Free Microsoft AZ-900 Practice Questions

Correct answer: B. Read-only geo-redundant storage

Read-access geo-redundant storage (RA-GRS) replicates data three times in the primary region and asynchronously to a paired region far away. Unlike plain GRS, it also allows data to be read from the secondary region at any time. That meets all three requirements, including reads from both locations.

Why the other options are wrong

• A. Plain GRS replicates to a secondary region but does not allow reads from it unless a failover occurs.
• C. Zone-redundant storage keeps data within a single region, so it does not provide separate geographic locations.
• D. Locally redundant storage keeps all copies in one datacenter, so it offers no geographic separation.

Correct answer: B. No

The Professional Direct support plan is not a valid Azure support tier. Azure support plans include Basic (free), Developer, Standard, and Professional Direct. However, the requirement is to assess Azure environment design from Microsoft while minimizing costs. The appropriate plan would be Standard or Professional Direct. Since the question recommends Professional Direct (which does exist), but asks if this meets the goal of minimum expense, the Standard plan would be more cost-effective for design assessments. The answer is No because Professional Direct is the most expensive option, contradicting the cost minimization requirement.

Why the other options are wrong

• A. No is the correct answer; Professional Direct is the premium support plan and does not minimize expenses.

Correct answer: B. No

SaaS (Software as a Service) is not appropriate for deploying Azure virtual machines. SaaS provides fully managed applications accessed through a web browser, such as Microsoft 365 or Salesforce. Deploying virtual machines requires infrastructure-level control, which SaaS does not provide. Virtual machines are part of the IaaS (Infrastructure as a Service) cloud model, where you manage the VMs, operating systems, and applications while Azure manages the underlying infrastructure.

Why the other options are wrong

• A. Yes is incorrect; SaaS is not used for deploying virtual machines.

Correct answer: B. No

PaaS (Platform as a Service) is not the appropriate solution for deploying Azure virtual machines. PaaS provides a managed platform for developing and running applications, such as Azure App Service or Azure SQL Database, without managing underlying compute resources. Deploying virtual machines requires direct infrastructure control at the IaaS level. With PaaS, you cannot deploy and manage virtual machines yourself; the platform abstracts away infrastructure management entirely.

Why the other options are wrong

• A. Yes is incorrect; PaaS does not allow direct VM deployment and management.

Correct answer: A. Yes

IaaS (Infrastructure as a Service) is the correct cloud deployment solution for deploying Azure virtual machines. IaaS provides virtualized computing resources over the internet, allowing you to provision, configure, and manage virtual machines, storage, and networking. Azure Virtual Machines is a core IaaS offering that gives you complete control over the VM lifecycle, operating system, and applications while Azure manages the underlying physical infrastructure.

Why the other options are wrong

• B. No is incorrect; IaaS is precisely the correct model for VM deployment.

Correct answer: A. Standard

The Standard plan is required to meet all requirements. Standard supports custom domains, provides dedicated compute instances (eliminating shared resources), includes load balancing across instances, and offers sufficient storage (10 GB requirement). Basic does not support custom domains and lacks load balancing. Free and Shared plans do not support custom domains or dedicated instances. While Standard costs more than Basic, it is the minimum tier that satisfies all stated requirements including custom domains and load balancing.

Why the other options are wrong

• B. Basic does not support custom domains, which is a requirement.
• C. Free tier does not support custom domains or dedicated instances.
• D. Shared tier does not support custom domains or provide dedicated compute instances.

Correct answer: B. No

Using multiple Azure Active Directory directories does not minimize administrative effort; it actually increases complexity. The recommended approach is to use a single Azure AD directory with multiple subscriptions organized by division, combined with management groups and role-based access control (RBAC) to segment resources and delegate administrative rights. Multiple directories would require managing separate tenants, increasing administrative overhead for identity management, licensing, and cross-directory collaboration.

Why the other options are wrong

• A. Yes is incorrect; multiple directories increase rather than decrease administrative effort.

Correct answer: A. Standard

The Standard plan is the minimum tier that meets all requirements. It supports custom domains (miami.weyland.com), allows deployment to multiple instances (two instances for load balancing), includes SSL/TLS support, and provides the required 12 GB of storage. Basic tier does not include custom domain support. Free and Shared tiers lack both custom domain and SSL support. Standard is the most cost-effective option that satisfies all stated requirements while meeting the deployment needs for a public-facing web application.

Why the other options are wrong

• B. Basic tier does not support custom domains, which is explicitly required.
• C. Free tier does not support custom domains or SSL certificates.
• D. Shared tier does not support custom domains or SSL/TLS encryption.

Correct answer: B. No

The question asks about the correct expenditure model for migrating VMs to Azure pay-as-you-go subscription. 'Elastic expenditure model' is not a recognized Azure expenditure model term. The company is migrating to pay-as-you-go, which is an operational expenditure (OpEx) model, not something called 'elastic expenditure model.' Therefore, the solution does not meet the goal.

Why the other options are wrong

• A. Elastic expenditure model is not a standard Azure expenditure model classification.

Correct answer: B. No

The question asks about the correct expenditure model for migrating VMs to Azure pay-as-you-go subscription. 'Scalable expenditure model' is not a recognized Azure expenditure model term. Azure distinguishes between CapEx (capital expenditure) and OpEx (operational expenditure). A pay-as-you-go subscription follows the operational expenditure model, not a 'scalable' one. Therefore, the solution does not meet the goal.

Why the other options are wrong

• A. Scalable expenditure model is not a standard Azure expenditure classification; the correct term is operational expenditure.

Correct answer: A. Yes

The question asks about the correct expenditure model for migrating VMs to an Azure pay-as-you-go subscription. The operational expenditure (OpEx) model is exactly what pay-as-you-go subscriptions represent, you pay only for what you use without large upfront capital investments. This is the correct expenditure model for cloud migration scenarios where companies shift from owning infrastructure (CapEx) to renting it (OpEx). Therefore, the solution meets the goal.

Why the other options are wrong

• B. The operational expenditure model perfectly aligns with pay-as-you-go Azure subscriptions.

Correct answer: A. No change is needed

The statement is correct as written. Azure SQL Data Warehouse (now Azure Synapse Analytics) includes built-in high availability features such as geo-redundant backups and automatic failover capabilities, making high availability an inherent platform benefit.

Why the other options are wrong

• B. Automatic scaling is a feature but is not the primary benefit being referenced in the statement.
• C. Data compression is a storage optimization feature, not a high availability benefit.
• D. Versioning is not a standard benefit of Azure SQL Data Warehouse.

Correct answer: D. Microsoft Defender for Cloud

Microsoft Defender for Cloud is the Azure service that provides secure score functionality, which helps you understand your security posture and recommendations to improve it. It displays a numerical representation of your security health across your Azure resources.

Why the other options are wrong

• A. Azure Monitor is for collecting and analyzing telemetry data, not for security scoring.
• B. Azure Advisor provides general optimization recommendations but not security scoring.
• C. Help + support is for getting customer support, not for reviewing security metrics.

Correct answer: A. Yes

Azure DevTest Labs is specifically designed for developers to quickly create and destroy temporary VMs with minimal administrative overhead. It supports both Windows and Linux systems, automates resource provisioning and deprovisioning, includes cost management features, and allows for custom VM configurations. This service directly addresses the requirement to reduce administrative effort for weekly VM deployment and removal cycles with mixed operating systems.

Why the other options are wrong

• B. Azure DevTest Labs is purpose-built for this exact scenario of rapid development VM provisioning and teardown.

Correct answer: B. No

Deploying virtual machines to multiple resource groups does not protect against a single data center failure. Resource groups are logical containers for organization and management purposes only; they do not affect the physical placement of resources. Multiple resource groups in the same region or even the same data center would still be vulnerable to a data center outage. To protect against data center failures, you need to use Availability Zones or deploy across multiple regions.

Why the other options are wrong

• A. Resource groups are purely organizational tools and have no bearing on physical redundancy or data center protection.

