85 Free AZ-305 Practice Questions and Answers
85 questions for the AZ-305 exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Storage queues do not guarantee ordering, and custom metadata does not change that.
Not this one. Try another answer.
Why B is wrong
Partitioning spreads a queue across multiple message brokers for throughput, which works against strict ordering rather than for it.
Right, C is the answer.
Why C is right
First in, first out ordering in Service Bus is delivered by message sessions. Messages that share a session identifier are locked to a single receiver and handed over in the order they arrived, which is what guarantees the sequence. Without sessions a queue only makes a best effort at ordering once multiple receivers or redeliveries are involved.
Not this one. Try another answer.
Why D is wrong
A stored access policy governs shared access signatures. It has no bearing on delivery order.
Question 2 Play from 01:57
• Builds a custom container image by using a base image stored in a public Docker Hub repository.
• Stores the custom container image in Azure Container Registry.
• Deploys the custom container image to Azure Container Apps. The pipeline is triggered by commits to the Azure Repos repository. You need to ensure that when the base image in Docker Hub is updated, the custom image in Azure Container Registry is updated automatically. The solution must minimize administrative effort. What should you include in the solution?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
ACR Tasks can build container images in Azure Container Registry and automatically rebuild them when their base image is updated. When a task builds an image from a Dockerfile, it discovers the base image in the FROM statement and tracks it, and public repositories in Docker Hub are a supported base image location. When the Docker Hub base image is updated under a stable tag, the task detects the change and rebuilds the custom image, pushing the updated version to the registry. Because the base image trigger is enabled by default on tasks and requires no custom code or polling logic, this is the solution with the least administrative effort.
Not this one. Try another answer.
Why B is wrong
An Azure Automation runbook would require custom scripting to poll Docker Hub for changes and trigger a rebuild, which adds development and administrative effort compared to the built-in base image trigger in ACR Tasks.
Not this one. Try another answer.
Why C is wrong
An Azure function hosted in Container Apps would need custom code to detect base image updates and start builds, which adds effort and duplicates functionality that ACR Tasks provides natively.
Not this one. Try another answer.
Why D is wrong
The existing pipeline is triggered only by commits to Azure Repos, and adding a pipeline task does not make it react to updates of a Docker Hub base image.
Question 3 Play from 04:48
• Ensure that the applications remain available if a single AKS cluster fails.
• Ensure that the connection traffic over the internet is encrypted by using SSL without having to configure SSL on each container. Which service should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Azure Front Door is a global layer 7 entry point. It load balances across the two AKS clusters and takes an unhealthy region out of rotation, so the applications stay available if one cluster fails. It also terminates TLS at the edge, which means the SSL certificate is managed once at Front Door rather than configured on each container.
Not this one. Try another answer.
Why B is wrong
Traffic Manager works at DNS level and cannot terminate TLS, so SSL would still have to be handled behind it.
Not this one. Try another answer.
Why C is wrong
An ingress controller lives inside a single cluster, so it cannot provide availability if that whole cluster fails.
Not this one. Try another answer.
Why D is wrong
Azure Load Balancer is a regional layer 4 service. It neither spans regions nor terminates TLS.
Question 4 Play from 06:56
• Deploy the solution on-premises and to Azure. Support low-latency and hyperscale operations.
• Allow independent upgrades to each microservice.
• Set policies for performing automatic repairs to the microservices. You need to recommend a technology. What should you recommend?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Container Instances runs individual containers with no orchestration, versioned upgrades, or health-based repair, and it is Azure only.
Not this one. Try another answer.
Why B is wrong
A Logic App is a workflow orchestration service, not a microservices runtime.
Right, C is the answer.
Why C is right
Service Fabric is the platform that matches every requirement. Its runtime can be deployed on-premises as well as in Azure, so the same solution runs in both, it is built for low-latency hyperscale microservices, each service can be versioned and upgraded independently, and health policies drive automatic repair when a service becomes unhealthy.
Not this one. Try another answer.
Why D is wrong
A scale set manages identical virtual machines. It has no notion of individual microservices or their independent upgrade.
Question 5 Play from 09:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Data Migration Assistant assesses a SQL Server estate for migration blockers and does not run packages.
Right, B is the answer.
Why B is right
Azure Data Factory can provision an Azure-SSIS integration runtime, a managed cluster that hosts and runs existing SSIS packages in Azure. The 100 packages are deployed to it and retargeted at the migrated Azure SQL databases, so the investment in them is preserved rather than rewritten.
Not this one. Try another answer.
Why C is wrong
Azure Data Catalog registers and describes data assets.
Not this one. Try another answer.
Why D is wrong
SQL Server Migration Assistant converts schemas and data from other database engines to SQL Server.
Question 6 Play from 11:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Migrate discovers and assesses servers. It does not perform the database migration.
Right, B is the answer.
Why B is right
Azure Database Migration Service is the managed service for moving SQL Server to Azure SQL Managed Instance, and it handles all 50 databases in a single migration project rather than one at a time. Running it in offline mode is exactly the supported scenario, and because the service orchestrates backup, copy, and restore itself, the administrative effort is far lower than scripting the work.
Not this one. Try another answer.
Why C is wrong
SQL Server Migration Assistant converts from other database engines such as Oracle or MySQL to SQL Server.
Not this one. Try another answer.
Why D is wrong
Data Migration Assistant assesses compatibility and can move small workloads, but it is not designed to migrate 50 databases with minimal effort.
Question 7 Play from 13:08
• Limit the exposure of sensitive data.
• Follow the principle of least privilege. What should you use?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Azure RBAC lets you assign a built-in data role such as Storage Blob Data Contributor to the developers' Microsoft Entra identities, scoped as narrowly as a single container. Developers authenticate with their own identities, so no shared secret is distributed, access can be revoked centrally, and every operation is attributable to a specific user. Granting only read and write data permissions at the smallest required scope follows the principle of least privilege and limits the exposure of sensitive data. Microsoft recommends Microsoft Entra authorization with RBAC over key-based or token-based access for these reasons.
Not this one. Try another answer.
Why B is wrong
A certificate is not an authorization mechanism for reading and writing data in a storage account.
Not this one. Try another answer.
Why C is wrong
A SAS is a bearer token: anyone who obtains it can use it until it expires, and it is not tied to a developer's identity, so it exposes more risk than RBAC.
Not this one. Try another answer.
Why D is wrong
A storage account key grants full access to all data and operations in the account, which violates least privilege and maximizes exposure.
Question 8 Play from 15:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
ZIP packages contain application code for deployment, not the configuration of the App Service instances, so they do not define the instance settings.
Not this one. Try another answer.
Why B is wrong
Container images in Azure Container Registry are used for container-based apps, and the web apps are code-based. Images also package the application, not the App Service configuration.
Right, C is the answer.
Why C is right
Bicep is a declarative infrastructure-as-code language for Azure Resource Manager. A Bicep file describes the desired configuration of resources such as App Service plans and web apps, including settings, app settings, and scaling options, and can be deployed repeatedly to create all 50 instances consistently. Storing the Bicep files in Azure Repos, a Git-based version control system, records every change as a commit, which provides a full version history of the configurations and lets you review, compare, and roll back changes. Pipelines can then deploy the files whenever they change, keeping the instances aligned with the defined configuration.
Not this one. Try another answer.
Why D is wrong
Azure Compute Gallery stores virtual machine images and VM applications, which do not apply to App Service instances.
Question 9 Play from 17:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Weekly backups are only one of the available periods; monthly and yearly retention can also be included in the policy.
Not this one. Try another answer.
Why B is wrong
Monthly retention is only one of the available periods; weekly and yearly retention can also be included.
Not this one. Try another answer.
Why C is wrong
Yearly retention is only one of the available periods; weekly and monthly retention can also be included.
Not this one. Try another answer.
Why D is wrong
This omits yearly retention, which is also a supported LTR period and the natural choice for multi-year retention.
Not this one. Try another answer.
Why E is wrong
This omits weekly retention, which is also a supported LTR period.
Right, F is the answer.
Why F is right
Long-term retention for Azure SQL Database copies full backups into separate Azure Blob storage containers and keeps them for up to 10 years. An LTR policy is a combination of weekly retention (W), monthly retention (M), and yearly retention (Y), plus the week of the year used for the yearly backup. Any of the three periods can be set alone or together, and each can be configured to retain backups for as long as the policy allows. A policy that keeps weekly, monthly, and yearly backups therefore satisfies the requirement to retain backups for up to seven years, and all three periods can be included in the solution.
Question 10 Play from 20:25
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The on-premises data gateway serves Power BI, Power Apps, and Logic Apps. Data Factory uses its own integration runtime.
Not this one. Try another answer.
Why B is wrong
The Azure Pipelines agent runs CI/CD jobs and has no role in a data pipeline.
Right, C is the answer.
Why C is right
Azure Data Factory reaches data that is not publicly accessible through a self-hosted integration runtime installed on a machine that can see it. Deploying it on VM1 lets the factory read the 500 GB of local files, run the transformation, and write the result to Data Lake Storage.
Not this one. Try another answer.
Why D is wrong
The Azure File Sync agent synchronises a Windows file server with an Azure file share.
Show all 85 questionsShow fewer questions
Question 11 Play from 22:22
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The TDE protector for a managed instance is an asymmetric key held in Azure Key Vault, and SQL supports RSA keys of 2048 or 3072 bits for this purpose. RSA 3072 is the strongest of the supported lengths, so it is the right choice when the requirement is to maximise encryption strength.
Not this one. Try another answer.
Why B is wrong
AES 256 is the symmetric algorithm used for the database encryption key itself. The protector that wraps it is asymmetric, so AES is not an option here.
Not this one. Try another answer.
Why C is wrong
RSA 4096 is not a supported key length for the TDE protector, so it cannot be used however strong it sounds.
Not this one. Try another answer.
Why D is wrong
RSA 2048 is supported but is the weaker of the two available lengths.
Question 12 Play from 24:31
• Stored procedures are implemented by using CLR.
• The largest database is currently 3 TB. None of the databases will ever exceed 4 TB. You plan to move all the data from SQL Server to Azure. You need to recommend a service to host the databases. The solution must meet the following requirements:
• Whenever possible, minimize management overhead for the migrated databases.
• Ensure that users can authenticate by using Azure Active Directory (Azure AD) credentials.
• Minimize the number of database changes required to facilitate the migration. What should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Elastic pools are built on Azure SQL Database, which does not support CLR stored procedures.
Right, B is the answer.
Why B is right
The databases use CLR stored procedures, which Azure SQL Database does not support, so a platform with near full SQL Server surface area is required. Azure SQL Managed Instance provides CLR integration, keeps the migration close to a lift and shift with minimal database changes, supports Azure AD authentication, and is still a managed service, so it beats running SQL Server on a virtual machine on management overhead. The 3 TB size sits inside its limits.
Not this one. Try another answer.
Why C is wrong
Single databases have the same CLR limitation and would force changes to the databases.
Not this one. Try another answer.
Why D is wrong
SQL Server on a virtual machine would run the workload, but patching, backups, and high availability all become the customer's responsibility, which is the opposite of minimising management overhead.
Question 13 Play from 27:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A geo-redundant storage account replicates to the paired region only, and it is not a container registry.
Right, B is the answer.
Why B is right
Geo-replication is a Premium tier feature of Azure Container Registry. It presents one registry with a single login server and image name while keeping a replica in each configured region, so an image pushed once is replicated automatically to all four regions and each AKS cluster pulls from its local replica.
Not this one. Try another answer.
Why C is wrong
A CDN caches content at edge nodes on demand. It does not host or replicate container images for a registry.
Not this one. Try another answer.
Why D is wrong
Azure Cache for Redis is an in-memory data cache.
Question 14 Play from 29:16
• The Point-to-Site (P2S) VPN connections of mobile users must connect automatically to the closest Azure region.
• The offices in each region must connect to their local Azure region by using an ExpressRoute circuit.
• Transitive routing between virtual networks and on-premises networks must be supported.
• The network traffic between virtual networks must be filtered by using FQDNs. What should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Azure Virtual WAN with a secured virtual hub is the only design that meets all four requirements. Virtual WAN gives every hub a regional presence so P2S clients connect to the nearest one, each region's office terminates its own ExpressRoute circuit on the local hub, and the hubs form a fully transitive mesh so virtual networks and on-premises networks route between each other. Securing the hub deploys Azure Firewall into it, and Azure Firewall filters traffic by fully qualified domain name.
Not this one. Try another answer.
Why B is wrong
Virtual network peering is not transitive, and application security groups filter by IP-based groupings rather than by FQDN.
Not this one. Try another answer.
Why C is wrong
Gateways connected point to point do not provide transitive routing, and network security groups filter on addresses and ports, not FQDNs.
Not this one. Try another answer.
Why D is wrong
Route Server exchanges routes with a network virtual appliance and Network Function Manager deploys appliances at the edge. Neither delivers the P2S regional affinity or the FQDN filtering asked for.
Question 15 Play from 31:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Health check in App Service pings a path to remove unhealthy instances from the load balancer rotation; it does not measure or report response times experienced by end users.
Not this one. Try another answer.
Why B is wrong
Log Analytics stores and queries log data, but on its own it does not instrument App1 to collect end-user response times, so additional configuration would be needed.
Right, C is the answer.
Why C is right
Azure Monitor Application Insights is the application performance monitoring feature of Azure Monitor, and it can be enabled for an App Service app directly from the portal, often without code changes. It automatically collects request rates, server response times, dependency durations and failures, and its browser telemetry captures page load and response timings as experienced by end users. These metrics are preaggregated and available immediately in dashboards and alerts, so the response times of App1 can be monitored with minimal administrative effort.
Not this one. Try another answer.
Why D is wrong
Network Watcher connection monitor tests network reachability and latency between endpoints, not the application response times that end users experience.
Question 16 Play from 34:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Application groups belong to Azure Virtual Desktop and quotas limit resource consumption. Neither organises resources for reporting.
Right, B is the answer.
Why B is right
Tags carry the department against each resource, and Cost Management and the compliance views group and filter by them, so a report can be produced per department across all 1,000 resources. Azure Policy is what makes that reliable, by requiring the department tag on resources and remediating any that lack it, so no resource falls out of the grouping.
Not this one. Try another answer.
Why C is wrong
Administrative units delegate user and group administration, and Azure Lighthouse enables cross-tenant management by a service provider.
Not this one. Try another answer.
Why D is wrong
Resource groups are a single, rigid grouping and a resource can only be in one, so they cannot express a department view across an existing estate. Role assignments control access rather than reporting.
Question 17 Play from 36:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A cluster in a single availability zone runs entirely in one datacenter, so a datacenter failure takes the whole cluster down.
Not this one. Try another answer.
Why B is wrong
Multiple node pools in the same zone still share one datacenter, so they provide no protection if that datacenter fails.
Not this one. Try another answer.
Why C is wrong
An AKS cluster is a regional resource and its nodes cannot be deployed across different Azure regions; multiregion designs require separate clusters.
Right, D is the answer.
Why D is right
Availability zones are physically separate datacenters within a region, each with independent power, cooling, and networking. An AKS cluster with availability zones enabled spreads its node pools across zones, so planned maintenance or the failure of one datacenter affects only part of the nodes, and the remaining zones keep App1 running with minimal downtime. Zone-spanning node pools are backed by virtual machine scale sets, so the cluster autoscaler can still add and remove nodes dynamically in response to workload demand. This is the only option that satisfies all three requirements within a single cluster.
Question 18 Play from 38:35
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Batch is designed for large-scale parallel and HPC jobs and requires defining pools, jobs, and tasks, which adds cost and administrative effort for a single daily lookup.
Not this one. Try another answer.
Why B is wrong
An event hub is a high-throughput event ingestion service. It cannot query a website or write to a database on its own, so separate compute would still be required.
Not this one. Try another answer.
Why C is wrong
An Azure container instance requires building and maintaining a container image plus a separate scheduling mechanism, which increases development and administrative effort compared to a timer-triggered function.
Right, D is the answer.
Why D is right
The requirement is a small, recurring job: once a day, call an external website, read the maximum temperature for the previous 24 hours, and write one value to DB1. Azure Functions handles this with a timer trigger that runs the code on a schedule, and an Azure SQL output binding writes the result to the database without custom data access plumbing, which minimizes development effort. On the Consumption or Flex Consumption plan you pay only for the brief execution time, so costs are minimal, and because the service is serverless there are no servers, pools, or containers to manage, which minimizes administrative effort.
Question 19 Play from 41:02
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Data Box Gateway is a virtual appliance for moving bulk data into Azure. It is not needed when there is network connectivity and Data Factory can do the copy.
Not this one. Try another answer.
Why B is wrong
The Import/Export service ships physical disks for a one-time bulk transfer, which does not suit an ongoing load.
Right, C is one of the answers.
Why C is right
Azure Data Factory is what reaches the on-premises Oracle database, using a self-hosted integration runtime installed on the local network, and copies the data into Azure on a schedule. Azure Data Lake Storage is where it lands, and Databricks mounts that storage directly to transform the data before loading it into Synapse. The two together make the App1 data available.
Not this one. Try another answer.
Why D is wrong
Data Box Edge is an on-premises appliance with local compute for pre-processing, which this scenario does not require.
Right, E is one of the answers.
Why E is right
Azure Data Factory is what reaches the on-premises Oracle database, using a self-hosted integration runtime installed on the local network, and copies the data into Azure on a schedule. Azure Data Lake Storage is where it lands, and Databricks mounts that storage directly to transform the data before loading it into Synapse. The two together make the App1 data available.
Question 20 Play from 43:13
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Logs Ingestion API sends data to a data collection endpoint (or a data collection rule endpoint), which routes it through a data collection rule into the custom table in Workspace1. An Azure Monitor Private Link Scope connects a virtual network to Azure Monitor resources, including data collection endpoints and Log Analytics workspaces, through a single private endpoint. After the data collection endpoint and Workspace1 are added to the AMPLS, the virtual machines send their custom JSON logs over private IP addresses, and the workspace network isolation settings can be set to block ingestion and query access from public networks. This keeps the ingestion path private while still supporting the API for all 1,000 virtual machines.
Not this one. Try another answer.
Why B is wrong
A linked storage account is used for specific scenarios such as custom logs or saved queries stored in your own storage. It does not provide private network access to the Logs Ingestion API or block internet access to Workspace1.
Not this one. Try another answer.
Why C is wrong
Service Connector configures connection settings between compute services and backing services. It does not create a private network path for Azure Monitor ingestion.
Not this one. Try another answer.
Why D is wrong
Azure Peering Service optimizes internet connectivity to Microsoft services through partner providers. Traffic still uses public endpoints, so it cannot prevent internet access to Workspace1.
Question 21 Play from 46:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Service Health alerts report Azure platform incidents and maintenance; they do not collect or query log and trace data from workloads or Arc-enabled machines.
Not this one. Try another answer.
