Azure Practice Questions & Quiz

In Azure, which logical container is used to group related resources and manage their lifecycle together?

Answer: Resource Group

A Resource Group is a management unit for related Azure resources such as VMs, VNets, and App Services. It is important for lifecycle and permission boundaries.

In Azure, which mechanism lets a VM or App Service authenticate to resources such as Key Vault without storing passwords in code?

Answer: Managed Identity

Managed Identity assigns an identity managed by Microsoft Entra ID to an Azure resource, allowing authentication without storing secrets in application code.

What is the primary purpose of Azure Key Vault?

Answer: To securely manage secrets, keys, and certificates

Key Vault is used to manage connection strings, API keys, cryptographic keys, and certificates. It is commonly combined with Managed Identity.

Which description best matches an Azure VNet?

Answer: A logically isolated private network created in Azure

A VNet is used to design network boundaries together with subnets, NSGs, routes, and Private Endpoints.

What is a practical use of Azure Monitor and Log Analytics?

Answer: To collect and analyze metrics and logs for alerts and visualization

Azure Monitor is central to monitoring. Logs are often collected in a Log Analytics workspace and queried with KQL.

In AKS, which modern method is appropriate for letting Pods securely access services such as Azure Key Vault?

Answer: Use Workload Identity or Managed Identity

In AKS, Workload Identity or Managed Identity lets Pods access Microsoft Entra-protected resources without embedding long-lived secrets.

In Azure, which feature is commonly used to avoid public internet exposure and connect to PaaS services using private IP addresses?

Answer: Private Endpoint

Private Endpoint lets services such as Storage and Key Vault be accessed through private IP addresses inside a VNet. DNS design is also important.

In Azure, you want to publish a web app with less server management. Which PaaS is a common entry-level candidate?

Answer: Azure App Service

Azure App Service is a representative PaaS for running web apps and APIs. It reduces OS and web server management so you can focus on publishing the application.

Which Azure service is commonly used to store files, images, and static content as objects?

Answer: Blob Storage

Blob Storage stores objects such as images, logs, backups, and static files. It is managed through containers inside a Storage Account.

Which Azure identity platform manages users, groups, and application identities?

Answer: Microsoft Entra ID

Microsoft Entra ID is Azure's identity platform. It is involved in authentication and authorization for users, groups, app registrations, and Managed Identity.

In Azure, you want to run small pieces of code triggered by HTTP requests or timers. Which service is appropriate?

Answer: Azure Functions

Azure Functions is a serverless function service. It can run small workloads using HTTP triggers, timer triggers, queue integrations, and more.

In Azure, which feature adds metadata such as environment or team to resources for search and cost classification?

Answer: Tag

Tags add key-value metadata to resources. They are used to organize environment, department, system name, cost allocation, and similar classifications.

You run an internal web app on Azure App Service. As usage grows, you want to increase instances and load-balance traffic across them. Which setting should you look at first?

Answer: Scale out the App Service Plan

App Service instance count is adjusted by scaling out the App Service Plan. Scale up changes the size; scale out increases the number of instances.

A VM in a VNet must access a Storage Account through a private IP without using the public internet. Which design is appropriate?

Answer: Design a Private Endpoint and Private DNS Zone

Private Endpoint lets supported PaaS services be reached through private IP addresses in a VNet. Name resolution is important, so Private DNS Zone design should also be checked.

In Azure, you want to prevent resource creation outside approved regions in a production subscription. Which mechanism is appropriate?

Answer: Azure Policy

Azure Policy evaluates and controls resource configuration rules. It can enforce allowed regions, required tags, SKU restrictions, and similar governance controls.

For Azure SQL Database, you want the application to authenticate securely with its identity instead of hard-coding connection secrets. Which combination is appropriate?

Answer: Managed Identity and Microsoft Entra authentication

Managed Identity with Microsoft Entra authentication lets an application authenticate to Azure SQL without long-lived secrets. Database authentication is still separate from network controls.

You want Azure Monitor to notify you when CPU usage is high. Which feature is the most direct choice?

Answer: Metric alert

For metric-based conditions such as CPU usage, use a metric alert. Notification targets such as email or webhooks are configured through an Action Group.

You are hosting multiple business systems on Azure. You want central management of outbound traffic, auditing, and name resolution while keeping each system network separate. Which design is appropriate?

