 99.99% uptime), often through redundancy across multiple availability zones, not the ability to access the system from various devices and networks. Option C is wrong because resource pooling describes the provider's multi-tenant model where computing resources are pooled to serve multiple customers, with physical and virtual resources dynamically assigned and reassigned according to demand; this scenario does not illustrate multi-tenancy or shared resource allocation. Option D is wrong because rapid elasticity involves the ability to quickly scale resources up or down based on demand, such as automatically adding virtual machines during peak usage; the scenario describes access from different locations and devices, not dynamic scaling of resources.

Full explanation →
100
MCQmedium

What is the purpose of Azure Cost Management budgets?

A.To automatically stop resources when spending exceeds a defined limit
B.To set spending thresholds and receive alerts when approaching those limits
C.To transfer unused budget from one resource to another
D.To reserve compute capacity for future use
AnswerB

Budgets set cost/usage thresholds and send notifications when actual or forecasted spending reaches alert levels.

Why this answer

Azure Cost Management budgets allow you to set spending thresholds (e.g., monthly, quarterly) and configure alerts that notify you via email or action groups when costs reach a certain percentage of the budget (e.g., 50%, 90%, 100%). This enables proactive cost governance without automatically stopping resources, which is not a built-in budget action.

Exam trap

The trap here is that candidates confuse budget alerts with automated cost-saving actions, assuming budgets can directly stop or deallocate resources, when in fact budgets only provide notifications and require external automation for enforcement.

How to eliminate wrong answers

Option A is wrong because Azure Cost Management budgets do not automatically stop resources; they only trigger alerts. Stopping resources requires Azure Automation runbooks or other custom automation triggered by budget alerts. Option C is wrong because budgets are per-scope (subscription, resource group, etc.) and do not support transferring unused budget between resources; budget amounts are fixed thresholds, not allocatable funds.

Option D is wrong because reserving compute capacity is the purpose of Azure Reserved Instances or Savings Plans, not Cost Management budgets.

Full explanation →
101
MCQmedium

A company plans to migrate its on-premises SQL Server database to Azure. The database uses many features including SQL Server Agent jobs, cross-database queries, and CLR integration. The company wants a fully managed PaaS service that minimizes application code changes and supports native virtual network (VNet) integration without requiring a private endpoint. Which Azure service should the company use?

A.Azure SQL Database
B.Azure SQL Managed Instance
C.SQL Server on Azure Virtual Machine
D.Azure Cosmos DB
AnswerB

Azure SQL Managed Instance is a fully managed PaaS service that offers near 100% compatibility with on-premises SQL Server, including support for SQL Server Agent, cross-database queries, and CLR integration. It also natively integrates with a VNet, allowing the instance to be placed directly into a subnet without additional configuration. This makes it ideal for migrations requiring minimal application changes.

Why this answer

Azure SQL Managed Instance is the correct choice because it provides near 100% compatibility with on-premises SQL Server, including SQL Server Agent jobs, cross-database queries, and CLR integration, while being a fully managed PaaS service. It supports native VNet integration without requiring a private endpoint, allowing the database to be placed directly into a customer's virtual network for secure, isolated connectivity.

Exam trap

The trap here is that candidates often confuse Azure SQL Database with Azure SQL Managed Instance, not realizing that Azure SQL Database lacks key SQL Server features like SQL Server Agent and native VNet integration, which are critical for the scenario described.

How to eliminate wrong answers

Option A is wrong because Azure SQL Database is a PaaS service that does not support SQL Server Agent jobs, cross-database queries, or CLR integration at the same level as SQL Server, and it requires a private endpoint for VNet integration rather than native VNet injection. Option C is wrong because SQL Server on Azure Virtual Machine is an IaaS service, not a fully managed PaaS, requiring the customer to manage the OS, SQL Server patches, and backups. Option D is wrong because Azure Cosmos DB is a NoSQL database service that does not support SQL Server features like SQL Server Agent jobs, cross-database queries, or CLR integration, and it uses a different data model and API.

Full explanation →
102
MCQmedium

A manufacturing company is evaluating whether to migrate its on-premises workloads to Azure. The IT team calculates that the total cost of running the equivalent compute and storage resources in Azure is lower than operating its own datacenter. They attribute this cost advantage to the fact that Azure purchases servers, networking gear, and power in massive quantities and passes the savings on to customers by spreading the fixed costs across a vast number of tenants. This cost-saving benefit is a direct illustration of which cloud computing concept?

A.Economies of scale
B.Resource pooling
C.Measured service
D.Rapid elasticity
AnswerA

Correct. Economies of scale means the provider can reduce per-unit cost by buying and managing resources in large volumes, passing savings to customers.

Why this answer

The scenario describes a cost advantage that arises because Azure buys hardware and energy in bulk, reducing per-unit costs and spreading fixed expenses across many customers. This is the direct definition of economies of scale, a core cloud concept where large-scale operations lower the average cost per unit, enabling providers to offer services at a lower price than individual organizations could achieve on-premises.

Exam trap

The trap here is that candidates may confuse economies of scale with resource pooling, because both involve shared infrastructure, but economies of scale specifically addresses the cost reduction from large-scale purchasing and operations, not the multi-tenant sharing of resources.

How to eliminate wrong answers

Option B (Resource pooling) is wrong because resource pooling refers to the provider's ability to serve multiple customers from a shared pool of physical and virtual resources, dynamically assigning and reassigning them based on demand; it does not directly explain the cost reduction from bulk purchasing. Option C (Measured service) is wrong because measured service is about metering and billing for resource usage (e.g., pay-as-you-go), not about the underlying cost advantage from scale. Option D (Rapid elasticity) is wrong because rapid elasticity describes the ability to quickly scale resources up or down in response to demand, not the cost efficiency gained from large-scale procurement.

Full explanation →
103
MCQmedium

Which Azure service enables the creation of private endpoints so that Azure PaaS services like Storage and SQL Database are accessible only through a private IP within a VNet?

A.VNet Service Endpoints
B.Azure Private Link with Private Endpoints
C.Azure Firewall
D.Network Security Groups
AnswerB

Private Link creates a private endpoint with a VNet private IP for PaaS services, keeping traffic entirely off the public internet.

Why this answer

Azure Private Link with Private Endpoints is the correct service because it enables you to access Azure PaaS services (e.g., Storage, SQL Database) over a private IP address within your Virtual Network (VNet). This ensures traffic never traverses the public internet, as the private endpoint uses a network interface with a private IP from your VNet, mapping the PaaS service to your VNet.

Exam trap

The trap here is that candidates often confuse VNet Service Endpoints with Private Endpoints, not realizing that Service Endpoints still use the service's public endpoint (though with source network identity), while Private Endpoints provide a true private IP address within the VNet.

How to eliminate wrong answers

Option A is wrong because VNet Service Endpoints extend your VNet's identity to Azure services over the Microsoft backbone, but they do not assign a private IP to the service; traffic still uses the service's public endpoint, though it is routed via the Microsoft network. Option C is wrong because Azure Firewall is a managed, cloud-based network security service that filters traffic at the perimeter, not a mechanism to create private IP-based access to PaaS services. Option D is wrong because Network Security Groups (NSGs) filter traffic at the subnet or NIC level using rules, but they cannot assign a private IP to a PaaS service or change its endpoint from public to private.

Full explanation →
104
MCQmedium

A global e-commerce company has deployed its web application in two Azure regions: West US and East US. The company wants to automatically route end users to the region that provides the lowest latency, and if an entire region becomes unavailable, gracefully redirect all traffic to the remaining healthy region. Which Azure service should the company use?

A.Azure Load Balancer
B.Azure Application Gateway
C.Azure Traffic Manager
D.Azure Front Door
AnswerC

Azure Traffic Manager is a DNS-based traffic load balancer that works at the global level. It can route users to the endpoint with the lowest latency (performance routing) and automatically fail over to a different region if the primary endpoint is unhealthy.

Why this answer

Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming DNS requests to the endpoint with the lowest latency based on the user's geographic location. It also supports automatic failover: if an entire region becomes unavailable, Traffic Manager detects the endpoint health probe failure and redirects all traffic to the remaining healthy region, meeting the company's requirements.

Exam trap

The trap here is that candidates often confuse Azure Traffic Manager (DNS-based, global, multi-region) with Azure Load Balancer (regional, Layer 4) or Azure Front Door (global, Layer 7 with advanced features), failing to recognize that Traffic Manager is the simplest and most cost-effective service for DNS-level latency routing and regional failover without requiring HTTP/HTTPS traffic inspection.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and distributes traffic within a single region, not across multiple regions, and does not provide global latency-based routing or regional failover. Option B is wrong because Azure Application Gateway is a regional Layer 7 load balancer with features like SSL termination and URL-based routing, but it cannot route traffic between different Azure regions or perform global latency-based routing. Option D is wrong because Azure Front Door is a global Layer 7 service that does provide latency-based routing and regional failover, but it is designed for HTTP/HTTPS traffic with advanced features like web application firewall and SSL offload, making it more complex and expensive than needed for simple latency-based DNS routing; Traffic Manager is the simpler, DNS-based solution that directly matches the requirement.

Full explanation →
105
MCQeasy

Which of the following is an example of a SaaS (Software as a Service) offering from Microsoft?

A.Azure Virtual Machines
B.Azure App Service
C.Microsoft 365
D.Azure SQL Database
AnswerC

Microsoft 365 is SaaS — Microsoft manages everything; users just access the application.

Why this answer

Microsoft 365 is a SaaS offering because it provides ready-to-use productivity applications (e.g., Word, Excel, Teams) accessed via a web browser or client, with Microsoft managing the underlying infrastructure, operating system, and application updates. The customer simply consumes the software without needing to install or maintain servers or runtime environments.

Exam trap

The trap here is that candidates often confuse PaaS (like Azure App Service or Azure SQL Database) with SaaS, because both are 'managed' services, but PaaS still requires the customer to manage application code or database schemas, whereas SaaS provides a fully finished application ready for end-user consumption.

