Question 1 of 40Cloud Concepts
A retail company runs its e-commerce platform in its own datacentre. During holiday sales, traffic increases tenfold, requiring servers that sit idle the rest of the year. Which cloud benefit would MOST directly address this problem?
A ✓Elasticity — automatically scaling resources up during peaks and down afterwards
BDisaster recovery — replicating workloads to a second region
CHigh availability — ensuring services remain accessible during failures
DPredictive maintenance — using AI to anticipate hardware failures
Explanation: Elasticity is the ability to automatically scale resources to match demand — exactly the holiday-peak problem. The company pays for extra capacity only when needed, instead of owning idle servers year-round. High availability and disaster recovery address different concerns (uptime and recovery), not fluctuating demand.
Question 2 of 40Cloud Concepts
Your CFO wants to stop large upfront hardware purchases and instead pay monthly based on actual usage. Which financial model shift does moving to the cloud provide?
A ✓CapEx to OpEx — capital expenditure becomes operational expenditure
BOpEx to CapEx — operational expenditure becomes capital expenditure
CFixed cost to sunk cost accounting
DDepreciation-based to amortisation-based accounting
Explanation: Cloud computing shifts spending from capital expenditure (CapEx — large upfront purchases of hardware that depreciate) to operational expenditure (OpEx — ongoing pay-as-you-go costs). This improves cash flow and removes the risk of over-provisioning hardware.
Question 3 of 40Cloud Concepts
A hospital must keep patient records on servers it physically controls due to regulation, but wants to run its public website and appointment booking system in Azure. Which cloud model fits?
APublic cloud only
BPrivate cloud only
C ✓Hybrid cloud
DCommunity cloud
Explanation: Hybrid cloud combines private infrastructure (the regulated patient records staying on-premises) with public cloud services (the website and booking system in Azure). This is the classic hybrid use case: keeping sensitive workloads local while using public cloud for scalable public-facing services.
Question 4 of 40Cloud Concepts
In the shared responsibility model, which responsibility ALWAYS remains with the customer, regardless of whether they use IaaS, PaaS, or SaaS?
APhysical security of datacentres
B ✓Information and data, devices, and accounts and identities
COperating system patching
DNetwork infrastructure maintenance
Explanation: The customer always retains responsibility for their data, their devices, and their accounts/identities — in every service model. Physical security always belongs to the cloud provider. OS patching shifts depending on the model (customer in IaaS, provider in PaaS/SaaS).
Question 5 of 40Cloud Concepts
A startup wants to deploy a web application without managing virtual machines, operating systems, or runtime environments — they just want to deploy code. Which service model should they choose?
AIaaS — Infrastructure as a Service
B ✓PaaS — Platform as a Service
CSaaS — Software as a Service
DOn-premises with automation tools
Explanation: PaaS provides the platform (OS, runtime, middleware) fully managed — developers just deploy code. Azure App Service is the classic example. IaaS would still require managing the OS; SaaS is consuming finished software (like Microsoft 365), not deploying your own code.
Question 6 of 40Cloud Concepts
Which of the following is the BEST example of Software as a Service (SaaS)?
AAzure Virtual Machines
BAzure App Service
C ✓Microsoft 365 (Outlook, Word, Excel online)
DAzure Kubernetes Service
Explanation: Microsoft 365 is finished software consumed over the internet — the definition of SaaS. Users don't manage any infrastructure, platform, or code. Virtual Machines are IaaS; App Service and AKS are PaaS offerings where you still deploy your own applications.
Question 7 of 40Cloud Concepts
A company experiences a regional power outage that takes down its only datacentre for two days, halting all business operations. Which cloud benefit would have prevented this business impact?
AScalability
B ✓Disaster recovery through geographic distribution
CPay-as-you-go pricing
DServerless computing
Explanation: Disaster recovery via geographic distribution means workloads can fail over to another region when one fails. Azure's paired regions are designed exactly for this. Scalability handles demand changes, not outages; pricing models and serverless don't address regional failure.
Question 8 of 40Cloud Concepts
What does 'high availability' mean in cloud computing?