Why B is wrong
An Azure Monitor workspace in each workload subscription stores Prometheus metrics, not log and trace data, and deploying one per subscription creates the disparate locations the requirements prohibit.
Not this one. Try another answer.
Why C is wrong
Azure Managed Grafana visualizes data from other sources but does not store logs or traces, so it cannot by itself centralize the monitoring data.
Right, D is the answer.
Why D is right
A single Log Analytics workspace in the dedicated management subscription gives the operations teams one place to run Kusto queries that correlate platform logs with workload telemetry. Azure resources in every workload subscription can send resource logs to it through diagnostic settings, Azure Arc-enabled on-premises virtual machines send logs through the Azure Monitor Agent and data collection rules, and workspace-based Application Insights stores application traces in the same workspace. Centralizing on one workspace, backed by Azure Policy and permissions, stops teams from scattering monitoring data across separate locations while still supporting the hybrid resources.
Question 22 Play from 49:09
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
Azure AD Application Proxy publishes an internal web app to the internet through an outbound connector, so remote users reach WebApp1 without a VPN, and it supports Kerberos constrained delegation so Integrated Windows authentication still works and single sign-on is preserved. The published app appears in the tenant as an Azure AD enterprise application, which is where the assignment, SSO configuration, and policy for it live. Both pieces are needed.
Not this one. Try another answer.
Why B is wrong
Privileged Identity Management provides just-in-time activation of privileged roles. It plays no part in publishing an internal web app.
Not this one. Try another answer.
Why C is wrong
Conditional Access can add controls once the app is published, but on its own it creates no path to an on-premises app.
Not this one. Try another answer.
Why D is wrong
Azure Arc projects servers and Kubernetes clusters into Azure for management. It does not publish a web app for remote access.
Right, E is one of the answers.
Why E is right
Azure AD Application Proxy publishes an internal web app to the internet through an outbound connector, so remote users reach WebApp1 without a VPN, and it supports Kerberos constrained delegation so Integrated Windows authentication still works and single sign-on is preserved. The published app appears in the tenant as an Azure AD enterprise application, which is where the assignment, SSO configuration, and policy for it live. Both pieces are needed.
Not this one. Try another answer.
Why F is wrong
Azure Application Gateway is a regional layer 7 load balancer inside a virtual network. Reaching an on-premises app through it would still require network connectivity that the remote users do not have.
Question 23 Play from 51:59
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A shared access signature grants access to blob resources for a defined window, with an explicit start and expiry time and a chosen set of permissions. Issuing SAS tokens valid only through April gives the ten finance users access for that month and nothing beyond it, with no change to the account keys.
Not this one. Try another answer.
Why B is wrong
Conditional Access governs how an identity signs in, applying controls such as MFA or device state. It does not put an expiry on access to a blob.
Not this one. Try another answer.
Why C is wrong
Certificates authenticate a client. They do not by themselves limit access to a container for a calendar month.
Not this one. Try another answer.
Why D is wrong
Access keys grant full, permanent control of the whole storage account. They cannot be scoped to a time window or to specific blobs.
Question 24 Play from 54:03
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A user risk policy responds to the likelihood that the account itself is compromised, such as leaked credentials, and typically forces a password change. It does not evaluate the network of each sign-in.
Not this one. Try another answer.
Why B is wrong
An access package bundles resources that users request through entitlement management. It does not prompt for MFA at sign-in.
Not this one. Try another answer.
Why C is wrong
An identity governance policy manages access lifecycle tasks such as requests and reviews. It does not enforce MFA based on the network a user signs in from.
Right, D is the answer.
Why D is right
User1 has a Microsoft Entra ID P2 license, which includes Microsoft Entra ID Protection. A sign-in risk policy evaluates each authentication attempt against built-in detections such as anonymous IP addresses, unfamiliar sign-in properties and atypical travel, which are typical of access from untrusted networks, and requires MFA when the sign-in risk reaches the configured level. The detections are maintained by Microsoft, so the policy is configured once and no list of network locations or IP ranges has to be built and kept current, which minimizes administrative effort.
Question 25 Play from 56:30
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The delay appears when many users read the same data under load, which is the classic case for a cache. Azure Cache for Redis holds the frequently requested results in memory, so most reads are served without touching SQL1 at all. That cuts response time for users and takes pressure off the database during peak periods.
Not this one. Try another answer.
Why B is wrong
A CDN caches static content at edge locations. The data here is dynamic and comes from a database.
Not this one. Try another answer.
Why C is wrong
Data Factory moves and transforms data on a schedule. It does nothing for interactive read latency.
Not this one. Try another answer.
Why D is wrong
Synapse Analytics is an analytical platform for large queries, not a way to speed up transactional reads.
Question 26 Play from 58:27
• Requests to the logic apps from the developers must be limited to lower rates than the requests from the users at Contoso.
• The developers must be able to rely on their existing OAuth 2.0 provider to gain access to the logic apps.
• The solution must NOT require changes to the logic apps.
• The solution must NOT use Azure AD guest accounts. What should you include in the solution?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Front Door is a global entry point with WAF and routing. It does not validate third-party OAuth 2.0 tokens or apply per-consumer rate limits.
Not this one. Try another answer.
Why B is wrong
Application Proxy publishes on-premises apps to Azure AD identities. The logic apps are already in Azure and Azure AD accounts are explicitly excluded.
Not this one. Try another answer.
Why C is wrong
Azure AD B2B works by inviting external users as guests, which the requirements rule out.
Right, D is the answer.
Why D is right
Azure API Management sits in front of the logic apps and satisfies every constraint at once. Rate limit policies applied per product or subscription give the Fabrikam developers a lower request rate than Contoso users. Its validate-jwt policy accepts tokens from any third-party OAuth 2.0 provider, so the developers keep their existing identity provider and no Azure AD guest accounts are needed. Because the enforcement lives in the gateway, the logic apps themselves are untouched.
Question 27 Play from 1:01:31
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Administrative units are an Azure AD construct for delegating user and group administration. They sit outside the resource hierarchy that Azure Policy governs.
Not this one. Try another answer.
Why B is wrong
An Azure AD tenant is the identity boundary. Policy is assigned to resource scopes, with the management group as the highest one.
Right, C is one of the answers.
Why C is right
Azure Policy assignments follow the Azure Resource Manager hierarchy, so a definition can be assigned at a management group, a subscription, or a resource group, and it then applies to everything beneath that scope. Those three are the assignable scopes.
Not this one. Try another answer.
Why D is wrong
An individual compute resource is the target of a policy evaluation, not a scope an assignment is made at.
Right, E is one of the answers.
Why E is right
Azure Policy assignments follow the Azure Resource Manager hierarchy, so a definition can be assigned at a management group, a subscription, or a resource group, and it then applies to everything beneath that scope. Those three are the assignable scopes.
Right, F is one of the answers.
Why F is right
Azure Policy assignments follow the Azure Resource Manager hierarchy, so a definition can be assigned at a management group, a subscription, or a resource group, and it then applies to everything beneath that scope. Those three are the assignable scopes.
Question 28 Play from 1:03:35
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A data catalog documents data assets. It does not attach operational metadata to Azure resources or drive resource reporting.
Not this one. Try another answer.
Why B is wrong
A management group hierarchy organises subscriptions. It cannot record an owner or a cost centre against an individual resource.
Right, C is the answer.
Why C is right
The operational information named here, environment, owner, department, and cost centre, is exactly what resource tags carry, and Cost Management and the resource reports group and filter by them. An Azure Policy that enforces tagging rules makes sure every resource actually carries those tags, which is what keeps the reports complete.
Not this one. Try another answer.
Why D is wrong
Administrative units delegate administration of users and groups in Azure AD and have no bearing on resource reporting.
Question 29 Play from 1:05:46
• The evaluation must be repeated automatically every three months.
• Every member must be able to report whether they need to be in Group1.
• Users who report that they do not need to be in Group1 must be removed from Group1 automatically.
• Users who do not report whether they need to be in Group1 must be removed from Group1 automatically. What should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Identity Protection is a risk engine for sign-ins and users. It performs no membership attestation.
Not this one. Try another answer.
Why B is wrong
A dynamic group derives membership from attributes automatically, so no member is ever asked whether they still belong.
Right, C is the answer.
Why C is right
An access review covers all four requirements directly. It can be scheduled to recur every three months, the members themselves can be set as the reviewers so each person reports whether they still need to be in Group1, denied results remove the user, and the setting for reviewers who do not respond removes those who never answer.
Not this one. Try another answer.
Why D is wrong
Privileged Identity Management provides just-in-time activation for privileged roles, not recurring review of a security group.
Question 30 Play from 1:08:09
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A Data Factory pipeline is scheduled batch data movement, not a messaging fabric for a transactional flow.
Not this one. Try another answer.
Why B is wrong
Multiple queues would mean the publisher writing the same message to each one and knowing every consumer in advance, which is what a topic removes.
Not this one. Try another answer.
Why C is wrong
A Service Bus queue improves on a storage queue but still delivers each message once, so additional applications could not read the same transaction.
Right, D is the answer.
Why D is right
A queue delivers each message to exactly one consumer, so once several applications need to see the same shipping transactions a queue cannot work. A Service Bus topic is publish and subscribe: each application gets its own subscription, and a subscription filter selects only the transactions whose details are relevant to it, which is precisely the future requirement described.
Question 31 Play from 1:10:25
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SQL Server Stretch Database moves cold rows of an on-premises table into Azure. It is not a migration target for the whole application.
Right, B is one of the answers.
Why B is right
The application addresses tables by server, database, and table name, so the target has to support cross-database queries within one instance. SQL Server on an Azure virtual machine keeps the full engine behaviour, and Azure SQL Managed Instance supports cross-database queries on the same instance, so both allow the existing code to work unchanged.
Not this one. Try another answer.
Why C is wrong
Azure SQL Database isolates each database, so a query that names another database on the same server fails.
Right, D is one of the answers.
Why D is right
The application addresses tables by server, database, and table name, so the target has to support cross-database queries within one instance. SQL Server on an Azure virtual machine keeps the full engine behaviour, and Azure SQL Managed Instance supports cross-database queries on the same instance, so both allow the existing code to work unchanged.
Question 32 Play from 1:12:19
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Microsoft Purview is a data governance service for cataloging and classifying data, and it does not capture the requests made against a key vault.
Not this one. Try another answer.
Why B is wrong
The activity log of KV1 records only management operations, such as changes to the vault's configuration, so it does not show when secrets, keys or certificates are read.
Right, C is the answer.
Why C is right
Key Vault records every data plane request, such as reading a secret or a key, in its resource logs, together with the caller identity, the operation and the time it ran. Those resource logs are not kept until a diagnostic setting in Azure Monitor routes them to a destination, and sending them to a storage account keeps the cost low because no workspace ingestion is billed. That diagnostic setting is what makes it possible to review how and when KV1 is accessed. The activity log, by contrast, records only management operations on the vault resource itself.
Not this one. Try another answer.
Why D is wrong
Microsoft Sentinel is a SIEM that bills for the data ingested into its workspace, which costs far more than routing the Key Vault resource logs to storage with Azure Monitor.
Question 33 Play from 1:14:32
• Support at least 500 requests per second.
• Support a large image, video, and audio streams. Which type of Azure Storage account should you provision?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A standard general-purpose v2 account would hold the data but on spinning media, so it is the slower option for a demanding streaming workload.
Right, B is the answer.
Why B is right
Large image, video, and audio streams are block blobs, and a high request rate with low latency is what the premium block blob account type is for. It stores data on solid state disks and delivers much higher transaction rates and lower latency than the standard tier, so it comfortably serves 500 requests per second of streaming media.
Not this one. Try another answer.
Why C is wrong
Premium page blobs are optimised for random read and write access and are used for virtual machine disks, not for streaming media.
Not this one. Try another answer.
Why D is wrong
Premium file shares serve SMB and NFS clients rather than streaming large media objects.
Question 34 Play from 1:16:27
• The users must only have access to the app of the project to which they are assigned currently.
• Project managers must verify which users have access to their project’s app and remove users that are no longer assigned to their project.
• Once every 30 days, the project managers must be prompted automatically to verify which users are assigned to their projects. What should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Identity Protection detects risky users and sign-ins. It does not manage who is entitled to which app.
Not this one. Try another answer.
Why B is wrong
Microsoft Defender for Identity monitors on-premises Active Directory for attacks.
Not this one. Try another answer.
Why C is wrong
Permissions Management discovers and right-sizes permissions across cloud infrastructure. It does not run manager attestations on app assignments.
Right, D is the answer.
Why D is right
Identity Governance is the umbrella that contains entitlement management and access reviews, which together cover all three requirements. Access packages grant a user the app for the project they are currently on and remove it when they move, and a recurring access review set to every 30 days prompts each project manager to confirm who should still have their project's app and removes those who should not.
Question 35 Play from 1:18:53
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Vaulted backup of Azure blobs targets standard blob accounts and protects against deletion or corruption; it is not the regional disaster recovery mechanism for a Data Lake Storage Gen2 account.
Not this one. Try another answer.
Why B is wrong
Operational backup of Azure blobs keeps restore points locally in the source account and does not support accounts with a hierarchical namespace, so it provides no protection from a regional outage.
Not this one. Try another answer.
Why C is wrong
Geo-backup in Azure Synapse Analytics protects only dedicated SQL pool data warehouses; Workspace1 has no dedicated SQL pool, and geo-backup never covers a storage account.
Right, D is the answer.
Why D is right
Disaster recovery for an Azure Data Lake Storage Gen2 account is provided by geo-redundant storage. With GRS or GZRS, Azure Storage asynchronously replicates the account's data, including the hierarchical namespace metadata and ACLs, to a secondary region hundreds of miles away. If the primary region becomes unavailable, a customer-managed failover promotes the secondary region so that the serverless SQL pool and the Apache Spark pool in Workspace1 can again read the data. Accounts with a hierarchical namespace support both planned and unplanned customer-managed failover, so asynchronous replication is the recovery mechanism for storage1.
Question 36 Play from 1:21:25
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Restoring anywhere in the world would break the data residency boundary the backup format deliberately enforces.
Not this one. Try another answer.
Why B is wrong
The restriction is the geography rather than the individual region, so another region within the same geography is a valid target.
Not this one. Try another answer.
Why C is wrong
The backup can be restored into a different vault, which is what makes it useful for disaster recovery.
Right, D is the answer.
Why D is right
A key vault backup is encrypted with a key that Azure holds within the security boundary of the geography the vault lives in, so the backup blob can only be restored into a vault in that same geography. West US is in the United States geography, so the restore target has to be a vault in the United States, not necessarily the same region and not another geography.
Question 37 Play from 1:23:24
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Databricks runs Spark and can perform the same transformation, but it requires notebook code rather than the mapping data flow feature named in the requirement.
Not this one. Try another answer.
Why B is wrong
Azure Storage Sync keeps Windows file servers in step with an Azure file share.
Right, C is the answer.
Why C is right
Mapping data flow is a feature of Azure Data Factory. It provides a visual transformation designer whose logic is executed on a managed Spark cluster, so the files can be read from Blob Storage, transformed, and written to Data Lake Storage without writing any Spark code.
Not this one. Try another answer.
Why D is wrong
Data Box Gateway is a virtual appliance for shipping data into Azure and performs no transformation.
Question 38 Play from 1:25:05
• Ensures that applications can access the data by using a REST connection
• Hosts 20 independent tables of varying sizes and usage patterns
• Automatically replicates the data to a second Azure region
• Minimizes costs What should you recommend?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An elastic pool provisions and bills for compute continuously, which is a much larger cost than table storage for twenty simple tables.
Right, B is the answer.
Why B is right
Twenty independent tables of varying size and usage fit the Azure Table service, which is accessed over REST and is by far the cheapest of the options, since you pay only for the data stored and the transactions made rather than for provisioned database capacity. Geo-redundant storage replicates the account to a second region automatically, which satisfies the replication requirement.
Not this one. Try another answer.
Why C is wrong
Read-access geo-redundant storage also replicates to a second region but charges more for the read access to the secondary, which the requirements never asked for.
Not this one. Try another answer.
Why D is wrong
A single database with active geo-replication runs a second live database, so the cost is higher still.
Question 39 Play from 1:27:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The Pricing calculator estimates the cost of sizes you supply. It has no visibility of the existing machines and cannot recommend sizes.
Not this one. Try another answer.
Why B is wrong
Azure Advisor makes recommendations about resources already running in Azure, so it cannot assess an on-premises VMware environment.
Right, C is the answer.
Why C is right
Azure Migrate discovers the VMware estate, collects performance data from the running machines over time, and then produces an assessment that recommends a specific Azure virtual machine size for each one along with the projected cost. Because it measures actual utilisation rather than the configured size, it right-sizes the 300 machines automatically, which is what keeps administrative effort down.
Not this one. Try another answer.
Why D is wrong
Cost Management analyses spend on existing Azure resources rather than sizing a future migration.
Question 40 Play from 1:29:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Event Grid routes events to handlers, but it has no built-in Dataverse source and cannot write documents to Cosmos DB on its own, so code would still be required.
Not this one. Try another answer.
Why B is wrong
Azure App Service hosts web apps and APIs, which means writing and deploying custom code to watch Dataverse and update Cosmos DB.
Not this one. Try another answer.
Why C is wrong
Azure Functions would require writing code to receive Dataverse changes and call the Cosmos DB API, which is more development effort than using ready-made connectors.
Right, D is the answer.
Why D is right
Azure Logic Apps provides prebuilt connectors for both Microsoft Dataverse and Azure Cosmos DB. A workflow can start with the Dataverse trigger that fires when a row is added, modified or deleted, and then use the Azure Cosmos DB connector action to create or update the matching document in db1. Because the whole integration is assembled from managed connectors in a visual designer, there is no custom code to write, host or maintain, which minimizes development effort.
Question 41 Play from 1:31:47
• Maintain access to the app in the event of a regional outage.
• Support Azure Web Application Firewall (WAF).
• Support cookie-based affinity.
• Support URL routing. What should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Only Front Door does all four. It is a global service, so it keeps the app reachable when a region fails, its integrated Web Application Firewall satisfies the WAF requirement, and being a layer 7 reverse proxy it supports session affinity through cookies and routing rules based on the URL path.
Not this one. Try another answer.
Why B is wrong
Traffic Manager works at DNS level, so it cannot offer WAF, cookie-based affinity, or URL routing.
Not this one. Try another answer.
Why C is wrong
Application Gateway supports WAF, affinity, and URL routing but is regional, so it fails the regional outage requirement.
Not this one. Try another answer.
Why D is wrong
Azure Load Balancer is regional and operates at layer 4, so none of the HTTP-level requirements are met.
Question 42 Play from 1:33:46
• App1 is an interactive app that users access by using HTTPS connections.
• The number of connections to App1 changes significantly throughout the day.
• App1 runs multiple concurrent instances.