Correct answer: B. Azure Machine Learning Designer

Azure Machine Learning Designer is specifically designed for building, testing, and deploying predictive analytics and AI solutions. It provides a visual interface and tools for creating end-to-end machine learning workflows.

Why the other options are wrong

• A. Azure Logic Apps is for workflow automation and integration, not for building machine learning models.
• C. Azure Batch is for running large-scale parallel computing jobs, not for predictive analytics specifically.
• D. Azure Cosmos DB is a NoSQL database, not a tool for building or deploying machine learning solutions.

Correct answer: B. No

No, this solution does not meet the goal. PowerApps is a low-code platform for building business applications and workflows, not an Azure infrastructure management tool. PowerApps cannot be used to create Azure virtual machines. While it can integrate with Azure services, it is not designed for VM provisioning and does not provide the necessary functionality to create VMs.

Correct answer: A. Yes

Yes, this solution meets the goal. Azure Cloud Shell is accessible from any device with a web browser, including Android tablets. Cloud Shell provides both PowerShell and Bash environments that can be used to create Azure virtual machines using commands like New-AzVM in PowerShell. Since an Android tablet has a browser, the user can access the Azure portal, open Cloud Shell, and execute PowerShell commands to create a VM.

Correct answer: A, D. multiple subscriptions; multiple resource groups

Multiple subscriptions and multiple resource groups are both valid techniques to segment Azure for different departments with separate management. Multiple subscriptions provide complete isolation and independent billing, allowing department administrators to manage resources separately with distinct identity and access control. Multiple resource groups within subscriptions also allow logical separation of department resources. Multiple Azure AD directories and multiple regions are not practical segmentation solutions for department-level resource management.

Why the other options are wrong

• B. Multiple Azure AD directories would overcomplicate identity management and is not a standard approach for departmental segmentation.
• C. Multiple regions are used for geographic distribution and disaster recovery, not for departmental segmentation.

Correct answer: C. Azure Key Vault

Azure Key Vault is the dedicated service for storing and managing certificates, keys, and secrets securely in Azure. It provides secure storage, access control, and audit logging for sensitive cryptographic material. Azure Security Center is for security monitoring and threat detection. Azure Storage accounts are for general data storage, not for certificate management. Azure Information Protection is for data classification and protection.

Why the other options are wrong

• A. Azure Security Center is a security monitoring and threat management tool, not a certificate storage service.
• B. Azure Storage accounts are designed for general-purpose data storage, not for secure certificate management.
• D. Azure Information Protection is for data classification and encryption of sensitive information, not for certificate storage.

Correct answer: A. fault tolerance

Fault tolerance is the ability of a system to continue operating and remain available even when one or more components fail. To ensure that servers remain available if a single Azure data center goes offline, the solution must include fault tolerance through mechanisms like redundancy across availability zones or multiple data centers. This guarantees continued service availability despite infrastructure failures.

Why the other options are wrong

• B. Elasticity refers to scaling resources up or down based on demand, not to maintaining availability during data center outages.
• C. Scalability refers to the ability to increase capacity to handle more load, not to maintaining availability during infrastructure failures.
• D. Low latency refers to minimizing network delay, not to ensuring availability during data center failures.

Correct answer: A. Yes

Deploying virtual machines across two or more availability zones ensures services remain available if a single datacenter fails. Availability zones are physically separate datacenters within a region designed for this exact purpose.

Correct answer: A. Yes

Deploying virtual machines to two or more regions ensures that if a single data center (or even an entire region) fails, the services remain available in other regions. This multi-region deployment strategy provides geographic redundancy and meets the goal of protecting against single data center failures.

Why the other options are wrong

• B. Multi-region deployment is a proven and effective strategy for achieving high availability across data center failures.

Correct answer: A. hybrid

A hybrid cloud model combines on-premises infrastructure with cloud-based resources, allowing organizations to use both environments together. This provides flexibility, allowing workloads to run where they are most appropriate while maintaining integration between on-premises and cloud systems.

Why the other options are wrong

• B. A public cloud uses only cloud-based resources provided by a vendor to multiple customers.
• C. A private cloud uses only on-premises or dedicated cloud resources, not a combination of both.

Correct answer: D. Define your strategy.

The Microsoft Cloud Adoption Framework for Azure begins with 'Define your strategy' as the first stage. This stage involves understanding business objectives, defining cloud strategy, and establishing governance models before any implementation begins. The five stages follow in order: Strategy, Plan, Ready, Adopt, and Govern/Manage.

Why the other options are wrong

• A. Adopt the cloud is the fourth stage, coming after strategy, planning, and readiness.
• B. Make a plan is the second stage, following the strategy definition phase.
• C. Ready your organization is the third stage, after strategy and planning are established.

Correct answer: C. a File service in a storage account

The File service in a storage account provides SMB protocol support for mapping network drives from Windows clients. This allows seamless integration with Windows 10 computers using standard network drive mapping. Blob storage is for unstructured object storage without network drive mapping capabilities. SQL Database is a relational database service. VM data disks are for single VM storage, not network-accessible shared storage.

Why the other options are wrong

• A. SQL Database is a relational database service, not for network drive mapping.
• B. VM data disks attach to individual virtual machines and cannot be mapped as network drives from multiple computers.
• D. Blob service stores unstructured data and does not support SMB protocol for network drive mapping.

Correct answer: B, C, E. a computer that runs Windows 10 and has the Azure PowerShell module installed; a computer that runs Linux and has the Azure PowerShell module installed; a computer that runs Chrome OS and uses Azure Cloud Shell.

Windows 10 with Azure PowerShell module (B) provides native PowerShell support. Linux with Azure PowerShell module (C) works with PowerShell Core. Chrome OS with Azure Cloud Shell (E) provides browser-based access to CLI tools including PowerShell. These three options all enable PowerShell script execution for Azure resource creation. MacOS with PowerShell Core can run PowerShell but typically uses bash in Cloud Shell, and Linux with Azure CLI tools uses CLI rather than PowerShell.

Why the other options are wrong

• A. While macOS can run PowerShell Core, it's not the most direct solution listed and Azure Cloud Shell on macOS would use bash by default.
• D. Linux with only Azure CLI tools provides CLI capability but not PowerShell for running PowerShell scripts.

Correct answer: A. Azure Repos

Azure Repos is the Azure service that provides version control tools for managing code. It offers both Git and Team Foundation Version Control (TFVC) repositories, allowing teams to store, manage, and collaborate on source code. It integrates with Azure DevOps and provides features like pull requests, branch policies, and code review capabilities.

Why the other options are wrong

• B. Azure DevTest Labs is for creating and managing test environments, not for version control of code.
• C. Azure Storage is for storing blobs, files, queues, and tables, not for version control management.
• D. Azure Cosmos DB is a globally distributed NoSQL database service, not a version control system.

Correct answer: D. isolation and segmentation

Isolation and segmentation is a core feature of Azure Virtual Networks. They allow you to create isolated network environments, segment traffic using subnets and network security groups, and control communication between resources, providing security and organizational boundaries.

Why the other options are wrong

• A. Resource cost analysis is a feature of Azure Cost Management, not Virtual Networks.
• B. Packet inspection is a function of firewalls and security appliances, not a primary feature of virtual networks themselves.
• C. Geo-redundancy is a feature of Azure Storage and database services, not Virtual Networks.

Correct answer: A. hybrid

A hybrid cloud model combines both on-premises infrastructure and public cloud resources that work together. Having 50 virtual machines on-premises and 50 in Azure that connect to each other represents a hybrid cloud deployment where both private (on-premises) and public (Azure) resources are integrated.

Why the other options are wrong

• B. Private cloud refers only to on-premises or dedicated infrastructure, not a combination with public cloud.
• C. Public cloud refers only to shared cloud resources, not a combination with on-premises infrastructure.

Correct answer: D. high availability

High availability is the cloud computing benefit that ensures continuous user access to cloud-based applications with minimal downtime. It is achieved through redundancy, fault tolerance, and failover mechanisms that keep services running even when failures occur. Agility refers to speed of deployment, scalability to handling increased load, and elasticity to dynamic resource adjustment, none of which directly address minimizing downtime.