How to eliminate wrong answers

Option A is wrong because Azure Virtual Machines are an IaaS (Infrastructure as a Service) offering, providing virtualized compute resources where the customer manages the guest OS, middleware, and applications. Option B is wrong because Azure App Service is a PaaS (Platform as a Service) offering that provides a managed hosting environment for web applications, but the customer still deploys and manages their own application code and configuration. Option D is wrong because Azure SQL Database is a PaaS offering that provides a managed relational database engine, where Microsoft handles the underlying hardware and database software patching, but the customer is responsible for schema design, indexing, and query optimization.

Full explanation →
106
MCQmedium

What is the minimum Azure support plan that provides 24/7 access to technical support via phone and email?

A.Basic
B.Developer
C.Business
D.Enterprise
AnswerC

Business support provides 24/7 technical support via phone and email with severity-based response times.

Why this answer

The Business support plan is the minimum Azure support plan that provides 24/7 access to technical support via phone and email. Basic and Developer plans offer only web-based support with limited hours, while the Business plan includes unlimited severity-level incidents and round-the-clock phone and email support for production environments.

Exam trap

The trap here is that candidates often assume the Developer plan includes 24/7 phone support because it is the first paid tier, but it only offers business-hours web support, making Business the correct minimum for round-the-clock phone and email access.

How to eliminate wrong answers

Option A is wrong because the Basic support plan provides only billing and subscription support with no technical support access via phone or email. Option B is wrong because the Developer support plan offers technical support only during business hours via web (email/chat), not 24/7 phone access. Option D is wrong because the Enterprise support plan also provides 24/7 phone and email support, but it is not the minimum plan that does so; the Business plan is the lowest tier with that capability.

Full explanation →
107
MCQeasy

Which term describes the cloud's ability to quickly provision and de-provision resources to meet demand without human intervention?

A.High availability
B.Elasticity
C.Fault tolerance
D.Disaster recovery
AnswerB

Elasticity is the automatic, dynamic scaling of resources to match demand without human intervention.

Why this answer

Elasticity is the correct term because it specifically refers to the cloud's ability to automatically scale resources up or down in response to fluctuating demand, without requiring manual intervention. This is a core characteristic of cloud computing, enabling dynamic provisioning and de-provisioning of compute, storage, or network resources based on real-time metrics like CPU utilization or request count.

Exam trap

The trap here is that candidates often confuse elasticity with high availability, but high availability is about uptime and redundancy, not the ability to dynamically adjust capacity to match demand.

How to eliminate wrong answers

Option A is wrong because high availability focuses on ensuring that applications or services remain operational and accessible despite component failures, typically through redundancy and failover mechanisms (e.g., multiple availability zones), not on dynamic scaling to meet demand. Option C is wrong because fault tolerance is the ability of a system to continue operating without interruption when one or more components fail, often using redundant hardware or software, but it does not involve provisioning or de-provisioning resources based on demand. Option D is wrong because disaster recovery refers to the processes and policies for restoring IT infrastructure and data after a catastrophic event (e.g., natural disaster or cyberattack), not to the rapid scaling of resources in response to normal demand fluctuations.

Full explanation →
108
MCQmedium

Which Azure tool enables administrators to run PowerShell or Bash commands to manage Azure resources directly from a web browser without installing any tools locally?

A.Azure portal dashboard
B.Azure Cloud Shell
C.Azure DevOps
D.Azure Mobile App
AnswerB

Azure Cloud Shell provides browser-based Bash and PowerShell with Azure tools pre-installed and subscription authentication built in.

Why this answer

Azure Cloud Shell is a browser-accessible shell environment that provides both PowerShell and Bash interfaces, allowing administrators to run commands against Azure resources without any local installation. It authenticates automatically via the Azure portal session and includes pre-installed tools like Azure CLI, AzCopy, and kubectl, making it the correct answer for managing Azure resources directly from a web browser.

Exam trap

The trap here is that candidates confuse the Azure portal dashboard (a GUI) with Cloud Shell, thinking the dashboard itself can run commands, or they assume Azure DevOps (a CI/CD platform) provides a browser-based shell for ad-hoc management, when it does not.

How to eliminate wrong answers

Option A is wrong because the Azure portal dashboard is a customizable UI for viewing and managing Azure resources through graphical tiles and blades, not a command-line interface for running PowerShell or Bash commands. Option C is wrong because Azure DevOps is a set of development tools for CI/CD pipelines, boards, and repos, not a browser-based shell for ad-hoc Azure resource management. Option D is wrong because the Azure Mobile App provides monitoring and basic management via a mobile interface, but it does not offer a full PowerShell or Bash command-line environment.

Full explanation →
109
MCQmedium

A company wants to run a containerized application that responds to HTTP requests. They want to deploy it without managing any virtual machines or orchestration. Which Azure service is the simplest option?

A.Azure Kubernetes Service
B.Azure Container Instances
C.Azure Virtual Machines
D.Azure App Service
AnswerB

ACI runs containers on demand without any infrastructure management.

Why this answer

Azure Container Instances (ACI) is the simplest option because it allows you to run a containerized application directly in Azure without managing any underlying virtual machines or orchestration. ACI automatically starts the container, assigns a public IP address, and handles HTTP requests on port 80/443, making it ideal for event-driven or stateless workloads that need rapid deployment.

Exam trap

The trap here is that candidates often confuse Azure Container Instances with Azure Kubernetes Service, assuming that any container deployment requires orchestration, but ACI is specifically designed for simple, single-container workloads without orchestration overhead.

How to eliminate wrong answers

Option A is wrong because Azure Kubernetes Service (AKS) requires managing a Kubernetes cluster, including nodes, networking, and orchestration, which adds complexity beyond the stated requirement of no VM or orchestration management. Option C is wrong because Azure Virtual Machines require full OS management, patching, and scaling, which contradicts the desire to avoid managing VMs. Option D is wrong because Azure App Service, while simpler than VMs, still abstracts the container runtime and requires configuring a web app plan, scaling settings, and runtime stack, which is more complex than the direct container launch provided by ACI.

Full explanation →
110
MCQeasy

A company wants to enforce a naming convention on all Azure resources by automatically adding a tag with the environment name (e.g., 'Env-Prod' or 'Env-Dev') when a resource is created. They do not want to block resource creation if the tag is missing. Which Azure Policy effect should they use?

A.Deny
B.Audit
C.Append
D.DeployIfNotExists
AnswerC

The Append effect adds the specified tag and its value to the resource during creation, without blocking the creation.

Why this answer

The Append effect adds a specified tag (e.g., 'Env-Prod' or 'Env-Dev') to a resource during creation or update without blocking the operation. This matches the requirement to enforce a naming convention via tags automatically while allowing resource creation to proceed even if the tag is missing.

Exam trap

The trap here is confusing Append with DeployIfNotExists, as both can 'add' something, but Append modifies the resource inline during creation, while DeployIfNotExists deploys a separate resource (like a diagnostic setting) after the resource exists.

How to eliminate wrong answers

Option A is wrong because Deny blocks resource creation entirely if the condition is not met, which contradicts the requirement to not block creation. Option B is wrong because Audit only logs a compliance warning without adding the tag, so it does not enforce the naming convention automatically. Option D is wrong because DeployIfNotExists is used to deploy a resource (e.g., a Log Analytics agent) if it does not exist, not to add a tag to an existing resource during creation.

Full explanation →
111
MCQmedium

Which Azure feature enables organizations to review and recertify privileged role assignments on a scheduled basis?

A.Azure AD Privileged Identity Management role history
B.Azure AD Access Reviews
C.Azure RBAC audit logs
D.Azure Policy RBAC compliance
AnswerB

Access Reviews enable scheduled recertification of privileged roles and group memberships, removing uncertified access.

Why this answer

Azure AD Access Reviews allow administrators to configure periodic reviews of privileged role assignments, ensuring that only authorized users retain access. This feature directly supports recertification workflows by sending reviewers notifications and automatically removing stale assignments based on policy.

Exam trap

The trap here is confusing Azure AD Access Reviews (which handle scheduled recertification of identities) with Azure RBAC audit logs or Policy compliance, which focus on resource-level activity and configuration governance rather than identity lifecycle management.

How to eliminate wrong answers

Option A is wrong because Azure AD Privileged Identity Management role history provides an audit trail of past activations and changes, not a scheduled recertification process. Option C is wrong because Azure RBAC audit logs record who did what and when, but do not initiate or enforce periodic reviews of role assignments. Option D is wrong because Azure Policy RBAC compliance evaluates resource configurations against policies, not the recertification of user role assignments.

Full explanation →
112
MCQmedium

Which Azure security service provides a cloud-native firewall with built-in high availability and unrestricted cloud scalability?

A.Network Security Groups
B.Azure WAF
C.Azure Firewall
D.Azure DDoS Protection
AnswerC

Azure Firewall is a managed, stateful, cloud-native firewall with FQDN filtering, threat intelligence, and unlimited scalability.

Why this answer

Azure Firewall is a cloud-native, stateful firewall as a service that provides built-in high availability and scales automatically to accommodate changing network traffic patterns. Unlike other options, it is designed specifically as a managed firewall service with unrestricted cloud scalability, supporting both inbound and outbound traffic filtering at the network and application layers.

Exam trap

The trap here is that candidates often confuse Azure Firewall with Network Security Groups (NSGs) because both filter traffic, but NSGs lack the centralized management, built-in high availability, and automatic scaling that define Azure Firewall as a cloud-native firewall service.

How to eliminate wrong answers

Option A is wrong because Network Security Groups (NSGs) are a distributed, stateless (or stateful at layer 4) packet filtering mechanism that operates at the subnet or NIC level, not a centralized firewall service, and they lack built-in high availability and automatic scaling. Option B is wrong because Azure WAF (Web Application Firewall) is a layer 7 service that protects web applications from common exploits like SQL injection and XSS, but it is not a general-purpose firewall and does not provide network-layer filtering or unrestricted cloud scalability for all traffic types. Option D is wrong because Azure DDoS Protection is a mitigation service designed to protect against distributed denial-of-service attacks at layers 3 and 4, not a stateful firewall that controls normal traffic flows with allow/deny rules.

