61 Practice Questions & Answers
You need to design a disaster recovery solution for a mission-critical application currently running on-premises. The RTO is 4 hours and RPO is 1 hour. Which Azure service combination would best meet these requirements?
-
A
Azure Backup with daily snapshots stored in geo-redundant storage
-
B
Manual VM creation in a secondary region with weekly data exports
-
C
Azure Traffic Manager with read-only replicas in multiple regions
-
D
Azure Site Recovery with continuous replication to a secondary region
✓ Correct
Explanation
Azure Site Recovery provides continuous replication enabling RPO of minutes and RTO measured in hours, directly meeting the 1-hour RPO and 4-hour RTO requirements. Other options either lack the necessary recovery speed or replication frequency.
Your organization requires a multi-region deployment where data residency laws mandate that customer data never leaves specific geographic boundaries. Which design approach should you implement?
-
A
Deploy separate Azure subscriptions per region with restricted resource group permissions
-
B
Use Azure Policy to enforce region-locked resource deployments with data sovereignty constraints
✓ Correct
-
C
Configure Azure ExpressRoute private peering between all regions for data transfer
-
D
Implement Azure Front Door for global load balancing with regional failover
Explanation
Azure Policy can enforce deployment restrictions to specific regions and prevent data movement across boundaries, directly addressing data residency and sovereignty requirements. Front Door, ExpressRoute, and multi-subscription approaches don't inherently enforce data residency constraints.
A company needs to migrate 50 TB of data to Azure with minimal downtime. Network bandwidth is limited to 100 Mbps. What is the most appropriate solution?
-
A
Use multiple Azure VPN Gateway connections in parallel for concurrent transfers
-
B
Leverage Azure Data Box for offline bulk data transfer combined with delta sync
✓ Correct
-
C
Implement Azure File Sync to gradually migrate data over several months
-
D
Use Azure ExpressRoute with 1 Gbps dedicated connection for faster data transfer
Explanation
Azure Data Box is specifically designed for large-scale offline data transfers (50 TB fits within a single Data Box device), eliminating network constraints. Delta sync can then handle incremental changes over the limited 100 Mbps connection, minimizing total downtime.
You are designing a solution for a financial services company requiring HIPAA and PCI-DSS compliance. Which Azure services combination provides the strongest security foundation?
-
A
Azure Storage with encryption at rest and shared access signatures for access control
-
B
Azure App Service with managed TLS certificates and network security groups
-
C
Azure SQL Database with Transparent Data Encryption, Always Encrypted, and Azure Private Link
✓ Correct
-
D
Azure Virtual Machines with Windows Defender and standard firewalls
Explanation
Azure SQL Database with Transparent Data Encryption (encryption at rest), Always Encrypted (encryption in use), and Azure Private Link (network isolation) together provide layered security required for HIPAA and PCI-DSS compliance. Other options lack the comprehensive encryption and isolation controls needed for regulated industries.
A startup is launching a new SaaS application and needs to scale from 10 to 10,000 users within 6 months. Which Azure compute option provides the best cost efficiency and automatic scaling?
-
A
Azure Virtual Machine Scale Sets for predictable workload scaling with reserved capacity
-
B
Azure Container Instances for containerized microservices with automatic scaling
-
C
Reserved Azure App Service plans with auto-scale based on CPU metrics
-
D
Azure Functions with consumption-based pricing and automatic concurrent execution handling
✓ Correct
Explanation
Azure Functions with consumption-based pricing automatically scales from minimal to thousands of concurrent executions without pre-provisioned capacity, making it most cost-efficient for unpredictable growth patterns. Reserved instances and Scale Sets require capacity planning that may lead to overprovisioning.
Your organization has adopted a hub-and-spoke network topology in Azure. Which service enables secure, centralized management of internet traffic and DDoS protection across all spokes?
-
A
Azure DDoS Protection Standard with Azure Load Balancer distributing traffic
-
B
Azure Bastion with network security groups and user-defined routes
-
C
Azure Firewall Premium deployed in the hub with forced tunneling to spokes
✓ Correct
-
D
Azure Application Gateway with Web Application Firewall rules per spoke network
Explanation
Azure Firewall Premium in the hub with forced tunneling ensures all spoke traffic passes through a centralized security point, providing unified DDoS protection, threat intelligence, and threat prevention. This is the standard pattern for centralized security in hub-and-spoke architectures.
A company wants to reduce Azure costs for non-production environments that operate on predictable schedules (9 AM–5 PM weekdays only). What is the most cost-effective approach?