• App1 requires major changes to run in a container. You plan to migrate App1 to Azure. You need to recommend a compute solution for App1. The solution must meet the following requirements:
• The solution must run multiple instances of App1.
• The number of instances must be managed automatically depending on the load.
• Administrative effort must be minimized. What should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Batch runs finite compute jobs. It is not a host for an interactive web application.
Right, B is the answer.
Why B is right
App1 needs major changes to run in a container, which rules out the container platforms, and it is an interactive HTTPS application whose load varies through the day. Azure App Service runs Java applications natively on Linux, scales instances automatically against load rules, and is a managed platform with no operating system to patch, which is what minimises administrative effort.
Not this one. Try another answer.
Why C is wrong
AKS requires the app to be containerised, which the scenario says would take major changes.
Not this one. Try another answer.
Why D is wrong
A virtual machine scale set would run the app and autoscale, but you then own the operating system, patching, and the runtime, which is far more administration than App Service.
Question 43 Play from 1:36:15
• Runs the script once an hour to identify whether duplicate files exist
• Sends an email notification to the operations manager requesting approval to delete the duplicate files
• Processes an email response from the operations manager specifying whether the deletion was approved
• Runs the script if the deletion was approved What should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Event Grid routes events as they occur. It provides neither an hourly schedule nor an approval wait.
Right, B is the answer.
Why B is right
Azure Logic Apps supplies the parts that involve waiting and approval: a recurrence trigger fires hourly, an approval email action sends the request to the operations manager and then waits for the reply, and a condition branches on the answer. Azure Functions is where the existing PowerShell script runs, called by the logic app both to detect duplicates and to delete them once approved. Both are serverless.
Not this one. Try another answer.
Why C is wrong
Azure Pipelines is a CI/CD system and Service Fabric is a microservices platform. Neither is a serverless approval workflow.
Not this one. Try another answer.
Why D is wrong
Functions alone cannot wait days for an email reply, and Azure Batch is for large-scale compute jobs.
Question 44 Play from 1:38:48
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Event Hubs has no device identity registry or IoT Edge deployment management, so it cannot manage the IoT Edge runtimes.
Not this one. Try another answer.
Why B is wrong
The IoT Hub basic tier does not support Azure IoT Edge, so the edge runtimes could not be deployed or managed.
Right, C is the answer.
Why C is right
Azure IoT Edge devices are registered and managed through IoT Hub, which receives the MQTT telemetry they forward and routes it to services that process and analyze it in Azure. IoT Edge depends on module twins and deployment manifests, which are only available in the IoT Hub standard tier; the basic tier supports device-to-cloud telemetry but not IoT Edge, device twins, or cloud-to-device messaging. The standard tier is therefore the lowest-cost option that supports the planned IoT Edge runtimes.
Not this one. Try another answer.
Why D is wrong
Azure Event Hubs premium tier costs more and still provides no IoT Edge device management.
Question 45 Play from 1:41:00
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Dynamic data masking hides sensitive values in the result of a query for users who are not authorised to see them, while privileged users see the real data. The data itself is unchanged on disk, so this is the control that lets ordinary users work with the table while personally identifiable information stays hidden from them.
Not this one. Try another answer.
Why B is wrong
Role-based access control decides who can reach the database or the resource. It cannot show one user a masked column and another the real value.
Not this one. Try another answer.
Why C is wrong
Data Discovery and Classification finds and labels sensitive columns. It reports on where the data is rather than hiding it.
Not this one. Try another answer.
Why D is wrong
Transparent Data Encryption encrypts the data at rest. Any user who can query the database still sees the plaintext values.
Question 46 Play from 1:42:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Files provides an SMB or NFS file share, which costs more per gigabyte and is aimed at applications expecting a file system rather than internet delivery.
Not this one. Try another answer.
Why B is wrong
Data Lake Storage Gen2 adds a hierarchical namespace for analytics workloads. That is overhead this scenario has no use for.
Right, C is the answer.
Why C is right
Blob Storage is built for large unstructured objects, handles the 50 MB to 12 GB range comfortably as block blobs, serves them over HTTPS to internet users, and is the cheapest of these options per gigabyte with access tiers to tune cost further. That combination gives the fast reads and low storage cost the requirement asks for.
Not this one. Try another answer.
Why D is wrong
Azure SQL Database is a relational store. Holding multi-gigabyte video files in it would be both slow and far more expensive.
Question 47 Play from 1:45:09
• Supports estimates of request processing runtimes
• Supports event-driven autoscaling for the app Which hosting plan should you recommend?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The Dedicated plan can run long executions but scales on App Service rules rather than on the event source.
Not this one. Try another answer.
Why B is wrong
The Consumption plan caps a single execution at ten minutes, which is short of the estimated processing time.
Not this one. Try another answer.
Why C is wrong
An App Service plan has the same limitation as Dedicated: it does not autoscale in response to the event backlog.
Right, D is the answer.
Why D is right
Processing that can take up to 20 minutes exceeds the Consumption plan's default timeout, and the Premium plan removes that limit while keeping the event-driven scaling that the Event Hubs trigger relies on. It also avoids cold starts, so it satisfies both the long runtime and the autoscaling requirement.
Question 48 Play from 1:46:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An enterprise application represents a service instance in the directory. It still needs credentials configured and managed.
Right, B is the answer.
Why B is right
A system-assigned managed identity is enabled on the function app itself, and Azure creates and rotates the credential automatically. Granting that identity the Reader role on the subscription lets the function read the activity logs with no secret to store, no application registration to maintain, and no expiry to track, which is the minimum administrative effort.
Not this one. Try another answer.
Why C is wrong
Shared access signatures authorise access to storage resources. They do not authenticate a caller to the Azure management API.
Not this one. Try another answer.
Why D is wrong
An application registration requires a secret or certificate that has to be stored and rotated, which is exactly the overhead a managed identity removes.
Question 49 Play from 1:48:51
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
ExpressRoute by itself is a private circuit into Azure. It provides no central management of firewall rules and needs a separately built and maintained hub for transit routing.
Not this one. Try another answer.
Why B is wrong
Azure VPN Gateway connects sites to a single virtual network. Transit between datacenters and central route and firewall management would require manually building and maintaining a hub network.
Not this one. Try another answer.
Why C is wrong
Azure Front Door is a global HTTP and HTTPS entry point for web applications. It does not provide network connectivity between datacenters and Azure virtual networks.
Right, D is the answer.
Why D is right
Azure Virtual WAN provides Microsoft-managed virtual hubs that terminate site-to-site VPN and ExpressRoute connections from all five datacenters and connect Azure virtual networks, with any-to-any transit between them. Hubs in North America and Europe are interconnected automatically, so datacenters can reach Azure and each other, and Azure workloads can reach the datacenters. Routing is managed centrally through hub route tables, and deploying Azure Firewall in secured virtual hubs with Azure Firewall Manager centralizes firewall rules. Because Microsoft operates the hub infrastructure, there is far less to build and maintain than a self-managed hub and spoke design, which minimizes administrative effort.
Question 50 Play from 1:51:41
• Support server-side transactions across DB1 and DB2.
• Minimize administrative effort to update the solution. What should you recommend?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Databases in an elastic pool are still separate Azure SQL databases and cannot take part in a server-side transaction with each other.
Right, B is the answer.
Why B is right
Server-side transactions spanning two databases require both databases to live inside one instance. Azure SQL Managed Instance supports cross-database queries and distributed transactions between databases on the same instance, and because it is a managed service, patching, backups, and high availability are handled for you, which keeps the administrative effort down.
Not this one. Try another answer.
Why C is wrong
Two databases on one SQL Server instance on a virtual machine would support the transactions, but you then own the operating system, patching, and backups.
Not this one. Try another answer.
Why D is wrong
Databases on different logical servers are even further apart and cannot share a transaction.
Question 51 Play from 1:54:09
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Azure Data Factory is the managed data movement service. A pipeline with a copy activity reads the performance data from Blob Storage and writes it to the Azure SQL database, and a schedule or tumbling window trigger keeps it running continually as new data arrives from the devices.
Not this one. Try another answer.
Why B is wrong
Data Migration Assistant assesses databases before a one-time migration.
Not this one. Try another answer.
Why C is wrong
Azure Data Box is a physical appliance for shipping bulk data into Azure once.
Not this one. Try another answer.
Why D is wrong
Database Migration Service performs one-time or continuous migration between database engines, not a copy from blob storage into SQL.
Question 52 Play from 1:55:55
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Privileged Identity Management provides just-in-time activation for privileged directory roles, which has nothing to do with SSO to a business application.
Not this one. Try another answer.
Why B is wrong
Application Gateway is a layer 7 load balancer. It is not an identity provider and issues no SAML assertions.
Right, C is one of the answers.
Why C is right
Two things are needed. The internally developed application has to be represented in the directory before Azure AD can issue SAML assertions for it, which is what registering it as an Azure AD enterprise application does, and the SAML SSO settings are configured there. A Conditional Access policy then supplies the second requirement, using the locations condition to require multi-factor authentication whenever the sign-in comes from a location that is not trusted.
Not this one. Try another answer.
Why D is wrong
Identity Protection evaluates risk signals such as impossible travel or leaked credentials. Enforcing MFA by location is a Conditional Access condition, not an Identity Protection one.
Right, E is one of the answers.
Why E is right
Two things are needed. The internally developed application has to be represented in the directory before Azure AD can issue SAML assertions for it, which is what registering it as an Azure AD enterprise application does, and the SAML SSO settings are configured there. A Conditional Access policy then supplies the second requirement, using the locations condition to require multi-factor authentication whenever the sign-in comes from a location that is not trusted.
Question 53 Play from 1:58:24
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Events published by Azure services, including Azure Service Bus Premium namespaces, are exposed in Event Grid through system topics. To route events from Namespace1, you first create a system topic for the namespace as the event source, and then add an event subscription on that system topic that filters the Service Bus events and delivers them to the destination. Custom topics are used only for events published by your own applications, so the Service Bus events must enter Event Grid through a system topic before they can be routed.
Not this one. Try another answer.
Why B is wrong
Partner topics receive events from third-party SaaS providers integrated with Event Grid, not from Azure services such as Service Bus.
Not this one. Try another answer.
Why C is wrong
A message is not an Event Grid resource that you create to configure routing; events are generated by the source service.
Not this one. Try another answer.
Why D is wrong
An Event Grid domain manages large numbers of custom topics for application-published events and does not act as a source for Service Bus events.
Question 54 Play from 2:00:25
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Site Recovery replicates virtual machines for disaster recovery failover and does not provide a 99.99 percent availability SLA for running instances.
Right, B is the answer.
Why B is right
Microsoft offers a 99.99 percent virtual machine connectivity SLA when two or more instances are deployed across two or more availability zones in the same region. Each zone is a physically separate datacenter location with independent power, cooling, and networking, so the loss of an entire datacenter leaves the other instances of App1 running. Placing the App1 virtual machines in availability zones is therefore the high availability design that meets the required SLA.
Not this one. Try another answer.
Why C is wrong
Application groups are an Azure Virtual Desktop construct for publishing apps and desktops, not a virtual machine availability feature.
Not this one. Try another answer.
Why D is wrong
Availability sets spread VMs across fault and update domains within one datacenter and carry a 99.95 percent SLA, which is below the 99.99 percent requirement.
Question 55 Play from 2:02:39
• The solution must meet a Service Level Agreement (SLA) of 99.99% uptime.
• The compute resources allocated to the databases must scale dynamically.
• The solution must have reserved capacity. Compute charges must be minimized. What should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Twenty databases of 20 GB with varying usage patterns is the textbook case for an elastic pool: the databases share a pool of compute, so a quiet database releases capacity to a busy one and the total compute purchased is far less than provisioning each database separately. Azure SQL Database carries a 99.99 percent SLA, and reserved capacity can be purchased against the pool to minimise the compute charge.
Not this one. Try another answer.
Why B is wrong
SQL Server on a virtual machine in an availability set gives a 99.95 percent SLA, which falls short of the requirement, and compute does not scale dynamically across the databases.
Not this one. Try another answer.
Why C is wrong
A single virtual machine has an even lower SLA and no dynamic scaling between databases.
Not this one. Try another answer.
Why D is wrong
Twenty serverless databases each scale independently but cannot share capacity with each other, and serverless is not eligible for reserved capacity.
Question 56 Play from 2:05:21
• Automatically deploy new versions of the apps when changes to the apps' source code are committed in Azure Repos.
• Automatically stage a preview version of an app when a pull request is processed.
• Support Azure API Management by using the /api path.
• Minimize costs. What should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Blob Storage static websites only serve files; they provide no built-in pull request preview environments and no /api route integration with API Management.
Not this one. Try another answer.
Why B is wrong
App Service web apps run dedicated compute that is unnecessary for apps without server-side rendering, so hosting 100 apps this way does not minimize costs.
Not this one. Try another answer.
Why C is wrong
Azure Functions runs event-driven backend code and is not a hosting platform for a React front end with commit-based deployment and pull request previews.
Right, D is the answer.
Why D is right
Azure Static Web Apps is built for client-rendered frameworks such as React. It connects to a repository in Azure Repos through an Azure Pipelines task, so every commit triggers an automatic build and deployment, and it can stage a pre-production environment for a pull request (with Azure Repos, by configuring a named environment in the pipeline) so changes are reviewed before they reach production. Requests to the /api route can be served by a linked backend, including Azure API Management, without any extra proxy configuration. Because the static content is served from a globally distributed platform with a Free plan and a low-cost Standard plan, hosting 100 apps this way costs far less than running compute for each app.
Question 57 Play from 2:08:06
• App1 must be available to users if an Azure datacenter becomes unavailable.
• Costs must be minimized. What should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A web app cannot host a custom COM component that must be installed on the server.
Not this one. Try another answer.
Why B is wrong
Two regions would work but is more expensive than two zones, and the requirement only calls for surviving a datacenter failure.
Right, C is the answer.
Why C is right
The custom COM component has to be registered on the host, which rules out App Service and forces virtual machines. The requirement is only that the app survives a datacenter becoming unavailable, and an availability zone is a physically separate datacenter within a region. Spreading a scale set across two zones behind a load balancer therefore meets the availability requirement at a much lower cost than running a second region.
Not this one. Try another answer.
Why D is wrong
This again relies on web apps, which cannot host the COM component.
Question 58 Play from 2:10:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Data Lake Storage Gen2 has an availability SLA but makes no latency or throughput guarantee.
Not this one. Try another answer.
Why B is wrong
Blob Storage likewise carries an availability SLA only.
Not this one. Try another answer.
Why C is wrong
Azure SQL guarantees uptime but does not commit to a write latency figure or a throughput level.
Right, D is the answer.
Why D is right
Azure Cosmos DB is the only Azure data service whose SLA covers latency and throughput as well as availability. It guarantees single-digit millisecond latency at the 99th percentile for reads and writes and guarantees the provisioned throughput, which is what a mission critical application with a write latency commitment needs.
Question 59 Play from 2:12:24
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Header-based SSO requires the app to trust an HTTP header for identity, which is a change to how it authenticates.
Not this one. Try another answer.
Why B is wrong
SAML requires the application to act as a service provider and consume assertions, which an app with no identity provider support cannot do.
Right, C is the answer.
Why C is right
The application manages its own credential store and supports no identity provider, so it cannot be changed to accept a federated token. Password-based SSO is the method for exactly that case: Azure AD stores the credentials for each user and replays them into the app's own sign-in form, so users get single sign-on without the application being modified.
Not this one. Try another answer.
Why D is wrong
OpenID Connect likewise requires the application to implement a federation protocol.
Question 60 Play from 2:14:24
• Provide the ability to recover in the event of a regional outage.
• Support a recovery time objective (RTO) of 15 minutes.
• Support a recovery point objective (RPO) of 24 hours.
• Support automated recovery.
• Minimize costs. What should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An availability set protects against failures inside a single datacenter. It offers nothing when the whole region is lost.
Not this one. Try another answer.
Why B is wrong
Azure Disk Backup takes disk snapshots. Restoring from them is a manual rebuild, so neither the RTO nor the automation requirement is met.
Not this one. Try another answer.
Why C is wrong
An Always On availability group across regions would meet the objectives but requires a second running SQL environment plus cluster configuration, which costs more and adds administration the batch workload does not justify.
Right, D is the answer.
Why D is right
Site Recovery replicates the whole virtual machine to a second region and can fail it over with an automated recovery plan, which covers the regional outage, the automation requirement, and an RTO well inside 15 minutes. Because the databases are only written nightly, the generous 24 hour RPO is easily met, and replication is far cheaper than running a second live SQL environment.
Question 61 Play from 2:16:42
• Minimizes costs Minimizes failover time if a single server fails What should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A virtual network name listener needs an internal load balancer in front of it, which adds cost and slows failover compared with a DNN.
Not this one. Try another answer.
Why B is wrong
A failover cluster instance depends on shared storage, and a standard file share cannot deliver the performance a SQL Server workload needs.
Right, C is the answer.
Why C is right
An availability group keeps a synchronous secondary with its own copy of the data on locally attached premium disks, so failover is fast and no shared storage is needed. Using a distributed network name rather than a virtual network name removes the Azure Load Balancer that a VNN listener requires, which cuts both the cost and the failover time, since clients connect straight to the replica rather than waiting for a load balancer probe to move the endpoint.
Not this one. Try another answer.
Why D is wrong
A failover cluster instance on a premium file share still fails over by remounting shared storage on the other node, which takes longer than an availability group failover.
Question 62 Play from 2:19:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Container Apps requires packaging and running the notification logic as a container, which adds more overhead than a single function for a simple event-triggered task.
Right, B is the answer.
Why B is right
Azure Functions runs code in response to events, so an HTTP-triggered function can act as the Azure endpoint that receives order creation and deletion requests from the other app and immediately start the email workflow. On the Consumption plan you pay only for executions and resources used, and the platform scales automatically, so there is no idle compute to pay for between orders. This serverless, event-driven model meets the requirement to trigger notifications immediately while minimizing costs.
Not this one. Try another answer.
Why C is wrong
Azure Kubernetes Service requires a continuously running cluster of nodes, which is far more expensive and complex than needed to send email notifications.
Not this one. Try another answer.
Why D is wrong
Azure WebJobs run inside an App Service plan that is billed whether or not orders arrive, so they cost more than a consumption-based function.
Question 63 Play from 2:21:53
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Synapse Link exposes the Cosmos DB analytical store to the workspace, and an Apache Spark pool is the runtime engine that can read it directly, process the records in near real time, and write the results into a dedicated SQL pool acting as the data warehouse. Because Spark reads the analytical store in place, the data is not copied out first, which is what minimises data movement.
Not this one. Try another answer.
Why B is wrong
Serverless SQL can query the analytical store but it is a query service over data in place and is not the runtime engine for writing results into a data warehouse.
Not this one. Try another answer.
