Question 1 of 40Cloud Concepts
Which term describes designing a system to continue operating when components fail?
A ✓Fault tolerance
BVertical scaling
CServerless computing
DConsumption pricing
Explanation: Fault tolerance means the system keeps functioning despite component failures — through redundancy, failover, and graceful degradation. It's related to but distinct from high availability (the outcome fault tolerance helps achieve).
Question 2 of 40Cloud Concepts
A university's student portal sees demand only during enrolment weeks (4 weeks/year). Management proposes buying servers sized for enrolment peaks. What is the cloud-based counterargument?
A ✓Elastic cloud capacity handles enrolment peaks, then scales down — avoiding 48 weeks of paying for idle hardware
BThe university should buy even bigger servers
CCloud cannot handle education workloads
DPeak capacity is impossible in the cloud
Explanation: Peak-sized hardware idles 92% of the year. Cloud elasticity provisions enrolment capacity for 4 weeks and scales down after — paying for what's used. Seasonal workloads are among the strongest cloud economics cases.
Question 3 of 40Cloud Concepts
In which service model does the customer manage the LEAST?
A ✓SaaS
BPaaS
CIaaS
DOn-premises
Explanation: Responsibility decreases IaaS → PaaS → SaaS. In SaaS the customer manages only data, devices, and identities; the provider runs everything else. On-premises means managing everything yourself.
Question 4 of 40Cloud Concepts
A company adopts Microsoft 365 for email, deploys custom apps on Azure App Service, and runs a legacy database on Azure VMs. Which statement correctly maps these to service models?
A ✓Microsoft 365 = SaaS, App Service = PaaS, VMs = IaaS
BAll three are IaaS
CMicrosoft 365 = IaaS, VMs = SaaS
DApp Service = SaaS, Microsoft 365 = PaaS
Explanation: Finished software consumed as-is = SaaS (M365). Platform for deploying your code = PaaS (App Service). Raw infrastructure you configure = IaaS (VMs). Most enterprises use all three simultaneously.
Question 5 of 40Cloud Concepts
What is a private cloud?
A ✓Cloud infrastructure used exclusively by one organisation, whether self-hosted or provider-hosted
BAny cloud with a password
CAzure with private IP addresses
DA discount Azure tier
Explanation: Private cloud dedicates infrastructure to a single organisation — offering cloud-like self-service and scaling with full control. It can live in your datacentre or a provider's. Exclusivity of use defines it, not passwords or IP types.
Question 6 of 40Cloud Concepts
An insurer's compliance team requires certain workloads stay on-premises, while the innovation team wants cloud AI services. The architecture connects both environments. Beyond 'hybrid cloud', which Azure service could manage BOTH environments' servers from one control plane?
A ✓Azure Arc
BAzure CDN
CAzure DNS
DAzure Front Door
Explanation: Azure Arc extends Azure's management plane to on-premises and multi-cloud servers — unified policy, monitoring, and security across the hybrid estate. CDN, DNS, and Front Door are delivery/networking services.
Question 7 of 40Azure Architecture & Services
How many Availability Zones does an enabled Azure region have AT MINIMUM?
Explanation: Zone-enabled regions provide a minimum of three separate zones — each with independent power, cooling, and networking — enabling architectures that survive datacentre failure with quorum-based redundancy.
Question 8 of 40Azure Architecture & Services
A solo developer needs a small Linux VM for a hobby project, deleting it after each session to save money. Which set of Azure characteristics makes this workflow practical?
A ✓Per-second billing, rapid provisioning, and no upfront commitment
BMandatory 3-year contracts
CMinimum purchase of 100 VMs
DPhysical hardware delivery
Explanation: Azure VMs bill by the second with no commitment and deploy in minutes — create, use, delete, pay only for actual usage. This zero-friction model serves individuals as well as enterprises.
Question 9 of 40Azure Architecture & Services
Which storage account service stores messages for asynchronous processing between application components?