Answer: Use a Hub-Spoke architecture, centralizing shared services in a Hub VNet and separating systems into Spoke VNets

Hub-Spoke is a common design for separating shared network services from individual systems. Azure Firewall, VPN/ExpressRoute, and DNS can be centralized in the Hub while Spoke boundaries are controlled.

For an Azure business application, you want protection against datacenter-level failures. Which concept distributes VMs and supported services across physically separate locations within a region?

Answer: Availability Zone

Availability Zones are physically separate locations within a region. Zone-redundant services and VM placement across zones improve tolerance to a single datacenter failure.

You want to deliver a web application globally, route users to nearby endpoints, and apply WAF protection. Which Azure service is central to this design?

Answer: Azure Front Door

Azure Front Door acts as a global HTTP/HTTPS entry point with routing, TLS, caching, and WAF capabilities. It is suitable for multi-region web application delivery.

A business system uses Azure SQL Database and must consider recovery from a regional outage. Which design perspective should be decided first?

Answer: Define RTO/RPO and choose backups, geo-replication, and failover approach

In DR design, RTO/RPO are prerequisites for choosing the approach. For Azure SQL, automatic backups, geo-replication, and failover groups should be evaluated against requirements.

Multiple teams use the same Azure environment. You want to separate what network, application, and audit teams can do. Which design is appropriate?

Answer: Define scopes such as management groups, subscriptions, and resource groups, then assign Azure RBAC with least privilege

Azure RBAC assigns permissions at different scopes. Combined with management group and subscription structure, it supports least-privilege separation of duties.

You want to assess security configuration across an Azure environment and review recommendations and Secure Score. Which service is appropriate?

Answer: Microsoft Defender for Cloud

Defender for Cloud assesses cloud security posture and provides recommendations and Secure Score. Defender plans can extend workload protection capabilities.

You want administrative privileges to be activated only when needed after approval and multifactor authentication, rather than assigned permanently. Which feature is appropriate?

Answer: Microsoft Entra Privileged Identity Management

PIM supports just-in-time privileged role activation with approval, MFA, expiration, and auditing. It helps reduce standing high privileges.

An App Service application needs an API key. Which design lets it retrieve the key securely without storing the value directly in code or configuration files?

Answer: Store it in Key Vault and grant the App Service managed identity only the required read permission

Key Vault with managed identity lets the application retrieve secrets without holding fixed credentials. Permissions should be limited to the required secret operations.

You want to allow only HTTPS inbound traffic to a web server subnet and restrict the source to the Application Gateway subnet. Which control is appropriate?

Answer: A Network Security Group inbound rule

NSGs control inbound and outbound traffic for subnets or NICs by source, destination, port, and protocol. Rule priority and default rules must also be considered.

You want stronger mitigation and visibility for an internet-facing service during large-scale DDoS attacks. Which service should be considered?

Answer: Azure DDoS Protection

Azure DDoS Protection strengthens DDoS mitigation and monitoring for public IP resources in a VNet. Layer 7 attacks require complementary controls such as WAF.

You want to regularly apply security updates to multiple Azure VMs and centrally review update status. Which capability is appropriate?

Answer: Azure Update Manager

Azure Update Manager is used to assess, schedule, and monitor updates for VMs. DNS, CDN, and container registry services have different roles.

You want daily backups for Azure VMs retained for 30 days. Which service is central to this?

Answer: Azure Backup

Azure Backup manages backup, retention, and restore for workloads such as VMs and file shares using vaults.

You need RDP/SSH access to Azure VMs without assigning public IP addresses to the VMs. Which service is appropriate?

Answer: Azure Bastion

Azure Bastion provides secure browser-based RDP/SSH access to VMs in a VNet without exposing public IPs on each VM.

You want recommendations across Azure resources for cost reduction, reliability, security, and operations. Which service is appropriate?

Answer: Azure Advisor

Azure Advisor analyzes configurations and provides recommendations for cost, security, reliability, operations, and performance.

You want to connect an on-premises site to an Azure VNet over an internet VPN. Which resource is typically deployed on the VNet side?

Answer: VPN Gateway

VPN Gateway connects Azure VNets to on-premises networks using IPsec/IKE VPN. Dedicated connectivity uses ExpressRoute.

You want centralized traffic control between VNets and on-premises networks using FQDN and network rules. Which service is typically placed in the hub?

Answer: Azure Firewall

Azure Firewall is a managed network security service used in designs such as hub-spoke for traffic control, logging, and threat intelligence integration.

