CCNA Describe Azure architecture and services Questions

The Archive tier is designed specifically for long-term retention of data that is accessed rarely, offering the lowest per-gigabyte storage cost among Azure Blob Storage tiers. Because these backups must be kept for 7 years and are unlikely to be read regularly, the retrieval latency of up to several hours (via rehydration) is acceptable. This makes Archive the most cost-effective and correct choice for meeting the retention requirement while minimizing expenditure.

Azure VM Auto-Shutdown lets you configure a daily fixed time when the virtual machine is automatically powered off and deallocated. This stops compute-hour billing (vCPU and instance usage) while leaving the VM's disks, IP, and configuration intact, which is why it is primarily used in dev/test workloads to cut costs overnight. It does not delete anything or adapt to performance demands; it simply schedules a hard stop and deallocation each day.

Application Gateway provides layer 7 load balancing with URL routing, session affinity, SSL termination, and WAF.

Azure region pairs are designed to satisfy both geo-redundancy and data residency: each pair consists of two regions within the same geography, typically at least 300 miles apart, and together they support features such as GRS/RA-GRS. When one region experiences an outage, traffic and data can fail over to the paired region, and Azure coordinates planned maintenance by sequentially updating paired members.

Azure Database for PostgreSQL is the correct answer because it is a fully managed Platform-as-a-Service (PaaS) offering that runs the open-source PostgreSQL engine. It provides built-in features such as automatic backups, point-in-time restore, high availability, and automated patching, with no administrative overhead. The service supports PostgreSQL's native wire protocol, extensions, and tools, making it directly compatible with existing PostgreSQL applications. This aligns exactly with the need for a managed PostgreSQL database in Azure.

Azure Kubernetes Service (AKS) is a managed container orchestration platform built on the open-source Kubernetes engine. It fully manages the control plane and abstracts the underlying virtual machines, allowing you to focus on deploying, scaling, and managing containerized microservices as a cohesive cluster. AKS provides essential orchestration primitives like pod scheduling, service discovery, load balancing, and automated rollouts/rollbacks, which are critical for running a distributed microservices architecture. Its built-in integration with Azure Active Directory, monitoring, and virtual networking makes it the appropriate choice for production-grade microservices deployments.

Azure Container Apps is a serverless container platform designed specifically for running full containerized applications and microservices without managing Kubernetes infrastructure. It natively integrates with KEDA (Kubernetes Event-driven Autoscaling) and supports true scale-to-zero, meaning a revision can have zero replicas when no events are incoming and automatically scale out in response to HTTP requests, queue messages, or custom triggers. It also provides built-in service discovery, Dapr integration, and revision-based versioning, making it the correct choice for event-driven containerized workloads that need to pause entirely when idle.

Azure Virtual WAN is a managed networking service that builds a global hub-and-spoke architecture, connecting branch offices, data centers, and remote users through Microsoft's backbone rather than the public internet. It integrates SD-WAN, site-to-site VPN, ExpressRoute, and dynamic routing into a single control plane, automatically optimizing network paths and minimizing costs. Because it provides an any-to-any transit network across regions, it is the service purpose-built for WAN-scale branch connectivity.

Correct. AKS provides a managed Kubernetes environment, automating orchestration, scaling, and updates.

SQL Server Always On availability groups are a built-in SQL Server feature that operates at the database level by maintaining synchronous or asynchronous replicas of the database and using a Windows Server Failover Clustering health model to detect and automatically fail over the primary replica. Running on Azure VMs gives the full SQL Server engine feature set, including automatic failover, a virtual network listener for transparent client reconnection, and optional secondary replica read-only routing. This exactly matches the requirement for automatic failover and load balancing for SQL Server databases on Azure VMs.

Azure Blob Storage is an object storage service designed for massive scale of unstructured data, including billions of image files. It provides native HTTP/HTTPS REST endpoints, allowing any application or client to access individual blobs via a direct URL. Combined with features like geographic redundancy, lifecycle management, and CDN integration, it delivers the high durability, availability, and performance required for internet-scale image serving.

Azure App Service is a fully managed PaaS for web apps that supports autoscaling based on CPU utilization, and Microsoft manages the infrastructure. Azure SQL Database is a fully managed relational database with built-in HA and automatic backups, minimizing administrative overhead.

An availability set is correct for protecting against failures within a single datacenter because it logically groups VMs across fault domains (shared power and network racks) and update domains (maintenance schedules). This distribution ensures that during unplanned hardware rack failures or Azure-initiated planned maintenance, at least one VM remains available. However, an availability set does not survive a complete datacenter outage, as all VMs in the set reside in the same datacenter.

