SkillTestPro | Microsoft AZ-104 Practice Test 1

AZ-104 Practice Test 1

Microsoft Azure Administrator AZ-104 practice test

1 / 80

Your organization has the following Azure hierarchy:

Management group: Corp
- Subscription: Production
  - Resource group: RG-App
    - VM: VM01
Subscription: Development

An administrator must be able to start, stop, and restart virtual machines in Production, but must not be able to:

Modify VM configuration
Delete VMs
Access resources in Development
Manage resources other than VMs

You want to use a built-in Azure role and assign it at the highest possible scope while satisfying the requirements.

Which action should you take?

Assign Virtual Machine Contributor at the Corp management-group scope.

Assign Virtual Machine Contributor at the Production subscription scope.

Assign Virtual Machine Contributor at the RG-App resource-group scope.

Assign Contributor at the Production subscription scope.

Assign Reader at the Production subscription scope and Virtual Machine Contributor at RG-App.

Assign Contributor at the RG-App resource-group scope.

2 / 80

Which Azure Active Directory (Microsoft Entra ID) object type represents a non-human identity used by an application to authenticate and access resources?

A managed identity, which is automatically managed rather than manually registered

A security group

An administrative unit

A service principal

A dynamic group

A user account

3 / 80

Which Azure RBAC role grants full access to manage all resources within a scope, but does NOT allow granting access to others?

Owner, which does allow granting access to others

Virtual Machine Contributor

Contributor

User Access Administrator, which manages access rather than resources themselves

Reader

Backup Contributor

4 / 80

Which Azure RBAC role allows a user to manage access to Azure resources, without granting the ability to manage the resources themselves?

User Access Administrator

Contributor, which grants resource management but not access management

Owner, which grants both resource management and access management

Backup Contributor

Virtual Machine Contributor

Reader

5 / 80

Which Azure governance feature allows an organization to enforce rules across resources, such as requiring all storage accounts to use encryption, and can audit or deny non-compliant resources?

Management groups alone, which organize subscriptions rather than enforcing configuration rules

Azure Blueprints alone, which orchestrates deployment rather than the ongoing rule enforcement itself

Azure RBAC, which controls who can perform actions rather than enforcing configuration rules on resources

Tags alone, which are metadata labels rather than an enforcement mechanism

Azure Policy

Resource locks alone, which prevent deletion/modification rather than enforcing broader configuration rules

6 / 80

Which Azure governance feature allows resources to be organized under a hierarchy above the subscription level, enabling consistent policy and RBAC assignment across multiple subscriptions?

Azure Policy alone, which enforces rules but does not itself provide the organizational hierarchy above subscriptions

Tags alone, which are metadata labels rather than a hierarchical organizational structure

Management groups

Resource groups, which organize resources within a single subscription rather than above the subscription level

Azure Blueprints alone

Resource locks alone

7 / 80

An administrator wants to prevent a critical production resource from being accidentally deleted, even by users who have Contributor access. Which feature should be used?

A budget alert alone, which is unrelated to preventing resource deletion

Azure Policy alone, which enforces broader configuration rules rather than specifically preventing accidental deletion by an already-permitted user

Tags alone, which are metadata labels with no enforcement capability

Azure RBAC alone, which controls permission levels rather than specifically preventing an already-permitted user's accidental action

Management groups alone

A resource lock (Delete lock)

8 / 80

Which type of resource lock prevents any configuration changes to a resource, while still allowing it to be deleted?

A tag-based restriction alone, which is metadata rather than an enforcement lock type

A Reader-level restriction alone

An Owner-level restriction alone

A Contributor-level restriction alone, which is an RBAC concept rather than a specific lock type

A Delete lock, which prevents deletion but still allows configuration changes

A ReadOnly lock

9 / 80

Which Azure feature allows an administrator to apply metadata, such as 'Environment: Production' or 'CostCenter: 1234', to resources for organization and cost tracking purposes?

Resource locks, which prevent changes rather than applying descriptive metadata

Azure Policy, which enforces rules rather than simply applying descriptive metadata

Azure Blueprints, which orchestrate deployment rather than applying ongoing descriptive metadata

Tags

RBAC role assignments, which control permissions rather than applying descriptive metadata

Management groups, which organize subscriptions rather than applying descriptive metadata to individual resources

10 / 80

Which Microsoft Entra ID feature requires a user to provide a second form of verification, such as a code from an authenticator app, in addition to their password?

Multifactor authentication (MFA)

Conditional Access alone, which is the policy engine that can require MFA rather than being MFA itself

Identity Protection alone, which detects risk rather than being the additional verification factor itself

Self-service password reset, which allows resetting a forgotten password rather than requiring an additional verification factor

Single sign-on, which reduces repeated sign-in prompts rather than requiring an additional verification factor

Password protection, which blocks weak passwords rather than requiring an additional verification factor

11 / 80

Which Microsoft Entra ID feature allows an administrator to require MFA only when a sign-in is deemed risky, based on signals such as an unfamiliar location?

Azure Policy, which enforces resource configuration rules rather than identity sign-in conditions

A resource lock, which is unrelated to identity sign-in policy enforcement

An Azure Blueprint, which orchestrates deployment rather than enforcing ongoing sign-in conditions

A management group, which organizes subscriptions rather than enforcing sign-in conditions

A Conditional Access policy

A tag, which is metadata rather than an identity sign-in enforcement mechanism

12 / 80

Which Microsoft Entra ID capability allows an administrator to provide just-in-time, time-bound access to a privileged role, such as Global Administrator, rather than a standing assignment?