You want Azure Functions to run a batch process at scheduled times. Which trigger is typically configured?

Answer: Timer trigger

A Timer trigger runs Functions on a schedule. HTTP, Queue, Blob, and other triggers are used for other event sources.

You want asynchronous messaging between microservices so messages are retained even if one service is temporarily stopped. Which Azure service is appropriate?

Answer: Azure Service Bus

Azure Service Bus provides enterprise messaging with queues and topics/subscriptions, supporting decoupling and asynchronous processing.

For an Azure Storage Account, you want to block anonymous Blob access from the internet and allow only required paths. Which setting should you check first?

Answer: Blob anonymous access and networking access settings

Storage access design combines anonymous access settings, shared keys, RBAC, Private Endpoints, and firewall settings.

For Azure SQL Database, you want to restore to a previous point in time after an accidental update. Which built-in capability is used?

Answer: Point-in-time restore from automatic backups

Azure SQL Database provides point-in-time restore from automatic backups. DR requirements may also require long-term retention or failover groups.

You want to require a CostCenter tag on all resources and deny creation if it is missing. Which mechanism is appropriate?

Answer: Azure Policy

Azure Policy evaluates rules such as required tags, allowed regions, and SKU restrictions, and can deny, audit, or remediate.

You want to prevent accidental deletion of important resources in a production subscription. What should you configure?

Answer: Resource Lock

Resource Locks can make resources or resource groups delete-protected or read-only to reduce accidental deletion or modification.

You publish a web app through Application Gateway and want protection from SQL injection and XSS. Which feature should be combined with it?

Answer: Web Application Firewall

Application Gateway WAF inspects HTTP/HTTPS requests and detects or blocks common OWASP-style web attacks.

Azure subscriptions are increasing across departments. You need to apply allowed-Region and audit policies consistently and reduce configuration gaps. What is the core hierarchy design?

Answer: Organize subscriptions under management groups and assign Azure Policy and RBAC from higher scopes

Management groups organize subscriptions into a hierarchy where Azure Policy and RBAC assignments can be inherited. Validate changes in a test hierarchy and govern exceptions and ownership.

You are introducing a Conditional Access policy that requires MFA for all employees. How should it be rolled out without locking out administrators?

Answer: Exclude emergency access accounts, evaluate in report-only mode and a pilot group, then roll out in stages

Conditional Access can affect broad authentication paths. Protect emergency access accounts, use report-only evaluation and a scoped pilot, review sign-in logs, and then expand enforcement gradually.

GitHub Actions must deploy to Azure without storing a client secret in the repository. Which design uses temporary tokens?

Answer: Use Microsoft Entra workload identity federation to trust GitHub OIDC tokens

Workload identity federation validates the issuer, subject, and audience of GitHub OIDC tokens and exchanges them for short-lived access tokens without a stored secret. Scope Azure RBAC to the deployment target.

You need to recover accidentally deleted Key Vault secrets and prevent privileged users from permanently purging them during the retention period. Which protection is required?

Answer: Enable soft delete and purge protection, and test recovery and rotation procedures

Soft delete retains deleted vaults and objects for recovery, while purge protection prevents permanent deletion during retention. Also design separation of duties, backup, rotation, and application refresh validation.

A Private Endpoint was created for a Storage Account, but a VM resolves the service name to a public IP and cannot connect. What should be checked first?

Answer: The matching Private DNS Zone record, VNet link, and on-premises DNS forwarding

Private Endpoint connectivity depends on resolving the normal service name to the private IP. Verify the Private DNS Zone record, VNet link, and conditional forwarding when custom DNS is used.

On-premises DNS must resolve Azure Private DNS Zones, and Azure workloads must resolve corporate domains. Which design is appropriate?

Answer: Use Azure DNS Private Resolver inbound and outbound endpoints with a forwarding ruleset

Azure DNS Private Resolver provides inbound endpoints for on-premises queries and outbound endpoints for forwarding selected domains from Azure. Connectivity and redundancy must also be designed.

VMs in a subnet have no public IPs but need outbound internet access from stable source IPs for updates, without allowing inbound connections. Which design is appropriate?

Answer: Associate Azure NAT Gateway and a public IP or prefix with the subnet

Azure NAT Gateway provides explicit, scalable outbound connectivity for private subnet resources. It does not accept new inbound connections and provides stable source IPs for allowlists.

An App Service release must be validated with production settings, switched with minimal downtime, and quickly rolled back if needed. Which method is appropriate?

