Practice test 1 Flashcards
Which of the following services can help you:
Assign time-bound access to resources using start and end dates
Enforce multi-factor authentication to activate any role
- Azure DDos Protection
- Azure Security Center
- Azure Advanced Threat Protection (ATP)
- Azure Privileged Identity Management
4.Azure Privileged Identity Management
Azure Active Directory (Azure AD) Privileged Identity Management (PIM) is a service that enables you to manage, control, and monitor access to important resources in your organization. These resources include resources in Azure AD, Azure, and other Microsoft Online Services like Office 365 or Microsoft Intune.
Reasons to use:
Organizations want to minimize the number of people who have access to secure information or resources, because that reduces the chance of a malicious actor getting that access, or an authorized user inadvertently impacting a sensitive resource. However, users still need to carry out privileged operations in Azure AD, Azure, Office 365, or SaaS apps. Organizations can give users just-in-time (JIT) privileged access to Azure resources and Azure AD. There is a need for oversight for what those users are doing with their administrator privileges.
For all Virtual Machines that have two or more instances deployed across two or more Availability Zones in the same Azure region, you will have Virtual Machine Connectivity to at least one instance guaranteed at least _______ of the time.
1. 99.95%
2. 99.99%
3. 99%
4. 99.5%
- 99.99%
SLA for Virtual Machines
For all Virtual Machines that have two or more instances deployed across two or more Availability Zones in the same Azure region, we guarantee you will have Virtual Machine Connectivity to at least one instance at least 99.99% of the time.
For all Virtual Machines that have two or more instances deployed in the same Availability Set or in the same Dedicated Host Group, we guarantee you will have Virtual Machine Connectivity to at least one instance at least 99.95% of the time.
For any Single Instance Virtual Machine using Premium SSD or Ultra Disk for all Operating System Disks and Data Disks, we guarantee you will have Virtual Machine Connectivity of at least 99.9%.
For any Single Instance Virtual Machine using Standard SSD Managed Disks for Operating System Disk and Data Disks, we guarantee you will have Virtual Machine Connectivity of at least 99.5%.
For any Single Instance Virtual Machine using Standard HDD Managed Disks for Operating System Disks and Data Disks, we guarantee you will have Virtual Machine Connectivity of at least 95%.
Suppose the lead architect in your company has asked your team to implement a PaaS based solution in Azure for a quick Proof-of-Concept (POC) to senior management. One of your colleagues goes ahead and creates an Azure Logic App and an Azure Data Factory instance.
Would you agree with this implementation?
Yes or No
Yes
Azure Logic App and Azure Data Factory both fall under the PaaS (Platform as a Service) category.
Yes or no?
All resource types support Tags in Azure.
No, according to the official documentation, Tags CANNOT be applied to all resource types. Management groups currently don’t support tags.
Yes or No:
Deleting a resource groups deletes all the resources inside it as well.
Yes
Deleting the resource group will remove the resource group as well as all the resources in that resource group. This can be useful for the management of resources. For example, a virtual machine has several components (the VM itself, virtual disks, network adapter etc.).
By placing the VM in its own resource group, you can delete the VM along with all its associated components by deleting the resource group.
Another example is when creating a test environment. You could place the entire test environment (Network components, virtual machines etc.) in one resource group. You can then delete the entire test environment by deleting the resource group.
Which of the following services provides information about Azure service incidents, planned maintenance and can notify you of issues via Email, SMS and push notifications?
- Azure Trust Portal
- Azure Initiatives
- Azure Service Health
- Azure Monitor
- Azure Service Health
Azure Service Health notifies you about Azure service incidents and planned maintenance so you can take action to mitigate downtime. We can configure customizable cloud alerts and use your personalized dashboard to analyze health issues, monitor the impact to your cloud resources, get guidance and support, and share details and updates.
Yes or No:
A resource can belong to more than one resource group
No
No! 1 resource = 1 resource group (very simply logic)
Which of the following affect costs in Azure? (Choose 2)
1. Availability Zone
2. Instance size
3. Knowledge center usage
4. Location
2,4
2. Instance size
4. Location
The instance size and the location (eg -US or Europe etc ) affect the prices. The knowledge center is completely free to use, and you aren’t charged for an Availability Zone.
When computing and processing demand increases beyond an on-premises datacenter’s capabilities, businesses can easily use the ___________ cloud to instantly scale capacity up or down to handle excess capacity.
- Public
- Private
- Public
When computing and processing demand increases beyond an on-premises datacenter’s capabilities, businesses can use the cloud to instantly scale capacity up or down to handle excess capacity. It also allows them to avoid the time and cost of purchasing, installing, and maintaining new servers that they may not always need.
When assigning Azure role-based access control (Azure RBAC) at the management group level, which of the following occurs?
- Permissions are restricted to the management group level only.
- Permissions are assigned individually for each subscription under the management group.
- Permissions are inherited by all sub-management groups, subscriptions, resource groups, and resources under the management group.
- Permissions apply only to the resources within the management group.
- Permissions are inherited by all sub-management groups, subscriptions, resource groups, and resources under the management group.
Permissions are inherited by all sub-management groups, subscriptions, resource groups, and resources under the management group.
When you assign Azure role-based access control (Azure RBAC) at the management group level, the permissions are inherited by all sub-management groups, subscriptions, resource groups, and resources under the management group. This approach simplifies access management and helps maintain consistency across the organization.
Yes or No:
When you create a resource group, you need to provide a location for that resource group.
Yes
When you create a resource group, you need to provide a location for that resource group.
You may be wondering, “Why does a resource group need a location? And, if the resources can have different locations than the resource group, why does the resource group location matter at all?”
The resource group stores metadata about the resources. When you specify a location for the resource group, you’re specifying where that metadata is stored. For compliance reasons, you may need to ensure that your data is stored in a particular region.
When should you scale out your deployment?
- When you need additional Virtual Machines / computers to speed up your application
- When you want to reduce the unused capacity of your system
- When you need to reduce your cost of operation
- When you need a stronger CPU to make your application run faster
- When you need additional Virtual Machines / computers to speed up your application
Scale Out
A scale out operation is the equivalent of creating multiple copies of your web site and adding a load balancer to distribute the demand between them. When you scale out a web site in Azure, there is no need to configure load balancing separately since this is already provided by the platform
Select the characteristics of the Public Cloud from the following:
- Metered pricing
- No capital expenditure to scale up
- Hardware must be purchased for start-up and maintenance.
- Applications can be quickly provisioned and deprovisioned.
- Organizations are responsible for hardware maintenance and updates.
- Unsecured connections
- Metered pricing
- No capital expenditure to scale up
- Applications can be quickly provisioned and deprovisioned.
With the public cloud, you get pay-as-you-go pricing and you pay only for what you use, no CapEx costs are involved.
With the public cloud, you have self-service management. You are responsible for the deployment and configuration of the cloud resources such as virtual machines or web sites. The underlying hardware that hosts the cloud resources is managed by the cloud provider.
Incorrect Answers:
Hardware must be purchased for start-up and maintenance - You don’t have to purchase any hardware on the public cloud. The underlying hardware is shared so you could have multiple customers using cloud resources hosted on the same physical hardware. Moreover, this is a characteristic of the private cloud.
Unsecured Connections - Connections to the public cloud are secure.
Organizations are responsible for hardware maintenance and updates - This is a characteristic of the Private Cloud.
Can you apply a read-only lock to an Azure resource that already has a delete lock applied to it?
- No, but a read-only lock can be temporarily disabled to make modifications
- No, a delete lock overrides all other locks and prevents any modifications or deletions
- Yes, but only by the owner of the subscription
- Yes, but only by the owner of the subscription
As an administrator, you can lock an Azure subscription, resource group, or resource to protect them from accidental user deletions and modifications. The lock overrides any user permissions.
You can set locks that prevent either deletions or modifications. In the portal, these locks are called Delete and Read-only. In the command line, these locks are called CanNotDelete and ReadOnly.
CanNotDelete means authorized users can read and modify a resource, but they can’t delete it.
ReadOnly means authorized users can read a resource, but they can’t delete or update it. Applying this lock is similar to restricting all authorized users to the permissions that the Reader role provides.
Try this out in the Azure portal, you should be able to add a read-only lock to a resource having a CanNotDelete lock already!
Which of the following can be used to manage your Azure Resources from an iPhone?
- Azure Mobile App
- Azure Portal
- Azure CLI
- Azure Cloud Shell
- Windows PowerShell
- Azure Mobile App
- Azure Portal
- Azure Cloud Shell
The Azure portal is the web-based portal for managing Azure. Being web-based, you can use the Azure portal on an iPhone.
Azure Cloud Shell is a web-based command line for managing Azure. You access the Azure Cloud Shell from the Azure portal. Being web-based, you can use the Azure Cloud Shell on an iPhone.
Incorrect Answers:
A: Azure CLI can be installed on MacOS but it cannot be installed on an iPhone.
D: Windows PowerShell can be installed on MacOS but it cannot be installed on an iPhone.
Your organization has an on-premise infrastructure. The requirement from senior management is to migrate everything to the cloud.
As an advisor, what would you recommend to deal with an unexpected Azure outage in a Data Center / Availability Zone?
