Question 1 of 40Cloud Concepts
A news website normally serves 10,000 daily visitors, but a breaking story brings 2 million in one hour, then traffic returns to normal. In the cloud, which capability handles the spike, and what happens to cost afterwards?
A ✓Elastic scaling handles the spike; cost returns to baseline when resources scale back in
BElastic scaling handles the spike; the higher cost becomes permanent
CThe site must pre-purchase capacity for 2 million users year-round
DCloud providers block traffic spikes automatically
Explanation: Elasticity scales out for the spike and scales back in afterwards — cost follows usage in both directions. This is the fundamental advantage over owning peak-capacity hardware that idles the rest of the year.
Question 2 of 40Cloud Concepts
Which term describes the ability to deploy applications closer to users in multiple geographies to reduce latency?
A ✓Global reach through worldwide regions
BVertical scaling
CFault tolerance
DServerless computing
Explanation: Azure's global footprint of 60+ regions lets you deploy near users on every continent, reducing latency. Vertical scaling adds power to one machine; fault tolerance survives failures — neither addresses geographic proximity.
Question 3 of 40Cloud Concepts
A bank asks: 'If we move to PaaS and our application leaks customer data due to a coding flaw, is Microsoft liable?' What is the correct shared-responsibility answer?
A ✓No — application code and data protection remain the customer's responsibility in every service model
BYes — Microsoft assumes all liability in PaaS
CLiability transfers to Microsoft after 12 months
DNeither party is responsible for data
Explanation: Application code, data, identities, and access management stay with the customer in IaaS, PaaS, AND SaaS. Microsoft secures the platform; the customer secures what they build and store on it.
Question 4 of 40Cloud Concepts
What is 'vertical scaling' (scaling up)?
A ✓Adding more power (CPU/RAM) to an existing machine
BAdding more machine instances to share load
CMoving workloads to a different region
DReducing the number of applications on a server
Explanation: Vertical scaling (up) increases the resources of a single instance — bigger VM size. Horizontal scaling (out) adds more instances. Cloud favours horizontal scaling because it has no single-machine ceiling and improves resilience.
Question 5 of 40Cloud Concepts
A legacy application cannot run multiple instances — it must run on exactly one server. Demand has outgrown the current VM. Which scaling approach is the ONLY option?
A ✓Vertical scaling — resizing to a larger VM
BHorizontal scaling with a load balancer
CDeploying to multiple regions
DConverting to serverless functions
Explanation: Single-instance applications can only scale vertically — a bigger VM. Horizontal scaling requires the app to support multiple concurrent instances, which this legacy app cannot. This is a common real-world constraint driving VM resizing.
Question 6 of 40Cloud Concepts
Which is an example of a hybrid cloud scenario?
A ✓An on-premises Active Directory synchronising identities with Microsoft Entra ID for cloud apps
BRunning everything in Azure public cloud
CTwo departments sharing one Azure subscription
DUsing both Azure Blob and Azure Files storage
Explanation: Hybrid = on-premises infrastructure working WITH public cloud. Directory synchronisation between on-prem AD and Entra ID is a textbook hybrid identity scenario. Using multiple Azure services is still purely public cloud.
Question 7 of 40Cloud Concepts
A CIO must justify cloud migration to the board. Current annual datacentre costs include $2M hardware refresh, $400K power/cooling, and $600K facilities staff. Which tool produces a formal comparison against Azure costs?
A ✓Total Cost of Ownership (TCO) Calculator
BAzure Advisor
CAzure Service Health
DMicrosoft Sentinel
Explanation: The TCO Calculator models complete on-premises costs — hardware, power, cooling, labour, facilities — against equivalent Azure spending, producing board-ready comparison reports. The Pricing Calculator only estimates Azure-side costs.
Question 8 of 40Cloud Concepts
Why can a composite application using three Azure services each with 99.9% SLA have an effective SLA LOWER than 99.9%?