-
A
Migrate all non-production workloads to Azure Container Instances with scheduled start/stop
-
B
Use Azure Automation runbooks to deallocate VMs during off-hours combined with spot instances
✓ Correct
-
C
Implement Azure Cost Management budgets with automatic alerting and manual resource cleanup
-
D
Purchase 3-year reserved instances and configure auto-shutdown during off-hours
Explanation
Combining Azure Automation runbooks for scheduled VM deallocation (avoiding compute charges when stopped) with spot instances (up to 90% discount) provides maximum cost savings for predictable, non-production usage patterns. Reserved instances lock in capacity unnecessarily.
You need to design a highly available, globally distributed API that serves customers in Europe, Asia, and North America. Latency must be under 100 ms for 99.9% of requests. Which architecture is most suitable?
-
A
Azure App Service instances in three regions behind Azure Front Door with health probes and automatic failover
✓ Correct
-
B
Azure API Management in one region with Service Fabric microservices deployed globally
-
C
Azure Functions in a single region with Application Insights monitoring for distributed tracing
-
D
Single Azure App Service in a central region with Azure CDN for static content caching
Explanation
Azure Front Door provides global load balancing with sub-100 ms latency by routing requests to the geographically closest region, combined with automatic failover and health probes. Single-region solutions cannot meet the latency requirement across continents.
A healthcare organization requires secure communication between on-premises systems and Azure-hosted applications. They need encryption, authentication, and compliance with HIPAA network requirements. Which connectivity solution is most appropriate?
-
A
Azure ExpressRoute with private peering, providing dedicated, encrypted network connectivity with SLA guarantees
✓ Correct
-
B
Public internet connection with TLS 1.3 encryption and certificate-pinning
-
C
Azure VPN Gateway with site-to-site IPSec tunnels and MFA-enabled access
-
D
Azure Virtual WAN with hub-and-spoke model and encrypted tunnels to on-premises
Explanation
Azure ExpressRoute with private peering provides a dedicated, encrypted, non-internet connection with guaranteed SLA and throughput—essential for HIPAA compliance and sensitive healthcare data. VPN Gateway traverses the public internet, which carries higher compliance risks despite encryption.
You are designing a solution to store and analyze 100 TB of unstructured log data generated daily by IoT devices. The data must be queryable within seconds using SQL-like syntax. What architecture minimizes cost while meeting performance requirements?
-
A
Azure Cosmos DB with unlimited throughput for real-time log ingestion and analysis
-
B
Azure Blob Storage with Azure Data Lake Analytics for on-demand querying
-
C
Azure Synapse Analytics with Polybase connecting to Azure Data Lake Storage Gen2
✓ Correct
-
D
Azure SQL Data Warehouse with continuous data loading from Event Hubs
Explanation
Azure Synapse Analytics with Polybase enables SQL queries directly against data in Data Lake Storage Gen2, eliminating expensive data movement and providing fast query performance at lower cost than fully loading into a data warehouse. Cosmos DB lacks cost-effective bulk analytical capabilities for this volume.
A multi-tenant SaaS application needs to isolate customer data while maintaining a shared infrastructure. Which Azure database design pattern best balances isolation, scalability, and cost?
-
A
Azure SQL elastic pool with separate logical databases per premium customer and RLS for standard customers
✓ Correct
-
B
Azure Cosmos DB with logical partitioning by customer and row-level security
-
C
Single database with row-level security (RLS) policies per customer
-
D
Separate database per customer with cross-tenant analytics database
Explanation
An elastic pool with separate databases for premium customers (strong isolation) and RLS for standard customers (cost efficiency) provides flexible isolation levels based on customer tier while optimizing resource utilization and cost.
Your organization plans to migrate a legacy monolithic application to Azure. The application has strong interdependencies and unpredictable load patterns. Which deployment approach reduces risk?
-
A
Parallel run on-premises and Azure using Azure ExpressRoute until stability is proven
-
B
Big Bang migration using Azure Site Recovery with immediate cutover to Azure
-
C
Rewrite the application as microservices on Azure Kubernetes Service (AKS) before cutover
-
D
Phased migration using Azure App Service slots with traffic shifting and gradual validation
✓ Correct
Explanation
Phased migration with traffic shifting allows gradual validation, rollback capability, and reduced blast radius for issues. Big Bang cutover risks full outages; rewriting adds project risk; parallel operations add cost and complexity without reducing migration risk.
An enterprise requires that all Azure resources in production adhere to specific naming conventions, tagging schemas, and resource types. Which Azure feature enforces these organizational standards automatically?
-
A
Azure Advisor recommendations for identifying non-compliant resources post-deployment
-
B
Azure Blueprints for defining reusable sets of approved Azure resources
-
C
Azure Policy with deny effects to prevent non-compliant resource creation and remediation tasks
✓ Correct
-
D
Azure Resource Manager templates with hardcoded naming conventions and parameters
Explanation
Azure Policy with deny effects prevents creation of non-compliant resources before they are provisioned, enforcing organizational standards automatically. Templates and Blueprints are design tools; Advisor only provides recommendations without enforcement.