Answer: Warm up and validate in a staging deployment slot, then swap it with production

Deployment slots run the new version at a separate URL and preserve slot-specific settings for validation. After warm-up, swap into production; swap again to restore the previous version if needed.

You want to send only 10% of traffic to a new Azure Container Apps revision, observe its error rate, and increase gradually. Which feature is appropriate?

Answer: Traffic splitting in multiple-revision mode

Container Apps multiple-revision mode can allocate a percentage of traffic to each revision. Compare new and old revision metrics and return 100% to the known-good revision if problems appear.

A sudden increase in Azure Functions concurrency overwhelms a downstream API. Which design appropriately prevents recurrence?

Answer: Buffer with a queue, align concurrency and bounded retries to downstream capacity, and make processing idempotent

Buffer events in a queue and align Functions concurrency and retry behavior with downstream capacity. Use a business idempotency key so duplicate delivery or post-timeout execution does not repeat side effects.

A Service Bus send times out, leaving the sender unsure whether an order event was accepted. Which design reduces duplicate registration when the event is resent?

Answer: Use duplicate detection with a stable order MessageId and make the consumer idempotent using a business key

Service Bus duplicate detection discards repeated sends with the same MessageId within the configured window. Consumer redelivery can still occur, so processing must also be idempotent using an order or business ID.

Service Bus messages for the same order must be processed sequentially, while different orders should run in parallel. Which feature is appropriate?

Answer: Use Service Bus sessions with the order number as SessionId

Service Bus sessions provide exclusive processing for a group of messages sharing a SessionId, supporting per-order ordering while different sessions can be processed in parallel.

You need high-throughput ingestion of telemetry from millions of devices and streaming delivery to multiple analytics consumers. Which service is appropriate?

Answer: Azure Event Hubs

Azure Event Hubs is a streaming ingestion platform for high-volume events and telemetry. Design partitions, consumer groups, and retention so analytics consumers can read independently.

Azure SQL Database is deployed across two Regions and must switch connection targets during an outage. Which complete design is appropriate?

Answer: Use the failover group's read-write listener and implement bounded retries for transient faults

A failover group listener routes to the current role. Existing connections can break and transient faults can occur during failover, so applications need reconnection, exponential backoff, and idempotency.

Cosmos DB traffic concentrates on a few logical partitions and frequently exhausts request units. What is the most important improvement?

Answer: Design a high-cardinality, evenly distributed partition key based on query patterns and write distribution

In Cosmos DB, the partition key determines data placement and throughput distribution. Choose a key that supports primary access patterns without concentrating data and traffic on a few values.

Multiple users edit the same Cosmos DB document, and the last save silently overwrites an earlier change. How should the conflict be detected?

Answer: Send the read _ETag in an If-Match condition and replace only when it still matches

Cosmos DB _ETag with If-Match allows a write only if the item has not changed since it was read. Treat a mismatch as a conflict, reread, and reconcile according to business rules.

An API request is slow across multiple services. Which design traces where time was spent for one end-to-end request?

Answer: Propagate correlation context across services and collect Application Insights distributed traces and dependency telemetry

Distributed tracing propagates trace context from ingress to dependencies and correlates requests, dependencies, and exceptions over time. Exclude personal data and secrets and govern sampling and retention.

Before updating production resources with Bicep, you need to review changes including deletions and replacements. Which procedure is appropriate?

Answer: Review the what-if diff, assess permission, data, and downtime impact, then deploy in stages

Azure Resource Manager what-if previews resources expected to be created, modified, or deleted. Because runtime conditions and noise remain possible, combine review with locks, backups, staged rollout, and rollback planning.

You are considering an Azure savings plan, but many VMs have low utilization. What is the appropriate sequence?

Answer: Use Advisor and Cost Management to review utilization, anomalies, and performance impact, rightsize first, then consider commitments for stable remaining usage

A long-term commitment on oversized capacity can lock in unnecessary usage. Evaluate shutdown and rightsizing candidates using business impact and performance metrics, then cover stable baseline usage with a savings plan.

Azure Site Recovery replication appears healthy, but recovery within the target time has not been verified. What should be done next?

Answer: Run a test failover in an isolated network and validate dependencies, data integrity, procedures, and elapsed time

Healthy replication does not prove application recovery or RTO compliance. Periodically test failover in an isolated environment and validate startup order, endpoints, identity, DNS, data, and failback.