AThe ability to recover data after accidental deletion
B ✓Ensuring services remain operational and accessible for a high percentage of time, often expressed as uptime SLA
CThe ability to serve users in many geographic regions
DAutomatically increasing compute power during traffic spikes
Explanation: High availability means maximising uptime — keeping services accessible despite failures, typically measured as an SLA percentage like 99.9%. Azure achieves this through redundancy: availability zones, load balancing, and fault domains. Geographic reach is global distribution; scaling is elasticity.
Question 9 of 40Cloud Concepts
A development team needs identical test environments created and destroyed dozens of times per day. Manually building each one takes hours. Which cloud characteristic solves this MOST directly?
A ✓Self-service and automation via templates and APIs
BHigh availability zones
CContent delivery networks
DReserved capacity pricing
Explanation: Cloud self-service and automation (using ARM templates, Bicep, or APIs) lets teams programmatically create and destroy identical environments in minutes. This agility is a core cloud benefit. Availability zones, CDNs, and pricing models don't address environment provisioning speed.
Question 10 of 40Cloud Concepts
Which statement BEST describes the consumption-based pricing model?
AYou pay a fixed monthly fee regardless of usage
B ✓You pay only for the resources you actually use, with no upfront cost
CYou pre-purchase capacity for one or three years at a discount
DYou pay per user per month
Explanation: Consumption-based (pay-as-you-go) means paying only for actual usage — compute seconds, storage consumed, transactions processed — with no upfront commitment. Reserved instances are the pre-purchase model; per-user pricing is typical of SaaS licensing.
Question 11 of 40Azure Architecture & Services
A company needs to run a legacy Windows application that requires full control over the operating system, custom registry settings, and specific driver installations. Which Azure service should they use?
AAzure App Service
B ✓Azure Virtual Machines
CAzure Functions
DAzure Container Instances
Explanation: Azure Virtual Machines (IaaS) provide full OS control — registry, drivers, custom configurations. App Service and Functions are PaaS/serverless where the OS is abstracted away. Legacy applications requiring OS-level customisation are the classic VM use case.
Question 12 of 40Azure Architecture & Services
What is an Azure Region?
AA single physical datacentre building
B ✓A set of datacentres deployed within a latency-defined perimeter, connected through a dedicated low-latency network
CA billing boundary for Azure subscriptions
DA virtual network spanning multiple countries
Explanation: An Azure region is one or more datacentres within a latency-defined perimeter connected by a dedicated low-latency network. Regions are the primary unit of geographic deployment. A single building is a datacentre; billing boundaries are subscriptions.
Question 13 of 40Azure Architecture & Services
An application must survive the failure of an entire datacentre within a region without downtime. Which Azure feature should the architecture use?
A ✓Availability Zones — physically separate datacentres within a region
BResource groups
CAzure DNS
DA larger virtual machine size
Explanation: Availability Zones are physically separate datacentres within a region, each with independent power, cooling, and networking. Deploying across zones protects against datacentre-level failure. Resource groups are logical containers, not resilience features.
Question 14 of 40Azure Architecture & Services
Which Azure storage service is BEST suited for storing large amounts of unstructured data such as images, videos, and documents?
AAzure SQL Database
B ✓Azure Blob Storage
CAzure Virtual Network
DAzure Cosmos DB
Explanation: Blob (Binary Large Object) Storage is designed for unstructured data — images, videos, documents, backups. SQL Database is for relational data; Cosmos DB for globally distributed NoSQL; Virtual Network is networking, not storage.
Question 15 of 40Azure Architecture & Services
A company wants code to run automatically whenever a file is uploaded to storage — paying only for the milliseconds of execution time, with no servers to manage. Which service fits?
AAzure Virtual Machines
B ✓Azure Functions
CAzure Virtual Desktop
DAzure ExpressRoute
Explanation: Azure Functions is serverless compute — code triggered by events (like file uploads), billed per execution, with zero server management. This event-driven, pay-per-execution model is exactly the scenario described. VMs require management; AVD is desktop virtualisation; ExpressRoute is networking.
Question 16 of 40Azure Architecture & Services
What is the purpose of Azure Virtual Network (VNet)?