Full explanation →
113
MCQmedium

A company wants to ensure that their cloud provider's physical data centers are located in specific geographic areas to comply with data residency requirements. Which cloud concept is this related to?

A.Data sovereignty
B.Availability
C.Disaster recovery
D.Hybrid cloud
AnswerA

Correct. Data sovereignty deals with data being stored within specific geographic or legal boundaries, directly relating to choosing Azure regions for compliance.

Why this answer

Data sovereignty is the concept that data is subject to the laws and regulations of the country or region where it is physically stored. By ensuring their cloud provider's data centers are located in specific geographic areas, the company is directly addressing data sovereignty requirements to comply with local data residency laws, such as GDPR in Europe or the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada.

Exam trap

The trap here is that candidates often confuse data sovereignty with availability or disaster recovery, mistakenly thinking that geographic placement is about uptime or backup rather than legal jurisdiction and data residency compliance.

How to eliminate wrong answers

Option B is wrong because availability refers to the ability of a system to remain operational and accessible, typically measured by uptime percentages (e.g., 99.99%), and does not involve geographic placement for legal compliance. Option C is wrong because disaster recovery focuses on restoring IT infrastructure and data after a disruptive event (e.g., using Azure Site Recovery), not on the initial geographic location of data centers for regulatory purposes. Option D is wrong because hybrid cloud describes a combination of on-premises and public cloud environments (e.g., using Azure Arc), which is a deployment model, not a concept related to data residency or legal jurisdiction.

Full explanation →
114
MCQmedium

A company's CTO asks why Azure can offer services at lower costs than building an equivalent on-premises solution. Which cloud principle BEST explains this?

A.Elasticity
B.Economies of scale
C.High availability
D.Geo-distribution
AnswerB

Cloud providers achieve economies of scale by serving millions of customers, allowing them to buy infrastructure at lower per-unit costs and pass savings to customers.

Why this answer

Economies of scale is the correct answer because cloud providers like Azure operate massive, standardized data centers that serve millions of customers simultaneously. This allows them to negotiate bulk discounts on hardware, power, and cooling, and to spread fixed operational costs across a vast customer base, resulting in per-unit costs far lower than what a single company would pay for an equivalent on-premises deployment.

Exam trap

The trap here is that candidates often confuse elasticity (scaling to meet demand) with cost savings, but elasticity reduces waste from over-provisioning, not the fundamental unit cost of compute or storage, which is where economies of scale provide the primary cost advantage.

How to eliminate wrong answers

Option A is wrong because elasticity refers to the ability to automatically scale resources up or down based on demand, which reduces waste but does not directly explain the lower baseline cost of cloud services compared to on-premises. Option C is wrong because high availability ensures uptime through redundancy and failover mechanisms, which can actually increase costs due to duplicate infrastructure, not lower them. Option D is wrong because geo-distribution involves deploying resources across multiple geographic regions to reduce latency and improve resilience, but this typically adds cost for data replication and cross-region networking, rather than reducing overall expenditure.

Full explanation →
115
MCQmedium

A global company creates a new Azure subscription for each major project. To ensure compliance and consistency, the governance team needs a single, versioned, auditable package that, when assigned to a subscription, automatically deploys a standard set of Azure Policy assignments, role assignments, a resource group structure, and a pre-configured virtual network. The solution must allow these packages to be updated centrally and have changes tracked for auditing. Which Azure service should the governance team use?

A.Azure Policy
B.Azure Blueprints
C.Azure Resource Manager templates
D.Management groups
AnswerB

Azure Blueprints allows you to define a repeatable set of Azure resources and governance artifacts (policies, role assignments, resource groups, ARM templates) that can be assigned to subscriptions. Blueprints are versioned and auditable, ideal for a single package that enforces a standard environment.

Why this answer

Azure Blueprints is the correct service because it provides a single, versioned, auditable package that can be assigned to a subscription to orchestrate the deployment of Azure Policy assignments, role assignments, resource groups, and resource templates (like a virtual network). Blueprints support versioning and central update management, with changes tracked in the blueprint definition history for auditing. This aligns exactly with the requirement for a governance team to enforce compliance and consistency across subscriptions.

Exam trap

The trap here is that candidates often confuse Azure Blueprints with Azure Policy or ARM templates, failing to recognize that Blueprints uniquely combine multiple artifact types into a single, versioned, auditable package that can be centrally managed and updated across subscriptions.

How to eliminate wrong answers

Option A is wrong because Azure Policy is a service for creating, assigning, and managing individual policy rules that enforce compliance, but it cannot package multiple artifacts like role assignments, resource groups, or virtual networks into a single versioned, auditable deployment unit. Option C is wrong because Azure Resource Manager (ARM) templates are declarative JSON files that deploy resources, but they lack built-in versioning, central update management, and the ability to orchestrate policy and role assignments as a cohesive, auditable package with lifecycle tracking. Option D is wrong because Management groups are a hierarchical container for organizing and managing access, policy, and compliance across multiple subscriptions, but they do not provide a deployable, versioned package that includes resource templates, role assignments, or resource group structures.

Full explanation →
116
MCQeasy

A company traditionally purchased physical servers and networking equipment every three years, paying the full cost upfront. They are now migrating their workloads to Azure virtual machines. The finance team wants to understand the primary financial benefit of the new cloud model. Which statement best describes this benefit?

A.The company can stop paying for electricity and cooling because Azure includes those costs in the monthly bill.
B.The company can replace large upfront capital expenditures with variable monthly payments based on actual usage.
C.The company will pay a fixed monthly fee for each virtual machine, regardless of whether it is running or stopped.
D.The company can reduce its overall IT spending by 50% or more when moving to the cloud.
AnswerB

This correctly describes the consumption-based model (OpEx) of cloud computing. Instead of buying hardware every few years, you pay only for what you use, which improves cash flow and aligns costs with business activity.

Why this answer

Option B is correct because migrating from on-premises physical servers to Azure virtual machines shifts the cost model from Capital Expenditure (CapEx) — paying the full hardware cost upfront every three years — to Operational Expenditure (OpEx), where you pay only for the compute, storage, and network resources you actually consume on a monthly basis. This aligns costs directly with usage, avoiding large upfront investments and enabling better cash flow management.

Exam trap

The trap here is that candidates often confuse the 'pay-as-you-go' model with a simple reduction in total cost, when the actual exam focus is on the shift from CapEx to OpEx as the primary financial benefit of cloud computing.

How to eliminate wrong answers

Option A is wrong because while Azure does include the cost of electricity, cooling, and physical infrastructure in its pricing, the primary financial benefit of the cloud is not merely shifting utility costs; it is the fundamental change from CapEx to OpEx, which improves financial flexibility and reduces upfront risk. Option C is wrong because Azure virtual machines incur charges only when they are in a 'Running' state (allocated); stopped (deallocated) VMs do not incur compute charges, though storage costs for disks still apply — so a fixed monthly fee regardless of state is incorrect. Option D is wrong because there is no guaranteed 50% or more reduction in IT spending when moving to the cloud; actual savings depend on workload optimization, reserved instances, and usage patterns, and costs can sometimes increase if resources are not managed properly.

Full explanation →
117
MCQeasy

What is the primary purpose of Azure subscriptions?

A.To provide a private network for Azure resources
B.To serve as the billing unit and access boundary for Azure resources
C.To authenticate users accessing Azure resources
D.To enforce compliance policies across resource groups
AnswerB

Subscriptions are the billing unit for Azure and define the scope of resource management and access control.

Why this answer

Azure subscriptions serve as the primary billing unit, aggregating resource usage into a single invoice, and as an access boundary where Azure RBAC policies and management groups define administrative scope. Without a subscription, resources cannot be deployed or tracked for cost. This dual role makes B correct.

Exam trap

The trap here is confusing Azure subscriptions with Azure AD tenants or virtual networks, leading candidates to select authentication or networking options instead of recognizing the subscription's core role as a billing and access boundary.

How to eliminate wrong answers

Option A is wrong because a private network for Azure resources is provided by Azure Virtual Network (VNet), not by a subscription; subscriptions are administrative and billing containers, not network constructs. Option C is wrong because authentication of users accessing Azure resources is handled by Azure Active Directory (Azure AD), not by subscriptions; subscriptions rely on Azure AD for identity but do not perform authentication themselves. Option D is wrong because compliance policies are enforced via Azure Policy and management groups, not directly by subscriptions; subscriptions are the scope where policies are applied, but they do not enforce them.

Full explanation →
118
MCQmedium

A manufacturing company runs its proprietary production scheduling software on on-premises servers. The IT team also manages on-premises file servers. The company decides to move its email system to Microsoft 365 but keeps all other systems on-premises. Which cloud deployment model does this scenario best describe?

A.Private cloud
B.Public cloud
C.Hybrid cloud
D.Community cloud
AnswerC

Correct. A hybrid cloud combines on-premises infrastructure (or private cloud) with public cloud services. The company keeps its core on-premises systems and adds Microsoft 365 for email, creating a mixed environment that spans both private and public clouds.

Why this answer

This scenario describes a hybrid cloud because the company uses a mix of on-premises infrastructure (production scheduling servers and file servers) and a public cloud service (Microsoft 365 for email). In a hybrid cloud model, organizations integrate on-premises resources with public cloud services, allowing data and applications to be shared between them. Here, the email system runs in Microsoft's public cloud while all other systems remain on-premises, creating a hybrid deployment.

Exam trap

The trap here is that candidates often think hybrid cloud requires active data sharing or integration between on-premises and cloud, but the AZ-900 definition includes any mix of on-premises and public cloud resources, even if they are used independently.

