Courseiva

Microsoft Azure Fundamentals AZ-900 (AZ-900) — Questions 1–75

1031 questions total · 14pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 14

Page 2
1
MCQmedium

A company has a resource group named 'RG-Prod' that contains critical virtual machines (VMs), virtual networks, and a SQL database. The infrastructure team needs to grant a group of developers the ability to start, stop, and restart only the VMs in RG-Prod. The developers must not be able to create new VMs, delete existing VMs, modify the virtual networks, or access the database. The company wants to follow the principle of least privilege. Which Azure role-based access control (RBAC) approach should the company use?

A.Assign the Virtual Machine Contributor built-in role to the developers.
B.Create a custom RBAC role that includes only the specific actions required (e.g., Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action) and assign it to the developers.
C.Assign the Contributor built-in role and then create an Azure Policy to deny any VM creation or deletion and VNet modifications in RG-Prod.
D.Assign the Reader role to the developers and use Azure Policy to automatically start, stop, and restart VMs on their behalf.
AnswerB

A custom RBAC role allows you to define a precise set of allowed actions. By including only the start, deallocate, and restart actions, you grant exactly the permissions needed. The role does not include write or delete actions, so developers cannot create or delete VMs. Since VNet and database actions are not included, those resources are also protected. This meets the least privilege requirement.

Why this answer

Option B is correct because the principle of least privilege requires granting only the exact permissions needed. The built-in Virtual Machine Contributor role includes permissions beyond start/stop/restart (e.g., it allows creating and deleting VMs), which violates the requirement. A custom RBAC role scoped to RG-Prod with only the specific actions (Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/restart/action) meets the need precisely.

Exam trap

The trap here is that candidates often assume built-in roles like Virtual Machine Contributor are sufficiently restrictive, but they actually include broader permissions (e.g., create, delete, modify) that violate the principle of least privilege when only start/stop/restart is needed.

How to eliminate wrong answers

Option A is wrong because the Virtual Machine Contributor built-in role includes permissions to create, delete, and modify VMs (e.g., Microsoft.Compute/virtualMachines/write and delete), which exceeds the required scope and violates least privilege. Option C is wrong because the Contributor built-in role grants full management access to all resources in the resource group, including the ability to modify virtual networks and access the SQL database; Azure Policies can deny specific actions but do not remove the underlying permissions, and the developers would still have Contributor-level access that could be exploited through other means, making this approach insecure and not following least privilege.

Full explanation →
2
MCQmedium

A company manages its production workloads in a dedicated Azure subscription under the root management group. The infrastructure team recently created a critical resource group named 'rg-prod-core' that contains networking resources. To prevent accidental deletion of this entire resource group, the team needs a mechanism that blocks delete operations on 'rg-prod-core' while still allowing changes to resources within it. The solution must not affect any other resource groups in the subscription. Which Azure feature should the team apply to 'rg-prod-core'?

A.Assign an Azure Policy with the 'deny' effect at the management group scope to block deletions of any resource group.
B.Apply a resource lock with the 'CanNotDelete' setting to the resource group.
C.Create a custom RBAC role that explicitly denies the delete action, and assign it to the infrastructure team at the resource group scope.
D.Deploy an Azure Blueprint that includes a policy to audit deletions of the resource group.
AnswerB

A 'CanNotDelete' resource lock prevents deletion of the resource group and its resources but still allows modifications to the resources within. This lock is scoped to the specific resource group, so it does not affect other resource groups.

Why this answer

Option B is correct because a resource lock with the 'CanNotDelete' setting prevents deletion of the resource group while still allowing read and update operations on resources within it. This lock applies only to the specific resource group scope, so it does not affect any other resource groups in the subscription. This directly meets the requirement to block deletion of 'rg-prod-core' without impacting other groups.

Exam trap

The trap here is that candidates often confuse Azure Policy (which enforces compliance rules) with resource locks (which provide operational protection against accidental deletion), leading them to choose a policy-based solution that would affect broader scopes instead of the targeted lock.

How to eliminate wrong answers

Option A is wrong because assigning an Azure Policy with the 'deny' effect at the management group scope would block deletions of all resource groups under that management group, not just 'rg-prod-core', which violates the requirement to not affect other resource groups. Option C is wrong because creating a custom RBAC role that denies the delete action and assigning it to the infrastructure team would only prevent that specific team from deleting the resource group, but other users (e.g., subscription admins) could still delete it, so it does not provide a universal block. Option D is wrong because an Azure Blueprint that includes a policy to audit deletions only logs the event for compliance; it does not actively block the delete operation, so it fails to prevent accidental deletion.

Full explanation →
3
MCQmedium

A company plans to migrate a line-of-business application to Azure. The application will run on a virtual machine (IaaS). The company wants to ensure that the operating system is kept up to date with security patches. According to the shared responsibility model, who is primarily responsible for applying these patches?

A.Microsoft, because they manage all operating system updates in Azure.
B.The customer, because the customer manages the guest operating system and is responsible for patching it.
C.Both Microsoft and the customer share responsibility equally for operating system patching.
D.The cloud service provider, as a general rule for all services in Azure.
AnswerB

This is correct. In IaaS, the customer is responsible for maintaining the guest OS, including applying security patches and updates.

Why this answer

In the shared responsibility model for IaaS, the customer retains control over the guest operating system, including applying security patches. Microsoft manages the physical host and hypervisor but does not patch the OS running inside the VM. Therefore, the customer is primarily responsible for keeping the OS up to date.

Exam trap

The trap here is that candidates often assume Microsoft handles all patching in Azure because of the 'as a service' nature, but in IaaS, the customer retains full control and responsibility for the guest OS.

How to eliminate wrong answers

Option A is wrong because Microsoft does not manage all operating system updates in Azure; they only manage the underlying infrastructure (hypervisor, physical hosts), not the guest OS. Option C is wrong because responsibility is not shared equally for OS patching in IaaS; the customer is fully responsible for the guest OS, while Microsoft handles the host OS and physical security. Option D is wrong because the cloud service provider is not responsible for OS patching in all services; in IaaS, the customer manages the guest OS, whereas in PaaS or SaaS, the provider may handle patching.

Full explanation →
4
MCQeasy

A company needs to store backup data that must be retained for 7 years. They want to store the data as cheaply as possible, and access may be rare. Which Azure Storage access tier is most cost-effective?

A.Hot tier
B.Cool tier
C.Archive tier
D.Premium tier
AnswerC

Archive tier offers the lowest storage cost for data that is accessed rarely, with retrieval taking hours.

Why this answer

The Archive tier is the most cost-effective option for data that must be retained for 7 years with rare access. It offers the lowest storage cost among Azure Blob Storage access tiers, specifically designed for long-term retention where retrieval latency of up to 15 hours is acceptable. This aligns perfectly with the requirement to minimize cost while meeting the 7-year retention period.

Exam trap

The trap here is that candidates often confuse 'cheapest storage cost' with 'cheapest overall cost,' overlooking the high retrieval costs and rehydration latency of the Archive tier, or they mistakenly choose Cool tier because it sounds 'cool enough' for rare access without considering the 7-year retention requirement.

How to eliminate wrong answers

Option A is wrong because the Hot tier is optimized for frequent access (e.g., multiple times per day) and has higher storage costs than Cool or Archive tiers, making it unsuitable for rarely accessed backup data. Option B is wrong because the Cool tier, while cheaper than Hot, is designed for data accessed infrequently (e.g., once every 30 days) and still incurs higher storage costs than Archive, plus early deletion penalties if data is deleted before 30 days. Option D is wrong because the Premium tier is intended for low-latency, high-performance workloads (e.g., Azure Virtual Machine disks) and has the highest storage cost, making it completely inappropriate for cheap, long-term backup storage.

Full explanation →
5
Matchingmedium

Match each Azure pricing model to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Pay only for resources used, no upfront commitment

Pre-pay for one or three years for discount

Use unused capacity at reduced cost

Use on-premises licenses in Azure

12 months of free services and $200 credit

Why these pairings

These models help optimize costs based on usage patterns.

Full explanation →
6
MCQmedium

A company has a critical resource group named 'Prod-Databases' that contains Azure SQL databases and virtual machines used by a production order-processing system. The database administrator wants to prevent any user, including administrators, from accidentally deleting or modifying resources in this resource group. The operations team needs a safeguard that requires an explicit action to be taken before any changes become possible, without affecting the ability to manage resources in other resource groups. Which Azure feature should the team implement?

A.Azure Policy with the Deny effect
B.Azure RBAC role assignment (e.g., restrict to Reader role)
C.Azure Resource Lock (CanNotDelete)
D.Azure management group
AnswerC

Resource Locks (CanNotDelete or ReadOnly) prevent accidental deletion or modification of critical Azure resources. A user must first remove the lock, which provides a clear safeguard. This is the correct feature for the described scenario.

Why this answer

Option C is correct because Azure Resource Locks provide a safeguard that prevents accidental deletion or modification of critical resources at the subscription, resource group, or individual resource level. The CanNotDelete lock specifically blocks delete operations while allowing all read and update operations, and it requires an explicit unlock action before any changes can be made, even by administrators. This meets the requirement of protecting the 'Prod-Databases' resource group without affecting other resource groups.

Exam trap

The trap here is that candidates often confuse Azure Policy's Deny effect with a resource lock, thinking policy can provide a temporary safeguard, but policy is for compliance enforcement and lacks the explicit unlock mechanism that resource locks offer.

How to eliminate wrong answers

Option A is wrong because Azure Policy with the Deny effect is used to enforce compliance rules (e.g., requiring specific resource types or tags) and does not provide a reversible, explicit unlock mechanism; it permanently denies non-compliant resource creation or modification, which would block legitimate administrative changes even after an explicit action. Option B is wrong because assigning the Reader role would prevent all modifications, including necessary updates, and would require changing the role assignment to make changes, which is not an explicit action but a permanent permission change; it also does not allow administrators to temporarily override the restriction without altering the role assignment.

Full explanation →
7
MCQeasy

Which Azure compliance feature allows organizations to understand which standards and regulations Azure services comply with?

A.Azure Security Center
B.Azure Compliance Documentation / Trust Center
C.Azure Policy
D.Azure Blueprints
AnswerB

The Trust Center and compliance documentation list all regulatory certifications and compliance standards Azure meets.

Why this answer

Azure Compliance Documentation (often accessed via the Trust Center) provides detailed information about certifications, attestations, and regulatory standards that Azure services adhere to, such as ISO 27001, SOC 2, and GDPR. This is the dedicated resource for understanding which specific compliance frameworks Azure meets, rather than enforcing or monitoring compliance.

Exam trap

The trap here is that candidates confuse Azure Policy (which enforces compliance rules on resources) with the Compliance Documentation/Trust Center (which explains Azure's own compliance with external standards), leading them to select Azure Policy because it sounds compliance-related.

How to eliminate wrong answers

Option A is wrong because Azure Security Center (now Microsoft Defender for Cloud) is a unified infrastructure security management system that strengthens security posture and provides threat protection, not a repository of compliance documentation. Option C is wrong because Azure Policy enforces organizational standards and assesses compliance at resource level by applying rules and effects (e.g., deny, audit), but it does not list which external regulations Azure itself complies with. Option D is wrong because Azure Blueprints orchestrates the deployment of resource templates, policies, and role assignments to create compliant environments, but it is not a source of information about Azure's own regulatory compliance.

Full explanation →
8
MCQeasy

Which statement accurately describes the consumption-based pricing model in cloud computing?

A.You pay a flat monthly fee regardless of how much you use
B.You pay only for the resources you actually use
C.You must commit to a one-year contract
D.Cloud resources are always free during off-peak hours
AnswerB

Consumption-based pricing means costs scale directly with usage — no idle capacity costs, no upfront investment.

Why this answer

The consumption-based pricing model, also known as pay-as-you-go, is a core financial model in cloud computing where you are billed only for the specific resources you consume (e.g., compute hours, storage GB, data transfer). This model eliminates upfront capital expenditure and allows costs to scale dynamically with usage, directly aligning expenses with actual consumption rather than capacity.

Exam trap

The trap here is that candidates often confuse consumption-based pricing with a flat-rate or subscription model, mistakenly thinking that 'pay-as-you-go' means a fixed monthly fee, when in reality it is variable and directly tied to actual resource usage.

How to eliminate wrong answers

Option A is wrong because a flat monthly fee regardless of usage describes a reserved or subscription-based pricing model, not the consumption-based model which charges only for what you use. Option C is wrong because committing to a one-year contract is characteristic of reserved instances or savings plans, which offer discounted rates in exchange for a term commitment, whereas consumption-based pricing has no upfront commitment. Option D is wrong because cloud resources are never universally free during off-peak hours; while some providers offer limited free tiers or spot instances with variable pricing, the consumption model always incurs charges for resources used, regardless of time.

Full explanation →
9
MCQeasy

What does Azure Auto-Shutdown for virtual machines provide?

A.Automatic deletion of VMs that haven't been used for 30 days
B.Automatic daily power-off of VMs at a configured time to reduce costs
C.Automatic scaling down of VM CPU when under low utilization
D.Automatic failover of VMs to another region during outages
AnswerB

VM Auto-Shutdown powers off VMs at a scheduled time daily, stopping compute billing for dev/test savings.

Why this answer

Azure Auto-Shutdown is a cost-saving feature that automatically powers off virtual machines at a user-defined schedule (e.g., nightly at 7 PM). It helps reduce compute costs by ensuring VMs are not running when not needed, but does not delete or modify the VM's configuration or resources.

Exam trap

The trap here is that candidates confuse 'shutting down' with 'deleting' or 'scaling'—Azure Auto-Shutdown only powers off the VM, it does not remove the VM or adjust its performance characteristics.

How to eliminate wrong answers

Option A is wrong because Azure Auto-Shutdown does not delete VMs; it only powers them off. Automatic deletion after 30 days of inactivity is not a built-in feature—deletion requires manual action or Azure Policy. Option C is wrong because Auto-Shutdown does not scale down CPU or adjust VM size based on utilization; scaling is handled by Azure Autoscale or VM Scale Sets.

Option D is wrong because Auto-Shutdown does not provide failover capabilities; disaster recovery and cross-region failover are managed by Azure Site Recovery or paired regions.