- Fault Tolerance
- Scalability
- Using cheap resources to lose lesser money
- Elasticity
- Fault Tolerance
There are several mechanisms built into Microsoft Azure to ensure services and applications remain available in the event of a failure. Such failures can include hardware failures, such as hard-disk crashes, or temporary availability issues of dependent services, such as storage or networking services. Azure and its software-controlled infrastructure are written in a way to anticipate and manage such failures. In the event of a failure, the Azure infrastructure (the Fabric Controller) reacts immediately to restore services and infrastructure. For example, if a virtual machine (VM) fails due to a hardware failure on the physical host, the Fabric Controller moves that VM to another physical node based on the same hard disk stored in Azure storage. Azure is similarly capable of coordinating upgrades and updates in such a way as to avoid service downtime.
For computing resources (such as cloud services, traditional IaaS VMs, VM scale sets), the most important and fundamental concepts for enabling high availability are fault domains and upgrade domains. These have been part of Azure since its inception.
What is the primary purpose of Microsoft Defender for Cloud?
1. To monitor security posture and protect against threats in cloud, on-premises, hybrid, and multi-cloud environments.
2. To provide a physical security layer for computing hardware.
3. To automate the deployment of virtual machines in the cloud.
4. To provide network segmentation for virtual machines.
- To monitor security posture and protect against threats in cloud, on-premises, hybrid, and multi-cloud environments.
From the official Microsoft documentation:
Defender for Cloud is a monitoring tool for security posture management and threat protection. It monitors your cloud, on-premises, hybrid, and multi-cloud environments to provide guidance and notifications aimed at strengthening your security posture.
Defender for Cloud provides the tools needed to harden your resources, track your security posture, protect against cyber attacks, and streamline security management. Deployment of Defender for Cloud is easy, it’s already natively integrated to Azure.
Which of the following factors influence the cost of Azure resources? (Select all that apply)
- Maintenance
- Geography
- Consumption
- Resource type
- Geography
- Consumption
- Resource type
The correct answers are - Resource type, Consumption, and Geography. These factors influence the cost of Azure resources. Maintenance, on the other hand, is an important aspect of managing resources to control costs but does not directly influence the cost of the resources themselves.
When you as a consumer are implementing a Software as a Service (SaaS) solution, you are responsible for configuring high availability.
Review the bolded text. If the statement is already correct, select “No change is needed”. If the statement is incorrect, choose the option below that would make the statement correct.
- Installing the SaaS solution
- Configuring the SaaS solution
- No change is needed
- Creating a resource group
- Configuring the SaaS solution
Software as a service (SaaS) allows users to connect to and use cloud-based apps over the Internet. Common examples are email, calendaring, and office tools (such as Microsoft Office 365).
SaaS provides a complete software solution that you purchase on a pay-as-you-go basis from a cloud service provider. You rent the use of an app for your organization, and your users connect to it over the Internet, usually with a web browser. All of the underlying infrastructure, middleware, app software, and app data are located in the service provider’s data center. The service provider manages the hardware and software, and with the appropriate service agreement, will ensure the availability and the security of the app and your data as well. SaaS allows your organization to get quickly up and running with an app at minimal upfront cost.
If you’ve used a web-based email service such as Outlook, Hotmail, or Yahoo! Mail, then you’ve already used a form of SaaS. With these services, you log into your account over the Internet, often from a web browser. The email software is located on the service provider’s network, and your messages are stored there as well. You can access your email and stored messages from a web browser on any computer or Internet-connected device.
The previous examples are free services for personal use. For organizational use, you can rent productivity apps, such as email, collaboration, and calendaring; and sophisticated business applications such as customer relationship management (CRM), enterprise resource planning (ERP), and document management. You pay for the use of these apps by subscription or according to the level of use.
What is the primary goal of the defense-in-depth model in cybersecurity?
- To establish multiple layers of security controls to mitigate risks.
- To outsource security responsibilities to third-party providers.
- To focus solely on physical security measures for data centers.
- To create a single layer of security controls to prevent all threats.
- To establish multiple layers of security controls to mitigate risks.
The defense-in-depth model involves implementing a series of security layers, each providing a different type of protection against threats. This approach minimizes the impact of a single security breach by adding multiple lines of defense.
You want to deploy a file share that can be accessed from multiple Azure virtual machines without setting up a separate file server. Which Azure service can you use to achieve this?
- Azure App Service
- Azure Storage Account
- Azure SQL Database
- Azure Virtual Network
- Azure Storage Account
This is a tricky question. Azure Storage Account is the correct answer as it provides Azure Files, which can be used to create a file share accessible from multiple virtual machines. Remember, we always need to choose the BEST option from the ones provided. Even though Azure Files would’ve been the ideal option, but since its not one of the options we need to go with the best option possible.
Other Options:
Azure SQL Database is a database service and not suitable for sharing files among multiple virtual machines.
Azure Virtual Network is a networking service and not suitable for file sharing.
Azure App Service is a platform for hosting web applications and not suitable for file sharing.
Power BI can access infrequently used data from which of the following?
- Azure Cosmos DB
- Azure PostgreSQL
- Azure SQL Data Warehouse
- Azure DataLake
- Azure SQL Data Warehouse
- Azure DataLake
What is the primary purpose of Microsoft Purview in Azure?
1. To offer a suite of security services for protecting virtual machines.
2. To enable real-time analytics and monitoring for Azure resources.
3. To manage and govern data across on-premises, multi-cloud, and SaaS environments.
4. To provide a cloud-based development platform for building and deploying applications.
- To manage and govern data across on-premises, multi-cloud, and SaaS environments.
Microsoft Purview is designed to help organizations manage, discover, classify, and govern data across a variety of sources, including on-premises, multi-cloud, and software-as-a-service (SaaS) environments. It provides a unified data governance solution to ensure data security, compliance, and data-driven insights.
How does Defender for Cloud contribute to the security of Azure-native services?
1. By enforcing access controls on physical hardware.
2. By natively integrating with Azure services to provide monitoring and protection.
3. By focusing solely on Azure App Service protection.
4. By automatically deploying Log Analytics agents to Azure machines.
- By natively integrating with Azure services to provide monitoring and protection.
Defender for Cloud, being an Azure-native service, natively integrates with Azure services, monitoring and protecting them without requiring additional deployment. This integration enhances the security posture of Azure resources.
Which of the following is a server-less solution that allows you to write less code, maintain less infrastructure, and save on costs.?
1. Azure DevOps
2. Azure Logic Apps
3. Azure Functions
4. Azure App Service
- Azure Functions
Azure Functions allows you to run small pieces of code (called “functions”) without worrying about application infrastructure. With Azure Functions, the cloud infrastructure provides all the up-to-date servers you need to keep your application running at scale.
A function is “triggered” by a specific type of event. Supported triggers include responding to changes in data, responding to messages, running on a schedule, or as the result of an HTTP request.
Few of the features of Azure Functions are:
Which of the following Azure Support Plans grants access to:
1) 24x7 Access to Support Engineers via email and phone
2) Training in the form of webinars from Azure experts
3) Access to the Support API
_______________________________________________________
1. Basic
2. Developer
3. Standard
4. Professional Direct
- Professional Direct
Look at the table below. Clearly, Professional Direct is the correct option.
It is the only option (last column) that fulfills all mentioned requirements.
You’ve been asked by senior management to prepare a presentation describing not only the benefits, but also the estimated cost savings you can realize by migrating your workloads to Azure. As the lead architect, which service would you use for these calculations?
1. Azure Cost Management
2. Azure Advisor
3. Azure TCO calculator
4. Azure Monitor
- Azure TCO calculator
For users wishing to adopt cloud services, Azure provides a web-based TCO Calculator. You can use this calculator to estimate the costs of migrating your data and applications to Azure and predict potential savings.
In the defense-in-depth model, what is the role of the “network” layer?
1. It limits communication between resources and enforces access controls.
2. It secures access to virtual machines.
3. It focuses on securing access to applications.
4. It ensures the physical security of computing hardware.
- It limits communication between resources and enforces access controls.
The “network” layer in the defense-in-depth model is responsible for limiting communication between resources, which helps prevent the spread of attacks. It enforces access controls to ensure that only necessary communication occurs and reduces the risk of an attack affecting other systems.
Yes or No:
It is possible to deploy Azure resources through a Tablet by using Bash in the Azure Cloud Shell.
Yes
Azure Cloud Shell is an interactive, authenticated, browser-accessible (the key to everything since all you need is a browser and the OS doesn’t matter) shell for managing Azure resources. It provides the flexibility of choosing the shell experience that best suits the way you work, either Bash or PowerShell.
You are the senior architect of XYZ organization and the senior management has requested to migrate all on-prem resources to the cloud.
The requirement is that only Platform as a Service (PaaS) solutions must be used in Azure.
Solution: To begin, you create an Azure App Service and Azure SQL databases.
Would this meet the goal?
Yes
Please always remember - Azure App Service and Azure SQL Databases are both PaaS services!
Azure App Service - Allows us to quickly build, deploy, and scale web apps created with popular frameworks such as .NET, .NET Core, Node.js, Java, PHP, Ruby, or Python, in containers or running on any operating system. It offers rigorous, enterprise-grade performance, security, and compliance requirements by using the fully managed platform for your operational and monitoring tasks.
Azure SQL Database - Microsoft Azure SQL Database is a managed cloud database provided as a part of Microsoft Azure. A cloud database is a database that runs on a cloud computing platform, and access to it is provided as a service. Managed database services take care of scalability, backup, and high availability of the database.
Which of the following services allows you to send events generated from Azure resources to applications?