You need to design a disaster recovery solution where the standby environment must be in a different Azure region and automatically activate when the primary region experiences an outage. Which service provides automatic failover with minimal intervention?
-
A
Azure Site Recovery with replication and automatic failover policies configured
✓ Correct
-
B
Azure Front Door with weighted routing and automatic backend health checks
-
C
Azure Traffic Manager with priority-based routing and manual failover triggering
-
D
Azure Load Balancer with cross-region failover and connection draining
Explanation
Azure Site Recovery automates the entire failover process including VM startup, network configuration, and DNS updates without manual intervention. Traffic Manager and Front Door require manual or application-level failover triggers; Load Balancer operates only within a region.
A company processes sensitive Personal Identifiable Information (PII) and requires cryptographic keys to be hardware-protected, rotated automatically, and never exported. Which Azure service is specifically designed for these requirements?
-
A
Azure App Configuration for centralized key storage with managed identity access
-
B
Azure Key Vault with soft delete and purge protection for key management
-
C
Azure Storage encryption with customer-managed keys stored in Azure Key Vault
-
D
Azure Dedicated HSM with FIPS 140-2 Level 3 compliance and automatic key rotation
✓ Correct
Explanation
Azure Dedicated HSM provides hardware-protected, FIPS 140-2 Level 3 certified key storage with automatic rotation and non-exportable keys. Key Vault is software-based; App Configuration is for application settings; Storage encryption uses Key Vault as a backend but doesn't guarantee hardware protection.
You are designing a solution for real-time customer sentiment analysis from social media feeds. The system must ingest millions of events per second, process them in real-time, and store results for historical analysis. Which Azure services architecture is optimal?
-
A
IoT Hub for ingestion, Azure Functions for processing, and Cosmos DB for result storage
-
B
Event Hubs for ingestion, Stream Analytics for real-time processing, Data Lake Storage for historical storage
✓ Correct
-
C
Application Insights for collection, custom processing service on App Service, and Blob Storage for archival
-
D
Azure Service Bus with Topic subscriptions, Logic Apps for processing, and SQL Database for results
Explanation
Event Hubs handles millions of events/second ingestion at scale, Stream Analytics provides real-time processing without managing infrastructure, and Data Lake Storage provides cost-effective historical storage. Other combinations lack the throughput or processing capabilities needed for this scale.
A financial institution needs to implement role-based access control (RBAC) where a developer can deploy infrastructure changes only to non-production environments. Which Azure feature enables this at scale?
-
A
Azure RBAC custom roles scoped to resource groups combined with Azure Policy to restrict resource types per environment
-
B
Azure AD conditional access policies blocking prod region deployments for developer accounts
-
C
Azure subscription-level permissions with separate subscriptions for prod and non-prod
-
D
Management group-level role assignments with deny assignments on production subscriptions
✓ Correct
Explanation
Management groups enable hierarchy-based RBAC where deny assignments on production subscriptions override any allow assignments, preventing accidental prod access. Combined with custom roles scoped to non-prod groups, this provides enterprise-scale environment separation with explicit deny enforcement.
Your organization runs batch jobs that process large datasets nightly. The jobs require high computational power but run only 2–3 hours per day. Which Azure compute option minimizes cost for this workload?
-
A
Batch pools with low-priority VMs that scale down after job completion
✓ Correct
-
B
Dedicated Kubernetes nodes with resource quotas and manual scaling
-
C
App Service with always-on configuration and scheduled scaling rules
-
D
Always-on Virtual Machines with reserved instances
Explanation
Azure Batch with low-priority VMs (up to 80% discount) that auto-scale to zero after job completion provides the lowest cost for intermittent, batch-oriented workloads. Reserved instances lock in cost unnecessarily; App Service doesn't scale to zero economically.
You need to design a solution where Azure resources automatically remediate non-compliance issues (e.g., adding missing tags, enabling encryption). Which Azure service automates this remediation at scale?
-
A
Azure Policy with remediation tasks and managed identity permissions to modify resources
✓ Correct
-
B
Azure Automation runbooks triggered by non-compliance alerts from Azure Security Center
-
C
Azure Blueprints with periodic re-deployment to enforce desired state
-
D
Azure DevOps pipelines with custom scripts to audit and fix resource configurations
Explanation
Azure Policy remediation tasks automatically correct non-compliant resources using managed identities for permissions, providing scalable, policy-driven remediation without manual intervention or runbook management.
A company wants to implement network segmentation where a web tier can communicate with an app tier, but the app tier cannot initiate communication with the web tier. Which Azure networking feature enforces this asymmetric access pattern?
