40 questions / 10 random questions
Random questions, instant feedback, and review for missed questions.
Multiple departments are adopting Azure. You need common governance while delegating control by subscription. Which foundation is most appropriate?
Answer: A landing zone using a management group hierarchy and Azure Policy
A landing zone organizes management groups and subscriptions, applies policy guardrails at higher scopes, and delegates workload ownership.
Many workload subscriptions share the same governance requirements. Where should Azure Policy normally be assigned for maintainable inheritance?
Answer: The management group containing the target subscriptions
Assign shared policies or initiatives at the management group so descendants inherit them, while explicitly governing exceptions.
A production workload must tolerate an availability-zone failure. What is the appropriate baseline for a stateless application tier?
Answer: Distribute instances across zones and use a zone-redundant entry point
Zone resilience requires distributing both compute and ingress across zones and externalizing state so another zone can continue serving.
You need one public endpoint for global HTTP applications, with WAF and fast global failover. Which service fits?
Answer: Azure Front Door
Azure Front Door is a global layer-7 entry point integrating Anycast, HTTP routing, health probes, and WAF.
A VNet must access a storage account by private IP while public network access is disabled. What additional design is critical?
Answer: Configure a private endpoint and Private DNS resolution
Private endpoints require DNS design so the normal service FQDN resolves to the private IP; hybrid environments also need DNS forwarding.
Many spoke VNets share a firewall, DNS, and on-premises connectivity. Which topology best supports separation of responsibilities?
Answer: A hub in a connectivity subscription with workload-specific spokes
Hub-spoke centralizes shared connectivity services under the platform team while isolating workloads in spokes and subscriptions.
Privileged administrator roles must not remain permanently active and should require approval and MFA for limited activation. What should you use?
Answer: Microsoft Entra Privileged Identity Management
PIM manages eligible roles and supports just-in-time activation with duration, approval, MFA, and justification controls.
You want to minimize credential operations for an application accessing Key Vault. Which approach is preferred?
Answer: Use managed identity and grant least privilege on Key Vault
Managed identity obtains Entra ID tokens without app-held long-lived credentials; data-plane permissions should be limited to required operations.
Azure Monitor Agent collects Windows events from many VMs, and unwanted events should be filtered before ingestion. What is central to the design?
Answer: A data collection rule and its associations
A DCR defines sources, transformations, and destinations, while DCR associations bind it to resources; pre-ingestion filtering can reduce storage cost.
You want fewer false alerts from one-off spikes and detection of deviations from normal trends. What should you consider?
Answer: Tune dynamic thresholds and evaluation windows to workload behavior
Dynamic thresholds learn historical behavior; tune them with evaluation frequency and windows using production data to balance sensitivity and noise.
You need to query resources with public IPs and missing tags across many subscriptions. Which service is appropriate?
Answer: Azure Resource Graph
Azure Resource Graph efficiently inventories resource configuration across many subscriptions using a KQL-style query language.
Azure SQL Database needs a readable replica in another region and managed failover for regional outages. Which feature fits?
Answer: Failover group
Azure SQL failover groups manage cross-region database replication and read-write listeners, supporting planned and automatic failover.
Even if a backup administrator account is compromised, protected data should resist immediate deletion. Which Azure Backup capability should be prioritized?
Answer: Vault immutability and multi-user authorization
Vault immutability resists modification or deletion, while multi-user authorization requires separate approval for critical operations.
On-premises VMs need disaster recovery to Azure with regular RPO/RTO validation. What service and practice are central?
Answer: Configure Azure Site Recovery and regularly run nondisruptive test failovers
Site Recovery manages replication and recovery plans; test failovers validate dependencies and procedures against RTO without affecting production.
Which AKS design best helps applications remain available during node failures and upgrades?
Answer: Configure multiple replicas, topology spread, and PodDisruptionBudgets to match requirements
Spread replicas across failure domains, use PDBs to preserve availability during voluntary disruptions, and route only to ready pods.
AKS pods need Azure service access without storing long-lived client secrets in Kubernetes Secrets. What is recommended?
Answer: Use Microsoft Entra Workload ID
Workload ID federates a Kubernetes service account with Entra ID so pods can obtain tokens without long-lived secrets.
Before purchasing a commitment for stable VM workloads, what should you do first to reduce cost responsibly?
Answer: Analyze utilization, runtime, rightsizing, and forecast demand
First remove waste and overprovisioning and establish durable baseline usage, then compare reservation and savings-plan flexibility and discounts.
Teams need monthly budget alerts, while recognizing that an alert doesn't inherently stop VMs. Which statement is correct?
Answer: Use a Cost Management budget for alerts and, if needed, connect carefully controlled automation through an action group
Budgets primarily notify on actual or forecast spend; shutdown automation requires separate logic designed for business impact, permissions, and idempotency.
You need lower change failure rates and limited impact when releases fail. Which Well-Architected operational practice fits?
Answer: Design progressive rollout, health evaluation, and automated halt or rollback
Safe deployment practices begin with a small scope, use observed health as an expansion gate, and automate halt and recovery on failure.
An architecture review requires justification for a 99.99% availability target. What is the best approach?
Answer: Evaluate user flows, dependencies, composite SLA, redundancy, and recovery procedures
Workload availability depends on services and configuration; map dependencies per critical user flow and evaluate composite SLA, measured SLIs, and recovery capability.
A regional internet-facing web app needs TLS termination, path-based routing, and WAF. Which service fits?