Self-service password reset, which is unrelated to privileged role activation

Multifactor authentication alone, which is one possible requirement within PIM but not PIM itself

Conditional Access, which enforces sign-in conditions rather than providing time-bound role activation

Privileged Identity Management (PIM)

Entitlement management, which manages access packages rather than specifically privileged role activation

Identity Protection, which detects risk rather than providing time-bound role activation

13 / 80

An administrator needs to create hundreds of new user accounts in Microsoft Entra ID at once, based on a spreadsheet of employee data. Which approach is most efficient?

Using a bulk import via a CSV file in the Microsoft Entra admin center (or Azure PowerShell/CLI scripting)

Contacting Microsoft support to manually create each account individually

Manually creating each user account one at a time through the Azure portal

Assuming bulk user creation is not supported by Microsoft Entra ID under any circumstance

Using Azure Policy, which enforces resource configuration rather than creating user accounts

Creating a single shared account for all employees to use

14 / 80

Which Microsoft Entra ID group membership type automatically adds or removes members based on defined rules, such as all users in a specific department?

A distribution group alone, which is focused on email distribution rather than automated membership rules

A Microsoft 365 group alone, without specifying the dynamic membership type

A security group alone, without specifying the dynamic membership type

A dynamic group

An assigned group, which requires manually adding and removing each member individually

An administrative unit, which scopes administrative permissions rather than describing automated group membership

15 / 80

Which Azure feature allows a company to delegate administrative permissions over a specific subset of users, such as those in a particular regional office, without granting tenant-wide administrative access?

A management group, which organizes subscriptions rather than delegating scoped administrative permissions over specific users

A resource lock, which prevents changes to resources rather than delegating administrative permissions over users

An administrative unit

A tag, which is metadata rather than a delegated administrative scope

A resource group, which organizes Azure resources rather than delegating scoped administrative permissions over Microsoft Entra users

A dynamic group alone, which is a membership mechanism rather than specifically a delegated administrative scope

16 / 80

Which Azure cost management feature allows an administrator to set a spending threshold and receive an alert when actual or forecasted spending approaches or exceeds that threshold?

Azure Policy, which enforces configuration rules rather than tracking spending thresholds

A resource lock, which prevents changes rather than tracking spending

An RBAC role assignment, which controls permissions rather than tracking spending thresholds

A tag, which is metadata rather than a spending threshold mechanism

A management group, which organizes subscriptions rather than tracking spending thresholds

A budget (in Azure Cost Management)

17 / 80

Which Azure Cost Management tool provides recommendations for reducing costs, such as identifying underutilized virtual machines that could be resized or shut down?

A management group, which is an organizational hierarchy rather than a recommendation engine

A resource lock, which is unrelated to cost optimization recommendations

Azure Policy, which enforces configuration compliance rather than providing cost optimization recommendations

A tag, which is metadata rather than a recommendation engine

Azure Advisor

Azure Monitor, which is focused on operational monitoring rather than specifically cost optimization recommendations

18 / 80

Which Azure subscription-level concept determines the billing boundary and acts as a container for resource groups and resources?

A tag, which is metadata rather than a billing boundary

A management group, which sits above subscriptions in the hierarchy rather than being the billing boundary itself

A resource group, which organizes resources within a subscription rather than being the billing boundary itself

A tenant, which represents the overall Microsoft Entra ID organization rather than specifically the billing boundary

An administrative unit, which delegates administrative scope over users rather than serving as the billing boundary

A subscription

19 / 80

Which Azure RBAC concept determines the level, such as management group, subscription, resource group, or individual resource, at which a role assignment applies?

A management group alone, which is one specific possible scope level rather than the general concept itself

A security principal, which represents who is being granted access rather than where that access applies

A role definition, which describes what actions are permitted rather than where those permissions apply

A resource lock, which prevents changes rather than determining the level at which a role assignment applies

A tag, which is metadata rather than determining the level at which a role assignment applies

Scope

20 / 80

An administrator wants to grant a contractor temporary access to a specific resource group for 30 days, with access automatically expiring afterward. Which Azure Entra ID feature is most appropriate?

A resource lock, which prevents resource changes rather than managing time-limited user access

A standard, permanent RBAC role assignment with no built-in expiration mechanism

Azure Policy, which enforces resource configuration rather than managing time-limited user access

A management group, which organizes subscriptions rather than managing time-limited individual user access

Entitlement management (access packages with time-limited assignment)

A tag, which is metadata rather than managing time-limited access

21 / 80

Which term describes the recommended security practice of granting a user only the minimum level of Azure RBAC permissions necessary to perform their specific job function?

Zero Trust, which is a broader security philosophy rather than specifically this minimal-permission-granting principle

Federation, which describes cross-organization identity trust rather than minimal permission granting

Single sign-on, which describes a sign-in experience rather than minimal permission granting

Multi-tenancy, which describes shared infrastructure architecture rather than minimal permission granting

Defense in depth, which describes layered security controls rather than specifically this minimal-permission-granting principle

The principle of least privilege

22 / 80

Which Azure Storage account replication option provides the lowest cost, replicating data three times within a single data center in the primary region?

Locally redundant storage (LRS)

Geo-zone-redundant storage (GZRS), which combines zone and geo redundancy at the highest cost

Read-access geo-redundant storage (RA-GRS), which is a more expensive variant of GRS

Geo-redundant storage (GRS), which replicates to a secondary region at higher cost

A completely unreplicated storage configuration, which does not exist as a standard Azure option

Zone-redundant storage (ZRS), which replicates across multiple data centers at higher cost

23 / 80

Which Azure Blob Storage access tier offers the lowest storage cost but the highest cost and latency for retrieving data, suited for compliance archives rarely accessed?