-
A
Virtual network service endpoints restricting app tier resources to web tier access only
-
B
Azure Firewall with network rules enforcing unidirectional traffic based on source, destination, and port
✓ Correct
-
C
Application security groups with tag-based filtering and application-level gateways
-
D
Network security groups with stateful rules allowing only web-to-app direction and blocking app-to-web
Explanation
Azure Firewall rules can enforce directional traffic policies where the web tier initiates to the app tier, but return traffic doesn't allow reverse initiation. NSGs are stateful (allowing bidirectional return traffic after initial connection); service endpoints and ASGs lack this directional enforcement capability.
You need to deploy a containerized application across multiple Azure regions with automatic updates, self-healing, and consistent state. Which Kubernetes-based approach is most suitable for this enterprise scenario?
-
A
Azure Kubernetes Service (AKS) with Azure Container Registry, GitOps CD pipeline, and cluster auto-scaler
✓ Correct
-
B
Azure Container Instances for stateless workloads with Azure Logic Apps for orchestration
-
C
Virtual Machine Scale Sets with custom container runtimes and load balancer failover
-
D
App Service container deployments with custom scaling rules and regional replication
Explanation
AKS with GitOps provides declarative deployments, automatic self-healing through pod restart policies, multi-region replication, and Azure-native integration. Other options lack Kubernetes orchestration capabilities or scale appropriately for enterprise multi-region scenarios.
An organization requires network traffic inspection between Azure virtual networks to detect and block malicious patterns. Which solution provides deep packet inspection without significant latency?
-
A
Network security groups with application rules and user-defined routes to third-party NVAs
-
B
Azure Firewall Premium with intrusion detection/prevention system (IDS/IPS) and threat intelligence filtering
✓ Correct
-
C
Azure DDoS Protection Standard with layer 7 attack detection and automatic mitigation
-
D
Network Watcher packet capture with third-party SIEM analysis and manual rule updates
Explanation
Azure Firewall Premium integrates IDS/IPS, threat intelligence, and deep packet inspection with minimal latency for inter-vnet traffic. Network Watcher is post-facto analysis; DDoS Protection focuses on volumetric attacks; NSGs lack deep packet inspection capabilities.
You are designing an Azure landing zone for a large enterprise with multiple business units, each requiring isolated subscription governance. Which management structure best supports this?
-
A
Multiple resource groups in a single subscription with custom role definitions and network isolation
-
B
Single subscription with resource groups per business unit and RBAC at resource group level
-
C
Separate tenants per business unit with Azure Lighthouse for cross-tenant management
-
D
Management groups with subscriptions per business unit, Azure Policy inheritance, and centralized billing and governance
✓ Correct
Explanation
Management groups provide hierarchical governance where policies cascade to subscriptions and resource groups, enabling per-business-unit isolation while maintaining centralized control. Single subscription and resource groups lack true isolation; multiple tenants add operational complexity.
A media company streams video content globally and needs to cache content at the edge while protecting the origin server from direct access. Which Azure service combination achieves this?
-
A
Azure CDN with origin masking and access restrictions to the origin resource using private endpoints
-
B
Application Gateway with multi-region backends and geo-replication across blob storage accounts
-
C
Azure Traffic Manager routing to regional cache servers with DDoS protection on origin
-
D
Azure Front Door Premium with origin authentication and Web Application Firewall blocking direct origin access
✓ Correct
Explanation
Azure Front Door Premium provides edge caching, origin masking, origin authentication (ensuring requests only come from Front Door), and WAF rules blocking direct origin access. Azure CDN has cache capabilities but lacks the origin protection mechanisms of Front Door Premium.
Your organization has workloads spanning on-premises, Azure, and AWS. You need a consistent governance framework for compliance and cost management across all clouds. Which Azure approach enables this?
-
A
Azure Management Groups with custom policies for on-premises and AWS resource tagging
-
B
Azure Lighthouse for delegated resource management of external cloud environments
-
C
Azure Arc for unified management of hybrid and multi-cloud resources with Azure Policy and Cost Management integration
✓ Correct
-
D
Azure Migrate for discovering and assessing resources across cloud providers
Explanation
Azure Arc extends Azure management, governance, and security to on-premises, AWS, and GCP resources, enabling unified Azure Policy enforcement and cost analysis across clouds. Lighthouse is for delegated access; Migrate is for discovery; Management Groups operate only within Azure.
You need to ensure that all Azure VMs in production have endpoint protection installed and that non-compliant VMs are automatically quarantined from the network. Which Azure service combination enforces this?