How to eliminate wrong answers

Option A is wrong because a private cloud is dedicated to a single organization and hosted either on-premises or by a third-party provider, but here the email system is moved to Microsoft 365, which is a multi-tenant public cloud service, not a private cloud. Option B is wrong because a public cloud model would involve moving all workloads to a cloud provider like Azure or AWS, but the company keeps its production scheduling and file servers on-premises, so it is not fully public. Option D is wrong because a community cloud is shared by several organizations with common concerns (e.g., compliance or security requirements), and this scenario involves only one company using Microsoft 365, not a shared infrastructure among multiple entities.

Full explanation →
119
MCQmedium

A development team wants to deploy a microservices-based application using containers. They want to orchestrate the containers with automatic scaling and rolling updates, but they want to avoid managing the underlying infrastructure such as virtual machines. Which Azure compute service meets these requirements?

A.Azure Virtual Machines
B.Azure Container Instances
C.Azure Kubernetes Service (AKS)
D.Azure App Service
AnswerC

AKS provides managed Kubernetes orchestration with automatic scaling, rolling updates, and no need to manage the control plane or VMs.

Why this answer

Azure Kubernetes Service (AKS) is the correct choice because it provides a managed Kubernetes orchestration platform that handles container deployment, automatic scaling, and rolling updates while abstracting away the underlying virtual machine infrastructure. AKS manages the control plane for you, so you only need to manage the agent nodes (or use virtual nodes for serverless containers), meeting the requirement to avoid managing VMs directly.

Exam trap

The trap here is that candidates often confuse Azure Container Instances (ACI) with a full orchestration solution, but ACI lacks the automatic scaling and rolling update capabilities that AKS provides, making it unsuitable for complex microservices management.

How to eliminate wrong answers

Option A is wrong because Azure Virtual Machines require you to manage the OS, updates, and scaling manually, which contradicts the requirement to avoid managing underlying infrastructure. Option B is wrong because Azure Container Instances (ACI) is a serverless container service that does not provide built-in orchestration features like automatic scaling or rolling updates; it is designed for simple, single-container deployments. Option D is wrong because Azure App Service is a platform-as-a-service (PaaS) for hosting web applications, not designed for container orchestration with microservices; while it supports containers, it lacks native Kubernetes features such as pod-level scaling and rolling update strategies.

Full explanation →
120
Matchingmedium

Match each Azure service to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Serverless compute service

Workflow automation service

Event routing service

Message broker service

Simple message queue service

Why these pairings

These are common Azure services with distinct roles in compute and messaging.

Full explanation →
121
MCQmedium

A company plans to deploy a critical application across two Azure regions for disaster recovery. The compliance team requires that planned maintenance updates (such as OS patches to the underlying Azure infrastructure) must never be applied to both regions at the same time. The company also needs the data stored in the primary region to be automatically replicated to the secondary region. Which Azure architecture feature should the company rely on to meet the requirement of non-simultaneous updates?

A.Availability Zones
B.Region Pairs
C.Azure Resource Manager
D.Azure Traffic Manager
AnswerB

Correct. Each Azure region is paired with another region in the same geography (e.g., East US with West US). Microsoft serializes platform updates across the pair, so only one region in the pair receives updates at a time. This supports disaster recovery and meets the compliance requirement.

Why this answer

Region Pairs ensure that planned maintenance updates (e.g., OS patches) are applied to only one region in the pair at a time, with a minimum 300-minute stagger between updates. This design meets the compliance requirement for non-simultaneous updates while also supporting automatic geo-redundant storage replication from the primary to the secondary region.

Exam trap

The trap here is that candidates often confuse Availability Zones (which protect against datacenter failures within one region) with Region Pairs (which protect against region-wide failures and enforce staggered maintenance), leading them to incorrectly select Availability Zones for cross-region update sequencing.

How to eliminate wrong answers

Option A is wrong because Availability Zones provide fault tolerance within a single region by distributing resources across physically separate datacenters, but they do not span multiple regions and cannot guarantee non-simultaneous updates across regions. Option C is wrong because Azure Resource Manager is the management and deployment layer for Azure resources; it does not control the timing of infrastructure updates or provide cross-region update sequencing. Option D is wrong because Azure Traffic Manager is a DNS-based traffic load balancer that routes user traffic to endpoints based on routing methods; it does not manage or schedule platform maintenance updates.

Full explanation →
122
MCQhard

A multinational company runs a web application that must serve users from around the world with low latency. The application is deployed in multiple Azure regions. The company also requires built-in protection against distributed denial-of-service (DDoS) attacks at the network layer. The solution must automatically route users to the closest healthy endpoint based on geographic location. Which Azure service should the company use?

A.Azure Traffic Manager
B.Azure Load Balancer
C.Azure Application Gateway
D.Azure Front Door
AnswerD

Azure Front Door is a global, scalable entry point that uses Microsoft's global edge network to route users to the nearest healthy application endpoint based on latency or geography. It offers built-in DDoS protection at the network layer (L3/L4) as a standard feature, meeting both requirements.

Why this answer

Azure Front Door is correct because it provides global load balancing with automatic routing to the closest healthy endpoint based on geographic location (latency-based routing), and it includes built-in DDoS protection at the network layer (L3/L4) as part of the Azure infrastructure. This combination of global routing and integrated DDoS mitigation directly matches the requirements for a multinational application serving users worldwide.

Exam trap

The trap here is that candidates often confuse Azure Traffic Manager's DNS-based global routing with Azure Front Door's Anycast-based global routing, overlooking that Traffic Manager lacks built-in network-layer DDoS protection and that Front Door provides both global routing and integrated DDoS mitigation.

How to eliminate wrong answers

Option A is wrong because Azure Traffic Manager is a DNS-based global load balancer that routes traffic based on DNS queries, but it does not provide built-in DDoS protection at the network layer; it relies on separate Azure DDoS Protection plans. Option B is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and is regional, not global, so it cannot route users to the closest endpoint across multiple Azure regions. Option C is wrong because Azure Application Gateway is a regional Layer 7 load balancer with web application firewall (WAF) capabilities, but it lacks global routing and built-in network-layer DDoS protection; it also does not automatically route users based on geographic location.

Full explanation →
123
MCQmedium

A company needs to enforce compliance by deploying a standard set of Azure resources, policies, and RBAC assignments for each new development subscription. They want to define this environment as a repeatable package. Which Azure service should they use?

A.Azure Blueprints
B.Azure Policy
C.Azure Resource Manager Templates
D.Management Groups
AnswerA

Correct. Blueprints orchestrate deployment of resources, policies, and RBAC as a composable artifact.

Why this answer

Azure Blueprints is the correct service because it enables the orchestrated deployment of a repeatable, governed environment that includes resource templates, policies, and RBAC assignments as a single, versioned package. Unlike individual services, Blueprints coordinates these components together, ensuring compliance from the moment a new subscription is created.

Exam trap

The trap here is that candidates often confuse Azure Policy (which only enforces rules) with Azure Blueprints (which orchestrates policies, RBAC, and resources together), or they think ARM templates alone can handle governance, ignoring the need for policy and role assignments as part of a repeatable package.

How to eliminate wrong answers

Option B (Azure Policy) is wrong because it only enforces individual rules (e.g., allowed locations) but cannot deploy resources or assign RBAC roles as part of a repeatable package. Option C (Azure Resource Manager Templates) is wrong because they deploy infrastructure but do not natively include policy or RBAC assignments as a cohesive, versioned blueprint. Option D (Management Groups) is wrong because they provide hierarchical organization and policy inheritance across subscriptions but cannot define or deploy a standard set of resources, policies, and RBAC assignments as a repeatable package.

Full explanation →
124
MCQmedium

A company has several Azure subscriptions that contain hundreds of virtual machines. A new corporate standard requires that all VMs must use Azure managed disks instead of unmanaged disks. The governance team needs to automatically identify existing VMs with unmanaged disks and convert them to managed disks without requiring manual intervention for each VM. The team also wants to ensure that any new VMs created in the future automatically use managed disks. Which Azure feature should they use to meet both requirements?

A.Azure Blueprints
B.Azure Policy with the DeployIfNotExists effect (with remediation)
C.Azure Resource Manager (ARM) templates
D.Azure Cost Management + Budgets
AnswerB

Azure Policy with the 'DeployIfNotExists' effect automatically evaluates existing resources for compliance. When a non-compliant resource is found, a remediation task can execute a deployment to bring the resource into compliance (e.g., convert unmanaged disks to managed disks). The policy also applies to new resources, ensuring all future VMs use managed disks.

Why this answer

Azure Policy with the DeployIfNotExists effect can automatically identify VMs using unmanaged disks and, when combined with remediation tasks, convert them to managed disks without manual intervention. It also enforces that any new VMs are created with managed disks by evaluating and automatically deploying the required configuration at creation time. This meets both the identification/conversion of existing resources and the enforcement for future resources.

Exam trap

The trap here is that candidates often confuse Azure Policy's auditing capabilities (e.g., 'AuditIfNotExists') with its remediation capabilities, assuming that simply identifying non-compliant resources is sufficient, but the question explicitly requires automatic conversion, which only the DeployIfNotExists effect with remediation can achieve.

How to eliminate wrong answers

Option A is wrong because Azure Blueprints is used to orchestrate the deployment of resource groups, policies, role assignments, and ARM templates as a repeatable package, but it does not automatically identify and remediate existing non-compliant resources like unmanaged disks. Option C is wrong because ARM templates are infrastructure-as-code files used to deploy resources, but they cannot continuously monitor or automatically enforce compliance on existing or future VMs without manual execution or integration with other services. Option D is wrong because Azure Cost Management + Budgets is focused on monitoring, analyzing, and controlling cloud spending, not on enforcing technical configurations like disk types.

Full explanation →
125
MCQmedium

Which Azure service provides a cloud-native SIEM (Security Information and Event Management) solution for detecting and responding to threats?

