Scenario practice questions

Azure Event Hubs for triggering real-time serverless webhooks upon user profile updates.

Why it fails: Event Hubs ingests high-volume telemetry streams for processing, not discrete user-profile change notifications. Profile updates are lightweight discrete events, which Event Grid routes to webhooks via subscriptions. Event Hubs would be correct for continuous telemetry or log ingestion at scale, where throughput and partitioning matter.

Azure Event Grid for streaming continuous IoT sensor telemetry into Azure Databricks.

Why it fails: Event Grid delivers discrete, low-latency notifications to handlers such as Azure Functions; it does not provide the partitioned, high-throughput retention needed for continuous IoT telemetry. Event Hubs is the ingestion service for streaming sensor data into analytics platforms like Databricks, so the pairing reverses the two services' roles.

Azure Notification Hubs

Why it fails: Notification Hubs pushes mobile push notifications to app users across platforms; it does not publish resource-change events to subscribers. It would suit broadcasting alerts to device tokens, but the stem requires discrete reactive event notifications on resource creation or modification, which Event Grid and Event Hubs deliver.

Azure Event Hubs

Why it fails: Azure Event Hubs ingests high-volume telemetry and streaming data through partitions and consumer groups; it does not publish discrete resource-lifecycle notifications. It is tempting because Event Hubs is the correct choice for streaming ingestion pipelines, but the stem requires reactive notifications when resources are created or modified.

Azure Service Bus Queues

Why it fails: Azure Service Bus Queues store messages for competing consumers to pull, providing brokered point-to-point messaging rather than discrete resource-lifecycle event notifications. It is tempting because Service Bus is the correct choice for reliable command and message queuing between applications, not for reacting to resource creation or modification.

Deploy an Azure Service Bus relay across all subscriptions.

Why it fails: Service Bus Relay exposes on-premises services through the cloud; it does not deliver published domain events to multiple subscriber microservices. Relay is tempting for hybrid connectivity, and would be correct when external clients must reach an internal service without a public endpoint, not for cross-subscription event distribution.

Create individual Event Hubs namespaces in every consumer subscription and peer them via ExpressRoute.

Why it fails: Event Hubs is a high-throughput streaming ingestion service, not an event routing fabric; separate namespaces cannot subscribe to a central Order Service's domain events. Event Hubs is tempting for telemetry pipelines, and would be correct for ingesting millions of streaming events for processing rather than event-driven subscription routing.

Use Azure Storage Queues shared via SAS URLs across subscriptions.

Why it fails: Storage Queues provide polling-based message storage, not publish-subscribe event routing to multiple subscribers across subscriptions; Event Grid domains or custom topics with subscriptions deliver that. Queues are tempting for decoupled messaging, and would be correct for point-to-point work distribution rather than fan-out domain events.

Azure Notification Hubs

Why it fails: Notification Hubs pushes broadcast messages to mobile device registrations; it does not ingest or buffer high-rate telemetry streams for analytics. It is tempting because it handles massive device fan-out, and would be correct for sending push notifications to millions of handsets, not for streaming clickstream events into a training pipeline.

Azure Event Grid

Why it fails: Event Grid is a reactive event-routing backbone delivering discrete notifications to subscribers; it lacks the partitioned throughput and retention needed for millions of events per second. It is tempting because it is serverless and event-driven, and would be correct for reacting to resource state changes, not sustained telemetry ingestion.

Azure Service Bus Queues

Why it fails: Service Bus Queues provide brokered messaging with per-message overhead and no native telemetry partitioning, capping throughput well below millions of events per second. It is tempting because it is a durable queue for decoupling application workloads, and would suit reliable command or job distribution rather than high-volume clickstream ingestion.

Exactly one vector field per index

Why it fails: Azure AI Search permits many vector fields per index, each with its own embedding configuration, so a single-field limit is false. The claim tempts because early vector previews supported one field. Multiple vector fields are needed when documents carry several embeddings, for example title and body vectors searched together.

A maximum of two vector fields

Why it fails: Azure AI Search indexes allow far more than two vector fields; the limit is generous and configurable per index, not a fixed pair. Two sounds plausible when a design pairs one content vector with one caption vector. Exceeding two is valid whenever documents require additional embeddings for separate searchable attributes.

Vector fields are not supported in Azure AI Search

Why it fails: Azure AI Search indexes do support vector fields, so this claim contradicts the platform's documented capability and cannot answer the maximum-field question. It tempts candidates who associate vector search solely with dedicated vector databases, yet Azure AI Search is precisely the correct choice when vector search must combine with multi-lingual and faceted search.

Disable the Application Insights telemetry client entirely in production to save bandwidth.

Why it fails: Disabling the telemetry client removes the very error and request data the scenario requires, so failures go unrecorded. It is tempting when bandwidth or ingestion cost is the concern, and disabling telemetry would suit an offline or air-gapped workload where no Application Insights resource exists.

Route all application logs exclusively to local text files on ephemeral container storage.