Full explanation →
10
MCQeasy

A company wants to move from an on-premises data center to Azure. They currently budget for purchasing servers, networking equipment, and software licenses as a one-time capital expense. In Azure, they will pay a monthly fee based on the resources they use. What type of cloud benefit does this represent?

A.High availability
B.Scalability
C.Operational expenditure (OpEx)
D.Fault tolerance
AnswerC

OpEx is the model where costs are variable and incurred based on usage, aligning with monthly fees.

Why this answer

Option C is correct because moving from a capital expense (CapEx) model—where servers, networking gear, and licenses are purchased upfront—to a pay-as-you-go monthly fee in Azure represents a shift to operational expenditure (OpEx). This cloud benefit allows the company to avoid large upfront investments and instead pay for only the compute, storage, and network resources consumed, aligning costs with usage.

Exam trap

The trap here is that candidates confuse the financial benefit (OpEx) with operational benefits like high availability or scalability, because all three are cloud advantages, but only OpEx directly addresses the shift from upfront capital spending to ongoing usage-based payments.

How to eliminate wrong answers

Option A is wrong because high availability refers to ensuring services remain accessible despite failures, typically through redundancy across availability zones or regions, not a change in cost model. Option B is wrong because scalability is the ability to increase or decrease resources dynamically based on demand, which is a separate cloud characteristic from the financial shift from CapEx to OpEx. Option D is wrong because fault tolerance is the ability of a system to continue operating without interruption after a component failure, achieved through replication and failover mechanisms, not a billing or expenditure model.

Full explanation →
11
MCQeasy

Which term describes the practice of deploying resources across multiple Azure availability zones to protect against datacenter-level failures?

A.Geo-redundancy
B.Zone-redundant deployment
C.Horizontal scaling
D.Disaster recovery
AnswerB

Zone-redundant deployment spreads resources across availability zones within a region, protecting against datacenter failures.

Why this answer

Zone-redundant deployment (B) is the correct term because it specifically refers to replicating resources across multiple Azure availability zones within a single Azure region. Availability zones are physically separate datacenters with independent power, cooling, and networking, so deploying across them protects against a single datacenter-level failure while keeping the application within the same low-latency region.

Exam trap

The trap here is that candidates often confuse 'zone-redundant deployment' with 'geo-redundancy,' mistakenly thinking both protect against datacenter failures, but geo-redundancy is for region-level failures and involves higher latency, while zone-redundancy is for datacenter-level failures within the same region.

How to eliminate wrong answers

Option A is wrong because geo-redundancy replicates data or services across multiple Azure regions (geographies), not across availability zones within a single region, and is designed to protect against region-wide failures, not datacenter-level failures. Option C is wrong because horizontal scaling (scale-out) adds more instances of a resource (e.g., VMs) to handle increased load, but does not inherently distribute those instances across availability zones for fault tolerance. Option D is wrong because disaster recovery is a broader strategy (e.g., Azure Site Recovery) that includes failover to a secondary region or site after a major outage, not the specific practice of deploying across zones to prevent datacenter-level failures.

Full explanation →
12
MCQeasy

A healthcare company is planning to migrate its on-premises data center to Azure. The CFO wants to shift from making large upfront hardware purchases to paying for IT resources as an ongoing operational cost. Which cloud computing benefit does this scenario describe?

A.High availability
B.Elasticity
C.Operational expenditure (OpEx)
D.Fault tolerance
AnswerC

Operational expenditure (OpEx) is the cloud computing benefit that allows organizations to pay for IT resources as an ongoing cost rather than making large upfront capital investments. This aligns directly with the CFO's goal.

Why this answer

Option C is correct because the scenario describes shifting from capital expenditure (CapEx) for upfront hardware purchases to operational expenditure (OpEx) for ongoing, pay-as-you-go IT resource consumption. This is a core financial benefit of cloud computing, where costs are treated as variable operating expenses rather than fixed capital investments.

Exam trap

The trap here is that candidates often confuse operational expenditure (OpEx) with elasticity or high availability, but the question specifically focuses on the financial shift from upfront hardware purchases to ongoing operational costs, not on scaling or reliability features.

How to eliminate wrong answers

Option A is wrong because high availability refers to ensuring services remain accessible despite failures, not to the financial model of paying for resources. Option B is wrong because elasticity describes the ability to automatically scale resources up or down based on demand, not the shift from upfront to ongoing costs. Option D is wrong because fault tolerance is the ability of a system to continue operating after a component failure, which is a reliability feature, not a cost model.

Full explanation →
13
MCQeasy

A company deploys their application across multiple availability zones in an Azure region. This is done to improve which aspect of the application?

A.Scalability
B.Elasticity
C.High availability
D.Cost efficiency
AnswerC

Availability zones improve uptime by isolating failures.

Why this answer

Deploying an application across multiple availability zones within an Azure region ensures that if one zone experiences an outage (e.g., due to power failure or network disruption), the application can continue serving traffic from the remaining zones. This architecture directly improves high availability by eliminating a single point of failure at the datacenter level, typically achieving a service-level agreement (SLA) of 99.99% for virtual machines when using two or more instances across zones.

Exam trap

The trap here is that candidates confuse high availability with scalability or elasticity, mistakenly thinking that distributing across zones helps handle more users or automatically adjust capacity, when in fact it is solely about maintaining uptime during failures.

How to eliminate wrong answers

Option A is wrong because scalability refers to the ability to increase or decrease resources (e.g., adding more VMs or scaling out) to handle varying load, which is achieved through features like Azure Virtual Machine Scale Sets or autoscaling, not by distributing across availability zones alone. Option B is wrong because elasticity is the ability to automatically provision and de-provision resources in response to demand changes, which is a dynamic scaling behavior often implemented with Azure Autoscale, not a direct benefit of multi-zone deployment.

Full explanation →
14
MCQmedium

A company has a policy that all Azure resources must have a tag named 'CostCenter'. The governance team wants to automatically add the tag with a default value 'IT' to any new resource that is created without it. The team wants the tag to be applied during resource creation, not just report non-compliance. The solution must also support remediation for existing non-compliant resources if needed later. Which Azure Policy effect should the team use in their policy definition?

A.Append
B.Modify
C.DeployIfNotExists
D.Audit
AnswerB

Correct. The Modify effect is designed to add, change, or remove tags and other properties on resources. It can be applied during resource creation or update and supports remediation tasks to bring existing non-compliant resources into compliance. This makes it the best fit for the scenario.

Why this answer

The Modify effect is correct because it can automatically add or change tags on resources during creation or update, enforcing compliance in real-time. Unlike Append, Modify supports both creation and remediation of existing resources, and unlike DeployIfNotExists, it directly alters the resource properties without deploying a separate remediation task.

Exam trap

The trap here is that candidates confuse Append with Modify, thinking Append can also update existing tags, but Append only adds to properties that don't exist, while Modify can replace or add tags and supports full remediation for existing resources.

How to eliminate wrong answers

Option A is wrong because Append can only add tags to resources during creation or update, but it cannot modify existing tags or support remediation for existing non-compliant resources without additional policy re-evaluation. Option C is wrong because DeployIfNotExists is used to deploy a resource (like a Logic App) to remediate non-compliance, not to directly modify the resource's tags during creation; it requires a separate remediation task and does not apply the tag automatically at resource creation time.

Full explanation →
15
MCQmedium

Which Azure service provides application-level, request-based routing with session persistence for web workloads?

A.Azure Load Balancer
B.Azure Application Gateway
C.Azure Traffic Manager
D.Azure Front Door
AnswerB

Application Gateway provides layer 7 load balancing with URL routing, session affinity, SSL termination, and WAF.

Why this answer

Azure Application Gateway is a Layer 7 (HTTP/HTTPS) load balancer that provides application-level, request-based routing based on URL path, host headers, or other HTTP attributes. It also supports session persistence (also known as sticky sessions) using cookies, which ensures that all requests from a client during a session are directed to the same backend server. This makes it the correct choice for web workloads requiring request-level routing and session affinity.

Exam trap

The trap here is that candidates often confuse Azure Load Balancer (Layer 4) with Azure Application Gateway (Layer 7), assuming all load balancers provide application-level routing and session persistence, but only Layer 7 services like Application Gateway can inspect HTTP headers and manage cookie-based affinity.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and routes traffic based on IP address and port, not on application-level request attributes like URL paths or HTTP headers, and it does not natively provide session persistence via cookies. Option C is wrong because Azure Traffic Manager is a DNS-based traffic router that directs traffic based on DNS resolution and endpoint health, not on individual HTTP requests; it cannot perform request-level routing or maintain session persistence at the application layer. Option D is wrong because Azure Front Door is a global Layer 7 load balancer and CDN that can route requests based on URL paths and supports session affinity, but it is designed for global, multi-region scenarios with edge caching and WAF capabilities, not specifically for application-level, request-based routing with session persistence for a single-region web workload—Application Gateway is the more targeted service for that use case.

Full explanation →
16
MCQmedium

A company runs a critical line-of-business application on Azure virtual machines. The operations team needs to receive proactive notifications about any upcoming planned maintenance events that could affect their virtual machines, as well as real-time alerts when a service incident occurs in the Azure region where the application is deployed. The team wants a native Azure solution that provides a personalized view of all service health events relevant to their subscriptions, including historical incident reports. Which Azure service should the operations team use?

A.Azure Monitor
B.Azure Service Health
C.Azure Advisor
D.Azure Status Page (status.azure.com)
AnswerB

Correct. Azure Service Health provides a personalized view of the health of Azure services, regions, and resources you actually use. It includes alerts for planned maintenance, service issues, and health advisories, and offers a historical incident report. It is the native Azure solution for this requirement.

Why this answer

Azure Service Health provides a personalized dashboard of service health events, including planned maintenance notifications, real-time service incident alerts, and historical reports, all scoped to the user's subscriptions. This makes it the correct native Azure solution for the operations team's requirements.

Exam trap

The trap here is that candidates often confuse Azure Monitor's alerting capabilities with Service Health's platform-level notifications, but Azure Monitor is designed for resource-level telemetry, not for Azure service-wide planned maintenance or incident alerts.

How to eliminate wrong answers

Option A is wrong because Azure Monitor focuses on collecting and analyzing telemetry from resources (e.g., metrics, logs) for performance and diagnostics, not on providing a personalized view of Azure platform-level service health events or planned maintenance notifications. Option C is wrong because Azure Advisor offers personalized recommendations for optimizing cost, security, reliability, and performance, but it does not deliver proactive notifications about planned maintenance or real-time service incident alerts.

Full explanation →
17
MCQeasy

A company wants to ensure its Azure resources are deployed in a geographic location that is paired with another region for disaster recovery. If a regional outage occurs, they plan to failover to the paired region. Which concept does this describe?

A.Azure region pairs
B.Availability zones
C.Azure geographies
D.Sovereign regions
AnswerA

Correct. Region pairs provide cross-region replication and failover capabilities.

Why this answer

Azure region pairs are designed to support disaster recovery by ensuring that each Azure region is paired with another region in the same geography (e.g., East US paired with West US). During a regional outage, services can failover to the paired region, and Microsoft prioritizes recovery of paired regions to minimize downtime. This concept directly matches the scenario described, where the company plans to use a paired region for failover.

Exam trap

The trap here is that candidates often confuse availability zones (which provide redundancy within a region) with region pairs (which provide disaster recovery across regions), leading them to select availability zones when the question explicitly mentions a paired region for failover.

How to eliminate wrong answers

Option B (Availability zones) is wrong because availability zones are physically separate datacenters within a single Azure region, used for high availability within that region, not for cross-region disaster recovery. Option C (Azure geographies) is wrong because a geography is a broader grouping of regions that ensures data residency and compliance boundaries, but it does not define the specific failover pairing between two regions. Option D (Sovereign regions) is wrong because sovereign regions are isolated instances of Azure (e.g., US Gov, China) designed for compliance and regulatory requirements, not for general disaster recovery pairing with other commercial regions.

Full explanation →
18
MCQmedium

A company manages hundreds of Azure SQL databases across multiple subscriptions. The compliance team requires that every Azure SQL database has diagnostic settings enabled to send logs to a central Log Analytics workspace. The team wants a solution that automatically configures diagnostic settings for any new Azure SQL database when it is created, without requiring manual intervention or additional scripting. Which Azure governance feature should the team use?

A.Azure Policy with the DeployIfNotExists effect
B.Azure Blueprints with a resource group artifact
C.Azure Resource Manager templates deployed via Azure DevOps
D.Azure Monitor with a data collection rule
AnswerA

This option is correct. The DeployIfNotExists effect automatically deploys a template to configure diagnostic settings on resources that do not have them, making it ideal for ensuring compliance on newly created SQL databases.

Why this answer

Azure Policy with the DeployIfNotExists effect is the correct choice because it automatically evaluates new Azure SQL databases against a policy rule and, if diagnostic settings are missing, triggers a remediation task to deploy them to the specified Log Analytics workspace. This effect operates at resource creation time without manual intervention or scripting, fulfilling the compliance team's requirement for automatic, consistent configuration across all subscriptions.

Exam trap

The trap here is that candidates often confuse Azure Policy's DeployIfNotExists effect with Azure Blueprints or Azure Monitor data collection rules, mistakenly thinking those can automatically configure resources at creation time, but only Azure Policy provides native, automatic enforcement and remediation without additional scripting or manual triggers.

How to eliminate wrong answers

Option B is wrong because Azure Blueprints with a resource group artifact can define a template for the environment but does not automatically enforce or remediate settings on newly created resources outside the blueprint's scope; it requires manual assignment or redeployment. Option C is wrong because Azure Resource Manager templates deployed via Azure DevOps require a pipeline trigger or manual execution for each new database, not automatic enforcement at creation time. Option D is wrong because Azure Monitor with a data collection rule collects telemetry from existing resources but cannot deploy or enforce diagnostic settings on Azure SQL databases; it is designed for data ingestion, not policy-driven configuration.

Full explanation →
19
MCQeasy

Which Azure service provides managed relational database compatible with open-source PostgreSQL?

A.Azure SQL Managed Instance
B.Azure Database for PostgreSQL
C.Azure Cosmos DB for PostgreSQL
D.Azure SQL Database Hyperscale
AnswerB

Azure Database for PostgreSQL is the fully managed PostgreSQL service with automatic backups and high availability.