1. Azure Event Grid
2. Azure App Service
3. Azure Cognitive Services
4. Azure Event Hub
- Azure Event Grid
Yes or No:
A resource group can contain resources from multiple Azure regions.
Yes
Resources from multiple different regions can be placed in a resource group. The resource group only contains metadata about the resources it contains.
Yes or No: Permissions are by default inherited by all resources residing in a resource group.
Yes
A resource group can be used to scope access control for administrative actions. By default, permissions set at the resource level are inherited by the resources in the resource group.
For industries that work with highly sensitive data, such as banking, finance, government, and healthcare, ___________ cloud may be their best cloud option.
1. Hybrid
2. Public
3. Private
- Hybrid
For industries that work with highly sensitive data, such as banking, finance, government, and healthcare, hybrid may be their best cloud option. For example, some regulated industries require certain types of data to be stored on-premises while allowing less sensitive data to be stored on the cloud. In this kind of hybrid cloud architecture, organizations gain the flexibility of the public cloud for less regulated computing tasks, while still meeting their industry requirements.
A hacker group recently attacked your video streaming website and all your resources were exhausted and unavailable to your users. What can you do to prevent this type of attack in the future?
1. Use Azure Virtual Networks
2. Use Azure DDoS protection
3. Use an Azure Firewall
4. Use a Network Security Group
- Use Azure DDoS protection
Azure has two DDoS service offerings that provide protection from network attacks (Layer 3 and 4): DDoS Protection Basic and DDoS Protection Standard.
DDoS Protection Basic
Basic protection is integrated into the Azure by default at no additional cost. The scale and capacity of the globally deployed Azure network provides defense against common network-layer attacks through always-on traffic monitoring and real-time mitigation. DDoS Protection Basic requires no user configuration or application changes. DDoS Protection Basic helps protect all Azure services, including PaaS services like Azure DNS.
Basic DDoS protection in Azure consists of both software and hardware components. A software control plane decides when, where, and what type of traffic should be steered through hardware appliances that analyze and remove attack traffic. The control plane makes this decision based on an infrastructure-wide DDoS Protection policy. This policy is statically set and universally applied to all Azure customers.
For example, the DDoS Protection policy specifies at what traffic volume the protection should be triggered. (That is, the tenant’s traffic should be routed through scrubbing appliances.) The policy then specifies how the scrubbing appliances should mitigate the attack.
The Azure DDoS Protection Basic service is targeted at protection of the infrastructure and protection of the Azure platform. It mitigates traffic when it exceeds a rate that is so significant that it might affect multiple customers in a multitenant environment. It doesn’t provide alerting or per-customer customized policies.
DDoS Protection Standard
Standard protection provides enhanced DDoS mitigation features. It’s automatically tuned to help protect your specific Azure resources in a virtual network. Protection is simple to enable on any new or existing virtual network, and it requires no application or resource changes. It has several advantages over the basic service, including logging, alerting, and telemetry. The following sections outline the key features of the Azure DDoS Protection Standard service.
Which of the following is an accurate description of Azure ExpressRoute?
1. A service that provides backup and disaster recovery solutions for Azure resources.
2. A service that provides dedicated, private network connectivity between your on-premises infrastructure and Azure datacenters.
3. A service that enables you to manage and monitor Azure resources from a single, unified dashboard.
4. A service that allows you to connect your on-premises infrastructure to Azure over the public internet.
- A service that provides dedicated, private network connectivity between your on-premises infrastructure and Azure datacenters.
Azure ExpressRoute is a service that provides dedicated, private network connectivity between your on-premises infrastructure and Azure datacenters. This allows you to extend your on-premises network into Azure, providing a more secure and reliable connection than the public internet.
A service that allows you to connect your on-premises infrastructure to Azure over the public internet: This is incorrect because Azure ExpressRoute does not use the public internet for connectivity. Instead, it provides a private, dedicated connection.
A service that provides backup and disaster recovery solutions for Azure resources: This is incorrect because Azure ExpressRoute is not specifically designed for backup and disaster recovery. While it can be used in conjunction with these solutions, it is primarily used for private connectivity.
A service that enables you to manage and monitor Azure resources from a single, unified dashboard: This is incorrect because Azure ExpressRoute is not a management or monitoring tool for Azure resources. It is a connectivity service that enables you to extend your on-premises network into Azure.
Which of the following is a distributed network of servers that can efficiently deliver web content to users?
1. Azure Application Gateway
2. Azure Virtual Network
3. Azure Logic Apps
4. Azure Content Delivery Network
- Azure Content Delivery Network
According to the official docs, a Content Delivery Network (CDN) is a distributed network of servers that can efficiently deliver web content to users. CDNs store cached content on edge servers in point-of-presence (POP) locations that are close to end users, to minimize latency.
Azure Content Delivery Network (CDN) offers developers a global solution for rapidly delivering high-bandwidth content to users by caching their content at strategically placed physical nodes across the world. Azure CDN can also accelerate dynamic content, which cannot be cached, by leveraging various network optimizations using CDN POPs. For example, route optimization to bypass Border Gateway Protocol (BGP).
Which of the following factors can affect the availability of an Azure service under the SLA?
1. Natural disasters
2. Planned maintenance activities
3. Network disruptions outside of Azure
4. Hardware or software failures within Azure
- Natural disasters
- Planned maintenance activities
The Service Level Agreement (SLA) for Azure services guarantees a certain level of availability, which is expressed as a percentage of uptime over a specific period of time. However, certain factors can affect the availability of an Azure service, even if it is covered under the SLA.
Network disruptions outside of Azure, such as issues with your own internet service provider (ISP), can impact your ability to connect to Azure services and can affect their availability. However, these types of disruptions are outside of Microsoft’s control, so they are NOT considered in the Azure SLA.
Planned maintenance activities, which are performed to update or maintain Azure services, can cause temporary downtime. However, Microsoft typically schedules maintenance activities during off-peak hours to minimize their impact on availability.
Hardware or software failures within Azure can cause disruptions to service availability. Microsoft implements measures to minimize the impact of these failures, such as redundancy and failover mechanisms, but they can still occur.
Natural disasters, such as earthquakes or hurricanes, can also impact the availability of Azure services, but this is outside of Microsoft’s control.
You want to restrict access to certain Azure resources based on departmental requirements within your organization. Which Azure feature would you use?
1. Azure Active Directory
2. Subscriptions
3. Management groups
4. Resource groups
- Subscriptions
In this scenario, you would use subscriptions to restrict access to certain Azure resources based on departmental requirements. Subscriptions can be used to apply different access-management policies, reflecting different organizational structures. Azure applies access-management policies at the subscription level, which allows you to manage and control access to the resources that users provision within specific subscriptions.
Other options -
Resource groups: Resource groups are primarily used to organize resources that are related to the same project or have the same lifecycle. They are not specifically designed for access control based on departmental requirements.
Management groups: Management groups are used to efficiently manage access, policies, and compliance for multiple subscriptions, providing a level of scope above subscriptions. They are more suitable for large-scale governance rather than restricting access based on departmental requirements.
Azure Active Directory: While Azure Active Directory (Azure AD) is responsible for handling authentication and authorization, it alone cannot restrict access to certain Azure resources based on departmental requirements. Instead, Azure AD is used in conjunction with other features like subscriptions to control access.
The ___________________ is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area.
1. Center for Internet Security (CIS)
2. American National Standards Institute (ANSI)
3. International Organization for Standardization (ISO)
4. General Data Protection Regulation (GDPR)
- General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area. The GDPR is an important component of EU privacy law and of human rights law, in particular Article 8 of the Charter of Fundamental Rights of the European Union.
Which of the following services would you help achieve the following:
1) Create and manage a group of load balanced VMs.
2) Provide high availability and application resiliency by distributing VMs across availability zones
3) Allows your application to automatically scale as resource demand changes
——————————————————————————————
1. Azure Resource Groups
2. Azure Scale Sets
3. Azure Region Pairs
4. Azure Subscriptions
- Azure Scale Sets
Suppose the lead architect in your company has asked your team to implement a PaaS based solution in Azure for a quick Proof-of-Concept (POC) to senior management. One of your colleagues goes ahead and creates an Azure App Service and 3 Azure Virtual machines.
Would you agree with this implementation?
No
An Azure App Service is a PaaS (Platform as a Service) example so this is not an issue.
However, Azure Virtual machines fall under the category of IaaS (Infrastructure as a Service) service since you’re renting infrastructure. Therefore, we would disagree with this decision.
Is it possible to modify an Azure resource that has a delete lock applied to it?
1. Yes, but only by users with the least privileges
2. No, a delete lock prevents all users from modifying or deleting the resource
3. No, but a delete lock can be temporarily disabled to make modifications
4. Yes, it is possible for the admin to do so
- Yes, it is possible for the admin to do so
As an administrator, you can lock an Azure subscription, resource group, or resource to protect them from accidental user deletions and modifications. The lock overrides any user permissions.
You can set locks that prevent either deletions or modifications. In the portal, these locks are called Delete and Read-only. In the command line, these locks are called CanNotDelete and ReadOnly.
CanNotDelete means authorized users can read and modify a resource, but they can’t delete it.
ReadOnly means authorized users can read a resource, but they can’t delete or update it. Applying this lock is similar to restricting all authorized users to the permissions that the Reader role provides.
_________________ offers fully managed file shares in the cloud that are accessible via the industry standard Server Message Block (SMB) protocol or Network File System (NFS) protocol. This means it can be used to completely replace or supplement traditional on-premises file servers or NAS devices.
