Microsoft Azure Fundamentals AZ-900 AZ-900 Questions 751–825 | Page 11/14

751

MCQmedium

An Azure service guarantees 99.95% uptime for virtual machines deployed with two or more instances in an availability set. If the monthly uptime falls below this percentage, customers can receive a service credit. What does this guarantee represent?

A.Service Level Agreement (SLA)

B.Service Level Objective (SLO)

C.Service Level Indicator (SLI)

D.Service Health

AnswerA

Correct. An SLA outlines guaranteed service levels and compensation for non-compliance.

Why this answer

This guarantee is a Service Level Agreement (SLA) because it is a formal, published commitment from Microsoft regarding the uptime percentage (99.95%) for a specific Azure service (Virtual Machines in an Availability Set), and it includes a financial remedy (service credits) if the commitment is not met. SLAs are contractual agreements that define the level of service a customer can expect and the compensation for failures.

Exam trap

The trap here is that candidates confuse a formal, financially-backed SLA with an internal SLO, mistakenly thinking any published uptime number is automatically an SLO, when in fact the presence of a service credit mechanism is the key differentiator for an SLA.

How to eliminate wrong answers

Option B (Service Level Objective) is wrong because an SLO is an internal target or goal set by the service provider (e.g., aiming for 99.99% uptime) that is not contractually binding and does not include financial penalties for non-compliance. Option C (Service Level Indicator) is wrong because an SLI is a raw, measured metric (e.g., actual uptime percentage over a month), not a formal guarantee or commitment. Option D (Service Health) is wrong because Service Health is a feature in the Azure portal that provides real-time status and incident information about Azure services, not a contractual uptime guarantee with credit provisions.

Full explanation →

752

Drag & Dropmedium

Order the steps to set up Azure Site Recovery for disaster recovery.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

Site Recovery requires a vault, replication enablement, target configuration, validation, and ongoing monitoring.

Full explanation →

753

MCQmedium

A small start-up company needs to run complex machine learning training jobs that require powerful GPU instances for only a few hours each day. The company cannot afford the high upfront capital expense of purchasing and maintaining multiple GPU servers on-premises. Instead, they spin up GPU-optimized virtual machines on Azure during training hours and delete them when the jobs finish, paying only for the compute time consumed. Which benefit of cloud computing does this scenario primarily illustrate?

A.High availability

B.Fault tolerance

C.Consumption-based pricing

D.Geographic distribution

AnswerC

Consumption-based pricing (pay-as-you-go) is a core benefit of cloud computing. The start-up avoids capital expense by renting GPU instances only for the time they are needed, paying only for what they consume.

Why this answer

The scenario describes the company spinning up GPU-optimized VMs only when needed and deleting them after use, paying solely for the compute time consumed. This directly illustrates consumption-based pricing (also known as pay-as-you-go), a core cloud benefit where customers pay only for the resources they actually use, avoiding large upfront capital expenditures. The ability to scale down to zero when not in use is a hallmark of this model, enabling cost efficiency for intermittent workloads.

Exam trap

Microsoft often tests the confusion between consumption-based pricing and other operational benefits like high availability or fault tolerance; the trap here is that candidates may incorrectly associate the ability to spin up and delete VMs with high availability or fault tolerance, rather than recognizing it as a direct illustration of the pay-as-you-go cost model.

How to eliminate wrong answers

Option A is wrong because high availability refers to ensuring services remain operational with minimal downtime, typically through redundant infrastructure across availability zones, not the cost model of paying only for used resources. Option B is wrong because fault tolerance is the ability of a system to continue operating without interruption despite component failures, which is unrelated to the financial model of paying for compute time. Option D is wrong because geographic distribution involves deploying resources across multiple regions to reduce latency or meet compliance, not the consumption-based pricing model demonstrated by spinning up and deleting VMs.

Full explanation →

754

MCQmedium

A company wants to receive notifications when Azure services in their region experience an outage or planned maintenance that might affect their resources. Which Azure service should they set up alerts for?

A.Azure Monitor

B.Azure Service Health

C.Azure Advisor

D.Azure Resource Health

AnswerB

Service Health gives you a personalized view of the health of Azure services in the regions you use, including outages and planned maintenance.

Why this answer

Azure Service Health is the correct service because it provides personalized alerts and notifications specifically for Azure service issues—such as outages and planned maintenance—that affect your subscriptions and resources in a given region. It combines global service health information with region-specific and resource-specific impacts, allowing you to configure alerts via Azure Service Health alerts (formerly known as Service Health Alerts).

Exam trap

The trap here is that candidates often confuse Azure Monitor (which handles resource-level alerts) with Azure Service Health (which handles Azure platform-level alerts), leading them to choose Azure Monitor for outage notifications when Service Health is the dedicated service for that purpose.

How to eliminate wrong answers

Option A is wrong because Azure Monitor is a general-purpose monitoring platform for collecting metrics, logs, and setting alerts on resource performance and availability, but it does not natively provide notifications for Azure platform-level outages or planned maintenance. Option C is wrong because Azure Advisor is a personalized recommendation engine that offers best-practice guidance on cost, security, reliability, and performance, but it does not send alerts for service outages or maintenance events. Option D is wrong because Azure Resource Health focuses on the health of individual resources (e.g., a specific VM or database) and reports on resource-level issues, not on broader Azure service outages or planned maintenance that affect an entire region.

Full explanation →

755

MCQmedium

Which Azure feature enables you to create custom roles with specific permissions when built-in RBAC roles do not meet your requirements?

A.Azure AD application permissions

B.Custom RBAC role definitions

C.Azure Policy custom definitions

D.Azure AD group membership rules

AnswerB

Custom RBAC roles allow defining precise permissions beyond what built-in roles provide.

Why this answer

Custom RBAC role definitions allow you to create roles with granular permissions tailored to your specific needs when built-in roles are insufficient. This Azure feature uses JSON-based role definitions that specify actions, notActions, dataActions, and assignable scopes to control access to Azure resources.

Exam trap

The trap here is confusing Azure Policy (which enforces compliance rules) with RBAC (which controls access permissions), leading candidates to select Azure Policy custom definitions instead of custom RBAC roles.

How to eliminate wrong answers

Option A is wrong because Azure AD application permissions are used to grant access to Azure AD resources (like Graph API) for applications, not to create custom roles for Azure resource management. Option C is wrong because Azure Policy custom definitions enforce compliance rules (e.g., tagging or location restrictions) on resources, not assignable permissions for user/group access control. Option D is wrong because Azure AD group membership rules (dynamic groups) automate user membership based on attributes, but they do not define or assign custom permissions to Azure resources.

Full explanation →

756

MCQmedium

A company has a simple containerized web application that runs in a single container. The application processes a workload for a few minutes every hour and remains idle the rest of the time. The company wants to deploy the container in Azure without managing any virtual machines or container orchestrators. They also want to pay only for the time the container is actually running, with no cost when idle. Which Azure compute service should the company use?

A.Azure App Service

B.Azure Container Instances

C.Azure Virtual Machine Scale Sets

D.Azure Kubernetes Service

AnswerB

Azure Container Instances (ACI) is the correct choice. It allows you to run containers directly on Azure without managing VMs or orchestrators. ACI bills per second of container execution and has no active cost when the container is stopped, matching the pay-per-use requirement perfectly.

Why this answer

Azure Container Instances (ACI) is the correct choice because it allows you to run a containerized application without managing any underlying virtual machines or container orchestrators like Kubernetes. ACI supports a per-second billing model, meaning you only pay for the compute resources consumed while the container is actively running, and incur no cost when the container is stopped or idle. This aligns perfectly with the company's requirement of a simple, single-container workload that runs intermittently.

Exam trap

The trap here is that candidates often confuse Azure App Service's container support with a serverless container service, not realizing that App Service still requires a continuously running plan (e.g., Basic, Standard) that incurs charges even when the container is idle.

How to eliminate wrong answers

Option A is wrong because Azure App Service runs containers within a managed platform that always has at least one instance running, incurring continuous costs even during idle periods, and it does not offer a true pay-per-execution billing model. Option C is wrong because Azure Virtual Machine Scale Sets require you to manage and pay for the underlying virtual machines even when they are not processing workloads, and they involve managing VMs and a container orchestrator, contradicting the requirement to avoid managing VMs or orchestrators.

Full explanation →

757

MCQmedium

Which Azure service provides near real-time data analytics using SQL queries on streaming data from sources like IoT devices?

A.Azure Synapse Analytics

B.Azure Stream Analytics

C.Azure Data Factory

D.Azure Log Analytics

AnswerB

Stream Analytics runs SQL-like queries on real-time streaming data from IoT and event sources.

Why this answer

Azure Stream Analytics is a fully managed, real-time analytics service designed to process high-velocity streaming data from sources like IoT devices, social media feeds, or application logs. It uses a SQL-like query language to perform near real-time analytics, aggregations, and pattern matching on data as it arrives, making it the correct choice for this scenario.

Exam trap

The trap here is that candidates often confuse Azure Stream Analytics with Azure Synapse Analytics, mistakenly thinking Synapse's SQL pools can handle real-time streaming, when in fact Synapse is optimized for batch and interactive analytics on stored data, not continuous streaming queries.

How to eliminate wrong answers

Option A is wrong because Azure Synapse Analytics is a unified analytics platform for large-scale data warehousing and big data analytics, not designed for near real-time processing of streaming data with SQL queries. Option C is wrong because Azure Data Factory is a cloud-based ETL and data integration service that orchestrates and moves data between various stores, but it does not perform real-time analytics on streaming data. Option D is wrong because Azure Log Analytics is a tool for querying and analyzing log and performance data from Azure Monitor, primarily for operational monitoring and troubleshooting, not for near real-time analytics on streaming IoT data.

Full explanation →

758

MCQmedium

Which Azure service provides a managed Kubernetes environment that reduces the complexity and operational overhead of running Kubernetes?

A.Azure Container Instances

B.Azure Kubernetes Service

C.Azure Container Apps

D.Azure App Service

AnswerB

AKS is a managed Kubernetes service where Azure runs the control plane, simplifying cluster management significantly.

Why this answer

Azure Kubernetes Service (AKS) is the correct answer because it is a managed Kubernetes service that handles critical operational tasks such as health monitoring, patching, and upgrades of the control plane, thereby reducing the complexity and overhead of running Kubernetes. Unlike unmanaged Kubernetes, AKS abstracts the master node management, allowing you to focus on deploying and managing your containerized applications.

Exam trap

The trap here is that candidates often confuse Azure Container Apps (a serverless abstraction over Kubernetes) with Azure Kubernetes Service (a direct managed Kubernetes offering), but the question specifically asks for a 'managed Kubernetes environment' that reduces operational overhead, which is the defining feature of AKS.

How to eliminate wrong answers

Option A is wrong because Azure Container Instances (ACI) is a serverless container service that runs a single container or a small group of containers without orchestration, not a managed Kubernetes environment. Option C is wrong because Azure Container Apps is a serverless platform for running microservices and containerized applications that uses Kubernetes under the hood but abstracts away the Kubernetes API and control plane, so it is not a 'managed Kubernetes environment' in the sense of providing direct Kubernetes access. Option D is wrong because Azure App Service is a fully managed platform for hosting web applications, REST APIs, and mobile backends, and it does not provide a Kubernetes orchestration layer.

Full explanation →

759

MCQmedium

Which feature of Azure subscriptions allows an organization to separate billing and access management for different departments?

A.Resource groups

B.Multiple subscriptions

C.Azure tags

D.Azure RBAC

AnswerB

Each subscription is a separate billing and access boundary, allowing departmental separation of costs and permissions.

Why this answer

Multiple subscriptions allow an organization to create separate billing invoices and independent access management boundaries for different departments. Each subscription has its own billing relationship and can be assigned distinct Azure AD tenants or RBAC configurations, enabling cost tracking and administrative isolation per department.

Exam trap

The trap here is that candidates confuse Azure tags or resource groups as mechanisms for separating billing and access, when in fact only multiple subscriptions provide independent billing and administrative boundaries.

How to eliminate wrong answers

Option A is wrong because resource groups are logical containers for resources within a single subscription and do not provide separate billing or access management across departments. Option C is wrong because Azure tags are metadata key-value pairs used for organizing resources and cost reporting, but they cannot enforce separate billing or access management boundaries. Option D is wrong because Azure RBAC provides fine-grained access control within a subscription or resource group, but it operates within a single subscription and cannot create separate billing or administrative isolation for different departments.

Full explanation →

760

MCQeasy

A startup wants to avoid managing physical servers and instead focus on developing their application. Which cloud service model provides them with the most control over the operating system and applications while still not managing hardware?

A.Software as a Service (SaaS)

B.Platform as a Service (PaaS)

C.Infrastructure as a Service (IaaS)

D.Functions as a Service (FaaS)

AnswerC

IaaS gives control over the OS and applications while the provider manages the physical hardware.

Why this answer

Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet, giving the startup full control over the operating system, storage, and deployed applications without managing the underlying physical hardware. This model is ideal for a startup that wants to avoid hardware maintenance while retaining the flexibility to configure and manage their own OS and application stack.

Exam trap

The trap here is that candidates often confuse PaaS with IaaS, thinking PaaS gives OS control because they can deploy custom code, but PaaS actually abstracts the OS and runtime, whereas IaaS provides full OS access without hardware management.

How to eliminate wrong answers

Option A is wrong because Software as a Service (SaaS) delivers fully managed applications to end users, offering no control over the operating system or application runtime environment. Option B is wrong because Platform as a Service (PaaS) abstracts away the operating system and runtime, providing a managed platform where the user only deploys code and cannot control the underlying OS. Option D is wrong because Functions as a Service (FaaS) is a serverless compute model where the user writes stateless functions that run in a managed environment, with no control over the OS or application server.