Azure Virtual Network Peering directly links two VNets over the Microsoft backbone, enabling private IP address traffic between them without going through the internet or a VPN gateway. It supports cross-region (global) peering and can connect VNets in different subscriptions or Azure Active Directory tenants. This makes it the native, low-latency solution for interconnecting virtual networks within Azure.

Azure Virtual Desktop (AVD) is the correct choice because it is Microsoft's dedicated desktop and app virtualization service, running on Azure. It delivers a full Windows desktop experience and remote applications to any device via the Remote Desktop Protocol (RDP) or a modern browser, using Windows 10/11 Enterprise multi-session or Windows Server. AVD provides centralized management, identity-based access through Azure AD, and built-in security features like conditional access, making it the only option here that natively matches the stated requirement for Windows desktops and applications.

The Archive access tier is the correct choice for 10-year archival because it offers the lowest storage cost of all Azure Storage tiers, specifically designed for data that is rarely accessed. Retrieval can take up to several hours and incurs a higher access charge, but for long-term compliance or backup data that will almost never be read, that trade-off is acceptable. Archive also has a minimum retention period of 180 days, which aligns well with a 10-year requirement.

Memory-optimized M-series and E-series VMs are specifically built to support very large memory footprints, offering high memory-to-CPU ratios and RAM capacities ranging from hundreds of GiB to multiple terabytes. These families are certified for SAP HANA, in-memory analytics, and large relational databases because they provide the RAM capacity and memory bandwidth to keep entire datasets resident in memory. This design ensures the SQL Pool or SAP workloads can run without constant disk reads, delivering the low-latency query performance expected from a memory-intensive deployment.

ExpressRoute is the correct choice because it provides a dedicated, private connection between your on-premises network and Azure, completely bypassing the public internet. This delivers higher and more consistent bandwidth, lower and predictable latency, and an availability SLA — all critical for a latency-sensitive trading application. The connection is established through a service provider over a private MPLS circuit, ensuring that traffic never traverses the public internet, which also enhances security and reliability.

Availability Zones are unique physical locations with independent power, cooling, and networking within an Azure region, creating fault isolation from a datacenter-scale failure. By deploying resources across multiple zones, an application can continue operating if one entire datacenter is disrupted, which is the core high-availability benefit these zones provide. This is why Availability Zones are the correct answer for protecting against datacenter-level failures within a region.

Azure SQL Database is the correct fully managed PaaS option for SQL Server workloads. Microsoft handles the underlying infrastructure, operating system, SQL Server patches, built-in high availability, automatic backups, and point-in-time restore, so you only manage the database schema and data. It is the direct service-level answer for running SQL Server without managing virtual machines.

Azure Region Pairs are two regions within the same Azure geography that are deliberately paired for disaster recovery and replication. Each pair is separated by a significant distance (often 300+ miles), enabling data redundancy and automatic failover across regions during a disaster. Microsoft also uses these pairs to sequence platform updates, reducing the chance of simultaneous downtime. This direct pairing for business continuity makes Region Pairs the correct answer.

Azure Application Gateway is a layer 7 HTTP/HTTPS load balancer that provides cookie-based session affinity (sticky sessions) and health probes. It can distribute traffic across virtual machines in the same region and automatically stop sending traffic to an unhealthy machine.

Azure Traffic Manager is the correct answer because it operates at the DNS layer, resolving domain names to the best available endpoint based on routing methods such as performance, failover, geographic, weighted, or multi-value. It does not sit in the data path; instead, it returns an IP address to the client's DNS resolver, making it a true global DNS-based load balancer. This contrasts with regional or layer 7 services that inspect traffic or terminate connections.

Azure Application Gateway is a regional, layer 7 (HTTP/HTTPS) load balancer that can route client traffic to backend Azure VMs based on URL path rules, such as sending /images to one pool and /api to another. It performs TLS termination (SSL offloading) at the gateway, offloading cryptographic overhead from the VMs and centralizing certificate management. This directly meets the stated requirements of intra-region traffic distribution and URL-based routing, making it the correct service for this scenario.

Azure Blob Storage lifecycle management policies are a native, declarative feature that lets you define JSON rules to automatically move blobs between access tiers (hot, cool, or archive) based on criteria such as age in days, last modified time, or last accessed time. The rules run continuously and apply to both existing and newly uploaded blobs without any custom code or external orchestration. This directly satisfies the requirement to transition historical sales data to a cooler tier after 30 days, as it is a fully managed, time-based automation.