A ✓Combined availability multiplies: 99.9% × 99.9% × 99.9% ≈ 99.7%
BAzure penalises multi-service applications
CSLAs only apply to single services
DIt cannot — the SLA stays 99.9%
Explanation: When services depend on each other, availabilities multiply: 0.999³ ≈ 0.997 (99.7%). Each additional dependency lowers the composite SLA — an important architectural consideration when making uptime promises.
Question 9 of 40Cloud Concepts
A developer wants to test a new idea: spin up resources for 3 hours, run experiments, delete everything. On-premises this would need a purchase request taking weeks. Which TWO cloud benefits does this illustrate MOST directly?
A ✓Agility and consumption-based pricing
BHigh availability and disaster recovery
CGeo-distribution and compliance
DPredictability and governance
Explanation: Minutes-not-weeks provisioning is agility; paying only for 3 hours is consumption-based pricing. Together they make experimentation cheap and fast — a major driver of cloud innovation velocity.
Question 10 of 40Azure Architecture & Services
What is a sovereign cloud in Azure terms?
A ✓Isolated Azure instances for specific jurisdictions, such as Azure Government (US) or Azure China
BA private cloud any company can build
CThe most expensive Azure pricing tier
DA region with only one datacentre
Explanation: Sovereign clouds are physically and logically isolated Azure instances meeting specific national requirements — Azure Government for US agencies, Azure China operated by 21Vianet. They have separate identities, portals, and compliance scopes.
Question 11 of 40Azure Architecture & Services
An architect deploys three VMs behind a load balancer, each in a different Availability Zone within one region. Which failure types does this design survive, and which does it NOT?
A ✓Survives server, rack, and datacentre failures — but not a full regional outage
BSurvives all failures including regional outages
CSurvives only single-server failures
DSurvives nothing without a second region
Explanation: Zones are separate datacentres with independent power/cooling/network — surviving datacentre-level failure. But all zones are within ONE region; a regional disaster requires multi-region architecture (region pairs) to survive.
Question 12 of 40Azure Architecture & Services
Which compute option bills ONLY while code executes, scaling to zero when idle?
A ✓Azure Functions (consumption plan)
BAzure Virtual Machines
CAKS with a fixed node pool
DAzure Virtual Desktop
Explanation: Functions on the consumption plan is serverless: bills per execution (time and memory), scales automatically, and costs nothing when idle. VMs and fixed AKS nodes bill while running regardless of activity.
Question 13 of 40Azure Architecture & Services
A retailer's checkout system sends order messages to a warehouse system that is sometimes offline for maintenance. Orders must NEVER be lost while the warehouse system is down. Which pattern/service prevents loss?
A ✓Message queuing (e.g. Azure Queue Storage or Service Bus) to decouple the systems
BDirect synchronous API calls between the systems
CStoring orders in browser cookies
DA larger VM for the checkout
Explanation: Queues decouple producers from consumers: checkout writes messages to the queue; the warehouse processes them when available. Messages persist until consumed — nothing is lost during downtime. Synchronous calls fail when the receiver is offline.
Question 14 of 40Azure Architecture & Services
Which service should host a static website (HTML, CSS, JavaScript) at the LOWEST cost?
A ✓Azure Blob Storage static website hosting (or Azure Static Web Apps)
BA Windows Server VM running IIS
CAzure Kubernetes Service
DAzure SQL Database
Explanation: Static content needs no compute — Blob static hosting or Static Web Apps serve files for cents per month. Running a VM or Kubernetes cluster for static files pays for unnecessary compute continuously.
Question 15 of 40Azure Architecture & Services
During a ransomware incident on-premises, a company restores clean data from Azure because backups were configured with immutability. Which service category made this recovery possible?
A ✓Azure Backup with immutable/soft-delete protection
BAzure CDN
CAzure Load Balancer
DAzure DNS
Explanation: Azure Backup provides off-site, policy-driven backups; immutability and soft delete prevent attackers (or mistakes) from destroying recovery points. Off-site immutable backups are the core ransomware recovery control.
Question 16 of 40Azure Architecture & Services
What does Azure Site Recovery provide?