Full explanation →

761

MCQeasy

Which Azure support plan provides a dedicated Technical Account Manager and a 15-minute response time for critical business impact issues?

A.Business

B.Enterprise On-Ramp

C.Enterprise

D.Developer

AnswerC

Enterprise Support provides a dedicated TAM and 15-minute initial response time for critical (Severity A) issues.

Why this answer

The Enterprise support plan is the only Azure plan that includes a dedicated Technical Account Manager (TAM) and guarantees a 15-minute response time for critical business impact issues (severity A). This plan is designed for large-scale enterprise customers who require proactive guidance and rapid escalation handling.

Exam trap

The trap here is that candidates often confuse the Enterprise On-Ramp plan's shared TAM and 30-minute critical response with the Enterprise plan's dedicated TAM and 15-minute response, or they mistakenly think the Business plan includes a TAM because it is a paid tier.

How to eliminate wrong answers

Option A is wrong because the Business support plan provides a 1-hour response time for critical issues and does not include a dedicated Technical Account Manager. Option B is wrong because the Enterprise On-Ramp plan offers a 30-minute response time for critical issues and includes a TAM only as a shared resource, not dedicated. Option D is wrong because the Developer support plan has a maximum response time of 8 hours for critical issues and does not provide any TAM or proactive services.

Full explanation →

762

MCQmedium

A company wants to ensure that all resources in their Azure environment are created with mandatory tags for cost tracking. They have already assigned a policy to append tags, but existing resources are still missing tags. They want to automatically add the tags to existing resources without manual intervention. What should they do?

A.Modify the policy effect to 'deny' instead of 'append'.

B.Create a remediation task for the policy.

C.Use Azure Resource Graph to identify and manually tag.

D.Reassign the policy with a new scope.

AnswerB

Remediation tasks automatically apply the 'deployIfNotExists' or 'modify' effect to existing non-compliant resources.

Why this answer

A remediation task is the correct solution because Azure Policy's 'append' effect only applies to new or updated resources. To automatically add the missing tags to existing non-compliant resources, you must create a remediation task that triggers a deployment to apply the policy's 'deployIfNotExists' or 'modify' effect. This task runs on demand or on a schedule to bring existing resources into compliance without manual intervention.

Exam trap

The trap here is that candidates confuse the 'append' effect's behavior (which only applies to new/modified resources) with a retroactive fix, leading them to incorrectly choose reassignment or effect changes instead of recognizing the need for a remediation task.

How to eliminate wrong answers

Option A is wrong because changing the policy effect to 'deny' would block creation of untagged resources but would not add tags to existing resources; it only prevents future non-compliance. Option C is wrong because using Azure Resource Graph to identify resources and manually tag them contradicts the requirement for 'without manual intervention'; it is a manual process. Option D is wrong because reassigning the policy with a new scope does not retroactively apply the 'append' effect to existing resources; the scope change only affects resources within the new scope going forward.

Full explanation →

763

MCQmedium

Which Azure feature allows organizations to apply the same governance at a hierarchy of subscriptions and resource groups?

A.Azure Resource Locks inheritance

B.Azure Policy and RBAC inheritance through the management hierarchy

C.Azure Blueprints auto-assignment

D.Azure Cost Management budget inheritance

AnswerB

Policies and RBAC assigned at Management Group or Subscription scope are inherited by all child scopes.

Why this answer

Azure Policy and RBAC (Role-Based Access Control) inheritance through the management hierarchy allows organizations to apply consistent governance across multiple subscriptions and resource groups. When a policy or RBAC assignment is applied at a management group, it is inherited by all child subscriptions and resource groups, ensuring uniform compliance and access control without manual reconfiguration.

Exam trap

The trap here is that candidates often confuse Azure Resource Locks inheritance (which does not exist) with the hierarchical inheritance of Azure Policy and RBAC, or mistakenly think Azure Blueprints auto-assignment is the mechanism for inheritance rather than a deployment tool.

How to eliminate wrong answers

Option A is wrong because Azure Resource Locks (e.g., CanNotDelete, ReadOnly) are applied at a single resource, resource group, or subscription scope and do not inherently inherit across a hierarchy of subscriptions and resource groups; they must be explicitly applied at each level. Option C is wrong because Azure Blueprints auto-assignment is a packaging and deployment mechanism for templates, policies, and RBAC, but the inheritance of governance itself is achieved through the management group hierarchy and Azure Policy/RBAC inheritance, not through Blueprints' auto-assignment feature. Option D is wrong because Azure Cost Management budgets are scoped to a single subscription or resource group and do not inherit across a management hierarchy; they must be created individually for each scope.

Full explanation →

764

MCQhard

A company needs to connect their on-premises network to Azure with a dedicated, private, and high-bandwidth connection that does not traverse the public internet. They require an SLA for availability and performance. Which Azure service should they use?

A.Azure VPN Gateway

B.Azure ExpressRoute

C.Azure Virtual WAN

D.Azure Peering Service

AnswerB

ExpressRoute provides a private, dedicated circuit from an on-premises location to Azure, with higher bandwidth and SLA guarantees.

Why this answer

Azure ExpressRoute is the correct choice because it provides a dedicated, private connection from on-premises networks to Azure that does not traverse the public internet. It offers a Service-Level Agreement (SLA) for availability (e.g., 99.95% for a single connection with redundancy) and performance, which is not guaranteed over internet-based VPNs. This meets the requirement for high bandwidth, privacy, and a guaranteed SLA.

Exam trap

The trap here is that candidates often confuse Azure VPN Gateway's 'private tunnel' (which is still over the public internet) with a truly private connection, or they assume Azure Virtual WAN alone provides dedicated bandwidth, when in fact it is an orchestration service that requires ExpressRoute for non-internet connectivity.

How to eliminate wrong answers

Option A is wrong because Azure VPN Gateway uses encrypted tunnels over the public internet, which does not provide a dedicated, private connection and typically offers no SLA for bandwidth or performance (only for gateway availability). Option C is wrong because Azure Virtual WAN is a networking service that aggregates multiple connectivity options (including VPN and ExpressRoute) but is not itself a dedicated private connection; it requires ExpressRoute as an underlying component to achieve the described requirements, and without ExpressRoute, it relies on internet-based VPNs.

Full explanation →

765

MCQeasy

In the context of cloud computing, what does 'going global in minutes' mean?

A.Cloud providers can physically ship servers to any country within minutes

B.Deploying applications to multiple worldwide regions rapidly with minimal effort

C.Users anywhere in the world can access cloud applications at zero latency

D.Cloud providers can guarantee 100% uptime globally

AnswerB

Cloud enables deploying globally in minutes by provisioning resources in any Azure region worldwide instantly.

Why this answer

Option B is correct because 'going global in minutes' refers to the ability to deploy applications and services across multiple Azure regions worldwide with minimal effort and rapid provisioning. Azure's global infrastructure, combined with tools like Azure Resource Manager and Traffic Manager, allows you to replicate resources across regions in minutes, enabling low-latency access and disaster recovery without physical hardware shipping.

Exam trap

The trap here is that candidates confuse 'going global in minutes' with physical server shipping (Option A) or assume zero latency (Option C), when the core concept is about rapid, software-defined global deployment using cloud regions and traffic management.

How to eliminate wrong answers

Option A is wrong because cloud providers do not physically ship servers to countries within minutes; that would involve logistics and customs delays, not cloud elasticity. Option C is wrong because zero latency is impossible due to the speed of light and network propagation delays; even with global distribution, latency is minimized but never zero. Option D is wrong because no cloud provider can guarantee 100% uptime globally; SLAs typically offer 99.9% to 99.99% uptime, and 100% is not achievable due to inevitable failures and maintenance.

Full explanation →

766

MCQmedium

Which Azure service provides a managed relational database compatible with PostgreSQL?

A.Azure SQL Database

B.Azure Database for PostgreSQL

C.Azure Cosmos DB for PostgreSQL

D.Azure Database for MariaDB

AnswerB

Azure Database for PostgreSQL is the fully managed service for open-source PostgreSQL workloads.

Why this answer

Azure Database for PostgreSQL is a fully managed, enterprise-ready relational database service built on the open-source PostgreSQL engine. It provides built-in high availability, automated backups, and scaling, making it the correct choice for a managed PostgreSQL-compatible database in Azure.

Exam trap

The trap here is confusing Azure Cosmos DB for PostgreSQL (a distributed, sharded database) with the standard managed Azure Database for PostgreSQL, leading candidates to select the Cosmos DB option when the question asks for a managed relational database compatible with PostgreSQL.

How to eliminate wrong answers

Option A is wrong because Azure SQL Database is a managed relational database based on Microsoft SQL Server engine, not PostgreSQL. Option C is wrong because Azure Cosmos DB for PostgreSQL (formerly Hyperscale (Citus)) is a distributed, scale-out option that uses PostgreSQL but is primarily designed for multi-tenant and sharded workloads, not a standard managed relational database service. Option D is wrong because Azure Database for MariaDB is a managed relational database based on the MariaDB engine, which is a fork of MySQL, not PostgreSQL.

Full explanation →

767

MCQmedium

A company has an Azure subscription used by multiple development teams. The security team wants to ensure that every virtual network (VNet) created in the subscription automatically has a specific network security group (NSG) associated with its default subnet. The NSG rules are defined by the security team, and developers should not have to perform any extra steps after creating a VNet. Which Azure Policy effect should the security team use in the policy definition?

A.Deny

B.Audit

C.DeployIfNotExists

D.Append

AnswerC

The DeployIfNotExists effect automatically deploys a resource (in this case, an NSG and its association to the subnet) when a VNet is created without it. This ensures compliance without manual effort from developers, matching the requirement exactly.

Why this answer

The DeployIfNotExists effect is correct because it automatically deploys a specific NSG to the default subnet of any VNet that does not already have it, ensuring compliance without requiring developer intervention. This effect evaluates the resource after creation and triggers a deployment to remediate non-compliant states, aligning with the requirement for zero extra steps.

Exam trap

The trap here is that candidates often confuse DeployIfNotExists with Deny, thinking that blocking non-compliant resources is the only way to enforce compliance, but the question explicitly requires automatic association without extra steps, which only DeployIfNotExists can achieve through remediation.

How to eliminate wrong answers

Option A is wrong because Deny prevents the creation of VNets that do not meet the condition, but it cannot automatically associate an NSG with the default subnet after creation; it would block VNet creation entirely if the NSG is missing, which is not the desired behavior. Option B is wrong because Audit only logs non-compliant resources for monitoring and reporting, but it does not perform any automatic remediation or deployment of the required NSG, leaving developers to manually fix the issue.

Full explanation →

768

MCQmedium

A company migrates its on-premises servers to Azure virtual machines (IaaS model). The security team is planning the patching strategy and asks who is responsible for installing security updates on the guest operating system of the Azure VMs. According to the shared responsibility model, which statement is correct?

A.Microsoft is responsible for maintaining and patching the guest operating system on Azure virtual machines.

B.The customer is responsible for maintaining and patching the guest operating system on Azure virtual machines.

C.Microsoft is responsible for patching any application software that runs on Azure virtual machines.

D.The customer is responsible for the physical security of the Azure datacenter where the virtual machines are hosted.

AnswerB

This is correct. Under the shared responsibility model for IaaS, the customer has full control over the guest OS, applications, and data, and is therefore responsible for patching and securing the OS.

Why this answer

In the shared responsibility model for IaaS, the customer retains control over the guest operating system, applications, and data. Microsoft manages the physical host, hypervisor, and underlying Azure infrastructure, but the customer must install and maintain security updates on the guest OS of their Azure VMs. This is because the customer has full administrative access to the VM and is responsible for its configuration and patch management.

Exam trap

The trap here is that candidates confuse IaaS with PaaS or SaaS, where Microsoft does manage the guest OS (e.g., Azure App Service or SQL Database), leading them to incorrectly assume Microsoft handles patching for Azure VMs.

How to eliminate wrong answers

Option A is wrong because Microsoft is not responsible for patching the guest OS on Azure VMs; their responsibility ends at the hypervisor layer, and they only manage the host OS and physical infrastructure. Option C is wrong because Microsoft does not patch application software running on Azure VMs; the customer is responsible for all software installed on the guest OS, including applications, as part of their IaaS management duties.

Full explanation →

769

MCQeasy

Which Azure support option provides technical support through community forums and documentation only?

A.Developer support

B.Basic support

C.Business support

D.Enterprise support

AnswerB

Basic support is free and provides community forums, documentation, and health status — no direct engineer support.

Why this answer

Basic support is the free tier included with every Azure subscription. It provides access only to community forums, documentation, and billing support, with no technical support from Microsoft engineers. This makes it the correct answer for support limited to community forums and documentation.

Exam trap

The trap here is that candidates often assume 'Basic' means minimal but still includes some engineer support, when in fact it provides zero technical support from Microsoft engineers, only community forums and documentation.

How to eliminate wrong answers

Option A is wrong because Developer support includes technical support from Microsoft engineers during business hours for development environments, not just community forums and documentation. Option C is wrong because Business support offers 24/7 technical support with faster response times for production environments, far beyond forums and documentation. Option D is wrong because Enterprise support provides proactive guidance, a designated Technical Account Manager (TAM), and the fastest response times for critical workloads, not just community forums and documentation.

Full explanation →

770

MCQmedium

A company has a policy that every Azure resource must have a 'CostCenter' tag assigned at creation time. The governance team wants to automatically prevent any resource creation if the tag is missing, without requiring manual review after deployment. Which Azure feature should they use to enforce this requirement?

