CCNA Azure Architecture Questions

Azure Virtual Machines is an IaaS offering that gives you complete control over the guest OS—Windows or Linux—including the kernel, installed software, patching, and OS-level configuration. You can run any workload that requires full OS access, such as legacy applications that need Windows services, custom drivers, or OS ACLs, without rearchitecting. The other options abstract or containerize the runtime and do not expose an OS that you can directly manage.

App Service is a PaaS offering that handles scaling, patching, and availability, and supports multiple frameworks.

Application Insights is an application performance management (APM) service that automatically monitors live web applications, capturing request rates, response times, failure rates, and dependency call durations. It provides code-level diagnostics, distributed tracing, and user behavior analytics (e.g., page views and session counts) through instrumentation SDKs, enabling proactive anomaly detection. This makes it the correct choice for monitoring application performance and user behavior.

Azure DNS is the correct answer because it is a cloud-based DNS hosting service that allows you to manage your DNS zones and records through Azure. It provides authoritative name resolution using Azure's global anycast network, ensuring low-latency responses from anywhere in the world. You can host public and private DNS zones, and it integrates with other Azure services for automated record management. This directly matches the requirement to host DNS zones and resolve domain names.

Azure Kubernetes Service (AKS) is the correct choice because it provides a fully managed Kubernetes control plane, enabling containerized microservices to be deployed, scaled, and updated independently. With native support for horizontal pod autoscaling, service discovery, and rolling updates, AKS directly addresses the requirement for independent scaling and deployment of each microservice component, without the operational overhead of managing the control plane yourself.

Azure IoT Hub is the complete IoT connectivity platform, offering secure, bidirectional communication between devices and the cloud over MQTT, AMQP, and HTTPS. It provides a device identity registry, per-device authentication, device twins for desired and reported state, direct methods for remote commands, and automatic device provisioning. IoT Hub also handles telemetry ingestion and cloud-to-device messaging, along with file upload and device management at scale. This makes it the central, correct service for connecting and managing IoT devices.

Correct. Azure Traffic Manager is a DNS-based global traffic load balancer that routes end-user traffic to the nearest regional endpoint based on the configured routing method, such as Performance (lowest latency). It does not terminate HTTP traffic and works at the DNS level.

Blob versioning and soft delete are native Azure Storage features that provide continuous protection against accidental modification and deletion. Blob versioning automatically captures a new version whenever a blob is overwritten, so you can restore to any prior version, while soft delete retains deleted blobs and their versions in a non-accessible state for a configurable retention period (e.g., 7 days). These features operate at the storage account level, require no separate service or extra compute, and are the direct mechanism for undoing accidental changes or deletions within a storage account.

Azure Kubernetes Service (AKS) is a managed Kubernetes offering in which Azure operates the control plane—the API server, etcd, and scheduler—while providing automated upgrades, health monitoring, and scaling. You still configure a node pool of VMs, but the raw virtual machines are pooled into a managed cluster rather than existing as standalone infrastructure you provision and track individually. For running containerized applications, AKS gives you native orchestration with pods, auto-scaling, load balancing, and rolling deployments, making it the appropriate abstraction when you want to avoid managing the Kubernetes control plane yourself.

Azure Firewall is a managed, cloud-native firewall service that provides centralized, stateful inspection of both inbound and outbound traffic at the network level. It supports FQDN-based rules, allowing or denying traffic based on fully qualified domain names rather than just IP addresses, and can integrate with Microsoft Threat Intelligence to block domains associated with known malicious activity. These capabilities directly satisfy the requirement for outbound traffic control with FQDN filtering and threat detection.

Correct. Azure Load Balancer operates at Layer 4 (TCP/UDP) of the OSI model, forwarding network traffic to backend VM instances based on configured rules and health probes. It is the simplest and most efficient way to distribute inbound traffic across VMs within a single region, including across availability zones, without adding HTTP-level features or DNS-level indirection.

An Availability Set spreads VMs across multiple fault domains (separate power, cooling, and network hardware) and update domains (groups that receive planned maintenance one at a time) within the same datacenter. This placement protects against both hardware failures and maintenance downtime, enabling a higher availability SLA when combined with at least two VMs in the set. It is the correct choice because the requirement is to ensure resilience inside a single Azure datacenter, not across regions.