A ✓Disaster recovery orchestration — replicating workloads to another region and failing over during outages
BRecovering deleted user passwords
CWebsite design templates
DFinding lost Azure invoices
Explanation: Site Recovery replicates VMs/physical servers to a secondary region and orchestrates failover and failback during disasters — the DR component of business continuity, complementing Azure Backup's data protection.
Question 17 of 40Azure Architecture & Services
Two VNets in different regions must communicate privately using Microsoft's backbone, without internet transit or gateways. Which feature connects them?
A ✓Global VNet peering
BPublic IP addresses on every VM
CAzure CDN
DPort forwarding rules
Explanation: VNet peering (global when cross-region) connects VNets privately over Microsoft's backbone with low latency — no internet exposure, no VPN gateways. Traffic never touches the public internet.
Question 18 of 40Azure Architecture & Services
Which Azure service translates human-friendly names like www.contoso.com into IP addresses?
A ✓Azure DNS
BAzure Bastion
CAzure Key Vault
DAzure Monitor
Explanation: Azure DNS hosts DNS zones and resolves domain names to IPs using Azure's global anycast network — managed with the same credentials, tools, and billing as other Azure resources.
Question 19 of 40Azure Architecture & Services
An IoT company collects telemetry from 50,000 sensors, needs to ingest millions of events per second, and analyse them in near-real-time. Which Azure service category handles massive event ingestion?
A ✓Azure Event Hubs (big data streaming ingestion)
BAzure Files
CAzure DNS
DAzure Bastion
Explanation: Event Hubs is the big-data streaming ingestion service — millions of events per second from devices, feeding stream analytics and storage. Files, DNS, and Bastion serve entirely different purposes.
Question 20 of 40Azure Architecture & Services
A company needs to run SAP HANA workloads requiring certified, very large memory VMs. What does this illustrate about Azure VM offerings?
A ✓Azure provides specialised VM families optimised for different workloads (memory, compute, GPU, storage)
BAll Azure VMs are identical in capability
CSAP cannot run in Azure
DOnly Microsoft software runs on Azure VMs
Explanation: Azure VM families target workload profiles: M-series for massive memory (SAP HANA), N-series GPUs for AI, F-series for compute, L-series for storage throughput. Choosing the right family optimises cost and performance.
Question 21 of 40Azure Architecture & Services
A security review finds developers have been committing storage account keys into source code. Which TWO Azure capabilities eliminate this practice?
A ✓Managed identities for Azure resources plus Azure Key Vault
BBigger VMs and more storage
CResource locks and tags
DAvailability zones and region pairs
Explanation: Managed identities give Azure resources an automatic Entra ID identity to authenticate to services — no credentials in code at all. Key Vault stores any secrets that must exist. Together they remove hardcoded credentials entirely.
Question 22 of 40Azure Architecture & Services
What is Microsoft Entra ID's relationship to on-premises Active Directory?
A ✓They are separate identity systems that can synchronise via Entra Connect for hybrid identity
BThey are the same product
CEntra ID replaces AD automatically upon Azure signup
DThey cannot work together
Explanation: Entra ID is cloud-native identity; AD DS is on-premises directory. Entra Connect synchronises them so users have one identity across both — the hybrid identity pattern most enterprises run.
Question 23 of 40Azure Architecture & Services
An organisation wants passwordless sign-in using fingerprint or facial recognition on registered devices. Which Microsoft capability provides this?
A ✓Windows Hello for Business / passwordless authentication methods in Entra ID
BLonger password complexity requirements
CShared administrator accounts
DDisabling MFA
Explanation: Entra ID supports passwordless methods — Windows Hello biometrics, FIDO2 keys, Authenticator app — replacing passwords with stronger, phishing-resistant factors. Password complexity rules still leave password vulnerabilities.
Question 24 of 40Azure Architecture & Services
Which describes DDoS Protection in Azure?
A ✓Detecting and mitigating distributed denial-of-service attacks that attempt to overwhelm applications with traffic
BEncrypting databases
CManaging user licences
DCompressing network traffic
Explanation: DDoS Protection absorbs and scrubs flood attacks aimed at exhausting application resources. Basic protection is built into the platform; the Standard tier adds tuned mitigation, telemetry, and cost protection for public endpoints.