Why C is wrong
A dedicated SQL pool is the data warehouse that receives the output. It is the destination rather than the engine that processes the Cosmos DB data.
Not this one. Try another answer.
Why D is wrong
A Data Explorer pool is for log and telemetry analytics and does not read the Cosmos DB analytical store through Synapse Link.
Question 64 Play from 2:24:09
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Geo-replication creates readable secondaries for disaster recovery and does not raise the maximum database size.
Right, B is the answer.
Why B is right
Each database must grow to 15 TB, which exceeds the maximum size of the General Purpose and Business Critical service tiers (4 TB) and of the DTU-based tiers. The Hyperscale service tier uses a distributed architecture in which compute is separated from page servers that hold the data, so a single database can grow up to 128 TB. Moving each database out of the pool and converting it to Hyperscale is an online operation: the database remains available during the data copy and only a brief disconnection occurs at the final cutover, which keeps downtime to a minimum.
Not this one. Try another answer.
Why C is wrong
The Premium tier caps database size well below 15 TB, so the databases still could not grow to the required size.
Not this one. Try another answer.
Why D is wrong
Business Critical databases are limited to 4 TB, which is far below the 15 TB requirement.
Question 65 Play from 2:26:35
• Minimize the time it takes to provision compute resources during scale-out operations.
• Support autoscaling of Linux containers.
• Minimize administrative effort. Which scaling option should you recommend?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The horizontal pod autoscaler scales replicas within existing capacity and cannot add compute.
Not this one. Try another answer.
Why B is wrong
The cluster autoscaler works but has to provision a whole virtual machine and join it to the cluster, which is minutes rather than seconds.
Right, C is the answer.
Why C is right
Virtual nodes schedule pods onto Azure Container Instances instead of onto cluster virtual machines, so a pod starts in seconds with no node to provision. That is the fastest scale-out available, it supports Linux containers, and because there is no node pool to size or patch for that capacity, it is also the lowest administrative effort.
Not this one. Try another answer.
Why D is wrong
Virtual Kubelet is the underlying open source project. In AKS the supported, managed form of it is the virtual nodes feature.
Question 66 Play from 2:28:36
• Ingress access to the microservices must be restricted to a single private IP address and protected by using mutual TLS authentication.
• The number of incoming microservice calls must be rate-limited.
• Costs must be minimized. What should you include in the solution?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Application Gateway with WAF can do mutual TLS but has no built-in per-consumer rate limiting for API calls.
Not this one. Try another answer.
Why B is wrong
A service endpoint keeps traffic on the Azure backbone but does not give the gateway a private IP inside the virtual network, so the ingress would still be public.
Not this one. Try another answer.
Why C is wrong
Front Door is a global public entry point, which is the opposite of restricting ingress to a single private address.
Right, D is the answer.
Why D is right
Only the Premium tier of API Management supports full virtual network injection, which places the gateway inside the virtual network with a single private IP address and no public exposure. API Management also terminates mutual TLS by validating client certificates, and its rate-limit policies cap the number of incoming calls, so all three functional requirements are met by one service.
Question 67 Play from 2:31:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Monitor provides metrics, logs, and alerting for resource telemetry, but planned maintenance events are surfaced through Service Health rather than through general Azure Monitor configuration.
Not this one. Try another answer.
Why B is wrong
Defender for Cloud assesses security posture and detects threats; it does not announce planned platform maintenance.
Not this one. Try another answer.
Why C is wrong
Azure Advisor gives best-practice recommendations for cost, reliability, security, and performance, not notifications of upcoming regional maintenance.
Right, D is the answer.
Why D is right
Azure Service Health gives a personalized view of service issues, planned maintenance, and health advisories that affect the resources and regions you actually use. You can create Service Health alerts for the planned maintenance event type, scoped to the relevant subscriptions, regions, and services, and route them through action groups to email, SMS, push notifications, or webhooks. Because Service Health already filters events to your own resources and alerts are configured once per subscription with no custom queries or code, it meets the requirement with the least administrative effort.
Question 68 Play from 2:33:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An integration account stores B2B artifacts such as trading partners and schemas for Logic Apps. It is not a data transfer mechanism.
Right, B is one of the answers.
Why B is right
Both options move bulk file data from an on-premises server into a blob container as a complete solution. An Azure Import/Export job ships the data physically on disks and Microsoft loads it into the account, and Azure Data Factory copies it over the network using a self-hosted integration runtime installed on the on-premises network. Either one gets the 500 GB into store1.
Right, C is one of the answers.
Why C is right
Both options move bulk file data from an on-premises server into a blob container as a complete solution. An Azure Import/Export job ships the data physically on disks and Microsoft loads it into the account, and Azure Data Factory copies it over the network using a self-hosted integration runtime installed on the on-premises network. Either one gets the 500 GB into store1.
Not this one. Try another answer.
Why D is wrong
An on-premises data gateway lets Azure services query on-premises sources for reporting. It does not copy files into a storage account.
Not this one. Try another answer.
Why E is wrong
Azure Batch runs large-scale compute jobs. It is not a data movement service.
Question 69 Play from 2:35:29
• The executed code must be able to access the private IP address of a Microsoft SQL Server instance that runs on an Azure virtual machine.
• Costs must be minimized. What should you include in the solution?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Logic Apps in the Consumption plan cannot run custom C# code and has no virtual network integration.
Right, B is the answer.
Why B is right
Reaching a private IP address inside a virtual network requires virtual network integration, which the Consumption plan for Functions does not provide. The Premium plan does, while keeping the serverless programming model and event-driven scale, so it can run the C# handler for the Event Grid event and connect privately to the SQL Server instance. Among the options that can reach the private address, it is the cheapest.
Not this one. Try another answer.
Why C is wrong
The Consumption plan for Functions runs the code but cannot join a virtual network, so the private IP is unreachable.
Not this one. Try another answer.
Why D is wrong
An integration service environment gives Logic Apps virtual network access but is markedly more expensive and still does not execute custom C#.
Question 70 Play from 2:37:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Windows Server Backup with a Recovery Services vault protects the data but recovery is a restore operation, so users cannot simply carry on working.
Not this one. Try another answer.
Why B is wrong
Azure File Sync synchronises with an Azure file share, not with blob containers, so this pairing does not work.
Not this one. Try another answer.
Why C is wrong
Azure Backup again provides recovery of data rather than continuous availability of the shares.
Right, D is the answer.
Why D is right
An Azure file share holds the authoritative copy of the data in the cloud, and Azure File Sync keeps servers in the branch offices synchronised with it. If the Toronto office becomes unreachable the file share and the other synced endpoints still hold the data, so users continue to work, and because each office has a local cache they get fast access rather than pulling everything across the network.
Question 71 Play from 2:40:01
• Support parameters.
• Support versioning and source control. Which two options can you use? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Policy evaluates and enforces rules on resources; it is a governance tool, not a parameterized, version-controlled deployment mechanism for the resources themselves.
Not this one. Try another answer.
Why B is wrong
Azure Automation runs runbooks for operational tasks; it is not a declarative deployment format designed for versioned resource definitions.
Right, C is one of the answers.
Why C is right
ARM templates and Bicep files are declarative infrastructure-as-code definitions for Azure resources. Both support parameters, so the same definition can be deployed to different subscriptions with environment-specific values, and both are plain text files that can be stored in a Git repository for versioning, pull request review, and source control. They can be deployed at subscription and management group scope and integrated into Azure Pipelines or GitHub Actions to automate deployments across a landing zone. Bicep compiles to an ARM template, so either option is a complete solution.
Right, D is one of the answers.
Why D is right
ARM templates and Bicep files are declarative infrastructure-as-code definitions for Azure resources. Both support parameters, so the same definition can be deployed to different subscriptions with environment-specific values, and both are plain text files that can be stored in a Git repository for versioning, pull request review, and source control. They can be deployed at subscription and management group scope and integrated into Azure Pipelines or GitHub Actions to automate deployments across a landing zone. Bicep compiles to an ARM template, so either option is a complete solution.
Not this one. Try another answer.
Why E is wrong
Azure Functions runs event-driven application code and is not a resource deployment technology.
Question 72 Play from 2:42:23
• Ensure that the virtual machines can authenticate to Azure Active Directory (Azure AD) to gain access to an Azure key vault, Azure Logic Apps instances, and an Azure SQL database.
• Avoid assigning new roles and permissions for Azure services when you deploy additional virtual machines.
• Avoid storing secrets and certificates on the virtual machines.
• Minimize administrative effort for managing identities. Which type of identity should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A system-assigned identity is tied to one virtual machine and dies with it, so every additional machine would need its own set of role assignments.
Not this one. Try another answer.
Why B is wrong
A service principal using a certificate means placing and rotating a certificate on each machine, which the requirements forbid.
Not this one. Try another answer.
Why C is wrong
A service principal using a client secret likewise requires storing a secret on the machines and managing its expiry.
Right, D is the answer.
Why D is right
A user-assigned managed identity is created once as its own resource, granted the required access to the key vault, the logic apps, and the SQL database once, and then attached to each virtual machine that runs App1. Adding a machine later means attaching the existing identity, with no new role assignments to make. Azure manages the credential, so nothing is stored on the machines.
Question 73 Play from 2:44:54
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Azure Data Lake Storage Gen2 adds a hierarchical namespace to Blob Storage and exposes an ABFS driver that is compatible with the Hadoop Distributed File System, so Hadoop and Spark workloads read and write it as though it were HDFS. That is exactly the compatibility the migration requires.
Not this one. Try another answer.
Why B is wrong
Azure NetApp Files serves NFS and SMB shares. It is not an HDFS-compatible store.
Not this one. Try another answer.
Why C is wrong
Azure Data Share is a service for sharing data with external organisations, not a storage platform.
Not this one. Try another answer.
Why D is wrong
Table storage is a key-value store with no file system semantics at all.
Question 74 Play from 2:46:39
• Make configuration recommendations for the Azure virtual machines.
• Ensure access to the on-premises VMware environment.
• Estimate Azure workload costs.
• Minimize administrative effort. What should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The MAP Toolkit is a legacy, locally installed inventory tool. It does not perform the migration and does not provide the integrated Azure sizing, cost estimation, and migration workflow that Azure Migrate offers.
Not this one. Try another answer.
Why B is wrong
VM insights monitors the performance and dependencies of virtual machines. It does not assess VMware virtual machines for Azure, estimate migration costs, or migrate them.
Not this one. Try another answer.
Why C is wrong
Azure VMware Solution runs VMware environments natively in Azure rather than converting the workloads to Azure virtual machines, so it does not provide Azure virtual machine configuration recommendations.
Right, D is the answer.
Why D is right
Azure Migrate is the central hub for discovering, assessing, and migrating on-premises servers to Azure. For VMware, you deploy the Azure Migrate appliance in the vCenter environment, which connects to vCenter Server to discover virtual machines agentlessly and collect configuration and performance data. The assessment uses that data to recommend Azure virtual machine sizes and disk types and to estimate monthly compute and storage costs. The same project can then perform agentless migration of the VMware virtual machines to Azure. Because discovery, assessment, cost estimation, and migration run from one integrated service without installing agents on each server, it minimizes administrative effort.
Question 75 Play from 2:49:28
• Store the data for multiple users.
• Encrypt each user's data by using a separate key.
• Encrypt all the data in the storage account by using customer-managed keys. What should you deploy?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Encryption scopes are not available for file shares, so a premium file share account cannot give each user a separate key.
Right, B is the answer.
Why B is right
Encryption scopes are a blob feature. They let a single storage account hold data encrypted under different keys, so each user's data can be assigned its own scope backed by its own customer-managed key, while the account default also uses a customer-managed key. A general purpose v2 account with blobs supports encryption scopes and therefore meets all three requirements.
Not this one. Try another answer.
Why C is wrong
Data Lake Storage Gen2 adds a hierarchical namespace for analytics workloads. It does not provide the per-user key separation asked for here.
Not this one. Try another answer.
Why D is wrong
Files in a general purpose v2 account have the same limitation as option A: no encryption scopes, so no separate key per user.
Question 76 Play from 2:51:38
• Support using synthetic transaction monitoring to monitor traffic between the App1 components.
• Minimize development effort. What should you include in the solution?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Network insights visualises network resources and their health. It does not run synthetic transactions.
Right, B is the answer.
Why B is right
Synthetic transaction monitoring is delivered by Application Insights availability tests, which issue requests on a schedule from selected locations and record the result. A standard or custom test can walk the path between App1's components without the application code being instrumented for it, which keeps development effort down.
Not this one. Try another answer.
Why C is wrong
Container insights collects performance and log data from container workloads. It observes what happens rather than generating traffic.
Not this one. Try another answer.
Why D is wrong
Log Analytics Workspace insights reports on the health and usage of the workspace itself.
Question 77 Play from 2:53:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Conditional Access policies control the conditions under which users can sign in to App1, but they provide no periodic report or review of which users have been granted access.
Not this one. Try another answer.
Why B is wrong
Privileged Identity Management manages just-in-time activation of privileged roles; it is not designed to review ordinary user assignments to a third-party app.
Right, C is the answer.
Why C is right
Access reviews in Microsoft Entra ID let you schedule recurring reviews of who has access to an enterprise application, such as a monthly review of the users assigned to App1. The App1 owners can be set as the reviewers, so they can see every user with access and deny access for users who no longer need it, without being granted any administrative role in the tenant. Because the reviews recur automatically and can apply results automatically, the solution follows the principle of least privilege and minimizes administrative effort while directly addressing the per-user licensing costs.
Not this one. Try another answer.
Why D is wrong
Managed identities give Azure resources an identity to authenticate to other services and have nothing to do with tracking which users can access App1.
Question 78 Play from 2:56:04
• Use the same scaling mechanism as the current deployment.
• Support kubenet and Azure Container Networking Interface (CNI) networking. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct answer is worth one point.
Tap an answer. The reason for that answer shows here.
Right, A is one of the answers.
Why A is right
The function scales today on the depth of a storage queue, and Kubernetes-based Event Driven Autoscaling is what reproduces that on AKS: KEDA watches the queue and drives the replica count from the backlog. It does that by managing a horizontal pod autoscaler, which is why the autoscaler has to be configured as well. Neither depends on the networking model, so kubenet and Azure CNI both work.
Not this one. Try another answer.
Why B is wrong
Virtual Kubelet schedules pods onto Azure Container Instances. It is a placement mechanism rather than the queue-driven scaling trigger.
Not this one. Try another answer.
Why C is wrong
The cluster autoscaler adds nodes when pods cannot be scheduled. It reacts to pending pods, not to queue length.
Not this one. Try another answer.
Why D is wrong
The virtual node add-on is not supported with kubenet networking, so it fails the second requirement.
Right, E is one of the answers.
Why E is right
The function scales today on the depth of a storage queue, and Kubernetes-based Event Driven Autoscaling is what reproduces that on AKS: KEDA watches the queue and drives the replica count from the backlog. It does that by managing a horizontal pod autoscaler, which is why the autoscaler has to be configured as well. Neither depends on the networking model, so kubenet and Azure CNI both work.
Question 79 Play from 2:58:35
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Container soft delete restores a deleted container. It does nothing when a blob inside a live container is overwritten.
Not this one. Try another answer.
Why B is wrong
Snapshots would work but each one has to be created explicitly by the application, so the solution stops being automatic.
Not this one. Try another answer.
Why C is wrong
Blob soft delete recovers a deleted or overwritten blob for a retention period, but it is aimed at accidental deletion recovery rather than keeping an addressable version of each day's file.
Right, D is the answer.
Why D is right
Blob versioning automatically preserves a version of the blob every time it is overwritten, so each hourly upload keeps the one it replaced and any previous state can be restored. Combined with a lifecycle rule that deletes versions older than 30 days, it meets the retention window while storing only the changed blocks, which is what keeps the space use down.
Question 80 Play from 3:00:46
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Azure Data Factory connects to SQL Server, MySQL, and Oracle through a self-hosted integration runtime installed on the on-premises network, and copies from all 12 sources into Data Lake Storage on a schedule. Mapping data flows handle the transform step, and because it is a managed service with built-in connectors and triggers, the administrative effort is far lower than building the movement by hand.
Not this one. Try another answer.
Why B is wrong
Azure Data Explorer is an analytics engine for telemetry. It is a query destination rather than an ETL orchestrator.
Not this one. Try another answer.
Why C is wrong
Azure Data Share publishes datasets to other organisations. It does not extract from on-premises databases.
Not this one. Try another answer.
Why D is wrong
Azure Data Studio is a desktop client for querying and managing databases.
Question 81 Play from 3:02:54
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Data Factory orchestrates batch data movement and transformation pipelines; it does not analyze streaming telemetry in real time.
Not this one. Try another answer.
Why B is wrong
Data Lake Analytics ran batch U-SQL jobs over stored data, so it cannot deliver real-time insights, and the service has been retired.
Not this one. Try another answer.
Why C is wrong
Log Analytics queries collected log data after ingestion; it is not a stream processing engine for real-time IoT telemetry.
Right, D is the answer.
Why D is right
Azure Stream Analytics is a fully managed, real-time stream processing engine that reads continuous data from inputs such as Azure IoT Hub and Azure Event Hubs. Processing logic is written in a SQL-like query language with built-in windowing and aggregation functions, so insights such as rolling averages or anomaly detection need no custom code. Results can be sent directly to outputs such as Power BI dashboards, databases, or alerts with low latency. Because no infrastructure must be managed and queries replace application code, it provides real-time insights from the telemetry with minimal development effort.
Question 82 Play from 3:05:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SQL Server Migration Assistant converts schemas and data from other database engines during a one-time migration.
Not this one. Try another answer.
Why B is wrong
Data Migration Assistant assesses a SQL Server estate for migration blockers. It is an assessment tool, not a recurring pipeline.
Not this one. Try another answer.
Why C is wrong
AzCopy copies data to and from storage from the command line, and it has no scheduler and no path into a SQL database.
Right, D is the answer.
Why D is right
Azure Data Factory is the managed service for scheduled data movement. A pipeline with a copy activity reads the access logs from Blob Storage and writes them into Azure SQL Database, and a monthly trigger runs it automatically, which is exactly the automated process the requirement describes.
Question 83 Play from 3:06:52
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Azure Automation runs runbooks for operational tasks. Building HPC cluster management on it would be a custom project.
Right, B is the answer.
Why B is right
Azure CycleCloud is the service for provisioning and managing HPC clusters in Azure, and its distinguishing feature is that it supports third-party schedulers such as Slurm, PBS Pro, LSF, and Grid Engine. It creates the cluster, autoscales the node count against the scheduler's queue, and manages the node lifecycle, which is exactly what is being asked for.
Not this one. Try another answer.
Why C is wrong
Azure Purview, now Microsoft Purview, is a data governance and cataloguing service.
Not this one. Try another answer.
Why D is wrong
Azure Lighthouse lets a service provider manage a customer's tenant. It provisions no compute.