Azure Synapse Analytics is the correct answer because it is a unified analytics platform designed specifically for enterprise data warehousing and big data analytics. It uses a massively parallel processing (MPP) architecture that distributes query execution across multiple compute nodes, enabling complex queries against enormous datasets at high throughput. Its dedicated SQL pool provides T-SQL-based relational semantics, allowing business intelligence tools like Power BI to query structured data stored in tables or external file sources.

Microsoft Power Platform is a comprehensive low-code/no-code suite that includes Power Apps for building custom business applications, Power Automate for workflow automation, Power BI for data analytics, and Power Virtual Agents for chatbots. It is specifically designed for citizen developers and business users to create functional apps through intuitive drag-and-drop interfaces and prebuilt connectors, without needing to write traditional programming code. This aligns precisely with the requirement to build business apps with minimal technical effort, making it the correct choice.

Azure App Service is a fully managed Platform-as-a-Service (PaaS) offering specifically designed for hosting web applications, REST APIs, and mobile backends. It includes built-in auto-scaling capabilities based on metrics or schedules, as well as automatic patching, load balancing, and high availability, without requiring you to manage infrastructure. This makes it the optimal choice for a web app that needs to handle variable traffic with minimal operational effort.

Azure Data Factory is the canonical ETL/ELT orchestration service in Azure. It provides over 90 native connectors to on-premises and cloud data sources, enabling you to design, schedule, and monitor data movement and transformation pipelines visually or via code. Data Factory supports both code-free mapping data flows and hand-written activities that can invoke compute engines like Azure Databricks and HDInsight, making it the dedicated service for orchestrating end-to-end data integration.

Azure IoT Edge is the correct service because it provides a software runtime that packages Azure workloads — such as machine learning models, Azure Stream Analytics, and custom code — as containerized modules executed locally on IoT devices. The runtime keeps workloads running even when connectivity to the cloud is lost, and it allows modules to be deployed and updated from the cloud. This direct local execution of Azure services is exactly what the scenario describes.

Correct. Azure Functions Consumption plan is a serverless, event-driven compute service. It automatically scales based on incoming HTTP requests and bills only for the time the function code executes. When there are no requests, there is no cost.

Azure Migrate is the correct answer because it is a centralized hub that discovers, assesses, and migrates on-premises servers, including VMware, Hyper-V, and physical machines, to Azure. It provides a comprehensive suite of tools for planning, dependency analysis, and execution of server migrations, making it the appropriate service for a full workload migration. While it can integrate with other services like Site Recovery and Database Migration Service, Azure Migrate itself orchestrates the end-to-end migration process.

Availability zones are physically distinct datacenters within an Azure region, each with independent power, cooling, and networking. By deploying VMs across multiple zones, you ensure that at least one instance remains operational if a single datacenter suffers a catastrophic failure. This configuration also qualifies for the 99.99% virtual machine SLA, which is exactly the level of isolation required to protect against an entire datacenter going offline.

Azure Cache for Redis is a managed in-memory data store built on the open-source Redis engine, providing sub-millisecond read/write performance for frequently accessed data and session state. It supports rich data structures (strings, hashes, lists), TTL, and pub/sub, making it a distributed cache that can scale across multiple app instances. Its in-memory design and automatic failover options make it the correct choice for low-latency caching scenarios.

ARM templates (and Bicep) are declarative Infrastructure as Code artifacts written in JSON or Bicep DSL that define the desired state of Azure resources. When deployed, the Azure Resource Manager engine reconciles the template's resource definitions against the current environment, creating or updating resources idempotently so the same template produces consistent, repeatable deployments across environments, subscriptions, and CI/CD pipelines.

Availability Zones are distinct physical locations within an Azure region, each with its own independent power, cooling, and networking infrastructure. They are isolated from failures in other zones, meaning if one zone experiences an outage, the others continue operating. This isolation protects against an entire datacenter failure, making Availability Zones the correct feature for fault tolerance within a region.

Choosing a region in Europe (e.g., West Europe) ensures proximity to users and low latency.

Azure CDN with a Blob Storage origin is the standard solution because the CDN caches large files on edge nodes spread across the globe, so users retrieve the file from the nearest point of presence, minimizing latency and jitter. This pattern automatically handles high download volumes, reduces egress costs for the storage account, and integrates seamlessly with Blob Storage for static content. It is the intended Azure service for achieving fast, reliable, worldwide delivery of large files.