A Premium tier, which is optimized for high-performance, low-latency access rather than archival

The Cold tier, which offers lower retrieval latency than Archive at a higher storage cost

The Hot tier, which is optimized for frequently accessed data with the opposite cost profile

The Cool tier, which offers a middle-ground cost profile rather than the lowest storage cost and highest retrieval latency

A Standard tier alone, without specifying this is the lowest-cost archival option

The Archive tier

24 / 80

An administrator wants to move an infrequently accessed blob from the Hot tier to a lower-cost tier automatically after 30 days without access, and to the Archive tier after 90 days. Which feature should be used?

Azure Policy, which enforces broader configuration rules rather than automating storage tier transitions based on access age

A resource lock, which prevents changes/deletion rather than automating tier transitions

Immutable storage, which prevents modification rather than automating tier transitions

A shared access signature, which grants time-limited access rather than automating tier transitions

Soft delete, which recovers deleted data rather than automating tier transitions

A lifecycle management policy

25 / 80

Which Azure Storage security feature generates a time-limited, permission-scoped URL that grants temporary access to a specific blob or container without sharing the storage account key?

Soft delete, which recovers deleted data rather than generating a time-limited access URL

Azure RBAC alone, which is a separate, broader permission model rather than this specific time-limited URL mechanism

A resource lock, which prevents changes rather than generating time-limited access

A private endpoint, which controls network-level access rather than generating a time-limited access URL

A shared access signature (SAS)

Storage account access keys, which grant full, unrestricted access to the entire account rather than time-limited, scoped access

26 / 80

Which Azure Storage feature protects blobs and containers from accidental deletion by retaining deleted items for a configurable retention period, allowing recovery?

Lifecycle management, which automates tier transitions rather than protecting against accidental deletion

A resource lock alone, which is a broader Azure Resource Manager concept rather than this specific storage-level deletion protection feature

A shared access signature, which grants temporary access rather than protecting against accidental deletion

Soft delete

Immutable storage, which prevents modification/deletion entirely rather than allowing recovery within a retention window

Geo-redundant storage alone, which addresses regional durability rather than protecting against accidental logical deletion

27 / 80

Which Azure Storage feature prevents blob data from being modified or deleted for a specified period, or indefinitely, supporting regulatory compliance (WORM) requirements?

Lifecycle management, which automates tier transitions rather than preventing modification or deletion

A resource lock alone, which is a broader Azure Resource Manager concept rather than this specific blob-level WORM compliance feature

Geo-redundant storage alone, which addresses regional durability rather than compliance-driven immutability

Soft delete, which allows recovery of deleted data within a retention window rather than actively preventing modification or deletion in the first place

Immutable storage (a time-based retention or legal hold policy)

A shared access signature, which grants time-limited access rather than preventing modification or deletion

28 / 80

An organization needs a storage account that must remain accessible for read operations even if the primary Azure region experiences a complete outage. Which replication option is most appropriate?

An Archive tier alone, which is an access tier for infrequently accessed data rather than a regional replication configuration

Zone-redundant storage (ZRS) alone, which replicates within a single region across zones but does not protect against a full regional outage

Geo-redundant storage (GRS) alone, which replicates to a secondary region but does not allow read access to that secondary copy unless a failover occurs

Locally redundant storage (LRS), which does not replicate to a secondary region and would be unavailable during a primary region outage

A Premium tier alone, which is a performance tier rather than a replication and regional availability configuration

Read-access geo-redundant storage (RA-GRS)

29 / 80

Which Azure Files feature allows a managed file share to be mounted using the standard SMB protocol on both Windows and Linux clients, similar to an on-premises file server?

Azure Queue Storage, which is for message queuing rather than a mountable file share

Azure Table Storage, which is a NoSQL key-value store rather than a mountable file share

Azure Files (SMB protocol support)

Azure Disk Storage, which provides block-level storage for VM disks rather than a network-mountable SMB file share

Azure Blob Storage, which is accessed via REST APIs and object storage semantics rather than a mountable SMB file-system protocol

Azure NetApp Files alone, without specifying the core native Azure Files SMB capability being described

30 / 80

Which Azure Storage networking feature allows a storage account to be accessed privately from within a virtual network, using a private IP address rather than traversing the public internet?

Soft delete, which is a data protection feature unrelated to network connectivity

Lifecycle management, which is a cost optimization feature unrelated to network connectivity

A shared access signature, which grants scoped access permissions rather than controlling network-level connectivity

Immutable storage, which is a compliance feature unrelated to network connectivity

A private endpoint

Storage firewall rules alone, which restrict access by public IP address but still traverse the public internet path rather than using a private IP address

31 / 80

An administrator needs to copy a large volume of on-premises data (many terabytes) to Azure Blob Storage, but the organization's internet bandwidth would make an online transfer take several weeks. Which Azure service is most appropriate?

A shared access signature alone, which grants access permissions rather than performing the actual bulk data transfer

AzCopy alone, which is an online transfer tool that would still be constrained by the same limited internet bandwidth

Azure Site Recovery, which is a disaster recovery replication service rather than a one-time bulk offline data transfer service

Azure File Sync alone, which synchronizes file shares rather than performing a one-time bulk offline transfer of many terabytes

Azure Data Box

Azure Storage Explorer alone, which is a GUI management tool rather than a dedicated large-scale offline transfer service

32 / 80

Which Azure Files feature allows an on-premises Windows Server to cache frequently accessed files locally while the full file set is stored in an Azure file share, synchronizing changes in both directions?