A.Azure Policy

B.Azure Blueprints

C.Azure Role-Based Access Control (RBAC)

D.Azure Tags

AnswerA

Correct. Azure Policy can enforce tagging rules at resource creation time by using a policy definition with a 'Deny' effect. This ensures that resources without the required tag are automatically blocked from being created.

Why this answer

Azure Policy is correct because it enables the enforcement of organizational standards by evaluating resources against custom or built-in policies at creation time. In this scenario, a policy can be configured with a 'deny' effect to automatically block any resource deployment that lacks the required 'CostCenter' tag, preventing non-compliant resources from being created without manual intervention.

Exam trap

The trap here is that candidates confuse Azure Policy's enforcement capabilities with Azure Blueprints' packaging role or RBAC's access control, mistakenly thinking Blueprints or RBAC can evaluate resource properties like tags at creation time.

How to eliminate wrong answers

Option B is wrong because Azure Blueprints is a declarative orchestration tool that packages together Azure Policy definitions, RBAC assignments, and resource templates for consistent environment setup, but it does not itself enforce real-time tag requirements during resource creation; it relies on included policies for enforcement. Option C is wrong because Azure Role-Based Access Control (RBAC) manages permissions and access to Azure resources based on roles (e.g., Contributor, Owner), but it cannot evaluate or enforce resource properties like tags at creation time; RBAC controls who can create resources, not what tags those resources must have.

Full explanation →

771

MCQhard

A company wants to ensure a specific resource group cannot be deleted, but they also need to be able to delete it temporarily during maintenance windows. Which approach allows the most granular control?

A.Assign an Azure Policy with deny effect on delete operations.

B.Apply a 'CanNotDelete' resource lock and remove it before maintenance.

C.Use Azure RBAC with a custom role that denies delete.

D.Use Azure Blueprints to enforce protection.

AnswerB

Resource locks can be easily removed and reapplied, offering flexible control.

Why this answer

A 'CanNotDelete' resource lock prevents deletion of a resource group and its resources, but it can be removed and reapplied as needed, providing granular control during maintenance windows. This approach allows temporary deletion by removing the lock, performing the deletion, and then reapplying the lock afterward. It is the only option that directly supports the requirement for both protection and temporary removal without permanent configuration changes.

Exam trap

The trap here is that candidates often confuse Azure Policy with resource locks, thinking Policy can block deletion, but Policy is for compliance auditing and enforcement of resource configurations, not for operational locks that directly prevent deletion actions.

How to eliminate wrong answers

Option A is wrong because Azure Policy with deny effect on delete operations is not designed to block resource group deletion; policies evaluate and enforce compliance rules on resource properties, but they do not prevent deletion actions at the resource group level. Option C is wrong because Azure RBAC with a custom role that denies delete would require modifying role assignments for each maintenance window, which is less granular and more cumbersome than a resource lock that can be toggled directly on the resource group. Option D is wrong because Azure Blueprints enforce governance and compliance by deploying resources and policies, but they do not provide a mechanism to temporarily allow deletion of a resource group; they are for environment setup, not operational control.

Full explanation →

772

MCQmedium

A company uses Azure for multiple projects. The IT governance team wants to ensure that every new Azure resource within a subscription is automatically assigned a 'CostCenter' tag based on the resource group it is created in. The team does not want to rely on users manually applying the tag. They need a built-in Azure solution that enforces this rule without custom scripts. Which Azure feature should they use?

A.Azure Policy with the 'Inherit a tag from the resource group if missing' effect

B.Azure Resource Graph

C.Azure Management Groups

D.Azure Tags (manual tagging feature)

AnswerA

Correct. Azure Policy includes built-in effects (e.g., modify, append) that can automatically apply or inherit tags. The 'Inherit a tag from the resource group if missing' effect copies the resource group's tag value to resources that do not already have that tag, ensuring automatic compliance.

Why this answer

Azure Policy with the 'Inherit a tag from the resource group if missing' effect is correct because it automatically applies the 'CostCenter' tag from the resource group to any new resource created within that resource group, without requiring manual intervention or custom scripts. This built-in policy effect enforces governance rules at scale, ensuring compliance across the subscription.

Exam trap

The trap here is that candidates often confuse Azure Policy (which enforces rules) with Azure Tags (which are just metadata) or Azure Resource Graph (which only queries), leading them to pick a manual or non-enforcing option.

How to eliminate wrong answers

Option B (Azure Resource Graph) is wrong because it is a query service for exploring resources, not an enforcement mechanism; it cannot automatically assign tags. Option C (Azure Management Groups) is wrong because they provide hierarchical organization for managing access, policies, and compliance across multiple subscriptions, but they do not directly inherit or apply tags to resources. Option D (Azure Tags manual tagging feature) is wrong because it requires users to manually apply tags, which contradicts the requirement to avoid relying on users.

Full explanation →

773

MCQmedium

A company has five Azure subscriptions, each managed by a different department. The IT governance team needs to enforce a single set of compliance policies (e.g., allowed VM SKUs) and assign a specific role to a central security team across all subscriptions. The goal is to minimize administrative overhead. Which Azure component should the governance team use as the scope for these assignments?

A.Assign the policies and role at each subscription level individually.

B.Create a resource group in each subscription and assign policies and roles at the resource group level.

C.Place all subscriptions under a single management group and assign policies and roles at that management group level.

D.Create an Azure Blueprint definition and apply it to each subscription separately.

AnswerC

A management group can contain multiple subscriptions. Assignments made at the management group level are inherited by all subscriptions within it, providing a single, centralized scope for enforcement. This minimizes administrative overhead.

Why this answer

Management groups provide a hierarchical scope above subscriptions, enabling centralized governance. By placing all five subscriptions under a single management group, the IT governance team can assign Azure Policy definitions (e.g., allowed VM SKUs) and role-based access control (RBAC) roles (e.g., for the security team) once at that management group level. This inheritance automatically applies the policies and roles to all child subscriptions, minimizing administrative overhead compared to per-subscription or per-resource-group assignments.

Exam trap

The trap here is that candidates often think resource groups are the natural scope for governance, but management groups are designed specifically for cross-subscription policy and RBAC inheritance, making them the correct choice for minimizing overhead across multiple subscriptions.

How to eliminate wrong answers

Option A is wrong because assigning policies and roles at each subscription level individually creates significant administrative overhead, requiring manual repetition across five subscriptions and increasing the risk of configuration drift. Option B is wrong because creating a resource group in each subscription and assigning policies and roles at the resource group level still requires per-subscription management and does not leverage Azure's hierarchical inheritance; it also fails to enforce policies on resources outside those specific resource groups within each subscription.

Full explanation →

774

MCQmedium

Which Azure service provides intelligent search capabilities with AI-powered features like OCR, entity recognition, and key phrase extraction?

A.Azure Form Recognizer

B.Azure Cognitive Search

C.Azure Language Understanding

D.Azure Text Analytics

AnswerB

Cognitive Search provides AI-enriched full-text search with OCR, entity recognition, and key phrase extraction over documents.

Why this answer

Azure Cognitive Search (now Azure AI Search) is the correct answer because it is a cloud search-as-a-service solution that integrates AI-powered capabilities such as OCR (optical character recognition), entity recognition, and key phrase extraction via built-in cognitive skills. These skills enrich the indexing pipeline, allowing unstructured data to be transformed into searchable, structured content without custom ML code.

Exam trap

The trap here is that candidates confuse Azure Cognitive Search with Azure Form Recognizer or Azure Text Analytics because both offer OCR or entity extraction, but only Cognitive Search combines these AI enrichments with a full-text search engine and indexing pipeline.

How to eliminate wrong answers

Option A is wrong because Azure Form Recognizer is a specialized service for extracting key-value pairs, tables, and text from forms and documents using prebuilt or custom models, but it does not provide general-purpose intelligent search or indexing capabilities. Option C is wrong because Azure Language Understanding (LUIS) is a conversational AI service for interpreting user intents and entities in natural language, not a search service with OCR or key phrase extraction. Option D is wrong because Azure Text Analytics is a single-purpose API for sentiment analysis, key phrase extraction, and entity recognition, but it lacks the search indexing, scoring, and OCR features that define Azure Cognitive Search.

Full explanation →

775

MCQeasy

Which Azure pricing calculator helps you estimate monthly costs for Azure services before deploying them?

A.Azure TCO Calculator

B.Azure Pricing Calculator

C.Azure Cost Management

D.Azure Advisor

AnswerB

The Azure Pricing Calculator lets you estimate monthly costs for any Azure service before deployment, supporting budget planning.

Why this answer

The Azure Pricing Calculator is the correct tool for estimating monthly costs of Azure services before deployment. It allows you to configure services (e.g., VMs, storage, databases) by specifying parameters like region, tier, and usage hours, then generates a detailed cost estimate. This pre-deployment estimation is its primary purpose, distinguishing it from post-deployment cost analysis tools.

Exam trap

The trap here is confusing the Azure Pricing Calculator (pre-deployment estimation) with the Azure TCO Calculator (on-premises vs. cloud comparison) or Azure Cost Management (post-deployment monitoring), as all three involve cost but serve different lifecycle stages.

How to eliminate wrong answers

Option A is wrong because the Azure TCO Calculator compares on-premises infrastructure costs with Azure cloud costs, not monthly service estimates for new deployments. Option C is wrong because Azure Cost Management analyzes and optimizes costs of already deployed resources, not pre-deployment estimation. Option D is wrong because Azure Advisor provides best-practice recommendations for existing resources (e.g., high availability, security), not cost estimation for planned services.

Full explanation →

776

MCQmedium

Which Azure service provides distributed tracing across microservices to help developers identify performance bottlenecks and failures?

A.Azure Log Analytics

B.Azure Application Insights

C.Azure Monitor Metrics

D.Azure Sentinel

AnswerB

Application Insights provides distributed tracing with end-to-end correlation across microservices, enabling bottleneck identification.

Why this answer

Azure Application Insights is the correct service because it provides distributed tracing, which allows developers to track requests as they travel across multiple microservices. This capability helps identify performance bottlenecks and failures by correlating telemetry from different components, using a correlation ID to link operations. It is part of Azure Monitor and supports OpenTelemetry for standardized instrumentation.

Exam trap

The trap here is that candidates confuse Azure Monitor Metrics (which shows performance counters) with Application Insights (which provides distributed tracing), or they mistakenly think Log Analytics alone can correlate cross-service requests without the built-in trace context propagation.

How to eliminate wrong answers

Option A is wrong because Azure Log Analytics is a query and analysis tool for log data, not a distributed tracing solution; it lacks the automatic correlation and end-to-end request tracking across microservices. Option C is wrong because Azure Monitor Metrics focuses on numerical time-series data (e.g., CPU usage, request rates) and does not provide distributed tracing or detailed failure analysis across service boundaries. Option D is wrong because Azure Sentinel is a Security Information and Event Management (SIEM) system for threat detection and security analytics, not for application performance monitoring or distributed tracing.

Full explanation →

777

MCQeasy

Which cloud model provides the greatest degree of control over the underlying infrastructure?

A.Public cloud

B.Private cloud

C.Hybrid cloud

D.Community cloud

AnswerB

Private cloud is dedicated to a single organization, providing maximum infrastructure control.

Why this answer

The private cloud model provides the greatest degree of control over the underlying infrastructure because it is dedicated to a single organization, allowing full customization of hardware, virtualization layers, networking, and security configurations. In contrast, public clouds abstract infrastructure management away from the customer, limiting control to the application and data layers only.

Exam trap

The trap here is that candidates often confuse 'control' with 'scalability' or 'cost efficiency,' assuming public cloud offers more control because of its flexibility, but the question specifically targets control over the underlying infrastructure, which is maximized only in a private cloud.

How to eliminate wrong answers

Option A is wrong because the public cloud model shares infrastructure across multiple tenants, with the provider managing the hypervisor, physical servers, and network fabric, leaving the customer with no control over the underlying hardware or host OS. Option C is wrong because hybrid cloud combines public and private clouds, but the degree of control is limited to the private portion; the public component still restricts infrastructure control. Option D is wrong because community cloud is shared among several organizations with similar concerns, but the underlying infrastructure is still managed by a provider or a third party, reducing individual control compared to a fully private deployment.

Full explanation →

778

MCQmedium

A company wants to connect an on-premises network to Azure with a dedicated private connection that bypasses the internet. Which service should they use?

A.Azure VPN Gateway

B.Azure ExpressRoute

C.Azure Virtual WAN

D.Azure DNS

AnswerB

Correct. ExpressRoute is a private dedicated connection that does not go over the internet.

Why this answer

Azure ExpressRoute is the correct service because it provides a dedicated, private connection from an on-premises network directly into Azure, bypassing the public internet entirely. This ensures lower latency, higher reliability, and greater security compared to internet-based connections, and it supports higher bandwidth options.

Exam trap

The trap here is that candidates often confuse Azure VPN Gateway (which also connects on-premises to Azure) with a private connection, but VPN Gateway still uses the public internet as the underlying transport, whereas ExpressRoute is the only option that completely bypasses the internet.

How to eliminate wrong answers

Option A is wrong because Azure VPN Gateway uses encrypted tunnels over the public internet (IPsec/IKE), so it does not bypass the internet and is not a dedicated private connection. Option C is wrong because Azure Virtual WAN is a networking service that aggregates branch connectivity, but it can use either VPN or ExpressRoute as underlying transport; it is not itself a dedicated private connection that bypasses the internet. Option D is wrong because Azure DNS is a domain name resolution service and has nothing to do with private network connectivity between on-premises and Azure.