A ✓Queue Storage
BBlob Storage
CAzure Files
DDisk Storage
Explanation: Queue Storage holds messages that producers write and consumers read asynchronously — decoupling components. Blobs store objects, Files provides shares, Disks attach to VMs.
Question 10 of 40Azure Architecture & Services
A video platform stores newly uploaded videos accessed heavily for 30 days, occasionally for a year, then almost never. Which lifecycle approach minimises storage cost?
A ✓Lifecycle management rules moving blobs Hot → Cool → Archive as access declines
BKeeping everything in Hot forever
CKeeping everything in Archive from day one
DDeleting all videos after 30 days
Explanation: Lifecycle management automates tier transitions by age/access: Hot for the active month, Cool for the occasional year, Archive after. Archiving fresh videos would make them painfully slow to serve; Hot-forever wastes money.
Question 11 of 40Azure Architecture & Services
What must be TRUE for two VMs in the same VNet but different subnets to communicate by default?
A ✓Nothing extra — subnets within a VNet route to each other by default
BA VPN gateway between the subnets
CPublic IP addresses on both
DAn ExpressRoute circuit
Explanation: Azure automatically routes traffic between subnets in the same VNet — no gateways or public IPs required. NSGs can restrict this default connectivity, but the routing exists out of the box.
Question 12 of 40Azure Architecture & Services
A three-tier app (web, app, database) needs the database tier to accept traffic ONLY from the app tier — never from the web tier or internet. How is this enforced within the VNet?
A ✓Network Security Group rules on the database subnet allowing only the app subnet's range
BDeleting the web tier
CUsing a bigger database VM
DPlacing all tiers in one subnet with no rules
Explanation: NSGs enforce micro-segmentation: rules on the database subnet allow inbound only from the app subnet's address range and deny all else — the standard three-tier isolation pattern.
Question 13 of 40Azure Architecture & Services
Azure Firewall differs from Network Security Groups in that it:
A ✓Is a managed, stateful firewall service with centralised rules, threat intelligence, and FQDN filtering across VNets
BIs free while NSGs cost money
COnly works on-premises
DReplaces the need for identity management
Explanation: Azure Firewall is a fully managed network security service: centralised policy, FQDN/application rules, threat intelligence feeds, SNAT/DNAT. NSGs are simpler distributed packet filters on subnets/NICs. Many architectures use both.
Question 14 of 40Azure Architecture & Services
A global app needs one entry point that routes each user to the nearest healthy backend region, with automatic failover if a region dies. Which service category provides global HTTP load balancing?
A ✓Azure Front Door (global layer-7 routing)
BA single regional Load Balancer
CAzure Files
DAzure Bastion
Explanation: Front Door is Azure's global HTTP(S) entry point — latency-based routing to the nearest healthy backend, instant regional failover, WAF integration. Regional Load Balancer works within one region only.
Question 15 of 40Azure Architecture & Services
What is the purpose of Azure ExpressRoute's higher SLA compared to VPN connections?
A ✓Private dedicated circuits offer more predictable performance and reliability than internet-dependent VPN tunnels
BExpressRoute is always cheaper
CVPNs cannot encrypt traffic
DExpressRoute works without any physical connection
Explanation: ExpressRoute's dedicated private circuits avoid internet variability — delivering consistent latency, higher bandwidth, and stronger SLAs. VPNs encrypt well but ride the unpredictable public internet. ExpressRoute costs more, not less.
Question 16 of 40Azure Architecture & Services
A startup's PostgreSQL VM requires weekend patching, backup scripting, and failover configuration — consuming a day per week of engineer time. What is the Azure-native remedy?
A ✓Migrate to Azure Database for PostgreSQL, where patching, backups, and HA are managed by the platform
BHire more engineers
CStop patching the database
DMove the VM to a bigger size
Explanation: Managed database services absorb undifferentiated operational toil — automated patching, backups, and high availability — freeing engineers for product work. This IaaS→PaaS migration is one of the most common cloud optimisations.