A.Microsoft Defender for Cloud
B.Azure Monitor
C.Microsoft Sentinel
D.Azure DDoS Protection
AnswerC

Sentinel is Azure's cloud-native SIEM/SOAR solution for threat detection and automated response.

Why this answer

Microsoft Sentinel is the correct answer because it is a cloud-native SIEM (Security Information and Event Management) solution that provides intelligent security analytics and threat intelligence across the enterprise. It collects data from various sources, including Azure, on-premises, and other clouds, and uses built-in AI and machine learning to detect and respond to threats in real time.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud (a CSPM tool) with a SIEM, because both deal with security, but Defender for Cloud does not provide the log aggregation, event correlation, and threat hunting capabilities that define a SIEM like Microsoft Sentinel.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP), not a SIEM; it focuses on hardening configurations and providing security recommendations, not on aggregating and analyzing logs from multiple sources for threat detection. Option B is wrong because Azure Monitor is a monitoring and observability service for collecting metrics, logs, and diagnostics from Azure resources, but it lacks the SIEM capabilities of correlating security events, threat intelligence, and incident response workflows. Option D is wrong because Azure DDoS Protection is a dedicated network security service that mitigates Distributed Denial-of-Service attacks at the network layer (L3/L4), and it does not perform log aggregation, event correlation, or threat hunting across an enterprise.

Full explanation →
126
MCQmedium

A company runs an on-premises line-of-business application that uses a SQL Server database. The database currently has 500 GB of data and is accessed by 50 users simultaneously. The company is planning to migrate this database to Azure. The IT team wants to minimize administrative overhead for patching the operating system and database engine, and for performing automated backups with point-in-time restore. The team also wants the ability to scale compute and storage independently without managing virtual machines. Which Azure service should they choose?

A.Azure SQL Database (Platform-as-a-Service)
B.SQL Server on Azure Virtual Machine (Infrastructure-as-a-Service)
C.Azure Cosmos DB
D.Azure Database for MySQL
AnswerA

Correct. Azure SQL Database is a PaaS relational database that fully manages the underlying infrastructure, including automatic OS/engine patching and backups. It supports independent scaling of compute and storage, meeting all stated requirements.

Why this answer

Azure SQL Database is a Platform-as-a-Service (PaaS) offering that fully manages the underlying operating system and SQL Server engine, including patching and updates. It provides automated backups with point-in-time restore (up to 35 days retention) and allows independent scaling of compute (DTUs/vCores) and storage without any virtual machine management. This directly meets the team's requirements to minimize administrative overhead while supporting 500 GB of data and 50 concurrent users.

Exam trap

The trap here is that candidates often confuse the managed IaaS option (SQL Server on Azure VM) with PaaS, thinking it also automates patching and backups, but in reality, IaaS leaves all OS and DB engine maintenance to the customer.

How to eliminate wrong answers

Option B is wrong because SQL Server on Azure Virtual Machine (IaaS) requires the customer to manage the OS and SQL Server patches, backups, and VM scaling, which contradicts the goal of minimizing administrative overhead. Option C is wrong because Azure Cosmos DB is a NoSQL database designed for globally distributed, schema-less workloads, not for a SQL Server line-of-business application with a relational schema and T-SQL queries. Option D is wrong because Azure Database for MySQL is a managed MySQL database, not compatible with the existing SQL Server database engine, and would require application code changes to migrate from T-SQL to MySQL syntax.

Full explanation →
127
MCQeasy

Which Azure service provides the ability to test and debug Azure applications locally that interact with Azure services?

A.Azure DevTest Labs
B.Azurite (Azure Storage Emulator) and Azure Cosmos DB Emulator
C.Azure Local Network Gateway
D.Azure Cloud Shell local mode
AnswerB

Azurite and Cosmos DB Emulator enable local development and testing against emulated Azure services.

Why this answer

Azurite and the Azure Cosmos DB Emulator provide local emulation of Azure Blob Storage, Queue Storage, Table Storage, and Cosmos DB, enabling developers to test and debug applications that interact with these Azure services without incurring cloud costs or requiring network connectivity. This allows full offline development and debugging of Azure-dependent code.

Exam trap

The trap here is that candidates confuse Azure DevTest Labs (a cloud resource management tool) with local emulators, or assume that Azure Cloud Shell has a local mode for offline development, when in fact only dedicated emulators like Azurite and Cosmos DB Emulator provide true local testing of Azure service interactions.

How to eliminate wrong answers

Option A is wrong because Azure DevTest Labs is a service for creating managed environments for development and testing, not for local emulation of Azure services; it provisions actual Azure resources in the cloud. Option C is wrong because Azure Local Network Gateway is a VPN gateway component used to connect on-premises networks to Azure over Site-to-Site VPN, not a local emulator for testing applications. Option D is wrong because Azure Cloud Shell local mode does not exist; Cloud Shell is a browser-based shell in the Azure portal, and there is no 'local mode' for emulating Azure services.

Full explanation →
128
MCQhard

A company uses Azure SQL Database for a web application. They need to ensure that the database can automatically scale to handle sudden spikes in traffic without downtime. Which feature should they enable?

A.Geo-replication
B.Serverless compute
C.Active geo-replication
D.Elastic pool
AnswerB

Correct. Serverless compute auto-scales and is designed for intermittent usage patterns with spikes.

Why this answer

Serverless compute for Azure SQL Database automatically scales compute resources based on workload demand and pauses the database during idle periods, charging only for consumed resources. This enables handling sudden traffic spikes without downtime because the service dynamically adjusts the vCore count and memory within a configurable range, ensuring continuous availability during bursts.

Exam trap

The trap here is that candidates often confuse high-availability features (like geo-replication or elastic pools) with automatic compute scaling, but serverless compute is the only option that directly addresses dynamic scaling of compute resources without downtime for a single Azure SQL Database.

How to eliminate wrong answers

Option A is wrong because Geo-replication creates readable secondary replicas in different Azure regions for disaster recovery and read-scale, not for automatic scaling of compute resources. Option C is wrong because Active geo-replication is an enhanced version of geo-replication that supports manual failover for high availability, but it does not provide automatic scaling to handle traffic spikes. Option D is wrong because Elastic pool is used to manage and share resources among multiple databases with a fixed eDTU or vCore limit, which can handle variable usage patterns but does not automatically scale compute for a single database in response to sudden spikes without manual adjustment.

Full explanation →
129
MCQmedium

Which Azure feature automatically identifies and informs you of Azure service issues that may be affecting your resources in your region?

A.Azure Monitor resource health
B.Azure Service Health alerts
C.Azure Advisor notifications
D.Azure Policy compliance alerts
AnswerB

Service Health alerts notify you about Azure platform outages, degradation, and planned maintenance in your regions.

Why this answer

Azure Service Health provides personalized alerts when Azure service issues (outages, degraded performance) affect the services and regions you use. It distinguishes between broad platform issues, planned maintenance, and health advisories specific to your subscriptions.

Full explanation →
130
MCQmedium

Which Azure service acts as a cloud-based VPN gateway that enables secure site-to-site connectivity between an on-premises network and Azure virtual networks?

A.Azure ExpressRoute
B.Azure VPN Gateway
C.Azure Front Door
D.Azure Firewall
AnswerB

VPN Gateway creates encrypted site-to-site VPN tunnels for secure on-premises-to-Azure hybrid connectivity.

Why this answer

Azure VPN Gateway is the correct service because it is specifically designed to establish secure, encrypted site-to-site connectivity between an on-premises network and Azure virtual networks over the public internet using IPsec/IKE protocols. It acts as a cloud-based VPN endpoint that terminates VPN tunnels from on-premises VPN devices, enabling hybrid connectivity.

Exam trap

The trap here is that candidates often confuse Azure VPN Gateway with Azure ExpressRoute, mistakenly thinking ExpressRoute is a VPN service, when in fact ExpressRoute is a dedicated private connection that bypasses the internet entirely and does not use IPsec encryption.

How to eliminate wrong answers

Option A is wrong because Azure ExpressRoute provides dedicated private connectivity to Azure via a service provider, not over the public internet, and does not use VPN encryption; it is a Layer 3 private connection, not a VPN gateway. Option C is wrong because Azure Front Door is a global load balancer and application delivery controller that operates at Layer 7 (HTTP/HTTPS) for web traffic optimization and acceleration, not a VPN gateway for site-to-site connectivity. Option D is wrong because Azure Firewall is a managed network security service that filters traffic based on rules, but it does not terminate VPN tunnels or provide site-to-site connectivity; it is a stateful firewall, not a VPN gateway.

Full explanation →
131
Multi-Selectmedium

A company uses Azure Resource Manager templates to deploy and manage infrastructure. They need to ensure that resources are deployed in a consistent, repeatable manner across environments. Which two benefits does using ARM templates provide? (Choose two.)

Select 2 answers
A.Declarative syntax ensures that deployments are idempotent and repeatable.
B.Templates can be versioned and stored in source control alongside application code.
C.Templates automatically scale resources based on demand.
D.Templates are limited to a specific Azure region.
AnswersA, B

ARM templates are declarative, so deploying them multiple times results in the same state, ensuring consistency.

Why this answer

Option A is correct because ARM templates use declarative syntax, meaning you define the desired state of your infrastructure rather than scripting the steps to achieve it. This makes deployments idempotent: running the same template multiple times produces the same result, ensuring consistency across environments without side effects.

Exam trap

The trap here is that candidates may confuse ARM templates with auto-scaling capabilities, assuming templates can dynamically adjust resources, when in fact templates are static definitions and scaling requires separate Azure services like Autoscale or VMSS.

Full explanation →
132
MCQmedium

A cloud provider uses virtualization technology to host multiple customers on the same physical server. Each customer's data, applications, and operating systems are logically isolated and secured from one another. Which characteristic of cloud computing does this scenario best describe?

A.Resource pooling
B.Rapid elasticity
C.Measured service
D.On-demand self-service
AnswerA

Correct. Resource pooling (often called multi-tenancy) is the cloud characteristic where computing resources are pooled to serve multiple customers, with physical and virtual resources dynamically assigned and reassigned according to demand. Customers typically have no control over the exact physical location of the resources, but logical isolation ensures security.

