60 questions / 10 random questions
Random questions, instant feedback, and review for missed questions.
Multiple departments are adopting Azure. You need common governance while delegating control by subscription. Which foundation is most appropriate?
Answer: A landing zone using a management group hierarchy and Azure Policy
A landing zone organizes management groups and subscriptions, applies policy guardrails at higher scopes, and delegates workload ownership.
Many workload subscriptions share the same governance requirements. Where should Azure Policy normally be assigned for maintainable inheritance?
Answer: The management group containing the target subscriptions
Assign shared policies or initiatives at the management group so descendants inherit them, while explicitly governing exceptions.
A production workload must tolerate an availability-zone failure. What is the appropriate baseline for a stateless application tier?
Answer: Distribute instances across zones and use a zone-redundant entry point
Zone resilience requires distributing both compute and ingress across zones and externalizing state so another zone can continue serving.
You need one public endpoint for global HTTP applications, with WAF and fast global failover. Which service fits?
Answer: Azure Front Door
Azure Front Door is a global layer-7 entry point integrating Anycast, HTTP routing, health probes, and WAF.
A VNet must access a storage account by private IP while public network access is disabled. What additional design is critical?
Answer: Configure a private endpoint and Private DNS resolution
Private endpoints require DNS design so the normal service FQDN resolves to the private IP; hybrid environments also need DNS forwarding.
Many spoke VNets share a firewall, DNS, and on-premises connectivity. Which topology best supports separation of responsibilities?
Answer: A hub in a connectivity subscription with workload-specific spokes
Hub-spoke centralizes shared connectivity services under the platform team while isolating workloads in spokes and subscriptions.
Privileged administrator roles must not remain permanently active and should require approval and MFA for limited activation. What should you use?
Answer: Microsoft Entra Privileged Identity Management
PIM manages eligible roles and supports just-in-time activation with duration, approval, MFA, and justification controls.
You want to minimize credential operations for an application accessing Key Vault. Which approach is preferred?
Answer: Use managed identity and grant least privilege on Key Vault
Managed identity obtains Entra ID tokens without app-held long-lived credentials; data-plane permissions should be limited to required operations.
Azure Monitor Agent collects Windows events from many VMs, and unwanted events should be filtered before ingestion. What is central to the design?
Answer: A data collection rule and its associations
A DCR defines sources, transformations, and destinations, while DCR associations bind it to resources; pre-ingestion filtering can reduce storage cost.
You want fewer false alerts from one-off spikes and detection of deviations from normal trends. What should you consider?
Answer: Tune dynamic thresholds and evaluation windows to workload behavior
Dynamic thresholds learn historical behavior; tune them with evaluation frequency and windows using production data to balance sensitivity and noise.
You need to query resources with public IPs and missing tags across many subscriptions. Which service is appropriate?
Answer: Azure Resource Graph
Azure Resource Graph efficiently inventories resource configuration across many subscriptions using a KQL-style query language.
Azure SQL Database needs a readable replica in another region and managed failover for regional outages. Which feature fits?
Answer: Failover group
Azure SQL failover groups manage cross-region database replication and read-write listeners, supporting planned and automatic failover.
Even if a backup administrator account is compromised, protected data should resist immediate deletion. Which Azure Backup capability should be prioritized?
Answer: Vault immutability and multi-user authorization
Vault immutability resists modification or deletion, while multi-user authorization requires separate approval for critical operations.
On-premises VMs need disaster recovery to Azure with regular RPO/RTO validation. What service and practice are central?
Answer: Configure Azure Site Recovery and regularly run nondisruptive test failovers
Site Recovery manages replication and recovery plans; test failovers validate dependencies and procedures against RTO without affecting production.
Which AKS design best helps applications remain available during node failures and upgrades?
Answer: Configure multiple replicas, topology spread, and PodDisruptionBudgets to match requirements
Spread replicas across failure domains, use PDBs to preserve availability during voluntary disruptions, and route only to ready pods.
AKS pods need Azure service access without storing long-lived client secrets in Kubernetes Secrets. What is recommended?
Answer: Use Microsoft Entra Workload ID
Workload ID federates a Kubernetes service account with Entra ID so pods can obtain tokens without long-lived secrets.
Before purchasing a commitment for stable VM workloads, what should you do first to reduce cost responsibly?