Why the other options are wrong

• A. Agility refers to rapid deployment and development speed, not continuous availability.
• B. Scalability is the ability to handle increased load, not specifically about minimizing downtime.
• C. Elasticity allows dynamic resource adjustment but does not inherently provide continuous availability during failures.

Correct answer: A. Yes

The question requires deploying an AI solution with the ability to build, test, and deploy predictive analytics. Azure Machine Learning Studio is the correct Azure service designed specifically for building, testing, and deploying machine learning models and predictive analytics solutions. It provides the necessary tools and environment for data scientists and developers to create AI solutions. Therefore, the solution meets the goal.

Why the other options are wrong

• B. Azure Machine Learning Studio is the appropriate service for building, testing, and deploying predictive analytics models.

Correct answer: B. vertical scaling

Vertical scaling refers to increasing the computing capacity of an existing virtual machine by adding resources such as memory (RAM) or CPUs to a single instance. This is also called 'scaling up' and involves making a single server more powerful.

Why the other options are wrong

• A. Agility refers to the ability to quickly provision and deploy resources, not to adding capacity to existing machines.
• C. Horizontal scaling involves adding more instances or servers to distribute the load, not upgrading a single machine.
• D. Elasticity is the ability to automatically scale resources up or down based on demand, not the specific mechanism of adding CPUs or memory.

Correct answer: A. Yes

PowerShell Core 6.0 is cross-platform and runs natively on macOS. With PowerShell Core installed on a Mac, users can execute PowerShell scripts directly to create Azure resources. This meets the requirement for running a PowerShell script without needing Cloud Shell or additional tools.

Why the other options are wrong

• B. PowerShell Core 6.0 and later versions are fully supported on macOS and can execute PowerShell scripts for Azure resource management.

Correct answer: D. Create a new support request

To increase Azure subscription limits, you must create a new support request. Azure subscription limits are set quotas that can only be modified by Microsoft support after review of your request and justification. Support requests are the official mechanism for requesting limit increases on resources like managed SQL Server instances, compute cores, and other Azure services.

Why the other options are wrong

• A. A service health alert monitors the status of Azure services but does not increase subscription limits.
• B. Upgrading your support plan may improve support response time but does not directly increase resource limits.
• C. Azure policies are used to enforce compliance and resource governance, not to increase subscription limits.

Correct answer: B. an Azure policy

Azure Policy allows administrators to create and enforce rules that restrict resource creation to specific regions. Policies can evaluate resources against defined rules and prevent non-compliant deployments.

Why the other options are wrong

• A. Read-only locks prevent modifications but do not restrict which regions resources can be created in.
• C. Management groups help organize subscriptions hierarchically but do not enforce regional restrictions.
• D. Reservations are for purchasing Azure services at a discount and do not control resource location.

Correct answer: A. Yes

The command shown is an Azure CLI command (az vm create...). While launched from PowerShell in Cloud Shell, Azure Cloud Shell automatically provides both Azure CLI and PowerShell environments. The Azure CLI command will execute successfully in Cloud Shell regardless of whether PowerShell or Bash was selected as the primary shell, making this solution viable.

Why the other options are wrong

• B. This solution does work because Cloud Shell provides the full Azure CLI toolset even when PowerShell is the selected shell environment.

Correct answer: B. Azure DevTest Labs

Azure DevTest Labs is specifically designed for rapid provisioning and deprovisioning of development and test environments using templates, making it ideal for scenarios where 50 VMs are deployed and removed weekly with minimal administrative overhead.

Why the other options are wrong

• A. Reserved VM Instances are for cost optimization of long-running VMs, not for frequent temporary deployments.
• C. Virtual machine scale sets are for auto-scaling production workloads, not for managing temporary development/test environments.
• D. Azure Virtual Desktop is for hosting user desktops and applications, not for managing temporary development infrastructure.

Correct answer: A. network security groups (NSGs)

Network Security Groups (NSGs) are the correct solution for limiting connection types between resources within Azure virtual networks. NSGs operate at the network interface and subnet level, allowing you to create inbound and outbound rules that filter traffic between web servers and database servers. Azure Service Bus is a messaging service, not for network filtering. A local network gateway is for hybrid connectivity, and a route filter is for BGP advertisement filtering in ExpressRoute scenarios.

Why the other options are wrong

• B. Azure Service Bus is a messaging service for asynchronous communication, not for network traffic filtering.
• C. A local network gateway is used for site-to-site VPN or ExpressRoute connectivity, not for filtering connections between Azure resources.
• D. A route filter is used to filter BGP advertisements in ExpressRoute, not for controlling connections between servers.

Correct answer: B. No

While Azure App Service is PaaS, Azure Storage accounts are classified as Infrastructure as a Service (IaaS). Storage accounts provide raw storage resources that require manual management and configuration. The requirement mandates PaaS-only solutions, so including a storage account (IaaS) violates the migration plan.

Why the other options are wrong

• A. Azure Storage is IaaS, not PaaS, so this does not meet the PaaS-only requirement.

Correct answer: B. No

The question requires a strategy to create Azure resources automatically for multiple business units with identical resource needs. Management groups are organizational and governance tools used for organizing subscriptions, applying policies, and managing access, they do not automate resource creation. Azure Resource Manager templates, Blueprints, or infrastructure-as-code solutions are the appropriate tools for automated resource creation. Therefore, the solution does not meet the goal.

Why the other options are wrong

• A. Management groups are for organizational hierarchy and governance, not for automating the creation of Azure resources themselves.

Correct answer: A. operational

Migrating the virtual machines to an Azure pay-as-you-go subscription converts hardware ownership into a metered, consumption-based service that is billed as an ongoing running cost. Costs that recur for the day-to-day operation of a service, with no up-front purchase of assets, are operational expenditure (OpEx). Because Azure charges only for the compute, storage, and networking consumed each month, the planned solution follows the operational expenditure model.

Why the other options are wrong

• B. Elasticity describes the ability to add or remove capacity on demand, not a way of accounting for spending.
• C. Capital expenditure applies to buying and depreciating physical assets such as the on-premises Hyper-V hosts being retired.
• D. Scalability is a technical characteristic of a cloud platform rather than an expenditure model.

Correct answer: C. a logic app

Azure Logic Apps is a serverless computing solution designed specifically for automating workflows and integrating systems, including sending email notifications based on rules. Logic Apps provides a visual workflow designer, built-in email connectors, and rule-based triggering, making it ideal for migrating rule-based email notification applications.

Why the other options are wrong

• A. A web app requires server management and is not a serverless solution.
• B. A server image in Azure Marketplace still requires virtual machine management and is not serverless.
• D. An API app is used for building APIs, not for automating email notifications based on rules.

Correct answer: A. Azure Resource Manager templates

Azure Resource Manager (ARM) templates enable infrastructure-as-code, allowing automated creation and deployment of identical sets of resources. Templates can be reused across multiple business units to consistently provision the same 20 resources. Virtual machine scale sets manage VM instances rather than diverse resource types, API Management is for API governance, and management groups organize subscriptions.

Why the other options are wrong

• B. Virtual machine scale sets are specifically for managing multiple identical VMs, not for provisioning diverse resource types needed across business units.
• C. Azure API Management is for managing APIs and integration, not for automating the creation of general Azure resources.
• D. Management groups organize subscriptions hierarchically but do not automate resource creation or deployment.

Correct answer: B. No

No, this solution does not meet the goal. Azure Traffic Manager is a DNS-based load balancing service used for routing traffic across multiple endpoints in different regions. Modifying a Traffic Manager profile does not enable HTTP access to VM1 from the Internet. To make VM1 accessible over HTTP, you would need to configure a Network Security Group (NSG) to allow inbound HTTP traffic on port 80 and assign a public IP address to the VM.

