Azure Practice Questions & Quiz

In Azure, which logical container is used to group related resources and manage their lifecycle together?

Answer: Resource Group

A Resource Group is a management unit for related Azure resources such as VMs, VNets, and App Services. It is important for lifecycle and permission boundaries.

In Azure, which mechanism lets a VM or App Service authenticate to resources such as Key Vault without storing passwords in code?

Answer: Managed Identity

Managed Identity assigns an identity managed by Microsoft Entra ID to an Azure resource, allowing authentication without storing secrets in application code.

What is the primary purpose of Azure Key Vault?

Answer: To securely manage secrets, keys, and certificates

Key Vault is used to manage connection strings, API keys, cryptographic keys, and certificates. It is commonly combined with Managed Identity.

Which description best matches an Azure VNet?

Answer: A logically isolated private network created in Azure

A VNet is used to design network boundaries together with subnets, NSGs, routes, and Private Endpoints.

What is a practical use of Azure Monitor and Log Analytics?

Answer: To collect and analyze metrics and logs for alerts and visualization

Azure Monitor is central to monitoring. Logs are often collected in a Log Analytics workspace and queried with KQL.

In AKS, which modern method is appropriate for letting Pods securely access services such as Azure Key Vault?

Answer: Use Workload Identity or Managed Identity

In AKS, Workload Identity or Managed Identity lets Pods access Microsoft Entra-protected resources without embedding long-lived secrets.

In Azure, which feature is commonly used to avoid public internet exposure and connect to PaaS services using private IP addresses?

Answer: Private Endpoint

Private Endpoint lets services such as Storage and Key Vault be accessed through private IP addresses inside a VNet. DNS design is also important.

In Azure, you want to publish a web app with less server management. Which PaaS is a common entry-level candidate?

Answer: Azure App Service

Azure App Service is a representative PaaS for running web apps and APIs. It reduces OS and web server management so you can focus on publishing the application.

Which Azure service is commonly used to store files, images, and static content as objects?

Answer: Blob Storage

Blob Storage stores objects such as images, logs, backups, and static files. It is managed through containers inside a Storage Account.

Which Azure identity platform manages users, groups, and application identities?

Answer: Microsoft Entra ID

Microsoft Entra ID is Azure's identity platform. It is involved in authentication and authorization for users, groups, app registrations, and Managed Identity.

In Azure, you want to run small pieces of code triggered by HTTP requests or timers. Which service is appropriate?

Answer: Azure Functions

Azure Functions is a serverless function service. It can run small workloads using HTTP triggers, timer triggers, queue integrations, and more.

In Azure, which feature adds metadata such as environment or team to resources for search and cost classification?

Answer: Tag

Tags add key-value metadata to resources. They are used to organize environment, department, system name, cost allocation, and similar classifications.

You run an internal web app on Azure App Service. As usage grows, you want to increase instances and load-balance traffic across them. Which setting should you look at first?

Answer: Scale out the App Service Plan

App Service instance count is adjusted by scaling out the App Service Plan. Scale up changes the size; scale out increases the number of instances.

A VM in a VNet must access a Storage Account through a private IP without using the public internet. Which design is appropriate?

Answer: Design a Private Endpoint and Private DNS Zone

Private Endpoint lets supported PaaS services be reached through private IP addresses in a VNet. Name resolution is important, so Private DNS Zone design should also be checked.

In Azure, you want to prevent resource creation outside approved regions in a production subscription. Which mechanism is appropriate?

Answer: Azure Policy

Azure Policy evaluates and controls resource configuration rules. It can enforce allowed regions, required tags, SKU restrictions, and similar governance controls.

For Azure SQL Database, you want the application to authenticate securely with its identity instead of hard-coding connection secrets. Which combination is appropriate?

Answer: Managed Identity and Microsoft Entra authentication

Managed Identity with Microsoft Entra authentication lets an application authenticate to Azure SQL without long-lived secrets. Database authentication is still separate from network controls.

You want Azure Monitor to notify you when CPU usage is high. Which feature is the most direct choice?

Answer: Metric alert

For metric-based conditions such as CPU usage, use a metric alert. Notification targets such as email or webhooks are configured through an Action Group.

You are hosting multiple business systems on Azure. You want central management of outbound traffic, auditing, and name resolution while keeping each system network separate. Which design is appropriate?

Answer: Use a Hub-Spoke architecture, centralizing shared services in a Hub VNet and separating systems into Spoke VNets

Hub-Spoke is a common design for separating shared network services from individual systems. Azure Firewall, VPN/ExpressRoute, and DNS can be centralized in the Hub while Spoke boundaries are controlled.

For an Azure business application, you want protection against datacenter-level failures. Which concept distributes VMs and supported services across physically separate locations within a region?

Answer: Availability Zone

Availability Zones are physically separate locations within a region. Zone-redundant services and VM placement across zones improve tolerance to a single datacenter failure.

You want to deliver a web application globally, route users to nearby endpoints, and apply WAF protection. Which Azure service is central to this design?

Answer: Azure Front Door

Azure Front Door acts as a global HTTP/HTTPS entry point with routing, TLS, caching, and WAF capabilities. It is suitable for multi-region web application delivery.

A business system uses Azure SQL Database and must consider recovery from a regional outage. Which design perspective should be decided first?