Azure Site Recovery, which is a disaster recovery replication service rather than a local caching and bidirectional sync service

A shared access signature, which grants access permissions rather than providing caching and sync capability

Azure File Sync

Storage Explorer, which is a GUI management tool rather than a caching and sync service

AzCopy, which is a one-time or scripted copy tool rather than an ongoing bidirectional caching sync service

Azure Backup, which protects against data loss rather than providing local caching and bidirectional sync

33 / 80

Which Azure Storage account setting, when enabled, would prevent any public (anonymous) read access to blob data, even if an individual container's access level is configured to allow it?

Configuring geo-redundant storage, which governs regional replication rather than public access permissions

Enabling soft delete, which protects against accidental deletion rather than governing public access permissions

Disabling 'Allow Blob public access' at the storage account level

Configuring lifecycle management, which governs tier transitions rather than public access permissions

Enabling immutable storage, which governs modification/deletion rather than public read access permissions

Configuring a resource lock, which prevents changes/deletion but does not specifically govern public blob access permissions

34 / 80

An administrator wants to regenerate a storage account's access keys without causing downtime for applications currently using the account. Which practice supports this?

Deleting and recreating the entire storage account whenever a key rotation is needed

Regenerating both access keys simultaneously with no coordination, accepting that all connected applications will immediately fail

Assuming storage accounts only ever provide a single access key with no rotation mechanism available

Using two separate access keys (key1 and key2), rotating applications to use one key while regenerating the other, then repeating for the second key

Disabling the storage account entirely during the rotation process

Assuming access keys never need to be rotated once initially generated

35 / 80

Which Azure Blob Storage capability allows an application to read and write to specific byte ranges within very large files, supporting scenarios like streaming video?

Immutable storage, which governs modification prevention rather than partial byte-range access

Lifecycle management, which governs tier transitions rather than partial byte-range read/write access

Range requests (supported by block blobs and particularly efficient with page blobs)

Geo-redundant storage, which governs regional replication rather than partial byte-range access

Soft delete, which governs deletion recovery rather than partial byte-range access

A shared access signature alone, which grants access permissions rather than describing the underlying partial byte-range access capability itself

36 / 80

Which Azure resource defines the compute size, such as vCPU count and memory, available to a virtual machine, such as Standard_D2s_v5?

A network security group, which filters network traffic rather than defining compute size

A resource group, which is an organizational container rather than defining compute size

A managed disk, which provides storage rather than defining compute size

An availability set, which is a fault-tolerance grouping mechanism rather than defining compute size

A VM extension, which adds post-deployment configuration or software rather than defining the core compute size

A VM size (SKU)

37 / 80

Which Azure feature groups two or more virtual machines to protect against a single hardware failure or planned maintenance event within a data center, by spreading them across different fault and update domains?

A resource group, which is an organizational container rather than a fault-tolerance mechanism

An availability set

A virtual machine scale set alone, which is focused on automated scaling rather than specifically fault/update domain grouping (though scale sets can also span these)

A managed disk, which provides storage rather than fault-tolerance grouping

An availability zone, which spreads resources across physically separate data centers within a region rather than fault/update domains within a single data center

A load balancer, which distributes traffic rather than providing this specific fault/update domain grouping

38 / 80

Which Azure feature provides resilience against an entire data center outage within a region, by allowing resources to be deployed across physically separate facilities within that region?

Availability zones

An availability set, which protects against failures within a single data center rather than across physically separate data centers

A resource group, which is an organizational container rather than a resilience mechanism

A managed disk, which provides storage rather than cross-data-center resilience

A virtual machine scale set alone, which is focused on automated scaling rather than specifically cross-data-center resilience (though scale sets can also use zones)

A load balancer alone, which distributes traffic rather than providing the underlying cross-data-center resilience mechanism

39 / 80

Which Azure feature automatically increases or decreases the number of virtual machine instances in a group based on demand, such as CPU utilization?

An availability zone alone, which provides physical data center distribution rather than automated instance count scaling

A virtual machine scale set (with autoscale configured)

A network security group, which filters traffic rather than automated instance scaling

An availability set, which provides fault-tolerance grouping rather than automated instance count scaling

A managed disk, which provides storage rather than automated instance scaling

A resource group, which is an organizational container rather than an automated scaling mechanism

40 / 80

Which Azure VM disk type provides the operating system files for a virtual machine and is automatically deleted when certain deallocation actions are taken, unless configured otherwise?

A data disk, which stores application data and persists independently rather than describing the primary OS disk

The OS disk

A managed disk alone, which is a broader disk management category that both OS and data disks can use, rather than specifically the OS disk

A snapshot, which is a point-in-time copy rather than the OS disk itself

A temporary disk, which is ephemeral local storage rather than the OS disk itself

An unmanaged disk, which is an older disk management approach rather than specifically describing the OS disk

41 / 80

Which Azure VM disk type provides high-performance, non-persistent local storage that is lost when the VM is stopped/deallocated or moved to different host hardware?

A snapshot, which is a persistent point-in-time copy rather than non-persistent local storage

An unmanaged disk, which is an older but still generally persistent disk management approach rather than inherently non-persistent local storage

The OS disk, which is generally persistent (unless specifically configured otherwise) rather than inherently non-persistent local storage

A managed disk alone, which is generally the persistent, durable disk management category rather than specifically this non-persistent local storage

A data disk, which is persistent managed storage rather than non-persistent local storage

The temporary disk

42 / 80

Which Azure feature allows an administrator to install and configure additional software or run custom scripts on a VM automatically after deployment, such as installing a monitoring agent?