1. Azure Files
2. Azure Blob Storage
3. Azure SQL Database
4. Azure Data Lake Storage
- Azure Files
Azure Files is Microsoft’s easy-to-use cloud file system. Azure file shares can be seamlessly used in Windows and Windows Server. To use an Azure file share with Windows, you must either mount it, which means assigning it a drive letter or mount point path, or access it via its UNC path.
Unlike other SMB shares you may have interacted with, such as those hosted on a Windows Server, Linux Samba server, or NAS device, Azure file shares do not currently support Kerberos authentication with your Active Directory (AD) or Azure Active Directory (AAD) identity.
Instead, you must access your Azure file share with the storage account key for the storage account containing your Azure file share. A storage account key is an administrator key for a storage account, including administrator permissions to all files and folders within the file share you’re accessing, and for all file shares and other storage resources (blobs, queues, tables, etc) contained within your storage account.
What is the present maximum capacity for storage accounts?
1. 400 TB
2. 2 PiB
3. 750 TiB
4. 5 PiB
- 5 PiB
The maximum storage account capacity currently is : 5PiB
*These might change with time
Yes or No:
We get total control of the underlying Operating System when working with Platform As a Service (PaaS) solutions.
No
Platform as a service (PaaS) is a complete development and deployment environment in the cloud, with resources that enable you to deliver everything from simple cloud-based apps to sophisticated, cloud-enabled enterprise applications. You purchase the resources you need from a cloud service provider on a pay-as-you-go basis and access them over a secure Internet connection.
Like IaaS, PaaS includes infrastructure—servers, storage, and networking—but also middleware, development tools, business intelligence (BI) services, database management systems, and more. PaaS is designed to support the complete web application lifecycle: building, testing, deploying, managing, and updating.
PaaS allows you to avoid the expense and complexity of buying and managing software licenses, the underlying application infrastructure and middleware, container orchestrators such as Kubernetes, or the development tools and other resources. You manage the applications and services you develop, and the cloud service provider typically manages everything else.
Your company plans to deploy multiple Virtual Machines in Azure. As the lead architect, you must ensure that all these virtual machines are available if a single data center fails.
Solution: You deploy the virtual machines to two or more Availability Zones.
Would this solution meet the goal?
Yes
Absolutely! The answer is in the question itself. If one data center goes down, we can make sure our VM is still running in another data center! This is the entire concept of fault tolerance - Make sure you have enough backups to prevent downtime.
Availability Zones -
An Availability Zone is a high-availability offering that protects your applications and data from datacenter failures. Availability Zones are unique physical locations within an Azure region. Each zone is made up of one or more datacenters equipped with independent power, cooling, and networking (VERY IMPORTANT PLEASE NOTE).
To ensure resiliency, there’s a minimum of three separate zones in all enabled regions. The physical separation of Availability Zones within a region protects applications and data from datacenter failures. Zone-redundant services replicate your applications and data across Availability Zones to protect from single-points-of-failure. With Availability Zones, Azure offers industry best 99.99% VM uptime SLA.
Azure services that support Availability Zones fall into two categories:
1) Zonal services – where a resource is pinned to a specific zone (for example, virtual machines, managed disks, Standard IP addresses), or
2) Zone-redundant services – when the Azure platform replicates automatically across zones (for example, zone-redundant storage, SQL Database).
To achieve comprehensive business continuity on Azure, build your application architecture using the combination of Availability Zones with Azure region pairs. You can synchronously replicate your applications and data using Availability Zones within an Azure region for high-availability and asynchronously replicate across Azure regions for disaster recovery protection.
During live telecasts of football matches, streaming platforms sometimes experience massive spikes in viewerships and users visiting their websites when a goal is scored. Which of the following would be beneficial to deal with such expected demand of resources?
1. Serverless Computing
2. Containers
3. Virtual Machines
4. Kubernetes
- Serverless Computing
Serverless computing enables developers to build applications faster by eliminating the need for them to manage infrastructure. With serverless applications, the cloud service provider automatically provisions, scales, and manages the infrastructure required to run the code.
While understanding the definition of serverless computing, it’s important to note that servers are still running the code. The serverless name comes from the fact that the tasks associated with infrastructure provisioning and management are invisible to the developer. This approach enables developers to increase their focus on the business logic and deliver more value to the core of the business (IMPORTANT). Serverless computing helps teams increase their productivity and bring products to market faster, and it allows organizations to better optimize resources and stay focused on innovation.
Which of the following services provides a personalized view of the health of the Azure services, regions, and resources you rely on?
1. Azure Monitor
2. Azure Service Health
3. Azure Advisor
4. Azure Resource Health
- Azure Service Health
Azure Service Health provides a personalized view of the health of the Azure services, regions, and resources you rely on. The status.azure.com website, which displays only major issues that broadly affect Azure customers, doesn’t provide the full picture. But Azure Service Health displays both major and smaller, localized issues that affect you. Service issues are rare, but it’s important to be prepared for the unexpected. You can set up alerts that help you triage outages and planned maintenance. After an outage, Service Health provides official incident reports, called root cause analyses (RCAs), which you can share with stakeholders.
You have dozens of Virtual Machines (VM) hosted in Azure. The lead architect has asked for your suggestions to migrate all the VMs to an Azure pay-as-you-go subscription. Which expenditure model would apply to the stated requirement?
1. Scalable
2. Operational
3. Capital
4. Fault Tolerant
- Operational
Fault Tolerant and Scalable are wrong answers because such payment models don’t exist. Capital expenditure is also incorrect since we aren’t going to be paying anything up front. Operational makes most sense since it means ‘pay as you go’ , i.e paying only for what you consume and nothing else.
Pay-As-You-Go
This offer is billed at the standard Pay-As-You-Go rates, except as otherwise specified.
You will be notified through email at least 30 days in advance of any changes to the Pay-As-You-Go rates. New services may be added periodically to the Azure platform. Azure will notify you in advance of these new services and any fees that might be charged for using them. However, you would only be charged if you elect to use the new services.
Any taxes which may result from receiving services at no charge are the sole responsibility of the recipient.
How can you determine the estimated monthly cost of an Azure service or resource?
1. By checking the current Azure Marketplace pricing
2. By contacting Microsoft customer support
3. By analyzing the usage data of the resource
4. By using the Azure Pricing Calculator
- By using the Azure Pricing Calculator
The Azure Pricing Calculator is a free tool that can be used to estimate the monthly cost of Azure services and resources based on factors such as region, usage, and quantity. It allows users to select specific Azure services and configurations and provides an estimated monthly cost based on the chosen parameters.
Other options:
By contacting Microsoft customer support : This is incorrect because contacting Microsoft customer support is not a reliable method to determine the estimated monthly cost of an Azure service or resource.
By analyzing the usage data of the resource: This is incorrect because analyzing the usage data of a resource can help in optimizing costs but it does not provide an estimated monthly cost.
By checking the current Azure Marketplace pricing: This is incorrect because checking the current Azure Marketplace pricing does not necessarily provide the estimated monthly cost of a particular service or resource.
Yes or No:
Data in an Azure storage account is replicated 3 times in the primary region.
Yes
Azure Storage always stores multiple copies of your data so that it is protected from planned and unplanned events, including transient hardware failures, network or power outages, and massive natural disasters. Redundancy ensures that your storage account meets the Service-Level Agreement (SLA) for Azure Storage even in the face of failures.
Which of the following displays personalized recommendations for all your subscriptions, and you can use filters to select recommendations for specific subscriptions, resource groups, or services?
1. Azure Service Health
2. Azure Monitor
3. Azure Advisor
4. Azure Arc
- Azure Advisor
Azure Advisor evaluates your Azure resources and makes recommendations to help improve reliability, security, and performance, achieve operational excellence, and reduce costs. Advisor is designed to help you save time on cloud optimization. The recommendation service includes suggested actions you can take right away, postpone, or dismiss.
The recommendations are available via the Azure portal and the API, and you can set up notifications to alert you to new recommendations.
When you’re in the Azure portal, the Advisor dashboard displays personalized recommendations for all your subscriptions, and you can use filters to select recommendations for specific subscriptions, resource groups, or services.
Azure virtual machines (VM) are classified as which of the following offering
1. Platform-as-a-service (Paas)
2. Software-as-a-service (Saas)
3. Infrastructure-as-a-service (Iaas)
4. Database-as-a-service (Daas)
- Infrastructure-as-a-service (Iaas)
According to the official Azure website, Azure VMs are classified as IaaS since you are renting out physical hardware. Refer to this image :
What is the significance of implementing security controls at the “data” layer in the defense-in-depth model?
1. It prevents network-based attacks against resources.
2. It ensures the physical security of data storage.
3. It protects sensitive data and ensures confidentiality, integrity, and availability.
4. It reduces the impact of denial of service (DoS) attacks.
- It protects sensitive data and ensures confidentiality, integrity, and availability.
The “data” layer in the defense-in-depth model is responsible for controlling access to business and customer data. It ensures that sensitive data is properly secured and complies with regulatory requirements, ensuring its confidentiality, integrity, and availability.
You can significantly reduce costs (up-to 72%) as compared to pay-as-you-go pricing by _______________.
1. Using the free tier
2. Using Reserved Instances
3. Not using a lot of resources
4. Provisioning a lot of resources
- Using Reserved Instances
You can significantly reduce costs — up to 72 percent compared to pay-as-you-go prices—with
one-year or three-year terms on Windows and Linux virtual machines (VMs). When you combine the cost savings gained from Azure RIs (reserved instances) with the added value of the Azure Hybrid Benefit, you can save up to 80 percent**.