Question 84 Play from 3:08:37
• Provides dedicated throughput and the fastest possible read and write times for the data.
• Minimizes storage costs. What should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Azure Cosmos DB for Table is compatible with the Azure Table storage REST API and SDKs, so App1 can use the same code while gaining Cosmos DB capabilities. Cosmos DB provides dedicated throughput through provisioned request units and offers single-digit millisecond latency for reads and writes backed by SLAs, which standard Table storage does not guarantee. Because App1 stores structured and unstructured data as flexible entities, Cosmos DB for Table also indexes all properties automatically for fast queries. To keep throughput costs low, the account can use autoscale throughput, which scales provisioned request units down to 10 percent of the maximum when demand is low, so you avoid paying for peak capacity while idle. Among the options, it is the only one that meets the throughput and latency requirements through the Table API.
Not this one. Try another answer.
Why B is wrong
Table storage in a standard storage account uses shared, multi-tenant throughput with no dedicated capacity or latency guarantees, so it does not provide the fastest possible read and write times.
Not this one. Try another answer.
Why C is wrong
Premium storage accounts are available for block blobs, page blobs, and file shares, not for Table storage, so they cannot host data accessed through the Table storage REST API.
Not this one. Try another answer.
Why D is wrong
Azure Cache for Redis is an in-memory cache with its own protocol, not a persistent store that supports the Table storage REST API, and holding all data in memory raises costs.
Question 85 Play from 3:11:29
• The storage must support 1 PB of data.
• The data must be stored in blob storage.
• The storage must support three levels of subfolders.
• The storage must support access control lists (ACLs). What should you include in the recommendation?
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A premium block blob account is fast but without the hierarchical namespace it has only a flat namespace and no ACLs.
Right, B is the answer.
Why B is right
Enabling the hierarchical namespace on a general purpose v2 account turns it into Azure Data Lake Storage Gen2. That gives real directories, so subfolders nest to any depth, and POSIX-style access control lists on files and directories, while the data still lives in blob storage and scales well beyond a petabyte.
Not this one. Try another answer.
Why C is wrong
Page blobs back virtual machine disks and are not the right storage for this at all.
Not this one. Try another answer.
Why D is wrong
A file share is not blob storage, which the requirement explicitly calls for.
Transcript
Play from 00:00 Question 1. You are designing an app that will include two components. The components will communicate by sending messages via a queue. You need to recommend a solution to process the messages by using a First in, First out (FIFO) pattern. What should you include in the recommendation? Here are the options. Option A. storage queues with a custom metadata setting. Option B. Azure Service Bus queues with partitioning enabled. Option C. Azure Service Bus queues with sessions enabled. Option D. storage queues with a stored access policy. Pause the video now if you want time to think about the answer.
The correct answer is C. Azure Service Bus queues with sessions enabled. First in, first out ordering in Service Bus is delivered by message sessions. Messages that share a session identifier are locked to a single receiver and handed over in the order they arrived, which is what guarantees the sequence. Without sessions a queue only makes a best effort at ordering once multiple receivers or redeliveries are involved. Now, why are the other options incorrect? Option A is incorrect. Storage queues do not guarantee ordering, and custom metadata does not change that. Option B is incorrect. Partitioning spreads a queue across multiple message brokers for throughput, which works against strict ordering rather than for it. Option D is incorrect. A stored access policy governs shared access signatures. It has no bearing on delivery order. Therefore, C, Azure Service Bus queues with sessions enabled, is the correct answer.
Play from 01:57 Question 2. You have an Azure subscription that contains an Azure DevOps pipeline and an Azure Repos repository. The pipeline performs the following actions: • Builds a custom container image by using a base image stored in a public Docker Hub repository. • Stores the custom container image in Azure Container Registry. • Deploys the custom container image to Azure Container Apps. The pipeline is triggered by commits to the Azure Repos repository. You need to ensure that when the base image in Docker Hub is updated, the custom image in Azure Container Registry is updated automatically. The solution must minimize administrative effort. What should you include in the solution? Here are the options. Option A. ACR Tasks. Option B. an Azure Automation runbook. Option C. an Azure function hosted in Container Apps. Option D. an Azure DevOps pipeline task. Pause the video now if you want time to think about the answer.
The correct answer is A. ACR Tasks. ACR Tasks can build container images in Azure Container Registry and automatically rebuild them when their base image is updated. When a task builds an image from a Dockerfile, it discovers the base image in the FROM statement and tracks it, and public repositories in Docker Hub are a supported base image location. When the Docker Hub base image is updated under a stable tag, the task detects the change and rebuilds the custom image, pushing the updated version to the registry. Because the base image trigger is enabled by default on tasks and requires no custom code or polling logic, this is the solution with the least administrative effort. Now, why are the other options incorrect? Option B is incorrect. An Azure Automation runbook would require custom scripting to poll Docker Hub for changes and trigger a rebuild, which adds development and administrative effort compared to the built-in base image trigger in ACR Tasks. Option C is incorrect. An Azure function hosted in Container Apps would need custom code to detect base image updates and start builds, which adds effort and duplicates functionality that ACR Tasks provides natively. Option D is incorrect. The existing pipeline is triggered only by commits to Azure Repos, and adding a pipeline task does not make it react to updates of a Docker Hub base image. Therefore, A, ACR Tasks, is the correct answer.
Play from 04:48 Question 3. You plan to deploy 10 applications to Azure. The applications will be deployed to two Azure Kubernetes Service (AKS) clusters. Each cluster will be deployed to a separate Azure region. The application deployment must meet the following requirements: • Ensure that the applications remain available if a single AKS cluster fails. • Ensure that the connection traffic over the internet is encrypted by using SSL without having to configure SSL on each container. Which service should you include in the recommendation? Here are the options. Option A. Azure Front Door. Option B. Azure Traffic Manager. Option C. AKS ingress controller. Option D. Azure Load Balancer. Pause the video now if you want time to think about the answer.
The correct answer is A. Azure Front Door. Azure Front Door is a global layer 7 entry point. It load balances across the two AKS clusters and takes an unhealthy region out of rotation, so the applications stay available if one cluster fails. It also terminates TLS at the edge, which means the SSL certificate is managed once at Front Door rather than configured on each container. Now, why are the other options incorrect? Option B is incorrect. Traffic Manager works at DNS level and cannot terminate TLS, so SSL would still have to be handled behind it. Option C is incorrect. An ingress controller lives inside a single cluster, so it cannot provide availability if that whole cluster fails. Option D is incorrect. Azure Load Balancer is a regional layer 4 service. It neither spans regions nor terminates TLS. Therefore, A, Azure Front Door, is the correct answer.
Show full transcriptShow less
Play from 06:56 Question 4. You are designing a microservices architecture that will support a web application. The solution must meet the following requirements: • Deploy the solution on-premises and to Azure. Support low-latency and hyperscale operations. • Allow independent upgrades to each microservice. • Set policies for performing automatic repairs to the microservices. You need to recommend a technology. What should you recommend? Here are the options. Option A. Azure Container Instance. Option B. Azure Logic App. Option C. Azure Service Fabric. Option D. Azure virtual machine scale set. Pause the video now if you want time to think about the answer.
The correct answer is C. Azure Service Fabric. Service Fabric is the platform that matches every requirement. Its runtime can be deployed on-premises as well as in Azure, so the same solution runs in both, it is built for low-latency hyperscale microservices, each service can be versioned and upgraded independently, and health policies drive automatic repair when a service becomes unhealthy. Now, why are the other options incorrect? Option A is incorrect. Container Instances runs individual containers with no orchestration, versioned upgrades, or health-based repair, and it is Azure only. Option B is incorrect. A Logic App is a workflow orchestration service, not a microservices runtime. Option D is incorrect. A scale set manages identical virtual machines. It has no notion of individual microservices or their independent upgrade. Therefore, C, Azure Service Fabric, is the correct answer.
Play from 09:00 Question 5. You have 100 Microsoft SQL Server Integration Services (SSIS) packages that are configured to use 10 on-premises SQL Server databases as their destinations. You plan to migrate the 10 on-premises databases to Azure SQL Database. You need to recommend a solution to create Azure-SQL Server Integration Services (SSIS) packages. The solution must ensure that the packages can target the SQL Database instances as their destinations. What should you include in the recommendation? Here are the options. Option A. Data Migration Assistant (DMA). Option B. Azure Data Factory. Option C. Azure Data Catalog. Option D. SQL Server Migration Assistant (SSMA). Pause the video now if you want time to think about the answer.
The correct answer is B. Azure Data Factory. Azure Data Factory can provision an Azure-SSIS integration runtime, a managed cluster that hosts and runs existing SSIS packages in Azure. The 100 packages are deployed to it and retargeted at the migrated Azure SQL databases, so the investment in them is preserved rather than rewritten. Now, why are the other options incorrect? Option A is incorrect. Data Migration Assistant assesses a SQL Server estate for migration blockers and does not run packages. Option C is incorrect. Azure Data Catalog registers and describes data assets. Option D is incorrect. SQL Server Migration Assistant converts schemas and data from other database engines to SQL Server. Therefore, B, Azure Data Factory, is the correct answer.
Play from 11:06 Question 6. You have an on-premises Microsoft SQL server named SQL1 that hosts 50 databases. You plan to migrate SQL1 to Azure SQL Managed Instance. You need to perform an offline migration of SQL1. The solution must minimize administrative effort. What should you include in the solution? Here are the options. Option A. Azure Migrate. Option B. Azure Database Migration Service. Option C. SQL Server Migration Assistant (SSMA). Option D. Data Migration Assistant (DMA). Pause the video now if you want time to think about the answer.
The correct answer is B. Azure Database Migration Service. Azure Database Migration Service is the managed service for moving SQL Server to Azure SQL Managed Instance, and it handles all 50 databases in a single migration project rather than one at a time. Running it in offline mode is exactly the supported scenario, and because the service orchestrates backup, copy, and restore itself, the administrative effort is far lower than scripting the work. Now, why are the other options incorrect? Option A is incorrect. Azure Migrate discovers and assesses servers. It does not perform the database migration. Option C is incorrect. SQL Server Migration Assistant converts from other database engines such as Oracle or MySQL to SQL Server. Option D is incorrect. Data Migration Assistant assesses compatibility and can move small workloads, but it is not designed to migrate 50 databases with minimal effort. Therefore, B, Azure Database Migration Service, is the correct answer.
Play from 13:08 Question 7. You have an Azure subscription that contains a storage account named storage1. You need to provide developers with the ability to read and write the data in storage1. The solution must meet the following requirements: • Limit the exposure of sensitive data. • Follow the principle of least privilege. What should you use? Here are the options. Option A. a role-based access control (RBAC) role. Option B. a certificate. Option C. a shared access signature (SAS). Option D. a storage account key. Pause the video now if you want time to think about the answer.
The correct answer is A. a role-based access control (RBAC) role. Azure RBAC lets you assign a built-in data role such as Storage Blob Data Contributor to the developers' Microsoft Entra identities, scoped as narrowly as a single container. Developers authenticate with their own identities, so no shared secret is distributed, access can be revoked centrally, and every operation is attributable to a specific user. Granting only read and write data permissions at the smallest required scope follows the principle of least privilege and limits the exposure of sensitive data. Microsoft recommends Microsoft Entra authorization with RBAC over key-based or token-based access for these reasons. Now, why are the other options incorrect? Option B is incorrect. A certificate is not an authorization mechanism for reading and writing data in a storage account. Option C is incorrect. A SAS is a bearer token: anyone who obtains it can use it until it expires, and it is not tied to a developer's identity, so it exposes more risk than RBAC. Option D is incorrect. A storage account key grants full access to all data and operations in the account, which violates least privilege and maximizes exposure. Therefore, A, a role-based access control (RBAC) role, is the correct answer.
Play from 15:33 Question 8. You have an Azure subscription. You plan to deploy 50 Azure App Service instances that will host code-based web apps. You need to recommend a solution to define the configuration of the instances and maintain a version history of the configurations. What should you include in the recommendation? Here are the options. Option A. ZIP packages in Azure Repos. Option B. images in an Azure container registry. Option C. Bicep files in Azure Repos. Option D. images in Azure Compute Gallery. Pause the video now if you want time to think about the answer.
The correct answer is C. Bicep files in Azure Repos. Bicep is a declarative infrastructure-as-code language for Azure Resource Manager. A Bicep file describes the desired configuration of resources such as App Service plans and web apps, including settings, app settings, and scaling options, and can be deployed repeatedly to create all 50 instances consistently. Storing the Bicep files in Azure Repos, a Git-based version control system, records every change as a commit, which provides a full version history of the configurations and lets you review, compare, and roll back changes. Pipelines can then deploy the files whenever they change, keeping the instances aligned with the defined configuration. Now, why are the other options incorrect? Option A is incorrect. ZIP packages contain application code for deployment, not the configuration of the App Service instances, so they do not define the instance settings. Option B is incorrect. Container images in Azure Container Registry are used for container-based apps, and the web apps are code-based. Images also package the application, not the App Service configuration. Option D is incorrect. Azure Compute Gallery stores virtual machine images and VM applications, which do not apply to App Service instances. Therefore, C, Bicep files in Azure Repos, is the correct answer.
Play from 17:57 Question 9. You have an Azure subscription that contains an Azure SQL database named DB1. You need to recommend a long-term retention (LTR) backup solution for DB1. The solution must ensure that backups can be retained for up to seven years. Which backup periods can you include in the solution? Here are the options. Option A. weekly only. Option B. monthly only. Option C. yearly only. Option D. weekly and monthly only. Option E. monthly and yearly only. Option F. weekly, monthly, and yearly. Pause the video now if you want time to think about the answer.
The correct answer is F. weekly, monthly, and yearly. Long-term retention for Azure SQL Database copies full backups into separate Azure Blob storage containers and keeps them for up to 10 years. An LTR policy is a combination of weekly retention (W), monthly retention (M), and yearly retention (Y), plus the week of the year used for the yearly backup. Any of the three periods can be set alone or together, and each can be configured to retain backups for as long as the policy allows. A policy that keeps weekly, monthly, and yearly backups therefore satisfies the requirement to retain backups for up to seven years, and all three periods can be included in the solution. Now, why are the other options incorrect? Option A is incorrect. Weekly backups are only one of the available periods; monthly and yearly retention can also be included in the policy. Option B is incorrect. Monthly retention is only one of the available periods; weekly and yearly retention can also be included. Option C is incorrect. Yearly retention is only one of the available periods; weekly and monthly retention can also be included. Option D is incorrect. This omits yearly retention, which is also a supported LTR period and the natural choice for multi-year retention. Option E is incorrect. This omits weekly retention, which is also a supported LTR period. Therefore, F, weekly, monthly, and yearly, is the correct answer.
Play from 20:25 Question 10. You have an Azure virtual machine named VM1 that runs Windows Server 2019 and contains 500 GB of data files. You are designing a solution that will use Azure Data Factory to transform the data files, and then load the files to Azure Data Lake Storage. What should you deploy on VM1 to support the design? Here are the options. Option A. the On-premises data gateway. Option B. the Azure Pipelines agent. Option C. the self-hosted integration runtime. Option D. the Azure File Sync agent. Pause the video now if you want time to think about the answer.
The correct answer is C. the self-hosted integration runtime. Azure Data Factory reaches data that is not publicly accessible through a self-hosted integration runtime installed on a machine that can see it. Deploying it on VM1 lets the factory read the 500 GB of local files, run the transformation, and write the result to Data Lake Storage. Now, why are the other options incorrect? Option A is incorrect. The on-premises data gateway serves Power BI, Power Apps, and Logic Apps. Data Factory uses its own integration runtime. Option B is incorrect. The Azure Pipelines agent runs CI/CD jobs and has no role in a data pipeline. Option D is incorrect. The Azure File Sync agent synchronises a Windows file server with an Azure file share. Therefore, C, the self-hosted integration runtime, is the correct answer.
Play from 22:22 Question 11. You have an app named App1 that uses an on-premises Microsoft SQL Server database named DB1. You plan to migrate DB1 to an Azure SQL managed instance. You need to enable customer managed Transparent Data Encryption (TDE) for the instance. The solution must maximize encryption strength. Which type of encryption algorithm and key length should you use for the TDE protector? Here are the options. Option A. RSA 3072. Option B. AES 256. Option C. RSA 4096. Option D. RSA 2048. Pause the video now if you want time to think about the answer.
The correct answer is A. RSA 3072. The TDE protector for a managed instance is an asymmetric key held in Azure Key Vault, and SQL supports RSA keys of 2048 or 3072 bits for this purpose. RSA 3072 is the strongest of the supported lengths, so it is the right choice when the requirement is to maximise encryption strength. Now, why are the other options incorrect? Option B is incorrect. AES 256 is the symmetric algorithm used for the database encryption key itself. The protector that wraps it is asymmetric, so AES is not an option here. Option C is incorrect. RSA 4096 is not a supported key length for the TDE protector, so it cannot be used however strong it sounds. Option D is incorrect. RSA 2048 is supported but is the weaker of the two available lengths. Therefore, A, RSA 3072, is the correct answer.
Play from 24:31 Question 12. You have 100 servers that run Windows Server 2012 R2 and host Microsoft SQL Server 2014 instances. The instances host databases that have the following characteristics: • Stored procedures are implemented by using CLR. • The largest database is currently 3 TB. None of the databases will ever exceed 4 TB. You plan to move all the data from SQL Server to Azure. You need to recommend a service to host the databases. The solution must meet the following requirements: • Whenever possible, minimize management overhead for the migrated databases. • Ensure that users can authenticate by using Azure Active Directory (Azure AD) credentials. • Minimize the number of database changes required to facilitate the migration. What should you include in the recommendation? Here are the options. Option A. Azure SQL Database elastic pools. Option B. Azure SQL Managed Instance. Option C. Azure SQL Database single databases. Option D. SQL Server 2016 on Azure virtual machines. Pause the video now if you want time to think about the answer.
The correct answer is B. Azure SQL Managed Instance. The databases use CLR stored procedures, which Azure SQL Database does not support, so a platform with near full SQL Server surface area is required. Azure SQL Managed Instance provides CLR integration, keeps the migration close to a lift and shift with minimal database changes, supports Azure AD authentication, and is still a managed service, so it beats running SQL Server on a virtual machine on management overhead. The 3 TB size sits inside its limits. Now, why are the other options incorrect? Option A is incorrect. Elastic pools are built on Azure SQL Database, which does not support CLR stored procedures. Option C is incorrect. Single databases have the same CLR limitation and would force changes to the databases. Option D is incorrect. SQL Server on a virtual machine would run the workload, but patching, backups, and high availability all become the customer's responsibility, which is the opposite of minimising management overhead. Therefore, B, Azure SQL Managed Instance, is the correct answer.