Why it fails: Ephemeral container storage is destroyed on restart, so logs vanish before troubleshooting and never reach Application Insights. Local file logging is tempting for low-latency debugging on a developer workstation, but the scenario requires centralised, queryable telemetry across instances.

Store plain-text passwords in telemetry custom dimensions.

Why it fails: Custom dimensions are transmitted to Application Insights and readable by anyone with access, so plain-text passwords become a credential leak. Storing secrets in telemetry is tempting for correlating authentication failures, but secrets belong in Azure Key Vault, referenced by identifier rather than logged.

SQL Server connection string

Why it fails: A SQL Server connection string supplies relational data to an indexer's data source, not the model endpoint a vectorizer calls. Integrated vectorization requires the Azure OpenAI resource URI and deployment name (plus key or managed identity). The connection string would be correct when indexing Azure SQL data.

Cosmos DB container database name

Why it fails: A Cosmos DB container database name identifies a data source for an indexer, not the embedding model endpoint. The vectorizer needs the Azure OpenAI service URI and deployment name, authenticated by key or managed identity. Cosmos DB details belong in a data source definition, not vectorizer configuration.

Blob storage SAS token expiration time

Why it fails: A blob storage SAS token expiry governs access to documents in Azure Storage; it has no role in authenticating the vectorizer against an Azure OpenAI deployment. It is tempting because integrated vectorization does read content from blob storage, but the Azure OpenAI connection requires the endpoint and a key or managed identity credential.

Regex Pattern Matching Filters

Why it fails: Service Bus supports SQL, correlation and true/false filters only; regex matching is not a filter type. It is tempting because regex is a familiar pattern-matching tool, and SQL filters do support LIKE-style matching, but that is not regex semantics.

Machine Learning Inference Filters

Why it fails: Service Bus filters evaluate message properties and system properties using SQL, correlation or boolean expressions; no inference engine runs against message content. It is tempting given the AI classification context, but classification must happen in the consuming application, not in subscription filters.

Azure Container Registry storage tiers

Why it fails: Container Registry storage tiers govern image storage cost and performance, exposing no security posture or regulatory compliance score for AI resources. It is tempting because AI workloads often pull container images, so registry configuration feels adjacent to the platform; tier selection is correct when optimising image pull latency or storage spend.

Azure DNS zone editor

Why it fails: A DNS zone editor manages name resolution records and cannot assess security posture or compliance. It is tempting because AI endpoints are reached by hostname, so DNS feels connected to the resource; it is correct when you must create or delegate public and private DNS records for custom domains.

Azure Cost Management for billing forecasts

Why it fails: Cost Management reports spend and forecasts billing; it evaluates neither security controls nor compliance against benchmarks. It is tempting because AI resources are expensive and cost anomalies can signal misuse, so it appears security-adjacent; it is correct when you need budget alerts or chargeback reporting across subscriptions.

Disable all monitoring to reduce cloud resource costs.

Why it fails: Disabling monitoring removes the observability telemetry the standard requires, so security incidents and model drift go undetected. It is tempting as a cost-saving measure, and would be defensible in a sandbox or proof-of-concept subscription where telemetry retention is genuinely unnecessary.

Use shared root passwords for all virtual machines.

Why it fails: Shared root passwords eliminate individual accountability and cannot be rotated or attributed, breaking least privilege and audit requirements. It is tempting because a single credential appears to simplify administration, and centralised identity would be correct — but implemented through Microsoft Entra ID with per-user accounts and role assignments, not shared secrets.

Allow developers to store production database passwords in public README files.

Why it fails: Storing production database passwords in public README files exposes credentials to anyone with repository access, violating secret-management standards. It is tempting because README documentation aids onboarding, and committing non-sensitive configuration or usage examples there is legitimate — but credentials belong in Azure Key Vault with managed identities.

Virtual machine CPU core count assigned to the client application

Why it fails: Client-side VM CPU cores affect how fast the calling application issues queries, not the relevance score Azure AI Search computes server-side. It is tempting because under-provisioned clients do cause timeouts and slow responses, and that factor would be correct when troubleshooting client throughput rather than ranking.

Azure Blob Storage container access tier (Hot vs Cool)

Why it fails: Blob Storage access tier affects retrieval cost and latency for indexed content, not the relevance score computed during hybrid semantic ranking. It is tempting because storage tiering genuinely influences indexing throughput and freshness, and that factor would be correct when diagnosing stale or delayed index content.

Azure Front Door geo-filtering rules blocking all international DNS queries.

Why it fails: Incorrect. Front Door geo-filtering does not resolve VNet private endpoint routing issues.

Local admin passwords on the App Service worker instances.

Why it fails: Incorrect. App Service is a PaaS offering where customers do not manage OS-level local admin passwords.

SQL Database connection strings

Why it fails: SQL connection strings authenticate to Azure SQL Database, not to an Event Grid namespace MQTT broker, which validates MQTT clients through Entra ID tokens or X.509 certificates. Connection strings are tempting because they are a familiar credential format for database access, but they carry no meaning for MQTT broker authentication.