It is possible to lower your total cost of ownership by combining Azure Reserved Instances with pay-as-you-go prices to manage costs across predictable and variable workloads. In many cases, you can further reduce your costs with reserved instance size flexibility.
Is an internet connection necessary for using cloud computing?
No
The answer is no. Cloud computing services can be used over the internet, but they can also be used through private networks or dedicated connections, such as Azure ExpressRoute, which provides a dedicated, private network connection between on-premises infrastructure and Azure data centers. Some cloud services can also be accessed offline or through local networks.
For example, Azure Stack is a hybrid cloud solution that allows you to use Azure services on-premises, without an internet connection. This can be useful for organizations that have limited or unreliable internet connectivity but still want to take advantage of the benefits of cloud computing.
Similarly, some cloud providers offer edge computing solutions that allow you to run cloud workloads on devices located at the edge of the network, such as in a factory or remote location, without needing a constant internet connection.
In general, however, most cloud services do require an internet connection to access and use them. This is because the underlying infrastructure and resources that support these services are typically hosted in data centers that are connected to the internet.
Yes or No:
If you assign permissions to a resource group, all the resources inside it inherit these permissions.
Yes
Yes, it is true that if you assign certain permissions to a resource group, then all the resources inside it inherit those permissions.
A resource group is a container that holds related resources for an Azure solution. The resource group can include all the resources for the solution, or only those resources that you want to manage as a group. You decide how you want to allocate resources to resource groups based on what makes the most sense for your organization.
Generally, we add resources that share the same lifecycle to the same resource group so you can easily deploy, update, and delete them as a group.
See below (VERY IMPORTANT TO UNDERSTAND AND REMEMBER THIS DIAGRAM):
Yes or No:
One of the definitions of the Hybrid cloud model is to use multiple Public Clouds in conjunction with a Private Cloud.
Yes
A hybrid cloud—sometimes called a cloud hybrid—is a computing environment that combines an on-premises datacenter (also called a private cloud) with a public cloud, allowing data and applications to be shared between them. Some people define hybrid cloud to include “multicloud” configurations where an organization uses more than one public cloud in addition to their on-premises datacenter.
A client of yours is a content creator and would like to be notified via Email whenever their course is purchased. Which of the following solutions would be best suited for this automation?
1. A Server image in Azure Marketplace
2. An API app
3. A Web App
4. A Logic App
- A Logic App
Azure Logic Apps is a cloud service that helps you schedule, automate, and orchestrate tasks, business processes, and workflows when you need to integrate apps, data, systems, and services across enterprises or organizations. Logic Apps simplifies how you design and build scalable solutions for app integration, data integration, system integration, enterprise application integration (EAI), and business-to-business (B2B) communication, whether in the cloud, on premises, or both.
For example, here are just a few workloads you can automate with logic apps:
-> Process and route orders across on-premises systems and cloud services.
-> Send email notifications with Office 365 when events happen in various systems, apps, and services.
-> Move uploaded files from an SFTP or FTP server to Azure Storage.
-> Monitor tweets for a specific subject, analyze the sentiment, and create alerts or tasks for items that need review.
An example of a flow:
Which of the following services can automatically sign users in when they are on their corporate devices & connected to your corporate network?
1. Password Auth
2. Azure Sentinel
3. Single-Sign-On (SSO)
4. Multi-Factor Authentication (MFA)
- Single-Sign-On (SSO)
From the official documentation: Azure Active Directory Seamless Single Sign-On (Azure AD Seamless SSO) automatically signs users in when they are on their corporate devices connected to your corporate network. When enabled, users don’t need to type in their passwords to sign in to Azure AD, and usually, even type in their usernames. This feature provides your users easy access to your cloud-based applications without needing any additional on-premises components.
With single sign-on, users sign in once with one account to access domain-joined devices, company resources, software as a service (SaaS) applications, and web applications. After signing in, the user can launch applications from the Office 365 portal or the Azure AD MyApps access panel. Administrators can centralize user account management, and automatically add or remove user access to applications based on group membership.
An organization would like to create a web app to allow its employees to enter their vacation / time-off details and then store that information in a backend storage solution. They have noted that Python is their preferred language.
As the lead consultant, which service would you recommend?
1. Azure Functions
2. Azure Cosmos DB
3. Azure App Service
4. Azure Kubernetes
- Azure App Service
Azure App Service is an HTTP-based service for hosting web applications, REST APIs, and mobile back ends. You can develop in your favorite language, be it .NET, .NET Core, Java, Ruby, Node.js, PHP, or Python. Applications run and scale with ease on both Windows and Linux-based environments.
It is also possible to scale apps on an enterprise grade platform:
One of the teams in your company is looking for a solution for collecting, analyzing, and potentially taking action based on the metric and logging data from your entire Azure and on-premises environment.
Which of the following would you recommend?
1. Azure Monitor
2. Azure Logs
3. Azure Insights
4. Azure Advisor
- Azure Monitor
Azure Monitor is a platform for collecting, analyzing, visualizing, and potentially taking action based on the metric and logging data from your entire Azure and on-premises environment.
The following diagram illustrates just how comprehensive Azure Monitor is.
On the left is a list of the sources of logging and metric data that can be collected at every layer in your application architecture, from application to operating system and network.
In the center, you can see how the logging and metric data is stored in central repositories.
On the right, the data is used in a number of ways. You can view real-time and historical performance across each layer of your architecture, or aggregated and detailed information. The data is displayed at different levels for different audiences. You can view high-level reports on the Azure Monitor Dashboard or create custom views by using Power BI and Kusto queries.
Additionally, you can use the data to help you react to critical events in real time, through alerts delivered to teams via SMS, email, and so on. Or you can use thresholds to trigger autoscaling functionality to scale up or down to meet the demand.
You have managed an app that you developed and deployed On-Prem for a long time, but would now like to move it to Azure and be relieved of all the manual administration and maintenance. Which of the following buckets would be most suitable for your use case?
1. Infrastructure as a Service (IaaS)
2. Software as a Service (SaaS)
3. Platform as a Service (PaaS)
4. Database as a Service (DaaS)
- Platform as a Service (PaaS)
Platform as a service (PaaS) is a complete development and deployment environment in the cloud, with resources that enable you to deliver everything from simple cloud-based apps to sophisticated, cloud-enabled enterprise applications. You purchase the resources you need from a cloud service provider on a pay-as-you-go basis and access them over a secure Internet connection.
Like IaaS, PaaS includes infrastructure—servers, storage, and networking—but also middleware, development tools, business intelligence (BI) services, database management systems, and more. PaaS is designed to support the complete web application lifecycle: building, testing, deploying, managing, and updating.
PaaS allows you to avoid the expense and complexity of buying and managing software licenses, the underlying application infrastructure and middleware, container orchestrators such as Kubernetes, or the development tools and other resources. You manage the applications and services you develop, and the cloud service provider typically manages everything else.
________________ is the mission-critical cloud, delivering breakthrough innovation to US government customers and their partners. Only US federal, state, local, and tribal governments and their partners have access to this dedicated instance, with operations controlled by screened US citizens.
1. Azure Government
2. Azure United States
3. Azure Nation
4. Azure US
- Azure Government
Azure Government - It is the mission-critical cloud, delivering breakthrough innovation to US government customers and their partners. Only US federal, state, local, and tribal governments and their partners have access to this dedicated instance, with operations controlled by screened US citizens.
Which of the following can you use to implement strict governance and ensure that the right people have access to the right resources, and only when they need it?
1. Microsoft Defender for Cloud
2. Microsoft Sentinel
3. Azure Bastion
4. Azure Active Directory
- Azure Active Directory
Azure Active Directory (Azure AD), part of Microsoft Entra, is an enterprise identity service that provides single sign-on, multifactor authentication, and conditional access to guard against 99.9 percent of cybersecurity attacks.
Microsoft Defender for Cloud - is a solution for cloud security posture management (CSPM) and cloud workload protection (CWP) that finds weak spots across cloud configurations, helps strengthen the overall security posture of environments, and can protect workloads across multicloud and hybrid environments from evolving threats.
Azure Bastion - is a fully managed service that provides more secure and seamless Remote Desktop Protocol (RDP) and Secure Shell Protocol (SSH) access to virtual machines (VMs) without any exposure through public IP addresses.
Microsoft Sentinel - is a birds-eye view across the enterprise. It puts the cloud and large-scale intelligence from decades of Microsoft security experience to work. Make your threat detection and response smarter and faster with artificial intelligence (AI).
Yes or No:
Your company has explored some of the services in Azure Public preview. One of the architects working in your team has advised to deploy mission critical services/applications to these services. Are they correct?
No
According to the official documentation, it is important to note that the services offered in public preview are excluded from the Service Level Agreements (SLAs) . It is therefore not a good idea to deploy production environments on resources / services that are in preview (public or private).
How does the defense-in-depth model enhance cybersecurity compared to relying solely on perimeter security?
1. It eliminates the need for regular security updates.
2. It reduces the need for user authentication.
3. It provides protection against both external and internal threats.
4. It isolates the network from the internet entirely.
- It provides protection against both external and internal threats.
The defense-in-depth model focuses on multiple layers of security, including internal defenses. This strategy provides safeguards against both external threats (outside attackers) and internal threats (compromised insiders).