Play from 27:16 Question 13. You plan to deploy an application named App1 that will run in containers on Azure Kubernetes Service (AKS) clusters. The AKS clusters will be distributed across four Azure regions. You need to recommend a storage solution to ensure that updated container images are replicated automatically to all the Azure regions hosting the AKS clusters. Which storage solution should you recommend? Here are the options. Option A. geo-redundant storage (GRS) accounts. Option B. Premium SKU Azure Container Registry. Option C. Azure Content Delivery Network (CDN). Option D. Azure Cache for Redis. Pause the video now if you want time to think about the answer.
The correct answer is B. Premium SKU Azure Container Registry. Geo-replication is a Premium tier feature of Azure Container Registry. It presents one registry with a single login server and image name while keeping a replica in each configured region, so an image pushed once is replicated automatically to all four regions and each AKS cluster pulls from its local replica. Now, why are the other options incorrect? Option A is incorrect. A geo-redundant storage account replicates to the paired region only, and it is not a container registry. Option C is incorrect. A CDN caches content at edge nodes on demand. It does not host or replicate container images for a registry. Option D is incorrect. Azure Cache for Redis is an in-memory data cache. Therefore, B, Premium SKU Azure Container Registry, is the correct answer.
Play from 29:16 Question 14. Your company has offices in North America and Europe. You plan to migrate to Azure. You need to recommend a networking solution for the new Azure infrastructure. The solution must meet the following requirements: • The Point-to-Site (P2S) VPN connections of mobile users must connect automatically to the closest Azure region. • The offices in each region must connect to their local Azure region by using an ExpressRoute circuit. • Transitive routing between virtual networks and on-premises networks must be supported. • The network traffic between virtual networks must be filtered by using FQDNs. What should you include in the recommendation? Here are the options. Option A. Azure Virtual WAN with a secured virtual hub. Option B. virtual network peering and application security groups. Option C. virtual network gateways and network security groups (NSGs). Option D. Azure Route Server and Azure Network Function Manager. Pause the video now if you want time to think about the answer.
The correct answer is A. Azure Virtual WAN with a secured virtual hub. Azure Virtual WAN with a secured virtual hub is the only design that meets all four requirements. Virtual WAN gives every hub a regional presence so P2S clients connect to the nearest one, each region's office terminates its own ExpressRoute circuit on the local hub, and the hubs form a fully transitive mesh so virtual networks and on-premises networks route between each other. Securing the hub deploys Azure Firewall into it, and Azure Firewall filters traffic by fully qualified domain name. Now, why are the other options incorrect? Option B is incorrect. Virtual network peering is not transitive, and application security groups filter by IP-based groupings rather than by FQDN. Option C is incorrect. Gateways connected point to point do not provide transitive routing, and network security groups filter on addresses and ports, not FQDNs. Option D is incorrect. Route Server exchanges routes with a network virtual appliance and Network Function Manager deploys appliances at the edge. Neither delivers the P2S regional affinity or the FQDN filtering asked for. Therefore, A, Azure Virtual WAN with a secured virtual hub, is the correct answer.
Play from 31:52 Question 15. You have an Azure App Service app named App1. You need to recommend a solution to monitor the response times of App1 for end users. The solution must minimize administrative effort. What should you include in the recommendation? Here are the options. Option A. Health check in App Service. Option B. Log Analytics. Option C. Azure Monitor Application Insights. Option D. Azure Network Watcher connection monitor. Pause the video now if you want time to think about the answer.
The correct answer is C. Azure Monitor Application Insights. Azure Monitor Application Insights is the application performance monitoring feature of Azure Monitor, and it can be enabled for an App Service app directly from the portal, often without code changes. It automatically collects request rates, server response times, dependency durations and failures, and its browser telemetry captures page load and response timings as experienced by end users. These metrics are preaggregated and available immediately in dashboards and alerts, so the response times of App1 can be monitored with minimal administrative effort. Now, why are the other options incorrect? Option A is incorrect. Health check in App Service pings a path to remove unhealthy instances from the load balancer rotation; it does not measure or report response times experienced by end users. Option B is incorrect. Log Analytics stores and queries log data, but on its own it does not instrument App1 to collect end-user response times, so additional configuration would be needed. Option D is incorrect. Network Watcher connection monitor tests network reachability and latency between endpoints, not the application response times that end users experience. Therefore, C, Azure Monitor Application Insights, is the correct answer.
Play from 34:06 Question 16. You have an Azure subscription that contains 1,000 resources. You need to generate compliance reports for the subscription. The solution must ensure that the resources can be grouped by department. What should you use to organize the resources? Here are the options. Option A. application groups and quotas. Option B. Azure Policy and tags. Option C. administrative units and Azure Lighthouse. Option D. resource groups and role assignments. Pause the video now if you want time to think about the answer.
The correct answer is B. Azure Policy and tags. Tags carry the department against each resource, and Cost Management and the compliance views group and filter by them, so a report can be produced per department across all 1,000 resources. Azure Policy is what makes that reliable, by requiring the department tag on resources and remediating any that lack it, so no resource falls out of the grouping. Now, why are the other options incorrect? Option A is incorrect. Application groups belong to Azure Virtual Desktop and quotas limit resource consumption. Neither organises resources for reporting. Option C is incorrect. Administrative units delegate user and group administration, and Azure Lighthouse enables cross-tenant management by a service provider. Option D is incorrect. Resource groups are a single, rigid grouping and a resource can only be in one, so they cannot express a department view across an existing estate. Role assignments control access rather than reporting. Therefore, B, Azure Policy and tags, is the correct answer.
Play from 36:02 Question 17. You have a business-critical app named App1 that is hosted in an Azure Kubernetes Service (AKS) cluster. You need to recommend a configuration solution for the cluster. The solution must meet the following requirements: ● Maintain availability during planned datacenter maintenance events. ● Support dynamic scaling in response to workload demands. ● Minimize downtime if a datacenter fails. What should you recommend? Here are the options. Option A. an AKS cluster deployed to a single availability zone. Option B. an AKS cluster with multiple node pools deployed to a single availability zone. Option C. an AKS cluster that has nodes deployed to different Azure regions. Option D. an AKS cluster with availability zones enabled. Pause the video now if you want time to think about the answer.
The correct answer is D. an AKS cluster with availability zones enabled. Availability zones are physically separate datacenters within a region, each with independent power, cooling, and networking. An AKS cluster with availability zones enabled spreads its node pools across zones, so planned maintenance or the failure of one datacenter affects only part of the nodes, and the remaining zones keep App1 running with minimal downtime. Zone-spanning node pools are backed by virtual machine scale sets, so the cluster autoscaler can still add and remove nodes dynamically in response to workload demand. This is the only option that satisfies all three requirements within a single cluster. Now, why are the other options incorrect? Option A is incorrect. A cluster in a single availability zone runs entirely in one datacenter, so a datacenter failure takes the whole cluster down. Option B is incorrect. Multiple node pools in the same zone still share one datacenter, so they provide no protection if that datacenter fails. Option C is incorrect. An AKS cluster is a regional resource and its nodes cannot be deployed across different Azure regions; multiregion designs require separate clusters. Therefore, D, an AKS cluster with availability zones enabled, is the correct answer.
Play from 38:35 Question 18. You have an Azure subscription. You plan to deploy an Azure SQL database named DB1 that will store the maximum daily temperature. You need to recommend a solution to query an external website, retrieve the maximum temperature from the previous 24 hours, and write the temperature to DB1. The solution should minimize costs, development effort, and administrative effort. What should you include in the recommendation? Here are the options. Option A. an Azure Batch job. Option B. an Azure event hub. Option C. an Azure container instance. Option D. an Azure function. Pause the video now if you want time to think about the answer.
The correct answer is D. an Azure function. The requirement is a small, recurring job: once a day, call an external website, read the maximum temperature for the previous 24 hours, and write one value to DB1. Azure Functions handles this with a timer trigger that runs the code on a schedule, and an Azure SQL output binding writes the result to the database without custom data access plumbing, which minimizes development effort. On the Consumption or Flex Consumption plan you pay only for the brief execution time, so costs are minimal, and because the service is serverless there are no servers, pools, or containers to manage, which minimizes administrative effort. Now, why are the other options incorrect? Option A is incorrect. Azure Batch is designed for large-scale parallel and HPC jobs and requires defining pools, jobs, and tasks, which adds cost and administrative effort for a single daily lookup. Option B is incorrect. An event hub is a high-throughput event ingestion service. It cannot query a website or write to a database on its own, so separate compute would still be required. Option C is incorrect. An Azure container instance requires building and maintaining a container image plus a separate scheduling mechanism, which increases development and administrative effort compared to a timer-triggered function. Therefore, D, an Azure function, is the correct answer.
Play from 41:02 Question 19. You have an on-premises application named App1 that uses an Oracle database. You plan to use Azure Databricks to transform and load data from App1 to an Azure Synapse Analytics instance. You need to ensure that the App1 data is available to Databricks. Which two Azure services should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. Azure Data Box Gateway. Option B. Azure Import/Export service. Option C. Azure Data Lake Storage. Option D. Azure Data Box Edge. Option E. Azure Data Factory. Pause the video now if you want time to think about the answer.
The correct answers are C. Azure Data Lake Storage, and E. Azure Data Factory. Azure Data Factory is what reaches the on-premises Oracle database, using a self-hosted integration runtime installed on the local network, and copies the data into Azure on a schedule. Azure Data Lake Storage is where it lands, and Databricks mounts that storage directly to transform the data before loading it into Synapse. The two together make the App1 data available. Now, why are the other options incorrect? Option A is incorrect. Data Box Gateway is a virtual appliance for moving bulk data into Azure. It is not needed when there is network connectivity and Data Factory can do the copy. Option B is incorrect. The Import/Export service ships physical disks for a one-time bulk transfer, which does not suit an ongoing load. Option D is incorrect. Data Box Edge is an on-premises appliance with local compute for pre-processing, which this scenario does not require. Therefore, C and E are the correct answers.
Play from 43:13 Question 20. You have an Azure subscription that contains 1,000 virtual machines and a Log Analytics workspace named Workspace1. You plan to collect custom JSON logs from the virtual machines and store the logs in a custom table in Workspace1. You need to ensure that the logs are collected by using the Logs Ingestion API. The solution must prevent access to Workspace1 from the internet. What should you include in the solution? Here are the options. Option A. an Azure Monitor Private Link Scope (AMPLS). Option B. the linked storage account of Workspace1. Option C. Service Connector. Option D. an Azure Peering Service connection. Pause the video now if you want time to think about the answer.
The correct answer is A. an Azure Monitor Private Link Scope (AMPLS). The Logs Ingestion API sends data to a data collection endpoint (or a data collection rule endpoint), which routes it through a data collection rule into the custom table in Workspace1. An Azure Monitor Private Link Scope connects a virtual network to Azure Monitor resources, including data collection endpoints and Log Analytics workspaces, through a single private endpoint. After the data collection endpoint and Workspace1 are added to the AMPLS, the virtual machines send their custom JSON logs over private IP addresses, and the workspace network isolation settings can be set to block ingestion and query access from public networks. This keeps the ingestion path private while still supporting the API for all 1,000 virtual machines. Now, why are the other options incorrect? Option B is incorrect. A linked storage account is used for specific scenarios such as custom logs or saved queries stored in your own storage. It does not provide private network access to the Logs Ingestion API or block internet access to Workspace1. Option C is incorrect. Service Connector configures connection settings between compute services and backing services. It does not create a private network path for Azure Monitor ingestion. Option D is incorrect. Azure Peering Service optimizes internet connectivity to Microsoft services through partner providers. Traffic still uses public endpoints, so it cannot prevent internet access to Workspace1. Therefore, A, an Azure Monitor Private Link Scope (AMPLS), is the correct answer.
Play from 46:04 Question 21. You have the following Azure subscriptions: ● Multiple subscriptions that host workloads ● A dedicated management subscription for the workloads Your company runs platform and application resources across several subscriptions and has on-premises Azure Arc-enabled virtual machines. Development teams have permission to deploy monitoring components to their own subscriptions. Operations teams find it difficult to correlate platform with workload telemetry across Azure and hybrid resources. You need to recommend a monitoring solution that provides centralized querying for log and trace data. The solution must meet the following requirements: ● Support the hybrid resources. ● Prevent the teams from storing monitoring data in disparate locations. What should you include in the recommendation? Here are the options. Option A. Configure Azure Service Health alerts for each subscription. Option B. Deploy an Azure Monitor workspace to each workload subscription. Option C. Deploy Azure Managed Grafana to the management subscription. Option D. Deploy a Log Analytics workspace to the management subscription. Pause the video now if you want time to think about the answer.
The correct answer is D. Deploy a Log Analytics workspace to the management subscription. A single Log Analytics workspace in the dedicated management subscription gives the operations teams one place to run Kusto queries that correlate platform logs with workload telemetry. Azure resources in every workload subscription can send resource logs to it through diagnostic settings, Azure Arc-enabled on-premises virtual machines send logs through the Azure Monitor Agent and data collection rules, and workspace-based Application Insights stores application traces in the same workspace. Centralizing on one workspace, backed by Azure Policy and permissions, stops teams from scattering monitoring data across separate locations while still supporting the hybrid resources. Now, why are the other options incorrect? Option A is incorrect. Azure Service Health alerts report Azure platform incidents and maintenance; they do not collect or query log and trace data from workloads or Arc-enabled machines. Option B is incorrect. An Azure Monitor workspace in each workload subscription stores Prometheus metrics, not log and trace data, and deploying one per subscription creates the disparate locations the requirements prohibit. Option C is incorrect. Azure Managed Grafana visualizes data from other sources but does not store logs or traces, so it cannot by itself centralize the monitoring data. Therefore, D, Deploy a Log Analytics workspace to the management subscription, is the correct answer.
Play from 49:09 Question 22. You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory domain. You have an internal web app named WebApp1 that is hosted on-premises. WebApp1 uses Integrated Windows authentication. Some users work remotely and do NOT have VPN access to the on-premises network. You need to provide the remote users with single sign-on (SSO) access to WebApp1. Which two features should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. Azure AD Application Proxy. Option B. Azure AD Privileged Identity Management (PIM). Option C. Conditional Access policies. Option D. Azure Arc. Option E. Azure AD enterprise applications. Option F. Azure Application Gateway. Pause the video now if you want time to think about the answer.
The correct answers are A. Azure AD Application Proxy, and E. Azure AD enterprise applications. Azure AD Application Proxy publishes an internal web app to the internet through an outbound connector, so remote users reach WebApp1 without a VPN, and it supports Kerberos constrained delegation so Integrated Windows authentication still works and single sign-on is preserved. The published app appears in the tenant as an Azure AD enterprise application, which is where the assignment, SSO configuration, and policy for it live. Both pieces are needed. Now, why are the other options incorrect? Option B is incorrect. Privileged Identity Management provides just-in-time activation of privileged roles. It plays no part in publishing an internal web app. Option C is incorrect. Conditional Access can add controls once the app is published, but on its own it creates no path to an on-premises app. Option D is incorrect. Azure Arc projects servers and Kubernetes clusters into Azure for management. It does not publish a web app for remote access. Option F is incorrect. Azure Application Gateway is a regional layer 7 load balancer inside a virtual network. Reaching an on-premises app through it would still require network connectivity that the remote users do not have. Therefore, A and E are the correct answers.
Play from 51:59 Question 23. You have an Azure subscription. The subscription has a blob container that contains multiple blobs. Ten users in the finance department of your company plan to access the blobs during the month of April. You need to recommend a solution to enable access to the blobs during the month of April only. Which security solution should you include in the recommendation? Here are the options. Option A. shared access signatures (SAS). Option B. Conditional Access policies. Option C. certificates. Option D. access keys. Pause the video now if you want time to think about the answer.
The correct answer is A. shared access signatures (SAS). A shared access signature grants access to blob resources for a defined window, with an explicit start and expiry time and a chosen set of permissions. Issuing SAS tokens valid only through April gives the ten finance users access for that month and nothing beyond it, with no change to the account keys. Now, why are the other options incorrect? Option B is incorrect. Conditional Access governs how an identity signs in, applying controls such as MFA or device state. It does not put an expiry on access to a blob. Option C is incorrect. Certificates authenticate a client. They do not by themselves limit access to a container for a calendar month. Option D is incorrect. Access keys grant full, permanent control of the whole storage account. They cannot be scoped to a time window or to specific blobs. Therefore, A, shared access signatures (SAS), is the correct answer.
Play from 54:03 Question 24. You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains a user named User1 that is assigned a Microsoft Entra ID P2 license. The tenant has security defaults disabled. You need to ensure that User1 is prompted for multifactor authentication (MFA) when the user attempts to access Azure resources from untrusted networks. The solution must minimize administrative effort. What should you use? Here are the options. Option A. a user risk policy. Option B. an access package. Option C. an identity governance policy. Option D. a sign-in risk policy. Pause the video now if you want time to think about the answer.
The correct answer is D. a sign-in risk policy. User1 has a Microsoft Entra ID P2 license, which includes Microsoft Entra ID Protection. A sign-in risk policy evaluates each authentication attempt against built-in detections such as anonymous IP addresses, unfamiliar sign-in properties and atypical travel, which are typical of access from untrusted networks, and requires MFA when the sign-in risk reaches the configured level. The detections are maintained by Microsoft, so the policy is configured once and no list of network locations or IP ranges has to be built and kept current, which minimizes administrative effort. Now, why are the other options incorrect? Option A is incorrect. A user risk policy responds to the likelihood that the account itself is compromised, such as leaked credentials, and typically forces a password change. It does not evaluate the network of each sign-in. Option B is incorrect. An access package bundles resources that users request through entitlement management. It does not prompt for MFA at sign-in. Option C is incorrect. An identity governance policy manages access lifecycle tasks such as requests and reviews. It does not enforce MFA based on the network a user signs in from. Therefore, D, a sign-in risk policy, is the correct answer.
Play from 56:30 Question 25. You have a multi-tier app named App1 and an Azure SQL database named SQL1. The backend service of App1 writes data to SQL1. Users use the App1 client to read the data from SQL1. During periods of high utilization, the users experience delays retrieving the data. You need to minimize how long it takes for data requests. What should you include in the solution? Here are the options. Option A. Azure Cache for Redis. Option B. Azure Content Delivery Network (CDN). Option C. Azure Data Factory. Option D. Azure Synapse Analytics. Pause the video now if you want time to think about the answer.
The correct answer is A. Azure Cache for Redis. The delay appears when many users read the same data under load, which is the classic case for a cache. Azure Cache for Redis holds the frequently requested results in memory, so most reads are served without touching SQL1 at all. That cuts response time for users and takes pressure off the database during peak periods. Now, why are the other options incorrect? Option B is incorrect. A CDN caches static content at edge locations. The data here is dynamic and comes from a database. Option C is incorrect. Data Factory moves and transforms data on a schedule. It does nothing for interactive read latency. Option D is incorrect. Synapse Analytics is an analytical platform for large queries, not a way to speed up transactional reads. Therefore, A, Azure Cache for Redis, is the correct answer.