Correct answer: B. infrastructure as a service (IaaS)

For moving a legacy accounting application with an existing database to the cloud, IaaS (Infrastructure as a Service) is most appropriate. IaaS provides virtual machines and infrastructure where you can install and run legacy applications and databases with minimal refactoring, maintaining compatibility with existing systems.

Why the other options are wrong

• A. PaaS requires refactoring the application to work with managed services, which may not be compatible with legacy database structures.
• C. SaaS is not suitable because it provides pre-built applications that cannot be customized for legacy systems or databases.

Correct answer: C. Configure a Point-to-Site (P2S) VPN.

Point-to-Site (P2S) VPN is the correct solution for allowing individual remote workers to connect to resources in a single Azure virtual network. P2S VPN enables individual client machines to establish secure connections to the VNet without requiring complex site-to-site infrastructure. This is the standard approach for remote user access to Azure resources and is more appropriate than S2S VPN, which is designed for connecting entire networks or branch offices.

Why the other options are wrong

• A. Site-to-Site VPN is for connecting entire networks or branch offices, not individual remote workers.
• B. VNet-to-VNet VPN connects multiple virtual networks, not remote individual users.
• D. DirectAccess is a Windows on-premises solution and is not the primary Azure solution for remote access.
• E. Multi-Site VPN is for connecting multiple branch offices, not individual remote workers to a single VNet.

Correct answer: A, E. a virtual network gateway; a gateway subnet

A virtual network gateway and a gateway subnet are essential for establishing connectivity between on-premises networks and Azure virtual machines. The virtual network gateway (specifically a VPN gateway or ExpressRoute gateway) serves as the endpoint for the hybrid connection, while the gateway subnet is a dedicated subnet within the virtual network required to host the gateway. A virtual network is also necessary, but the question asks for two resources, and the gateway and subnet are the most specific components required for the connectivity solution.

Why the other options are wrong

• B. A load balancer distributes traffic among Azure resources but does not enable on-premises to Azure connectivity.
• C. An application gateway is used for application-level routing and SSL termination, not for hybrid network connectivity.
• D. While a virtual network is necessary infrastructure, it is not sufficient by itself to enable on-premises connectivity without the gateway components.

Correct answer: B. Azure Service Health

Azure Service Health is the dedicated service for receiving notifications about planned maintenance, service incidents, and health advisories that affect your Azure resources and subscriptions. It provides proactive communication about maintenance windows. Azure Monitor tracks resource performance metrics. Azure Advisor provides optimization recommendations. Microsoft Trust Center provides compliance and security information but not maintenance notifications.

Why the other options are wrong

• A. Azure Monitor is for performance metrics and diagnostics, not maintenance notifications.
• C. Azure Advisor provides optimization recommendations, not maintenance notifications.
• D. Trust Center provides compliance documentation, not personalized maintenance notifications.

Correct answer: B. No

A single virtual machine cannot achieve 99.99% availability regardless of how many availability zones are involved. While availability zones provide zone-level redundancy, you cannot span a single VM instance across multiple zones. You need at least two VMs deployed across two availability zones to provide both instance-level redundancy and zone-level redundancy for 99.99% uptime.

Why the other options are wrong

• A. One VM cannot be distributed across multiple zones; you need multiple instances for redundancy.

Correct answer: B. Management groups

Management groups, not resource groups, provide organizations with the ability to manage compliance of Azure resources across multiple subscriptions. Management groups are a hierarchical organizational structure that sits above subscriptions, allowing centralized policy and compliance management across many subscriptions. Resource groups only organize resources within a single subscription and cannot span multiple subscriptions.

Why the other options are wrong

• A. Resource groups cannot manage compliance across multiple subscriptions; they are limited to single subscriptions.
• C. While Azure policies can enforce compliance, management groups are the specific Azure structure that enables managing compliance across multiple subscriptions.
• D. Azure App Service plans are for hosting web applications and have no role in compliance management across subscriptions.

Correct answer: B. IP Addresses, Service tags and Application security groups

Network Security Group inbound rules can accept three types of sources: IP addresses (including IP ranges in CIDR notation), Service Tags (predefined identifiers for Azure services), and Application Security Groups (logical groupings of VMs). All three options are valid source specifications for NSG inbound security rules, providing flexibility in defining traffic policies.

Why the other options are wrong

• A. Service Tags alone are insufficient; IP addresses and Application Security Groups are also valid sources.
• C. Application Security Groups alone are insufficient; IP addresses and Service Tags are also valid sources.
• D. IP addresses alone are insufficient; Service Tags and Application Security Groups are also valid sources.

Correct answer: B. a virtual network for FinServer and another virtual network for all the other servers

To isolate a server on a separate network segment for compliance purposes, you must deploy it to a separate virtual network. Virtual networks provide network isolation and segmentation. Resource groups are only logical containers for management and billing purposes and do not provide network isolation. VPNs are for connectivity between networks, not for segmenting a single server. Resource locks prevent accidental deletion but do not create network segments.

Why the other options are wrong

• A. Resource groups are management containers only and do not provide network isolation.
• C. VPNs are for connecting networks, not for isolating a single server on a separate segment.
• D. Resource locks prevent modification/deletion but do not create network segmentation.

Correct answer: A, C. Azure Data Lake; Azure SQL Data Warehouse

For 20 TB of infrequently accessed data that will be visualized with Power BI, both Azure Data Lake (A) and Azure SQL Data Warehouse (C) are appropriate. Data Lake provides scalable storage for big data analytics, and SQL Data Warehouse is designed for large-scale data analytics and Power BI integration. Both support Power BI visualization and handle large data volumes efficiently.

Why the other options are wrong

• B. Azure Cosmos DB is optimized for operational transactional workloads, not for large-scale infrequent data access and analytics.
• D. Azure SQL Database is designed for transactional workloads, not for 20 TB analytics scenarios with Power BI.
• E. Azure Database for PostgreSQL is a relational database service suited for transactional applications, not large-scale analytics storage.

Correct answer: B. an Azure virtual machine

An Azure virtual machine is a classic example of Infrastructure as a Service (IaaS). IaaS provides virtualized computing resources over the internet where customers manage the OS, applications, and data while the cloud provider manages the infrastructure.

Why the other options are wrong

• A. An Azure web app is a Platform as a Service (PaaS) offering where the platform handles infrastructure and OS management.
• C. An Azure logic app is a Platform as a Service (PaaS) offering for workflow automation.
• D. An Azure SQL database is a Platform as a Service (PaaS) offering where the service manages database infrastructure and maintenance.

Correct answer: D. a hybrid cloud

A hybrid cloud combines on-premises infrastructure with public cloud resources, minimizing both capital and operational expenditure. It allows the company to keep existing on-premises servers while extending capacity with public cloud resources as needed, avoiding the high costs of building a new data center or complete migration, while managing costs more efficiently than a private cloud.

Why the other options are wrong

• A. Complete migration to public cloud eliminates capital expenditure but increases operational costs and may not be necessary.
• B. Building an additional data center requires significant capital expenditure and ongoing operational costs.
• C. A private cloud requires substantial capital investment in infrastructure and specialized staff for management.

Correct answer: A. Yes

The question requires reducing the effect on users when migrating all resources to Azure and retiring the on-premises data center. Syncing all Active Directory user accounts to Azure Active Directory using Azure AD Connect is the standard strategy that maintains user experience by allowing users to continue using familiar credentials and reducing disruption. This ensures users can authenticate to cloud resources seamlessly. Therefore, the solution meets the goal.

Why the other options are wrong

• B. Syncing AD accounts to Azure AD is the recommended best practice for hybrid identity and minimizes user disruption during migration.

Correct answer: A, D. enables the rapid provisioning of resources; shifts capital expenditures (CAPEX) to operating expenditures (OPEX)

Cloud computing enables rapid provisioning of resources because infrastructure is already available and can be deployed quickly without physical hardware procurement. It also shifts capital expenditures (CAPEX) to operating expenditures (OPEX), meaning organizations pay for usage rather than investing in expensive hardware purchases upfront.