A network security group, which filters traffic rather than installing software

A managed disk, which is storage rather than a post-deployment software installation mechanism

A resource lock, which prevents changes/deletion rather than installing software

An availability set, which is a fault-tolerance grouping mechanism rather than a post-deployment software installation mechanism

A VM extension

A shared access signature, which is a storage access mechanism rather than a VM software installation mechanism

43 / 80

Which Azure App Service feature allows an administrator to test a new version of a web application in a separate environment before swapping it into production with zero downtime?

A custom domain, which is a DNS/branding feature rather than a deployment testing and swap mechanism

Autoscale, which adjusts instance count based on demand rather than providing a separate pre-production testing and swap mechanism

Deployment slots

Application Insights, which provides monitoring rather than a deployment testing and swap mechanism

A managed identity, which provides an application identity rather than a deployment testing mechanism

An App Service Plan alone, which defines the underlying compute tier rather than the deployment slot testing/swap mechanism

44 / 80

Which Azure App Service feature defines the underlying compute resources (such as pricing tier and scale) shared by one or more web apps?

An App Service Plan

Autoscale alone, which is a scaling behavior configured on top of a plan rather than defining the base compute resources itself

A managed identity, which provides an application identity rather than defining compute resources

A deployment slot, which is a testing/swap environment rather than defining the underlying compute resources

Application Insights, which provides monitoring rather than defining compute resources

A custom domain, which is a DNS/branding feature rather than defining compute resources

45 / 80

Which Azure container service is most appropriate for running a single, simple containerized task without needing to manage an orchestrator or cluster?

Azure Functions, which is designed for event-driven code execution rather than general standalone container hosting

Azure Kubernetes Service (AKS), which provides a full container orchestration platform, more complex than needed for a single simple task

Azure Container Instances (ACI)

Azure App Service, which is designed for web applications rather than general standalone container task execution

Azure Batch, which is designed for large-scale parallel batch computing rather than a single simple containerized task

Azure Virtual Machines, which would require managing a full VM and container runtime rather than a simpler, more direct container execution service

46 / 80

Which Azure resource deployment approach uses a declarative JSON (or Bicep) file to define the desired state of infrastructure, allowing consistent, repeatable deployments?

A resource lock, which prevents changes rather than declaratively defining infrastructure

An availability set, which is a specific VM fault-tolerance feature rather than a general declarative infrastructure deployment approach

A VM extension, which configures an individual VM post-deployment rather than declaratively defining broader infrastructure

An Azure Resource Manager (ARM) template (or Bicep file)

A manual deployment through the Azure portal, which is not a declarative, repeatable file-based approach

A tag, which is metadata rather than a declarative infrastructure definition

47 / 80

Which ARM template concept allows the same template to be reused with different values, such as a VM size or region, without modifying the template itself?

Parameters

Resources, which define the actual infrastructure components being deployed rather than the customizable input values

Outputs, which return values after deployment rather than customizable input values

Variables, which are typically computed or reused values within the template itself rather than external customizable inputs

Functions, which perform template-language operations rather than serving as external customizable inputs

A dependency, which defines resource creation order rather than customizable input values

48 / 80

Which ARM template concept explicitly defines that one resource must be created before another, such as a virtual network needing to exist before a VM's network interface can be created?

An output, which returns values after deployment rather than defining resource creation order

A resource group, which is an organizational container rather than defining resource creation order within a template

A variable, which stores reusable computed values rather than defining resource creation order

A parameter, which provides customizable input values rather than defining resource creation order

A function, which performs template-language operations rather than specifically defining resource creation order

A dependency (dependsOn)

49 / 80

An administrator wants to redeploy the same ARM template repeatedly, with the deployment automatically creating any missing resources and updating any that have changed, without duplicating existing correctly configured resources. Which deployment characteristic supports this?

A parameter, which provides customizable input values rather than describing this repeatable deployment behavior

A tag, which is metadata rather than describing this repeatable deployment behavior

Idempotency

A resource lock, which prevents changes/deletion rather than describing this repeatable deployment behavior

An output, which returns values after deployment rather than describing this repeatable deployment behavior

A dependency, which defines resource creation order rather than describing this repeatable, non-duplicating deployment behavior

50 / 80

Which Azure Kubernetes Service (AKS) concept represents a group of underlying virtual machines that run containerized application workloads?

A service, which provides stable networking for pods rather than describing the underlying virtual machines

A deployment, which manages the desired state of pods rather than describing the underlying virtual machines

A namespace, which is a logical partitioning mechanism within the cluster rather than the underlying virtual machines

A pod, which is the smallest deployable unit running one or more containers, rather than the underlying group of virtual machines themselves

A container registry, which stores container images rather than describing the underlying compute virtual machines

A node pool

51 / 80

Which Azure service allows a developer to run individual pieces of code in response to an event, such as an HTTP request or a message arriving in a queue, without provisioning or managing servers?

Azure Functions

Azure Kubernetes Service, which requires managing a full container orchestration cluster rather than this simpler event-driven code execution model

Azure Container Instances, which runs standalone containers rather than specifically this event-triggered, serverless code execution model

Azure Batch, which is designed for large-scale parallel batch computing rather than this lightweight event-driven code execution model

Azure Virtual Machines, which requires managing a full server rather than this serverless event-driven code execution model

Azure App Service, which is designed for hosting complete web applications rather than individual event-triggered code snippets

52 / 80

Which Azure App Service hosting plan tier is specifically designed to allow multiple apps from different customers to run in complete isolation on dedicated infrastructure?