Answer: Analyze utilization, runtime, rightsizing, and forecast demand
First remove waste and overprovisioning and establish durable baseline usage, then compare reservation and savings-plan flexibility and discounts.
Teams need monthly budget alerts, while recognizing that an alert doesn't inherently stop VMs. Which statement is correct?
Answer: Use a Cost Management budget for alerts and, if needed, connect carefully controlled automation through an action group
Budgets primarily notify on actual or forecast spend; shutdown automation requires separate logic designed for business impact, permissions, and idempotency.
You need lower change failure rates and limited impact when releases fail. Which Well-Architected operational practice fits?
Answer: Design progressive rollout, health evaluation, and automated halt or rollback
Safe deployment practices begin with a small scope, use observed health as an expansion gate, and automate halt and recovery on failure.
An architecture review requires justification for a 99.99% availability target. What is the best approach?
Answer: Evaluate user flows, dependencies, composite SLA, redundancy, and recovery procedures
Workload availability depends on services and configuration; map dependencies per critical user flow and evaluate composite SLA, measured SLIs, and recovery capability.
A regional internet-facing web app needs TLS termination, path-based routing, and WAF. Which service fits?
Answer: Azure Application Gateway WAF
Application Gateway is a regional layer-7 load balancer providing TLS termination, URL routing, and WAF.
You need DNS-based distribution across public endpoints in multiple regions for arbitrary protocols, without an HTTP proxy. What fits?
Answer: Azure Traffic Manager
Traffic Manager uses DNS responses to direct clients to healthy public endpoints; because it isn't a proxy, failover behavior is affected by DNS caching and TTL.
After forcing traffic through Azure Firewall, some PaaS return paths became asymmetric. What design element should be checked first?
Answer: The combination of UDRs, BGP route propagation, next hops, and SNAT
Asymmetry occurs when route tables, gateway-learned routes, and firewall SNAT behavior disagree; inspect effective routes and next hops.
Azure Monitor ingestion and queries must use private connectivity and limit exfiltration to unapproved workspaces. What should be configured?
Answer: Design an Azure Monitor Private Link Scope with Private Only access
AMPLS groups Azure Monitor resources behind a Private Link boundary; Private Only can restrict a connected VNet from reaching monitoring resources outside that scope.
Defender for Cloud recommendations and security standards must be applied consistently across many subscriptions. What is the appropriate management approach?
Answer: Codify policy initiatives and Defender settings at management-group scope
Use management-group policy initiatives and IaC to inherit standards and detect or remediate drift in Defender plans and monitoring settings.
A SOC is overwhelmed by high volumes of low-quality Microsoft Sentinel alerts. What is an appropriate first improvement?
Answer: Tune analytics by use case, entities, and severity, then triage with automation rules
Tune detections and exclusions against the threat model, group related alerts into incidents, and automate classification of known low-risk events.
Existing noncompliant resources should be remediated by Azure Policy using a managed identity. Which effects support this?
Answer: modify or deployIfNotExists
Modify and deployIfNotExists can use the assignment's managed identity and permissions to change or add configuration; existing resources need a remediation task.
Production resources must be protected from accidental deletion while normal application updates remain allowed. Which resource lock fits?
Answer: Apply CanNotDelete at the appropriate scope
CanNotDelete permits updates but blocks deletion; because locks affect authorized users too, govern unlock permissions and procedures.
A regional outage target is RTO 15 minutes and RPO 5 minutes. What should be verified before assuming backup alone is sufficient?
Answer: Measure restore time, backup frequency, dependencies, and failover procedures
Backup existence doesn't prove RTO/RPO; rehearse restoration at realistic scale and the full procedure including network, identity, and DNS dependencies.
An Azure App Service version needs near-zero-downtime release, prevalidation, and quick rollback. Which feature should be used?
Answer: Deployment slots and swap
Deploy to another slot, warm and validate it, then swap into production; also design slot-specific settings and backward-compatible database changes.
Distributed traces are needed to identify which dependency API or database call causes latency. What capability is central?
Answer: Application Insights transaction search and dependency telemetry
Application Insights correlates requests, dependencies, exceptions, and traces to follow end-to-end execution and locate latency.
During an incident, you need to know whether Azure has a regional service degradation affecting your resources. What should be checked first?