Question 17 of 40Azure Architecture & Services
Which service enables querying and analysing massive datasets using a combination of data warehousing and big data analytics?
A ✓Azure Synapse Analytics
BAzure Bastion
CAzure Key Vault
DAzure DNS
Explanation: Synapse Analytics unifies enterprise data warehousing and big data analytics — SQL and Spark engines over petabyte-scale data with integrated pipelines and BI connectivity.
Question 18 of 40Azure Architecture & Services
A logistics firm wants a chatbot answering customer delivery queries using natural language, built without training AI models from scratch. Which Azure offering accelerates this?
A ✓Azure AI services — pre-built language and conversational AI capabilities (e.g. Azure AI Language, Azure OpenAI Service)
BAzure Disk Storage
CNetwork Security Groups
DAzure DNS zones
Explanation: Azure AI services expose pre-trained models via API — language understanding, OpenAI GPT models, speech — letting teams build conversational AI without ML expertise or model training.
Question 19 of 40Azure Architecture & Services
Which capability lets an Azure VM authenticate to Key Vault WITHOUT any stored credentials?
A ✓Managed identity assigned to the VM
BA password in a config file
CSharing the subscription owner's account
DDisabling Key Vault authentication
Explanation: Managed identities give Azure resources an Entra ID identity managed by the platform — the VM requests tokens automatically, Key Vault authorises via RBAC/access policy, and no secret ever exists to leak.
Question 20 of 40Azure Architecture & Services
An organisation's security team wants to review risky sign-ins — impossible travel, anonymous IPs, leaked credentials. Which Entra capability surfaces identity risk?
A ✓Microsoft Entra ID Protection
BAzure CDN
CCost Management
DAzure Backup
Explanation: Entra ID Protection detects identity risks — impossible travel, unfamiliar locations, credential leaks — scoring users and sign-ins, and can automate responses like forced MFA or password reset through Conditional Access.
Question 21 of 40Azure Architecture & Services
Which principle grants users ONLY the permissions required for their job, nothing more?
A ✓Least privilege
BMaximum availability
CDefence in depth
DElastic scaling
Explanation: Least privilege limits each identity to the minimum permissions their role needs — shrinking blast radius when accounts are compromised. RBAC's granular built-in roles exist to implement exactly this.
Question 22 of 40Management & Governance
Developers keep deploying expensive VM sizes in dev environments. Policy should permit only B-series and D-series VMs in the Dev subscription while leaving Production unrestricted. How?
A ✓Assign an 'allowed VM SKUs' Azure Policy at the Dev subscription scope only
BEmail developers a request
CApply the policy at the management group covering both subscriptions
DDelete the Dev subscription
Explanation: Policies apply at chosen scopes: assigning the SKU restriction at the Dev subscription enforces it there while Production (outside that scope) stays unrestricted. Management-group assignment would wrongly constrain Production too.
Question 23 of 40Management & Governance
What is an Azure Policy 'initiative'?
A ✓A group of related policy definitions managed and assigned as one unit
BA marketing campaign
CA type of virtual machine
DA budget alert
Explanation: Initiatives bundle multiple policies for a goal — e.g. an ISO 27001 initiative containing dozens of definitions — assigned and tracked together, keeping compliance manageable at scale.
Question 24 of 40Management & Governance
The IT director wants spending alerts at 50%, 80%, and 100% of a $10,000 monthly budget, notifying different people at each threshold. Is this possible, and how?
A ✓Yes — Cost Management budgets support multiple alert thresholds, each with its own notification recipients
BNo — only one alert per budget is allowed
COnly at exactly 100%
DBudgets automatically stop all resources at the limit
Explanation: Budgets support multiple percentage thresholds with distinct action groups/recipients per threshold. Note: budgets ALERT by default — they don't stop resources unless you wire automation to do so.
Question 25 of 40Management & Governance
Which is TRUE about Azure free account offerings?