Azure Blob Storage static website hosting is the most cost-effective option because it uses a built-in static website endpoint that serves content directly from a blob container. There is no compute resource to provision or pay for — you only incur storage costs and minimal data transfer fees. The service automatically scales to handle traffic spikes and requires no server administration, making it ideal for HTML, CSS, and JavaScript assets. This is a serverless hosting model, so you pay for exactly what you store and deliver, not for idle processing capacity.

Azure Cache for Redis is a managed implementation of the open-source Redis, which stores all data in memory, guaranteeing sub-millisecond read and write operations. It provides native session state support through operations like SET with expiration, and its distributed architecture allows multiple application instances to share the same session data consistently. With features like replication, persistence, and failover, it is specifically designed for high-performance scenarios like web session state, making it the correct choice.

Zone-Redundant Storage (ZRS) is correct because it synchronously replicates data across three availability zones within a single region. This design allows storage accounts to remain available even if an entire availability zone fails, without requiring a failover to a different region. The synchronous write ensures durability and consistency across all three copies, making ZRS the specific redundancy tier that meets the described requirement.

Azure Communication Services is the correct answer because it is a managed service that provides REST APIs and SDKs for voice and video calling, chat, SMS, and email, allowing developers to add real-time person-to-person communication to custom applications. It handles the signaling, media transport, and messaging infrastructure, so code in any supported language can integrate these interactive channels without building that complexity from scratch. This directly maps to the need for APIs that let an application become a communication platform.

ARM templates are declarative JSON files that define Azure resources and their dependencies. They handle creation order automatically, support parameters for multi-environment reuse, and are the native infrastructure-as-code tool for Azure. This matches all requirements in the scenario.

Azure CDN is Microsoft's dedicated content delivery network that replicates and caches static assets such as images, CSS, JavaScript, and videos at strategically located point-of-presence servers worldwide. When a user requests such content, the CDN serves it from the nearest edge node rather than the origin server, dramatically reducing latency, bandwidth use, and origin load. Its global edge caching capability is precisely designed for this purpose and is the service most directly matching the question's definition.

Azure Virtual Machine Scale Sets (VMSS) deployed across Availability Zones provide a zone-redundant group of identical VMs that can automatically scale in and out based on demand or a schedule. When configured with an Azure Load Balancer or Application Gateway, traffic is distributed across VMs in different zones, ensuring the application remains available even if an entire zone fails. This makes VMSS the correct choice because it combines auto-scaling with cross-zone high availability.

Azure App Service is a fully managed PaaS service that runs web applications, REST APIs, and mobile backends. It supports ASP.NET Core out of the box, handles patching of the OS and web server, and provides built-in scaling and load balancing, meeting the requirement of not managing infrastructure.

Azure Repos is the source control service within Azure DevOps. It provides both Git and Team Foundation Version Control (TFVC) repositories, enabling teams to host code, manage branches, and collaborate through pull requests. With features like branch policies, required reviewers, and code search, Azure Repos directly fulfills the role of storing and managing source code. This is why it is the correct answer when the question asks which service provides version control.

Azure Blob Storage is Microsoft's object storage solution designed for massive amounts of unstructured data, such as videos, images, and log files. It offers global scalability and low-latency access via HTTP/HTTPS, making it ideal for serving media directly to browsers or applications. Because it is not tied to a virtual machine or file share, it supports granular access control and tiered storage (hot/cool/archive) to optimize cost.

Azure ExpressRoute creates a dedicated, private network connection between your on-premises infrastructure and Azure data centers, entirely bypassing the public internet. This reduces latency, improves security, and provides higher reliability and consistent SLA-backed performance compared to internet-based connections. It supports private peering, Microsoft peering, and even dedicated circuits via ExpressRoute Direct.

A private endpoint creates a network interface with a private IP address in the VNet. Traffic to the storage account goes over the Microsoft backbone without ever leaving the VNet or touching the public internet. Because the storage account appears inside the VNet, on-premises access via Site-to-Site VPN is naturally possible. This meets both requirements.

Azure Kubernetes Service (AKS) is the correct choice because it is a fully managed Kubernetes platform that offloads control plane management to Azure. It provides native container orchestration capabilities including automatic scaling, service discovery, rolling updates, self-healing, and load balancing—all essential for complex containerized microservices. AKS simplifies deploying and operating microservices at scale, making it the most appropriate service among these options.