Why this answer

Azure Database for PostgreSQL is a fully managed relational database service specifically built for PostgreSQL, providing high availability, automated backups, and built-in security. It is the correct choice because it directly offers a managed PostgreSQL-compatible database without requiring any middleware or translation layer.

Exam trap

The trap here is that candidates confuse 'Azure Cosmos DB for PostgreSQL' (a distributed, multi-model service) with a standard managed relational PostgreSQL database, assuming the name implies full relational compatibility, when in fact it is optimized for sharded, globally distributed workloads and lacks some PostgreSQL features like triggers and foreign keys in certain configurations.

How to eliminate wrong answers

Option A is wrong because Azure SQL Managed Instance is a managed SQL Server offering, not compatible with PostgreSQL's wire protocol or SQL dialect. Option C is wrong because Azure Cosmos DB for PostgreSQL is a distributed database service that uses PostgreSQL as a front-end but is designed for multi-region, multi-model workloads, not as a standard managed relational PostgreSQL database. Option D is wrong because Azure SQL Database Hyperscale is a scaling tier for Azure SQL Database (SQL Server-based), not for PostgreSQL.

Full explanation →
20
MCQeasy

A company wants to ensure that all new Azure resources in a subscription are automatically tagged with a 'Department' tag. Which Azure service should they use to enforce this requirement?

A.Azure Policy
B.Azure Blueprints
C.Azure RBAC
D.Azure Resource Lock
AnswerA

Azure Policy can enforce tags on resources by using built-in or custom policies that audit or require tags.

Why this answer

Azure Policy is correct because it allows you to create, assign, and manage policies that enforce specific rules on your Azure resources. In this scenario, you can use a built-in or custom policy definition to require a 'Department' tag on all new resources, and Azure Policy will automatically evaluate and enforce this rule during resource creation, preventing non-compliant resources from being provisioned.

Exam trap

The trap here is that candidates often confuse Azure Policy with Azure Blueprints, thinking Blueprints can enforce tags, but Blueprints only deploys policies as part of a blueprint definition, not enforce them independently.

How to eliminate wrong answers

Option B (Azure Blueprints) is wrong because Azure Blueprints is used for orchestrating the deployment of resource templates, policies, and role assignments as a repeatable package, not for enforcing tagging rules in real time. Option C (Azure RBAC) is wrong because Azure RBAC manages access control by assigning roles to users, groups, or applications, but it does not enforce resource-level configurations like tags. Option D (Azure Resource Lock) is wrong because Resource Locks prevent accidental deletion or modification of resources at the resource, resource group, or subscription level, but they cannot enforce tagging requirements.

Full explanation →
21
MCQmedium

A software company develops a microservices application using Docker containers. The application consists of multiple services that need to be deployed, scaled, and managed together. The company wants to use Azure to orchestrate and manage these containers without provisioning or managing the underlying virtual machines. Which Azure service should they use?

A.Azure Container Instances
B.Azure Kubernetes Service (AKS)
C.Azure App Service
D.Azure Batch
AnswerB

AKS is a managed Kubernetes service that provides full orchestration capabilities for deploying and managing containerized microservices. It abstracts the underlying infrastructure, including virtual machines, so you can focus on application deployment and scaling.

Why this answer

Azure Kubernetes Service (AKS) is the correct choice because it provides a fully managed Kubernetes orchestration platform that automates the deployment, scaling, and management of containerized microservices. AKS abstracts the underlying virtual machines, allowing the company to focus on application logic without provisioning or managing the VM infrastructure, which directly matches the requirement for orchestration without VM management.

Exam trap

The trap here is that candidates often confuse Azure Container Instances (ACI) as a suitable orchestration tool because it runs containers quickly, but they overlook that ACI lacks the multi-service orchestration, service discovery, and scaling capabilities that Kubernetes (via AKS) provides for microservices applications.

How to eliminate wrong answers

Option A is wrong because Azure Container Instances (ACI) is a serverless container service for running individual containers on demand, but it lacks built-in orchestration, scaling, and management capabilities for multiple services working together as a microservices application. Option C is wrong because Azure App Service is a Platform-as-a-Service (PaaS) for hosting web applications, RESTful APIs, and mobile backends, but it does not natively support Docker container orchestration or multi-service microservices deployment without additional configuration (e.g., using Web App for Containers with limited orchestration). Option D is wrong because Azure Batch is designed for large-scale parallel and high-performance computing (HPC) workloads, not for orchestrating long-running microservices containers with service discovery and scaling.

Full explanation →
22
MCQmedium

Which Azure service enables serverless compute for running containers with scale-to-zero capabilities?

A.Azure Functions
B.Azure Container Apps
C.Azure Kubernetes Service
D.Azure Container Instances
AnswerB

Container Apps provides serverless containers with scale-to-zero and KEDA-based event-driven autoscaling.

Why this answer

Azure Container Apps is the correct answer because it is a fully managed serverless container service that automatically scales down to zero when there is no traffic, meaning you only pay for resources when your containers are actively running. This scale-to-zero capability is a key differentiator from other container services, as it allows cost-efficient execution of event-driven or idle workloads without maintaining a running cluster.

Exam trap

The trap here is that candidates often confuse Azure Container Apps with Azure Container Instances (ACI) because both are described as 'serverless containers,' but ACI lacks automatic scale-to-zero and has a minimum billing duration, whereas Container Apps is designed specifically for that capability.

How to eliminate wrong answers

Option A is wrong because Azure Functions is a serverless compute service for running code (functions) in response to events, but it does not natively run containers; it uses a function runtime and is designed for code snippets, not containerized applications. Option C is wrong because Azure Kubernetes Service (AKS) is a managed Kubernetes cluster that requires at least one running node (VM) and does not support scale-to-zero; you pay for the underlying VMs even when no pods are scheduled. Option D is wrong because Azure Container Instances (ACI) provides serverless containers but does not support scale-to-zero; each container group has a minimum billing duration (typically 1 minute) and cannot scale down to zero instances automatically.

Full explanation →
23
MCQmedium

A global e-commerce company runs its website on Azure virtual machines in two different Azure regions: West US and East US. The company wants to distribute incoming web traffic to the region that provides the lowest latency for each user. Additionally, if one region becomes unavailable, all traffic should automatically fail over to the healthy region. The solution must not require any changes to the web application code. Which Azure service should the company use?

A.Azure Traffic Manager
B.Azure Load Balancer
C.Azure Application Gateway
D.Azure Front Door
AnswerA

Correct. Azure Traffic Manager uses DNS to direct client traffic to the closest or healthiest regional endpoint based on the performance routing method. It automatically fails over in case of region failure, and requires no application changes.

Why this answer

Azure Traffic Manager is a DNS-based traffic load balancer that directs incoming web traffic to the region with the lowest latency based on the user's DNS resolver location. It supports automatic failover by routing traffic to the next healthy endpoint if a region becomes unavailable, and it requires no changes to the web application code because it operates at the DNS level.

Exam trap

The trap here is that candidates often confuse Azure Traffic Manager with Azure Front Door, but Front Door requires HTTPS and operates at the application layer with additional features like caching and WAF, whereas Traffic Manager is a simpler DNS-based solution that meets the requirement of no code changes and works with any HTTP/HTTPS or TCP traffic.

How to eliminate wrong answers

Option B (Azure Load Balancer) is wrong because it operates at Layer 4 (transport layer) and distributes traffic within a single region, not across multiple regions, and cannot perform latency-based routing or cross-region failover. Option C (Azure Application Gateway) is wrong because it is a regional Layer 7 load balancer focused on HTTP/HTTPS traffic with features like SSL termination and URL-based routing, but it does not provide global latency-based routing or multi-region failover. Option D (Azure Front Door) is wrong because, although it is a global Layer 7 service with latency-based routing and failover, it requires the web application to be served over HTTPS and can introduce additional HTTP-level processing (e.g., caching, WAF) that may not be desired; the question specifies no code changes, and Traffic Manager works purely at DNS without any application-layer dependencies.

Full explanation →
24
MCQmedium

What is the purpose of Azure Policy initiatives (policy sets)?

A.To deploy a group of Azure resources as a single unit
B.To group related policy definitions for assignment and management as a single unit
C.To create hierarchical management of Azure subscriptions
D.To set spending limits across multiple resource groups
AnswerB

Policy initiatives bundle related policies (like all HIPAA requirements) into one assignable unit.

Why this answer

Azure Policy initiatives, also known as policy sets, allow you to group together multiple related policy definitions into a single, manageable unit. This simplifies assignment and management by enabling you to apply a collection of compliance rules (e.g., for security or cost control) to a scope as one entity, rather than assigning each policy individually.

Exam trap

The trap here is confusing Azure Policy initiatives with Azure Blueprints, which also group resources but include artifacts like ARM templates and role assignments, whereas initiatives are purely for grouping policy definitions.

How to eliminate wrong answers

Option A is wrong because deploying a group of Azure resources as a single unit is the purpose of Azure Resource Manager (ARM) templates or Azure Blueprints, not Azure Policy initiatives. Option C is wrong because creating hierarchical management of Azure subscriptions is achieved through Azure management groups, which organize subscriptions into a hierarchy for policy and access management. Option D is wrong because setting spending limits across multiple resource groups is handled by Azure Cost Management + Billing budgets and alerts, not by Azure Policy initiatives.

Full explanation →
25
MCQmedium

A company uses Azure Blueprints to enforce a standard landing zone for all development subscriptions. The blueprint includes a virtual network, subnets, and network security groups. After the blueprint is assigned to a subscription, a development team manually adds a new subnet to the virtual network. The company plans to update the blueprint to add a new network security group rule. When the updated blueprint is published and the assignment is updated, what will happen to the manually added subnet?

A.The manually added subnet will be removed because the blueprint definition now takes precedence.
B.The manually added subnet will be preserved because blueprints do not manage resources after creation.
C.The manually added subnet will be overwritten by the updated blueprint definition.
D.The blueprint update will fail because the subnet already exists.
AnswerB

This is correct. By default, Azure Blueprints do not actively manage resources after they are deployed. When the blueprint assignment is updated, only the resources defined in the blueprint are added or modified; manually added resources that are not in the blueprint remain unchanged.

Why this answer

Azure Blueprints deploy resources using Azure Resource Manager templates in incremental mode by default. When a blueprint assignment is updated, only the resources defined in the blueprint are affected. Resources that were manually created and are not part of the blueprint definition—such as the manually added subnet—are preserved and not removed or overwritten.

To prevent manual modifications, a resource lock can be applied via the blueprint assignment, but that is not the case in this scenario.

Full explanation →
26
MCQmedium

Which cloud concept allows businesses to deploy applications to global markets quickly without building physical infrastructure in those locations?

A.Elasticity
B.Capital expense avoidance
C.Global reach through cloud infrastructure
D.Fault tolerance
AnswerC

Cloud's global infrastructure allows instant deployment to any region without building physical data centers.

Why this answer

Option C is correct because global reach through cloud infrastructure enables businesses to deploy applications in multiple geographic regions using the cloud provider's existing data centers, eliminating the need to build and manage physical infrastructure in each target market. Providers like Azure offer region pairs and geographies that allow low-latency access and compliance with local data residency requirements, enabling rapid global expansion.

Exam trap

The trap here is that candidates often confuse elasticity (scaling resources) or fault tolerance (high availability) with the ability to deploy globally, but neither concept inherently provides geographic distribution without physical infrastructure.

How to eliminate wrong answers

Option A is wrong because elasticity refers to the ability to automatically scale resources up or down based on demand, not to deploying applications globally without physical infrastructure. Option B is wrong because capital expense avoidance describes shifting from upfront hardware purchases to operational spending, which is a financial benefit of cloud computing but does not directly address global deployment capabilities. Option D is wrong because fault tolerance ensures system availability and resilience against failures through redundancy, but it does not enable deployment to new geographic markets without building physical infrastructure.

Full explanation →
27
Matchingmedium

Match each Azure identity service to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Cloud-based identity and access management

Customer identity and access management

Managed domain services like Group Policy

Automatically managed identity for Azure resources

Sync on-premises directories to Azure AD

Why these pairings

These services cover identity management for users, customers, and resources.

Full explanation →
28
MCQmedium

Which Azure networking service acts as a software-defined WAN that connects branch offices, datacenters, and remote users through an optimized global network?

A.Azure VPN Gateway
B.Azure Virtual WAN
C.Azure ExpressRoute
D.Azure Load Balancer
AnswerB

Azure Virtual WAN provides software-defined WAN capabilities, optimizing connectivity across branches, datacenters, and remote users over Microsoft's backbone.

Why this answer

Azure Virtual WAN is a software-defined WAN (SD-WAN) service that provides a unified, optimized global network connecting branch offices, datacenters, and remote users. It leverages Microsoft's global backbone to route traffic efficiently, automatically selecting the best path and reducing latency, while integrating with VPN, ExpressRoute, and SD-WAN partners for seamless connectivity.

Exam trap

The trap here is that candidates confuse Azure VPN Gateway with Virtual WAN because both support VPN connectivity, but Virtual WAN is a full SD-WAN solution that aggregates multiple connection types and optimizes global routing, whereas VPN Gateway is a single-site VPN endpoint.

How to eliminate wrong answers

Option A is wrong because Azure VPN Gateway is a site-to-site or point-to-site VPN service that creates encrypted tunnels over the public internet, but it does not provide a software-defined WAN architecture or global network optimization across multiple locations. Option C is wrong because Azure ExpressRoute is a dedicated private connection from on-premises to Azure that bypasses the internet, but it is a point-to-point link, not a software-defined WAN that connects multiple branch offices and remote users through an optimized global network. Option D is wrong because Azure Load Balancer is a Layer 4 traffic distribution service that balances incoming traffic across virtual machines or instances within a region, and it has no role in WAN connectivity or branch office networking.

Full explanation →
29
MCQmedium

What is the purpose of Azure Active Directory B2C?

A.To manage employee identities and corporate application access
B.To provide customer identity management for consumer-facing applications
C.To replicate on-premises Active Directory to Azure
D.To manage service-to-service authentication using managed identities
AnswerB

Azure AD B2C enables consumer sign-up/sign-in for applications using social or local accounts.