Anonymous access with IP restriction headers

Why it fails: Event Grid namespaces do not honour IP restriction headers as an authentication mechanism; anonymous access bypasses the Entra ID token or X.509 certificate validation the broker requires. IP filtering is tempting as a network control, but it authorises no client identity and is not an authentication method.

OAuth 2.0 client credentials grant via Service Bus endpoints

Why it fails: Service Bus endpoints do not issue tokens for Event Grid namespace MQTT brokers; the OAuth 2.0 client credentials grant must target Microsoft Entra ID, which the broker trusts. Service Bus is tempting because it also brokers messages, but its endpoint cannot authenticate MQTT clients here.

Event Hubs provides native webhook push delivery for serverless triggers without consumer code.

Why it fails: Event Hubs uses a partitioned pull model through consumer groups and the AMQP protocol; consumers must read partitions themselves. It is tempting because Event Grid does push events to webhook endpoints for serverless triggers, but Event Hubs has no native webhook delivery without consumer code.

Event Grid supports AMQP 1.0 session-based strict FIFO message ordering.

Why it fails: Event Grid delivers discrete events via HTTP webhooks and does not implement AMQP 1.0 sessions or strict FIFO ordering; that guarantee belongs to Service Bus queues and topics. It is tempting because Event Grid does route events reliably at scale, but ordering and sessions are Service Bus capabilities.

Exhaustive k-NN search

Why it fails: Exhaustive k-NN runs vector comparison only, scanning the full index without any keyword component, so results cannot be combined with lexical matches. It suits small indexes needing exact nearest neighbours. Hybrid search is required to run vector and keyword queries together and merge them.

Wildcard search

Why it fails: Wildcard search matches terms using * and ? syntax within keyword queries; it performs no vector encoding and cannot combine semantic and keyword result sets. It suits pattern matching on known text. Hybrid search is required to run vector and keyword queries together and merge them with reciprocal rank fusion.

Fuzzy search only

Why it fails: Fuzzy search corrects typos in keyword queries by edit distance; it generates no vector embeddings, so semantic similarity and hybrid fusion are impossible. It fits misspelled-term matching. Hybrid search is needed to execute vector and keyword queries simultaneously and combine their scores.

Providing a managed Kubernetes API control plane

Why it fails: ACR Tasks build, test and patch container images, triggered by source commits or base-image updates. A managed Kubernetes control plane is Azure Kubernetes Service's responsibility. It tempts because both are container services, but ACR Tasks operate on image artefacts, never on cluster control-plane provisioning.

Executing automated container vulnerability scans directly inside registry storage

Why it fails: ACR Tasks build, run and patch container images; they do not scan registry storage for vulnerabilities — that is Microsoft Defender for Containers' role, which surfaces findings in Defender for Cloud. Scanning is tempting because ACR integrates it, but the scan engine sits outside ACR Tasks' execution model.

Running a persistent, multi-node enterprise database cluster inside ACR

Why it fails: ACR Tasks execute short-lived container build and patch workflows; they cannot host a persistent multi-node database cluster, which requires compute infrastructure such as Azure Kubernetes Service or virtual machines. The confusion arises because ACR stores container images, but a registry is not a runtime platform.

Azure Queue Storage

Why it fails: Azure Queue Storage is a simple message queue that requires a producer to enqueue messages. Blob Storage does not automatically enqueue messages when a file is uploaded, so you would need additional code to detect uploads and create queue messages. This introduces polling or custom logic, which is not the serverless, event-driven approach requested.

Azure Service Bus

Why it fails: Azure Service Bus is a message broker that requires an intermediary to send messages to a queue or topic. Blob Storage does not natively publish events to Service Bus, so you would need custom code to detect uploads and send messages, which defeats the serverless and automatic trigger requirement. Service Bus is better suited for enterprise messaging patterns, not direct Blob Storage eventing.

Azure Event Hubs

Why it fails: Azure Event Hubs is designed for high-throughput event streaming and telemetry ingestion. It does not natively integrate with Blob Storage to emit events on file upload; you would need to build a custom producer. Event Hubs is not a push-based trigger for Azure Functions in this context, so it does not meet the requirement of automatic, near real-time processing.

Azure Machine Learning responsible AI dashboard with error analysis.

Why it fails: The responsible AI dashboard provides tools for error analysis, fairness assessment, and interpretability, but it is not designed for continuous monitoring of data drift in production. It is typically used for offline analysis. This option does not meet the requirement of detecting drift and triggering alerts.

Azure Monitor Application Insights with custom telemetry for input data.

Why it fails: Application Insights can collect custom telemetry, but it does not natively compute data drift metrics. You would need to implement custom logic to analyze distributions, which is not a built-in Azure Machine Learning feature. This approach is more manual and does not directly provide drift detection.

Azure Machine Learning model performance monitoring using the model's accuracy metric.

Why it fails: Model performance monitoring tracks metrics like accuracy, but it requires ground truth labels, which are often unavailable in real-time. It does not detect input data distribution drift directly. This feature is for performance degradation, not data drift, so it is not the correct choice.