Question 25 of 40Management & Governance
An auditor asks: 'Prove which resources are non-compliant with your tagging policy right now, without checking each manually.' Where do you get this evidence?
A ✓Azure Policy compliance dashboard showing evaluation state of every resource
BScreenshots of a few sample resources
CAn email survey of resource owners
DThe Azure status page
Explanation: Azure Policy continuously evaluates resources and its compliance dashboard reports exactly which resources violate which policies — audit-ready evidence, exportable, in real time.
Question 26 of 40Management & Governance
Which resource lock type allows reading but prevents BOTH modification and deletion?
A ✓ReadOnly lock
BCanNotDelete lock
CA 'production' tag
DAn NSG rule
Explanation: ReadOnly locks resources completely against changes and deletion — only reads permitted. CanNotDelete blocks deletion but allows modification. Tags and NSGs don't control management-plane actions.
Question 27 of 40Management & Governance
Finance requires each of 6 departments to see exactly what THEY spend in a shared subscription. Resources are currently untagged. What is the required approach?
A ✓Enforce department tags via Azure Policy, then filter Cost Management reports by tag
BSplit the bill evenly six ways
CAsk each department to estimate their usage
DCreate six copies of every resource
Explanation: Tags are the cost-attribution mechanism: Policy enforces tagging at deployment (and can remediate existing resources), then Cost Management groups and filters spend by tag — accurate departmental chargeback.
Question 28 of 40Management & Governance
Which tools can manage Azure resources programmatically or from the command line?
A ✓Azure CLI, Azure PowerShell, REST APIs, and SDKs
BOnly the Azure portal
COnly Microsoft Excel
DRemote Desktop only
Explanation: Azure offers full management parity across the portal, Azure CLI (cross-platform commands), Azure PowerShell (cmdlets), REST APIs, and language SDKs — everything scriptable and automatable.
Question 29 of 40Management & Governance
A workload can be interrupted at any time (batch rendering). The team wants maximum compute discount and accepts eviction when Azure needs capacity. Which pricing model fits?
A ✓Spot Virtual Machines
BPay-as-you-go
CReserved instances
DAzure Hybrid Benefit
Explanation: Spot VMs use spare capacity at up to ~90% discount with the trade-off of possible eviction — ideal for interruptible batch work. Reservations suit steady workloads; Hybrid Benefit is licensing, not capacity pricing.
Question 30 of 40Management & Governance
What information does the Azure Pricing Calculator require to produce an estimate?
A ✓The services, regions, tiers, and expected usage quantities you plan to deploy
BYour existing electricity bills
CYour competitors' Azure spend
DNothing — it produces one universal price
Explanation: The Pricing Calculator builds estimates from your planned configuration: which services, in which regions, at which tiers, with what usage volumes. It models YOUR architecture, unlike the TCO Calculator which compares against current on-prem costs.
Question 31 of 40Management & Governance
After a produced-at-2am incident, the ops team wants automatic notification whenever VM CPU exceeds 90% for 10 minutes. Which Azure Monitor capability delivers this?
A ✓Metric alerts with action groups (email/SMS/webhook notifications)
BManually watching dashboards overnight
CAzure Advisor weekly digests
DResource tags
Explanation: Azure Monitor alert rules evaluate metrics continuously; when thresholds breach, action groups fire notifications (email, SMS, push, webhook) or automated remediation. This is proactive monitoring versus reactive dashboard-watching.
Question 32 of 40Management & Governance
What is Microsoft Purview used for?
A ✓Unified data governance — discovering, classifying, and mapping data across the organisation
BPlaying media files
CDesigning PowerPoint slides
DHosting websites
Explanation: Purview provides data governance and compliance: automated data discovery, sensitivity classification, lineage mapping, and a unified catalogue across on-premises, Azure, and multi-cloud data estates.