Azure Batch is the correct service because it is purpose-built for HPC-grade job scheduling and large-scale parallel and scientific computing. It creates and manages a pool of virtual machines, automatically scales them based on the number of queued tasks, and schedules work across hundreds or thousands of cores. Batch supports MPI workloads, GPU-enabled VMs, and both Linux and Windows operating systems, along with task dependencies, retries, and timeout constraints. It decouples the job submission layer from the underlying compute pool, allowing you to run massive simulations, rendering, or genomic analysis in a managed way.

Automatic failover groups are the correct DR mechanism for Azure SQL Database because they provide automatic, transparent failover to a secondary replica in a paired region. They maintain a readable secondary, manage replication at the database or elastic pool level, and expose a listener endpoint so applications can reconnect without manual intervention or connection string changes. This directly satisfies the requirement for automatic failover in a multi-tier disaster recovery solution.

Azure Kubernetes Service (AKS) is Azure's managed Kubernetes offering, which abstracts the control plane and manages the worker node VMs as part of the cluster. It provides built-in capabilities such as horizontal pod autoscaling, cluster autoscaling, service discovery via DNS, and self-healing, so you don't directly provision or patch underlying VMs. By defining desired state in Kubernetes manifests, AKS continuously reconciles the cluster, making it the correct choice for running a containerized application without managing VMs.

Azure VPN Gateway is a virtual network gateway that sends encrypted traffic between an Azure virtual network and an on-premises location over the public internet. It supports IPsec/IKE site-to-site VPN tunnels, point-to-site OpenVPN/IKEv2/SSTP connections, and VNet-to-VNet tunnels. You deploy it into a dedicated GatewaySubnet and choose a route-based or policy-based gateway SKU, with the route-based type being the flexible, modern default. This is precisely the service that satisfies a requirement for encrypted hybrid connectivity across the internet.

Azure Managed Instance for Apache Cassandra is the only Azure service that runs the real open-source Cassandra codebase as a fully managed offering. It natively supports CQL, transparent failover, auto-tuned repairs, and separate clusters for each datacenter, enabling active-active multi-region writes. With its managed node lifecycle and built-in monitoring, it removes the overhead of manual Cassandra operations while preserving compatibility for existing drivers and applications. This makes it the correct choice for a native Cassandra database with multi-region write support.

Azure Functions is a serverless compute service that runs code on-demand without requiring you to provision or manage infrastructure. It automatically scales out to handle incoming HTTP requests and scales down to zero when idle, so you are billed only for the actual execution time and resources consumed during each invocation. This makes it the ideal choice for a mobile app backend that needs to handle sporadic or variable HTTP traffic while minimizing cost.

Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines blob storage's durability and scalability with a hierarchical namespace, enabling true directories and file-level access controls. It exposes a Hadoop-compatible file system through the ABFS driver, allowing Apache Spark, Hive, and other analytics frameworks to run directly on it with high throughput. Fine-grained, POSIX-like ACLs and atomic directory renames make it purpose-built for big data analytics workloads.

Azure IoT Central is a fully managed SaaS (Software-as-a-Service) platform that provides pre-built industry templates (e.g., retail, healthcare, energy) and a no-code/low-code interface for connecting devices, creating dashboards, setting alarms, and managing the device lifecycle. It abstracts the underlying infrastructure, scaling, and connectivity details, enabling rapid deployment of end-to-end IoT solutions without custom backend development or ongoing operational maintenance.

Azure SQL Managed Instance is a fully managed PaaS service that offers near 100% compatibility with on-premises SQL Server, including support for SQL Server Agent, cross-database queries, and CLR integration. It also natively integrates with a VNet, allowing the instance to be placed directly into a subnet without additional configuration. This makes it ideal for migrations requiring minimal application changes.

Azure Private Link with Private Endpoints creates a network interface with a private IP from a VNet that maps to a specific PaaS service, such as Azure SQL Database or Azure Storage. Traffic to that private endpoint remains entirely within the Microsoft network and never traverses the public internet. This meets the requirement of using a private VNet IP address while keeping the connection fully private and secure. Because the PaaS service is effectively accessible via a private IP, all other conditions are satisfied.

Azure Traffic Manager is a DNS-based traffic load balancer that works at the global level. It can route users to the endpoint with the lowest latency (performance routing) and automatically fail over to a different region if the primary endpoint is unhealthy.