The Premium tier alone, which offers enhanced performance but not necessarily the same full network isolation as the dedicated Isolated tier

The Free tier, which shares infrastructure with other tenants rather than providing dedicated isolated infrastructure

The Isolated (App Service Environment) tier

The Shared tier, which explicitly shares infrastructure with other tenants rather than providing dedicated isolated infrastructure

The Basic tier, which does not provide the dedicated, fully isolated infrastructure of the Isolated tier

The Standard tier, which does not provide the dedicated, fully isolated infrastructure of the Isolated tier

53 / 80

An administrator needs to move a running virtual machine to a different Azure region. Which general approach is required, since VMs cannot be directly moved across regions?

Assuming region migration is technically impossible under any circumstance for any VM

Assuming VMs can be moved across regions with a single drag-and-drop action in the Azure portal

Recreating the VM in the target region, typically using a snapshot, image, or Azure Site Recovery to migrate the disk data

Simply changing a configuration setting on the existing VM to instantly relocate it to the new region with no other action needed

Renaming the resource group, which has no effect on the VM's underlying physical region

Deleting the VM entirely with no plan to recreate it or migrate its data to the new region

54 / 80

Which Azure VM feature allows an administrator to capture a reusable template of a configured VM, including its OS and installed applications, for quickly deploying multiple identical VMs?

An availability set, which is a fault-tolerance grouping rather than a reusable deployment template

A VM image (custom image)

A managed disk alone, which is the underlying storage rather than specifically the reusable image template built from it

A resource lock, which prevents changes rather than creating a reusable deployment template

A VM extension, which adds functionality to an existing VM rather than creating a reusable template for new VMs

A snapshot, which is typically a point-in-time backup of a disk rather than specifically a reusable deployment template for new VMs

55 / 80

Which Azure Virtual Machine pricing option allows a customer to bid on unused Azure compute capacity at a significant discount, with the trade-off that the VM can be evicted with little notice when Azure needs the capacity back?

Azure Hybrid Benefit, which applies existing on-premises licenses to reduce cost rather than describing this spot capacity bidding model

A Dev/Test pricing offer, which provides discounted rates for non-production environments rather than describing this spot capacity bidding and eviction model

Pay-as-you-go pricing, which offers standard on-demand pricing with no eviction risk and no bidding discount

A savings plan, which is a flexible compute commitment discount rather than describing this specific bidding and eviction model

Azure Spot Virtual Machines

Reserved Instances, which require a 1- or 3-year upfront commitment for a discount, without the eviction risk

56 / 80

Which Azure networking resource filters inbound and outbound traffic to and from resources within a subnet or on a specific network interface, based on rules for source, destination, port, and protocol?

A network security group (NSG)

Azure Firewall, which is a centralized, managed firewall service rather than this more granular, per-subnet/NIC filtering resource

A VPN gateway, which establishes cross-premises connectivity rather than filtering traffic within a virtual network

A virtual network peering connection, which connects two virtual networks rather than filtering traffic based on security rules

A route table, which controls traffic routing paths rather than filtering traffic based on allow/deny rules

A load balancer, which distributes traffic rather than filtering it based on security rules

57 / 80

Which Azure networking feature allows two virtual networks, even in different regions, to communicate directly using private IP addresses, without traffic passing over the public internet?

A public IP address, which is unrelated to establishing private connectivity between two virtual networks

Azure Firewall, which filters and inspects traffic rather than establishing the underlying network connectivity

Virtual network peering

A VPN gateway alone, which is more commonly used for on-premises-to-Azure connectivity rather than the primary, most direct method for connecting two Azure virtual networks

A route table, which controls routing paths within an existing connection rather than establishing the initial connectivity itself

A network security group, which filters traffic rather than establishing connectivity between two virtual networks

58 / 80

Which Azure networking resource distributes incoming network traffic across multiple virtual machines to improve availability and performance, operating at the transport layer (Layer 4)?

A network security group, which filters traffic rather than distributing it across multiple VMs

Azure Load Balancer

Azure Application Gateway, which operates at the application layer (Layer 7) rather than the transport layer

Azure Traffic Manager, which performs DNS-based global traffic routing rather than Layer 4 load balancing within a region

A route table, which controls routing paths rather than distributing traffic across multiple VMs for load balancing purposes

Azure Front Door, which is a global, Layer 7 service rather than a regional, Layer 4 load balancing service

59 / 80

Which Azure networking resource operates at the application layer (Layer 7) and can make routing decisions based on URL path, in addition to providing web application firewall (WAF) capabilities?

A network security group, which filters traffic based on IP/port/protocol rather than making application-layer, URL-based routing decisions

Azure Application Gateway

Azure Traffic Manager, which performs DNS-based global routing rather than in-region, URL-path-based Layer 7 routing

A route table, which controls routing paths rather than making application-layer content-based routing decisions

A VPN gateway, which establishes cross-premises connectivity rather than providing application-layer routing and WAF capabilities

Azure Load Balancer, which operates at the transport layer (Layer 4) rather than the application layer with URL-based routing

60 / 80

Which Azure networking resource establishes an encrypted, site-to-site connection between an on-premises network and an Azure virtual network over the public internet?

A VPN Gateway (Site-to-Site VPN)

Azure Front Door, which is a global content delivery and routing service rather than a site-to-site VPN connectivity mechanism

Azure Load Balancer, which distributes traffic within Azure rather than establishing cross-premises connectivity

Virtual network peering, which connects two Azure virtual networks to each other rather than connecting an on-premises network to Azure

A network security group, which filters traffic rather than establishing cross-premises connectivity

A route table, which controls routing paths within an existing connection rather than establishing that connection itself

61 / 80

Which Azure networking service provides a dedicated, private connection between an on-premises network and Azure, bypassing the public internet entirely for improved reliability and lower latency?