Why the other options are wrong

• B. Cloud computing actually reduces administrative complexity by offloading management tasks to the cloud provider, not increasing it.
• C. Cloud computing provides more flexible and diverse configuration options than typical on-premises environments, not the same options.

Correct answer: B. No

The solution does not meet the goal because it includes Azure virtual machines and Azure Storage accounts, which are Infrastructure as a Service (IaaS), not Platform as a Service (PaaS). Only Azure SQL databases in this list qualifies as PaaS. A PaaS-only solution would require services like Azure App Service, Azure SQL Database, Azure Cosmos DB, and similar managed services.

Why the other options are wrong

• A. This solution fails to meet the goal because it includes IaaS services (VMs and storage accounts) mixed with PaaS (SQL databases).

Correct answer: B. No

Microsoft Managed Desktop is designed for managing end-user devices and desktops, not for deploying and removing custom server virtual machines. It does not support the deployment workflow described (weekly creation and removal of VMs) nor does it support custom configurations with mixed Windows Server and Linux deployments. This service is inappropriate for the stated requirement.

Why the other options are wrong

• A. Microsoft Managed Desktop is not designed for rapid VM deployment and removal; it manages end-user devices only.

Correct answer: B, C. the Azure portal; Azure Cloud Shell

The Azure portal and Azure Cloud Shell both have mobile-responsive interfaces that work on iPhones and can be used to manage Azure web app settings. The portal is a graphical interface, while Cloud Shell provides command-line access, and both are accessible from any device with a browser.

Why the other options are wrong

• A. Azure CLI is a command-line tool that requires terminal access, not optimal for iPhone management.
• D. Windows PowerShell is primarily for Windows systems and not naturally accessible from iPhones.
• E. Azure Storage Explorer is a desktop application designed for Windows/Mac, not for mobile devices like iPhones.

Correct answer: C. Azure Monitor workbooks

Of the options listed, only Azure Monitor workbooks is part of Azure Sentinel: Sentinel is built on Azure Monitor and uses its workbooks and Log Analytics workspace. The other three are Azure Security Center or Service Health features that do not act on Sentinel detections. Inside Sentinel, the automated responses themselves are built as playbooks, which run on Azure Logic Apps.

Why the other options are wrong

• A. Adaptive network hardening in Azure Security Center automatically hardens network configurations but is not specifically designed for Azure Sentinel threat response automation.
• B. Azure Service Health provides service status and incident information, not threat response automation.
• D. Adaptive application controls in Azure Security Center manage application whitelisting, not automated threat responses from Azure Sentinel.

Correct answer: B. No

To achieve 99.99% availability with minimum resources, you need at least two virtual machines deployed across two availability zones. A single availability zone provides only 99.95% availability. Two VMs in one availability zone does not provide zone-level redundancy and cannot guarantee 99.99% availability, as an entire zone failure would take both VMs offline.

Why the other options are wrong

• A. Two VMs in a single availability zone only guarantees 99.95% availability, not the required 99.99%.

Correct answer: A. Yes

The solution correctly identifies that Azure CLI can be installed on Windows 10 and executed from a command prompt. Command Prompt (cmd.exe) is a valid command-line interface where Azure CLI commands can be run after signing in with 'az login'. The method meets all requirements to execute the az vm create command successfully.

Why the other options are wrong

• B. Command prompt is a legitimate environment for running Azure CLI commands, making this a valid solution.

Correct answer: C. a content delivery network (CDN)

Azure Content Delivery Network (CDN) is specifically designed to cache and deliver large media files like videos to users worldwide with low latency. CDN edge servers cache content closer to end users, providing the best video playback experience globally.

Why the other options are wrong

• A. Application Gateway is a Layer 7 load balancer for routing HTTP/HTTPS traffic, not for optimizing video delivery.
• B. ExpressRoute provides dedicated private connectivity to Azure but doesn't cache or optimize content delivery for global users.
• D. Traffic Manager performs DNS-level routing between endpoints but doesn't cache content or optimize video streaming performance.

Correct answer: A. private cloud and hybrid cloud only

Physical servers can only be deployed in private cloud and hybrid cloud models. Private cloud allows an organization to deploy physical servers in its own data center, and hybrid cloud allows mixing on-premises physical servers with cloud resources. Public cloud providers do not allow customers to deploy their own physical servers.

Why the other options are wrong

• B. Physical servers can be deployed in both private and hybrid cloud models, not just private cloud alone.
• C. Public cloud does not allow deployment of customer-owned physical servers; it only provides shared virtualized resources.
• D. Physical servers can be deployed in private cloud as well, not only in hybrid cloud.

Correct answer: A. Yes

Azure AD Identity Protection is specifically designed to detect risky sign-in activities, including logins from unfamiliar locations and IP addresses. When it detects such risky behavior, it can automatically trigger remediation actions including requiring users to change their passwords through conditional access policies. This directly addresses the requirement to automatically encourage password changes when users connect from unidentified IP addresses.

Why the other options are wrong

• B. Azure AD Identity Protection is the correct tool for detecting risky sign-ins from unknown locations and triggering password change requirements.

Correct answer: B. No

The question requires a strategy to create Azure resources automatically for multiple business units with identical resource needs. Azure API Management is a service for managing APIs and providing API gateway functionality; it does not automate resource provisioning or creation. The appropriate solutions would be Azure Resource Manager templates, Terraform, or Azure Blueprints. Therefore, the solution does not meet the goal.

Why the other options are wrong

• A. Azure API Management is for API governance and management, not for automating Azure resource provisioning.

Correct answer: B. Microsoft Sentinel

Microsoft Sentinel is Azure's native Security Information and Event Management (SIEM) solution, providing threat detection, investigation, and automated response capabilities. Microsoft Sentinel was formerly called Azure Sentinel. Azure Analysis Services is for data analytics. Azure Information Protection is for data classification. Azure Cognitive Services provides AI and machine learning capabilities but is not a SIEM solution.

Why the other options are wrong

• A. Azure Analysis Services is a data analytics platform, not a SIEM solution.
• C. Azure Information Protection is for data classification and protection, not for SIEM functionality.
• D. Azure Cognitive Services provides AI and ML capabilities, not SIEM functionality.

Correct answer: A, C. Replacing failed server hardware; Managing physical server security

When migrating to Azure virtual machines, the company eliminates responsibility for replacing failed server hardware (Azure manages physical infrastructure) and managing physical server security (Azure secures the data center). However, backing up data, updating operating systems, and managing document permissions remain the customer's responsibility.

Why the other options are wrong

• B. Backing up application data remains the customer's responsibility in Azure IaaS.
• D. Updating server operating systems is still the customer's responsibility when using Azure VMs.
• E. Managing permissions to shared documents is an application-level responsibility that remains with the customer.

Correct answer: B. No

Azure Reserved VM Instances are designed for long-term commitments and cost savings when workloads are predictable and stable. They are inappropriate for the stated scenario where VMs are deployed weekly and removed within the same week. Reserved instances require multi-year commitments and do not reduce administrative effort for temporary VM deployments. This solution addresses cost, not administrative automation.

Why the other options are wrong

• A. Reserved instances are for long-term commitments, not weekly temporary deployments, and do not reduce administrative effort.

Correct answer: C. an Azure App Service and Azure SQL databases.

Azure App Service is a PaaS solution for hosting web and mobile applications, while Azure SQL Database is a PaaS managed database service. Both are fully managed platform services where Microsoft handles infrastructure, patching, and maintenance. This matches the company's requirement for PaaS-only solutions.

Why the other options are wrong

• A. Azure Virtual Machines are IaaS, not PaaS, as they require management of the operating system and software.
• B. Azure Virtual Machines are IaaS, and installing Microsoft SQL Server yourself makes it IaaS rather than using a managed PaaS database service.
• D. Azure Virtual Machines are IaaS, and deploying web servers on them requires infrastructure management rather than using managed PaaS services.

Correct answer: B. Azure Monitor

Azure Monitor is the correct service to use for viewing service failure notifications and service health alerts that can affect VM availability. It provides comprehensive health monitoring, alerts, and notifications about platform-level issues and service disruptions. Azure Monitor displays Azure Service Health, which specifically tracks service failures and maintenance events that could impact your resources.