Why this answer

Azure Active Directory B2C (Business-to-Consumer) is a customer identity access management (CIAM) solution designed specifically for external-facing applications. It allows developers to manage customer sign-up, sign-in, and profile management using social identity providers (e.g., Google, Facebook) or local accounts, while keeping customer identities isolated from the organization's employee directory (Azure AD). This directly supports consumer-facing applications, not internal employee access.

Exam trap

The trap here is that candidates confuse Azure AD B2C with Azure AD, assuming both are for employee identity, when Azure AD B2C is exclusively for customer-facing identity management with social login support.

How to eliminate wrong answers

Option A is wrong because managing employee identities and corporate application access is the purpose of Azure Active Directory (Azure AD), not Azure AD B2C. Option C is wrong because replicating on-premises Active Directory to Azure is achieved using Azure AD Connect, not Azure AD B2C. Option D is wrong because managing service-to-service authentication using managed identities is a feature of Azure AD (via managed identities for Azure resources), not Azure AD B2C.

Full explanation →
30
MCQmedium

A company's development team wants to deploy a containerized application without worrying about the underlying virtual machines or Kubernetes control plane. They need a service that automatically manages the container orchestration, scales, and provides rolling updates. Which Azure compute service should they choose?

A.Azure Kubernetes Service (AKS)
B.Azure Container Instances (ACI)
C.Azure Container Apps
D.Azure Service Fabric
AnswerA

Correct. AKS provides a managed Kubernetes environment, automating orchestration, scaling, and updates.

Why this answer

Azure Kubernetes Service (AKS) is the correct choice because it provides a fully managed Kubernetes cluster, handling the control plane and worker node management, while allowing the development team to focus on deploying and managing containerized applications. AKS supports automatic scaling, rolling updates, and self-healing, meeting the requirement for a managed container orchestration service without worrying about underlying VMs or the Kubernetes control plane.

Exam trap

The trap here is that candidates often confuse Azure Container Apps (a serverless abstraction) with a fully managed Kubernetes service, but Container Apps hides the Kubernetes control plane and does not provide the same level of orchestration control as AKS, making AKS the correct answer for teams needing direct Kubernetes management.

How to eliminate wrong answers

Option B (Azure Container Instances) is wrong because it is a serverless container service that runs individual containers on demand without orchestration, scaling, or rolling update capabilities—it lacks the Kubernetes control plane and multi-container orchestration features required. Option C (Azure Container Apps) is wrong because it is a serverless platform for microservices and containerized applications that abstracts away Kubernetes but does not provide direct control over the Kubernetes control plane or full orchestration features like AKS; it is designed for simpler scenarios, not for teams needing full Kubernetes orchestration. Option D (Azure Service Fabric) is wrong because it is a distributed systems platform for building and managing microservices and applications, not a container orchestration service like Kubernetes; it uses its own programming model and runtime, not Kubernetes, and is more complex than the managed Kubernetes solution needed.

Full explanation →
31
MCQmedium

What is the Microsoft Trust Center?

A.A tool for managing Azure resource permissions
B.A website providing information about Microsoft's security, privacy, and compliance practices
C.A monitoring service for Azure infrastructure health
D.An Azure portal feature for security recommendations
AnswerB

The Microsoft Trust Center publishes compliance documentation, audit reports, and transparency information about how Microsoft secures and handles data.

Why this answer

The Microsoft Trust Center is a dedicated website that provides detailed information about Microsoft's security, privacy, and compliance practices. It serves as a central resource for customers to understand how Microsoft protects their data, including certifications, audit reports, and regulatory compliance documentation. This aligns with the need for transparency in cloud services, making option B correct.

Exam trap

The trap here is that candidates confuse the Microsoft Trust Center with operational or management tools like Azure Security Center or Azure Policy, because all relate to security, but the Trust Center is purely informational and not a functional service.

How to eliminate wrong answers

Option A is wrong because the Microsoft Trust Center is not a tool for managing Azure resource permissions; that role belongs to Azure Role-Based Access Control (RBAC) and Azure Policy. Option C is wrong because monitoring Azure infrastructure health is the function of Azure Monitor and Service Health, not the Trust Center. Option D is wrong because security recommendations in the Azure portal are provided by Microsoft Defender for Cloud (formerly Azure Security Center), not the Trust Center.

Full explanation →
32
MCQmedium

A company has deployed a production Azure SQL Database that is used by a critical line-of-business application. The database administrators need to be able to change the database schema and scaling settings. However, the operations team must ensure that no one can accidentally delete the database or its server. The company does not want to implement a complex backup strategy for this prevention; they want a simple control that can be applied at the resource level without affecting other management operations. What should the operations team configure to meet these requirements?

A.An Azure Policy definition with the 'Deny' effect assigned to the resource group containing the database
B.A custom Azure Role-Based Access Control (RBAC) role that excludes the delete action
C.A 'CanNotDelete' resource lock on the database and the server
D.An Azure Blueprint that includes a policy enforcing a read-only state
AnswerC

Correct. A 'CanNotDelete' resource lock prevents deletion of the resource while allowing all other management operations such as reading, updating, and scaling. This directly meets the requirement for a simple, resource-level control.

Why this answer

A 'CanNotDelete' resource lock on the database and the server prevents accidental deletion while still allowing all other management operations, including schema changes and scaling. This meets the requirement for a simple, resource-level control that does not affect read or update permissions.

Exam trap

The trap here is that candidates often confuse Azure Policy (which enforces compliance rules across resources) with resource locks (which are simple, resource-level safeguards against accidental deletion), leading them to choose a policy or RBAC solution that is either too broad or too complex for the stated requirement.

How to eliminate wrong answers

Option A is wrong because an Azure Policy with 'Deny' effect applies to all resources in the resource group and can block a wide range of actions (e.g., creating, updating), not just deletion, which would interfere with schema changes and scaling. Option B is wrong because a custom RBAC role that excludes the delete action would require careful assignment and management, and it could inadvertently affect other operations if not scoped correctly; it is also more complex than a simple resource lock. Option D is wrong because an Azure Blueprint that enforces a read-only state would prevent all write operations, including schema changes and scaling, which violates the requirement to allow those actions.

Full explanation →
33
MCQeasy

What is the primary difference between a public cloud and a private cloud?

A.Public cloud is more secure than private cloud
B.Public cloud infrastructure is shared among multiple customers; private is dedicated to one organization
C.Private cloud is always hosted by a third-party provider
D.Public cloud can only be accessed from within the organization's network
AnswerB

Public cloud is multi-tenant (shared); private cloud dedicates resources to a single organization.

Why this answer

The primary difference is that a public cloud uses a multi-tenant architecture where infrastructure resources like compute, storage, and networking are shared across multiple unrelated customers, while a private cloud provisions dedicated infrastructure for a single organization, either on-premises or hosted by a third party. This distinction is fundamental to cloud deployment models as defined by NIST SP 800-145, which emphasizes resource pooling in public clouds versus single-tenant isolation in private clouds.

Exam trap

The trap here is that candidates often confuse 'security' as the primary difference, but Azure's shared responsibility model means both public and private clouds require proper security configuration, and the real distinction is multi-tenancy versus single-tenancy.

How to eliminate wrong answers

Option A is wrong because security is not inherently a differentiator between public and private clouds; both can be secure or insecure depending on configuration, compliance controls, and shared responsibility models. Option C is wrong because a private cloud can be hosted on-premises within an organization's own data center, not exclusively by a third-party provider. Option D is wrong because public clouds are accessible over the public internet from any network, not restricted to an organization's internal network.

Full explanation →
34
MCQmedium

A multinational corporation must ensure that every new Azure subscription automatically conforms to corporate security and compliance baselines. The team wants to deploy a predefined set of Azure resources (e.g., a central logging storage account, a network security group configuration) and apply a standard set of Azure Policy definitions (e.g., restricting allowed VM sizes, enforcing encryption) to any new subscription. They want to manage these as a single, versioned package that can be updated and re-assigned to existing subscriptions. Which Azure service should they use?

A.Azure Policy
B.Azure Blueprints
C.Azure Management Groups
D.Azure Resource Manager templates
AnswerB

Azure Blueprints is designed to define a repeatable set of Azure resources and policies that can be deployed together as a single, versioned artifact. It orchestrates the deployment of ARM templates, policy assignments, role assignments, and other artifacts to ensure new subscriptions meet corporate baselines.

Why this answer

Azure Blueprints is the service that enables the orchestrated deployment of resource templates (such as ARM templates) and policy assignments as a single, versioned package. It allows organizations to define a repeatable set of Azure resources and policies that can be applied to new or existing subscriptions to ensure consistency and compliance. Azure Policy alone can enforce rules but cannot deploy resources.

Azure Management Groups only organize subscriptions for hierarchical management. Azure Resource Manager templates can deploy resources but cannot natively enforce policies or be versioned as a governance package in the same way as Blueprints.

Full explanation →
35
MCQeasy

A company wants to move from paying large upfront costs for hardware to a model where they only pay for what they use on a monthly basis. This represents a shift from CapEx to which type of expenditure?

A.Operational expenditure (OpEx)
B.Direct expenditure
C.Indirect expenditure
D.Capital expenditure
AnswerA

OpEx is the ongoing cost of using cloud services, matching the pay-as-you-go model.

Why this answer

This scenario describes a shift from Capital Expenditure (CapEx), where large upfront costs are incurred for hardware, to Operational Expenditure (OpEx), where costs are based on actual usage and billed monthly. In cloud computing, OpEx aligns with the consumption-based model, where you pay only for resources consumed (e.g., compute hours, storage GB) without upfront commitments. This is a core financial benefit of cloud services like Azure, enabling variable costs instead of fixed capital investments.

Exam trap

The trap here is that candidates may confuse 'Direct expenditure' or 'Indirect expenditure' with OpEx, but these are not standard financial classifications in cloud cost models; the exam specifically tests the CapEx-to-OpEx shift as a key cloud concept.

How to eliminate wrong answers

Option B (Direct expenditure) is wrong because it is not a standard accounting term used to categorize IT spending models; CapEx and OpEx are the recognized classifications. Option C (Indirect expenditure) is wrong because it refers to costs not directly traceable to a specific product or service, such as overhead, not the consumption-based billing model. Option D (Capital expenditure) is wrong because it describes the exact opposite of the shift—large upfront costs for long-term assets—which the company is moving away from.

Full explanation →
36
MCQmedium

Which Azure service provides automatic failover and load balancing for SQL Server databases across multiple Azure VMs?

A.Azure SQL Database with active geo-replication
B.SQL Server Always On availability groups on Azure VMs
C.Azure Load Balancer
D.Azure Site Recovery
AnswerB

Always On availability groups provide automatic failover and load balancing for SQL Server databases on Azure VMs.

Why this answer

B is correct because SQL Server Always On availability groups on Azure VMs provide native high availability and disaster recovery for SQL Server, including automatic failover between replicas and built-in read/write load balancing via listener endpoints. This service operates at the SQL Server instance level, supporting multiple Azure VMs in an availability set or availability zone, and uses Windows Server Failover Clustering (WSFC) for health monitoring and automatic failover.

Exam trap

The trap here is that candidates confuse Azure SQL Database's built-in high availability (which is fully managed and includes automatic failover) with the IaaS-based SQL Server on Azure VMs, where you must configure Always On availability groups yourself to achieve similar automatic failover and load balancing.

How to eliminate wrong answers

Option A is wrong because Azure SQL Database with active geo-replication provides automatic failover at the database level but does not support SQL Server on Azure VMs; it is a PaaS service for Azure SQL Database, not for SQL Server installed on VMs. Option C is wrong because Azure Load Balancer distributes network traffic across VMs at Layer 4 (TCP/UDP) but does not provide SQL Server-level automatic failover or database synchronization; it lacks awareness of SQL Server instance health or data consistency. Option D is wrong because Azure Site Recovery orchestrates disaster recovery for entire VMs or workloads by replicating VMs to a secondary region, but it does not provide automatic failover or load balancing for SQL Server databases within a single region; it requires manual or scripted failover and does not handle SQL Server listener or read-scale routing.

Full explanation →
37
MCQmedium

A company stores billions of image files that are accessed frequently via HTTP from a web application. They need a highly scalable and durable storage solution with global accessibility. Which Azure storage service should they use?

A.Azure Blob Storage
B.Azure Files
C.Azure Queue Storage
D.Azure Disk Storage
AnswerA

Correct. Blob storage is designed for unstructured data with global HTTP access and high durability.

Why this answer

Azure Blob Storage is designed for storing massive amounts of unstructured data, such as image files, and provides HTTP/HTTPS access via REST APIs. It offers high scalability (up to petabytes), durability (99.9999999999% with LRS/RA-GRS), and global accessibility through a globally unique endpoint and optional CDN integration. This makes it the ideal choice for frequently accessed image files in a web application.

Exam trap

The trap here is that candidates confuse Azure Files (which also supports HTTP via REST) with Blob Storage, but Azure Files is primarily a managed file share for SMB/NFS protocols, not optimized for high-scale, HTTP-based object storage of billions of image files.

How to eliminate wrong answers

Option B (Azure Files) is wrong because it provides SMB/NFS file shares for legacy applications or lift-and-shift scenarios, not optimized for high-frequency HTTP access to billions of image files. Option C (Azure Queue Storage) is wrong because it is a message queue service for asynchronous communication between application components, not a storage solution for image files. Option D (Azure Disk Storage) is wrong because it provides block-level storage volumes attached to VMs (iSCSI-based), not accessible via HTTP or designed for global web application access.

Full explanation →
38
Multi-Selectmedium

A company plans to migrate a multi-tier web application to Azure. The frontend web tier must automatically scale out based on CPU utilization, and Microsoft must manage the underlying virtual machines and operating system. The backend tier requires a relational database with built-in high availability and automatic backups. The company wants to minimize administrative overhead. Which two Azure services should the company use?

Select 2 answers
A.Azure Virtual Machines and Azure SQL Managed Instance
B.Azure App Service and Azure SQL Database
C.Azure Kubernetes Service and Azure Cosmos DB
D.Azure Functions and Azure Table Storage
AnswersA, B

Azure Virtual Machines (IaaS) require the customer to manage the guest OS and scaling. SQL Managed Instance is a PaaS database but the compute tier (VMs) is not managed by Microsoft for the frontend, contradicting the requirement.