A ✓They include popular services free for 12 months, always-free services, and initial credit — subject to limits
BEverything in Azure is free forever
CFree accounts require a 3-year commitment
DFree tiers have no usage limits
Explanation: The free account offers time-limited free amounts of popular services, a set of always-free services, and starting credit — all within usage caps. Exceeding limits incurs charges (with spending safeguards for new accounts).
Question 26 of 40Management & Governance
An enterprise negotiates Azure pricing through a Microsoft Enterprise Agreement. A freelancer pays with a credit card at standard rates. What does this illustrate about Azure purchasing?
A ✓Azure offers multiple purchase channels — direct pay-as-you-go, Enterprise Agreements, and Cloud Solution Providers — with differing pricing and terms
BEveryone pays identical prices
COnly enterprises may use Azure
DCredit cards are prohibited
Explanation: Azure supports several commerce channels: web direct (PAYG), Enterprise Agreements (negotiated commitments for large organisations), and CSP partners (bundled with partner services). Pricing and support vary by channel.
Question 27 of 40Management & Governance
Which Azure Monitor component collects and stores log data for querying with KQL (Kusto Query Language)?
A ✓Log Analytics workspace
BAzure Marketplace
CResource tags
DAzure DNS
Explanation: Log Analytics workspaces store log telemetry from resources, agents, and services; KQL queries analyse it for troubleshooting, dashboards, and alert rules — the analytical core of Azure Monitor logs.
Question 28 of 40Management & Governance
Before migrating 200 on-premises servers, a company must inventory them, assess Azure readiness, and estimate right-sized costs. Which Azure service performs discovery and assessment?
A ✓Azure Migrate
BAzure Bastion
CAzure CDN
DAzure Front Door
Explanation: Azure Migrate discovers on-premises servers, assesses compatibility, right-sizes target VMs, estimates costs, and orchestrates migration — the central hub for migration projects.
Question 29 of 40Management & Governance
What happens to Azure Policy compliance when a policy is assigned to a scope containing EXISTING non-compliant resources?
A ✓Existing resources are marked non-compliant in reporting; deny policies affect only new/updated deployments unless remediation is configured
BExisting resources are instantly deleted
CExisting resources are exempt forever
DAzure blocks the policy assignment
Explanation: Policy evaluates existing resources and reports non-compliance; deny effects gate future operations. Remediation tasks (deployIfNotExists/modify) can bring existing resources into compliance — deletion never happens automatically.
Question 30 of 40Cloud Concepts
A CFO compares: on-premises servers depreciate over 5 years regardless of use, while Azure charges stop when workloads stop. Which financial risk does cloud REMOVE?
A ✓The risk of capital sunk into over-provisioned or underused hardware
BThe risk of any IT spending at all
CThe need for budgeting
DSoftware licensing costs
Explanation: OpEx consumption pricing eliminates stranded capital: stop the workload, stop the cost. On-premises hardware costs persist whether used or not. Cloud doesn't remove spending or budgeting — it aligns cost with usage.
Question 31 of 40Azure Architecture & Services
Which Azure service provides a Web Application Firewall (WAF) to protect against common web exploits like SQL injection?
A ✓WAF on Application Gateway or Azure Front Door
BAzure Files
CAzure Advisor
DCost Management
Explanation: WAF deploys with Application Gateway (regional) or Front Door (global), inspecting HTTP traffic against OWASP rulesets — blocking SQL injection, cross-site scripting, and other layer-7 attacks before they reach the application.
Question 32 of 40Azure Architecture & Services
A hospital app must encrypt patient data at rest with keys the HOSPITAL controls and can revoke — not Microsoft-managed keys. Which capability satisfies this?
A ✓Customer-managed keys stored in Azure Key Vault
BTurning off all encryption
CStoring keys in application source code
DUsing only default platform-managed keys
Explanation: Customer-managed keys (CMK) in Key Vault give the customer control of key lifecycle — creation, rotation, revocation. Revoking the key renders data unreadable even to Microsoft. Default platform keys don't provide customer revocation control.