Full explanation →

779

MCQeasy

A company wants to track and analyze Azure costs across multiple departments. They have tagged resources with 'Department' tags. Which tool should they use to view cost breakdowns by department?

A.Azure Policy

B.Azure Cost Management + Billing

C.Azure Advisor

D.Azure Service Health

AnswerB

This tool provides cost analysis and reporting, including the ability to group costs by resource tags.

Why this answer

Azure Cost Management + Billing is the correct tool because it provides native capabilities to analyze and visualize Azure spending, including the ability to filter and group costs by custom tags such as 'Department'. This allows the company to break down costs per department without needing additional configuration or external tools.

Exam trap

The trap here is that candidates often confuse Azure Policy's ability to enforce tagging with the ability to analyze costs by those tags, but Azure Policy does not provide any cost reporting or analytics functionality.

How to eliminate wrong answers

Option A is wrong because Azure Policy is a governance tool used to enforce rules and compliance on resources (e.g., requiring specific tags), but it does not provide cost analysis or breakdowns by tags. Option C is wrong because Azure Advisor offers recommendations for cost optimization, security, and performance, but it does not allow users to view or filter cost breakdowns by department tags.

Full explanation →

780

MCQeasy

A company wants to reduce its carbon footprint by using a cloud provider that invests in renewable energy. They want to ensure that their workloads in Azure run in datacenters that are among the most energy-efficient. Which Azure benefit is most directly related to this goal?

A.Economies of scale

B.Environmental sustainability

C.Scalability

D.Security and compliance

AnswerB

Azure's commitment to using renewable energy and improving energy efficiency directly supports the company's goal of reducing its carbon footprint.

Why this answer

Environmental sustainability is the Azure benefit that directly addresses the company's goal of reducing its carbon footprint by using a cloud provider that invests in renewable energy and operates energy-efficient datacenters. Microsoft has committed to being carbon negative by 2030 and powers its Azure datacenters with 100% renewable energy, making this the most relevant benefit for the stated objective.

Exam trap

The trap here is that candidates may confuse economies of scale with environmental sustainability, assuming that larger datacenters automatically mean better energy efficiency, but the question specifically asks about renewable energy investment and carbon footprint reduction, which is directly tied to environmental sustainability commitments and not to cost savings from scale.

How to eliminate wrong answers

Option A is wrong because economies of scale refer to cost advantages gained by spreading fixed costs over a larger number of customers, not to energy efficiency or renewable energy investments. Option C is wrong because scalability is the ability to adjust resources based on demand, which does not inherently reduce carbon footprint or relate to renewable energy usage. Option D is wrong because security and compliance focus on protecting data and meeting regulatory standards, not on environmental impact or energy efficiency of datacenters.

Full explanation →

781

MCQmedium

A company deploys a web application on Azure VMs across two different physical locations within the same Azure region. These locations are isolated from each other in terms of power, cooling, and networking. If one location fails, the application remains available from the other location. Which feature achieves this?

A.Availability sets

B.Availability zones

C.Resource groups

D.Virtual machine scale sets

AnswerB

Correct. Availability zones are unique physical locations within a region, offering isolation and redundancy.

Why this answer

Availability zones are physically separate locations (datacenters) within an Azure region, each with independent power, cooling, and networking. By deploying VMs across two zones, the application remains available if one zone fails, achieving high availability. This matches the scenario exactly.

Exam trap

The trap here is confusing availability zones (which span physically separate datacenters) with availability sets (which only protect against failures within a single datacenter), leading candidates to choose availability sets when the question explicitly describes isolated locations with independent power and cooling.

How to eliminate wrong answers

Option A is wrong because availability sets protect against failures within a single datacenter (e.g., rack or update domain failures) but do not provide isolation across separate physical locations with independent power and cooling. Option C is wrong because resource groups are logical containers for managing Azure resources and have no impact on physical redundancy or availability.

Full explanation →

782

MCQmedium

What distinguishes a 'region pair' in Azure?

A.Two datacenters within the same city connected by high-speed fiber

B.Two Azure regions paired for disaster recovery and update isolation

C.Two subscriptions in the same Azure AD tenant

D.Primary and secondary zones within a single Azure region

AnswerB

Region pairs are geographically separated (300+ miles) and coupled so that platform updates aren't applied simultaneously and recovery is prioritized.

Why this answer

A region pair consists of two Azure regions within the same geography, at least 300 miles apart, that are directly connected via high-speed fiber and are used for disaster recovery and planned maintenance isolation. This design ensures that only one region in a pair is updated at a time, reducing the risk of simultaneous failures across both regions.

Exam trap

The trap here is that candidates often confuse region pairs with availability zones, thinking a region pair is two datacenters within the same region, but region pairs are always two distinct regions separated by a significant geographic distance.

How to eliminate wrong answers

Option A is wrong because Azure region pairs are not two datacenters within the same city; they are separate regions, often hundreds of miles apart, to provide geographic redundancy. Option C is wrong because two subscriptions in the same Azure AD tenant are unrelated to region pairs; region pairs are about physical datacenter locations, not identity or billing constructs. Option D is wrong because primary and secondary zones within a single Azure region refer to availability zones, which are physically separate datacenters within one region, not a region pair spanning two distinct regions.

Full explanation →

783

MCQmedium

A company needs to track and optimize costs across multiple Azure subscriptions. They want to allocate budgets and receive notifications when spending exceeds forecasted amounts. Which Azure tool should they use?

A.Azure Advisor

B.Azure Cost Management

C.Azure Policy

D.Azure Budgets

AnswerB

Cost Management allows you to create budgets, monitor spending, and configure alerts when costs exceed thresholds.

Why this answer

Azure Cost Management is the correct tool because it provides native capabilities to track, analyze, and optimize cloud costs across multiple subscriptions. It allows you to set budgets, configure cost alerts, and receive notifications when actual or forecasted spending exceeds defined thresholds, directly addressing the requirement for budget allocation and proactive spending notifications.

Exam trap

The trap here is that candidates often confuse Azure Advisor's cost recommendations (which suggest ways to save money) with the actual cost management and alerting capabilities of Azure Cost Management, leading them to select Advisor instead.

How to eliminate wrong answers

Option A is wrong because Azure Advisor is a personalized recommendation engine that provides best-practice guidance on reliability, security, performance, and cost optimization, but it does not allow you to set budgets or configure spending alerts. Option C is wrong because Azure Policy is a governance tool used to enforce organizational rules and compliance by applying policies to resources (e.g., restricting resource types or locations), not for tracking or optimizing costs or sending budget notifications.

Full explanation →

784

MCQmedium

Which Azure service provides a fully managed, cloud-hosted Kubernetes environment for AI and machine learning workloads?

A.Azure Machine Learning compute clusters

B.Azure Kubernetes Service with GPU nodes

C.Azure Batch AI

D.Azure Neural Network Computing

AnswerB

AKS with GPU-enabled node pools provides Kubernetes orchestration for AI/ML workloads at scale.

Why this answer

Azure Kubernetes Service (AKS) with GPU nodes is the correct answer because it provides a fully managed Kubernetes cluster that can be configured with GPU-enabled virtual machines, making it ideal for running AI and machine learning workloads that require accelerated computing. AKS handles the control plane, patching, and scaling, while allowing you to deploy containerized ML models or training jobs using Kubernetes orchestration.

Exam trap

The trap here is that candidates may confuse Azure Machine Learning compute clusters (which also support GPU VMs) with a managed Kubernetes environment, not realizing that AKS is the dedicated Kubernetes service and that Azure ML compute clusters are not Kubernetes-based.

How to eliminate wrong answers

Option A is wrong because Azure Machine Learning compute clusters are a managed compute target for training and batch inference within Azure Machine Learning, but they are not a Kubernetes-based service; they use virtual machine scale sets with or without GPUs and lack the full Kubernetes orchestration capabilities. Option C is wrong because Azure Batch AI is a deprecated service that was replaced by Azure Machine Learning; it was a batch processing service for AI workloads, not a managed Kubernetes environment. Option D is wrong because Azure Neural Network Computing is not a real Azure service; it is a fabricated name that might confuse candidates into thinking it is a specialized compute service for neural networks.

Full explanation →

785

MCQmedium

A company wants to track costs by department across multiple Azure subscriptions. They have tagged resources with 'Department' tags. However, some resources are missing tags. They want to see a report of costs grouped by department, including untagged resources. Which Azure tool should they use?

A.Azure Cost Management + Billing

B.Azure Policy

C.Azure Resource Graph

D.Azure Advisor

AnswerA

Cost Management can analyze costs by tags and includes untagged resources in reports.

Why this answer

Azure Cost Management + Billing provides native cost analysis and reporting capabilities that can group costs by custom tags (like 'Department') and includes an 'Untagged' category for resources missing the specified tag. This allows the company to see a complete cost breakdown by department, including untagged resources, across multiple subscriptions in a single view.

Exam trap

The trap here is confusing Azure Policy's ability to enforce tagging (which ensures tags exist) with Cost Management's ability to report on existing tags, leading candidates to incorrectly select Azure Policy for cost reporting needs.

How to eliminate wrong answers

Option B (Azure Policy) is wrong because it is a governance tool for enforcing compliance rules (e.g., requiring tags on new resources) and cannot generate cost reports or show historical cost data grouped by tags. Option C (Azure Resource Graph) is wrong because it is a query engine for exploring and discovering Azure resources based on properties, but it does not provide cost data or cost aggregation by tags. Option D (Azure Advisor) is wrong because it is a personalized recommendation engine for best practices in cost, security, reliability, and performance, not a tool for generating cost reports grouped by tags.

Full explanation →

786

MCQeasy

A startup wants to run a web application without purchasing or managing any servers. They only want to upload their code and let the cloud provider handle everything from the runtime to scaling. Which cloud service model best fits this requirement?

A.Infrastructure as a Service (IaaS)

B.Platform as a Service (PaaS)

C.Software as a Service (SaaS)

D.Function as a Service (FaaS)

AnswerB

PaaS offers a managed hosting environment where you deploy your code and the provider handles servers, runtime, and scaling. Examples: Azure App Service.

Why this answer

Platform as a Service (PaaS) is the correct model because it provides a fully managed hosting environment where the startup can deploy their web application code without needing to provision or manage underlying servers, operating systems, or runtime infrastructure. Azure App Service is a prime example of PaaS that handles automatic scaling, load balancing, and patching, allowing developers to focus solely on code.

Exam trap

The trap here is that candidates often confuse FaaS with PaaS because both are serverless, but FaaS is for individual functions triggered by events, not for hosting a complete web application with a persistent runtime.

How to eliminate wrong answers

Option A (IaaS) is wrong because it requires the startup to provision and manage virtual machines, storage, and networking, which contradicts the requirement of not managing any servers. Option C (SaaS) is wrong because it delivers a fully functional application to end users, not a platform for deploying custom code; the startup would be consuming software, not uploading their own code. Option D (FaaS) is wrong because it is designed for event-driven, stateless functions that run in response to triggers, not for hosting a full web application with persistent runtime and state management.

Full explanation →

787

MCQhard

A company runs business-critical ERP software on Azure. If the ERP application has a 99.9% SLA and the Azure SQL Database backing it has a 99.99% SLA, what is the overall composite SLA?

A.99.99% (take the highest SLA)

B.Approximately 99.89%

C.99.9% (take the lowest SLA)

D.200% because two services are running

AnswerB

0.999 × 0.9999 ≈ 0.9989, so the composite SLA is approximately 99.89%.

Why this answer

The composite SLA for dependent services is calculated by multiplying their individual SLAs. Here, 99.9% (0.999) multiplied by 99.99% (0.9999) equals approximately 0.9989, or 99.89%. This reflects the overall availability when both the ERP application and the Azure SQL Database must be operational for the system to function.

Exam trap

The trap here is that candidates mistakenly pick the lowest SLA (Option C) or highest SLA (Option A) instead of multiplying the probabilities, failing to recognize that composite SLA for dependent services is a product, not a min or max.

How to eliminate wrong answers

Option A is wrong because taking the highest SLA (99.99%) ignores the dependency between services; composite SLA is multiplicative, not a maximum. Option C is wrong because taking the lowest SLA (99.9%) assumes only the weakest link matters, but the combined probability of failure includes both components. Option D is wrong because SLAs are probabilities (≤100%) and cannot exceed 100%; multiplying two SLAs always yields a value less than or equal to the lower SLA.

Full explanation →

788

Drag & Dropmedium

Arrange the steps to implement Azure Backup for a virtual machine.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

Azure Backup requires a vault, policy, enablement, initial backup, and monitoring.

Full explanation →

789

MCQmedium

Which Azure service provides an enterprise-grade, fully managed graph database as a service?

A.Azure SQL Database

B.Azure Cosmos DB for Gremlin

C.Azure Table Storage

D.Azure Cache for Redis

AnswerB

Cosmos DB for Gremlin is Azure's fully managed graph database service using the Apache TinkerPop standard.

Why this answer

Azure Cosmos DB for Gremlin is the correct answer because it provides a fully managed, enterprise-grade graph database service that uses the Apache TinkerPop Gremlin graph traversal language. It supports graph data models with vertices and edges, enabling complex relationship queries at global scale with turnkey distribution and SLA-backed performance.

Exam trap

The trap here is that candidates may confuse Azure Cosmos DB's multiple APIs (e.g., SQL, MongoDB, Cassandra, Table, Gremlin) and incorrectly assume that Azure SQL Database or Azure Table Storage can handle graph workloads, when only the Gremlin API within Cosmos DB is purpose-built for graph databases.