Why this answer

Azure App Service provides a fully managed platform for web applications, automatically scaling out based on CPU utilization thresholds without requiring you to manage the underlying VMs or OS. Azure SQL Database is a fully managed relational database service that includes built-in high availability (99.99% SLA) and automatic backups, minimizing administrative overhead. Together, they satisfy both the frontend scaling and backend database requirements while Microsoft handles infrastructure management.

Exam trap

The trap here is that candidates often confuse Azure SQL Managed Instance (which is still a PaaS but with more control and overhead) with Azure SQL Database (which is fully managed with less administrative burden), or they mistakenly think Azure Kubernetes Service reduces overhead when it actually requires significant cluster management expertise.

Full explanation →
39
MCQmedium

A company runs a critical application on Azure VMs. They need to ensure that if one VM fails, the application continues to serve users with another VM. The VMs should be placed in a configuration that protects against failures within a single datacenter. Which feature should they use?

A.Availability Set
B.Availability Zone
C.Resource Group
D.Scale Set
AnswerA

Correct. An availability set protects against failures within a datacenter by distributing VMs across different fault and update domains.

Why this answer

An Availability Set ensures that VMs are distributed across multiple fault domains (separate racks with independent power, cooling, and network) and update domains within a single Azure datacenter. This protects against hardware failures or maintenance events within that datacenter, so if one VM fails, another in a different fault domain continues serving users.

Exam trap

The trap here is that candidates often confuse Availability Zones (which protect against datacenter-wide outages) with Availability Sets (which protect against failures within a single datacenter), leading them to choose Zones when the question explicitly specifies 'within a single datacenter'.

How to eliminate wrong answers

Option B (Availability Zone) is wrong because it protects against entire datacenter failures by placing VMs in physically separate zones within a region, not against failures within a single datacenter. Option C (Resource Group) is wrong because it is a logical container for managing Azure resources, not a high-availability configuration. Option D (Scale Set) is wrong because it is designed for auto-scaling and load balancing identical VMs, but without explicit fault domain placement (unless combined with an Availability Set or Zones), it does not guarantee protection against a single datacenter failure.

Full explanation →
40
MCQmedium

Which Azure networking feature enables resources in different Azure virtual networks to communicate as if they were on the same network?

A.Azure VPN Gateway
B.Azure Virtual Network Peering
C.Azure ExpressRoute
D.Azure Private Link
AnswerB

VNet Peering directly connects two VNets via the Azure backbone, enabling private IP communication between them.

Why this answer

Azure Virtual Network Peering (Option B) connects two or more Azure virtual networks (VNets) directly using the Microsoft backbone infrastructure, enabling resources in each VNet to communicate with each other as if they were on the same network. Unlike a VPN gateway, peering does not require a public internet hop or encryption overhead, and it supports transitive routing only when explicitly configured via a hub-and-spoke topology. This makes it the correct choice for low-latency, high-bandwidth cross-VNet communication.

Exam trap

The trap here is that candidates often confuse Azure VPN Gateway (which can also connect VNets) with VNet Peering, but VPN Gateway introduces encryption and gateway overhead, while peering is a direct, low-latency connection that does not require a gateway and is the intended solution for same-network-like communication between VNets.

How to eliminate wrong answers

Option A (Azure VPN Gateway) is wrong because it creates an encrypted tunnel over the public internet between on-premises networks or between VNets, but it does not provide the same-network-like connectivity; it introduces latency and bandwidth constraints, and is designed for site-to-site or point-to-site connections, not direct VNet-to-VNet peering. Option C (Azure ExpressRoute) is wrong because it is a dedicated private connection from on-premises to Azure, not a mechanism for connecting multiple Azure VNets; it extends an on-premises network into Azure but does not enable VNet-to-VNet communication as if they were the same network. Option D (Azure Private Link) is wrong because it provides private connectivity to a specific Azure service (e.g., Azure SQL Database) over the Microsoft backbone, but it does not connect entire VNets; it exposes a service endpoint privately, not a full network-to-network link.

Full explanation →
41
MCQeasy

Which of the following is an advantage of cloud computing related to speed of deployment?

A.You never need to patch operating systems
B.Resources can be provisioned in minutes rather than weeks
C.You own the physical hardware
D.All data is automatically encrypted at rest
AnswerB

Cloud agility means spinning up resources nearly instantly, unlike lengthy on-premises procurement cycles.

Why this answer

Cloud computing enables rapid provisioning of resources through self-service portals and automation, allowing virtual machines, storage, and networks to be deployed in minutes via APIs or management consoles. This contrasts with on-premises environments where hardware procurement, racking, and configuration can take weeks. The speed of deployment is a core agility benefit of the cloud, directly supporting faster time-to-market for applications.

Exam trap

The trap here is that candidates confuse 'speed of deployment' with other cloud benefits like 'no maintenance' or 'automatic security,' leading them to select options that describe different advantages (e.g., patching or encryption) rather than the specific agility metric of rapid provisioning.

How to eliminate wrong answers

Option A is wrong because cloud customers are often responsible for patching their own operating systems on IaaS virtual machines, though PaaS and SaaS may offload this; the statement 'never need to patch' is absolute and incorrect. Option C is wrong because cloud computing is defined by renting or consuming shared physical hardware owned by the cloud provider, not owning it yourself. Option D is wrong because while many cloud services offer encryption at rest, it is not automatically enabled for all services by default; customers must configure encryption settings or use provider-managed keys.

Full explanation →
42
MCQmedium

What is the purpose of Azure's 'Secure Score' in Microsoft Defender for Cloud?

A.To measure the performance speed of Azure resources
B.To provide a quantified measurement of your security posture with actionable improvements
C.To show the availability percentage of Azure security services
D.To audit user login attempts and failed authentications
AnswerB

Secure Score quantifies your security posture (0-100) with prioritized recommendations to improve it.

Why this answer

Azure Secure Score in Microsoft Defender for Cloud provides a quantified measurement of an organization's security posture based on security controls and recommendations. It calculates a percentage score from completed recommendations, and each recommendation includes actionable steps to improve the score, directly reflecting the security state of your Azure resources.

Exam trap

The trap here is that candidates confuse Secure Score with a general health or performance metric, when it is specifically a security posture measurement tied to actionable recommendations in Defender for Cloud.

How to eliminate wrong answers

Option A is wrong because Secure Score does not measure performance speed; performance metrics are handled by Azure Monitor and Application Insights. Option C is wrong because Secure Score does not show availability percentages of Azure security services; availability is tracked via Service Level Agreements (SLAs) and Azure Service Health. Option D is wrong because Secure Score does not audit user login attempts or failed authentications; those are logged by Azure Active Directory sign-in logs and Azure Monitor.

Full explanation →
43
MCQmedium

Which Azure feature ensures that users accessing sensitive applications must be on compliant corporate devices?

A.Azure AD Identity Protection
B.Azure AD Conditional Access with device compliance
C.Azure RBAC with device restrictions
D.Azure Firewall with IP restrictions
AnswerB

Conditional Access policies can require device compliance (via Intune) before granting access to applications.

Why this answer

Azure AD Conditional Access with device compliance enforces policies that require users to access sensitive applications only from devices that meet compliance standards (e.g., managed by Intune, patched, encrypted). This integrates with Microsoft Intune to check device health before granting access, ensuring corporate data is protected.

Exam trap

The trap here is that candidates confuse Azure AD Identity Protection (which handles risk-based identity threats) with Conditional Access (which enforces broader conditions like device compliance), leading them to pick A instead of B.

How to eliminate wrong answers

Option A is wrong because Azure AD Identity Protection focuses on detecting and responding to identity-based risks (e.g., leaked credentials, impossible travel), not on device compliance enforcement. Option C is wrong because Azure RBAC (Role-Based Access Control) manages permissions for Azure resources based on user roles, not device state or compliance. Option D is wrong because Azure Firewall with IP restrictions controls network traffic based on source IP addresses, not device compliance or user identity.

Full explanation →
44
MCQmedium

A company has multiple Azure subscriptions for different projects. They want to apply the same set of Azure policies and role assignments to all subscriptions under a specific department, and they plan to add more subscriptions in the future. Which Azure construct should they use?

A.Management group
B.Resource group
C.Azure Policy initiative
D.Azure Blueprint
AnswerA

Correct. A management group can contain multiple subscriptions, and any policies or role assignments applied at the management group level are automatically inherited by all child subscriptions.

Why this answer

A management group is the correct construct because it allows you to manage governance, policy, and role assignments across multiple Azure subscriptions hierarchically. By placing all subscriptions for a department under a single management group, you can apply the same Azure Policy and role-based access control (RBAC) assignments once, and any new subscriptions added to that group will automatically inherit those settings.

Exam trap

The trap here is that candidates often confuse Azure Policy initiatives or Blueprints as the grouping mechanism, but they are assignment or deployment tools, whereas the management group is the hierarchical container that enables inheritance across subscriptions.

How to eliminate wrong answers

Option B is wrong because a resource group is a logical container for resources within a single subscription, not a mechanism to apply policies across multiple subscriptions. Option C is wrong because an Azure Policy initiative is a collection of policy definitions that can be assigned at a management group, subscription, or resource group scope, but it is not the hierarchical construct that groups subscriptions together; it is the policy assignment itself. Option D is wrong because Azure Blueprint is a declarative template for deploying and orchestrating resources, policies, and RBAC, but it is a deployment artifact, not a persistent hierarchical grouping construct that automatically applies to future subscriptions.

Full explanation →
45
MCQmedium

Which Azure service provides fully managed file shares in the cloud that support the NFS protocol for Linux clients?

A.Azure Blob Storage with NFS 3.0
B.Azure Files (NFS protocol)
C.Azure NetApp Files
D.Azure Data Lake Storage
AnswerB

Azure Files supports NFS 4.1 for Linux clients on the Premium tier for high-performance shared file storage.

Why this answer

Azure Files provides fully managed file shares in the cloud that support the NFS protocol, specifically NFS 4.1 for Linux clients. This allows Linux-based workloads to mount and access file shares using native NFS semantics without needing to deploy or manage a separate file server.

Exam trap

The trap here is that candidates often confuse Azure Blob Storage with NFS 3.0 support as a fully managed file share, but it is actually an object storage service with an NFS interface, lacking the full file system features and management simplicity of Azure Files.

How to eliminate wrong answers

Option A is wrong because Azure Blob Storage with NFS 3.0 is a protocol-level access layer for blob storage, not a fully managed file share service; it lacks the file system semantics (e.g., directory listing, locking) that Azure Files provides. Option C is wrong because Azure NetApp Files is a high-performance, enterprise-grade file service built on NetApp technology, but it is not the primary fully managed file share service for NFS in Azure; it is a separate offering with its own pricing and management model. Option D is wrong because Azure Data Lake Storage is a hierarchical namespace built on Blob Storage, designed for big data analytics and not for general-purpose file sharing with NFS protocol support.

Full explanation →
46
MCQeasy

Which Azure service provides a way to run Windows-based desktop applications from any device without installing them locally?

A.Azure App Service
B.Azure Virtual Desktop
C.Azure Container Instances
D.Azure Virtual Machines
AnswerB

Azure Virtual Desktop delivers Windows desktops and apps from Azure to any device over RDP or browser.

Why this answer

Azure Virtual Desktop (AVD) is a desktop and app virtualization service that runs on Azure. It enables users to access full Windows desktops and applications from virtually any device (including non-Windows devices) without requiring local installation, as the applications execute on remote session hosts in Azure.

Exam trap

The trap here is that candidates often confuse Azure Virtual Machines with Azure Virtual Desktop, not realizing that VMs are an IaaS building block requiring manual setup and licensing, whereas Azure Virtual Desktop is a managed service specifically designed for multi-user desktop virtualization with built-in scaling and identity integration.

How to eliminate wrong answers

Option A is wrong because Azure App Service is a platform-as-a-service (PaaS) for hosting web apps, REST APIs, and mobile backends, not for delivering full Windows-based desktop applications. Option C is wrong because Azure Container Instances runs containerized applications in a serverless environment, not Windows desktop applications with a graphical user interface. Option D is wrong because while Azure Virtual Machines can host Windows desktops, they require individual management, licensing, and client access via RDP; they do not provide the multi-session, brokered, and scalable desktop virtualization experience that Azure Virtual Desktop offers.

Full explanation →
47
MCQmedium

A company runs multiple virtual machines (VMs) in Azure. The IT team notices that their VMs are hosted on physical hardware that is shared among multiple customers. The team has no ability to specify or control which physical server their VMs run on, and they cannot see the underlying hardware details. The VMs are, however, always available when requested. This scenario exemplifies which essential characteristic of cloud computing as defined by the National Institute of Standards and Technology (NIST)?

A.On-demand self-service
B.Broad network access
C.Resource pooling
D.Rapid elasticity
AnswerC

Resource pooling is the characteristic where the provider's computing resources are pooled to serve multiple customers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to demand. The customer has no knowledge or control over the exact location of the provided resources, which matches the scenario described.

Why this answer

Resource pooling is the correct answer because the scenario describes the cloud provider's ability to serve multiple customers from the same physical hardware, with the customer having no control or knowledge of the exact underlying server. This is a core NIST characteristic where computing resources (including storage, processing, memory, and network bandwidth) are pooled to serve multiple consumers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to consumer demand. The fact that VMs are always available when requested further aligns with the elasticity and on-demand nature of resource pooling, but the key is the shared, abstracted infrastructure.

Exam trap

The trap here is that candidates confuse 'resource pooling' with 'on-demand self-service' because both involve automation and abstraction, but the key differentiator is the multi-tenant hardware sharing and lack of customer control over the physical server, which is unique to resource pooling.

How to eliminate wrong answers

Option A is wrong because on-demand self-service refers to a user's ability to provision computing capabilities (like VMs) automatically without requiring human interaction with each service provider, not the underlying hardware sharing or lack of control over physical servers. Option B is wrong because broad network access describes capabilities that are available over the network and accessed through standard mechanisms (e.g., mobile phones, tablets, laptops, and workstations), which is unrelated to the multi-tenant hardware sharing or the inability to specify physical server details.