Why the other options are wrong

• A. Azure Service Fabric is for building and managing microservices applications, not for monitoring service health notifications.
• C. The Azure virtual machines blade manages VM instances but does not provide service-wide failure notifications.
• D. Azure Advisor provides recommendations for optimization and best practices, not real-time service failure notifications.

Correct answer: B. No

Requiring Azure Multi-Factor Authentication (MFA) would actually increase the burden on users and complexity during and after migration, not reduce impact. MFA adds an additional authentication step that users must complete for every login, which increases friction rather than reducing it. A strategy to reduce user impact during migration would focus on seamless authentication, single sign-on capabilities, or hybrid identity synchronization, not adding authentication requirements.

Why the other options are wrong

• A. MFA increases authentication complexity and user burden, which would increase rather than decrease the effect on users during migration.

Correct answer: C. elasticity

Elasticity is the cloud's ability to automatically scale resources up or down based on demand. For an application with low usage during the first three weeks and high usage in the final week, elasticity allows automatic provisioning of additional resources during peak periods and scaling down during low-usage periods, directly optimizing costs by matching resource allocation to actual demand.

Why the other options are wrong

• A. High availability ensures uptime but does not specifically address cost management for variable usage patterns.
• B. High latency is a performance problem, not a cost management benefit.
• D. Load balancing distributes traffic across resources but does not automatically scale resources based on demand to manage costs.

Correct answer: A, D. Deploy the virtual machines to two or more availability zones; Deploy the virtual machines to two or more regions.

Availability Zones (option A) distribute VMs across physically separate data centers within a single region, protecting against data center failure. Multiple regions (option D) protect against entire region failures, providing geographic redundancy. Both are complete solutions for data center failure protection. Resource groups (B) are logical containers providing no fault tolerance. Scale sets (C) provide auto-scaling and load balancing but not protection against data center failures unless combined with zones or regions.

Why the other options are wrong

• B. Resource groups are management containers only and provide no fault tolerance or data center failure protection.
• C. Scale sets provide auto-scaling within a data center but do not protect against data center failures.

Correct answer: A. Azure Advisor

Azure Advisor provides personalized recommendations including identification of underutilized virtual machines based on usage patterns and configuration. It analyzes resource metrics and offers specific guidance for optimization and cost savings. Cost Management + Billing tracks spending but doesn't specifically identify underutilized resources, reservations are for commitment purchases, and Policy enforces compliance rules.

Why the other options are wrong

• B. Azure Cost Management shows spending but does not specifically identify underutilized or unused virtual machines.
• C. Azure Reservations are for purchasing discounted compute capacity, not for identifying underutilized resources.
• D. Azure Policy enforces compliance and governance rules but does not analyze resource utilization patterns.

Correct answer: B. No

A Local Network Gateway is used to represent an on-premises network location for hybrid connectivity scenarios, enabling VPN or ExpressRoute connections between Azure and on-premises environments. It does not control connection types between resources within Azure. For controlling connections between web servers and database servers deployed in Azure, Network Security Groups (NSGs) are the appropriate solution.

Why the other options are wrong

• A. A local network gateway is for on-premises network representation in hybrid scenarios, not for controlling inter-resource connections within Azure.

Correct answer: A. Yes

Azure Cloud Shell is accessible through a web browser and can run Bash commands to create Azure virtual machines using Azure CLI. Since Android tablets can access web browsers and connect to Azure Cloud Shell, users can create VMs using Bash commands from an Android device. This meets the goal of creating an Azure VM from an Android tablet.

Why the other options are wrong

• B. Azure Cloud Shell is accessible from Android via a web browser, making it a viable solution for creating Azure resources from a tablet.

Correct answer: D, E. metered pricing; self-service management

Public clouds are characterized by metered pricing, where customers pay only for resources consumed, and self-service management, allowing users to provision and manage resources independently without vendor intervention. Dedicated hardware is a private cloud characteristic, unsecured connections are not inherent to public clouds (security depends on implementation), and storage limitations are not a defining feature of public clouds.

Why the other options are wrong

• A. Dedicated hardware is a private cloud characteristic, not public cloud.
• B. Unsecured connections are not a characteristic of public clouds; security depends on implementation.
• C. Public clouds typically offer virtually unlimited scalable storage, not limited storage.

Correct answer: B. No

Deploying virtual machines to scale sets alone does not guarantee availability if a single data center fails. Scale sets provide auto-scaling and load balancing within a single region/data center but do not provide protection against data center failures. To survive a data center failure, VMs must be distributed across availability zones (within same region) or regions. Scale sets can be used in conjunction with these approaches but are not sufficient by themselves.

Why the other options are wrong

• A. Scale sets do not provide data center-level failure protection; they are for scaling and load balancing within a data center.

Correct answer: D. an Azure data center failure

Azure Availability Zones protect against data center failures by distributing resources across physically separate data centers within a region. When you deploy services across multiple Availability Zones, if one data center fails, services running in other zones remain available. This provides protection specifically against isolated data center outages, not broader region failures or individual server issues.

Why the other options are wrong

• A. Physical server failures are typically handled by Azure's internal redundancy within a data center, not by Availability Zones specifically.
• B. Availability Zones protect against data center failures within a region, not region-level failures; for region failures, you need geo-redundancy across regions.
• C. Storage failures are handled by storage redundancy options, not by Availability Zones.

Correct answer: A. a subscription

An Azure subscription is the foundational requirement and must be created first before any other Azure resources can be deployed. A subscription is the billing and access control boundary for all Azure resources. Resource groups are created within subscriptions, virtual networks are created within resource groups, and management groups organize subscriptions, so all come after the subscription is established.

Why the other options are wrong

• B. Resource groups are created within a subscription and cannot exist without one.
• C. Virtual networks are created within resource groups, which require a subscription first.
• D. Management groups organize subscriptions but a subscription must exist to be managed.

Correct answer: D. availability zones

Availability zones provide protection against datacenter failures by distributing resources across physically separate datacenters within a region. VMs deployed across multiple availability zones will remain available if one zone fails.

Why the other options are wrong

• A. Availability sets protect against planned maintenance and hardware failures within a single datacenter, not datacenter failures.
• B. Proximity placement groups optimize network latency between VMs but do not provide datacenter failure protection.
• C. Host groups are used to control the physical host placement of VMs and do not protect against datacenter failures.

Correct answer: B. Layer 3

ExpressRoute operates at Layer 3 (Network layer) of the OSI model. It provides a private, dedicated network connection between on-premises infrastructure and Azure data centers using Border Gateway Protocol (BGP) routing, which is a Layer 3 protocol.

Why the other options are wrong

• A. Layer 2 is the data link layer; ExpressRoute uses Layer 3 routing protocols like BGP.
• C. Layer 5 is the session layer, which is not relevant to ExpressRoute's core functionality.
• D. Layer 7 is the application layer, not where ExpressRoute operates.

Correct answer: A. Yes

Azure Resource Manager (ARM) templates are the ideal solution for automating the creation of identical Azure resources across multiple business units. ARM templates enable infrastructure-as-code, allowing you to define resources declaratively and deploy them repeatedly with consistency. This directly satisfies the requirement to create Azure resources automatically for business units with identical resource needs.

Why the other options are wrong

• B. ARM templates are specifically designed for automated resource creation and meet the stated goal.

Correct answer: B. No

Azure Information Protection is designed for data classification and protection of sensitive documents and emails, not for encrypting administrative credentials during deployment processes. For securing credentials during automated server deployment, Azure Key Vault is the appropriate solution as it provides secure storage and management of secrets, keys, and certificates used in deployment automation.

Why the other options are wrong

• A. Azure Information Protection does not address credential encryption during deployment; it focuses on document and email data protection.

Correct answer: A. Yes

Windows 10 with the Azure PowerShell module installed is a complete and valid configuration for running PowerShell scripts that create Azure resources. The Azure PowerShell module provides all necessary cmdlets to authenticate and provision resources in Azure, making this configuration fully capable of meeting the stated goal.