-
A
Windows Defender Advanced Threat Protection with manual isolation of detected threats
-
B
Azure Defender for Cloud with security recommendations and manual remediation playbooks
-
C
Azure Security Center vulnerability assessments with email notifications to security teams
-
D
Azure Policy with DeployIfNotExists effect to install extensions, combined with NSG rules triggered by Azure Automation for non-compliance
✓ Correct
Explanation
Azure Policy with DeployIfNotExists automatically installs required extensions, while automated remediation tasks using Azure Automation can modify NSG rules to quarantine non-compliant VMs. Defender for Cloud provides visibility but requires manual action; Security Center is detection-focused.
Your organization needs to design a multi-region Azure infrastructure for a mission-critical application. Which Azure service should you use to manage traffic distribution across regions with automatic failover capabilities?
-
A
Azure Load Balancer
-
B
Azure Traffic Manager
-
C
Azure Application Gateway
-
D
Azure Front Door
✓ Correct
Explanation
Azure Front Door provides global load balancing with Layer 7 capabilities and automatic failover across regions, making it ideal for mission-critical multi-region deployments. Traffic Manager works at Layer 3/4 but Front Door offers superior performance and advanced routing.
You are designing a storage solution for a company that requires immediate access to hot data and archive access for cold data older than 90 days. What is the most cost-effective storage tier strategy?
-
A
Use Blob Storage with fixed retention policies
-
B
Use only Hot tier for all data
-
C
Use Hot tier for recent data and transition to Archive tier after 90 days using lifecycle management
✓ Correct
-
D
Use Cool tier for all data with manual archival
Explanation
Azure Storage lifecycle management policies automatically transition blobs between tiers based on age, reducing costs by moving infrequently accessed data to cheaper Archive tier while maintaining quick access to recent data in Hot tier.
A healthcare organization must ensure patient data complies with HIPAA and maintain data residency within the United States. Which Azure deployment approach best addresses these requirements?
-
A
Use Azure public regions only
-
B
Deploy exclusively in Azure Government regions
✓ Correct
-
C
Use Azure Dedicated Hosts in any US region
-
D
Deploy in Azure Stack
Explanation
Azure Government provides HIPAA compliance certifications and ensures data residency within the US boundaries, meeting both regulatory and data sovereignty requirements for healthcare organizations.
You need to design a virtual network architecture where on-premises users require secure, encrypted access to Azure resources without using VPN. What solution should you implement?
-
A
Azure Bastion host configuration
-
B
Azure ExpressRoute with encryption
✓ Correct
-
C
Site-to-Site VPN connection
-
D
Point-to-Site VPN connection
Explanation
Azure ExpressRoute provides dedicated private connectivity to Azure resources with built-in encryption options, eliminating the need for VPN tunnels while maintaining security and performance for on-premises to Azure communications.
Your application requires a database with strong transactional consistency and ACID compliance for financial transactions. Which Azure database service is most appropriate?
-
A
Azure Table Storage
-
B
Azure Database for PostgreSQL
-
C
Azure SQL Database with single-region deployment
✓ Correct
-
D
Azure Cosmos DB
Explanation
Azure SQL Database with single-region deployment provides full ACID transactional guarantees needed for financial applications, whereas Cosmos DB trades some consistency for global distribution.
A company wants to modernize legacy applications without code changes using containers. What Azure service should they use for easy container orchestration with minimal management overhead?
-
A
Azure App Service with built-in container support and managed patches
✓ Correct
-
B
Azure Container Instances with manual container management
-
C
Azure Kubernetes Service (AKS) with full cluster management
-
D
Azure Virtual Machines with Docker runtime
Explanation
Azure App Service provides simplified container deployment with automatic scaling, patching, and minimal operational overhead compared to AKS, making it ideal for legacy application modernization without code changes.
You are designing a disaster recovery solution where RPO must be less than 15 minutes and RTO less than 1 hour. Which replication strategy should you recommend?
-
A
Manual backup copies stored in geographically distant locations
-
B
Daily backup snapshots with restore procedures
-
C
Synchronous replication with automated failover capabilities and continuous replication
✓ Correct
-
D
Asynchronous replication to a secondary region with manual failover
Explanation
Synchronous replication with automated failover ensures near-zero RPO (less than 15 minutes) and automatic RTO management within 1 hour, meeting strict recovery objectives better than asynchronous or manual approaches.
An organization needs to grant developers temporary elevated access to production resources for debugging. What Azure feature should be implemented?
-
A
Direct subscription owner role assignment
-
B
Azure AD Privileged Identity Management (PIM) with time-bound activation
✓ Correct
-
C
Permanent Admin role assignment
-
D
Shared administrator credentials in Key Vault
Explanation
Azure AD Privileged Identity Management provides just-in-time access with time-bound elevation, audit trails, and approval workflows, ensuring secure temporary access without permanent elevated permissions.