How to eliminate wrong answers

Option A is wrong because Azure SQL Database is a relational database management system (RDBMS) based on SQL Server, not a graph database, and it does not natively support graph traversal APIs like Gremlin. Option C is wrong because Azure Table Storage is a NoSQL key-value store for structured, non-relational data, lacking graph-specific features such as edges, vertices, and traversal queries. Option D is wrong because Azure Cache for Redis is an in-memory data store primarily used for caching and session management, not a graph database, and while Redis has a graph module (RedisGraph), Azure Cache for Redis does not support it as a managed graph service.

Full explanation →

790

MCQmedium

A company wants to deploy a standardized environment that includes Azure Policy assignments, RBAC roles, and resource group templates. They need to version these components and apply them to multiple subscriptions. Which Azure service should they use?

A.Azure Policy

B.Azure Blueprints

C.Azure Resource Manager

D.Azure Management Groups

AnswerB

Azure Blueprints allows you to orchestrate the deployment of resource groups, policies, role assignments, and ARM templates in a versioned, repeatable manner.

Why this answer

Azure Blueprints is the correct service because it is designed to orchestrate the deployment of a standardized environment by packaging Azure Policy assignments, RBAC roles, and resource group templates into a single, versioned, and repeatable artifact. It allows you to assign these components to multiple subscriptions while maintaining a consistent configuration and tracking changes through versioning.

Exam trap

The trap here is that candidates often confuse Azure Policy with Azure Blueprints, thinking that Policy alone can deploy and version a full environment, but Policy only enforces rules on existing resources and cannot orchestrate the deployment of RBAC roles and resource group templates as a single versioned artifact.

How to eliminate wrong answers

Option A is wrong because Azure Policy is a service for enforcing rules and compliance on existing resources, but it cannot package multiple components like RBAC roles and resource group templates into a versioned artifact for deployment across subscriptions. Option C is wrong because Azure Resource Manager (ARM) is the underlying deployment and management service for Azure resources, but it does not provide a built-in mechanism to version and orchestrate a collection of policies, roles, and templates as a single blueprint. Option D is wrong because Azure Management Groups provide a hierarchical structure for organizing subscriptions and applying governance at scale, but they do not directly deploy or version resource group templates, RBAC roles, or policy assignments as a cohesive unit.

Full explanation →

791

MCQeasy

A company wants to pay only for the compute resources they actually use, with no upfront costs. They can scale up or down based on demand. Which cloud pricing model does this describe?

A.A) Reserved capacity

B.B) Pay-as-you-go

C.C) Spot pricing

D.D) Hybrid benefit

AnswerB

Pay-as-you-go charges based on actual usage with no upfront payment, offering flexibility to scale.

Why this answer

The pay-as-you-go model (also called consumption-based pricing) allows a company to pay only for the compute resources they actually consume, with no upfront costs or long-term commitments. This model provides the flexibility to scale resources up or down based on real-time demand, aligning costs directly with usage. It is the standard pricing model for most cloud services, including Azure virtual machines and App Service plans, when no reservation or spot discount is applied.

Exam trap

Microsoft often tests the distinction between pay-as-you-go and reserved capacity, where candidates mistakenly think reserved capacity also allows scaling without upfront costs, but reserved capacity requires a commitment and does not offer the same on-demand flexibility.

How to eliminate wrong answers

Option A is wrong because reserved capacity requires a one- or three-year commitment with upfront or monthly payments, not a pay-per-use model with no upfront costs. Option C is wrong because spot pricing offers discounted compute capacity but comes with the risk of eviction when Azure needs the capacity back, and it still incurs costs per second of usage, not a pure 'pay only for what you use' model without upfront commitment. Option D is wrong because the Hybrid Benefit is a licensing discount that allows you to use existing on-premises Windows Server or SQL Server licenses with Software Assurance to reduce costs on Azure, not a pricing model for paying only for actual compute usage with no upfront costs.

Full explanation →

792

MCQhard

A company wants to connect their on-premises data center to Azure with a dedicated, private connection that does not traverse the internet. They also need to ensure high availability by having two active connections. Which Azure service and configuration should they use?

A.Azure VPN Gateway with active-active mode.

B.Azure ExpressRoute with two circuits.

C.Azure Virtual WAN with a single connection.

D.Azure Point-to-Site VPN.

AnswerB

ExpressRoute circuits provide private connections; using two circuits ensures high availability.

Why this answer

Azure ExpressRoute provides a dedicated, private connection from on-premises to Azure that does not traverse the public internet. To achieve high availability with two active connections, you must configure two ExpressRoute circuits, each connecting to different Microsoft Enterprise Edge (MSEE) devices, ensuring redundancy at the physical and network layer.

Exam trap

The trap here is that candidates confuse 'active-active mode' on VPN Gateway with a dedicated private connection, not realizing that VPN Gateway still uses the internet, while ExpressRoute is the only service that offers a private, internet-free connection with dual-circuit high availability.

How to eliminate wrong answers

Option A is wrong because Azure VPN Gateway with active-active mode still uses the public internet (over IPsec tunnels) and does not provide a dedicated, private connection that bypasses the internet. Option C is wrong because Azure Virtual WAN with a single connection does not inherently provide two active connections for high availability; it relies on underlying ExpressRoute or VPN connections, and a single connection creates a single point of failure.

Full explanation →

793

MCQmedium

A company runs its production database on an Azure SQL Database (PaaS) and its custom application on an Azure virtual machine (IaaS). The company needs to ensure that operating system security patches are applied. According to the shared responsibility model, which resource requires the company to apply OS patches?

A.Azure SQL Database only

B.Azure virtual machine only

C.Both Azure SQL Database and the virtual machine

D.Neither resource requires the company to apply OS patches

AnswerB

Azure virtual machine is an IaaS service. The customer is responsible for managing the guest operating system, including applying security patches, updates, and configuration.

Why this answer

In the shared responsibility model, the customer is responsible for securing the operating system on IaaS resources like Azure virtual machines. Azure SQL Database is a PaaS service where Microsoft manages the underlying OS, including patch management. Therefore, only the Azure virtual machine requires the company to apply OS security patches.

Exam trap

The trap here is that candidates mistakenly assume PaaS services like Azure SQL Database still require customer OS patching, confusing the boundary between customer-managed and provider-managed responsibilities under the shared responsibility model.

How to eliminate wrong answers

Option A is wrong because Azure SQL Database is a PaaS service where Microsoft handles OS patching, so the company does not need to apply OS patches to it. Option C is wrong because it incorrectly assumes the company must patch both resources; in reality, Microsoft manages the OS for Azure SQL Database, leaving only the Azure VM (IaaS) requiring customer-applied OS patches.

Full explanation →

794

MCQmedium

A company has deployed hundreds of virtual machines in Azure across multiple subscriptions. The governance team wants to generate a compliance report that identifies which VMs are using approved VM sizes and which are not, according to a corporate policy. The team must not block the deployment of non-compliant VMs; they only want to track compliance. Which Azure Policy effect should they use in the policy definition?

A.Deny

B.Audit

C.Append

D.DeployIfNotExists

AnswerB

The Audit effect logs a compliance event in the activity log and marks the resource as non-compliant, but does not block deployment. This allows the team to generate a compliance report without interfering with existing deployments.

Why this answer

The Audit effect is the correct choice because it enables the governance team to log non-compliant resources (such as VMs using unapproved sizes) in the Azure Activity Log without blocking their deployment. This effect generates a compliance report while allowing the deployment to proceed, exactly matching the requirement to track compliance without enforcement.

Exam trap

The trap here is that candidates often confuse Audit with Deny, assuming that compliance tracking requires blocking non-compliant resources, but Azure Policy separates auditing (logging) from enforcement (denying) to allow flexible governance scenarios.

How to eliminate wrong answers

Option A is wrong because the Deny effect actively blocks the deployment of non-compliant resources, which contradicts the requirement that the team must not block deployment. Option C is wrong because the Append effect adds additional fields or tags to a resource during creation or update, but it does not generate compliance reports or track non-compliant VMs; it is used to enforce tagging policies, not to audit existing configurations.

Full explanation →

795

MCQmedium

A company has multiple Azure subscriptions for different departments. The governance team needs to ensure that every new subscription is automatically provisioned with a consistent set of resources, including a predefined network topology, mandatory Azure Policy assignments (e.g., allowed locations), and specific role-based access control (RBAC) assignments for the security team. The solution must be repeatable, version-controlled, and allow the team to update the defined artifacts and apply updates to existing subscriptions. Which Azure service should the team use to define and deploy this collection of governance artifacts?

A.Azure Blueprints

B.Azure Policy

C.Azure Management Groups

D.Azure Resource Manager templates

AnswerA

Azure Blueprints enables the orchestrated deployment of a collection of Azure artifacts (policies, role assignments, ARM templates, resource groups) in a versioned, repeatable manner. It is the correct service for defining and applying a consistent governance baseline across subscriptions.

Why this answer

Azure Blueprints is the correct service because it enables the orchestrated deployment of a repeatable set of Azure resources, policies, and RBAC assignments as a single, version-controlled artifact. Unlike Azure Policy alone, Blueprints can include resource templates (e.g., network topology) and RBAC assignments, and it supports updating existing subscriptions by publishing new versions of the blueprint and assigning them to subscriptions.

Exam trap

The trap here is that candidates confuse Azure Policy (which only enforces rules) with Azure Blueprints (which orchestrates the deployment of policies, RBAC, and resources together), or they assume Management Groups can deploy resources when they only provide hierarchical management and policy inheritance.

How to eliminate wrong answers

Option B (Azure Policy) is wrong because Azure Policy only enforces rules and effects on existing resources (e.g., allowed locations) but cannot deploy resources like a predefined network topology or assign RBAC roles; it lacks the ability to orchestrate resource creation. Option C (Azure Management Groups) is wrong because Management Groups provide a hierarchical structure for organizing subscriptions and applying policies or RBAC at scale, but they cannot define or deploy a collection of artifacts like network topologies or version-controlled blueprints; they are a management container, not a deployment tool.

Full explanation →

796

MCQmedium

Which Azure service provides a serverless event routing service that connects event sources to event handlers?

A.Azure Service Bus

B.Azure Event Hubs

C.Azure Event Grid

D.Azure Queue Storage

AnswerC

Event Grid routes events from sources to handlers with filtering, fan-out, and serverless delivery.

Why this answer

Azure Event Grid is a fully managed serverless event routing service that uses a publish-subscribe model to connect event sources (e.g., Azure Blob Storage, resource groups) to event handlers (e.g., Azure Functions, webhooks). It filters and routes events based on event types and subscriptions, enabling reactive programming without polling or custom infrastructure.

Exam trap

The trap here is that candidates confuse event routing (Event Grid) with message queuing (Service Bus) or data streaming (Event Hubs), but Event Grid is specifically designed for serverless, reactive event distribution without polling or managing queues.

How to eliminate wrong answers

Option A is wrong because Azure Service Bus is a message broker for point-to-point or publish-subscribe messaging with queues and topics, not a serverless event routing service; it focuses on reliable message delivery and ordering, not event-driven routing. Option B is wrong because Azure Event Hubs is a big data streaming platform and event ingestion service optimized for high-throughput telemetry ingestion, not for routing events to handlers; it uses consumer groups and partitions for parallel processing. Option D is wrong because Azure Queue Storage is a simple message queuing service for decoupling application components, not a serverless event routing service; it stores messages in a queue and requires polling to retrieve them.

Full explanation →

797

MCQmedium

A company stores critical financial data in Azure Blob Storage. The data must remain available even if an entire Azure region becomes unavailable. Additionally, the company needs the ability to read the data from the secondary region immediately during a regional outage, without waiting for Microsoft to initiate a failover. Which storage redundancy option should the company configure?

A.Locally Redundant Storage (LRS)

B.Geo-Redundant Storage (GRS)

C.Read-Access Geo-Redundant Storage (RA-GRS)

D.Zone-Redundant Storage (ZRS)

AnswerC

RA-GRS replicates data to a secondary region and provides read-only access to the data in the secondary region at all times. This allows the company to continue reading data immediately during a regional outage, meeting both the availability and immediate read access requirements.

Why this answer

Read-Access Geo-Redundant Storage (RA-GRS) is the correct choice because it replicates data to a secondary region (geo-redundancy) and allows immediate read access to that secondary copy during a regional outage, without waiting for Microsoft to initiate a failover. This meets both the availability requirement and the need for instant read access from the secondary region.

Exam trap

The trap here is that candidates often confuse GRS with RA-GRS, assuming that geo-redundancy alone provides immediate read access, but GRS only allows reads after a Microsoft-initiated failover, not instantly during an outage.

How to eliminate wrong answers

Option A is wrong because Locally Redundant Storage (LRS) replicates data only within a single datacenter in a single region, so it cannot survive an entire regional outage. Option B is wrong because Geo-Redundant Storage (GRS) replicates data to a secondary region but does not provide read access to that secondary copy until Microsoft initiates a failover, which violates the requirement for immediate read access during an outage. Option D is wrong because Zone-Redundant Storage (ZRS) replicates data across availability zones within a single region, so it cannot protect against a full regional outage.

Full explanation →

798

MCQmedium

A large enterprise manages Azure subscriptions for three business units: Sales, Research & Development, and Information Technology. Each business unit has its own Azure subscription. The central governance team needs to ensure that a specific set of Azure Policy definitions (e.g., restricting allowed regions to 'East US' only) is applied to all current and future subscriptions belonging to these three business units. The team wants to minimize administrative overhead and ensure that any new subscription created for a business unit automatically inherits the same policies. Which Azure feature should the team use to achieve this goal?

A.Assign each policy definition individually to every subscription.