The remaining options don’t make any sense and rather reduce the security configuration.
True or False: Resources don’t inherit the tags you apply to a resource group or a subscription.
True
Yes, this is true. Resources don’t inherit the tags you apply to a resource group or a subscription. To apply tags from a subscription or resource group to the resources, see Azure Policies - tags.
You plan to create a Netflix like streaming service and would like to serve video content to users worldwide. Which of the following would help you deliver the best possible service with least latency?
1. A content delivery network (CDN)
2. An Azure Load Balancer
3. An Azure Virtual Network NAT
4. An Azure ExpressRoute circuit
- A content delivery network (CDN)
The question states that users are located worldwide and need the least possible latency. The video playback experience would be improved if they can download the video from servers in the same region as the users. We can achieve this by using a Content Delivery Network.
A content delivery network (CDN) is a distributed network of servers that can efficiently deliver web content to users. CDNs store cached content on edge servers in point-of-presence (POP) locations that are close to end users, to minimize latency.
Azure Content Delivery Network (CDN) offers developers a global solution for rapidly delivering high-bandwidth content to users by caching their content at strategically placed physical nodes across the world. Azure CDN can also accelerate dynamic content, which cannot be cached, by leveraging various network optimizations using CDN POPs. For example, route optimization to bypass Border Gateway Protocol (BGP).
The benefits of using Azure CDN to deliver website assets include:
-> Better performance and improved user experience for end users, especially when using applications in which multiple round-trips are required to load content.
-> Large scaling to better handle instantaneous high loads, such as the start of a product launch event.
-> Distribution of user requests and serving of content directly from edge servers so that less traffic is sent to the origin server.
Which of the following actions can help you reduce your Azure costs?
1. Enabling automatic scaling for all virtual machines
2. Increasing the number of virtual machines deployed
3. Keeping all virtual machines running 24/7
4. Reducing the amount of data transferred between Azure regions
- Reducing the amount of data transferred between Azure regions
Reducing the amount of data transferred between Azure regions can help reduce costs by minimizing data egress charges.
Other options:
Deploying more virtual machines: This can actually increase costs if they are not utilized efficiently.
Enabling automatic scaling: This can help optimize resource usage and reduce costs, but it depends on the specific workload and usage patterns.
Keeping virtual machines running 24/7: This can result in unnecessary costs, especially if they are not utilized all the time. It is recommended to use automation to start and stop VMs based on usage patterns.
One of the primary benefits of using an Azure Key Vault is ____________.
1. Enforcing organizational standards and to assess compliance at-scale
2. To see and stop threats before they cause harm
3. Key Management
4. Automatically masking sensitive information
- Key Management
Enforcing organizational standards and to assess compliance at-scale - This is done by Azure Policy.
To see and stop threats before they cause harm - This is done by Azure Sentinel.
From the official documentation:
Key Management - Azure Key Vault can be used as a Key Management solution. Azure Key Vault makes it easy to create and control the encryption keys used to encrypt your data.
You are a tech startup owner and would like to migrate your self hosted apps and services to Azure.
Which of the following is an advantage of the Public Cloud that you’ll realize thanks to the migration?
1. Peace of mind that Azure will send over hardware for you to store in your warehouse.
2. Resources are not shared with others, so higher levels of control and privacy are possible.
3. Near unlimited scalability as on-demand resources are available to meet your business needs.
4. Your organization can customize its cloud environment to meet specific business needs.
- Near unlimited scalability as on-demand resources are available to meet your business needs.
The public cloud is a shared entity whereby multiple corporations each use a portion of the resources in the cloud. The hardware resources (servers, infrastructure etc.) are managed by the cloud provider. Multiple companies create resources such as virtual machines and virtual networks on the hardware resources.
Incorrect Answers:
Resources are not shared with others, so higher levels of control and privacy are possible - This is a characteristic of a Private Cloud.
Your organization can customize its cloud environment to meet specific business needs - This is also a characteristic of a Private Cloud.
Peace of mind that Azure will send over hardware for you to store in your warehouse - Azure stores all infrastructure on their end. You’d be storing hardware that you purchased and incur CapEx in a Private cloud setup.
Yes or No:
Inter-Region transfer of data is always free of cost.
No
It is important to note that data inbound (ingress) is FREE, but data outbound (egress) is NOT FREE.
What is the maximum number of management groups that can be supported in a single directory?
1. 20,000
2. 10,000
3. 1,000
4. 5,000
- 10,000
The maximum number of management groups that can be supported in a single directory is 10,000. This allows for efficient management of access, policies, and compliance for a large number of subscriptions in an organization.
Which of the following statements is accurate?
If you want to migrate a website that is hosted On-Prem presently to Azure, one of the clear benefits is the Pay-As-You-Go Pricing that comes with Azure.
1. This is not true. You need a VPN to complete the migration which will cost a lot.
2. The given statement is correct.
3. This is not true, we first need to pay to transfer all the website data to Azure
4. This is not true, a website hosted on Azure will be costlier as its charged by the second.
- The given statement is correct.
When planning to migrate a website to Azure, the Pay As you Go pricing model is a big advantage. You can even use Azure Websites to accomplish this.
Azure Websites is offered in four tiers: Free, Shared (Preview), Basic and Standard.
Websites Shared (Preview): The price for the Shared tier during preview is $0.013 per hour per website instance (~$10/month). This price reflects a 33% preview discount.
Websites Basic and Standard: The Basic and Standard tiers offer multiple instance sizes as well as scaling to meet changing capacity needs starting from $56 for a Basic (Single Small instance) and $75 for a Standard ( Single small instance)
For more details on features per price tier , click here.
Incorrect Answers:
- You do not need a VPN for Azure web sites.
- You do not pay to transfer data into Azure web sites.
- You are not charged by the second.
Which of the following Azure storage solutions meets ALL the following requirements:
1) The ability to handle unstructured data (document, graph, key-value)
2) Automatically index all data, regardless of the data model.
- Azure Files
- Azure Database for MariaDB
- Azure SQL Edge
- Azure Cache for Redis
- Azure SQL Databases
- Azure Cosmos DB
- Azure Cosmos DB
Today’s applications are required to be highly responsive and always online. To achieve low latency and high availability, instances of these applications need to be deployed in datacenters that are close to their users. Applications need to respond in real time to large changes in usage at peak hours, store ever increasing volumes of data, and make this data available to users in milliseconds.
Azure Cosmos DB is Microsoft’s globally distributed, multi-model database service. With the click of a button, Cosmos DB enables you to elastically and independently scale throughput and storage across any number of Azure regions worldwide. You can elastically scale throughput and storage, and take advantage of fast, single-digit-millisecond data access using your favorite API including: SQL, MongoDB, Cassandra, Tables, or Gremlin. Cosmos DB provides comprehensive service level agreements (SLAs) for throughput, latency, availability, and consistency guarantees, something no other database service offers.
Azure Cosmos DB is a great way to store unstructured and JSON data. Combined with Azure Functions, Cosmos DB makes storing data quick and easy with much less code than required for storing data in a relational database.
How many levels of depth can a management group tree support, excluding the root level and the subscription level?
1. 6
2. 5
3. 4
4. 7
- 6
A management group tree can support up to 6 levels of depth. This limit doesn’t include the root level or the subscription level.
____________ is an agreement with Microsoft to use one or more Microsoft cloud platforms or services, for which charges accrue based on either a per-user license fee or on cloud-based resource consumption.
1. A User Account
2. A License
3. A Resource Group
4. A Subscription
- A Subscription
What Azure service provides recommendations to optimize your cloud spending based on your usage patterns?
1. Azure Policy
2. Azure Advisor
3. Azure Cost Management and Billing
4. Azure Monitor
- Azure Cost Management and Billing
Azure Cost Management and Billing is the correct answer & provides recommendations to optimize your cloud spending based on your usage patterns. The service provides insights and cost management tools to help you monitor, allocate, and optimize your cloud costs.
Other options:
Azure Advisor is a service that provides personalized recommendations to help you optimize your Azure resources for high availability, security, performance, and cost. Azure Advisor also provides recommendations to optimize your cloud spending, but its primary focus is on providing guidance for improving the security, reliability, and performance of your Azure resources. While it may include some cost optimization recommendations, it is not solely focused on cost management and billing like Azure Cost Management and Billing. In such questions we’ll always choose the BEST choice possible.
Azure Monitor is a service that provides a single pane of glass to monitor the performance and health of your applications and infrastructure in Azure.
Azure Policy is a service that enables you to enforce governance policies for your Azure resources to ensure compliance with organizational standards and regulations.
In which scenario is geo-redundant storage (GRS) recommended for Azure Storage?
1. When read access to the secondary region is essential.
2. When cost optimization is the top priority.
3. When protection from regional disasters is required.
4. When data needs to be replicated asynchronously across availability zones.
- When protection from regional disasters is required.
Geo-redundant storage (GRS) copies data synchronously within a single region and then asynchronously to a secondary region, providing durability and protection against regional disasters.
Is there a default spending limit for the Azure Free account?
Yes
A credit of $200 is assigned to the Free account and is valid for 30 days from the date of activation.
Where can you obtain up-to-date details about the personal data Microsoft processes, how it processes it and for what purposes?
1. Compliance Manager
2. Microsoft Privacy Statement
3. Azure Trust Center
4. Azure Knowledge Center
- Microsoft Privacy Statement
Overall explanation
This privacy statement explains the personal data Microsoft processes, how Microsoft processes it, and for what purposes.