A network security group, which filters traffic rather than establishing the underlying dedicated private connection

Azure Front Door, which is a global content delivery and routing service rather than a dedicated private on-premises connectivity service

A Site-to-Site VPN, which still traverses the public internet, even though the traffic itself is encrypted

Virtual network peering, which connects two Azure virtual networks to each other rather than connecting on-premises to Azure

A Point-to-Site VPN, which connects an individual client device rather than providing this dedicated, high-throughput site-level private connection

Azure ExpressRoute

62 / 80

Which Azure DNS record type maps a domain name directly to an IPv4 address?

An NS record, which specifies authoritative name servers for a domain rather than mapping to an IPv4 address

A TXT record, which stores arbitrary text data rather than mapping to an IPv4 address

An MX record, which specifies mail server routing rather than mapping to an IPv4 address

A CNAME record, which maps a domain name to another domain name (an alias) rather than directly to an IPv4 address

An AAAA record, which maps a domain name to an IPv6 address rather than an IPv4 address

An A record

63 / 80

Which Azure DNS record type maps a domain name to another domain name, commonly used to point a custom subdomain to an Azure service's default domain name?

An NS record, which specifies authoritative name servers rather than mapping a specific subdomain to another domain name

An AAAA record, which maps to an IPv6 address rather than to another domain name

A CNAME record

An A record, which maps directly to an IPv4 address rather than to another domain name

A TXT record, which stores arbitrary text data rather than specifically mapping to another domain name

An MX record, which specifies mail server routing rather than mapping to another domain name for general purposes

64 / 80

Which Azure networking resource allows an administrator to override the default system routes within a virtual network, such as directing traffic through a network virtual appliance for inspection?

A public IP address, which is unrelated to defining custom routing paths

Azure Load Balancer, which distributes traffic across VMs rather than defining custom routing paths

A VPN gateway, which establishes cross-premises connectivity rather than defining custom routing paths within a virtual network

A network security group, which filters traffic based on allow/deny rules rather than controlling the actual routing path taken

Virtual network peering, which establishes connectivity between virtual networks rather than defining custom routing paths within a network

A route table (with user-defined routes)

65 / 80

Which Azure networking resource provides a fully managed, cloud-native network security service that centrally filters traffic across multiple virtual networks and subscriptions, using threat intelligence?

A VPN gateway, which establishes cross-premises connectivity rather than providing this centralized, threat-intelligence-based security filtering

Azure Firewall

Virtual network peering, which establishes connectivity between networks rather than providing centralized security filtering

Azure Load Balancer, which distributes traffic rather than providing centralized, threat-intelligence-based security filtering

A network security group, which provides more granular, per-subnet/NIC filtering rather than this centralized, cross-network managed firewall service

A route table, which controls routing paths rather than providing centralized security filtering

66 / 80

An administrator has two NSG rules with the same priority number applying to the same traffic. What happens in this scenario?

The rule created first is always ignored in favor of the more recently created rule

Both rules are applied simultaneously with no conflict, regardless of priority number

NSG rules do not use priority numbers at all, making this scenario impossible by design

Azure randomly selects one of the two rules to apply on each connection attempt

The traffic is automatically blocked whenever two rules share a priority number

Azure does not allow two rules with the same priority number within the same NSG; each rule must have a unique priority value

67 / 80

Which NSG rule characteristic determines that, when multiple rules could apply to the same traffic, the rule with the lowest priority number takes precedence?

NSG rules are evaluated randomly with no defined precedence order

Rule priority evaluates rules from lowest number to highest, applying the first matching rule

Rule priority evaluates rules from highest number to lowest, applying the first matching rule

NSG rules are evaluated in alphabetical order by rule name rather than by priority number

NSG rules have no evaluation order and all matching rules are applied simultaneously

NSG rules are evaluated based on which rule was created most recently, regardless of priority number

68 / 80

An administrator wants to test whether a specific NSG rule is blocking traffic to a VM, without changing the actual rule configuration. Which Azure tool is most appropriate?

Lifecycle management, which is a storage cost optimization feature unrelated to network connectivity diagnostics

A resource lock, which prevents changes/deletion rather than diagnosing network connectivity issues

A management group, which is an organizational hierarchy unrelated to diagnosing a specific network connectivity issue

A shared access signature, which is a storage access mechanism unrelated to network connectivity diagnostics

IP flow verify (within Azure Network Watcher)

Azure Policy, which enforces configuration compliance rather than diagnosing a specific connectivity issue

69 / 80

Which Azure Network Watcher tool visually traces the actual path network traffic takes between a source and destination, helping diagnose routing or connectivity issues across multiple hops?

Azure Policy, which enforces configuration compliance rather than tracing a network traffic path

A shared access signature, which is a storage access mechanism unrelated to tracing network traffic paths

Lifecycle management, which is a storage cost optimization feature unrelated to tracing network traffic paths

A tag, which is metadata unrelated to tracing a network traffic path

Next hop / Connection troubleshoot (or Network topology visualization)

A resource lock, which prevents changes/deletion rather than tracing a network traffic path

70 / 80

Which Azure service collects and analyzes telemetry, such as metrics and logs, from Azure resources, on-premises environments, and applications, providing a unified monitoring platform?

Azure Advisor, which provides best-practice recommendations rather than serving as the primary telemetry collection and analysis platform

Azure Policy, which enforces configuration compliance rather than collecting and analyzing operational telemetry

Azure Cost Management, which tracks spending rather than collecting operational telemetry

Azure Blueprints, which orchestrates deployment rather than collecting operational telemetry

Azure Monitor

Azure Service Health, which reports on Azure platform incidents rather than serving as the general-purpose telemetry collection platform

71 / 80

Which Azure Monitor data store is optimized for storing and querying structured and unstructured log data, using the Kusto Query Language (KQL)?