B.Create a management group for each business unit, place the corresponding subscription inside each management group, and assign the policy set to each management group.

C.Create a single resource group at the tenant root level and assign the policy definitions to that resource group.

D.Use Azure Blueprints to deploy a new subscription with the policies, then manually move each existing subscription into the blueprint's management group.

AnswerB

Management groups allow policy assignment at the group level. Subscriptions inside the group automatically inherit the assigned policies, including future subscriptions placed in that management group. This minimizes administrative overhead.

Why this answer

Option B is correct because management groups provide a hierarchical structure above subscriptions, allowing Azure Policy assignments to be inherited by all subscriptions within a management group. By placing each business unit's subscription into its own management group and assigning the policy set (initiative) to each management group, the central governance team ensures that any current or future subscription under those management groups automatically inherits the policies, minimizing administrative overhead.

Exam trap

The trap here is that candidates often confuse management groups with resource groups or Azure Blueprints, thinking that resource groups can span subscriptions or that Blueprints are required for policy inheritance, when in fact management groups provide the simplest and most scalable inheritance mechanism for policy assignments across multiple subscriptions.

How to eliminate wrong answers

Option A is wrong because assigning each policy definition individually to every subscription creates significant administrative overhead and does not automatically apply policies to future subscriptions, requiring manual re-assignment for each new subscription. Option C is wrong because a resource group at the tenant root level does not exist; Azure Policy assignments can be scoped to management groups, subscriptions, or resource groups, but the tenant root is a management group, not a resource group, and assigning policies to a single resource group would not cover all subscriptions across business units. Option D is wrong because Azure Blueprints can deploy new subscriptions with policies, but manually moving existing subscriptions into a blueprint's management group is not a scalable or automated approach; management groups themselves provide inheritance without the need for blueprint orchestration for this specific goal.

Full explanation →

799

MCQmedium

A company stores sensitive customer transaction records in Azure Blob Storage. The records must be available for read access at all times, even if the primary Azure region becomes unavailable. The company initially configured geo-redundant storage (GRS). During a disaster recovery test, the operations team discovers that although data is replicated to a secondary region, they cannot read the data from the secondary region until a Microsoft-initiated failover occurs. The team needs a solution that provides immediate, continuous read access to the replicated data in the secondary region without waiting for a failover. Which Azure Storage replication option should the company use?

A.Locally-redundant storage (LRS)

B.Zone-redundant storage (ZRS)

C.Geo-redundant storage (GRS)

D.Read-access geo-redundant storage (RA-GRS)

AnswerD

RA-GRS provides the same geo-replication as GRS but additionally enables read access to the secondary region at all times, even before any failover event. This meets the company's need for immediate read availability during a regional outage without operational delay.

Why this answer

RA-GRS extends GRS by enabling read access to the data in the secondary region at all times, without requiring a Microsoft-initiated failover. This ensures that the customer transaction records remain continuously readable from the secondary region, meeting the requirement for immediate read access during a primary region outage.

Exam trap

The trap here is that candidates often confuse GRS with RA-GRS, assuming that geo-replication automatically provides read access to the secondary region, when in fact GRS requires a failover event to enable reads, while RA-GRS explicitly enables continuous read access from the secondary endpoint.

How to eliminate wrong answers

Option A (LRS) is wrong because it replicates data only within a single datacenter, providing no protection against a full region outage. Option B (ZRS) is wrong because it replicates data across availability zones within a single region, not to a secondary region, so it cannot provide read access during a primary region failure. Option C (GRS) is wrong because while it replicates data to a secondary region, it does not allow read access to that data until a Microsoft-initiated failover occurs, failing the requirement for immediate continuous read access.

Full explanation →

800

MCQmedium

A company runs multiple projects in Azure, each project is placed in a separate resource group. The finance team wants to set a monthly spending limit of $10,000 per project and receive automated email alerts when a project's spending reaches 80% of the limit and again when it exceeds the limit. The solution must use native Azure capabilities and be configurable per resource group. Which Azure service should the finance team use?

A.Azure Policy with a built-in policy definition to enforce spending limits

B.Azure Cost Management budgets with alert rules

C.Azure Advisor cost recommendations

D.Azure Resource Graph queries triggered by Azure Automation runbooks on a schedule

AnswerB

Azure Cost Management allows you to create budgets with a defined amount (e.g., $10,000) and set alert thresholds (e.g., 80% and 100%). Alerts can automatically send email notifications to specified recipients. Budgets can be scoped to resource groups, making them suitable for per-project tracking.

Why this answer

Azure Cost Management budgets allow you to set spending limits at the scope of a resource group and configure alert rules that trigger automated email notifications when costs reach a specified threshold (e.g., 80% of the budget) and again when the limit is exceeded. This meets all requirements natively without additional automation or custom scripting.

Exam trap

The trap here is that candidates confuse Azure Policy (which enforces governance rules on resource properties) with Azure Cost Management budgets (which handle financial thresholds and alerts), leading them to select Policy because it sounds like a 'limit' enforcement tool.

How to eliminate wrong answers

Option A is wrong because Azure Policy is used to enforce compliance rules on resource configurations (e.g., allowed locations, SKU sizes), not to set or enforce monetary spending limits; it cannot trigger cost-based alerts. Option C is wrong because Azure Advisor provides cost optimization recommendations (e.g., right-sizing VMs, reserved instances) but does not allow you to set per-resource-group spending limits or send threshold-based alerts. Option D is wrong because Azure Resource Graph queries can retrieve cost data but require custom Azure Automation runbooks and scheduling to implement alerting, which is not a native, built-in capability for budget alerts and adds unnecessary complexity.

Full explanation →

801

MCQmedium

A finance company is migrating a mission-critical trading application to Azure. The application must be resilient to a complete datacenter failure within the same Azure region. The solution should provide low-latency replication between separate physical locations with independent power, cooling, and networking. Which Azure feature should they use?

A.Availability Sets

B.Availability Zones

C.Azure Site Recovery

D.Region Pairs

AnswerB

Availability Zones are unique physical locations within an Azure region, each with its own independent power, cooling, and networking. Deploying resources across multiple zones ensures that if one datacenter experiences a failure, the application continues to run in the other zones with low-latency connectivity.

Why this answer

Availability Zones (B) are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. They provide low-latency replication and protect against a complete datacenter failure by allowing the application to run in multiple zones simultaneously, ensuring high availability and resilience within a single region.

Exam trap

The trap here is that candidates often confuse Availability Zones with Region Pairs, mistakenly thinking that cross-region replication is required for datacenter failure resilience, but the question explicitly specifies 'within the same Azure region' and 'low-latency replication,' which only Availability Zones satisfy.

How to eliminate wrong answers

Option A is wrong because Availability Sets protect against failures within a single datacenter (e.g., rack or update domain failures) but do not provide resilience to a complete datacenter failure, as they operate within one physical location. Option C is wrong because Azure Site Recovery is a disaster recovery service that replicates workloads to a secondary region (not within the same region) and typically involves higher latency and failover time, not low-latency replication between separate physical locations in the same region. Option D is wrong because Region Pairs replicate data between two different Azure regions (e.g., East US and West US) for disaster recovery, not within the same region, and thus do not meet the requirement for low-latency replication within a single region.

Full explanation →

802

MCQmedium

A company operates on-premises servers that they own. They are considering moving to Azure. Which cloud benefit would MOST directly reduce their total cost of ownership?

A.Automatic compliance with all regulations

B.Eliminating hardware purchase and maintenance costs

C.Guaranteed zero downtime for all services

D.Free support for all Azure services

AnswerB

Moving to cloud eliminates CapEx for servers, datacenter space, and hardware refresh cycles — the biggest on-premises cost drivers.

Why this answer

Option B is correct because moving to Azure eliminates the need to purchase, maintain, and eventually replace physical servers, which directly reduces capital expenditure (CapEx) and operational costs related to hardware lifecycle management. This is the most direct way to lower total cost of ownership (TCO) when transitioning from on-premises infrastructure to a public cloud model.

Exam trap

The trap here is that candidates may confuse 'eliminating hardware costs' with other indirect benefits like compliance or support, but the question specifically asks for the MOST direct reduction in TCO, which is the removal of physical hardware purchase and maintenance expenses.

How to eliminate wrong answers

Option A is wrong because Azure does not automatically ensure compliance with all regulations; it provides compliance certifications and tools (e.g., Azure Policy, Compliance Manager), but customers remain responsible for configuring their workloads to meet specific regulatory requirements (shared responsibility model). Option C is wrong because Azure does not guarantee zero downtime for all services; while it offers high-availability SLAs (e.g., 99.99% for certain services), planned maintenance, unplanned outages, and regional failures can still cause downtime, and some services have lower SLAs. Option D is wrong because Azure does not offer free support for all services; basic support is included for billing and subscription management, but technical support requires a paid support plan (e.g., Developer, Standard, Professional Direct).

Full explanation →

803

MCQmedium

Which Azure service provides a way to connect microservices-based applications using patterns like service discovery, circuit breaker, and distributed tracing?

A.Azure API Management

B.Azure Service Fabric

C.Azure Kubernetes Service

D.Azure Logic Apps

AnswerB

Service Fabric provides a platform for building and orchestrating microservices with service discovery, failover, and state management.

Why this answer

Azure Service Fabric is a distributed systems platform that provides built-in support for microservices patterns such as service discovery (via the Naming Service), circuit breaker (through reliable services and actors), and distributed tracing (integrated with Application Insights). It is designed specifically for orchestrating and managing microservices-based applications with these patterns out of the box.

Exam trap

The trap here is that candidates often confuse Azure Kubernetes Service (AKS) as the correct answer because it is commonly associated with microservices, but Service Fabric is the only Azure service that provides these patterns as native, built-in capabilities rather than requiring third-party add-ons.

How to eliminate wrong answers

Option A is wrong because Azure API Management is an API gateway that handles API publishing, security, and rate limiting, but it does not provide native service discovery, circuit breaker, or distributed tracing for microservices communication. Option C is wrong because Azure Kubernetes Service (AKS) is a container orchestration platform that can implement these patterns via add-ons (e.g., Istio, Linkerd), but it does not offer them as built-in, first-class features like Service Fabric does. Option D is wrong because Azure Logic Apps is a serverless workflow integration service for connecting apps and data, not a microservices runtime that supports service discovery or circuit breaker patterns.

Full explanation →

804

Drag & Dropmedium

Arrange the steps to implement Azure Cost Management and set a budget.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

Cost management involves portal access, budget creation, alerts, monitoring, and adjustment.

Full explanation →

805

MCQmedium

Which Azure pricing model allows customers to pay less per hour by committing to a 1-year or 3-year term for Azure services like VMs and SQL Database?

A.Pay-as-you-go

B.Azure Reservations

C.Azure Spot pricing

D.Azure Dev/Test pricing

AnswerB

Azure Reservations offer up to 72% discount for 1 or 3-year commitments on VMs, SQL Database, Cosmos DB, and other services.

Why this answer

Azure Reservations (also known as Reserved Instances) allow customers to commit to a 1-year or 3-year term for specific Azure services, such as VMs and SQL Database, in exchange for a significant discount (up to 72%) on the pay-as-you-go hourly rate. This pricing model is ideal for workloads with predictable usage, as the upfront commitment lowers the per-hour cost compared to on-demand pricing.

Exam trap

The trap here is that candidates often confuse Azure Reservations with Pay-as-you-go, thinking that any discount requires a long-term commitment, but Pay-as-you-go has no commitment and charges the highest per-hour rate, while Reservations specifically require a 1- or 3-year term for the discount.

How to eliminate wrong answers

Option A is wrong because Pay-as-you-go is a flexible pricing model with no upfront commitment, charging per hour or per second at the standard rate, which is higher than reserved pricing. Option C is wrong because Azure Spot pricing offers deep discounts on unused Azure capacity but does not involve a 1-year or 3-year commitment; instead, it can be evicted with short notice when capacity is needed elsewhere. Option D is wrong because Azure Dev/Test pricing provides discounted rates for development and testing workloads, but it does not require a 1-year or 3-year term commitment; it is based on a subscription benefit for non-production environments.

Full explanation →

806

MCQmedium

A company is migrating its on-premises batch processing jobs to Azure. The jobs are triggered by file uploads to an on-premises file share. After migration, the files will be uploaded to Azure Blob Storage. The company wants a solution where code runs automatically whenever a new blob is created, with no requirement to manage servers or containers. The code must process the blob and then terminate. Compute resources should be used only when there is a file to process. Which Azure compute service should the company use?

A.Azure App Service

B.Azure Kubernetes Service (AKS)

C.Azure Functions

D.Azure Virtual Machine Scale Sets

AnswerC

Azure Functions is a serverless compute service that runs code in response to events (e.g., blob creation, HTTP requests, queues) and automatically scales. It charges only for execution time, eliminating idle cost. This matches the need for automatic, triggered processing with no infrastructure management.

Why this answer

Azure Functions is the correct choice because it provides a serverless compute service that can be triggered automatically by Azure Blob Storage events (e.g., new blob creation). The code runs only when a blob is uploaded, processes it, and then terminates, ensuring zero compute cost when idle. No servers or containers need to be managed, aligning perfectly with the requirement for event-driven, ephemeral execution.

Exam trap

The trap here is that candidates may choose Azure App Service (Option A) because they associate it with running code automatically, but fail to recognize that App Service runs continuously and is not designed for event-driven, ephemeral tasks that terminate after processing a single blob.