Azure Container Instances (ACI) is a serverless compute service that runs a single container directly on Microsoft-managed infrastructure without requiring a virtual machine, orchestration cluster, or any persistent provisioning. It is ideal for an HTTP-responding containerized app because you just specify the image and ports, and ACI starts the container in seconds with a public IP address. There are no nodes to patch, no cluster to update, and billing is per-second, so for a simple container workload nothing else is simpler or more cost-effective.

Azure Firewall is a managed, stateful, cloud-native firewall service. It provides centralized traffic filtering across all VNets and subscriptions, with built-in FQDN filtering, threat intelligence integration, and automatic scaling. Unlike NSGs or WAFs, it handles both internal and external network traffic at L3-L4 (plus selective L7) and offers enterprise-grade logging and policy management. For the AZ-900 scope, Azure Firewall is the definitive modern firewall service for securing cloud workloads.

Correct. Each Azure region is paired with another region in the same geography (e.g., East US with West US). Microsoft serializes platform updates across the pair, so only one region in the pair receives updates at a time. This supports disaster recovery and meets the compliance requirement.

Azure Front Door is a global, scalable entry point that uses Microsoft's global edge network to route users to the nearest healthy application endpoint based on latency or geography. It offers built-in DDoS protection at the network layer (L3/L4) as a standard feature, meeting both requirements.

Azure SQL Database is a fully managed Platform-as-a-Service (PaaS) relational database built on Microsoft SQL Server technology, providing automatic OS updates, SQL engine patching, and backup management as core services. It offers a 99.99% availability SLA with built-in high availability, and supports independent scaling of compute and storage without requiring the customer to manage any virtual machines or underlying infrastructure. Because it exposes a T-SQL surface, it is the appropriate PaaS choice for a SQL Server line-of-business application, directly meeting the requirement to reduce management overhead.

Azurite (the Azure Storage emulator) and the Azure Cosmos DB Emulator are legitimate local tools that emulate the APIs and behaviors of their respective cloud services on a developer's workstation. They allow you to build and test applications against realistic Azure Storage (blob, queue, table) and Cosmos DB endpoints without incurring cloud costs or needing network connectivity. Using these emulators is the standard approach for local development before deploying to Azure, which is exactly why this is the correct answer.

Serverless compute in Azure SQL Database automatically scales compute resources based on the workload's active connections, CPU, and memory usage, pausing the database during idle periods to eliminate compute billing. It provides per-second billing and can burst to a configurable maximum vCore, making it ideal for intermittent usage patterns with unpredictable spikes. Because scaling is fully automated, there is no manual adjustment or capacity planning required.

Azure VPN Gateway is the correct service because it is a virtual network gateway that sends encrypted traffic between an Azure virtual network and an on-premises location over the public internet using IPsec/IKE protocol. It supports site-to-site connections that create secure, encrypted tunnels, which exactly matches the requirement for secure on-premises-to-Azure hybrid connectivity via VPN. It also supports point-to-site and VNet-to-VNet connections, making it the appropriate choice for this scenario.

Azure VPN Gateway is the correct answer. It creates a site-to-site VPN connection that encrypts traffic using IPsec/IKE protocols over the public internet. It is designed to securely connect on-premises networks to Azure virtual networks.

Azure Pipelines is the CI/CD service within Azure DevOps that automatically builds, tests, and deploys code whenever changes are pushed to a connected Git repository. It provides configurable YAML or classic build definitions, supports multiple platforms and languages, and runs jobs on Microsoft-hosted or self-hosted agents. Pipelines can include stages for building, testing, and releasing to multiple environments, making it the correct choice for automating software delivery. Its purpose is exactly the continuous integration and continuous delivery workflow described in the question.

Azure AD (now Microsoft Entra ID) is Microsoft's cloud-based identity and access management (IAM) service. It provides identity directories for users and groups, single sign-on (SSO) for thousands of SaaS apps, multi-factor authentication, and token issuance based on OAuth 2.0, OpenID Connect, and SAML. It also enforces fine-grained authorization policies, like conditional access, to determine exactly what resources a signed-in user can access.

Azure Front Door is the correct choice because it is a global, cloud-native entry point (layer 7) that provides HTTP/HTTPS load balancing across regions, geographic routing, automatic failover, and integrated Web Application Firewall (WAF). It uses Microsoft's global edge network with anycast to bring traffic to the nearest region, which is ideal for a global e-commerce platform. Front Door also supports path-based routing, domain acceleration, and TLS offload, making it a comprehensive global delivery solution.