Azure Logic Apps is a cloud service specifically built for automating and orchestrating business processes using an intuitive visual designer. It offers more than 300 connectors to seamlessly integrate apps, data, and services, along with built-in controls for conditions, loops, and error handling. This directly matches the requirement to orchestrate workflows across multiple systems without writing code, making it the correct answer for workflow automation.

Azure Active Directory (now Microsoft Entra ID) is Microsoft's cloud-native identity and access management service that provides authentication as a service, including single sign-on, multi-factor authentication, conditional access, device registration, and identity governance for both cloud and hybrid environments. It acts as the central identity provider for Office 365, Azure, and thousands of SaaS applications, and can federate with on-premises Active Directory using Azure AD Connect. Its core function is verifying users and controlling access to resources, making it the correct choice.

Azure Load Balancer operates at Layer 4 and uses rules and health probes to distribute TCP and UDP traffic evenly across a backend pool of virtual machines or instances. By sending traffic only to healthy backend resources, it improves availability and enables scaling by adding more instances without changing the front-end IP. This precisely matches the described purpose of distributing incoming network traffic across multiple backend resources.

Azure Cosmos DB for Apache Cassandra is a fully managed database service that natively supports the Cassandra wire protocol and CQL, allowing existing Cassandra drivers, tools, and applications to connect without code changes. It provides a wide-column NoSQL model that matches Cassandra's partition-key and clustering-key semantics, while adding Azure-specific benefits such as global distribution, multiple consistency levels, 99.999% availability SLAs, and serverless or provisioned throughput models. This makes it the correct choice for teams seeking Cassandra compatibility with reduced operational overhead.

ExpressRoute extends your on-premises networks into the Microsoft cloud over a private connection facilitated by a connectivity provider. This connection does not traverse the public internet, offering higher security, reliability, and up to 10 Gbps bandwidth with an SLA.

Azure Event Hubs is the Azure-native, fully managed event streaming platform that is architecturally equivalent to Apache Kafka, supporting the Kafka protocol for compatibility. It ingests millions of events per second with partitioned throughput, consumer groups, and configurable retention that enables event replay and distributed processing. This makes it the correct choice for telemetry streams, real-time analytics, and event-driven ingestion at scale.

Azure Traffic Manager is a DNS-based traffic routing service that can direct users to the closest or most appropriate regional endpoint based on geographic location, latency, or priority. It automatically detects endpoint health and fails over to healthy endpoints, making it ideal for global load balancing with DNS-level routing and without terminating HTTPS.

Correct. Azure ExpressRoute establishes a private, dedicated connection from on-premises to Azure, bypassing the public internet. It provides higher reliability, lower latency, consistent performance, and a service-level agreement from the connectivity partner, meeting all the stated requirements.

Azure region pairs are defined by Microsoft as two regions within the same geography that are at least 300 miles apart. They provide automatic fault isolation and ensure that planned updates are rolled out sequentially—only one region in the pair is updated at a time—to reduce the risk of simultaneous failures. For disaster recovery, this pairing guarantees that if a major event affects one region, the paired region is prioritized for recovery and has lower latency connectivity, making it the specific Azure feature designed for cross-region DR scenarios.

Azure Policy is a governance mechanism that can enforce business rules on resource deployments. When assigned a built-in or custom policy definition such as 'Allowed Locations', the policy intercepts every create, update, or delete request at the Azure Resource Manager and denies any deployment specifying a region not on the allowed list. The 'deny' effect is hard enforcement, not an alert, so resources simply cannot be provisioned outside permitted geographies. This makes Azure Policy the direct, enforceable method for guaranteeing all resources are created in required locations, regardless of which subscription or resource group the deployment targets.

Azure DDoS Protection Standard is the purpose-built service for defending Azure hosted resources against distributed denial-of-service attacks. It provides always-on traffic monitoring, adaptive tuning, and automatic mitigation for volumetric, protocol, and resource-layer attacks across Layers 3, 4, and 7. When enabled on a virtual network, it learns normal baseline traffic patterns and can neutralize malicious traffic within two minutes, while also offering cost protection and detailed attack analytics.