Answer: Azure Service Health and Resource Health
Service Health reports Azure events relevant to your services, while Resource Health shows individual resource state; correlate both with workload telemetry.
A landing-zone IaC pipeline needs privileged deployment access without storing a fixed client secret. Which authentication approach is appropriate?
Answer: Workload identity federation using OIDC
Workload identity federation trusts the CI/CD OIDC token in Entra ID and obtains short-lived access tokens without a long-lived secret.
Before applying IaC, you want to detect Azure Policy violations and risky changes, then require approval for production. Which pipeline design fits?
Answer: Stage linting, validation, what-if/plan, policy checks, approval, and apply
Run static checks, change previews, and policy evaluation first; protect production with approvals and monitor drift after deployment.
Subscription provisioning should be self-service while consistently applying networking, policy, budgets, and logging. What mechanism fits?
Answer: Automate IaC-based subscription vending with approved templates
Subscription vending reproducibly configures management-group placement, RBAC, connectivity, policy, budgets, and diagnostics from request data.
You need to connect many branches and VNets through a Microsoft-managed hub and simplify routing. Which service should be considered?
Answer: Azure Virtual WAN
Virtual WAN uses Microsoft-managed virtual hubs to provide scalable branch, VPN, ExpressRoute, and VNet connectivity with routing controls.
OS updates for VMs across subscriptions need centralized visibility and controlled maintenance windows. Which service fits?
Answer: Azure Update Manager
Azure Update Manager centrally assesses, schedules, and reports updates for Azure VMs and Azure Arc-enabled servers.
Azure Storage data must survive a regional outage and be readable from the secondary region. Which redundancy option fits?
Answer: Choose RA-GRS or RA-GZRS according to requirements
RA-GRS and RA-GZRS asynchronously replicate to another region and expose read access to the secondary; evaluate RPO, consistency, and failover behavior.
You want to validate automated recovery from a zone failure without causing an uncontrolled business outage. What is appropriate?
Answer: Run a game day with limited scope, abort criteria, monitoring, and rollback
A controlled game day defines hypotheses, blast radius, abort conditions, and success metrics to test recovery automation under realistic conditions.
A Well-Architected review finds that added redundancy improves availability but raises cost and operational complexity. How should the decision be made?
Answer: Document pillar tradeoffs based on business impact, SLOs, RTO/RPO, and risk tolerance
Well-Architected is not a checklist for maximizing everything; use business requirements to make explicit tradeoffs among reliability, cost, operational excellence, and other pillars.
A central network team must enforce common high-risk port denies across many VNets while workload teams retain subnet NSG control. Which feature fits?
Answer: Azure Virtual Network Manager security admin rules
Security admin rules apply central policy to VNets in network groups and are evaluated before NSGs, enabling layered central and workload controls.
On-premises must resolve Azure Private DNS zones, and Azure must conditionally forward corporate domains while minimizing DNS VMs. Which design fits?
Answer: Azure DNS Private Resolver inbound and outbound endpoints with a forwarding ruleset
Private Resolver accepts private DNS queries through an inbound endpoint and forwards selected domains through an outbound endpoint and ruleset.
Many VMs in a private subnet experience outbound SNAT port exhaustion and require stable outbound IPs. What is the primary measure?
Answer: Associate Azure NAT Gateway with the subnet and provision sufficient public IP capacity
NAT Gateway provides managed SNAT and stable public IPs for subnet outbound traffic. Size it using metrics, connection reuse, and destination concurrency.
Public-IP workloads across multiple VNets need large-scale DDoS protection, cost protection, and expert response support. Which option is appropriate?
Answer: Apply Azure DDoS Network Protection to the VNets and establish a response plan
DDoS Network Protection provides adaptive layer 3/4 mitigation, telemetry, cost protection, and expert support. Use WAF for application-layer threats too.
Privileged portal operations must allow only phishing-resistant MFA methods. Which control is central?
Answer: Require an authentication strength in Conditional Access
Conditional Access authentication strengths constrain accepted authentication method combinations for selected users, apps, and conditions.
While standardizing Key Vault permissions on Azure RBAC, management-plane and secret data-plane access must remain separate. Which approach is appropriate?