Azure Data Factory is the correct answer because it is the managed cloud-based ETL service explicitly designed for creating data-driven pipelines that move and transform data. It enables you to define linked services, datasets, and activities to copy data from source to destination, and you can use control flow and data flows for transformation. This capability aligns directly with the question's description, making it the only option that fits.

Azure SQL Managed Instance is a fully managed PaaS offering that runs the SQL Server database engine in Azure, delivering near-100% compatibility with on-premises SQL Server. It supports critical features like SQL Agent for job scheduling, Common Language Runtime (CLR) integration, linked servers, and cross-database queries, which are often required for enterprise lift-and-shift scenarios. Because it runs in the customer's virtual network and preserves the familiar SQL Server surface area, it allows existing applications to be migrated without rewriting code or redesigning data structures.

Azure Blob Storage static website hosting enables you to serve HTML, CSS, and JavaScript directly from a storage container named $web. When enabled, Blob Storage automatically serves content over a public URL with no compute resources, charging only for storage and transactions. It scales automatically to handle traffic spikes and can be combined with Azure CDN for low-latency global delivery. This makes it the most cost-effective and operationally simple option for hosting static assets.

ACI is correct because it is a serverless container service that runs a single container on demand. You do not need to provision VMs, manage an orchestrator, or configure scaling – just specify the container image and launch. It is the fastest and most lightweight option for the described scenario.

Azure Front Door is a global application delivery network that provides layer 7 load balancing, Web Application Firewall (WAF), SSL/TLS termination, and caching at the network edge. It uses anycast to route user requests to the nearest available point of presence, then intelligently forwards traffic to the healthiest and fastest backend across multiple Azure regions. This native global routing capability, combined with built-in WAF and TLS offload, directly satisfies all requirements for a global e-commerce API without additional components.

Correct. An Azure Private Endpoint assigns a private IP address from the virtual network to the Azure SQL Database, ensuring all traffic stays within the Microsoft backbone network and never traverses the public internet. The database is accessible only from the specified VNet.

Azure Functions on the Consumption plan is serverless: HTTP-triggered functions scale automatically on demand, and you pay only for execution time and resources used. The platform manages all infrastructure including the runtime host, and there is no server to provision, patch, or scale manually. This makes it the best fit for event-driven code triggered by an HTTP request.

Azure Virtual Machines provides infrastructure as a service (IaaS) where you deploy a full virtualized Windows Server OS instance with dedicated vCPUs, memory, and disk. This grants complete administrative control to install any custom-built application, modify registry settings, enable Windows roles or features, and configure the built-in Windows Defender Firewall or third-party security tools. You can also place multiple VM instances in an availability set or zone to achieve high availability for the application, making this the only option that delivers true guest OS-level access equivalent to a physical server.

Azure Paired Regions consist of two regions within the same geography that are linked to support disaster recovery. They provide low-latency data replication and are the appropriate choice for protecting against an entire region failure.

Availability Zones are physically separate locations within an Azure region, each with its own independent power, cooling, and networking infrastructure. By deploying application VMs across multiple zones, you ensure that if one datacenter (or an entire zone) fails, traffic can be served from the remaining healthy zones. This directly protects against a datacenter-level failure within the same region. VMs deployed across two or more zones qualify for the 99.99% uptime SLA, making this the correct choice for the stated requirement.

Azure Application Gateway with WAF is a layer-7 load balancer that includes a Web Application Firewall designed to protect web applications from OWASP Top 10 vulnerabilities. It inspects HTTP/HTTPS traffic in depth, blocking malicious payloads like SQL injection and XSS at the application edge. Because it operates at the application layer, it is the correct choice for this security requirement, unlike network-level filtering solutions.

Azure Container Instances (ACI) is the correct answer because it is a serverless container service that runs containers on-demand without requiring you to provision or manage underlying VMs. You specify CPU and memory requirements, and ACI places the container on shared infrastructure, with billing per-second based on the resources consumed. It is ideal for simple container workloads, event-driven tasks, or burst scenarios where you need immediate, isolated container execution without orchestration overhead.

ZRS replicates data synchronously across three Azure availability zones within the primary region. This ensures that if one zone fails, the data remains available and durable from the other zones, meeting the requirement for zone-level protection without cross-region replication.

Azure Functions is serverless, scales automatically in response to events, and charges only for execution time. Using a Blob Storage trigger, the function runs whenever a new blob is created. This is the simplest solution that meets all requirements: automatic scaling, no cost when idle, and no infrastructure management.