Azure Kubernetes Service (AKS) is the correct choice because it is a managed Kubernetes platform that provides full container orchestration for microservices. It handles deployment, scaling, service discovery, and load balancing across containers automatically, and the control plane is managed by Azure, reducing operational overhead. This makes AKS purpose-built for running a microservices architecture that requires continuous scaling and resilience.

Azure Front Door is a global HTTP(S) load balancer that provides SSL offloading, path-based routing, WAF integration, and intelligent traffic routing to the closest available regional backend. It meets all the specified requirements in a single global service.

An Availability Set groups VMs across multiple fault domains (separate server racks) and update domains (for planned maintenance). This ensures that at least one VM remains available during maintenance and that a single rack failure does not affect both VMs. No additional cost is incurred for using an Availability Set.

Locally Redundant Storage (LRS) creates three synchronous replicas of your data within a single physical data center in the primary region. It is the lowest-cost redundancy tier because it avoids the extra capacity and network costs of replicating to other zones or regions, making it the correct choice when the requirement is minimal cost and single-datacenter placement.

Azure HDInsight is the managed cloud service built for running Apache Hadoop (and related open-source frameworks such as Spark, Hive, and HBase) on large datasets. It supports traditional batch processing via MapReduce and Hive jobs, storing data in Azure Storage or Azure Data Lake for scale. As the direct, first-party answer for Hadoop-style batch analytics, this is the correct choice.

A resource group is a container that holds related resources for an Azure solution. It allows you to manage, delete, and apply policies, tags, and RBAC to all resources in that group together. This is exactly what the team needs to manage each environment independently.

Azure Dedicated Host is correct because it provisions a single-tenant physical server, placing your VMs on hardware that is exclusively allocated to your subscription and not shared with any other customers. This enables physical isolation at the server level, which is required for compliance standards that mandate dedicated compute resources. Unlike logical isolation, you also control the host's maintenance timing and workload placement, ensuring full hardware ownership.

Correct. ExpressRoute provides a dedicated private circuit from an on-premises network to Azure, bypassing the public internet for improved latency, security, and reliability. It supports high bandwidth (up to 10 Gbps) and offers a financially backed SLA (e.g., 99.95% availability for a single connection).

Resource groups are Azure's logical containers that group related resources for unified deployment, management, and monitoring. They act as the primary scope for RBAC permissions, policy assignments, and cost reporting, enabling you to treat a set of resources as a single administrative unit. Because they are purpose-built for organizing resources by lifecycle, security, or cost center, resource groups are the correct construct for logical grouping.

An availability zone is a physically separate datacenter within an Azure region, designed with its own independent power, cooling, and networking infrastructure. This isolation means that if one zone experiences a failure—whether from rack-level faults or broader utility outages—the other zones in the region remain operational. For this reason, Azure uses zones to provide high-availability SLAs for services that are deployed as zone-redundant, and this definition directly matches the question's requirement.

Azure Dedicated Host gives you a physical server in an Azure datacenter that is exclusively reserved for your organization's use, with full control over maintenance and host configuration. Because the hardware is not shared with any other tenant, it satisfies stringent compliance, regulatory, and data-sovereignty requirements. This model also lets you apply your own Windows Server or SQL Server licenses on dedicated hardware under existing Microsoft license mobility terms.

Azure AD Connect is Microsoft's on-premises identity synchronization tool that connects an existing on-premises Active Directory with Azure AD, replicating user accounts, groups, password hashes, and other directory attributes. It enables hybrid identity features such as password hash synchronization, pass-through authentication, and federation with Active Directory Federation Services (AD FS), as well as seamless single sign-on (SSO). This is exactly the scenario described in the question, making it the correct answer for synchronizing on-prem AD to Azure AD.

Azure Database for MariaDB is the correct choice because it is the dedicated Azure PaaS offering that provides a fully managed, high-availability deployment of the open-source MariaDB database engine. It includes built-in automated backups, scaling, and security features while preserving wire compatibility for MariaDB clients and tools. This service is specifically designed to host MariaDB workloads, making it the appropriate answer.

Azure App Service is a fully managed PaaS offering for web applications that provides automatic scaling, load balancing, and built-in DevOps capabilities without managing VMs. Azure SQL Database is a managed relational database with high availability, automated backups, and a compatibility level for typical transactional SQL workloads. Together they form a standard multi-tier stack where the web tier handles HTTP requests and the data tier stores structured data with low-latency access.