Microsoft offers a wide range of products, including server products used to help operate enterprises worldwide, devices you use in your home, software that students use at school, and services developers use to create and host what’s next. References to Microsoft products in this statement include Microsoft services, websites, apps, software, servers, and devices.
Please read the product-specific details in this privacy statement, which provide additional relevant information. This statement applies to the interactions Microsoft has with you and the Microsoft products listed below, as well as other Microsoft products that display this statement.
Select the valid types of storage tiers for Azure Blob Storage?
1. Cold Tier
2. Deep Sleep Tier
3. Infrequently Accessed Tier
4. Hot Tier
5. Archive Storage Tier
- Cold Tier
- Hot Tier
- Archive Storage Tier
Azure storage offers different access tiers, which allow you to store blob object data in the most cost-effective manner. The available access tiers include:
1) Hot Storage- Optimized for storing data that is accessed frequently.
2) Cool Storage- Optimized for storing data that is infrequently accessed and stored for at least 30 days.
3) Archive Storage- Optimized for storing data that is rarely accessed and stored for at least 180 days with flexible latency requirements (on the order of hours).
Yes or No:
When you cancel an Azure Subscription, your resources are immediately deleted permanently to free up space.
No
When you cancel an Azure subscription:
A resource lock doesn’t block the subscription cancellation.
Azure preserves your resources by deactivating them instead of immediately deleting them.
Azure only deletes your resources permanently after a waiting period.
Availability for all Azure services is calculated over a ____________ billing cycle.
1. weekly
2. quarterly
3. yearly
4. monthly
- monthly
Availability for all Azure services is calculated over a monthly billing cycle. Click here to download SLA for most Microsoft Azure Services.
What are the two options for replicating data within the primary region in Azure Storage?
1. Geo-redundant storage and zone-redundant storage.
2. Geo-zone-redundant storage and locally redundant storage.
3. Locally redundant storage and zone-redundant storage.
4. Geo-redundant storage and geo-zone-redundant storage.
- Locally redundant storage and zone-redundant storage.
Data in an Azure Storage account is always replicated three times in the primary region. Azure Storage offers two options for how your data is replicated in the primary region, locally redundant storage (LRS) and zone-redundant storage (ZRS).
Also, Azure Storage offers locally redundant storage (LRS) and zone-redundant storage (ZRS) as options for replicating data within the primary region.
Yes or No:
An Azure subscription can trust multiple Azure Active Directory (Azure AD) tenants
No
An Azure subscription has a trust relationship with Azure Active Directory (Azure AD). A subscription trusts Azure AD to authenticate users, services, and devices.
Please Note :
Multiple subscriptions can trust the same Azure AD directory. Each subscription can only trust a single directory.
Your organization has deployed a Virtual Machine in Azure with the Standard_D2s_v3 VM size. The Virtual Machine is running a resource-intensive workload, and you want to optimize costs. Which of the following could be an effective way to achieve this?
1. Enable automatic scaling to adjust VM size based on workload
2. Use a larger VM size to improve performance
3. Use a different Azure region with lower VM pricing.
4. Use a smaller VM size to reduce costs
- Enable automatic scaling to adjust VM size based on workload
The correct answer is ‘Enable automatic scaling to adjust VM size based on workload’ as it could be an effective way to optimize costs for the Virtual Machine in Azure. Automatic scaling allows you to automatically adjust the number of Virtual Machine instances and the size of the instances based on demand, which can help you save costs by avoiding overprovisioning.
Using a larger VM size : This would increase costs as its more expensive to use a larger VM size.
Using a smaller VM size: This could reduce performance and may not be suitable for a resource-intensive workload.
Using a different Azure region with lower VM pricing: This may not be a practical solution if the workload requires a specific region for compliance or latency reasons.
Yes or No:
Azure Advisor has the ability to provide recommendations for Azure ExpressRoute.
Yes
Advisor is a personalized cloud consultant that helps you follow best practices to optimize your Azure deployments. It analyzes your resource configuration and usage telemetry and then recommends solutions that can help you improve the cost effectiveness, performance, Reliability (formerly called High availability), and security of your Azure resources.
Advisor provides recommendations for Application Gateway, App Services, availability sets, Azure Cache, Azure Data Factory, Azure Database for MySQL, Azure Database for PostgreSQL, Azure Database for MariaDB, Azure ExpressRoute, Azure Cosmos DB, Azure public IP addresses, Azure Synapse Analytics, SQL servers, storage accounts, Traffic Manager profiles, and virtual machines.
Azure Advisor also includes your recommendations from Microsoft Defender for Cloud which may include recommendations for additional resource types.
True or False:
Each Azure Subscription can trust multiple Active Directories.
False
An Azure subscription has a trust relationship with Azure Active Directory (Azure AD). A subscription trusts Azure AD to authenticate users, services, and devices.
Multiple subscriptions can trust the same Azure AD directory. Each subscription can only trust a single directory.
Is it possible to run a PowerShell module directly from a Windows computer with Azure PowerShell installed?
Yes
A Powershell script can create Azure resources, and since the Powershell module is installed on the Windows computer, this is easily doable.
Yes or No:
When a subscription expires, the trusted instance of the Azure AD service remains, but the security principals still maintain access to Azure resources.
No
An Azure subscription has a trust relationship with Azure Active Directory (Azure AD). A subscription trusts Azure AD to authenticate users, services, and devices.
Multiple subscriptions can trust the same Azure AD directory. Each subscription can only trust a single directory.
One or more Azure subscriptions can establish a trust relationship with an instance of Azure Active Directory (Azure AD) in order to authenticate and authorize security principals and devices against Azure services. When a subscription expires, the trusted instance of the Azure AD service remains, but the security principals LOSE access to Azure resources.
Which of the following requires the greatest security effort on your part?
- Infrastructure as a service (Iaas)
- Software as a service (Saas)
- Platform as a service (Paas)
- Database as a service (Daas)
- Infrastructure as a service (Iaas)
IaaS (Infrastructure as a Service) is, in effect, where a cloud provider hosts the infrastructure components traditionally present in an on-premises data center including servers (operating systems), storage and networking hardware as well as the virtualization or hypervisor layer.
From a security perspective, this offering is probably the closest to traditional in-house IT infrastructure, (Indeed, many companies will effectively move existing server payloads to IaaS either partially or completely resulting in a hybrid solution.) and it will require much of the same security tools as a result.
Yes or No:
Australia is composed of 1 single Azure Region.
No
No, Australia has several Azure regions -
Including Australia East, Central, Southeast etc.
Yes or No:
The composite SLA for an application replying on multiple services would be higher than the individual SLAs of the particular services.
No
Composite SLAs involve multiple services supporting an application, each with differing levels of availability.
For example, consider an App Service web app that writes to Azure SQL Database. At the time of this writing, these Azure services have the following SLAs:
App Service web apps = 99.95%
SQL Database = 99.99%
What is the maximum downtime you would expect for this application? If either service fails, the whole application fails. The probability of each service failing is independent, so the composite SLA for this application is 99.95% × 99.99% = 99.94%. That’s LOWER than the individual SLAs, which isn’t surprising because an application that relies on multiple services has more potential failure points.
You can improve the composite SLA by creating independent fallback paths. For example, if SQL Database is unavailable, put transactions into a queue to be processed later.
With this design, the application is still available even if it can’t connect to the database. However, it fails if the database and the queue both fail at the same time. The expected percentage of time for a simultaneous failure is 0.0001 × 0.001, so the composite SLA for this combined path is:
Database or queue = 1.0 − (0.0001 × 0.001) = 99.99999%
The total composite SLA is:
Web app and (database or queue) = 99.95% × 99.99999% = ~99.95%
There are tradeoffs to this approach. The application logic is more complex, you are paying for the queue, and you need to consider data consistency issues.
Which of the following statements BEST describes the Modern Lifecycle Policy for Azure products and services?
- For products governed by the Modern Lifecycle Policy, Microsoft will provide a minimum of 12 months’ notification prior to ending support if no successor product or service is offered—excluding free services or preview releases.
- For products and services governed by the Modern Lifecycle Policy, unless otherwise noted, Microsoft’s policy is to provide a minimum 90 days’ notification when customers are required to take action in order to avoid significant degradation to the normal use of the product or service.
- For products governed by the Modern Lifecycle Policy, Microsoft will provide a minimum of 6 months’ notification prior to ending support if no successor product or service is offered—excluding free services or preview releases.
- For products and services governed by the Modern Lifecycle Policy, unless otherwise noted, Microsoft’s policy is to provide a minimum 120 days’ notification when customers are required to take action in order to avoid significant degradation to the normal use of the product or service.
- For products governed by the Modern Lifecycle Policy, Microsoft will provide a minimum of 12 months’ notification prior to ending support if no successor product or service is offered—excluding free services or preview releases.
The Modern Lifecycle Policy covers products and services that are serviced and supported continuously. Under this policy, the product or service remains in support if the following criteria are met:
Customers must stay current as per the servicing and system requirements published for the product or service.
Customers must be licensed to use the product or service.
Microsoft must currently offer support for the product or service.
What information can you input into the TCO calculator to estimate the cost difference between your current datacenter and Azure? (Select all that apply)
- Power costs
- Subscription type
- Current infrastructure configuration
- IT labor costs
- Power costs
- Current infrastructure configuration
- IT labor costs
Current infrastructure configuration - Correct, the TCO calculator allows you to input your current infrastructure configuration, including servers, databases, storage, and outbound network traffic.