Answer: Define RTO/RPO and choose backups, geo-replication, and failover approach

In DR design, RTO/RPO are prerequisites for choosing the approach. For Azure SQL, automatic backups, geo-replication, and failover groups should be evaluated against requirements.

Multiple teams use the same Azure environment. You want to separate what network, application, and audit teams can do. Which design is appropriate?

Answer: Define scopes such as management groups, subscriptions, and resource groups, then assign Azure RBAC with least privilege

Azure RBAC assigns permissions at different scopes. Combined with management group and subscription structure, it supports least-privilege separation of duties.

You want to assess security configuration across an Azure environment and review recommendations and Secure Score. Which service is appropriate?

Answer: Microsoft Defender for Cloud

Defender for Cloud assesses cloud security posture and provides recommendations and Secure Score. Defender plans can extend workload protection capabilities.

You want administrative privileges to be activated only when needed after approval and multifactor authentication, rather than assigned permanently. Which feature is appropriate?

Answer: Microsoft Entra Privileged Identity Management

PIM supports just-in-time privileged role activation with approval, MFA, expiration, and auditing. It helps reduce standing high privileges.

An App Service application needs an API key. Which design lets it retrieve the key securely without storing the value directly in code or configuration files?

Answer: Store it in Key Vault and grant the App Service managed identity only the required read permission

Key Vault with managed identity lets the application retrieve secrets without holding fixed credentials. Permissions should be limited to the required secret operations.

You want to allow only HTTPS inbound traffic to a web server subnet and restrict the source to the Application Gateway subnet. Which control is appropriate?

Answer: A Network Security Group inbound rule

NSGs control inbound and outbound traffic for subnets or NICs by source, destination, port, and protocol. Rule priority and default rules must also be considered.

You want stronger mitigation and visibility for an internet-facing service during large-scale DDoS attacks. Which service should be considered?

Answer: Azure DDoS Protection

Azure DDoS Protection strengthens DDoS mitigation and monitoring for public IP resources in a VNet. Layer 7 attacks require complementary controls such as WAF.

You want to regularly apply security updates to multiple Azure VMs and centrally review update status. Which capability is appropriate?

Answer: Azure Update Manager

Azure Update Manager is used to assess, schedule, and monitor updates for VMs. DNS, CDN, and container registry services have different roles.

You want daily backups for Azure VMs retained for 30 days. Which service is central to this?

Answer: Azure Backup

Azure Backup manages backup, retention, and restore for workloads such as VMs and file shares using vaults.

You need RDP/SSH access to Azure VMs without assigning public IP addresses to the VMs. Which service is appropriate?

Answer: Azure Bastion

Azure Bastion provides secure browser-based RDP/SSH access to VMs in a VNet without exposing public IPs on each VM.

You want recommendations across Azure resources for cost reduction, reliability, security, and operations. Which service is appropriate?

Answer: Azure Advisor

Azure Advisor analyzes configurations and provides recommendations for cost, security, reliability, operations, and performance.

You want to connect an on-premises site to an Azure VNet over an internet VPN. Which resource is typically deployed on the VNet side?

Answer: VPN Gateway

VPN Gateway connects Azure VNets to on-premises networks using IPsec/IKE VPN. Dedicated connectivity uses ExpressRoute.

You want centralized traffic control between VNets and on-premises networks using FQDN and network rules. Which service is typically placed in the hub?

Answer: Azure Firewall

Azure Firewall is a managed network security service used in designs such as hub-spoke for traffic control, logging, and threat intelligence integration.

You want Azure Functions to run a batch process at scheduled times. Which trigger is typically configured?

Answer: Timer trigger

A Timer trigger runs Functions on a schedule. HTTP, Queue, Blob, and other triggers are used for other event sources.

You want asynchronous messaging between microservices so messages are retained even if one service is temporarily stopped. Which Azure service is appropriate?

Answer: Azure Service Bus

Azure Service Bus provides enterprise messaging with queues and topics/subscriptions, supporting decoupling and asynchronous processing.

For an Azure Storage Account, you want to block anonymous Blob access from the internet and allow only required paths. Which setting should you check first?

Answer: Blob anonymous access and networking access settings

Storage access design combines anonymous access settings, shared keys, RBAC, Private Endpoints, and firewall settings.

For Azure SQL Database, you want to restore to a previous point in time after an accidental update. Which built-in capability is used?

Answer: Point-in-time restore from automatic backups

Azure SQL Database provides point-in-time restore from automatic backups. DR requirements may also require long-term retention or failover groups.

You want to require a CostCenter tag on all resources and deny creation if it is missing. Which mechanism is appropriate?

Answer: Azure Policy

Azure Policy evaluates rules such as required tags, allowed regions, and SKU restrictions, and can deny, audit, or remediate.

You want to prevent accidental deletion of important resources in a production subscription. What should you configure?

Answer: Resource Lock

Resource Locks can make resources or resource groups delete-protected or read-only to reduce accidental deletion or modification.

You publish a web app through Application Gateway and want protection from SQL injection and XSS. Which feature should be combined with it?

Answer: Web Application Firewall

Application Gateway WAF inspects HTTP/HTTPS requests and detects or blocks common OWASP-style web attacks.