Azure HDInsight is a fully managed cloud analytics service that supports popular open-source frameworks including Apache Spark, Hadoop, Hive, and Kafka. It is explicitly designed to process and analyze massive volumes of data in parallel across clusters, making it the correct choice for big data analytics workloads. HDInsight integrates with Azure Data Lake Storage and Blob Storage, allowing petabyte-scale processing with tools data engineers already use.

AKS is Azure's managed Kubernetes service that offloads the control plane, including API server, etcd, and scheduler, to Azure while you manage agent nodes, workloads, and scaling. It provides native Kubernetes primitives such as Deployments, Services, Ingress, and Horizontal Pod Autoscaler, plus integrated Azure Active Directory, Azure Policy, and container monitoring. This makes AKS the appropriate choice for deploying and operating containerized applications at scale with robust orchestration.

Azure Event Grid is the correct answer because it is the Azure-native event-routing backplane for reactive workloads. It ingests discrete state-change events from Azure resources and custom sources (via topics) and pushes them to subscribers such as Azure Functions, Logic Apps, or webhooks with server-side retry and dead-lettering. Its extremely low latency (typically sub-second) and built-in filtering make it ideal for serverless event-driven integrations that need to act immediately on changes like blob creation or VM status.

Availability Zones are physically separate groups of datacenters within an Azure region, each with independent power, cooling, and networking. They are interconnected through high-speed, private fiber-optic links, allowing synchronous replication and low-latency failover between zones. By deploying VM instances across multiple zones, an application can survive the failure of an entire datacenter. This is the correct choice for critical applications that require high availability within a single region.

Zone-Redundant Storage (ZRS) replicates data synchronously across three Azure availability zones within the primary region. Each zone is an independent datacenter (or set of datacenters) with separate power, cooling, and networking, so if one zone goes down, the data remains available and durable in the other two. ZRS provides high availability with no data loss during zone failures, and because all zones are in the same region, write latency remains low for applications that must access patient records quickly. Unlike LRS, ZRS protects against entire datacenter outages, and unlike GRS/RA-GRS, it does not add the latency of cross-region replication.

Azure Front Door is a global application delivery network that provides intelligent HTTP/HTTPS load balancing, SSL offload, URL-based routing, and latency-based routing to the closest healthy region. It also includes a built-in Web Application Firewall (WAF) that inspects all incoming traffic at the edge, protecting against common web exploits like SQL injection and XSS.

Azure Notification Hubs is a dedicated push notification engine that abstracts the complexities of multiple Platform Notification Systems (PNS) including APNs, FCM, and WNS. It manages device registrations, handles token expiry and retries, and provides a single API to send notifications to iOS, Android, and Windows devices. With template support, you can tailor message payloads per platform without altering your backend logic, making it the correct service for cross-platform mobile push notifications.

Traffic Manager is a DNS-based global traffic routing service that directs client requests to the most appropriate endpoint across Azure regions. It operates at the DNS level, using policies such as performance, priority, weighted, or geographic routing to respond with the best available endpoint's IP address. Because it does not inspect HTTP traffic, it is the simplest and most direct solution for routing a global web application based on DNS queries alone.

The Archive tier is designed for data that is rarely accessed and can accept a retrieval latency of up to several hours. It has the lowest storage cost per gigabyte among Azure Blob Storage access tiers, but data must be rehydrated to the Hot or Cool tier before reading, incurring additional time and fees. This makes Archive ideal for long-term retention, backup archives, or compliance data that requires minimal cost but does not need immediate access.

Azure Bastion is the correct choice because it is a platform-managed PaaS service that provides secure, browser-based RDP and SSH access to Azure VMs directly from the Azure portal. It connects to a VM's private IP over TLS without requiring a public IP, an agent, or a VPN client on the user's workstation. The service also integrates with Microsoft Entra ID for additional authentication and even supports conditional access policies, making it the ideal secure remote access tool for this scenario.

Microsoft Defender for SQL is a cloud-native security solution that provides advanced threat protection, including vulnerability assessments and security alerts for Azure SQL databases and SQL servers on VMs. It continuously monitors database activity to detect SQL injection, brute-force attacks, and anomalous access patterns, then delivers actionable alerts with investigation steps. This makes it specifically designed for the database-level threat detection described in the scenario.