Why this answer

This scenario describes resource pooling, where the provider's computing resources (such as storage, memory, and network bandwidth) are pooled to serve multiple customers using a multi-tenant model. Virtualization technology creates isolated virtual machines for each tenant, ensuring logical separation of data and applications while sharing the same physical hardware. This is a core characteristic of cloud computing as defined by NIST SP 800-145.

Exam trap

The trap here is that candidates often confuse resource pooling with rapid elasticity, thinking that 'pooling' implies dynamic scaling, but resource pooling specifically refers to the multi-tenant sharing of physical infrastructure, not the speed of resource allocation.

How to eliminate wrong answers

Option B (Rapid elasticity) is wrong because it refers to the ability to automatically scale resources up or down quickly based on demand, not the logical isolation of tenants on shared hardware. Option C (Measured service) is wrong because it involves metering resource usage for billing and optimization, typically via a pay-per-use model, not the multi-tenant isolation described. Option D (On-demand self-service) is wrong because it describes a user's ability to provision resources without human interaction, not the provider's internal architecture for sharing infrastructure.

Full explanation →
133
MCQmedium

A company has an on-premises data center with a site-to-site VPN connection to Azure. The company wants to ensure that the connection remains secure by encrypting all traffic between the on-premises network and Azure virtual network. The connection must be established over the public internet. Which Azure service should the company use to create this encrypted tunnel?

A.Azure ExpressRoute
B.Azure VPN Gateway
C.Azure Virtual WAN
D.Azure Bastion
AnswerB

Azure VPN Gateway is the correct answer. It creates a site-to-site VPN connection that encrypts traffic using IPsec/IKE protocols over the public internet. It is designed to securely connect on-premises networks to Azure virtual networks.

Why this answer

Azure VPN Gateway is the correct service because it creates an encrypted site-to-site VPN tunnel over the public internet using IPsec/IKE protocols. This meets the requirement for a secure connection between the on-premises data center and Azure virtual network over the public internet.

Exam trap

The trap here is that candidates often confuse Azure ExpressRoute as a secure option because it is private, but it does not encrypt traffic by default and does not use the public internet, which is explicitly required in the question.

How to eliminate wrong answers

Option A is wrong because Azure ExpressRoute provides a private, dedicated connection that does not traverse the public internet and does not natively encrypt traffic by default; it requires additional configurations like MACsec for encryption. Option C is wrong because Azure Virtual WAN is a networking service that can aggregate multiple VPN and ExpressRoute connections, but it is not the specific service for creating a single encrypted tunnel; it uses VPN Gateway instances under the hood. Option D is wrong because Azure Bastion is a fully managed PaaS service that provides secure RDP/SSH access to virtual machines within Azure, not a site-to-site VPN tunnel.

Full explanation →
134
MCQmedium

Which Azure service enables automated build and release pipelines triggered by code changes in a Git repository?

A.Azure Logic Apps
B.Azure Pipelines
C.Azure Resource Manager templates
D.Azure Automation runbooks
AnswerB

Azure Pipelines automatically builds, tests, and deploys code when changes are pushed to connected repositories.

Why this answer

Azure Pipelines is the correct service because it is specifically designed for continuous integration and continuous delivery (CI/CD), enabling automated build and test workflows that trigger on code changes in a Git repository. It supports multiple Git providers (e.g., GitHub, Azure Repos, Bitbucket) and can deploy to any target, making it the native DevOps solution for automating pipelines from source control commits.

Exam trap

The trap here is that candidates confuse Azure Pipelines (a CI/CD service) with Azure Logic Apps (an integration workflow service) because both involve 'automation' and 'triggers,' but Logic Apps cannot build or deploy code from Git repositories.

How to eliminate wrong answers

Option A is wrong because Azure Logic Apps is a low-code workflow automation service for integrating apps and data across enterprise systems (e.g., sending emails on new orders), not for building or deploying code from Git repositories. Option C is wrong because Azure Resource Manager (ARM) templates are declarative JSON files used to define and deploy Azure infrastructure (infrastructure as code), not to orchestrate build and release pipelines triggered by Git changes. Option D is wrong because Azure Automation runbooks execute PowerShell or Python scripts for routine operational tasks like VM start/stop or patch management, not for CI/CD pipeline execution triggered by code commits.

Full explanation →
135
MCQmedium

Which Azure service provides a centralized view of all Azure resources and their health status, showing which resources are healthy, degraded, or unavailable?

A.Azure Monitor
B.Azure Service Health
C.Azure Resource Health
D.Azure Advisor
AnswerC

Azure Resource Health shows the current and historical health of individual Azure resources and the cause of any availability issues.

Why this answer

Azure Resource Health is the correct answer because it provides a personalized dashboard that shows the health of your individual Azure resources, indicating whether they are available, degraded, or unavailable. Unlike Azure Service Health, which focuses on Azure service-wide outages, Resource Health gives a resource-by-resource view, including past health events and root cause analyses.

Exam trap

The trap here is confusing Azure Service Health (global service status) with Azure Resource Health (individual resource status), as both have 'Health' in their name and are often tested together to see if you understand the scope difference.

How to eliminate wrong answers

Option A is wrong because Azure Monitor is a comprehensive monitoring service that collects and analyzes telemetry data (metrics, logs) from resources, but it does not provide a centralized, at-a-glance health status of each resource as 'healthy', 'degraded', or 'unavailable'. Option B is wrong because Azure Service Health tracks the overall health of Azure services and regions, not individual resources; it alerts you to service-impacting events like outages or planned maintenance, but does not show per-resource health. Option D is wrong because Azure Advisor is a personalized recommendation engine that suggests best practices for cost, security, reliability, and performance, but it does not display the current health status of resources.

Full explanation →
136
MCQmedium

Which of the following is an example of a 'hybrid cloud' deployment?

A.Using only Azure for all company workloads
B.Running customer-facing applications on Azure while keeping sensitive HR data on on-premises servers
C.Using both Azure and AWS for different workloads
D.Storing data only in the cloud with no on-premises infrastructure
AnswerB

Hybrid cloud combines on-premises infrastructure for sensitive workloads with public cloud for others.

Why this answer

Option B is correct because a hybrid cloud deployment combines public cloud resources (Azure) with on-premises infrastructure, connected via technologies like VPNs or Azure ExpressRoute. Running customer-facing apps on Azure while keeping sensitive HR data on-premises exemplifies this blend, allowing organizations to maintain compliance or low latency for critical data while leveraging cloud scalability.

Exam trap

The trap here is confusing multi-cloud (using multiple public cloud providers) with hybrid cloud (public cloud plus on-premises/private cloud), leading candidates to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because using only Azure for all workloads is a public cloud deployment, not hybrid, as it lacks any on-premises or private cloud component. Option C is wrong because using both Azure and AWS is a multi-cloud deployment, not hybrid; hybrid specifically requires a mix of public cloud and on-premises/private cloud, not multiple public clouds. Option D is wrong because storing data only in the cloud with no on-premises infrastructure is a pure public cloud deployment, which excludes the on-premises element essential for hybrid.

Full explanation →
137
MCQmedium

Which Azure pricing option offers the GREATEST discount compared to pay-as-you-go pricing for a stable, predictable workload that will run continuously for one year?

A.Azure Spot VMs
B.Azure Reserved VM Instances
C.Azure Hybrid Benefit
D.Azure Dev/Test pricing
AnswerB

Reservations offer up to 72% discount for 1 or 3-year commitments, making them the best option for predictable, continuous workloads.

Why this answer

Azure Reserved VM Instances provide a significant discount (up to 72%) over pay-as-you-go pricing when you commit to a one-year or three-year term. For a stable, predictable workload that runs continuously for one year, this option offers the greatest savings because it is specifically designed for long-term, steady-state usage.

Exam trap

The trap here is that candidates often confuse Azure Hybrid Benefit with a direct discount on compute, but it only reduces software licensing costs, not the underlying VM compute rate, so it does not offer the greatest discount for a continuous workload.

How to eliminate wrong answers

Option A is wrong because Azure Spot VMs offer deep discounts but are designed for interruptible workloads and can be evicted at any time when Azure needs capacity, making them unsuitable for a continuous one-year workload. Option C is wrong because Azure Hybrid Benefit is a licensing benefit that allows you to use your existing on-premises Windows Server or SQL Server licenses with Software Assurance to reduce costs, but it does not inherently provide a discount on compute costs; it is often combined with Reserved Instances for maximum savings, not a standalone discount. Option D is wrong because Azure Dev/Test pricing offers discounted rates for development and testing environments, but it is not intended for production workloads and does not provide the greatest discount for a stable, predictable production workload running continuously for one year.

Full explanation →
138
MCQmedium

A company wants to query all Azure resources across multiple subscriptions to find all storage accounts without encryption enabled. They need to use a powerful query language to filter and join data. Which Azure tool should they use?

A.Azure Resource Graph
B.Azure Monitor Logs
C.Azure Advisor
D.Azure Policy
AnswerA

Resource Graph allows querying Azure resources at scale across subscriptions using KQL, perfect for discovering resources with specific configurations.

Why this answer

Azure Resource Graph (ARG) is the correct tool because it provides a powerful, Kusto Query Language (KQL)-based query engine that can explore Azure resources across multiple subscriptions, resource groups, and management groups. It allows you to filter, project, and join resource data (e.g., find all storage accounts where encryption is disabled) using a single query, making it ideal for cross-subscription resource discovery and compliance checks.

Exam trap

The trap here is confusing Azure Resource Graph (a resource inventory query tool) with Azure Monitor Logs (a telemetry and log analytics tool), as both use KQL but target fundamentally different data sources—resource properties vs. operational logs.