A dashboard, which visualizes data rather than storing and querying it

An alert rule, which defines a condition to monitor rather than storing and querying log data itself

An action group, which defines notification/automation responses rather than storing and querying log data

A resource group, which is a general organizational container rather than a specialized log data store

A Log Analytics workspace

A metrics database, which stores lightweight, numeric time-series data rather than richer structured/unstructured log data queried with KQL

72 / 80

Which Azure Monitor component defines the specific condition, such as CPU usage exceeding 90% for 5 minutes, that should trigger a notification or automated action?

An alert rule

A workbook, which provides interactive reporting rather than defining a specific alerting condition

A Log Analytics workspace, which stores log data rather than defining a specific alerting condition

A metric, which is the raw data point being monitored rather than the condition and threshold applied to it

A dashboard, which visualizes data rather than defining a specific alerting condition

An action group, which defines what happens once an alert fires rather than the triggering condition itself

73 / 80

Which Azure Monitor component defines the specific notification or automated response, such as sending an email or triggering an Azure Function, that occurs when an alert rule's condition is met?

An alert rule, which defines the triggering condition rather than the resulting notification/automated response itself

An action group

A metric, which is the raw monitored data point rather than the resulting notification/automated response

A dashboard, which visualizes data rather than defining a notification/automated response

A Log Analytics workspace, which stores log data rather than defining the resulting notification/automated response

A workbook, which provides interactive reporting rather than defining a notification/automated response

74 / 80

Which Azure service backs up virtual machines, databases, and files, allowing an administrator to restore them in the event of accidental deletion, corruption, or a ransomware attack?

Azure Backup

Azure Monitor, which is focused on telemetry collection and alerting rather than backup and restore

Azure Policy, which enforces configuration compliance rather than backup and restore

Soft delete, which is a specific storage-level recovery feature rather than the broader, general-purpose backup service across VM/database/file workloads

Azure Site Recovery, which is primarily focused on disaster recovery replication for business continuity rather than general-purpose scheduled backup and restore

Azure Advisor, which provides best-practice recommendations rather than performing backup and restore operations

75 / 80

Which Azure service replicates virtual machines to a secondary region, enabling failover and business continuity in the event of a regional disaster, distinct from routine data backup?

Azure Monitor, which is focused on telemetry collection and alerting rather than disaster recovery replication

Azure Site Recovery

Azure Backup, which protects against data loss (deletion/corruption) rather than providing ongoing replication for full regional disaster recovery failover

Azure Advisor, which provides best-practice recommendations rather than performing disaster recovery replication

A resource lock, which prevents changes/deletion rather than providing disaster recovery replication

Azure Policy, which enforces configuration compliance rather than disaster recovery replication

76 / 80

Which Azure service allows an administrator to schedule and manage the deployment of operating system updates across multiple Azure and on-premises (via Arc) virtual machines?

Azure Update Manager

Azure Monitor, which is focused on telemetry collection and alerting rather than scheduling and managing OS update deployment

Azure Backup, which protects data through backups rather than scheduling and managing OS update deployment

A VM extension alone, which is a general post-deployment configuration mechanism rather than the specific centralized update scheduling and management service

Azure Policy, which enforces configuration compliance rather than specifically scheduling and managing the OS update deployment process

Azure Site Recovery, which is focused on disaster recovery replication rather than scheduling and managing OS update deployment

77 / 80

Which Azure Monitor visualization tool allows an administrator to combine multiple queries, text, and visualizations into a single, interactive, shareable report?

A Log Analytics workspace alone, which is the underlying data store rather than the interactive report built on top of it

A metric alone, which is a single raw data point type rather than a combined, interactive report incorporating multiple queries and visualizations

A resource lock, which prevents changes/deletion and is unrelated to visualization and reporting

An action group, which defines a notification/automated response rather than providing an interactive, combined visual report

An alert rule, which defines a monitoring condition rather than providing an interactive, combined visual report

A workbook

78 / 80

Which Azure service provides current information about the health of the Azure platform itself, such as ongoing outages or planned maintenance affecting specific services and regions?

A resource lock, which prevents changes/deletion and is unrelated to platform health reporting

Azure Monitor, which is focused on the customer's own resource telemetry rather than the health of the underlying Azure platform itself

Azure Policy, which enforces configuration compliance rather than reporting on platform health

Azure Backup, which protects data rather than reporting on platform health

Azure Advisor, which provides best-practice recommendations for the customer's own resources rather than platform-wide health status

Azure Service Health

79 / 80

An administrator notices a virtual machine's CPU has been consistently near 100% for the past week, and wants a proactive recommendation on whether to resize it. Which Azure service is most appropriate?

Azure Policy, which enforces configuration compliance rather than providing proactive performance optimization recommendations

Azure Advisor

Azure Service Health, which reports on Azure platform incidents rather than providing proactive resource-level optimization recommendations

A resource lock, which prevents changes/deletion and is unrelated to performance optimization recommendations

A tag, which is metadata and is unrelated to performance optimization recommendations

Azure Backup, which protects data through backups rather than providing performance optimization recommendations

80 / 80

Which Azure Monitor concept represents a lightweight, numeric time-series data point, such as CPU percentage sampled every minute, distinct from richer log data?

An alert rule, which defines a condition applied to data rather than being the raw data point itself

A workbook, which is an interactive report built from data rather than being the raw data point itself

A dependency, which is an ARM template concept rather than an Azure Monitor data type

A metric

A log, which is typically richer, structured or unstructured textual data queried with KQL rather than a lightweight numeric time-series sample

An action group, which defines a notification response rather than being the raw data point itself

Your score is

The average score is 95%