You need to design a highly available web application across multiple availability zones. What is the minimum number of instances required in each zone for fault tolerance?
-
A
Five instances for production workloads
-
B
Three instances spread across all zones
-
C
One instance per zone with load balancing
-
D
Two instances per zone minimum to handle zone failures
✓ Correct
Explanation
Two instances per zone provides redundancy within the zone while allowing continued service during single instance failures, with load balancing distributing traffic across zones for true high availability.
A company wants to implement infrastructure-as-code for consistent Azure deployments across multiple environments. Which tool is natively integrated with Azure and recommended for this purpose?
-
A
CloudFormation templates
-
B
Ansible playbooks exclusively
-
C
Terraform only
-
D
Azure Resource Manager (ARM) templates and Bicep
✓ Correct
Explanation
Azure Resource Manager templates and Bicep are Microsoft's native infrastructure-as-code solutions with deep Azure integration, superior tooling, and native support for all Azure resources compared to third-party alternatives.
You need to secure sensitive data stored in Azure Storage. What combination of controls provides defense-in-depth?
-
A
Encryption at rest, encryption in transit, network security groups, and managed identities
✓ Correct
-
B
Only encryption at rest with storage account keys
-
C
Public access with strong passwords
-
D
Firewall rules with shared access signatures only
Explanation
Defense-in-depth requires multiple security layers: encryption at rest (Storage Service Encryption), encryption in transit (HTTPS/TLS), network isolation (NSGs), and authentication (managed identities), providing comprehensive data protection.
An application requires automatic scaling based on custom metrics. Which Azure service should be used alongside your compute resources?
-
A
Azure Monitor with autoscale rules
✓ Correct
-
B
Azure Application Insights only
-
C
Manual scaling with scheduled tasks
-
D
Azure Service Bus
Explanation
Azure Monitor's autoscale feature supports both built-in and custom metrics, allowing dynamic scaling based on application-specific indicators rather than standard CPU or memory metrics alone.
Your organization is designing a network for PCI-DSS compliance. Which network isolation approach is most appropriate?
-
A
Public endpoints with IP whitelisting
-
B
Single virtual network with all resources
-
C
Separate subnets with Network Security Groups, private endpoints, and service endpoints enforcement
✓ Correct
-
D
Multiple peered networks without traffic filtering
Explanation
PCI-DSS requires network segmentation achieved through separate subnets, NSG-based traffic filtering, and private connectivity via endpoints, preventing unauthorized access to cardholder data.
A startup needs a cost-effective database solution with NoSQL capabilities and global distribution. What should you recommend?
-
A
Multiple separate MongoDB instances per region
-
B
Azure Synapse Analytics
-
C
Azure Cosmos DB with multi-region writes
✓ Correct
-
D
Azure SQL Database with geo-replication
Explanation
Azure Cosmos DB provides NoSQL capabilities with built-in multi-region distribution, automatic failover, and single-digit millisecond latency globally, making it cost-effective for distributed startups.
You are designing a solution where Azure services need to communicate securely without traversing the public internet. What should you implement?
-
A
Open firewalls between services
-
B
Standard Azure services with public endpoints
-
C
Service endpoints and private endpoints for network isolation
✓ Correct
-
D
VPN tunnels between every service pair
Explanation
Service endpoints and private endpoints restrict Azure service access to private networks, ensuring service-to-service communication never traverses the public internet while avoiding VPN overhead.
An organization requires detailed compliance auditing and regulatory reporting. Which Azure feature provides this capability?
-
A
Azure Blueprints for resource grouping
-
B
Manual documentation and spreadsheets
-
C
Azure Policy for compliance enforcement
-
D
Azure Compliance Manager and Service Trust Portal
✓ Correct
Explanation
Azure Compliance Manager and the Service Trust Portal provide comprehensive compliance assessments, audit trails, and regulatory reporting specific to frameworks like HIPAA, PCI-DSS, and GDPR.
You need to design an application architecture that minimizes latency for global users. Which approach is recommended?
-
A
All resources in the region closest to headquarters
-
B
Primary-secondary passive replication model
-
C
Multi-region active-active deployment with Azure Front Door for routing
✓ Correct
-
D
Single region deployment with CDN
Explanation
Multi-region active-active deployment with Azure Front Door routes users to the nearest healthy region in real-time, minimizing latency globally while providing automatic failover capabilities.
A company wants to implement centralized logging for all Azure resources. What is the most comprehensive approach?
-
A
Enable Azure Storage logging for each service individually
-
B
Configure Azure Monitor Log Analytics workspace with data collection rules
✓ Correct
-
C
Store logs in separate storage accounts per resource
-
D
Use application-level logging only
Explanation
Azure Monitor's Log Analytics workspace provides centralized collection, retention, and analysis of logs from all Azure resources through unified data collection rules and KQL queries.