Power costs - Correct, the TCO calculator lets you add assumptions about power costs in your current environment to estimate the cost difference between on-premises and Azure.
IT labor costs - Correct, the TCO calculator allows you to include assumptions about IT labor costs to help estimate the cost difference between your current environment and Azure.
Subscription type - Incorrect, the TCO calculator focuses on comparing on-premises infrastructure costs with Azure Cloud infrastructure costs. Subscription type is not part of the input for the TCO calculator.
If you setup a free Azure account, then does the Standard support plan come along with this free account?
No
The BASIC Support plan is associated with all accounts but a STANDARD plan needs to be purchased and costs $100/month.
What is the key advantage of using zone-redundant storage (ZRS) in the primary region?
- It offers the highest level of durability compared to other options.
- It allows data to be accessible even if a zone becomes unavailable.
- It guarantees data replication to a secondary region.
- It provides read access to replicated data in the secondary region.
- It allows data to be accessible even if a zone becomes unavailable.
For Availability Zone-enabled Regions, zone-redundant storage (ZRS) replicates your Azure Storage data synchronously across three Azure availability zones in the primary region. ZRS offers durability for Azure Storage data objects of at least 12 nines (99.9999999999%) over a given year. With ZRS, your data is still accessible for both read and write operations even if a zone becomes unavailable.
A startup is planning to run a few simulations and needs to deploy pre-configured Virtual Machines in a lab-like environment using ARM templates. These VMs will be used to test app versions and scale up load testing by creating multiple test agents and environments.
As the principal consultant, which of the following services would you recommend?
- Azure Virtual Machine Scale Sets
- Azure DevTest Labs
- Azure Reserved Virtual Machine (VM) Instances
- Microsoft Managed Desktop
- Azure DevTest Labs
Azure DevTest Labs is a service for easily creating, using, and managing infrastructure-as-a-service (IaaS) virtual machines (VMs) and platform-as-a-service (PaaS) environments in labs. Labs offer preconfigured bases and artifacts for creating VMs, and Azure Resource Manager (ARM) templates for creating environments like Azure Web Apps or SharePoint farms.
Lab owners can create preconfigured VMs that have tools and software lab users need. Lab users can claim preconfigured VMs, or create and configure their own VMs and environments. Lab policies and other methods track and control lab usage and costs.
Which of the following is a great place to start when examining the security of your Azure-based solutions and provides threat protection across all of your services both in Azure, and on-premises?
- Azure Compliance Manager
- Azure Security Center
- Azure Advanced Threat Protection
- Azure Trust Center
- Azure Security Center
A great place to start when examining the security of your Azure-based solutions is Azure Security Center. Security Center is a monitoring service that provides threat protection across all of your services both in Azure, and on-premises. Security Center can:
1) Provide security recommendations based on your configurations, resources, and networks.
2) Monitor security settings across on-premises and cloud workloads, and automatically apply required security to new services as they come online.
3) Continuously monitor all your services, and perform automatic security assessments to identify potential vulnerabilities before they can be exploited.
4) Use machine learning to detect and block malware from being installed on your virtual
machines and services. You can also define a list of allowed applications to ensure that only the apps you validate are allowed to execute.
5) Analyze and identify potential inbound attacks, and help to investigate threats and any post-breach activity that might have occurred.
Azure _____________ are unique physical buildings—located all over the globe—that house a group of networked computer servers.
- Availability Zones
- Geographies
- Regions
- Datacenters
- Datacenters
Azure datacentres are unique physical buildings—located all over the globe—that house a group of networked computer servers.
Yes or No:
Azure guarantees 99.99% availability for the Free version of the Azure Active Directory (AAD).
No
Which of the following can you use to filter traffic to and from an Azure Virtual Network?
- Azure DDoS Protection
- Azure Firewall
- Azure Advanced Threat Protection (ATP)
- Azure Network Security Group
- Azure Network Security Group
You can use Azure network security group to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources.
For each rule, you can specify source and destination, port, and protocol. This article describes properties of a network security group rule, the default security rules that are applied, and the rule properties that you can modify to create an augmented security rule.
_______ is capable of sending encrypted traffic between an Azure virtual network and an on-premises location over the public Internet.
- A VPN Gateway
- An Application Gateway
- A Firewall
- Network Security Group (NSG)
- A VPN Gateway
A VPN gateway is a specific type of virtual network gateway that is used to send encrypted traffic between an Azure virtual network and an on-premises location over the public Internet. You can also use a VPN gateway to send encrypted traffic between Azure virtual networks over the Microsoft network. Each virtual network can have only one VPN gateway. However, you can create multiple connections to the same VPN gateway. When you create multiple connections to the same VPN gateway, all VPN tunnels share the available gateway bandwidth.
Yes or No:
Every Azure region is composed of a set of datacenters.
Yes
A region is a set of datacenters deployed within a latency-defined perimeter and connected through a dedicated regional low-latency network. Each Azure region has a minimum of three availability zones.
A company has approached you to help them plan an architecture, that would be capable of capturing data from millions of connected devices and securely storing them for analysis. Which of the following two services would you include in the project proposal?
- Azure Data Lake
- Azure Notification Hubs
- Azure IoT Hubs
- Azure ExpressRoute
- Azure Data Lake
- Azure IoT Hubs
Azure IoT Hub is a managed service hosted in the cloud that acts as a central message hub for communication between an IoT application and its attached devices. You can connect millions of devices and their backend solutions reliably and securely. Almost any device can be connected to an IoT hub.
Several messaging patterns are supported, including device-to-cloud telemetry, uploading files from devices, and request-reply methods to control your devices from the cloud. IoT Hub also supports monitoring to help you track device creation, device connections, and device failures.
IoT Hub scales to millions of simultaneously connected devices and millions of events per second to support your IoT workloads. For more information about scaling your IoT Hub, see IoT Hub scaling. To learn more about the tiers of service offered by IoT Hub, check out the pricing page.
IoT Hub can further route messages to Azure Data Lake Storage.
Which of the following services can facilitate the deployment and scaling of containers?
- Azure Kubernetes
- Azure Logic Apps
- Azure Active Directory
- Azure Cognitive Services
- Azure Kubernetes
Azure Kubernetes Service (AKS) offers the quickest way to start developing and deploying cloud-native apps, with built-in code-to-cloud pipelines and guardrails. Get unified management and governance for on-premises, edge, and multicloud Kubernetes clusters. Interoperate with Azure security, identity, cost management, and migration services.
Which of the following services would you use to embed the ability to see, hear, speak, search, understand, and accelerate decision-making into your apps without having any machine-learning expertise?
- Azure App Service
- Azure Machine Learning Studio
- Azure Events Hub
- Azure Cognitive Services
- Azure Cognitive Services
Cognitive Services bring AI within reach of every developer—without requiring machine-learning expertise. All it takes is an API call to embed the ability to see, hear, speak, search, understand, and accelerate decision-making into your apps.
________________ is a cloud-based platform for creating and running automated workflows that integrate your apps, data, services, and systems.
- Azure Logic Apps
- Azure App Service
- Azure Events Hub
- Azure DevOps
- Azure Logic Apps
Azure Logic Apps is a cloud service that helps you schedule, automate, and orchestrate tasks, business processes, and workflows when you need to integrate apps, data, systems, and services across enterprises or organizations.
Yes or No:
ExpressRoute connections go over the public Internet, and they offer more reliability, faster speeds, and lower latencies than typical Internet connections.
No
No, it is false that ExpressRoute connections go over the public Internet. However, they do offer more reliability, faster speeds, and lower latencies than typical Internet connections.
All incoming data into Azure using ExpressRoute is free of charge (as with any other inbound data transfer to Azure).
An Azure ________________ is a connection between two Azure Regions within the same geographic region for disaster recovery purposes.
- Region
- Availability Zone
- Geography
- Region Pair
- Region Pair
Regional Pairs are 2 connected Azure Regions for Disaster Recovery within the same Geography.
Many organizations require both high availability provided by availability zones that are also supported with protection from large-scale phenomena and regional disasters. As discussed in the resiliency overview for regions and availability zones, Azure regions are designed to offer protection against local disasters with availability zones. But they can also provide protection from regional or large geography disasters with disaster recovery by making use of another region that uses cross-region replication.
To ensure customers are supported across the world, Azure maintains multiple geographies. These discrete demarcations define a disaster recovery and data residency boundary across one or multiple Azure regions.
Cross-region replication is one of several important pillars in the Azure business continuity and disaster recovery strategy. Cross-region replication builds on the synchronous replication of your applications and data that exists by using availability zones within your primary Azure region for high availability. Cross-region replication asynchronously replicates the same applications and data across other Azure regions for disaster recovery protection.
You can link virtual networks together by using ________________.
- Virtual Network Seeding
- Virtual Network Proxy
- Virtual Network Peering
- Virtual Network Hub
- Virtual Network Peering
You can link virtual networks together by using virtual network peering. Peering enables resources in each virtual network to communicate with each other. These virtual networks can be in separate regions, which allows you to create a global interconnected network through Azure.
User-defined routes (UDR) are a significant update to Azure’s Virtual Networks that allows for greater control over network traffic flow. This method allows network administrators to control the routing tables between subnets within a VNet, as well as between VNets.
What is the maximum number of virtual network rules and IP network rules allowed per storage account in Azure?
- 300
- 150
- 200
- 500
- 200