A ✓To provide isolated, private networking for Azure resources to securely communicate
BTo distribute incoming web traffic across multiple servers
CTo store network configuration backups
DTo connect Azure to on-premises networks via private fibre
Explanation: A VNet provides isolated private networking in Azure where resources securely communicate with each other, the internet, and on-premises networks. Load distribution is Azure Load Balancer; private fibre connection is ExpressRoute.
Question 17 of 40Azure Architecture & Services
A financial firm requires a private, dedicated connection between its on-premises datacentre and Azure that never traverses the public internet. Which service provides this?
AVPN Gateway (site-to-site)
B ✓Azure ExpressRoute
CAzure Front Door
DNetwork Security Groups
Explanation: ExpressRoute provides a private, dedicated fibre connection to Azure that never touches the public internet — required for the strictest compliance and performance needs. Site-to-site VPN encrypts traffic but travels over the public internet.
Question 18 of 40Azure Architecture & Services
Which Azure service provides a fully managed relational database based on the Microsoft SQL Server engine?
AAzure Cosmos DB
B ✓Azure SQL Database
CAzure Table Storage
DAzure Cache for Redis
Explanation: Azure SQL Database is the fully managed PaaS relational database built on SQL Server. Microsoft handles patching, backups, and high availability. Cosmos DB is NoSQL; Table Storage is simple key-value; Redis is in-memory caching.
Question 19 of 40Azure Architecture & Services
A gaming company needs a database that replicates data globally with single-digit-millisecond latency for players in every continent. Which Azure service is designed for this?
AAzure SQL Database
B ✓Azure Cosmos DB
CAzure Blob Storage
DAzure Database for MySQL
Explanation: Cosmos DB is Azure's globally distributed, multi-model NoSQL database with guaranteed single-digit-millisecond latency and turnkey global replication — built exactly for planet-scale applications like gaming. SQL Database replicates but isn't designed for global low-latency writes.
Question 20 of 40Azure Architecture & Services
What is Azure Kubernetes Service (AKS) used for?
AHosting static websites
B ✓Orchestrating and managing containerised applications at scale
CRunning Windows desktop applications in the cloud
DManaging DNS records
Explanation: AKS is Azure's managed Kubernetes service for deploying, scaling, and managing containerised applications. Azure manages the control plane; you manage the containers. Static sites use Static Web Apps; desktops use Azure Virtual Desktop.
Question 21 of 40Azure Architecture & Services
Your company's remote workforce needs secure access to full Windows desktop environments from personal devices, without company hardware. Which Azure service delivers this?
A ✓Azure Virtual Desktop
BAzure App Service
CAzure Bastion
DAzure Container Apps
Explanation: Azure Virtual Desktop delivers full Windows desktop and app virtualisation from the cloud to any device. Bastion provides secure VM management access for admins (not desktops for users); App Service hosts web apps.
Question 22 of 40Azure Architecture & Services
Which Azure storage redundancy option provides the HIGHEST durability by replicating data to a secondary region hundreds of miles away?
ALocally-redundant storage (LRS)
BZone-redundant storage (ZRS)
C ✓Geo-redundant storage (GRS)
DPremium SSD storage
Explanation: GRS replicates data three times locally, then asynchronously to a paired secondary region hundreds of miles away — protecting against regional disasters. LRS stays in one datacentre; ZRS spans zones within one region; Premium SSD is a performance tier, not redundancy.
Question 23 of 40Azure Architecture & Services
A company wants to migrate hundreds of terabytes of data to Azure, but their internet connection would take months to upload it. Which Azure offering addresses this?
A ✓Azure Data Box — physical devices shipped to you for offline data transfer
BAzure CDN
CAzure File Sync
DUpgrading to ExpressRoute
Explanation: Azure Data Box is a physical appliance Microsoft ships to you — load your data locally, ship it back, and Microsoft uploads it directly into Azure. Designed for massive offline transfers where network upload is impractical.
Question 24 of 40Azure Architecture & Services
What is the role of Microsoft Entra ID (formerly Azure Active Directory)?
A ✓Cloud-based identity and access management — authenticating users and controlling access to resources
BStoring files in a hierarchical directory structure
CMonitoring application performance
DManaging DNS zones for domains
Explanation: Microsoft Entra ID is the cloud identity and access management service — it authenticates users (sign-in) and authorises access to applications and resources. It is the identity backbone for Azure, Microsoft 365, and thousands of SaaS applications.