Play from 58:27 Question 26. Your company, named Contoso, Ltd., implements several Azure logic apps that have HTTP triggers. The logic apps provide access to an on-premises web service. Contoso establishes a partnership with another company named Fabrikam, Inc. Fabrikam does not have an existing Azure Active Directory (Azure AD) tenant and uses third-party OAuth 2.0 identity management to authenticate its users. Developers at Fabrikam plan to use a subset of the logic apps to build applications that will integrate with the on-premises web service of Contoso. You need to design a solution to provide the Fabrikam developers with access to the logic apps. The solution must meet the following requirements: • Requests to the logic apps from the developers must be limited to lower rates than the requests from the users at Contoso. • The developers must be able to rely on their existing OAuth 2.0 provider to gain access to the logic apps. • The solution must NOT require changes to the logic apps. • The solution must NOT use Azure AD guest accounts. What should you include in the solution? Here are the options. Option A. Azure Front Door. Option B. Azure AD Application Proxy. Option C. Azure AD business-to-business (B2B). Option D. Azure API Management. Pause the video now if you want time to think about the answer.
The correct answer is D. Azure API Management. Azure API Management sits in front of the logic apps and satisfies every constraint at once. Rate limit policies applied per product or subscription give the Fabrikam developers a lower request rate than Contoso users. Its validate-jwt policy accepts tokens from any third-party OAuth 2.0 provider, so the developers keep their existing identity provider and no Azure AD guest accounts are needed. Because the enforcement lives in the gateway, the logic apps themselves are untouched. Now, why are the other options incorrect? Option A is incorrect. Azure Front Door is a global entry point with WAF and routing. It does not validate third-party OAuth 2.0 tokens or apply per-consumer rate limits. Option B is incorrect. Application Proxy publishes on-premises apps to Azure AD identities. The logic apps are already in Azure and Azure AD accounts are explicitly excluded. Option C is incorrect. Azure AD B2B works by inviting external users as guests, which the requirements rule out. Therefore, D, Azure API Management, is the correct answer.
Play from 1:01:31 Question 27. You are designing a large Azure environment that will contain many subscriptions. You plan to use Azure Policy as part of a governance solution. To which three scopes can you assign Azure Policy definitions? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. Azure Active Directory (Azure AD) administrative units. Option B. Azure Active Directory (Azure AD) tenants. Option C. subscriptions. Option D. compute resources. Option E. resource groups. Option F. management groups. Pause the video now if you want time to think about the answer.
The correct answers are C. subscriptions, and E. resource groups, and F. management groups. Azure Policy assignments follow the Azure Resource Manager hierarchy, so a definition can be assigned at a management group, a subscription, or a resource group, and it then applies to everything beneath that scope. Those three are the assignable scopes. Now, why are the other options incorrect? Option A is incorrect. Administrative units are an Azure AD construct for delegating user and group administration. They sit outside the resource hierarchy that Azure Policy governs. Option B is incorrect. An Azure AD tenant is the identity boundary. Policy is assigned to resource scopes, with the management group as the highest one. Option D is incorrect. An individual compute resource is the target of a policy evaluation, not a scope an assignment is made at. Therefore, C and E and F are the correct answers.
Play from 1:03:35 Question 28. You are designing an Azure governance solution. All Azure resources must be easily identifiable based on the following operational information: environment, owner, department and cost center. You need to ensure that you can use the operational information when you generate reports for the Azure resources. What should you include in the solution? Here are the options. Option A. an Azure data catalog that uses the Azure REST API as a data source. Option B. an Azure management group that uses parent groups to create a hierarchy. Option C. an Azure policy that enforces tagging rules. Option D. Azure Active Directory (Azure AD) administrative units. Pause the video now if you want time to think about the answer.
The correct answer is C. an Azure policy that enforces tagging rules. The operational information named here, environment, owner, department, and cost centre, is exactly what resource tags carry, and Cost Management and the resource reports group and filter by them. An Azure Policy that enforces tagging rules makes sure every resource actually carries those tags, which is what keeps the reports complete. Now, why are the other options incorrect? Option A is incorrect. A data catalog documents data assets. It does not attach operational metadata to Azure resources or drive resource reporting. Option B is incorrect. A management group hierarchy organises subscriptions. It cannot record an owner or a cost centre against an individual resource. Option D is incorrect. Administrative units delegate administration of users and groups in Azure AD and have no bearing on resource reporting. Therefore, C, an Azure policy that enforces tagging rules, is the correct answer.
Play from 1:05:46 Question 29. You have an Azure AD tenant named contoso.com that has a security group named Group1. Group1 is configured for assigned memberships. Group1 has 50 members, including 20 guest users. You need to recommend a solution for evaluating the membership of Group1. The solution must meet the following requirements: • The evaluation must be repeated automatically every three months. • Every member must be able to report whether they need to be in Group1. • Users who report that they do not need to be in Group1 must be removed from Group1 automatically. • Users who do not report whether they need to be in Group1 must be removed from Group1 automatically. What should you include in the recommendation? Here are the options. Option A. Implement Azure AD Identity Protection. Option B. Change the Membership type of Group1 to Dynamic User. Option C. Create an access review. Option D. Implement Azure AD Privileged Identity Management (PIM). Pause the video now if you want time to think about the answer.
The correct answer is C. Create an access review. An access review covers all four requirements directly. It can be scheduled to recur every three months, the members themselves can be set as the reviewers so each person reports whether they still need to be in Group1, denied results remove the user, and the setting for reviewers who do not respond removes those who never answer. Now, why are the other options incorrect? Option A is incorrect. Identity Protection is a risk engine for sign-ins and users. It performs no membership attestation. Option B is incorrect. A dynamic group derives membership from attributes automatically, so no member is ever asked whether they still belong. Option D is incorrect. Privileged Identity Management provides just-in-time activation for privileged roles, not recurring review of a security group. Therefore, C, Create an access review, is the correct answer.
Play from 1:08:09 Question 30. You have an Azure subscription that contains two applications named App1 and App2. App1 is a sales processing application. When a transaction in App1 requires shipping, a message is added to an Azure Storage account queue, and then App2 listens to the queue for relevant transactions. In the future, additional applications will be added that will process some of the shipping requests based on the specific details of the transactions. You need to recommend a replacement for the storage account queue to ensure that each additional application will be able to read the relevant transactions. What should you recommend? Here are the options. Option A. one Azure Data Factory pipeline. Option B. multiple storage account queues. Option C. one Azure Service Bus queue. Option D. one Azure Service Bus topic. Pause the video now if you want time to think about the answer.
The correct answer is D. one Azure Service Bus topic. A queue delivers each message to exactly one consumer, so once several applications need to see the same shipping transactions a queue cannot work. A Service Bus topic is publish and subscribe: each application gets its own subscription, and a subscription filter selects only the transactions whose details are relevant to it, which is precisely the future requirement described. Now, why are the other options incorrect? Option A is incorrect. A Data Factory pipeline is scheduled batch data movement, not a messaging fabric for a transactional flow. Option B is incorrect. Multiple queues would mean the publisher writing the same message to each one and knowing every consumer in advance, which is what a topic removes. Option C is incorrect. A Service Bus queue improves on a storage queue but still delivers each message once, so additional applications could not read the same transaction. Therefore, D, one Azure Service Bus topic, is the correct answer.
Play from 1:10:25 Question 31. You have an on-premises application that consumes data from multiple databases. The application code references database tables by using a combination of the server, database, and table name. You need to migrate the application data to Azure. To which two services can you migrate the application data to achieve the goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. SQL Server Stretch Database. Option B. SQL Server on an Azure virtual machine. Option C. Azure SQL Database. Option D. Azure SQL Managed Instance. Pause the video now if you want time to think about the answer.
The correct answers are B. SQL Server on an Azure virtual machine, and D. Azure SQL Managed Instance. The application addresses tables by server, database, and table name, so the target has to support cross-database queries within one instance. SQL Server on an Azure virtual machine keeps the full engine behaviour, and Azure SQL Managed Instance supports cross-database queries on the same instance, so both allow the existing code to work unchanged. Now, why are the other options incorrect? Option A is incorrect. SQL Server Stretch Database moves cold rows of an on-premises table into Azure. It is not a migration target for the whole application. Option C is incorrect. Azure SQL Database isolates each database, so a query that names another database on the same server fails. Therefore, B and D are the correct answers.
Play from 1:12:19 Question 32. You have an Azure subscription that contains an Azure key vault named KV1. You need to ensure that you can review how and when KV1 is accessed. The solution must minimize costs. What should you use? Here are the options. Option A. Microsoft Purview. Option B. the activity log of KV1. Option C. Azure Monitor. Option D. Microsoft Sentinel. Pause the video now if you want time to think about the answer.
The correct answer is C. Azure Monitor. Key Vault records every data plane request, such as reading a secret or a key, in its resource logs, together with the caller identity, the operation and the time it ran. Those resource logs are not kept until a diagnostic setting in Azure Monitor routes them to a destination, and sending them to a storage account keeps the cost low because no workspace ingestion is billed. That diagnostic setting is what makes it possible to review how and when KV1 is accessed. The activity log, by contrast, records only management operations on the vault resource itself. Now, why are the other options incorrect? Option A is incorrect. Microsoft Purview is a data governance service for cataloging and classifying data, and it does not capture the requests made against a key vault. Option B is incorrect. The activity log of KV1 records only management operations, such as changes to the vault's configuration, so it does not show when secrets, keys or certificates are read. Option D is incorrect. Microsoft Sentinel is a SIEM that bills for the data ingested into its workspace, which costs far more than routing the Key Vault resource logs to storage with Azure Monitor. Therefore, C, Azure Monitor, is the correct answer.
Play from 1:14:32 Question 33. You are planning a storage solution. The solution must meet the following requirements: • Support at least 500 requests per second. • Support a large image, video, and audio streams. Which type of Azure Storage account should you provision? Here are the options. Option A. standard general-purpose v2. Option B. premium block blobs. Option C. premium page blobs. Option D. premium file shares. Pause the video now if you want time to think about the answer.
The correct answer is B. premium block blobs. Large image, video, and audio streams are block blobs, and a high request rate with low latency is what the premium block blob account type is for. It stores data on solid state disks and delivers much higher transaction rates and lower latency than the standard tier, so it comfortably serves 500 requests per second of streaming media. Now, why are the other options incorrect? Option A is incorrect. A standard general-purpose v2 account would hold the data but on spinning media, so it is the slower option for a demanding streaming workload. Option C is incorrect. Premium page blobs are optimised for random read and write access and are used for virtual machine disks, not for streaming media. Option D is incorrect. Premium file shares serve SMB and NFS clients rather than streaming large media objects. Therefore, B, premium block blobs, is the correct answer.
Play from 1:16:27 Question 34. You have an Azure subscription that contains 10 web apps. The apps are integrated with Azure AD and are accessed by users on different project teams. The users frequently move between projects. You need to recommend an access management solution for the web apps. The solution must meet the following requirements: • The users must only have access to the app of the project to which they are assigned currently. • Project managers must verify which users have access to their project’s app and remove users that are no longer assigned to their project. • Once every 30 days, the project managers must be prompted automatically to verify which users are assigned to their projects. What should you include in the recommendation? Here are the options. Option A. Azure AD Identity Protection. Option B. Microsoft Defender for Identity. Option C. Microsoft Entra Permissions Management. Option D. Azure AD Identity Governance. Pause the video now if you want time to think about the answer.
The correct answer is D. Azure AD Identity Governance. Identity Governance is the umbrella that contains entitlement management and access reviews, which together cover all three requirements. Access packages grant a user the app for the project they are currently on and remove it when they move, and a recurring access review set to every 30 days prompts each project manager to confirm who should still have their project's app and removes those who should not. Now, why are the other options incorrect? Option A is incorrect. Identity Protection detects risky users and sign-ins. It does not manage who is entitled to which app. Option B is incorrect. Microsoft Defender for Identity monitors on-premises Active Directory for attacks. Option C is incorrect. Permissions Management discovers and right-sizes permissions across cloud infrastructure. It does not run manager attestations on app assignments. Therefore, D, Azure AD Identity Governance, is the correct answer.
Play from 1:18:53 Question 35. You have an Azure subscription that contains an Azure Data Lake Storage Gen2 account named storage1 and an Azure Synapse Analytics workspace named Workspace1. Workspace1 contains a serverless SQL pool and an Apache Spark pool. You need to recommend a disaster recovery solution for storage1. What should you include in the recommendation? Here are the options. Option A. vaulted backup of Azure blobs. Option B. operational backup of Azure blobs. Option C. geo-backup in Azure Synapse Analytics. Option D. asynchronous replication. Pause the video now if you want time to think about the answer.
The correct answer is D. asynchronous replication. Disaster recovery for an Azure Data Lake Storage Gen2 account is provided by geo-redundant storage. With GRS or GZRS, Azure Storage asynchronously replicates the account's data, including the hierarchical namespace metadata and ACLs, to a secondary region hundreds of miles away. If the primary region becomes unavailable, a customer-managed failover promotes the secondary region so that the serverless SQL pool and the Apache Spark pool in Workspace1 can again read the data. Accounts with a hierarchical namespace support both planned and unplanned customer-managed failover, so asynchronous replication is the recovery mechanism for storage1. Now, why are the other options incorrect? Option A is incorrect. Vaulted backup of Azure blobs targets standard blob accounts and protects against deletion or corruption; it is not the regional disaster recovery mechanism for a Data Lake Storage Gen2 account. Option B is incorrect. Operational backup of Azure blobs keeps restore points locally in the source account and does not support accounts with a hierarchical namespace, so it provides no protection from a regional outage. Option C is incorrect. Geo-backup in Azure Synapse Analytics protects only dedicated SQL pool data warehouses; Workspace1 has no dedicated SQL pool, and geo-backup never covers a storage account. Therefore, D, asynchronous replication, is the correct answer.
Play from 1:21:25 Question 36. You have an Azure web app that uses an Azure key vault named KeyVault1 in the West US Azure region. You are designing a disaster recovery plan for KeyVault1. You plan to back up the keys in KeyVault1. You need to identify to where you can restore the backup. What should you identify? Here are the options. Option A. any region worldwide. Option B. the same region only. Option C. KeyVault1 only. Option D. the same geography only. Pause the video now if you want time to think about the answer.
The correct answer is D. the same geography only. A key vault backup is encrypted with a key that Azure holds within the security boundary of the geography the vault lives in, so the backup blob can only be restored into a vault in that same geography. West US is in the United States geography, so the restore target has to be a vault in the United States, not necessarily the same region and not another geography. Now, why are the other options incorrect? Option A is incorrect. Restoring anywhere in the world would break the data residency boundary the backup format deliberately enforces. Option B is incorrect. The restriction is the geography rather than the individual region, so another region within the same geography is a valid target. Option C is incorrect. The backup can be restored into a different vault, which is what makes it useful for disaster recovery. Therefore, D, the same geography only, is the correct answer.
Play from 1:23:24 Question 37. You have data files in Azure Blob Storage. You plan to transform the files and move them to Azure Data Lake Storage. You need to transform the data by using mapping data flow. Which service should you use? Here are the options. Option A. Azure Databricks. Option B. Azure Storage Sync. Option C. Azure Data Factory. Option D. Azure Data Box Gateway. Pause the video now if you want time to think about the answer.
The correct answer is C. Azure Data Factory. Mapping data flow is a feature of Azure Data Factory. It provides a visual transformation designer whose logic is executed on a managed Spark cluster, so the files can be read from Blob Storage, transformed, and written to Data Lake Storage without writing any Spark code. Now, why are the other options incorrect? Option A is incorrect. Databricks runs Spark and can perform the same transformation, but it requires notebook code rather than the mapping data flow feature named in the requirement. Option B is incorrect. Azure Storage Sync keeps Windows file servers in step with an Azure file share. Option D is incorrect. Data Box Gateway is a virtual appliance for shipping data into Azure and performs no transformation. Therefore, C, Azure Data Factory, is the correct answer.
Play from 1:25:05 Question 38. You need to recommend a data storage solution that meets the following requirements: • Ensures that applications can access the data by using a REST connection • Hosts 20 independent tables of varying sizes and usage patterns • Automatically replicates the data to a second Azure region • Minimizes costs What should you recommend? Here are the options. Option A. an Azure SQL Database elastic pool that uses active geo-replication. Option B. tables in an Azure Storage account that use geo-redundant storage (GRS). Option C. tables in an Azure Storage account that use read-access geo-redundant storage (RA-GRS). Option D. an Azure SQL database that uses active geo-replication. Pause the video now if you want time to think about the answer.
The correct answer is B. tables in an Azure Storage account that use geo-redundant storage (GRS). Twenty independent tables of varying size and usage fit the Azure Table service, which is accessed over REST and is by far the cheapest of the options, since you pay only for the data stored and the transactions made rather than for provisioned database capacity. Geo-redundant storage replicates the account to a second region automatically, which satisfies the replication requirement. Now, why are the other options incorrect? Option A is incorrect. An elastic pool provisions and bills for compute continuously, which is a much larger cost than table storage for twenty simple tables. Option C is incorrect. Read-access geo-redundant storage also replicates to a second region but charges more for the read access to the secondary, which the requirements never asked for. Option D is incorrect. A single database with active geo-replication runs a second live database, so the cost is higher still. Therefore, B, tables in an Azure Storage account that use geo-redundant storage (GRS), is the correct answer.
Play from 1:27:29 Question 39. Your company has 300 virtual machines hosted in a VMware environment. The virtual machines vary in size and have various utilization levels. You plan to move all the virtual machines to Azure. You need to recommend how many and what size Azure virtual machines will be required to move the current workloads to Azure. The solution must minimize administrative effort. What should you use to make the recommendation? Here are the options. Option A. Azure Pricing calculator. Option B. Azure Advisor. Option C. Azure Migrate. Option D. Azure Cost Management. Pause the video now if you want time to think about the answer.
The correct answer is C. Azure Migrate. Azure Migrate discovers the VMware estate, collects performance data from the running machines over time, and then produces an assessment that recommends a specific Azure virtual machine size for each one along with the projected cost. Because it measures actual utilisation rather than the configured size, it right-sizes the 300 machines automatically, which is what keeps administrative effort down. Now, why are the other options incorrect? Option A is incorrect. The Pricing calculator estimates the cost of sizes you supply. It has no visibility of the existing machines and cannot recommend sizes. Option B is incorrect. Azure Advisor makes recommendations about resources already running in Azure, so it cannot assess an on-premises VMware environment. Option D is incorrect. Cost Management analyses spend on existing Azure resources rather than sizing a future migration. Therefore, C, Azure Migrate, is the correct answer.