Question 33 of 40Management & Governance
Which portal feature lets you build customised visual displays of resource metrics, charts, and shortcuts on the Azure home experience?
A ✓Azure dashboards
BAzure invoices
CMarketplace listings
DSupport tickets
Explanation: Azure dashboards are customisable portal canvases combining metrics charts, resource lists, and shortcuts — shareable with teams via RBAC for operational visibility.
Question 34 of 40Management & Governance
After enabling Defender for Cloud, a company receives a 'Secure Score' of 54%. What does this score represent?
A ✓A measurement of security posture based on how many recommended controls are implemented
BThe percentage of the Azure bill spent on security
CExam results for the IT team
DNetwork bandwidth utilisation
Explanation: Secure Score quantifies security posture: implemented recommendations raise the score toward 100%. It prioritises hardening actions by impact — a roadmap for improving cloud security systematically.
Question 35 of 40Cloud Concepts
Which statement about multi-cloud is accurate?
A ✓Using services from multiple public cloud providers (e.g. Azure AND AWS) simultaneously
BUsing multiple Azure regions
CHaving several Azure subscriptions
DRunning both Windows and Linux VMs
Explanation: Multi-cloud means consuming multiple providers' clouds — often for resilience, negotiating leverage, or best-of-breed services. Multiple regions/subscriptions within Azure is still single-cloud.
Question 36 of 40Azure Architecture & Services
A developer needs their web app to automatically get more instances when CPU exceeds 70% and fewer when below 30%. Which App Service capability configures this?
A ✓Autoscale rules based on metrics
BManual daily resizing
CDeleting the app at night
DA ReadOnly resource lock
Explanation: Autoscale rules define metric-driven instance scaling: scale out above CPU 70%, scale in below 30%, with min/max bounds. The platform adjusts automatically — elasticity configured declaratively.
Question 37 of 40Management & Governance
Who can access resources when an RBAC 'Reader' role is assigned at a resource group?
A ✓The assignee can view all resources in that group but cannot create, modify, or delete anything
BThe assignee gets full control
CThe assignee can delete resources only
DNobody can view anything
Explanation: Reader grants view-only access at its scope — see configurations and metrics, change nothing. It's the least-privileged built-in role for stakeholders needing visibility without control.
Question 38 of 40Management & Governance
A consultant needs Azure access for a 3-month project only. Security wants access to expire automatically. Which Entra ID capability suits time-bound external access?
A ✓Guest access (B2B) with access reviews / time-limited assignment
BCreating a permanent employee account
CSharing an existing admin's password
DNo access management is possible
Explanation: Entra B2B invites external identities as guests; access reviews and PIM time-bound assignments ensure access expires or gets re-justified — governed external collaboration without permanent accounts or shared credentials.
Question 39 of 40Azure Architecture & Services
Which option BEST describes Azure Virtual Machine Scale Sets?
A ✓A service that deploys and manages a group of identical, auto-scaling VMs behind load balancing
BA single extra-large VM
CA backup service
DA billing report
Explanation: Scale Sets manage fleets of identical VMs with integrated autoscaling and load balancing — the IaaS pattern for horizontally scaling stateless workloads without managing individual instances.
Question 40 of 40Management & Governance
An organisation wants new subscriptions to start compliant: standard policies, RBAC, and networking deployed automatically at creation. Which governance capability enables repeatable, governed environments?
A ✓Deployment templates/landing zones (e.g. via Bicep/Template Specs) applied through management group policy — the Azure landing zone approach
BManually configuring each subscription from a checklist
CHoping teams follow the wiki
DOne shared subscription for everyone
Explanation: Azure landing zones codify governed environments — policies, RBAC, networking as code — applied via management-group inheritance and IaC templates, so every new subscription is born compliant rather than remediated later.