Question 33 of 40Management & Governance
A resource group named RG-PROD has a ReadOnly lock. A user with Owner rights tries to add a VM to it. What happens?
A ✓The deployment fails — ReadOnly blocks create/update operations until the lock is removed
BThe VM deploys because Owners bypass locks
CThe VM deploys but runs slowly
DThe lock converts to CanNotDelete automatically
Explanation: Locks apply to ALL users regardless of RBAC role — including Owners. ReadOnly permits only read operations; creating a VM is a write and fails. The Owner must deliberately remove the lock first (which is the point: preventing accidents).
Question 34 of 40Management & Governance
Where does an RBAC role assignment made at the subscription scope apply?
A ✓To the subscription and everything beneath it — all resource groups and resources — via inheritance
BOnly to the subscription billing page
COnly to resources created after the assignment
DNowhere until repeated on each resource
Explanation: RBAC inherits downward: subscription-scope assignments flow to every resource group and resource within, existing and future. Assign at the highest appropriate scope to avoid repetitive per-resource assignments.
Question 35 of 40Management & Governance
Your monthly Azure invoice jumped 40%. Which Cost Management feature identifies exactly WHICH resources and services caused the increase?
A ✓Cost analysis — breaking down spend by service, resource, region, and time period
BAzure Service Health
CThe Azure status page
DMicrosoft Sentinel
Explanation: Cost analysis in Cost Management slices actual spend by service, resource group, resource, tag, and time — pinpointing what drove the increase. Service Health covers outages; Sentinel is security.
Question 36 of 40Management & Governance
Which describes the Azure Well-Architected Framework?
A ✓Guidance across five pillars — cost, security, reliability, performance, operational excellence — for building quality workloads
BA physical building standard for datacentres
CA mandatory exam
DAn Azure networking product
Explanation: The Well-Architected Framework guides workload design across five pillars: cost optimisation, security, reliability, performance efficiency, and operational excellence — with assessments to score existing workloads against best practice.
Question 37 of 40Management & Governance
An engineer needs to know whether last night's Azure maintenance in Australia East caused their app outage. Which source shows maintenance and incidents SPECIFIC to their resources?
A ✓Azure Service Health (personalised) with Resource Health for individual resources
BTwitter/X posts
CThe generic Azure status page only
DCost Management
Explanation: Service Health personalises platform events to YOUR subscriptions and regions; Resource Health reports the health history of individual resources. The public status page shows only broad incidents, not your specific impact.
Question 38 of 40Cloud Concepts
Which workload characteristic makes the STRONGEST case for cloud over on-premises?
A ✓Highly variable or unpredictable demand
BPerfectly constant 24/7 utilisation for 10 years
CA requirement to physically own hardware
DNo internet connectivity available
Explanation: Variable demand is the killer cloud use case — elasticity means never paying for idle peak capacity. Perfectly constant long-term workloads can sometimes favour owned hardware economics; physical-ownership mandates and no connectivity preclude cloud.
Question 39 of 40Azure Architecture & Services
A developer asks the difference between stopping a VM from inside the OS (shutdown) versus deallocating it from the portal. What is the billing difference?
A ✓OS shutdown keeps compute billing (hardware still reserved); deallocation stops compute charges, though disks still bill
BBoth stop all charges completely
CDeallocation deletes the VM permanently
DThere is no difference at all
Explanation: Shutting down inside the OS leaves the VM allocated to hardware — compute keeps billing. Deallocating (Stop in the portal) releases the hardware and stops compute charges; storage (disks) continues billing either way.
Question 40 of 40Management & Governance
What is Azure Arc designed to do?
A ✓Extend Azure management (policy, monitoring, security) to servers and Kubernetes running on-premises or in other clouds
BDraw architectural diagrams
CProvide gaming services
DReplace all on-premises hardware
Explanation: Azure Arc projects non-Azure resources — on-prem servers, other-cloud VMs, Kubernetes clusters — into Azure Resource Manager, so Azure Policy, Monitor, Defender, and RBAC govern them centrally. One control plane across hybrid and multi-cloud.