A preview of 15 of the 40 questions in this set, with full explanations. Take the interactive exam above for the complete set with timer, flagging, and scoring.
Question 1Cloud Concepts
Which term describes designing a system to continue operating when components fail?
A ✓Fault tolerance
BVertical scaling
CServerless computing
DConsumption pricing
Explanation: Fault tolerance means the system keeps functioning despite component failures — through redundancy, failover, and graceful degradation. It's related to but distinct from high availability (the outcome fault tolerance helps achieve).
Question 2Cloud Concepts
A university's student portal sees demand only during enrolment weeks (4 weeks/year). Management proposes buying servers sized for enrolment peaks. What is the cloud-based counterargument?
A ✓Elastic cloud capacity handles enrolment peaks, then scales down — avoiding 48 weeks of paying for idle hardware
BThe university should buy even bigger servers
CCloud cannot handle education workloads
DPeak capacity is impossible in the cloud
Explanation: Peak-sized hardware idles 92% of the year. Cloud elasticity provisions enrolment capacity for 4 weeks and scales down after — paying for what's used. Seasonal workloads are among the strongest cloud economics cases.
Question 3Cloud Concepts
In which service model does the customer manage the LEAST?
A ✓SaaS
BPaaS
CIaaS
DOn-premises
Explanation: Responsibility decreases IaaS → PaaS → SaaS. In SaaS the customer manages only data, devices, and identities; the provider runs everything else. On-premises means managing everything yourself.
Question 4Cloud Concepts
A company adopts Microsoft 365 for email, deploys custom apps on Azure App Service, and runs a legacy database on Azure VMs. Which statement correctly maps these to service models?
A ✓Microsoft 365 = SaaS, App Service = PaaS, VMs = IaaS
BAll three are IaaS
CMicrosoft 365 = IaaS, VMs = SaaS
DApp Service = SaaS, Microsoft 365 = PaaS
Explanation: Finished software consumed as-is = SaaS (M365). Platform for deploying your code = PaaS (App Service). Raw infrastructure you configure = IaaS (VMs). Most enterprises use all three simultaneously.
Question 5Cloud Concepts
What is a private cloud?
A ✓Cloud infrastructure used exclusively by one organisation, whether self-hosted or provider-hosted
BAny cloud with a password
CAzure with private IP addresses
DA discount Azure tier
Explanation: Private cloud dedicates infrastructure to a single organisation — offering cloud-like self-service and scaling with full control. It can live in your datacentre or a provider's. Exclusivity of use defines it, not passwords or IP types.
Question 6Cloud Concepts
An insurer's compliance team requires certain workloads stay on-premises, while the innovation team wants cloud AI services. The architecture connects both environments. Beyond 'hybrid cloud', which Azure service could manage BOTH environments' servers from one control plane?
A ✓Azure Arc
BAzure CDN
CAzure DNS
DAzure Front Door
Explanation: Azure Arc extends Azure's management plane to on-premises and multi-cloud servers — unified policy, monitoring, and security across the hybrid estate. CDN, DNS, and Front Door are delivery/networking services.
Question 7Azure Architecture & Services
How many Availability Zones does an enabled Azure region have AT MINIMUM?
Explanation: Zone-enabled regions provide a minimum of three separate zones — each with independent power, cooling, and networking — enabling architectures that survive datacentre failure with quorum-based redundancy.
Question 8Azure Architecture & Services
A solo developer needs a small Linux VM for a hobby project, deleting it after each session to save money. Which set of Azure characteristics makes this workflow practical?
A ✓Per-second billing, rapid provisioning, and no upfront commitment
BMandatory 3-year contracts
CMinimum purchase of 100 VMs
DPhysical hardware delivery
Explanation: Azure VMs bill by the second with no commitment and deploy in minutes — create, use, delete, pay only for actual usage. This zero-friction model serves individuals as well as enterprises.
Question 9Azure Architecture & Services
Which storage account service stores messages for asynchronous processing between application components?
A ✓Queue Storage
BBlob Storage
CAzure Files
DDisk Storage
Explanation: Queue Storage holds messages that producers write and consumers read asynchronously — decoupling components. Blobs store objects, Files provides shares, Disks attach to VMs.
Question 10Azure Architecture & Services
A video platform stores newly uploaded videos accessed heavily for 30 days, occasionally for a year, then almost never. Which lifecycle approach minimises storage cost?
A ✓Lifecycle management rules moving blobs Hot → Cool → Archive as access declines
BKeeping everything in Hot forever
CKeeping everything in Archive from day one
DDeleting all videos after 30 days
Explanation: Lifecycle management automates tier transitions by age/access: Hot for the active month, Cool for the occasional year, Archive after. Archiving fresh videos would make them painfully slow to serve; Hot-forever wastes money.
Question 11Azure Architecture & Services
What must be TRUE for two VMs in the same VNet but different subnets to communicate by default?
A ✓Nothing extra — subnets within a VNet route to each other by default
BA VPN gateway between the subnets
CPublic IP addresses on both
DAn ExpressRoute circuit
Explanation: Azure automatically routes traffic between subnets in the same VNet — no gateways or public IPs required. NSGs can restrict this default connectivity, but the routing exists out of the box.
Question 12Azure Architecture & Services
A three-tier app (web, app, database) needs the database tier to accept traffic ONLY from the app tier — never from the web tier or internet. How is this enforced within the VNet?
A ✓Network Security Group rules on the database subnet allowing only the app subnet's range
BDeleting the web tier
CUsing a bigger database VM
DPlacing all tiers in one subnet with no rules
Explanation: NSGs enforce micro-segmentation: rules on the database subnet allow inbound only from the app subnet's address range and deny all else — the standard three-tier isolation pattern.
Question 13Azure Architecture & Services
Azure Firewall differs from Network Security Groups in that it:
A ✓Is a managed, stateful firewall service with centralised rules, threat intelligence, and FQDN filtering across VNets
BIs free while NSGs cost money
COnly works on-premises
DReplaces the need for identity management
Explanation: Azure Firewall is a fully managed network security service: centralised policy, FQDN/application rules, threat intelligence feeds, SNAT/DNAT. NSGs are simpler distributed packet filters on subnets/NICs. Many architectures use both.
Question 14Azure Architecture & Services
A global app needs one entry point that routes each user to the nearest healthy backend region, with automatic failover if a region dies. Which service category provides global HTTP load balancing?
A ✓Azure Front Door (global layer-7 routing)
BA single regional Load Balancer
CAzure Files
DAzure Bastion
Explanation: Front Door is Azure's global HTTP(S) entry point — latency-based routing to the nearest healthy backend, instant regional failover, WAF integration. Regional Load Balancer works within one region only.
Question 15Azure Architecture & Services
What is the purpose of Azure ExpressRoute's higher SLA compared to VPN connections?
A ✓Private dedicated circuits offer more predictable performance and reliability than internet-dependent VPN tunnels
BExpressRoute is always cheaper
CVPNs cannot encrypt traffic
DExpressRoute works without any physical connection
Explanation: ExpressRoute's dedicated private circuits avoid internet variability — delivering consistent latency, higher bandwidth, and stronger SLAs. VPNs encrypt well but ride the unpredictable public internet. ExpressRoute costs more, not less.