How to eliminate wrong answers

Option A is wrong because Azure App Service is a platform-as-a-service (PaaS) for hosting web applications and APIs, not designed for event-driven, short-lived tasks triggered by blob uploads; it runs continuously and incurs costs even when idle. Option B is wrong because Azure Kubernetes Service (AKS) is a container orchestration service that requires managing a cluster of virtual machines and containers, contradicting the requirement to avoid managing servers or containers and to use compute resources only when processing files.

Full explanation →

807

MCQmedium

A company is migrating its customer relationship management (CRM) system to a Software as a Service (SaaS) provider. The provider manages the application, runtime, middleware, and infrastructure. The company's IT security team is concerned about who is responsible for protecting the company's data and managing user access. Based on the shared responsibility model for cloud computing, which statement is correct?

A.The SaaS provider is responsible for everything, including data classification and user access control.

B.The company is responsible for the security of the application itself, including patching vulnerabilities in the CRM software.

C.The company is responsible for managing user access and protecting their own data within the SaaS application.

D.The SaaS provider is responsible for physical security of data centers, and the company is responsible for patching the operating system of the servers hosting the CRM.

AnswerC

This is correct. Under the shared responsibility model for SaaS, the customer manages user identities, data classification, and access control. The provider secures the platform and infrastructure, but the customer must ensure only authorized users access the data and that data is handled appropriately.

Why this answer

In the shared responsibility model for SaaS, the provider manages the application, runtime, middleware, and infrastructure, but the customer retains responsibility for securing their own data and managing user access. This includes tasks such as data classification, identity and access management (IAM), and ensuring compliance with internal policies. Option C correctly identifies that the company must handle user access and data protection within the SaaS application.

Exam trap

The trap here is that candidates often assume the SaaS provider handles all security aspects, including data and access, because the provider manages the application, but the shared responsibility model clearly assigns data and access management to the customer.

How to eliminate wrong answers

Option A is wrong because it incorrectly states the SaaS provider is responsible for everything, including data classification and user access control; in reality, the customer retains responsibility for their data and user access. Option B is wrong because it claims the company is responsible for patching vulnerabilities in the CRM software, but in a SaaS model, the provider manages the application and its security patches, not the customer.

Full explanation →

808

MCQmedium

Which Azure service provides network filtering to protect web applications from common exploits like SQL injection and cross-site scripting?

A.Azure Firewall

B.Azure DDoS Protection

C.Network Security Groups (NSG)

D.Azure Web Application Firewall (WAF)

AnswerD

WAF protects web applications from SQL injection, XSS, and other OWASP Top 10 vulnerabilities.

Why this answer

Azure Web Application Firewall (WAF) is specifically designed to inspect and filter HTTP/HTTPS traffic at the application layer (Layer 7). It uses rule sets like the OWASP Core Rule Set to detect and block common web exploits such as SQL injection and cross-site scripting (XSS), making it the correct choice for protecting web applications.

Exam trap

The trap here is that candidates often confuse Azure Firewall (a general network firewall) with Azure WAF (an application-layer firewall), because both have 'firewall' in their name, but they operate at different OSI layers and serve distinct purposes.

How to eliminate wrong answers

Option A is wrong because Azure Firewall is a stateful network firewall that operates at Layers 3-4 (network and transport) and can filter traffic based on IP addresses, ports, and protocols, but it does not inspect application-layer payloads for SQL injection or XSS. Option B is wrong because Azure DDoS Protection mitigates volumetric Distributed Denial-of-Service attacks at Layers 3-4 (and some Layer 7) by absorbing attack traffic, but it does not provide granular web application filtering for exploits like SQL injection. Option C is wrong because Network Security Groups (NSGs) filter traffic based on source/destination IP addresses, ports, and protocols at Layers 3-4, and they lack the application-layer inspection capabilities needed to detect SQL injection or XSS payloads.

Full explanation →

809

MCQeasy

A company needs to ensure that all Azure resources have a mandatory 'CostCenter' tag. If a resource is created without this tag, the resource creation should be blocked. Which Azure Policy effect should they use?

A.Append

B.Deny

C.Audit

D.DeployIfNotExists

AnswerB

Deny prevents the creation of a resource that does not meet the policy condition, effectively blocking it.

Why this answer

The Deny effect is correct because it actively blocks any resource creation or update that does not comply with the policy rule, such as missing the mandatory 'CostCenter' tag. This ensures that non-compliant resources are never provisioned, enforcing governance at the point of creation.

Exam trap

The trap here is that candidates often confuse 'Deny' with 'Append' because both can enforce tags, but Append only adds the tag after creation and does not block the resource if the tag is missing, failing the requirement to block creation entirely.

How to eliminate wrong answers

Option A is wrong because the Append effect adds the missing tag automatically rather than blocking the creation, which does not enforce the requirement that the user must specify the tag. Option C is wrong because the Audit effect only logs non-compliant resources without preventing their creation, allowing untagged resources to exist and requiring manual remediation.

Full explanation →

810

MCQhard

A company wants to synchronize files between multiple on-premises Windows file servers and Azure Blob Storage for backup and centralized access. Which Azure service BEST enables this?

A.Azure Blob Storage with AzCopy

B.Azure File Sync

C.Azure Data Box

D.Azure Storage Explorer

AnswerB

Azure File Sync provides continuous synchronization between on-premises Windows file servers and Azure Files, with cloud tiering for infrequently accessed files.

Why this answer

Azure File Sync is the correct choice because it is specifically designed to synchronize files between on-premises Windows file servers and Azure file shares (not Blob Storage), enabling caching, backup, and centralized access. The scenario requires syncing files from multiple on-premises servers to Azure for backup and centralized access, which Azure File Sync accomplishes by using the Azure File Sync agent to replicate changes to Azure file shares while maintaining file server compatibility.

Exam trap

The trap here is that candidates confuse Azure File Sync (which works with Azure file shares) with Azure Blob Storage tools like AzCopy or Storage Explorer, assuming any Azure storage tool can synchronize files, but only Azure File Sync provides the continuous, multi-server sync and file server integration required for this scenario.

How to eliminate wrong answers

Option A is wrong because AzCopy is a command-line tool for copying data to/from Azure Blob Storage, but it does not provide continuous synchronization or multi-server file server integration; it is a one-time or scheduled copy tool, not a sync service. Option C is wrong because Azure Data Box is a physical data transfer appliance for large-scale offline data migration (typically terabytes to petabytes), not for ongoing synchronization between on-premises file servers and Azure. Option D is wrong because Azure Storage Explorer is a GUI tool for managing storage accounts and performing manual uploads/downloads, but it lacks the automated, bidirectional sync capabilities required for multiple file servers.

Full explanation →

811

Drag & Dropmedium

Sequence the steps to deploy a virtual network (VNet) with subnets in Azure.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

VNet deployment requires portal access, address space, subnets, DNS, and final creation.

Full explanation →

812

MCQmedium

A company wants to ensure that no one can create virtual machines without approval from the IT department. They want to block all VM creation attempts and notify the requester that they need to request access. Which Azure Policy effect should they use?

A.Deny

B.Audit

C.Append

D.Disabled

AnswerA

Deny prevents the resource creation and can display a user-defined error message explaining the approval process.

Why this answer

The Deny effect is correct because it actively prevents the creation of virtual machines by blocking the resource creation request at the Azure Resource Manager level. When a policy with the Deny effect is assigned, any attempt to create a VM that does not meet the policy's conditions is rejected with a 403 (Forbidden) status code, and the requester receives an error message indicating the policy violation and the need to request access. This directly enforces the requirement to block all VM creation attempts without requiring manual intervention.

Exam trap

The trap here is that candidates often confuse the Deny effect with the Audit effect, mistakenly thinking that logging violations is sufficient to block actions, but Azure Policy's Audit effect does not prevent resource creation—it only records the event for later review.

How to eliminate wrong answers

Option B (Audit) is wrong because it only logs the VM creation attempt to the activity log without blocking it, so the VM would still be created, which does not meet the requirement to block all VM creation. Option C (Append) is wrong because it adds additional fields or tags to the resource during creation but does not block the creation itself, so VMs could still be provisioned without approval. Option D (Disabled) is wrong because it means the policy effect is not enforced at all, effectively disabling the policy and allowing VM creation without any restriction or notification.

Full explanation →

813

MCQmedium

A company is designing a disaster recovery solution for an application hosted on Azure VMs. They want to replicate the VMs to a secondary Azure region and automatically failover if the primary region fails. Which Azure service should they use?

A.Azure Site Recovery

B.Azure Backup

C.Azure Traffic Manager

D.Azure Load Balancer

AnswerA

Azure Site Recovery is the dedicated disaster recovery service for Azure VMs.

Why this answer

Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs between regions. It continuously replicates VM disks to the secondary region and, upon a failure, allows you to initiate a planned or unplanned failover with a single click, meeting the stated disaster recovery and automatic failover requirements.

Exam trap

The trap here is that candidates confuse Azure Backup (which protects data) with Azure Site Recovery (which provides full disaster recovery with replication and automated failover), or they mistakenly think Traffic Manager's health-based routing can substitute for actual VM replication and failover orchestration.

How to eliminate wrong answers

Option B is wrong because Azure Backup is designed for long-term data protection and point-in-time recovery (e.g., restoring files, databases, or entire VMs from backup vaults), not for continuous replication and automated failover between regions. Option C is wrong because Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming requests to healthy endpoints based on routing methods (e.g., priority, performance), but it does not replicate VM data or orchestrate failover of the VMs themselves.

Full explanation →

814

MCQeasy

Which of the following is NOT a benefit of moving to the cloud?

A.Reduced time to provision new resources

B.Elimination of internet connectivity requirements

C.Access to a global network of data centers

D.Conversion of capital expenses to operational expenses

AnswerB

Cloud services typically require internet connectivity — this is not a cloud benefit, but rather a dependency.

Why this answer

Moving to the cloud does not eliminate the need for internet connectivity; in fact, cloud services are accessed over the internet or dedicated network connections. Option B is correct because it presents a false benefit—cloud computing still requires network connectivity to reach the provider's endpoints, and without it, resources become inaccessible. The other options are legitimate benefits: faster provisioning, global data center reach, and converting CapEx to OpEx.

Exam trap

The trap here is that candidates confuse 'cloud' with 'offline' or 'self-contained' computing, mistakenly thinking the cloud eliminates the need for a network, when in reality it is entirely dependent on network access to function.

How to eliminate wrong answers

Option A is wrong because reduced time to provision new resources is a real benefit of cloud computing—infrastructure is abstracted and can be spun up via APIs in minutes, compared to weeks for on-premises hardware. Option C is wrong because access to a global network of data centers is a core cloud benefit—providers like Azure operate regions worldwide, enabling low-latency deployment and geo-redundancy. Option D is wrong because converting capital expenses (CapEx) to operational expenses (OpEx) is a key financial advantage of the cloud—you pay for usage rather than upfront hardware costs, shifting from fixed to variable expenditure.

Full explanation →

815

MCQmedium

A company has traditionally managed on-premises servers for their internal business applications. Setting up a new test environment involves ordering hardware, waiting for delivery, racking, and configuring the OS and applications, which typically takes two to three weeks. The company is migrating their development and testing workloads to Azure. Now, developers can deploy a complete, pre-configured test environment using Azure Resource Manager templates in under two hours. This ability to rapidly provision resources and adapt to changing requirements best illustrates which benefit of cloud computing?

A.Scalability

B.Agility

C.High availability

D.Geographic distribution

AnswerB

Correct. Agility is the ability to quickly adapt to changing business requirements by provisioning and deprovisioning resources rapidly. The move from weeks to hours clearly demonstrates agility.

Why this answer

The scenario describes how the company can provision a complete test environment in under two hours using Azure Resource Manager templates, compared to the two-to-three-week on-premises process. This rapid provisioning and ability to quickly adapt to changing requirements is the definition of agility in cloud computing, which focuses on speed, flexibility, and reduced time-to-market for IT resources.

Exam trap

The trap here is that candidates often confuse agility with scalability, but agility specifically measures the speed of resource provisioning and adaptation to change, while scalability measures the capacity to handle growth or load variations.

How to eliminate wrong answers

Option A is wrong because scalability refers to the ability to increase or decrease resources (e.g., compute, storage) to handle varying loads, not the speed of provisioning or adapting to changes. Option C is wrong because high availability ensures that applications remain operational with minimal downtime through redundancy across multiple Azure Availability Zones or regions, which is unrelated to the rapid deployment of test environments described in the question.

Full explanation →

816

MCQmedium

Which Azure networking service enables you to create a hub-and-spoke network topology where multiple VNets are connected and can communicate through a central hub VNet?

A.Azure VPN Gateway

B.Azure VNet Peering

C.Azure Load Balancer

D.Azure Front Door

AnswerB

VNet Peering connects VNets for private communication and enables hub-and-spoke topologies with low-latency, high-bandwidth connectivity.

Why this answer

Azure VNet Peering is the correct service because it directly connects two or more Azure Virtual Networks (VNets) using the Microsoft backbone infrastructure, enabling a hub-and-spoke topology where multiple spoke VNets communicate through a central hub VNet. Unlike VPN-based solutions, VNet Peering provides low-latency, private connectivity without traversing the public internet, and it supports transitive routing only when explicitly configured via a network virtual appliance (NVA) or Azure Route Server in the hub.

Exam trap

The trap here is that candidates often confuse VNet Peering with VPN Gateway, assuming that a VPN connection is required to link VNets, but VNet Peering is the native, higher-performance, and lower-latency solution for connecting VNets within Azure without internet-based encryption overhead.