Answer: Azure Application Gateway WAF
Application Gateway is a regional layer-7 load balancer providing TLS termination, URL routing, and WAF.
You need DNS-based distribution across public endpoints in multiple regions for arbitrary protocols, without an HTTP proxy. What fits?
Answer: Azure Traffic Manager
Traffic Manager uses DNS responses to direct clients to healthy public endpoints; because it isn't a proxy, failover behavior is affected by DNS caching and TTL.
After forcing traffic through Azure Firewall, some PaaS return paths became asymmetric. What design element should be checked first?
Answer: The combination of UDRs, BGP route propagation, next hops, and SNAT
Asymmetry occurs when route tables, gateway-learned routes, and firewall SNAT behavior disagree; inspect effective routes and next hops.
Azure Monitor ingestion and queries must use private connectivity and limit exfiltration to unapproved workspaces. What should be configured?
Answer: Design an Azure Monitor Private Link Scope with Private Only access
AMPLS groups Azure Monitor resources behind a Private Link boundary; Private Only can restrict a connected VNet from reaching monitoring resources outside that scope.
Defender for Cloud recommendations and security standards must be applied consistently across many subscriptions. What is the appropriate management approach?
Answer: Codify policy initiatives and Defender settings at management-group scope
Use management-group policy initiatives and IaC to inherit standards and detect or remediate drift in Defender plans and monitoring settings.
A SOC is overwhelmed by high volumes of low-quality Microsoft Sentinel alerts. What is an appropriate first improvement?
Answer: Tune analytics by use case, entities, and severity, then triage with automation rules
Tune detections and exclusions against the threat model, group related alerts into incidents, and automate classification of known low-risk events.
Existing noncompliant resources should be remediated by Azure Policy using a managed identity. Which effects support this?
Answer: modify or deployIfNotExists
Modify and deployIfNotExists can use the assignment's managed identity and permissions to change or add configuration; existing resources need a remediation task.
Production resources must be protected from accidental deletion while normal application updates remain allowed. Which resource lock fits?
Answer: Apply CanNotDelete at the appropriate scope
CanNotDelete permits updates but blocks deletion; because locks affect authorized users too, govern unlock permissions and procedures.
A regional outage target is RTO 15 minutes and RPO 5 minutes. What should be verified before assuming backup alone is sufficient?
Answer: Measure restore time, backup frequency, dependencies, and failover procedures
Backup existence doesn't prove RTO/RPO; rehearse restoration at realistic scale and the full procedure including network, identity, and DNS dependencies.
An Azure App Service version needs near-zero-downtime release, prevalidation, and quick rollback. Which feature should be used?
Answer: Deployment slots and swap
Deploy to another slot, warm and validate it, then swap into production; also design slot-specific settings and backward-compatible database changes.
Distributed traces are needed to identify which dependency API or database call causes latency. What capability is central?
Answer: Application Insights transaction search and dependency telemetry
Application Insights correlates requests, dependencies, exceptions, and traces to follow end-to-end execution and locate latency.
During an incident, you need to know whether Azure has a regional service degradation affecting your resources. What should be checked first?
Answer: Azure Service Health and Resource Health
Service Health reports Azure events relevant to your services, while Resource Health shows individual resource state; correlate both with workload telemetry.
A landing-zone IaC pipeline needs privileged deployment access without storing a fixed client secret. Which authentication approach is appropriate?
Answer: Workload identity federation using OIDC
Workload identity federation trusts the CI/CD OIDC token in Entra ID and obtains short-lived access tokens without a long-lived secret.
Before applying IaC, you want to detect Azure Policy violations and risky changes, then require approval for production. Which pipeline design fits?
Answer: Stage linting, validation, what-if/plan, policy checks, approval, and apply
Run static checks, change previews, and policy evaluation first; protect production with approvals and monitor drift after deployment.
Subscription provisioning should be self-service while consistently applying networking, policy, budgets, and logging. What mechanism fits?
Answer: Automate IaC-based subscription vending with approved templates
Subscription vending reproducibly configures management-group placement, RBAC, connectivity, policy, budgets, and diagnostics from request data.
You need to connect many branches and VNets through a Microsoft-managed hub and simplify routing. Which service should be considered?
Answer: Azure Virtual WAN
Virtual WAN uses Microsoft-managed virtual hubs to provide scalable branch, VPN, ExpressRoute, and VNet connectivity with routing controls.
OS updates for VMs across subscriptions need centralized visibility and controlled maintenance windows. Which service fits?
Answer: Azure Update Manager
Azure Update Manager centrally assesses, schedules, and reports updates for Azure VMs and Azure Arc-enabled servers.
Azure Storage data must survive a regional outage and be readable from the secondary region. Which redundancy option fits?
Answer: Choose RA-GRS or RA-GZRS according to requirements
RA-GRS and RA-GZRS asynchronously replicate to another region and expose read access to the secondary; evaluate RPO, consistency, and failover behavior.
You want to validate automated recovery from a zone failure without causing an uncontrolled business outage. What is appropriate?
Answer: Run a game day with limited scope, abort criteria, monitoring, and rollback
A controlled game day defines hypotheses, blast radius, abort conditions, and success metrics to test recovery automation under realistic conditions.
A Well-Architected review finds that added redundancy improves availability but raises cost and operational complexity. How should the decision be made?
Answer: Document pillar tradeoffs based on business impact, SLOs, RTO/RPO, and risk tolerance
Well-Architected is not a checklist for maximizing everything; use business requirements to make explicit tradeoffs among reliability, cost, operational excellence, and other pillars.