Question 25 of 40Azure Architecture & Services
Security policy requires users to verify their identity with both a password AND a code from their phone when signing in. Which Entra ID feature enforces this?
ASingle sign-on (SSO)
B ✓Multifactor authentication (MFA)
CRole-based access control (RBAC)
DConditional access naming policies
Explanation: MFA requires two or more verification methods — something you know (password) plus something you have (phone code). SSO reduces sign-ins across apps; RBAC controls what resources users can access after signing in.
Question 26 of 40Azure Architecture & Services
Which security model assumes breach and verifies every request as though it originates from an untrusted network?
APerimeter security model
B ✓Zero Trust model
CDefence in depth
DCastle-and-moat model
Explanation: Zero Trust operates on 'never trust, always verify' — every access request is authenticated, authorised, and encrypted regardless of origin. It assumes breach rather than trusting anything inside a network perimeter. Defence in depth is layered protection (complementary but different).
Question 27 of 40Azure Architecture & Services
A developer needs to store database passwords and API keys securely, so they never appear in application code or configuration files. Which Azure service should be used?
A ✓Azure Key Vault
BAzure Blob Storage with encryption
CNetwork Security Groups
DMicrosoft Defender for Cloud
Explanation: Azure Key Vault securely stores and controls access to secrets, keys, and certificates. Applications retrieve secrets at runtime via managed identities — no credentials in code. Blob encryption protects stored files, not application secrets management.
Question 28 of 40Azure Architecture & Services
What does a Network Security Group (NSG) do?
A ✓Filters network traffic to and from Azure resources using allow/deny rules
BEncrypts data at rest in storage accounts
CProvides DDoS protection for public endpoints
DManages user identities and passwords
Explanation: NSGs filter network traffic with security rules that allow or deny traffic based on source, destination, port, and protocol — like a firewall for subnets and network interfaces. DDoS protection and identity are separate services.
Question 29 of 40Management & Governance
Your finance team is shocked by an unexpectedly high Azure bill. They want alerts BEFORE spending exceeds monthly limits, plus visibility into which departments consume what. Which tools address this?
A ✓Microsoft Cost Management with budgets and alerts, plus resource tags
BAzure Monitor with log analytics
CAzure Advisor recommendations
DAzure Service Health notifications
Explanation: Cost Management provides budgets with alert thresholds (warn before overspend), and tags attribute costs to departments/projects for chargeback visibility. Monitor tracks performance, Advisor gives optimisation tips, Service Health reports Azure outages.
Question 30 of 40Management & Governance
What is the purpose of resource tags in Azure?
A ✓To apply metadata (name-value pairs) to resources for organisation, cost tracking, and management
BTo encrypt resources with customer-managed keys
CTo physically label servers in datacentres
DTo version-control infrastructure templates
Explanation: Tags are name-value metadata pairs (like department:finance or env:production) applied to resources for organisation, cost reporting, automation, and governance. They power cost attribution across teams and projects.
Question 31 of 40Management & Governance
Company policy states that resources may only be deployed to the Australia East region, and every resource must have a 'costcentre' tag. How do you ENFORCE this automatically across all subscriptions?
ASend a memo to all developers
B ✓Azure Policy — definitions that audit or deny non-compliant deployments
CAzure Advisor recommendations
DManual monthly compliance reviews
Explanation: Azure Policy enforces organisational standards automatically — policies can deny deployments outside allowed regions or require specific tags at creation time. It provides continuous compliance evaluation, unlike manual reviews or advisory suggestions.
Question 32 of 40Management & Governance
What is the correct hierarchy of Azure management scopes, from broadest to narrowest?
A ✓Management groups → Subscriptions → Resource groups → Resources
BSubscriptions → Management groups → Resources → Resource groups
CResource groups → Subscriptions → Management groups → Resources
DResources → Resource groups → Management groups → Subscriptions
Explanation: The hierarchy: Management groups (organise multiple subscriptions) → Subscriptions (billing and access boundary) → Resource groups (logical containers) → Resources (the actual services). Policies and access applied at higher scopes inherit downward.