You need to migrate a large on-premises database to Azure while minimizing downtime. What Azure service provides this capability?
-
A
Azure Database Migration Service with online replication
✓ Correct
-
B
Simple blob storage import
-
C
Azure Site Recovery for databases
-
D
Manual backup and restore process
Explanation
Azure Database Migration Service supports online migrations with minimal downtime through continuous data replication, allowing switchover after validation without extended outages.
An organization wants to enforce consistent naming and tagging standards across all Azure resources. What should be implemented?
-
A
Resource group naming limitations only
-
B
Verbal communication to development teams
-
C
Azure Policy with custom definitions for naming and tagging enforcement
✓ Correct
-
D
Manual spreadsheet documentation
Explanation
Azure Policy with custom definitions enforces organizational standards automatically, preventing non-compliant resources from being created and ensuring consistent governance across subscriptions.
You are designing a solution where applications need to process large amounts of streaming data in real-time. Which Azure service is most appropriate?
-
A
Azure Queue Storage with batch processing
-
B
Azure SQL Database with frequent polling
-
C
Azure Event Hubs for ingestion with Stream Analytics for processing
✓ Correct
-
D
Azure Storage Blobs
Explanation
Azure Event Hubs provides scalable event ingestion with support for millions of events per second, while Stream Analytics provides real-time processing with SQL-like query capabilities.
A company requires their application to maintain state across distributed instances without reliance on local storage. What caching solution should you recommend?
-
A
Application server session management
-
B
Browser-based session storage
-
C
Azure Cache for Redis with appropriate expiration policies
✓ Correct
-
D
Local file system storage on VMs
Explanation
Azure Cache for Redis provides distributed, in-memory caching with sub-millisecond latency and automatic failover, allowing stateless applications to share session data across instances.
You need to design a backup strategy for Azure VMs with different recovery requirements. Which approach provides the most flexibility?
-
A
Azure Backup with multiple vault policies and recovery point objectives
✓ Correct
-
B
Manual snapshot creation weekly
-
C
Single backup vault for all VMs
-
D
Storage account-only backup strategy
Explanation
Azure Backup allows configurable backup policies per resource with granular RPO settings, point-in-time restore, and cross-region backup, providing flexible recovery options for different requirements.
An organization is designing a solution for processing batch jobs that can tolerate interruption. What cost-effective compute option should be used?
-
A
Azure Batch with low-priority VMs and spot instances
✓ Correct
-
B
Premium dedicated VMs at all times
-
C
Reserved Instances for guaranteed availability
-
D
App Service with continuous operation
Explanation
Azure Batch with low-priority and spot instances provides significant cost savings for interruptible workloads, offering 70-90% discounts compared to on-demand pricing while maintaining throughput through automatic retries.
You need to implement role-based access control (RBAC) for an application deployed on Azure. What is the recommended approach?
-
A
Use Azure AD groups with custom Azure roles assigned at appropriate scopes
✓ Correct
-
B
Assign all users the Owner role
-
C
Create individual role assignments for each user manually
-
D
Store access credentials in application configuration files
Explanation
Azure AD groups with custom roles assigned at resource group or subscription scopes provides scalable, maintainable RBAC by leveraging group membership for policy inheritance and least-privilege access.
You need to design a disaster recovery solution for a mission-critical application currently running on-premises. The application requires RPO of 15 minutes and RTO of 1 hour. Which Azure service combination would best meet these requirements?
-
A
Azure Backup with daily snapshots and manual failover
-
B
Azure Site Recovery with continuous replication and automated failover
✓ Correct
-
C
Azure Storage geo-redundant storage (GRS) only
-
D
Azure Traffic Manager with read-only replicas
Explanation
Azure Site Recovery provides continuous or frequent replication (meeting 15-minute RPO) and supports automated failover (meeting 1-hour RTO), making it ideal for mission-critical DR scenarios. Daily backups cannot guarantee 15-minute RPO.
Your organization requires a hub-and-spoke network topology in Azure with centralized security controls. Traffic between spokes must pass through the hub. What is the primary architectural component you would deploy in the hub?
-
A
Azure Load Balancer
-
B
Network Security Group rules only
-
C
Azure Firewall
✓ Correct
-
D
Application Gateway
Explanation
Azure Firewall in the hub VNet provides centralized security filtering and allows you to control traffic between spoke networks through forced tunneling, enforcing a hub-and-spoke security model.
You are designing storage for a healthcare application that must comply with HIPAA. The application processes patient data that must be encrypted both in transit and at rest, with audit logging for all data access. Which combination of Azure services addresses all requirements?