Full explanation →
48
MCQmedium

What happens when an Azure subscription reaches its spending limit?

A.Azure automatically increases the subscription limit to handle additional charges
B.Azure services are stopped and deallocated until the limit is removed or reset
C.Azure notifies the account owner but continues running services
D.All data is permanently deleted to prevent additional storage charges
AnswerB

When a spending limit is hit on eligible subscriptions, services are disabled until the limit resets or is removed.

Why this answer

When an Azure subscription reaches its spending limit, Azure suspends the subscription, stopping and deallocating all running services. This prevents any further charges beyond the configured budget. The limit must be removed or reset to resume services; no automatic increase occurs.

Exam trap

The trap here is that candidates may assume Azure will simply notify or automatically adjust the limit, confusing the spending limit with a budget alert or an auto-scaling cost policy.

How to eliminate wrong answers

Option A is wrong because Azure does not automatically increase the spending limit; the limit is a hard cap that stops services to prevent overage charges. Option C is wrong because Azure does not simply notify the account owner and continue services; it actively stops and deallocates resources to enforce the limit. Option D is wrong because Azure does not permanently delete data when the spending limit is reached; data is preserved but services are suspended until the limit is removed or reset.

Full explanation →
49
MCQeasy

A company uses Azure Policy to enforce resource tagging. The governance team creates a policy that requires all resources in a subscription to have a 'CostCenter' tag. However, the team does not want to block resource creation if the tag is missing. Instead, they want the policy to automatically add the tag with a default value of 'Unassigned' to any new resource that is created without the tag. Which Azure Policy effect should the team configure in the policy definition?

A.Deny
B.Audit
C.DeployIfNotExists
D.Modify
AnswerD

Correct. The Modify effect can add, update, or remove tags (or other properties) on existing or newly created resources. It can automatically add the 'CostCenter' tag with a default value without blocking the creation.

Why this answer

The Modify effect is correct because it allows Azure Policy to automatically add or change a tag on a resource during creation or update without blocking the operation. This matches the requirement to add the 'CostCenter' tag with a default value of 'Unassigned' to any new resource missing it, while still permitting resource creation.

Exam trap

The trap here is confusing DeployIfNotExists with Modify, as both can remediate non-compliance, but DeployIfNotExists deploys a separate resource (like an extension) while Modify directly changes properties of the evaluated resource itself.

How to eliminate wrong answers

Option A is wrong because Deny blocks resource creation if the condition is not met, which contradicts the requirement to allow creation and automatically add the tag. Option B is wrong because Audit only logs non-compliant resources without taking any remediation action, so it cannot automatically add the missing tag. Option C is wrong because DeployIfNotExists is used to deploy a resource (like a Log Analytics agent) when a condition is not met, not to modify properties of the existing resource itself; it cannot directly add a tag to the resource being evaluated.

Full explanation →
50
MCQmedium

A company has a single Azure subscription that contains multiple resource groups for different departments. The security team needs to ensure that only members of the 'VM Operators' Azure Active Directory group can create virtual machines in the subscription. All other users, including subscription Owners, must be blocked from creating virtual machines. Which Azure feature should the security team use to enforce this requirement?

A.Azure Policy with a deny effect
B.Azure role-based access control (RBAC)
C.Azure Resource Lock at the subscription level
D.Azure Blueprints
AnswerB

Correct. RBAC enables granular access management by assigning roles that include specific permissions (such as Microsoft.Compute/virtualMachines/write) to users or groups. By ensuring only the 'VM Operators' group has a role that allows creating VMs, and by using a deny assignment to block all others, the security team can enforce the requirement.

Why this answer

Azure RBAC allows you to assign specific roles (like 'Virtual Machine Contributor') to a security principal (e.g., the 'VM Operators' group) at a scope (the subscription). By granting the 'Virtual Machine Contributor' role only to the 'VM Operators' group and removing any built-in roles that allow VM creation from other users (including Owners), you can ensure that only that group can create VMs. This is the correct mechanism because RBAC is designed for fine-grained, role-based permission management.

Exam trap

The trap here is that candidates often confuse Azure Policy (which controls resource properties and compliance) with Azure RBAC (which controls user permissions and actions), leading them to select Policy when the requirement is about identity-based access control.

How to eliminate wrong answers

Option A is wrong because Azure Policy with a deny effect is used to enforce organizational standards and compliance by auditing or denying non-compliant resources (e.g., requiring a specific VM size), not to control who can perform an action based on identity. Option C is wrong because Azure Resource Lock at the subscription level prevents accidental deletion or modification of resources, but it does not restrict who can create new resources; it applies to all users equally and cannot differentiate based on group membership.

Full explanation →
51
MCQmedium

A company is evaluating whether to move to cloud. Their IT manager says they are concerned about losing control over their data. Which Azure feature MOST directly addresses this concern?

A.Azure guarantees data never leaves the specified region unless configured to do so
B.Microsoft employees have unrestricted access to all customer data
C.Data is automatically shared with government agencies
D.All Azure data is stored in the United States
AnswerA

Azure data residency guarantees that data stored in a region stays there — customers control and configure any replication to other regions.

Why this answer

Azure data residency controls, combined with Azure regions and data sovereignty guarantees, ensure that customer data stays within specified geographic boundaries. Microsoft's contractual commitments in the Microsoft Products and Services Data Protection Addendum (DPA) address data sovereignty concerns.

Full explanation →
52
MCQmedium

A company needs to store archival data for 10 years with the lowest possible storage cost. Data may be accessed once a year for compliance audits. Which Azure Storage access tier should they choose?

A.Cool
B.Hot
C.Archive
D.Premium
AnswerC

Archive tier offers the lowest storage cost for data that is rarely accessed, with up to several hours retrieval time.

Why this answer

The Archive access tier is designed for data that is rarely accessed and has a flexible latency requirement, making it the most cost-effective option for long-term archival storage. With a 10-year retention period and only annual access for compliance audits, Archive provides the lowest storage cost per gigabyte compared to Cool or Hot tiers, though it incurs higher retrieval costs and latency (typically hours to rehydrate data).

Exam trap

The trap here is that candidates often confuse 'lowest storage cost' with 'lowest overall cost,' forgetting that Archive has higher retrieval and data access charges, but the question explicitly asks for the lowest storage cost, making Archive the correct choice despite the access latency.

How to eliminate wrong answers

Option A is wrong because the Cool tier is optimized for data that is infrequently accessed but still requires immediate availability, with higher storage costs than Archive and a minimum 30-day retention charge, making it more expensive for 10-year archival. Option B is wrong because the Hot tier is designed for frequently accessed data with the highest storage cost and no retrieval delay, which is unnecessary and cost-prohibitive for data accessed only once per year.

Full explanation →
53
MCQeasy

Which Azure tool provides personalized recommendations to improve the security, performance, cost, and reliability of your Azure resources?

A.Azure Monitor
B.Azure Advisor
C.Azure Policy
D.Azure Security Center
AnswerB

Azure Advisor provides personalized best practice recommendations across cost, security, reliability, and performance.

Why this answer

Azure Advisor is the correct tool because it provides personalized, actionable recommendations across four pillars: security, performance, cost, and reliability. It analyzes your deployed Azure resources and configuration telemetry to generate best-practice guidance, making it the only service that explicitly covers all four areas in a unified dashboard.

Exam trap

The trap here is that candidates often confuse Azure Advisor with Azure Monitor or Azure Security Center because all three provide 'recommendations' or 'insights,' but only Advisor covers the full breadth of security, performance, cost, and reliability in a single, personalized view.

How to eliminate wrong answers

Option A is wrong because Azure Monitor focuses on collecting, analyzing, and acting on telemetry data (metrics, logs, alerts) from resources, but it does not generate personalized recommendations for cost, security, or reliability. Option C is wrong because Azure Policy enforces organizational standards and compliance rules (e.g., restricting resource SKUs or locations) via policy definitions and assignments, but it does not provide proactive, personalized recommendations for improving performance or cost. Option D is wrong because Azure Security Center (now part of Microsoft Defender for Cloud) provides security-specific recommendations and threat protection, but it does not cover cost, performance, or reliability recommendations.

Full explanation →
54
MCQeasy

Which Azure compute size family is optimized for memory-intensive workloads like large in-memory analytics or SAP HANA?

A.Compute-optimized VMs (Fsv2-series)
B.Memory-optimized VMs (M-series, E-series)
C.Storage-optimized VMs (Lsv2-series)
D.GPU VMs (NC-series)
AnswerB

Memory-optimized VMs provide high memory-to-CPU ratios for SAP HANA, in-memory analytics, and large databases.

Why this answer

Memory-optimized VMs, such as the M-series and E-series, are designed with a high memory-to-core ratio and large memory capacities (up to 12 TB for M-series) to handle workloads that require massive amounts of RAM, such as large in-memory analytics and SAP HANA. SAP HANA specifically requires certified VM sizes with sufficient memory to load the entire database into RAM, and Azure's M-series is SAP-certified for this purpose.

Exam trap

The trap here is that candidates often confuse 'memory-optimized' with 'compute-optimized' because both sound performance-related, but the key differentiator is the memory-to-core ratio and specific workload certification (e.g., SAP HANA) that only memory-optimized families provide.

How to eliminate wrong answers

Option A is wrong because Compute-optimized VMs (Fsv2-series) prioritize high CPU performance with a lower memory-to-core ratio, making them ideal for batch processing or web servers, not memory-intensive workloads like SAP HANA. Option C is wrong because Storage-optimized VMs (Lsv2-series) are designed for high disk throughput and I/O operations, using local NVMe storage for data-intensive tasks, not for large in-memory analytics. Option D is wrong because GPU VMs (NC-series) are optimized for graphics rendering, video encoding, and machine learning training with parallel processing, not for memory-intensive database workloads.

Full explanation →
55
MCQeasy

Which statement best describes the 'economies of scale' advantage of cloud computing for customers?

A.Organizations save money by eliminating all IT staff when using the cloud
B.Cloud providers achieve lower per-unit costs through massive purchasing power, offering customers lower prices
C.Organizations can use cloud resources without paying anything
D.Organizations pay less because cloud resources are lower quality than enterprise hardware
AnswerB

Economies of scale mean lower per-unit costs from massive purchases, enabling cloud providers to offer lower prices to customers.

Why this answer

Economies of scale in cloud computing means that cloud providers like AWS, Azure, or Google Cloud operate at a massive scale, allowing them to negotiate bulk discounts on hardware, power, and cooling. These cost savings are passed down to customers in the form of lower pay-as-you-go prices, making it cheaper for individual organizations than running their own on-premises data centers.

Exam trap

The trap here is confusing 'economies of scale' with 'free resources' or 'eliminating staff,' when the core concept is about cost reduction through provider-level efficiency and bulk purchasing power.

How to eliminate wrong answers

Option A is wrong because cloud computing does not eliminate the need for all IT staff; organizations still require staff to manage cloud resources, architecture, security, and governance. Option C is wrong because cloud resources are not free; providers charge based on consumption models like pay-as-you-go or reserved instances, though some services offer limited free tiers. Option D is wrong because cloud providers use enterprise-grade hardware and often offer higher reliability and performance than typical on-premises deployments, not lower quality.

Full explanation →
56
MCQmedium

A financial services company runs a critical trading application in its on-premises data center. The company is migrating some workloads to Azure and requires a dedicated, private network connection between its on-premises network and Azure. The connection must not use the public internet, must provide consistent latency and higher bandwidth than a typical internet-based VPN, and must be backed by a service-level agreement (SLA) for availability. Which Azure service should the company use to meet these requirements?

A.Azure VPN Gateway
B.ExpressRoute
C.Azure Firewall
D.Azure Front Door
AnswerB

ExpressRoute provides a dedicated private connection from on-premises to Azure that does not use the public internet. It offers higher bandwidth, lower and consistent latency, and an availability SLA, meeting all the stated requirements.

Why this answer

ExpressRoute is the correct choice because it provides a dedicated, private connection between on-premises networks and Azure that bypasses the public internet entirely. This ensures consistent latency, higher bandwidth options (up to 100 Gbps), and a financially backed SLA of at least 99.95% availability, meeting all the stated requirements for a critical trading application.

Exam trap

The trap here is that candidates often confuse Azure VPN Gateway with ExpressRoute because both provide connectivity, but they fail to recognize that ExpressRoute is the only option that bypasses the public internet and offers a guaranteed SLA for availability and consistent latency.

How to eliminate wrong answers

Option A (Azure VPN Gateway) is wrong because it uses the public internet (even with IPsec/IKE encryption) and cannot guarantee consistent latency or the same bandwidth levels as ExpressRoute; it also lacks a financially backed SLA for availability. Option C (Azure Firewall) is wrong because it is a cloud-native network security service that filters traffic within Azure or between Azure and on-premises, but it does not provide a dedicated private connection or an SLA for connectivity bandwidth and latency. Option D (Azure Front Door) is wrong because it is a global load balancer and application delivery controller for HTTP/HTTPS traffic, not a private network connectivity service; it operates over the public internet and does not offer a dedicated private link with an availability SLA for network connectivity.

Full explanation →
57
MCQeasy

A company wants to move its on-premises applications to the cloud to benefit from the ability to quickly scale resources up or down based on demand. They want to pay only for what they use. This combination of characteristics is known as:

A.High availability
B.Elasticity
C.Fault tolerance
D.Disaster recovery
AnswerB

Elasticity allows resources to be dynamically added or removed to match demand, and you pay only for what you use.

Why this answer

Elasticity is the correct term because it describes the ability to automatically scale computing resources up or down based on demand, combined with a pay-as-you-go pricing model. This allows the company to only pay for the resources they actually use, which is a core benefit of cloud computing.

Exam trap

The trap here is that candidates often confuse elasticity with high availability, because both involve scaling, but elasticity is specifically about dynamic resource adjustment based on demand, while high availability is about uptime and redundancy.

How to eliminate wrong answers

Option A is wrong because high availability refers to ensuring that applications or services remain accessible and operational for a high percentage of time, typically through redundancy and failover mechanisms, not dynamic scaling based on demand. Option C is wrong because fault tolerance is the ability of a system to continue operating without interruption when one or more components fail, often through redundant components, not the ability to scale resources up or down. Option D is wrong because disaster recovery involves policies, tools, and procedures to recover IT infrastructure and data after a catastrophic event, not the ability to dynamically adjust resource capacity.