Azure Data Lake Storage Gen2 (ADLS Gen2) is purpose-built for big data analytics, combining the massive scalability of Azure Blob Storage with a hierarchical file system. The hierarchical namespace enables directory-level operations, atomic rename, and POSIX-style access control lists, which are essential for maximizing throughput in massively parallel analytics engines such as Apache Spark, Azure Synapse, and Databricks. This design also reduces the number of rename/delete operations needed when executing job coordinators, directly improving analytics performance versus flat object storage.

Azure Container Apps is a fully managed serverless container service with native revision management and built-in traffic splitting. Each revision represents a version of your application, and you can assign a percentage of incoming traffic to each active revision — for example, 90% to v1 and 10% to v2 — without any manual Kubernetes configuration or external ingress setup. This built-in weighted routing directly enables canary deployments, making Container Apps the correct answer.

RA-GRS is identical to GRS in replication (data is copied to a secondary region), but it additionally enables read access to the secondary region at all times. If the primary region fails, data is automatically readable from the secondary endpoint without any manual failover steps, exactly matching the requirement. (The same logic applies to RA-GZRS for zone-redundant geo-replication.)

Azure Kubernetes Service (AKS) fully satisfies the requirement for orchestrating a containerized application because it is a managed Kubernetes offering in Azure. Microsoft operates the control plane, including the API server, etcd store, and scheduler, so customers only need to manage worker nodes and their application workloads. AKS delivers essential orchestration capabilities such as cluster-wide scaling, rolling updates, self-healing, and service discovery, making it the appropriate choice for production container deployments.

Each Azure region is paired with another region in the same geography (e.g., East US with West US) that is at least 300 miles away. Region pairs are predefined by Azure and enable built-in replication for services like Storage and SQL Database, ensuring data residency and disaster recovery compliance without manual pairing.

Azure Data Factory is Microsoft's hybrid data integration service that provides a code-free, visual pipeline designer for building ETL and ELT workflows. It supports over 90 built-in connectors to on-premises, SaaS, and cloud data stores, and includes Mapping Data Flows to transform data without writing code. You can schedule pipelines or trigger them on events, making it the dedicated service for visual ETL pipeline design.

Virtual Machine Scale Sets are the correct choice because they provide true infrastructure-level autoscaling: you define a scaling rule based on metrics such as CPU utilization, and the scale set automatically increments or decrements the number of VM instances to match demand. The scale set natively integrates with an Azure Load Balancer (or Application Gateway) and uses health probes to detect and automatically remove unhealthy VMs from the traffic rotation, ensuring that only healthy instances receive customer traffic for the e-commerce platform.

Azure Service Bus is a full-featured enterprise message broker with queues and topics that supports sessions and duplicate detection natively. Sessions enable FIFO and stateful message groups, while duplicate detection removes duplicated sends and receives within a deduplication window, together offering exactly-once processing semantics. Additionally, Service Bus supports atomic transactions that can batch send, receive, and complete operations against a queue, which is essential for reliable financial transaction workflows.

Azure SQL Managed Instance is a fully managed Platform-as-a-Service (PaaS) offering that provides near-complete compatibility with the on-premises SQL Server engine, including support for SQL Server Agent, cross-database queries, and database mail. It also offers automatic backups, patching, and high availability, and it supports network-level isolation via virtual network integration, making it the ideal lift-and-shift target for a set of on-premises databases with minimal application changes.

Azure DNS is the exact correct answer because it provides a global, authoritative DNS hosting service where you can manage your public domain zones and record sets. It uses Azure's anycast nameserver infrastructure to answer queries quickly and reliably, resolving domain names to IP addresses for internet-facing services. This is the exact function described in the question, and the other services lack this core DNS hosting capability.

Azure HDInsight is Microsoft's first-party managed Apache Hadoop distribution, where you create dedicated clusters of virtual machines running the Hadoop stack, including HDFS, Hive, HBase, Kafka, Spark, Storm, and Interactive Query. The service handles provisioning, patching, and monitoring of the cluster nodes, and gives you configuration control over the open-source framework version. For a workload that explicitly calls for a managed Hadoop ecosystem cluster on Azure, HDInsight is the definitive correct answer.

Azure DevOps is a comprehensive, Azure-native suite covering the whole software lifecycle: Azure Repos for Git repositories, Azure Pipelines for building and releasing code, Azure Boards for work-item tracking, Test Plans for manual and automated testing, and Artifacts for package sharing. Because this question asks which service directly manages the DevOps process, Azure DevOps is the only option that owns all these capabilities.