Question 33 of 40Management & Governance
A new administrator needs to manage virtual machines but must NOT be able to modify networking or access billing. What is the BEST way to grant these permissions?
AMake them a subscription Owner for simplicity
B ✓Assign the built-in Virtual Machine Contributor role via RBAC at the appropriate scope
CShare the global admin credentials
DGive them Reader role on everything
Explanation: Role-based access control (RBAC) with the least-privilege principle: the Virtual Machine Contributor built-in role grants VM management without networking or billing access. Owner grants everything (excessive); shared credentials violate security fundamentals; Reader can't manage anything.
Question 34 of 40Management & Governance
Which tool provides personalised recommendations to optimise Azure resources for cost, security, reliability, performance, and operational excellence?
A ✓Azure Advisor
BAzure Monitor
CAzure Service Health
DAzure Resource Manager
Explanation: Azure Advisor analyses your resource configuration and usage, then provides free personalised recommendations across five pillars: cost, security, reliability, performance, and operational excellence. Monitor collects telemetry; Service Health reports Azure incidents.
Question 35 of 40Management & Governance
Your application is running slowly and you need to investigate CPU usage, memory trends, and application logs from the past week. Which Azure service provides this telemetry?
A ✓Azure Monitor
BAzure Policy
CMicrosoft Cost Management
DAzure Blueprints
Explanation: Azure Monitor collects, analyses, and acts on telemetry — metrics (CPU, memory) and logs from applications and infrastructure. Log Analytics queries the data; Application Insights adds deep application performance monitoring.
Question 36 of 40Management & Governance
Where would you check whether an ongoing Azure platform outage is affecting your resources?
A ✓Azure Service Health
BAzure Advisor
CMicrosoft Entra ID
DAzure Key Vault
Explanation: Azure Service Health provides personalised alerts about Azure service issues affecting YOUR resources — platform outages, planned maintenance, and health advisories. It distinguishes global Azure status from what specifically impacts you.
Question 37 of 40Management & Governance
An organisation wants to estimate its monthly Azure costs BEFORE migrating workloads, comparing them with current datacentre costs. Which two tools should they use?
A ✓Pricing Calculator for Azure estimates and TCO Calculator for on-premises comparison
BAzure Monitor and Azure Advisor
CCost Management and Azure Policy
DAzure Migrate and Azure Backup
Explanation: The Pricing Calculator estimates costs of planned Azure resources; the Total Cost of Ownership (TCO) Calculator compares current on-premises costs (including power, cooling, labour) against Azure equivalents. Both are free pre-migration planning tools.
Question 38 of 40Management & Governance
Which purchasing option can reduce virtual machine costs by up to 72% in exchange for a one- or three-year commitment?
APay-as-you-go pricing
B ✓Azure Reservations (Reserved Instances)
CFree tier services
DSpot pricing with eviction
Explanation: Azure Reservations offer up to 72% savings versus pay-as-you-go in exchange for committing to one or three years of usage — ideal for stable, predictable workloads. Spot instances are cheaper still but can be evicted anytime (for interruptible workloads only).
Question 39 of 40Management & Governance
A DevOps team wants to define their entire infrastructure — VMs, networks, databases — in code files that can be versioned, reviewed, and deployed repeatedly with identical results. Which Azure-native approach enables this?
AManually documenting configurations in a wiki
B ✓Infrastructure as Code using ARM templates or Bicep
CTaking screenshots of portal settings
DAzure Advisor exports
Explanation: ARM templates (JSON) and Bicep (simpler syntax) are Azure's Infrastructure as Code languages — declarative files defining resources that deploy identically every time, live in version control, and support code review. This eliminates configuration drift and manual errors.
Question 40 of 40Management & Governance
What does the Microsoft Purview compliance portal (and tools like Compliance Manager) primarily help organisations do?
A ✓Manage data governance, risk, and regulatory compliance across the organisation
BDeploy virtual machines faster
CReduce network latency
DDesign user interfaces
Explanation: Microsoft Purview provides unified data governance, risk management, and compliance tooling — mapping regulations (GDPR, ISO, HIPAA) to controls, assessing compliance posture, and governing data across the estate. Essential for regulated industries adopting cloud.