Full explanation →
58
MCQeasy

What does 'high availability' mean in Azure?

A.Resources that are accessible from any device regardless of operating system
B.Services that remain operational and accessible with minimal planned or unplanned downtime
C.Resources that can be scaled up to handle maximum load
D.Data that is encrypted and protected from unauthorized access
AnswerB

High availability means systems stay up and accessible with minimal downtime through redundancy and failover.

Why this answer

High availability in Azure refers to the ability of services and resources to remain operational and accessible despite failures, with minimal planned or unplanned downtime. It is achieved through redundancy, fault tolerance, and automatic failover mechanisms, such as Azure Availability Zones and Availability Sets, which ensure that if one component fails, another takes over without significant interruption.

Exam trap

The trap here is that candidates often confuse high availability with scalability or disaster recovery, mistakenly thinking that scaling up (Option C) or data protection (Option D) directly ensures uptime, whereas high availability is specifically about minimizing downtime through redundancy and failover.

How to eliminate wrong answers

Option A is wrong because it describes cross-platform accessibility, not high availability; Azure resources can be accessed from any device via web browsers or APIs, but that is a matter of platform compatibility, not uptime guarantees. Option C is wrong because it describes scalability (specifically vertical scaling), which is about handling increased load by adding resources, not about minimizing downtime; high availability focuses on continuity, not capacity. Option D is wrong because it describes data security and encryption, which are part of Azure's security and compliance features (e.g., Azure Key Vault, encryption at rest/transit), not availability.

Full explanation →
59
MCQmedium

Which Azure feature allows organizations to track spending trends and get spending forecasts for the next 30 days?

A.Azure Advisor cost recommendations
B.Azure Cost Management Cost Analysis
C.Azure Budgets
D.Azure Pricing Calculator
AnswerB

Cost Analysis in Azure Cost Management shows spending trends and 30-day forecasts based on usage patterns.

Why this answer

Azure Cost Management Cost Analysis provides interactive dashboards and reports that allow organizations to visualize historical spending trends and generate forecasts for future costs, including a 30-day forecast. This feature uses historical usage data and machine learning models to predict spending, enabling proactive budget management.

Exam trap

The trap here is confusing Azure Budgets (which only set thresholds and alerts) with Cost Analysis (which provides actual trend visualization and forecasting), leading candidates to select Budgets when the question explicitly asks about tracking trends and forecasts.

How to eliminate wrong answers

Option A is wrong because Azure Advisor cost recommendations focus on optimizing existing resources to reduce costs (e.g., right-sizing VMs or identifying idle resources), not on tracking spending trends or providing forecasts. Option C is wrong because Azure Budgets are used to set spending limits and trigger alerts when costs exceed thresholds, but they do not provide trend analysis or forecasting capabilities. Option D is wrong because the Azure Pricing Calculator is a pre-deployment estimation tool for calculating expected costs based on selected services and configurations, not a tool for tracking actual spending or forecasting trends.

Full explanation →
60
MCQmedium

What is the purpose of Azure Availability Zones?

A.To reduce the latency of content delivery to global users
B.To provide fault isolation against datacenter-level failures within a region
C.To connect on-premises networks to Azure securely
D.To replicate data automatically between Azure regions
AnswerB

Availability Zones are physically separate datacenters within a region, protecting against single datacenter failures.

Why this answer

Azure Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By placing VMs or other resources across multiple zones, you protect your application from a single datacenter failure, ensuring high availability and fault isolation at the datacenter level within the region.

Exam trap

The trap here is confusing Availability Zones (which protect against datacenter failures within a region) with Azure Region Pairs (which protect against region-wide disasters by replicating data across geographically separated regions).

How to eliminate wrong answers

Option A is wrong because reducing latency for global users is the purpose of Azure Content Delivery Network (CDN) or Azure Front Door, not Availability Zones. Option C is wrong because connecting on-premises networks to Azure securely is achieved via Azure VPN Gateway or Azure ExpressRoute, not Availability Zones. Option D is wrong because automatic replication between Azure regions is a feature of Azure Site Recovery or geo-redundant storage (GRS), not Availability Zones, which operate within a single region.

Full explanation →
61
MCQmedium

Which Azure service helps organizations understand their compliance status against regulatory standards like ISO 27001, PCI DSS, and NIST?

A.Azure Security Center Secure Score
B.Microsoft Defender for Cloud Regulatory Compliance
C.Azure Policy compliance view
D.Azure Advisor security recommendations
AnswerB

Defender for Cloud's Regulatory Compliance dashboard shows pass/fail status against ISO 27001, PCI DSS, NIST, and other standards.

Why this answer

Microsoft Defender for Cloud Regulatory Compliance provides built-in compliance assessments against major regulatory standards such as ISO 27001, PCI DSS, and NIST. It continuously monitors your Azure environment and maps the compliance state of your resources to specific controls within each standard, offering a clear dashboard of your compliance posture.

Exam trap

The trap here is that candidates often confuse Azure Policy's general compliance view (which checks custom policies) with Defender for Cloud's dedicated regulatory compliance dashboard, which is specifically built to map to external standards like ISO 27001 and PCI DSS.

How to eliminate wrong answers

Option A is wrong because Azure Security Center Secure Score (now part of Defender for Cloud) measures your overall security posture based on security recommendations, not specifically against regulatory standards like ISO 27001 or PCI DSS. Option C is wrong because Azure Policy compliance view shows the compliance state of resources against custom or built-in policies (e.g., 'require encryption'), but it does not natively map to regulatory frameworks like NIST or PCI DSS without additional initiative definitions. Option D is wrong because Azure Advisor security recommendations focus on best practices for reliability, cost, performance, and security, but they do not provide a dedicated compliance dashboard against specific regulatory standards.

Full explanation →
62
MCQeasy

Which Azure service provides a fully managed relational database with built-in high availability, automated backups, and intelligent performance optimization for SQL Server workloads?

A.Azure Database for MySQL
B.Azure SQL Database
C.SQL Server on Azure VMs
D.Azure Cosmos DB
AnswerB

Azure SQL Database is the fully managed PaaS offering for SQL Server workloads with built-in HA and backups.

Why this answer

Azure SQL Database is a fully managed Platform-as-a-Service (PaaS) relational database engine that handles SQL Server workloads. It provides built-in high availability with a 99.99% SLA, automated backups with point-in-time restore, and intelligent performance optimization features like automatic tuning and intelligent insights, all without requiring any manual patching or infrastructure management.

Exam trap

The trap here is that candidates often confuse 'fully managed relational database' with 'SQL Server on Azure VMs' because both run SQL Server, but the key distinction is that Azure SQL Database is PaaS (no management overhead) while SQL Server on Azure VMs is IaaS (you manage the SQL Server and high availability).

How to eliminate wrong answers

Option A is wrong because Azure Database for MySQL is a fully managed relational database service for MySQL workloads, not SQL Server. Option C is wrong because SQL Server on Azure VMs is an Infrastructure-as-a-Service (IaaS) offering where you manage the SQL Server instance and high availability yourself, and it does not include built-in automated backups or intelligent performance optimization as a managed feature. Option D is wrong because Azure Cosmos DB is a globally distributed, multi-model NoSQL database service, not a relational database for SQL Server workloads.

Full explanation →
63
MCQeasy

Which Azure region feature pairs two regions together for business continuity and disaster recovery?

A.Availability Zones
B.Azure Region Pairs
C.Azure Data Centers
D.Sovereign Regions
AnswerB

Region pairs are two regions configured together for replication and sequential maintenance to ensure business continuity.

Why this answer

Azure Region Pairs are designed to provide business continuity and disaster recovery by pairing two regions within the same geography (e.g., East US and West US) that are at least 300 miles apart. This ensures that if a natural disaster or regional outage occurs, one region in the pair can take over workloads, and Azure prioritizes the recovery of paired regions during outages. The pairing also enables data replication services like Azure Site Recovery and geo-redundant storage (GRS) to automatically replicate data across the pair.

Exam trap

The trap here is that candidates often confuse Availability Zones (which are within a single region) with Region Pairs (which span two regions), leading them to select Availability Zones for disaster recovery scenarios that require geographic separation.

How to eliminate wrong answers

Option A is wrong because Availability Zones are physically separate datacenters within a single Azure region, not two distinct regions, and they protect against datacenter-level failures, not region-wide disasters. Option C is wrong because Azure Data Centers are individual physical facilities within a region, not a feature that pairs regions together for disaster recovery. Option D is wrong because Sovereign Regions (e.g., US Gov, China) are isolated instances of Azure for compliance and legal requirements, and they do not form paired relationships for business continuity across geographies.

Full explanation →
64
MCQhard

A company uses Azure Blueprints to define a standard environment with policies, role assignments, and resource groups. They publish a new version of the blueprint that adds a new role assignment. However, existing subscriptions created from older versions do not have this new role assignment. What must they do to apply the update to existing subscriptions?

A.Delete and recreate the subscriptions using the new blueprint.
B.The blueprint version update is automatically applied to all existing subscriptions.
C.They must manually assign the role to each subscription.
D.They need to update the existing blueprint assignment to use the latest published version.
AnswerD

Updating the assignment applies the latest blueprint version's artifacts to the scoped resources.

Why this answer

Azure Blueprints assignments are not automatically updated when a new version of the blueprint is published. To apply the new role assignment to existing subscriptions, you must update the existing blueprint assignment to reference the latest published version. This triggers Azure to evaluate and apply the changes defined in the new version, including the new role assignment, to the assigned subscriptions.

Exam trap

The trap here is assuming that publishing a new blueprint version automatically propagates changes to existing assignments, when in fact you must manually update the assignment to the new version to apply the changes.

How to eliminate wrong answers

Option A is wrong because deleting and recreating subscriptions is unnecessary and disruptive; Azure Blueprints supports updating assignments without destroying resources. Option B is wrong because blueprint version updates are not automatically applied to existing assignments; you must explicitly update the assignment to the new version. Option C is wrong because manually assigning the role bypasses the governance and automation benefits of Blueprints and is not the intended method for applying blueprint-defined changes.

Full explanation →
65
MCQmedium

A company hosts a web application in the West US region on two Azure virtual machines that are in the same virtual network. The application handles user sessions that must persist on the same virtual machine for the duration of a checkout process. The company needs to load balance incoming HTTP traffic across the two virtual machines. If one virtual machine becomes unhealthy, the load balancer must automatically stop sending new traffic to that machine. Which Azure service should the company use?

A.Azure Traffic Manager
B.Azure Application Gateway
C.Azure Load Balancer
D.Azure Front Door
AnswerB

Azure Application Gateway is a layer 7 HTTP/HTTPS load balancer that provides cookie-based session affinity (sticky sessions) and health probes. It can distribute traffic across virtual machines in the same region and automatically stop sending traffic to an unhealthy machine.

Why this answer

Azure Application Gateway is correct because it provides HTTP/HTTPS layer-7 load balancing with session affinity (also known as sticky sessions) using cookie-based persistence, which ensures that all requests from a user during the checkout process are routed to the same virtual machine. It also includes built-in health probes that automatically stop sending traffic to an unhealthy backend VM, meeting both requirements precisely.

Exam trap

The trap here is that candidates confuse layer-4 load balancing (Azure Load Balancer) with layer-7 load balancing (Application Gateway), assuming any load balancer can handle HTTP session persistence, but only Application Gateway provides the cookie-based affinity required for sticky sessions in a web application.

How to eliminate wrong answers

Option A is wrong because Azure Traffic Manager is a DNS-based global traffic load balancer that operates at layer 3/4 and does not support session affinity or HTTP-level health probes; it distributes traffic across regions, not within a single region. Option C is wrong because Azure Load Balancer operates at layer 4 (TCP/UDP) and does not provide HTTP session persistence or cookie-based affinity; it load-balances only at the network level and cannot maintain user sessions on the same VM for an HTTP checkout process.

Full explanation →
66
MCQmedium

A company wants to ensure that all Azure resources are tagged with metadata such as 'Environment' and 'Department'. They have created an Azure Policy that appends the required tags and their values when a resource is created. However, they notice that some resources created before the policy assignment are missing tags. They want to automatically add those tags without manual effort. What should they do?

A.Create a remediation task for the policy
B.Create a new policy with DeployIfNotExists effect
C.Use Azure Resource Graph to query and update
D.Create an Azure Automation runbook
AnswerB

A policy with DeployIfNotExists effect can deploy a resource (like a script) to add tags to existing resources. After assignment, a remediation task can run to apply the fix.

Why this answer

Option B is correct because the DeployIfNotExists (DINE) policy effect can automatically remediate non-compliant resources, including those created before the policy assignment. When combined with a managed identity, DINE triggers a deployment task that adds the required tags without manual intervention, addressing the gap left by the 'append' effect which only acts on new resources.

Exam trap

The trap here is that candidates assume a remediation task can be created for any policy, but remediation tasks only work with DeployIfNotExists or Modify effects, not with the 'append' effect used in the scenario.

How to eliminate wrong answers

Option A is wrong because a remediation task is only applicable to policies with the DeployIfNotExists or Modify effects; the existing policy uses the 'append' effect, which does not support remediation tasks. Option C is wrong because Azure Resource Graph is a query tool for resource discovery and does not have native write capabilities to update tags; any update would require an external script or tool. Option D is wrong because an Azure Automation runbook requires custom scripting and manual scheduling or event triggers, which is unnecessary overhead compared to the built-in, policy-driven remediation provided by DeployIfNotExists.

Full explanation →
67
MCQmedium

A company manages multiple Azure subscriptions for different business units. They want to define a standard set of policies, such as allowed VM SKUs and required resource tags, and ensure these policies are always applied whenever a new subscription is created. Which Azure feature should they use to enforce governance at this level?

A.Azure Management Groups
B.Azure Policy
C.Azure Resource Manager templates
D.Azure Blueprints
AnswerA

Management groups organize subscriptions into a hierarchy and allow policies to be assigned at the group level, which all child subscriptions inherit. New subscriptions added to a management group automatically inherit its policies.