-
A
Azure SQL Database with Transparent Data Encryption, SSL/TLS, and Azure SQL Auditing
✓ Correct
-
B
Azure Files with SMB encryption and access logs to Log Analytics
-
C
Azure Key Vault with managed keys and diagnostic logs
-
D
Azure Blob Storage with automatic encryption, HTTPS, and Storage Analytics logging
Explanation
Azure SQL Database provides Transparent Data Encryption (TDE) for data at rest, enforces SSL/TLS for data in transit, and includes comprehensive SQL Auditing capabilities specifically designed for compliance requirements like HIPAA.
An organization is migrating 500 VMs from on-premises to Azure. You need to minimize migration costs while maintaining application availability during the cutover. Which approach is most appropriate?
-
A
Database replication only, leaving compute infrastructure on-premises
-
B
Immediate shutdown of on-premises VMs and restoration from backup
-
C
Manual VM creation in Azure followed by application reinstallation
-
D
Azure Migrate using lift-and-shift with parallel running of on-premises and Azure workloads until validation
✓ Correct
Explanation
Azure Migrate with lift-and-shift replication enables parallel running for validation before cutover, minimizing downtime and risk while managing costs through phased migration. This approach allows for application testing in Azure before decommissioning on-premises resources.
You need to design a multi-region application architecture where users are distributed globally. The application must route users to the nearest region with sub-100ms latency and automatically failover if a region becomes unavailable. Which Azure service should be the primary component?
-
A
Azure Traffic Manager with geographic routing and health monitoring
-
B
Azure Front Door with latency-based routing
✓ Correct
-
C
Azure Load Balancer with availability zones
-
D
Azure Application Gateway across regions
Explanation
Azure Front Door provides sub-100ms latency-based routing globally and built-in automatic failover capabilities, making it ideal for globally distributed applications requiring low-latency user experience and high availability.
Your organization wants to implement a serverless architecture for an event-driven workload with unpredictable scaling needs. The solution must process events from multiple sources and integrate with existing enterprise systems. What is the recommended core service?
-
A
Azure Container Instances only
-
B
Azure Functions with Event Grid and Logic Apps
✓ Correct
-
C
Azure Service Fabric
-
D
Azure App Service with autoscaling
Explanation
Azure Functions provides serverless compute that scales automatically, Event Grid handles event routing from multiple sources, and Logic Apps enables integration with enterprise systems—together they form a complete serverless event-driven solution.
You are designing a database solution for an application with unpredictable query patterns and potential for sudden traffic spikes. The data model is document-based with varying schemas. Which database service best fits these requirements?
-
A
Azure Database for PostgreSQL with read replicas
-
B
Azure Cosmos DB with autoscale throughput
✓ Correct
-
C
Azure SQL Database with elastic pools
-
D
Azure SQL Managed Instance
Explanation
Azure Cosmos DB supports flexible document schemas, provides autoscaling for unpredictable workloads, and delivers global distribution with millisecond latencies—ideal for applications with variable query patterns and traffic spikes.
An enterprise requires isolation of billing and resource management across 50 business units while maintaining centralized governance and policy enforcement. Which Azure organizational structure is most appropriate?
-
A
Single subscription with resource groups for each business unit
-
B
Multiple tenants with separate Azure AD instances
-
C
Single management group with no additional organization
-
D
One subscription per business unit with a management group hierarchy and Azure Policy for governance
✓ Correct
Explanation
Multiple subscriptions organized under management groups enable separate billing per business unit while Azure Policy applied at the management group level provides centralized governance and policy enforcement across all subscriptions.
You need to implement a solution that monitors application performance across multiple Azure regions and automatically scales compute resources based on custom metrics. What combination of services should you use?
-
A
Azure Advisor with scheduled scaling
-
B
Application Insights for monitoring and standard autoscale rules only
-
C
Log Analytics with manual scaling triggers
-
D
Azure Monitor with Application Insights and custom autoscale based on Application Insights metrics
✓ Correct
Explanation
Application Insights collects application performance data across regions, Azure Monitor enables custom metric analysis, and autoscale rules can leverage Application Insights metrics to automatically scale resources based on application-specific performance indicators.
A regulatory requirement mandates that all data must remain within a specific geographic region and cannot be replicated outside it. You need to design a highly available solution within a single region. Which approach best meets this constraint?
-
A
Deploy across availability zones with zone-redundant storage and read-only secondary replicas in the same region
✓ Correct
-
B
Configure geo-redundant storage (GRS) to a paired region
-
C
Implement multi-region replication with regulatory exemption request
-
D
Use a single availability zone with daily backup exports
Explanation
Availability zones provide high availability within a single region by distributing infrastructure across separate datacenters, and zone-redundant storage replicates data only within that region, satisfying both the regulatory constraint and availability requirements.