How to eliminate wrong answers

Option A is wrong because Azure VPN Gateway is a site-to-site or point-to-site VPN service that connects on-premises networks or individual clients to Azure VNets over the public internet using IPsec/IKE protocols; it does not natively create a hub-and-spoke topology between multiple VNets, and it introduces higher latency and bandwidth constraints compared to VNet Peering. Option C is wrong because Azure Load Balancer is a Layer 4 (TCP/UDP) traffic distribution service that balances incoming traffic across backend resources within a single VNet or across peered VNets, but it does not establish network connectivity between VNets or define a hub-and-spoke topology. Option D is wrong because Azure Front Door is a global Layer 7 (HTTP/HTTPS) application delivery and load balancing service that routes traffic based on URL path and latency, operating at the edge; it does not provide VNet-to-VNet connectivity or support hub-and-spoke network topologies.

Full explanation →

817

MCQmedium

Which Azure service provides a managed virtual desktop infrastructure (VDI) solution for deploying Windows desktops and apps from Azure?

A.Azure Virtual Machines

B.Azure Virtual Desktop

C.Azure App Service

D.Azure Remote Desktop Gateway

AnswerB

Azure Virtual Desktop provides managed VDI with Windows multi-session desktops and app delivery from Azure.

Why this answer

Azure Virtual Desktop (AVD) is the correct answer because it is a managed desktop and app virtualization service that runs on Azure, providing a full multi-session Windows 10/11 experience and remote app streaming. Unlike IaaS-based VMs, AVD abstracts the underlying infrastructure, handles brokering, load balancing, and session management, and supports FSLogix profile containers for persistent user data. It uses the Remote Desktop Protocol (RDP) over HTTPS to deliver a secure, scalable VDI solution without needing to manage RDS roles or gateways.

Exam trap

The trap here is that candidates confuse Azure Virtual Machines (IaaS) with Azure Virtual Desktop (managed VDI), mistakenly thinking that simply deploying VMs with RDP access constitutes a full VDI solution, when in fact AVD provides the necessary brokering, scaling, and multi-session capabilities that VMs alone lack.

How to eliminate wrong answers

Option A is wrong because Azure Virtual Machines are IaaS compute instances that require manual configuration of Remote Desktop Services (RDS) roles, load balancers, and gateway components to create a VDI environment, whereas AVD provides a managed PaaS-like VDI service. Option C is wrong because Azure App Service is a PaaS offering for hosting web applications, REST APIs, and mobile backends, not for delivering full Windows desktops or remote apps. Option D is wrong because Azure Remote Desktop Gateway is not a standalone Azure service; it is a role within on-premises RDS that brokers RDP connections, and Azure Virtual Desktop itself includes the gateway functionality as part of its managed service.

Full explanation →

818

MCQmedium

A company is migrating a legacy application to Azure. The application stores data on a network file share that is accessed using the SMB protocol. After migration, multiple Azure virtual machines must be able to mount the same file share simultaneously. The company wants a fully managed service that eliminates the need to maintain a file server. Which Azure storage service should the company use?

A.Azure Files

B.Azure Blob Storage

C.Azure Managed Disks

D.Azure Queue Storage

AnswerA

Correct. Azure Files provides fully managed SMB file shares that can be accessed by multiple VMs concurrently. This aligns with the requirement to avoid managing a file server.

Why this answer

Azure Files provides fully managed file shares that use the SMB protocol, allowing multiple Azure VMs to mount the same share simultaneously. It eliminates the need to maintain a file server because Microsoft handles the underlying infrastructure, patching, and high availability. This makes it the ideal choice for migrating legacy applications that rely on SMB-based network file shares.

Exam trap

The trap here is that candidates confuse Azure Blob Storage with file shares because both are 'storage in the cloud,' but Blob Storage does not natively support SMB protocol or simultaneous multi-VM mounting without additional configuration.

How to eliminate wrong answers

Option B is wrong because Azure Blob Storage is an object storage service that uses REST-based APIs (HTTP/HTTPS), not the SMB protocol, and cannot be mounted as a network file share by multiple VMs simultaneously without additional tools like BlobFuse. Option C is wrong because Azure Managed Disks are block-level storage volumes attached to a single VM; they cannot be simultaneously mounted by multiple VMs and do not provide a file-sharing interface or SMB protocol support.

Full explanation →

819

MCQmedium

What does 'manageability' mean as a benefit of cloud computing?

A.The ability to physically access and repair cloud hardware

B.The ability to manage cloud resources through portal, CLI, APIs, and automated monitoring

C.The right to audit the cloud provider's security practices

D.The guarantee that resources will always be available

AnswerB

Manageability covers how you control and monitor resources — through multiple interfaces and automated capabilities.

Why this answer

Manageability in cloud computing refers to the ability to efficiently administer and control cloud resources through multiple interfaces such as the Azure portal, command-line interface (CLI), APIs, and automated monitoring tools. This allows administrators to deploy, configure, update, and scale resources programmatically or via a web interface without needing physical access to hardware, enabling rapid changes and consistent management across large environments.

Exam trap

The trap here is that candidates confuse manageability with other cloud benefits like reliability or security, mistakenly thinking it involves physical access or uptime guarantees, when it specifically refers to the ease of controlling resources through management interfaces and automation.

How to eliminate wrong answers

Option A is wrong because physical access to cloud hardware is not a customer benefit; it is the cloud provider's responsibility, and customers manage resources virtually, not by physically repairing servers. Option C is wrong because auditing the provider's security practices is a compliance or transparency feature, not a core definition of manageability; manageability focuses on operational control, not audit rights. Option D is wrong because the guarantee of resource availability is a definition of reliability or high availability, not manageability; manageability is about the ease of controlling and administering resources, not their uptime.

Full explanation →

820

MCQmedium

Which Azure networking service allows you to privately access Azure PaaS services from your virtual network using a private IP address?

A.Azure Service Endpoint

B.Azure Private Endpoint

C.Azure NAT Gateway

D.Azure VPN Gateway

AnswerB

Private Endpoint gives Azure PaaS services a private IP from your VNet, keeping traffic on Microsoft's backbone.

Why this answer

Azure Private Endpoint is correct because it assigns a private IP address from your virtual network to an Azure PaaS service (e.g., Azure SQL Database, Storage), enabling secure, private connectivity without traversing the public internet. This uses Azure Private Link to bring the service into your VNet, ensuring traffic stays within the Microsoft backbone network.

Exam trap

The trap here is confusing Azure Service Endpoint with Private Endpoint; candidates often think Service Endpoint provides a private IP, but it only secures traffic to the service’s public endpoint via the Azure backbone, not a private IP address.

How to eliminate wrong answers

Option A is wrong because Azure Service Endpoint extends your VNet identity to the PaaS service over the Microsoft backbone but does not assign a private IP address; the service still uses its public endpoint, and traffic is routed via the service’s public IP. Option C is wrong because Azure NAT Gateway provides outbound internet connectivity for private instances by translating private IPs to a public IP, not inbound private access to PaaS services. Option D is wrong because Azure VPN Gateway connects on-premises networks to Azure via encrypted tunnels (IPsec/IKE) but does not provide private IP-based access to PaaS services from within a VNet.

Full explanation →

821

Drag & Dropmedium

Order the steps to deploy an Azure app service (Web App) with a custom domain.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

Why this order

Deploying a web app requires plan creation, code deployment, DNS configuration, domain binding, and SSL.

Full explanation →

822

MCQmedium

A company has an Azure tenant with a management group hierarchy. The 'Production' management group contains five subscriptions used by the operations team. The IT security team wants to grant the 'Network Contributor' role to a group of network administrators for all subscriptions under the 'Production' management group. The role assignment must automatically apply to any new subscription added under the 'Production' management group in the future. The network administrators already exist as a security group in Azure AD. What is the most efficient way to achieve this?

A.Assign the 'Network Contributor' role at the scope of each existing subscription individually, and remember to assign it to new subscriptions manually.

B.Assign the 'Network Contributor' role to the security group at the 'Production' management group scope.

C.Create an Azure Policy that assigns the 'Network Contributor' role to the security group for all subscriptions under 'Production'.

D.Assign the 'Network Contributor' role to the security group at the root management group scope.

AnswerB

Role assignments at the management group scope are inherited by all subscriptions within that management group. This single assignment covers all current subscriptions and automatically applies to any new subscriptions added under the 'Production' management group, making it the most efficient method.

Why this answer

Assigning the 'Network Contributor' role at the 'Production' management group scope is the most efficient method because management groups provide a hierarchical scope that automatically inherits role assignments to all child subscriptions, including any new subscriptions added in the future. This eliminates the need for manual assignments per subscription and ensures consistent access control across the entire management group hierarchy.

Exam trap

The trap here is that candidates may confuse Azure Policy with Azure RBAC, thinking Policy can assign roles, when in fact Policy only evaluates and enforces compliance rules, while role assignments must be done through Azure RBAC at the appropriate scope.

How to eliminate wrong answers

Option A is wrong because it requires manually assigning the role to each existing subscription individually and does not automatically apply to new subscriptions, which violates the requirement for future subscriptions and is inefficient. Option C is wrong because Azure Policy is used to enforce compliance rules (e.g., auditing or denying configurations), not to assign Azure RBAC roles; role assignments are managed through Azure RBAC, not Azure Policy, and attempting to use Policy for this purpose would be technically incorrect and unsupported.

Full explanation →

823

MCQeasy

What is the difference between the Azure portal and Azure CLI?

A.Azure portal is for production; Azure CLI is only for development

B.Azure portal is a web GUI; Azure CLI is a command-line scripting tool

C.Azure portal only works on Windows; Azure CLI works cross-platform

D.Azure portal manages resources; Azure CLI only deploys applications

AnswerB

Azure portal provides a graphical interface; Azure CLI provides command-line access enabling automation and scripting.

Why this answer

Option B is correct because the Azure portal is a web-based graphical user interface (GUI) for managing Azure resources through a browser, while Azure CLI is a cross-platform command-line tool that allows you to script and automate resource management using commands. Both tools can be used for production and development tasks, and they both manage resources—just through different interaction methods.

Exam trap

The trap here is that candidates often confuse the interface type (GUI vs. CLI) with functional limitations, assuming one is only for development or only for deployment, when in fact both tools provide full management capabilities across all environments.

How to eliminate wrong answers

Option A is wrong because both the Azure portal and Azure CLI are fully supported for production and development workloads; Azure CLI is not limited to development only. Option C is wrong because the Azure portal works on any modern browser regardless of the operating system (Windows, macOS, Linux), and Azure CLI is also cross-platform. Option D is wrong because Azure CLI can manage all Azure resources (create, update, delete, configure), not just deploy applications; both tools provide full resource management capabilities.

Full explanation →

824

MCQmedium

A company needs to run a batch job that processes large amounts of data nightly. The job requires hundreds of VMs for a few hours and then terminates. Which Azure service is BEST suited for this workload?

A.Azure Virtual Machine Scale Sets

B.Azure Batch

C.Azure Functions

D.Azure Container Instances

AnswerB

Azure Batch is designed exactly for large-scale parallel batch workloads with automatic VM pool management.

Why this answer

Azure Batch is designed specifically for large-scale parallel and high-performance computing (HPC) workloads that require hundreds of VMs for a short duration. It automatically provisions, manages, and deallocates the VMs, scaling to the required number of nodes, running the batch job, and then terminating them—matching the nightly processing requirement exactly.

Exam trap

The trap here is that candidates often confuse Azure Virtual Machine Scale Sets with Azure Batch, but Scale Sets only handle VM scaling and not the job scheduling, task distribution, or automatic termination that Batch provides for ephemeral HPC workloads.

How to eliminate wrong answers

Option A is wrong because Azure Virtual Machine Scale Sets provide auto-scaling for VMs but are intended for long-running, stateful applications (e.g., web servers) and lack native job scheduling, task orchestration, and automatic VM termination after job completion. Option C is wrong because Azure Functions is a serverless compute service for event-driven, short-lived tasks (max 10 minutes default, up to 60 minutes on Premium plan) and cannot manage hundreds of VMs or run batch jobs lasting hours. Option D is wrong because Azure Container Instances launches individual containers without orchestration for batch workloads, cannot scale to hundreds of instances automatically, and does not provide job scheduling or automatic VM-level resource management.

Full explanation →

825

MCQmedium

Which Azure networking service provides a private connection from an on-premises network to Azure without using the public internet?

A.Azure VPN Gateway

B.Azure ExpressRoute

C.Azure Virtual Network

D.Azure Bastion

AnswerB

ExpressRoute provides dedicated private connectivity from on-premises to Azure bypassing the public internet.

Why this answer

Azure ExpressRoute is the correct answer because it establishes a dedicated, private connection from an on-premises network directly into Azure, bypassing the public internet entirely. This is achieved through a Layer 3 BGP peering session over a provider-managed circuit, ensuring low latency, higher reliability, and data does not traverse the public internet.

Exam trap

The trap here is that candidates often confuse Azure VPN Gateway with ExpressRoute because both provide site-to-site connectivity, but VPN Gateway uses the public internet while ExpressRoute is a private, dedicated connection.

How to eliminate wrong answers

Option A is wrong because Azure VPN Gateway uses IPSec/IKE tunnels over the public internet to create a site-to-site VPN, which still relies on internet connectivity and is not a private connection. Option C is wrong because Azure Virtual Network is a logically isolated network in Azure that hosts resources, but it does not provide a private connection from on-premises; it requires a gateway or ExpressRoute to extend connectivity. Option D is wrong because Azure Bastion is a PaaS service that provides secure RDP/SSH access to VMs within a VNet over TLS, without exposing public IPs, but it does not connect on-premises networks to Azure.

Full explanation →

Microsoft Azure Fundamentals AZ-900 (AZ-900) — Questions 751–825