Answer: Assign data-plane built-in roles at the required scope separately from management roles
Key Vault Azure RBAC separates resource management from vault data operations. Assign least-privilege data roles such as Secrets User at the required scope.
A storage account uses a customer-managed key in Key Vault and should automatically adopt rotated key versions. Which configuration is appropriate?
Answer: Grant the managed identity required access and configure a versionless key URI
A managed identity with key permissions and a versionless URI lets the service follow rotated key versions. Validate propagation and rollback.
A managed service provider must operate delegated scopes across customer Azure tenants from its own tenant. Which service is appropriate?
Answer: Delegate cross-tenant management with Azure Lighthouse
Azure Lighthouse lets customers delegate subscription or resource-group scopes to identities in a provider tenant for cross-tenant management.
Prometheus-format metrics from AKS should be managed and visualized across clusters in Grafana dashboards. Which combination is recommended?
Answer: Azure Monitor managed service for Prometheus and Azure Managed Grafana
Managed Prometheus collects and stores Prometheus-compatible metrics in Azure Monitor, and Managed Grafana queries and visualizes them.
Azure platform logs must stream near real time to an external SIEM while also being retained in Log Analytics. Which configuration is central?
Answer: Use diagnostic settings with Log Analytics workspace and Event Hub destinations
Diagnostic settings route resource logs and platform metrics to Log Analytics, Event Hubs, Storage, and other destinations. Monitor categories, retention, and delivery failures.
Teams need automatic notification of Azure service incidents and planned maintenance affecting their subscriptions. Which option is most appropriate?
Answer: Connect Service Health alerts to an action group
Service Health reports subscription-relevant service issues, planned maintenance, and advisories. Alert rules and action groups notify operational channels.
AKS automatic upgrades should occur in lower-impact periods. Which statement about planned maintenance is correct?
Answer: Define preferred windows and separately design upgrade settings and workload resilience
Planned maintenance is a best-effort scheduling control for cluster and node-image upgrades. Auto-upgrade enablement and workload resilience remain separate.
An AKS queue consumer should scale from zero according to message count. Which mechanism is appropriate?
Answer: Configure a queue trigger with a KEDA ScaledObject
KEDA scales Kubernetes workloads from event-source metrics and can scale supported workloads to zero. Configure authentication, polling, and cooldown.
Ten percent of Azure Container Apps traffic should go to a new revision and increase after metric validation. Which approach fits?
Answer: Use multiple-revision mode and configure revision weights
Multiple-revision mode splits traffic by percentage among active revisions. Also manage immutable images, health signals, and rollback criteria.
Events for the same order ID must be processed in order by one consumer while different orders run concurrently. Which Service Bus feature fits?
Answer: Service Bus sessions using the order ID as SessionId
Service Bus sessions let a receiver exclusively process messages sharing a SessionId while different sessions run concurrently.
A lost send acknowledgment may cause a business message to be retried. Service Bus should suppress duplicate sends within a time window. Which approach fits?
Answer: Enable duplicate detection and use a repeatable business-derived MessageId
Duplicate detection drops repeated MessageIds within its window. Consumers should still make side effects idempotent for end-to-end safety.
A multi-region Cosmos DB app needs read-your-writes within each user session without the latency cost of strong consistency. Which level fits?
Answer: Session consistency with session-token propagation
Session consistency provides monotonic reads, monotonic writes, and read-your-writes within a session. Propagate session tokens across stateless tiers.
One Cosmos DB tenant dominates traffic, making a single logical partition hot and causing concentrated 429 responses. What is the primary redesign?
Answer: Consider a synthetic or hierarchical partition key with enough cardinality to distribute load
The partition key controls data and RU distribution. Add a shard dimension so hot tenants span logical partitions while preserving efficient queries.
Audit logs must remain in WORM storage so even administrators cannot modify or delete them during the regulatory period. Which feature fits?
Answer: Lock a time-based retention policy in immutable Blob storage
A locked time-based retention policy enforces WORM behavior during the period. Test operations before locking because rollback is restricted.
Bicep-managed resources should be tracked as one unit with detach/delete behavior and write protection when resources leave the definition. Which feature fits?
Answer: Use Azure deployment stacks with designed actionOnUnmanage and deny settings
Deployment stacks track template-managed resources as a unit and configure detach/delete actions plus deny assignments. Design exclusions carefully.