How to eliminate wrong answers

Option B (Azure Monitor Logs) is wrong because it is designed to collect and query telemetry data (logs and metrics) from Azure resources, not to query the resource inventory or configuration properties like encryption settings across subscriptions. Option C (Azure Advisor) is wrong because it provides personalized recommendations for best practices (e.g., cost, security, reliability) but does not offer a query language to filter or join resource data; it is a recommendation engine, not a query tool. Option D (Azure Policy) is wrong because it enforces rules and compliance on resources (e.g., auditing or denying non-encrypted storage accounts) but does not provide a query language to manually filter and join data across subscriptions; it uses policy definitions and assignments, not ad-hoc queries.

Full explanation →
139
MCQmedium

A company wants to track and manage costs across multiple Azure subscriptions. They have created a hierarchy of management groups: Root -> Department A -> Project 1, Project 2. They want to see the total cost for Department A across all its projects. Which Azure tool should they use?

A.Azure Policy
B.Cost Management + Billing
C.Azure Advisor
D.Azure Monitor
AnswerB

Cost Management + Billing allows you to analyze costs by subscription, resource group, or management group scope, providing roll-up cost data.

Why this answer

Cost Management + Billing is the correct tool because it provides consolidated cost tracking and analysis across multiple subscriptions and management groups. By organizing subscriptions under the Department A management group, Cost Management can aggregate costs from Project 1 and Project 2, allowing the company to view the total cost for Department A in a single dashboard or report.

Exam trap

The trap here is that candidates may confuse Azure Advisor's cost recommendations with actual cost tracking, or think Azure Monitor's metrics can provide billing data, but only Cost Management + Billing aggregates actual consumption costs across management groups and subscriptions.

How to eliminate wrong answers

Option A is wrong because Azure Policy is used to enforce organizational standards and assess compliance, not to track or analyze costs. Option C is wrong because Azure Advisor provides recommendations for optimizing Azure resources (e.g., cost, security, performance), but it does not offer cost tracking or aggregation across subscriptions. Option D is wrong because Azure Monitor collects and analyzes telemetry data (metrics, logs) for application and infrastructure health, not for financial cost management.

Full explanation →
140
MCQmedium

A startup runs a web application on Azure virtual machines. The application experiences sudden, short-lived spikes in traffic multiple times a day. The startup configures an autoscale rule that adds two additional VM instances when CPU usage exceeds 75% and removes them when CPU drops below 30%. This approach is designed to match resource consumption closely to demand. Which cloud computing characteristic does this scenario primarily demonstrate?

A.High Availability
B.Elasticity
C.Fault Tolerance
D.Durability
AnswerB

Elasticity is the cloud characteristic that enables resources to be automatically provisioned and de-provisioned in response to real-time workload changes. The autoscale rule that adds or removes VMs based on CPU usage directly embodies elasticity by ensuring resource consumption closely follows demand.

Why this answer

Elasticity is the ability of a cloud system to automatically scale resources up or down based on real-time demand. In this scenario, the autoscale rule dynamically adds two VM instances when CPU exceeds 75% and removes them when CPU drops below 30%, closely matching resource consumption to traffic spikes. This on-demand provisioning and de-provisioning of compute capacity is the defining characteristic of elasticity.

Exam trap

The trap here is that candidates often confuse elasticity with high availability, because both involve multiple instances, but elasticity is about scaling to meet demand while high availability is about maintaining uptime through redundancy.

How to eliminate wrong answers

Option A is wrong because High Availability focuses on ensuring application uptime through redundancy across fault domains or availability zones, not on dynamically scaling resources in response to load changes. Option C is wrong because Fault Tolerance refers to a system's ability to continue operating without interruption after a component failure, typically through redundant components that take over instantly, not through scaling based on CPU thresholds. Option D is wrong because Durability is a data storage characteristic that guarantees data will not be lost or corrupted over time, often through replication and backup mechanisms, and is unrelated to compute scaling.

Full explanation →
141
MCQmedium

A manufacturing company wants to process IoT sensor data locally at their factory floor to reduce latency before sending summarized data to the cloud. Which cloud computing concept does this represent?

A.Hybrid cloud
B.Edge computing
C.Public cloud
D.Disaster recovery
AnswerB

Edge computing processes data locally near the source (factory floor) to reduce latency before sending to the cloud.

Why this answer

Edge computing is the correct concept because it involves processing data near the source (the factory floor) rather than sending it to a centralized cloud data center. This reduces latency by performing initial analysis locally, with only summarized results transmitted to the cloud. The scenario explicitly describes local processing to minimize delay, which is the core purpose of edge computing.

Exam trap

The trap here is that candidates confuse hybrid cloud with edge computing, thinking that any on-premises component automatically implies hybrid cloud, but edge computing specifically focuses on local data processing for latency reduction, not just a mix of cloud and on-premises resources.

How to eliminate wrong answers

Option A is wrong because hybrid cloud refers to a combination of on-premises infrastructure and public cloud services, not specifically to local data processing at the edge to reduce latency. Option C is wrong because public cloud involves resources hosted off-site by a third-party provider, which would introduce higher latency for real-time IoT sensor data compared to local processing. Option D is wrong because disaster recovery is a business continuity strategy for restoring systems after a failure, not a concept for reducing latency through local data processing.

Full explanation →
142
MCQmedium

A company runs several virtual machines on Azure that are hosted on physical servers shared with other customers. The company is concerned that another customer's high workload ('noisy neighbor') could degrade their own application performance. However, Azure's infrastructure ensures that each virtual machine receives a dedicated allotment of CPU and memory resources, and performance remains consistent regardless of the activity of other tenants. Which characteristic of cloud computing does this scenario best illustrate?

A.Measured service
B.Rapid elasticity
C.Resource pooling
D.On-demand self-service
AnswerC

Resource pooling is the correct answer. The physical servers are pooled to serve multiple customers, but Azure's hypervisor and resource governance ensure that each virtual machine gets its own guaranteed resources, demonstrating the isolation aspect of resource pooling.

Why this answer

Resource pooling is the correct answer because it describes how Azure's multi-tenant architecture allows physical resources (CPU, memory, storage, network) to be shared among multiple customers while ensuring each virtual machine receives a dedicated allocation of resources. This isolation prevents a 'noisy neighbor' scenario from degrading performance, as each VM's resource allotment is guaranteed regardless of other tenants' activity.

Exam trap

The trap here is that candidates confuse 'resource pooling' with 'rapid elasticity' because both involve shared resources, but resource pooling focuses on multi-tenant isolation and dedicated allocation, not dynamic scaling.

How to eliminate wrong answers

Option A is wrong because measured service refers to the metering and billing of cloud resource usage (e.g., pay-as-you-go), not the isolation or allocation of resources to prevent performance interference. Option B is wrong because rapid elasticity describes the ability to quickly scale resources up or down based on demand, not the dedicated resource assignment that mitigates noisy neighbor issues. Option D is wrong because on-demand self-service allows users to provision resources without human intervention, but it does not address how resources are allocated or isolated among tenants.

Full explanation →
143
MCQeasy

What is Azure Active Directory (Azure AD)?

A.A domain controller service for on-premises Active Directory
B.A cloud-based identity and access management service
C.A firewall service for protecting Azure resources
D.A virtual private network for connecting to Azure
AnswerB

Azure AD is Microsoft's cloud IAM service providing authentication, SSO, and authorization for cloud and SaaS applications.

Why this answer

Azure Active Directory (Azure AD) is Microsoft's cloud-based identity and access management (IAM) service. It provides authentication and authorization for users, applications, and resources in the cloud, supporting protocols like OAuth 2.0, OpenID Connect, and SAML. Unlike on-premises Active Directory, Azure AD is a multi-tenant, directory-as-a-service platform designed for cloud and hybrid scenarios.

Exam trap

The trap here is that candidates confuse Azure AD with on-premises Active Directory, assuming it is simply a cloud-hosted version of the same directory service, when in fact Azure AD is a fundamentally different identity platform focused on web-based authentication and authorization.

How to eliminate wrong answers

Option A is wrong because Azure AD is not a domain controller service for on-premises Active Directory; it is a cloud-based identity service that can integrate with on-premises AD via Azure AD Connect, but it does not replace domain controllers or provide LDAP/Kerberos authentication for on-premises resources. Option C is wrong because Azure AD is not a firewall service; Azure Firewall or Network Security Groups (NSGs) provide firewall capabilities for protecting Azure resources. Option D is wrong because Azure AD is not a virtual private network; Azure VPN Gateway or Azure Virtual WAN provide VPN connectivity to Azure.

Full explanation →
144
MCQhard

A global e-commerce platform runs on Azure App Service in multiple regions. They need to route user traffic to the nearest region based on geographic location, and also provide automatic failover if a region becomes unavailable. Which Azure service includes these capabilities with integrated Web Application Firewall (WAF)?

A.Azure Traffic Manager
B.Azure Front Door
C.Azure Application Gateway
D.Azure Load Balancer
AnswerB

Front Door provides global load balancing, geographic routing, failover, and integrated WAF.

Why this answer

Azure Front Door is a global, scalable entry point that uses the Microsoft global edge network to route user traffic to the nearest region based on geographic location (latency-based routing) and provides automatic failover across regions. It natively integrates Web Application Firewall (WAF) at the edge, protecting against common web exploits like SQL injection and cross-site scripting, making it the correct choice for this scenario.

Exam trap

The trap here is that candidates often confuse Azure Traffic Manager's DNS-based global routing with Azure Front Door's application-layer global routing and WAF integration, assuming Traffic Manager can also provide WAF protection, which it cannot.

How to eliminate wrong answers

Option A is wrong because Azure Traffic Manager is a DNS-based traffic router that directs traffic based on DNS queries and does not provide integrated Web Application Firewall (WAF) capabilities; it also lacks HTTP/HTTPS-level inspection and cannot inspect application-layer traffic. Option C is wrong because Azure Application Gateway is a regional load balancer that operates within a single Azure region and does not provide global geographic routing or automatic cross-region failover; while it supports WAF, it cannot route users to the nearest region globally. Option D is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and does not include WAF capabilities, nor does it support geographic routing or application-layer inspection.