Why the other options are wrong

• B. Windows 10 with Azure PowerShell module is a standard and supported configuration for running Azure resource creation scripts.

Correct answer: C. public

Public cloud is the model where all hardware resources are owned and managed by a third-party cloud provider and shared among multiple tenants. In public cloud, customers access shared infrastructure on a pay-as-you-go basis without owning the underlying hardware.

Why the other options are wrong

• A. Private cloud means the infrastructure is dedicated to a single organization, not shared among multiple tenants.
• B. Hybrid cloud is a combination of private and public cloud resources, not purely third-party owned and shared.

Correct answer: B. No

Azure AD Privileged Identity Management (PIM) is designed to manage, control, and monitor access to privileged roles and resources, focusing on just-in-time access and role activation for administrators. It does not detect risky sign-ins from unfamiliar IP addresses or automatically trigger password changes based on sign-in location. Azure AD Identity Protection is the appropriate solution for this requirement.

Why the other options are wrong

• A. PIM manages privileged role access, not risky sign-in detection based on IP addresses or automatic password change enforcement.

Correct answer: B. Platform as a Service (PaaS)

Platform as a Service (PaaS) minimizes administrative effort for web applications by handling infrastructure management, patches, scaling, and deployment frameworks. The vendor manages the underlying platform, allowing developers to focus on application code rather than server management. This reduces operational overhead compared to IaaS while providing more control than SaaS.

Why the other options are wrong

• A. SaaS is pre-built software that may not meet custom web application requirements.
• C. IaaS requires significant administrative effort for managing virtual machines, operating systems, and infrastructure.
• D. DaaS (Database as a Service) is not a standard cloud model and addresses only database needs, not web application hosting.

Correct answer: A. Azure Firewall

Azure Firewall provides centralized network traffic filtering and protection across multiple Azure subscriptions and virtual networks. It operates at the network layer and can be deployed as a managed service to protect traffic across subscriptions. Network Security Groups work at individual subnet/NIC level and are subscription-specific. Application Security Groups organize resources for rule management but don't filter across subscriptions. Azure DDoS protection focuses on DDoS mitigation, not general traffic filtering.

Why the other options are wrong

• B. Application Security Groups are used to group resources for simplified rule management within a subscription, not for cross-subscription filtering.
• C. Azure DDoS protection specifically protects against DDoS attacks, not for general network traffic filtering across subscriptions.
• D. Network Security Groups operate at the individual subnet and NIC level and are scoped to a single subscription.

Correct answer: A. Yes

Two virtual machines deployed across two availability zones is the minimum configuration to achieve 99.99% availability for a critical LOB application. This setup provides both instance-level redundancy (two VMs) and zone-level redundancy (across two separate zones), ensuring that the application remains available even if one entire zone fails. This is the optimal balance between availability requirements and resource minimization.

Why the other options are wrong

• B. Two VMs across two availability zones is the minimum viable configuration that meets the 99.99% SLA requirement.

Correct answer: B. No

Azure Multi-Factor Authentication (MFA) is an identity verification mechanism that adds an extra layer of authentication security, not a solution for encrypting credentials during deployment. MFA requires an additional verification step after authentication but does not encrypt administrative credentials used in automated deployment processes. Azure Key Vault or Azure Automation credentials encryption would be appropriate solutions.

Why the other options are wrong

• A. MFA is for user authentication verification, not for encrypting credentials during deployment automation.

Correct answer: A. Yes

Azure App Service and Azure SQL Database are both Platform as a Service (PaaS) offerings. App Service handles application hosting and management, while Azure SQL Database provides managed database services. Both abstract away infrastructure management, allowing the company to focus on applications and data, fully meeting the PaaS-only requirement.

Why the other options are wrong

• B. This solution meets the goal as both services are PaaS offerings.

Correct answer: C. Azure DevTest Labs

Azure DevTest Labs is specifically designed for teams that need to quickly deploy and tear down test environments with minimal administrative overhead. It provides automation for creating, managing, and destroying VMs on a schedule, making it ideal for the weekly deployment and removal of 50 customized virtual machines. The service supports both Windows Server and Linux, tracks costs, and enforces policies to minimize management effort.

Why the other options are wrong

• A. Reserved VM Instances are for long-term cost optimization of running VMs, not for frequent deployment and removal cycles.
• B. Virtual machine scale sets are designed for auto-scaling identical VMs based on demand, not for custom deployments and scheduled removals.
• D. Microsoft Managed Desktop is a cloud-based service for managing Windows 10/11 PCs in enterprises, not for managing customized server VMs.

Correct answer: D, E. Azure Container Instances; Azure Kubernetes Service (AKS)

Azure Container Instances and Azure Kubernetes Service (AKS) are both dedicated container management services. Container Instances provides serverless container execution, while AKS provides orchestrated Kubernetes-based container management.

Why the other options are wrong

• A. Azure Virtual Desktop is for remote desktop sessions, not container management.
• B. Azure Virtual Machines can run containers but are not dedicated container management services.
• C. Azure Functions is a serverless compute service for event-driven workloads, not a container management service.

Correct answer: B. No

The question asks about running a PowerShell script to create Azure resources. While Azure CLI tools can be used on Linux, the requirement specifically states a PowerShell script. Although Azure CLI can manage resources, it doesn't directly execute PowerShell scripts. PowerShell Core can run on Linux, but the solution proposed only mentions Azure CLI tools, not PowerShell, so it does not fully meet the goal.

Why the other options are wrong

• A. The solution mentions Azure CLI tools, not PowerShell, which is what the script requires to run directly on Linux.

Correct answer: C. Azure Monitor

Azure Monitor is the centralized service for collecting events, metrics, logs, and diagnostic data from multiple Azure resources into a unified repository. It provides comprehensive monitoring and diagnostics capabilities. Azure Event Hubs is for high-throughput event streaming but is more specialized for specific streaming scenarios. Azure Analysis Services is for data analysis. Azure Stream Analytics is for real-time stream processing, not centralized event collection.

Why the other options are wrong

• A. Event Hubs is designed for high-throughput event streaming rather than general-purpose centralized monitoring.
• B. Analysis Services is for analytical processing of data, not collection of events.
• D. Stream Analytics is for processing streaming data, not for collecting events from resources.

Correct answer: C. Azure Monitor

Azure Monitor is the comprehensive monitoring service that can track resource state changes and automatically send alerts based on configured conditions, such as when a virtual machine is stopped by an administrator.

Why the other options are wrong

• A. Azure Advisor provides recommendations for optimization but doesn't generate alerts for specific resource state changes.
• B. Azure Service Health monitors Azure service availability and incidents, not individual resource state changes.
• D. Azure Network Watcher monitors and diagnoses network issues, not virtual machine power states.

Correct answer: B. No

The question requires deploying an AI solution with the ability to build, test, and deploy predictive analytics. Azure Cosmos DB is a NoSQL database service designed for high-performance data storage and retrieval; it is not designed for building and deploying AI models or conducting predictive analytics. Azure Machine Learning is the appropriate service for this requirement. Therefore, the solution does not meet the goal.

Why the other options are wrong

• A. Azure Cosmos DB is a database service, not an AI/ML platform for building predictive analytics models.

Correct answer: C. Azure Marketplace

Azure Marketplace is the correct platform to purchase and deploy third-party virtual security appliances to Azure subscriptions. It offers vetted solutions ready for Azure deployment.

Why the other options are wrong

• A. Azure subscriptions are billing and resource containers, not purchasing platforms.
• B. Microsoft Defender for Cloud is a security monitoring and threat protection service, not a marketplace.
• D. Microsoft Store is for consumer applications and does not support enterprise Azure deployments.

Correct answer: A. application data

In a SaaS model, the customer provides only the application data. The cloud provider manages the application software, infrastructure, compute resources, storage, and all underlying systems. The customer simply uses the application and manages their own data.