Why this answer

Azure Management Groups allow you to organize subscriptions into a hierarchy and apply governance policies at the management group level. When a new subscription is created under a management group, it automatically inherits the policies assigned to that group, ensuring consistent enforcement across all subscriptions without manual intervention.

Exam trap

The trap here is that candidates often confuse Azure Policy (the tool for defining rules) with Management Groups (the hierarchical scope for applying those rules across multiple subscriptions), leading them to select Azure Policy instead of recognizing that Management Groups are the mechanism to enforce governance at the subscription creation level.

How to eliminate wrong answers

Option B is wrong because Azure Policy is used to create, assign, and manage individual policy definitions (like allowed VM SKUs or required tags), but it does not provide a hierarchical structure to automatically apply those policies to new subscriptions; policies must be assigned to a scope such as a management group, subscription, or resource group. Option C is wrong because Azure Resource Manager (ARM) templates are Infrastructure as Code (IaC) files used to deploy and configure resources declaratively, not to enforce ongoing governance or automatically apply policies to new subscriptions.

Full explanation →
68
MCQmedium

A company has multiple Azure subscriptions that are managed by different departments. The governance team needs to ensure that every new subscription follows a standardized set of compliance requirements, including specific Azure Policy definitions, a predefined role assignment for a central security group, and a base set of network resources. The solution must be reusable and allow the governance team to update the requirements centrally, with changes automatically applied to all subscriptions that use the same definition. Which Azure service should the governance team use?

A.Azure Management Groups
B.Azure Resource Manager (ARM) templates
C.Azure Blueprints
D.Azure Policy
AnswerC

Azure Blueprints allows you to define a repeatable set of Azure resources, policies, and role assignments that implements organizational standards. Blueprints can be versioned, published, and assigned to subscriptions, and when updated, the changes can be applied to existing assignments. This exactly meets the requirement for a reusable, centrally managed governance package.

Why this answer

Azure Blueprints is the correct choice because it enables the governance team to define a repeatable set of Azure resources and policies—including Azure Policy definitions, role assignments, and Resource Manager templates—that can be assigned to multiple subscriptions. When the blueprint definition is updated, all subscriptions using that blueprint receive the changes automatically, ensuring centralized compliance and versioning.

Exam trap

The trap here is that candidates often confuse Azure Blueprints with ARM templates, but Blueprints is designed for orchestrated, versioned, and centrally managed compliance packages, whereas ARM templates are single-use deployment scripts without built-in lifecycle management.

How to eliminate wrong answers

Option A is wrong because Azure Management Groups provide a hierarchical structure for organizing subscriptions and applying policies at scale, but they do not natively bundle multiple resource types (like network resources) into a single deployable artifact; they are a management boundary, not a packaging service. Option B is wrong because Azure Resource Manager (ARM) templates are declarative JSON files that deploy infrastructure, but they lack built-in versioning, automatic assignment tracking, and the ability to centrally update all existing deployments when the template changes; each subscription would need to be manually redeployed or updated.

Full explanation →
69
MCQmedium

An administrator wants to ensure that all Azure resources in a subscription have a 'CostCenter' tag applied. Which Azure service enforces this requirement?

A.Azure Resource Manager locks
B.Azure Policy
C.Azure Blueprints
D.Role-Based Access Control
AnswerB

Azure Policy can require and enforce tags on resources through Deny or Append policy effects.

Why this answer

Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules and effects over your resources. In this scenario, you can define a policy that requires the 'CostCenter' tag on all resources, and Azure Policy will automatically evaluate compliance and prevent creation of non-compliant resources or flag existing ones.

Exam trap

The trap here is that candidates often confuse Azure Policy with Azure Blueprints, thinking Blueprints enforce rules directly, when in fact Blueprints package policies but the enforcement is always performed by Azure Policy.

How to eliminate wrong answers

Option A is wrong because Azure Resource Manager locks prevent accidental deletion or modification of resources, but they do not enforce tagging requirements. Option C is wrong because Azure Blueprints is used to orchestrate the deployment of resource templates, policies, and role assignments as a package, but it does not itself enforce tagging; it can include a policy that enforces tagging, but the enforcement is done by Azure Policy, not Blueprints. Option D is wrong because Role-Based Access Control (RBAC) manages who has access to Azure resources and what actions they can perform, but it does not enforce resource properties like tags.

Full explanation →
70
MCQmedium

Which Azure networking service provides a distributed, highly available, and scalable DNS service for routing users to the best-performing endpoint?

A.Azure Front Door
B.Azure Traffic Manager
C.Azure Load Balancer
D.Azure Application Gateway
AnswerB

Traffic Manager routes users to the best endpoint using DNS-based routing methods (performance, failover, geographic).

Why this answer

Azure Traffic Manager is a DNS-based traffic load balancer that distributes traffic to the best-performing endpoint across global Azure regions. It uses DNS responses to direct users to the endpoint with the lowest latency or highest priority, providing high availability and scalability without proxying traffic.

Exam trap

The trap here is that candidates confuse Azure Front Door (which also provides global routing and performance optimization) with Traffic Manager, but Front Door operates at the application layer (HTTP/HTTPS) and proxies traffic, while Traffic Manager is purely DNS-based and works with any protocol.

How to eliminate wrong answers

Option A is wrong because Azure Front Door is an application delivery network that provides global HTTP load balancing with SSL offload and web application firewall, not a pure DNS-based routing service. Option C is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and distributes traffic within a single region, not globally via DNS. Option D is wrong because Azure Application Gateway is a regional Layer 7 HTTP load balancer with URL-based routing and SSL termination, not a global DNS-based service.

Full explanation →
71
MCQmedium

A company runs a web application on two Azure virtual machines in the same region. The application must be accessible from the internet, and incoming traffic should be distributed evenly across both VMs. Additionally, the company needs to offload Transport Layer Security (TLS) termination to a single service and route requests based on the URL path (e.g., /images to one set of VMs, /api to another). Which Azure service should the company use?

A.Azure Load Balancer
B.Azure Application Gateway
C.Azure Traffic Manager
D.Azure Front Door
AnswerB

Azure Application Gateway is a layer 7 load balancer that provides TLS termination, URL-based routing, and other advanced features. It is the correct choice for the stated requirements.

Why this answer

Azure Application Gateway is the correct choice because it is a Layer 7 (HTTP/HTTPS) load balancer that supports TLS termination, URL path-based routing, and cookie-based session affinity. This allows the company to offload TLS decryption to a single service and route requests like /images or /api to different backend pools, meeting all stated requirements.

Exam trap

The trap here is that candidates confuse Layer 4 load balancing (Azure Load Balancer) with Layer 7 application routing (Azure Application Gateway), assuming any 'load balancer' can handle URL paths and TLS offloading, but only Application Gateway operates at the HTTP/HTTPS layer.

How to eliminate wrong answers

Option A is wrong because Azure Load Balancer operates at Layer 4 (TCP/UDP) and cannot inspect URL paths or offload TLS termination; it distributes traffic based on IP and port only. Option C is wrong because Azure Traffic Manager is a DNS-based traffic router that directs clients to different endpoints based on geographic location or performance, but it does not handle TLS termination or URL path-based routing at the application layer.

Full explanation →
72
MCQeasy

A multinational corporation wants to reduce its carbon footprint by shifting workloads to the cloud. They want to understand how using a cloud provider's shared infrastructure contributes to sustainability. Which cloud computing concept is most directly related to this environmental benefit?

A.Broad network access
B.Resource pooling
C.On-demand self-service
D.Rapid elasticity
AnswerB

Resource pooling enables sharing of resources among multiple customers, improving utilization and reducing waste.

Why this answer

Resource pooling is the cloud computing concept most directly related to sustainability because it allows a cloud provider to serve multiple customers from the same shared physical infrastructure. By dynamically allocating and reallocating resources based on demand, the provider maximizes utilization rates, reducing the total number of physical servers and data centers needed. This consolidation directly lowers energy consumption and carbon emissions per workload, which is the core environmental benefit of shifting to the cloud.

Exam trap

The trap here is that candidates often confuse rapid elasticity (scaling) with resource pooling (sharing), mistakenly thinking that the ability to scale up and down is what reduces carbon footprint, when in fact the environmental benefit comes from the provider's ability to share infrastructure across many customers, not from the scaling mechanism itself.

How to eliminate wrong answers

Option A is wrong because broad network access refers to the ability to access cloud services over the network via standard protocols (e.g., HTTP, HTTPS) from various devices, and it does not inherently reduce resource usage or carbon footprint. Option C is wrong because on-demand self-service allows users to provision resources automatically without human interaction, which improves agility but does not directly contribute to the environmental benefit of shared infrastructure. Option D is wrong because rapid elasticity enables resources to scale up or down quickly based on demand, which can improve efficiency but is a dynamic scaling mechanism, not the fundamental shared-infrastructure model that drives sustainability.

Full explanation →
73
MCQmedium

What is the primary benefit of Azure Management Groups in a large enterprise with hundreds of subscriptions?

A.Automatically reducing the cost of Azure subscriptions
B.Applying governance policies and RBAC to all subscriptions in a hierarchy at once
C.Merging multiple subscriptions into a single billing account
D.Allowing resources in different subscriptions to share the same virtual network
AnswerB

Management Groups enable applying policies and RBAC to all subscriptions within a group simultaneously.

Why this answer

Azure Management Groups allow you to organize subscriptions into a hierarchy and apply governance policies (via Azure Policy) and role-based access control (RBAC) at the management group level, which then cascades down to all subscriptions and resources within that group. This enables consistent governance across hundreds of subscriptions without needing to configure each one individually, which is the primary benefit for large enterprises.

Exam trap

The trap here is that candidates confuse Management Groups with billing management or networking features, assuming they consolidate billing or enable network connectivity, when in fact their sole purpose is hierarchical governance of policy and access across subscriptions.

How to eliminate wrong answers

Option A is wrong because Azure Management Groups do not automatically reduce costs; cost management is handled by Azure Cost Management + Billing, not by management groups. Option C is wrong because management groups organize subscriptions for policy and access management, not for merging billing; billing consolidation is done via Enterprise Agreement enrollment or Microsoft Customer Agreement billing accounts. Option D is wrong because allowing resources in different subscriptions to share the same virtual network is a feature of Azure Virtual Network peering or VPN gateways, not management groups.

Full explanation →
74
MCQmedium

A company's CFO is evaluating the financial impact of moving the company's on-premises data center to Azure. The on-premises data center requires significant upfront investment for servers, storage, and networking equipment, which is depreciated over several years. In contrast, Azure offers a pay-as-you-go pricing model where the company pays only for the resources it consumes, with no upfront costs. The CFO wants to understand how this shift changes the company's financial reporting. Which statement accurately describes the financial difference between on-premises and cloud spending?

A.On-premises is an operational expenditure (OpEx), while Azure is a capital expenditure (CapEx).
B.On-premises is a capital expenditure (CapEx), while Azure is an operational expenditure (OpEx).
C.Both on-premises and Azure are classified as capital expenditures (CapEx).
D.Both on-premises and Azure are classified as operational expenditures (OpEx).
AnswerB

Correct. On-premises data center purchases (servers, storage, etc.) are CapEx because they involve large upfront investments that are depreciated. Azure's consumption-based pricing is OpEx because it is a variable cost incurred only when resources are used.

Why this answer

On-premises data centers require significant upfront capital investment for hardware, which is capitalized as a capital expenditure (CapEx) and depreciated over time. Azure's pay-as-you-go model shifts costs to operational expenditure (OpEx), where you pay only for consumed resources with no upfront costs, directly impacting financial reporting by converting fixed costs to variable costs.

Exam trap

The trap here is confusing the financial classification: candidates often mistakenly think cloud spending is CapEx because they associate 'paying for resources' with ownership, but Azure's no-upfront, consumption-based model is strictly OpEx.

How to eliminate wrong answers

Option A is wrong because it reverses the classification: on-premises is CapEx (capital expenditure) due to upfront hardware purchases, not OpEx. Option C is wrong because Azure's consumption-based model is OpEx, not CapEx; only on-premises involves capitalizing long-term assets.

Full explanation →
75
MCQmedium

A company stores historical sales data in Azure Blob Storage. The data is accessed frequently during the first 30 days after upload, but after that, it is rarely accessed. The company wants to automatically move blobs to a lower-cost storage tier after 30 days without any manual scripting or custom code. Which Azure feature should they use?

A.Azure Blob Storage lifecycle management policies
B.Azure Automation runbooks with a schedule
C.Azure Logic Apps with a recurrence trigger
D.Azure Policy to enforce storage tier at creation
AnswerA

Correct. Lifecycle management policies automatically move blobs between access tiers based on rules you define, such as age. This requires no custom code or external services.

Why this answer

Azure Blob Storage lifecycle management policies allow you to define rules that automatically transition blobs to a lower-cost storage tier (e.g., from Hot to Cool or Archive) based on the age of the data. This feature operates natively within Azure Storage, requires no custom code or scripting, and can be configured directly in the Azure portal or via ARM templates. The scenario's requirement for automatic, rule-based tiering after 30 days is exactly what lifecycle management policies are designed to do.

Exam trap

The trap here is that candidates may confuse Azure Policy (which enforces rules at creation) with lifecycle management (which automates post-creation actions), or they may think that Logic Apps or Automation runbooks are simpler than they actually are, overlooking the 'no custom code' constraint.

How to eliminate wrong answers

Option B is wrong because Azure Automation runbooks require custom PowerShell or Python scripts to implement the logic for moving blobs, which contradicts the 'no manual scripting or custom code' requirement. Option C is wrong because Azure Logic Apps with a recurrence trigger would need a custom workflow (e.g., using HTTP requests to the Blob Storage REST API) to move blobs, again requiring custom logic and code. Option D is wrong because Azure Policy enforces compliance at resource creation or update time (e.g., ensuring blobs are created in a specific tier), but it cannot automatically move existing blobs to a different tier based on age after creation.

Full explanation →

Page 1 of 14

Page 2

All pages

1234567891011121314

Practice AZ-900 by domain

Target a specific domain to shore up weak areas.

Describe cloud conceptsDescribe Azure architecture and servicesDescribe Azure management and governance
See all domains with question counts →