Full explanation →
145
MCQmedium

A retail company runs an e-commerce application on Azure virtual machines. Traffic follows a predictable daily pattern: peak load occurs from 9 AM to 5 PM on weekdays. To handle this, the company configures an Azure autoscale rule that adds virtual machines at 8:30 AM and removes them at 5:30 PM each weekday. This scenario best demonstrates which cloud computing characteristic?

A.High availability
B.Elasticity
C.Agility
D.Fault tolerance
AnswerB

Elasticity is the correct concept. Azure autoscale automatically adds or removes resources (VMs) based on defined rules or schedules to match workload demand. Here, the predictable daily pattern triggers scheduled scaling, which is a classic implementation of elasticity.

Why this answer

Elasticity is the ability to dynamically scale resources up or down to match demand. In this scenario, the autoscale rule adds VMs at 8:30 AM to handle the predictable peak load and removes them at 5:30 PM, demonstrating automatic resource provisioning and de-provisioning based on a schedule. This is a textbook example of elasticity in cloud computing.

Exam trap

The trap here is confusing elasticity with high availability: candidates often pick 'high availability' because they see multiple VMs being added, but the key is the scheduled scaling in response to predictable load, not redundancy for uptime.

How to eliminate wrong answers

Option A is wrong because high availability refers to ensuring application uptime through redundancy (e.g., multiple VMs in an availability set), not scaling based on load patterns. Option C is wrong because agility refers to the speed of deploying and iterating on resources (e.g., spinning up a new VM in minutes), not the automatic scaling behavior shown here. Option D is wrong because fault tolerance is the ability to continue operating without interruption after a component failure (e.g., using Azure Site Recovery), not the scheduled addition and removal of resources.

Full explanation →
146
MCQmedium

Which Azure service provides a fully managed, cloud-based data integration service for creating data-driven workflows?

A.Azure Synapse Analytics
B.Azure Data Factory
C.Azure Databricks
D.Azure Stream Analytics
AnswerB

Data Factory is the managed ETL service for creating data-driven pipelines that move and transform data.

Why this answer

Azure Data Factory (ADF) is a fully managed, cloud-based data integration service that allows you to create, schedule, and orchestrate data-driven workflows (pipelines). It supports over 90 built-in connectors to ingest, transform, and move data across on-premises and cloud sources, making it the correct choice for this scenario.

Exam trap

The trap here is confusing Azure Data Factory with Azure Synapse Analytics, as both involve data movement and transformation, but Synapse is primarily a unified analytics platform (data warehouse + big data), not a dedicated integration service for creating workflows.

How to eliminate wrong answers

Option A is wrong because Azure Synapse Analytics is an analytics service that combines big data and data warehousing, not a dedicated data integration service for creating workflows. Option C is wrong because Azure Databricks is an Apache Spark-based analytics platform for big data processing and machine learning, not a managed data integration service. Option D is wrong because Azure Stream Analytics is a real-time event processing engine for analyzing streaming data, not a service for orchestrating batch or scheduled data-driven workflows.

Full explanation →
147
MCQmedium

A company currently runs its application on-premises in a data center. The IT manager calculates that the cost per server per month is approximately $200 when considering hardware depreciation, electricity, cooling, and staff. The company is considering moving to Azure and discovers that Azure can provision the same server capacity for $150 per month, but only if the company commits to a three-year reservation. Which cloud concept best explains why Azure can offer a lower price even with the reservation commitment?

A.Rapid elasticity
B.Economies of scale
C.High availability
D.Measured service
AnswerB

Economies of scale is the correct concept. Cloud providers purchase hardware, electricity, and bandwidth in massive volumes, reducing their per-unit costs far below what a typical organization can achieve. These savings are passed to customers, even with reserved pricing.

Why this answer

Azure can offer a lower price for a three-year reserved instance because of economies of scale. Microsoft operates massive, globally distributed data centers that purchase hardware, power, and cooling in bulk, significantly reducing per-unit costs. This cost advantage is passed to customers who commit to longer-term reservations, as the provider can better predict and optimize resource utilization.

Exam trap

The trap here is that candidates confuse 'reservation' with 'reserved capacity' and assume the discount comes from the commitment itself, rather than understanding that the underlying cost advantage is driven by economies of scale at the provider level.

How to eliminate wrong answers

Option A is wrong because rapid elasticity refers to the ability to automatically scale resources up or down in response to demand, not to cost reductions from long-term commitments. Option C is wrong because high availability describes the ability of a system to remain operational despite failures, typically achieved through redundancy and SLAs, not through pricing discounts. Option D is wrong because measured service is the capability to track and bill resource usage (metering), which enables pay-as-you-go models but does not inherently explain lower prices from reservation commitments.

Full explanation →
148
MCQmedium

A company hosts a critical line-of-business application on Azure virtual machines. The application must remain available even if a single virtual machine fails due to hardware failure or operating system crash. The company deploys two virtual machines in an Availability Set and configures an Azure Load Balancer to distribute traffic. If one VM becomes unavailable, the Load Balancer automatically redirects traffic to the healthy VM. This configuration primarily demonstrates which benefit of cloud computing?

A.Elasticity – ability to scale resources up and down
B.Reliability – ability to recover from failures and continue functioning
C.Security – protection against unauthorized access
D.Cost efficiency – paying only for consumed resources
AnswerB

Correct. The use of an Availability Set and Load Balancer ensures that the application can tolerate the failure of a single VM and continue serving traffic. This is a direct example of reliability, a key benefit of cloud computing.

Why this answer

This configuration demonstrates reliability, a core cloud computing benefit, because the combination of an Availability Set and Azure Load Balancer ensures that the application remains operational even when a single VM fails due to hardware or OS issues. The Availability Set spreads VMs across fault domains and update domains to isolate failures, while the Load Balancer uses health probes to detect VM unavailability and redirect traffic only to healthy instances. This built-in redundancy and automatic failover capability directly aligns with the cloud's promise of high availability and fault tolerance.

Exam trap

The trap here is that candidates confuse reliability (the ability to recover from failures and continue functioning) with elasticity (scaling), because both involve multiple VMs, but the key distinction is that reliability focuses on fault tolerance and automatic failover, not dynamic scaling based on load.

How to eliminate wrong answers

Option A is wrong because elasticity refers to the ability to automatically scale resources up or down based on demand, such as adding more VMs during peak traffic, not to maintaining availability during a failure. Option C is wrong because security involves protecting resources through measures like network security groups, encryption, or Azure Active Directory, which are not part of the described failover configuration. Option D is wrong because cost efficiency relates to the pay-as-you-go model and optimizing resource usage to reduce expenses, not to the redundancy and automatic recovery provided by the Availability Set and Load Balancer.

Full explanation →
149
MCQmedium

A company uses Azure Policy to enforce governance rules across its subscriptions. The governance team wants to ensure that every resource in the 'Production' subscription has a tag named 'Environment' with the value 'Production'. If a resource is created without this tag, or with a different value, the tag must be automatically corrected to 'Production' without blocking the creation of the resource. Which Azure Policy effect should the team configure?

A.Deny
B.Audit
C.Append
D.Modify
AnswerD

The Modify effect is designed to add, update, or remove properties of a resource to ensure compliance. It can automatically correct tag values (e.g., set 'Environment' to 'Production') even if the user provides a different value, without blocking the resource creation. This matches the requirement exactly.

Why this answer

The Modify effect is correct because it automatically applies the required tag value to resources during creation or update without blocking the operation. Unlike Append, which only adds tags to new resources but cannot change existing values, Modify can alter both new and existing resources to enforce the desired tag value. This ensures that any resource created without the 'Environment' tag or with a different value is automatically corrected to 'Production'.

Exam trap

The trap here is confusing Append with Modify: Append only adds missing tags but cannot change existing values, while Modify can both add and change tags, making it the correct choice for enforcing a specific value.

How to eliminate wrong answers

Option A (Deny) is wrong because it would block the creation of any resource that does not have the correct tag, which contradicts the requirement to allow creation and automatically correct the tag. Option B (Audit) is wrong because it only logs non-compliant resources without taking any automatic corrective action. Option C (Append) is wrong because it can only add a tag if it is missing, but it cannot modify an existing tag that has a different value, so a resource created with 'Environment=Dev' would remain non-compliant.

Full explanation →
150
MCQmedium

A company uses Azure Policy to require that all storage accounts must have blob soft delete enabled. They also want to automatically create a remediation task that fixes any existing non-compliant storage accounts. Which policy effect should they include in the policy definition to achieve automatic remediation?

A.Deny
B.Audit
C.DeployIfNotExists
D.Append
AnswerC

DeployIfNotExists creates a remediation task that deploys a configuration to make existing resources compliant. It is designed for automatic remediation of non-compliant resources.

Why this answer

The DeployIfNotExists effect is designed to automatically remediate non-compliant resources by deploying a defined template (e.g., enabling blob soft delete) when the resource is evaluated as non-compliant. This effect triggers a remediation task that can be run on existing resources, ensuring all storage accounts meet the policy requirement without manual intervention.

Exam trap

The trap here is that candidates confuse 'Audit' (which only reports) with 'DeployIfNotExists' (which actually fixes), or assume 'Deny' can retroactively fix existing resources, when it only blocks new non-compliant changes.

How to eliminate wrong answers

Option A is wrong because Deny only prevents creation or modification of non-compliant resources but does not fix existing non-compliant resources. Option B is wrong because Audit only logs compliance status without taking any action to remediate non-compliant resources. Option D is wrong because Append adds fields to a resource during creation or update but cannot modify existing resources or enable features like blob soft delete retroactively.

Full explanation →
Page 1

Page 2 of 14

Page 3

All pages

1234567891011121314

Practice AZ-900 by domain

Target a specific domain to shore up weak areas.

Describe cloud conceptsDescribe Azure architecture and servicesDescribe Azure management and governance
See all domains with question counts →