Why the other options are wrong

• B. Data storage is provided and managed by the SaaS provider, not the customer.
• C. Compute resources are provided and managed by the SaaS provider as part of the service.
• D. Application software is provided by the SaaS vendor; the customer does not develop or provide it.

Correct answer: B. No

Deploying virtual machines to a scale set alone does not protect against a single data center failure unless the scale set is configured to spread instances across multiple Availability Zones. By default, a scale set may deploy all instances in a single zone or data center. To achieve data center failure protection, the scale set must be explicitly configured with zone redundancy or deployed across Availability Zones.

Why the other options are wrong

• A. A scale set without zone configuration does not guarantee protection against data center failures.

Correct answer: C. Azure Marketplace

Azure Marketplace is the dedicated platform for purchasing and deploying third-party solutions, including virtual security appliances, to Azure subscriptions. It provides pre-configured images and solutions ready for deployment in Azure.

Why the other options are wrong

• A. Azure subscriptions are containers for resources but not a purchasing platform for third-party appliances.
• B. Azure Security Center (now Microsoft Defender for Cloud) is a monitoring and security management service, not a marketplace for purchasing appliances.
• D. Microsoft Store is for consumer applications, not enterprise Azure solutions.

Correct answer: A. Yes

The solution correctly identifies that Azure CLI can be installed on Windows 10 and executed from PowerShell. PowerShell is a valid command-line interface where Azure CLI commands (az commands) can be run after signing in with 'az login'. Both the installation and execution method are appropriate for running the specified az vm create command.

Why the other options are wrong

• B. PowerShell is a perfectly valid environment to run Azure CLI commands after installation, so this is not a reason to reject the solution.

Correct answer: A, D. Azure Data Lake; Azure IoT Hub

For millions of sensors uploading data to Azure, you need Azure IoT Hub to ingest and manage the IoT device connections and telemetry data, and Azure Data Lake to store the massive volumes of structured and unstructured data collected from the sensors.

Why the other options are wrong

• B. Queue Storage is for message queuing between services, not the primary storage for sensor data.
• C. File Storage is for shared file access via SMB protocol, not optimized for IoT sensor data ingestion.
• E. Notification Hubs is for sending push notifications to mobile apps, not for collecting IoT sensor data.

Correct answer: B. No

While Azure App Service is PaaS, Azure Virtual Machines are Infrastructure as a Service (IaaS). Virtual machines require administrative management of the operating system, patches, and configurations. The requirement explicitly states only PaaS solutions must be used, so this mixed solution violates the migration plan by including an IaaS component.

Why the other options are wrong

• A. Virtual machines are IaaS, not PaaS, so this violates the PaaS-only requirement.

Correct answer: C. Infrastructure as a Service (laaS)

Infrastructure as a Service (IaaS) is the appropriate recommendation. Since the applications require multiple prerequisite applications and services to be installed and configured, the company needs full control over the operating system and infrastructure. IaaS provides virtual machines where they can install and manage all required components, whereas PaaS and SaaS provide more abstraction and less control.

Why the other options are wrong

• A. Software as a Service (SaaS) provides complete applications to end-users and does not allow installation of custom prerequisite applications.
• B. Platform as a Service (PaaS) provides a managed platform but may not offer sufficient flexibility to install diverse prerequisite applications and services needed for these custom applications.

Correct answer: A. Yes

Azure Cloud Shell supports Bash and provides pre-installed Azure CLI tools. Running the az vm create command in Cloud Shell Bash is a valid and direct method to execute the command. Cloud Shell eliminates the need for local installations and provides an authenticated session to Azure, making it a complete solution for creating the virtual machine.

Why the other options are wrong

• B. Azure Cloud Shell is specifically designed to run Azure CLI and PowerShell commands, making this a valid approach.

Correct answer: A. Yes

Network Security Groups (NSGs) are specifically designed to filter network traffic and control connection types between resources. NSGs contain security rules that allow or deny inbound and outbound traffic based on source, destination, ports, and protocols. This is the perfect solution for controlling which connection types are allowed between web servers and database servers in Azure.

Why the other options are wrong

• B. NSGs are the correct Azure solution for controlling connection types and traffic between network resources.

Correct answer: B. an Azure Key Vault

Azure Key Vault must be created first before implementing Azure Disk Encryption. The Key Vault stores the encryption keys used to encrypt the VM's disks. Azure Storage accounts are not required for disk encryption. Azure Information Protection is for data classification, not disk encryption. While an encryption key is needed, it is generated and stored within the Key Vault, so the vault must exist first.

Why the other options are wrong

• A. An Azure Storage account is not required for Azure Disk Encryption.
• C. Azure Information Protection policy is for data classification and protection, not for disk encryption.
• D. An encryption key must be stored in a Key Vault, so the vault must be created first before the key can be generated.

Correct answer: B. Azure Functions

Azure Functions is Azure's serverless computing service that allows execution of code without managing infrastructure. Users only pay for compute resources consumed during execution. Virtual Machines require managing the underlying infrastructure, storage accounts are for data storage, and dedicated hosts are for dedicated physical servers.

Why the other options are wrong

• A. Azure Virtual Machines require users to manage and provision virtual infrastructure, which is not serverless.
• C. Azure Storage Accounts are for data storage and do not provide serverless computing capabilities.
• D. Azure Dedicated Hosts are dedicated physical servers and require infrastructure management, contrary to serverless principles.

Correct answer: A. Yes

Yes, this solution meets the goal. The Azure portal is a web-based interface that is responsive and works on tablets, including Android devices with a web browser. From the Azure portal, users can navigate to Virtual Machines, click Create, and provision a new virtual machine through the graphical interface, which is fully functional on mobile devices.

Correct answer: D. The public cloud is a shared entity whereby multiple corporations each use a portion of the resources in the cloud

The public cloud is a shared multi-tenant environment where multiple organizations each utilize a portion of the same cloud infrastructure and resources. This shared model enables economies of scale, reduces per-customer costs, and provides flexibility compared to on-premises networks. The public cloud is managed by cloud providers, not by the public.

Why the other options are wrong

• A. Public clouds are owned and operated by corporations (like Microsoft, Amazon, Google), not by the public.
• B. Public clouds are not crowd-sourcing solutions; they are professionally managed by vendors.
• C. Public cloud resources are not freely accessible to the public; access requires subscriptions and authentication.

Correct answer: B. Azure Sentinel

Azure Sentinel (also known as Microsoft Sentinel) is Azure's native Security Information and Event Management (SIEM) solution. It provides threat detection, investigation, and automated response capabilities across cloud and on-premises environments. Azure Analysis Services is for data analytics. Azure Information Protection is for data classification. Azure Cognitive Services provides AI and machine learning capabilities but is not a SIEM solution.

Why the other options are wrong

• A. Azure Analysis Services is a data analytics platform, not a SIEM solution.
• C. Azure Information Protection is for data classification and protection, not for SIEM functionality.
• D. Azure Cognitive Services provides AI and ML capabilities, not SIEM functionality.

Correct answer: A, B, E. Use Bash in Azure Cloud Shell; Use PowerShell in Azure Cloud Shell; Use the Azure portal.

Bash in Cloud Shell, PowerShell in Cloud Shell, and the Azure portal all provide browser-based access and can be used from an Android tablet to create virtual machines. Cloud Shell uses Bash or PowerShell in a browser, and the Azure portal is a complete graphical management interface.

Why the other options are wrong

• C. PowerApps portal is for building and running business applications, not for creating Azure virtual machines.
• D. The Security & Compliance admin center is for Microsoft 365 security settings, not for Azure resource management.

Correct answer: C. provides a connection from an on-premises VPN device to an Azure VPN gateway

Site-to-Site VPN provides a secure connection from an on-premises VPN device to an Azure VPN gateway, enabling organizations to connect entire on-premises networks to Azure over the public internet.

Why the other options are wrong

• A. This describes Point-to-Site VPN, which connects individual computers to Azure, not on-premises networks.
• B. This describes Azure ExpressRoute, which provides a dedicated private connection that does not travel over the internet.