Play from 1:29:37 Question 40. You have a Microsoft Dataverse instance named dv1 and an Azure Cosmos DB database named db1. You need to develop a solution to update db1 automatically when a record is updated in dv1. The solution must minimize development effort. What should you include in the solution? Here are the options. Option A. Azure Event Grid. Option B. Azure App Service. Option C. Azure Functions. Option D. Azure Logic Apps. Pause the video now if you want time to think about the answer.
The correct answer is D. Azure Logic Apps. Azure Logic Apps provides prebuilt connectors for both Microsoft Dataverse and Azure Cosmos DB. A workflow can start with the Dataverse trigger that fires when a row is added, modified or deleted, and then use the Azure Cosmos DB connector action to create or update the matching document in db1. Because the whole integration is assembled from managed connectors in a visual designer, there is no custom code to write, host or maintain, which minimizes development effort. Now, why are the other options incorrect? Option A is incorrect. Azure Event Grid routes events to handlers, but it has no built-in Dataverse source and cannot write documents to Cosmos DB on its own, so code would still be required. Option B is incorrect. Azure App Service hosts web apps and APIs, which means writing and deploying custom code to watch Dataverse and update Cosmos DB. Option C is incorrect. Azure Functions would require writing code to receive Dataverse changes and call the Cosmos DB API, which is more development effort than using ready-made connectors. Therefore, D, Azure Logic Apps, is the correct answer.
Play from 1:31:47 Question 41. You plan to deploy an Azure App Service web app that will have multiple instances across multiple Azure regions. You need to recommend a load balancing service for the planned deployment The solution must meet the following requirements: • Maintain access to the app in the event of a regional outage. • Support Azure Web Application Firewall (WAF). • Support cookie-based affinity. • Support URL routing. What should you include in the recommendation? Here are the options. Option A. Azure Front Door. Option B. Azure Traffic Manager. Option C. Azure Application Gateway. Option D. Azure Load Balancer. Pause the video now if you want time to think about the answer.
The correct answer is A. Azure Front Door. Only Front Door does all four. It is a global service, so it keeps the app reachable when a region fails, its integrated Web Application Firewall satisfies the WAF requirement, and being a layer 7 reverse proxy it supports session affinity through cookies and routing rules based on the URL path. Now, why are the other options incorrect? Option B is incorrect. Traffic Manager works at DNS level, so it cannot offer WAF, cookie-based affinity, or URL routing. Option C is incorrect. Application Gateway supports WAF, affinity, and URL routing but is regional, so it fails the regional outage requirement. Option D is incorrect. Azure Load Balancer is regional and operates at layer 4, so none of the HTTP-level requirements are met. Therefore, A, Azure Front Door, is the correct answer.
Play from 1:33:46 Question 42. Your on-premises datacenter contains a server that runs Linux and hosts a Java app named App1. App1 has the following characteristics: • App1 is an interactive app that users access by using HTTPS connections. • The number of connections to App1 changes significantly throughout the day. • App1 runs multiple concurrent instances. • App1 requires major changes to run in a container. You plan to migrate App1 to Azure. You need to recommend a compute solution for App1. The solution must meet the following requirements: • The solution must run multiple instances of App1. • The number of instances must be managed automatically depending on the load. • Administrative effort must be minimized. What should you include in the recommendation? Here are the options. Option A. Azure Batch. Option B. Azure App Service. Option C. Azure Kubernetes Service (AKS). Option D. Azure Virtual Machine Scale Sets. Pause the video now if you want time to think about the answer.
The correct answer is B. Azure App Service. App1 needs major changes to run in a container, which rules out the container platforms, and it is an interactive HTTPS application whose load varies through the day. Azure App Service runs Java applications natively on Linux, scales instances automatically against load rules, and is a managed platform with no operating system to patch, which is what minimises administrative effort. Now, why are the other options incorrect? Option A is incorrect. Azure Batch runs finite compute jobs. It is not a host for an interactive web application. Option C is incorrect. AKS requires the app to be containerised, which the scenario says would take major changes. Option D is incorrect. A virtual machine scale set would run the app and autoscale, but you then own the operating system, patching, and the runtime, which is far more administration than App Service. Therefore, B, Azure App Service, is the correct answer.
Play from 1:36:15 Question 43. You have an Azure subscription that contains a storage account. An application sometimes writes duplicate files to the storage account. You have a PowerShell script that identifies and deletes duplicate files in the storage account. Currently, the script is run manually after approval from the operations manager. You need to recommend a serverless solution that performs the following actions: • Runs the script once an hour to identify whether duplicate files exist • Sends an email notification to the operations manager requesting approval to delete the duplicate files • Processes an email response from the operations manager specifying whether the deletion was approved • Runs the script if the deletion was approved What should you include in the recommendation? Here are the options. Option A. Azure Logic Apps and Azure Event Grid. Option B. Azure Logic Apps and Azure Functions. Option C. Azure Pipelines and Azure Service Fabric. Option D. Azure Functions and Azure Batch. Pause the video now if you want time to think about the answer.
The correct answer is B. Azure Logic Apps and Azure Functions. Azure Logic Apps supplies the parts that involve waiting and approval: a recurrence trigger fires hourly, an approval email action sends the request to the operations manager and then waits for the reply, and a condition branches on the answer. Azure Functions is where the existing PowerShell script runs, called by the logic app both to detect duplicates and to delete them once approved. Both are serverless. Now, why are the other options incorrect? Option A is incorrect. Event Grid routes events as they occur. It provides neither an hourly schedule nor an approval wait. Option C is incorrect. Azure Pipelines is a CI/CD system and Service Fabric is a microservices platform. Neither is a serverless approval workflow. Option D is incorrect. Functions alone cannot wait days for an email reply, and Azure Batch is for large-scale compute jobs. Therefore, B, Azure Logic Apps and Azure Functions, is the correct answer.
Play from 1:38:48 Question 44. You have a production line that is monitored by using IoT devices. The devices use Message Queuing Telemetry Transport (MQTT) to transport monitoring data. You plan to deploy Azure IoT Edge runtimes in containers to process the messages. You need to recommend a cloud service solution that can process and analyze the data in Azure. The solution must minimize costs. What should you include in the recommendation? Here are the options. Option A. Azure Event Hubs standard tier. Option B. Azure IoT Hub basic tier. Option C. Azure IoT Hub standard tier. Option D. Azure Event Hubs premium tier. Pause the video now if you want time to think about the answer.
The correct answer is C. Azure IoT Hub standard tier. Azure IoT Edge devices are registered and managed through IoT Hub, which receives the MQTT telemetry they forward and routes it to services that process and analyze it in Azure. IoT Edge depends on module twins and deployment manifests, which are only available in the IoT Hub standard tier; the basic tier supports device-to-cloud telemetry but not IoT Edge, device twins, or cloud-to-device messaging. The standard tier is therefore the lowest-cost option that supports the planned IoT Edge runtimes. Now, why are the other options incorrect? Option A is incorrect. Azure Event Hubs has no device identity registry or IoT Edge deployment management, so it cannot manage the IoT Edge runtimes. Option B is incorrect. The IoT Hub basic tier does not support Azure IoT Edge, so the edge runtimes could not be deployed or managed. Option D is incorrect. Azure Event Hubs premium tier costs more and still provides no IoT Edge device management. Therefore, C, Azure IoT Hub standard tier, is the correct answer.
Play from 1:41:00 Question 45. You plan to deploy an Azure SQL database that will store Personally Identifiable Information (PII). You need to ensure that only privileged users can view the PII. What should you include in the solution? Here are the options. Option A. dynamic data masking. Option B. role-based access control (RBAC). Option C. Data Discovery & Classification. Option D. Transparent Data Encryption (TDE). Pause the video now if you want time to think about the answer.
The correct answer is A. dynamic data masking. Dynamic data masking hides sensitive values in the result of a query for users who are not authorised to see them, while privileged users see the real data. The data itself is unchanged on disk, so this is the control that lets ordinary users work with the table while personally identifiable information stays hidden from them. Now, why are the other options incorrect? Option B is incorrect. Role-based access control decides who can reach the database or the resource. It cannot show one user a masked column and another the real value. Option C is incorrect. Data Discovery and Classification finds and labels sensitive columns. It reports on where the data is rather than hiding it. Option D is incorrect. Transparent Data Encryption encrypts the data at rest. Any user who can query the database still sees the plaintext values. Therefore, A, dynamic data masking, is the correct answer.
Play from 1:42:52 Question 46. You are designing an application that will be hosted in Azure. The application will host video files that range from 50 MB to 12 GB. The application will use certificate-based authentication and will be available to users on the internet. You need to recommend a storage option for the video files. The solution must provide the fastest read performance and must minimize storage costs. What should you recommend? Here are the options. Option A. Azure Files. Option B. Azure Data Lake Storage Gen2. Option C. Azure Blob Storage. Option D. Azure SQL Database. Pause the video now if you want time to think about the answer.
The correct answer is C. Azure Blob Storage. Blob Storage is built for large unstructured objects, handles the 50 MB to 12 GB range comfortably as block blobs, serves them over HTTPS to internet users, and is the cheapest of these options per gigabyte with access tiers to tune cost further. That combination gives the fast reads and low storage cost the requirement asks for. Now, why are the other options incorrect? Option A is incorrect. Azure Files provides an SMB or NFS file share, which costs more per gigabyte and is aimed at applications expecting a file system rather than internet delivery. Option B is incorrect. Data Lake Storage Gen2 adds a hierarchical namespace for analytics workloads. That is overhead this scenario has no use for. Option D is incorrect. Azure SQL Database is a relational store. Holding multi-gigabyte video files in it would be both slow and far more expensive. Therefore, C, Azure Blob Storage, is the correct answer.
Play from 1:45:09 Question 47. You are developing an app that will use Azure Functions to process Azure Event Hubs events. Request processing is estimated to take between five and 20 minutes. You need to recommend a hosting solution that meets the following requirements: • Supports estimates of request processing runtimes • Supports event-driven autoscaling for the app Which hosting plan should you recommend? Here are the options. Option A. Dedicated. Option B. Consumption. Option C. App Service. Option D. Premium. Pause the video now if you want time to think about the answer.
The correct answer is D. Premium. Processing that can take up to 20 minutes exceeds the Consumption plan's default timeout, and the Premium plan removes that limit while keeping the event-driven scaling that the Event Hubs trigger relies on. It also avoids cold starts, so it satisfies both the long runtime and the autoscaling requirement. Now, why are the other options incorrect? Option A is incorrect. The Dedicated plan can run long executions but scales on App Service rules rather than on the event source. Option B is incorrect. The Consumption plan caps a single execution at ten minutes, which is short of the estimated processing time. Option C is incorrect. An App Service plan has the same limitation as Dedicated: it does not autoscale in response to the event backlog. Therefore, D, Premium, is the correct answer.
Play from 1:46:52 Question 48. You are developing an app that will read activity logs for an Azure subscription by using Azure Functions. You need to recommend an authentication solution for Azure Functions. The solution must minimize administrative effort. What should you include in the recommendation? Here are the options. Option A. an enterprise application in Azure AD. Option B. system-assigned managed identities. Option C. shared access signatures (SAS). Option D. application registration in Azure AD. Pause the video now if you want time to think about the answer.
The correct answer is B. system-assigned managed identities. A system-assigned managed identity is enabled on the function app itself, and Azure creates and rotates the credential automatically. Granting that identity the Reader role on the subscription lets the function read the activity logs with no secret to store, no application registration to maintain, and no expiry to track, which is the minimum administrative effort. Now, why are the other options incorrect? Option A is incorrect. An enterprise application represents a service instance in the directory. It still needs credentials configured and managed. Option C is incorrect. Shared access signatures authorise access to storage resources. They do not authenticate a caller to the Azure management API. Option D is incorrect. An application registration requires a secret or certificate that has to be stored and rotated, which is exactly the overhead a managed identity removes. Therefore, B, system-assigned managed identities, is the correct answer.
Play from 1:48:51 Question 49. You have five datacenters across North America and Europe. You have an Azure subscription. You need to recommend a solution to provide connectivity between the datacenters and Azure. The solution must meet the following requirements: ● Ensure that apps hosted in a datacenter can access the resources hosted in Azure and the other datacenters. ● Ensure that apps hosted in Azure can access the resources hosted in the datacenters. ● Support the central management of network routes. ● Support the central management of firewall rules. ● Minimize administrative effort. What should you include in the recommendation? Here are the options. Option A. ExpressRoute. Option B. Azure VPN Gateway. Option C. Azure Front Door. Option D. Azure Virtual WAN. Pause the video now if you want time to think about the answer.
The correct answer is D. Azure Virtual WAN. Azure Virtual WAN provides Microsoft-managed virtual hubs that terminate site-to-site VPN and ExpressRoute connections from all five datacenters and connect Azure virtual networks, with any-to-any transit between them. Hubs in North America and Europe are interconnected automatically, so datacenters can reach Azure and each other, and Azure workloads can reach the datacenters. Routing is managed centrally through hub route tables, and deploying Azure Firewall in secured virtual hubs with Azure Firewall Manager centralizes firewall rules. Because Microsoft operates the hub infrastructure, there is far less to build and maintain than a self-managed hub and spoke design, which minimizes administrative effort. Now, why are the other options incorrect? Option A is incorrect. ExpressRoute by itself is a private circuit into Azure. It provides no central management of firewall rules and needs a separately built and maintained hub for transit routing. Option B is incorrect. Azure VPN Gateway connects sites to a single virtual network. Transit between datacenters and central route and firewall management would require manually building and maintaining a hub network. Option C is incorrect. Azure Front Door is a global HTTP and HTTPS entry point for web applications. It does not provide network connectivity between datacenters and Azure virtual networks. Therefore, D, Azure Virtual WAN, is the correct answer.
Play from 1:51:41 Question 50. You have an app named App1 that uses two on-premises Microsoft SQL Server databases named DB1 and DB2. You plan to migrate DB1 and DB2 to Azure You need to recommend an Azure solution to host DB1 and DB2. The solution must meet the following requirements: • Support server-side transactions across DB1 and DB2. • Minimize administrative effort to update the solution. What should you recommend? Here are the options. Option A. two Azure SQL databases in an elastic pool. Option B. two databases on the same Azure SQL managed instance. Option C. two databases on the same SQL Server instance on an Azure virtual machine. Option D. two Azure SQL databases on different Azure SQL Database servers. Pause the video now if you want time to think about the answer.
The correct answer is B. two databases on the same Azure SQL managed instance. Server-side transactions spanning two databases require both databases to live inside one instance. Azure SQL Managed Instance supports cross-database queries and distributed transactions between databases on the same instance, and because it is a managed service, patching, backups, and high availability are handled for you, which keeps the administrative effort down. Now, why are the other options incorrect? Option A is incorrect. Databases in an elastic pool are still separate Azure SQL databases and cannot take part in a server-side transaction with each other. Option C is incorrect. Two databases on one SQL Server instance on a virtual machine would support the transactions, but you then own the operating system, patching, and backups. Option D is incorrect. Databases on different logical servers are even further apart and cannot share a transaction. Therefore, B, two databases on the same Azure SQL managed instance, is the correct answer.
Play from 1:54:09 Question 51. You have 100 devices that write performance data to Azure Blob Storage. You plan to store and analyze the performance data in an Azure SQL database. You need to recommend a solution to continually copy the performance data to the Azure SQL database. What should you include in the recommendation? Here are the options. Option A. Azure Data Factory. Option B. Data Migration Assistant (DMA). Option C. Azure Data Box. Option D. Azure Database Migration Service. Pause the video now if you want time to think about the answer.
The correct answer is A. Azure Data Factory. Azure Data Factory is the managed data movement service. A pipeline with a copy activity reads the performance data from Blob Storage and writes it to the Azure SQL database, and a schedule or tumbling window trigger keeps it running continually as new data arrives from the devices. Now, why are the other options incorrect? Option B is incorrect. Data Migration Assistant assesses databases before a one-time migration. Option C is incorrect. Azure Data Box is a physical appliance for shipping bulk data into Azure once. Option D is incorrect. Database Migration Service performs one-time or continuous migration between database engines, not a copy from blob storage into SQL. Therefore, A, Azure Data Factory, is the correct answer.
Play from 1:55:55 Question 52. You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory domain. Your company has a line-of-business (LOB) application that was developed internally. You need to implement SAML single sign-on (SSO) and enforce multi-factor authentication (MFA) when users attempt to access the application from an unknown location. Which two features should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. Azure AD Privileged Identity Management (PIM). Option B. Azure Application Gateway. Option C. Azure AD enterprise applications. Option D. Azure AD Identity Protection. Option E. Conditional Access policies. Pause the video now if you want time to think about the answer.
The correct answers are C. Azure AD enterprise applications, and E. Conditional Access policies. Two things are needed. The internally developed application has to be represented in the directory before Azure AD can issue SAML assertions for it, which is what registering it as an Azure AD enterprise application does, and the SAML SSO settings are configured there. A Conditional Access policy then supplies the second requirement, using the locations condition to require multi-factor authentication whenever the sign-in comes from a location that is not trusted. Now, why are the other options incorrect? Option A is incorrect. Privileged Identity Management provides just-in-time activation for privileged directory roles, which has nothing to do with SSO to a business application. Option B is incorrect. Application Gateway is a layer 7 load balancer. It is not an identity provider and issues no SAML assertions. Option D is incorrect. Identity Protection evaluates risk signals such as impossible travel or leaked credentials. Enforcing MFA by location is a Conditional Access condition, not an Identity Protection one. Therefore, C and E are the correct answers.
Play from 1:58:24 Question 53. You have an Azure subscription that contains an Azure Service Bus Premium namespace named Namespace1 and an Azure Event Grid custom topic named Topic1. You need to route events from Namespace1 to Topic1. What should you create first in Event Grid? Here are the options. Option A. a system topic. Option B. a partner topic. Option C. a message. Option D. a domain. Pause the video now if you want time to think about the answer.
The correct answer is A. a system topic. Events published by Azure services, including Azure Service Bus Premium namespaces, are exposed in Event Grid through system topics. To route events from Namespace1, you first create a system topic for the namespace as the event source, and then add an event subscription on that system topic that filters the Service Bus events and delivers them to the destination. Custom topics are used only for events published by your own applications, so the Service Bus events must enter Event Grid through a system topic before they can be routed. Now, why are the other options incorrect? Option B is incorrect. Partner topics receive events from third-party SaaS providers integrated with Event Grid, not from Azure services such as Service Bus. Option C is incorrect. A message is not an Event Grid resource that you create to configure routing; events are generated by the source service. Option D is incorrect. An Event Grid domain manages large numbers of custom topics for application-published events and does not act as a source for Service Bus events. Therefore, A, a system topic, is the correct answer.
Play from 2:00:25 Question 54. You have an Azure subscription. You plan to deploy an app named App1 that will be hosted on multiple virtual machines. App1 requires a service-level agreement (SLA) of 99.99%. You need to recommend a high availability solution for the virtual machines. What should you include in the recommendation? Here are the options. Option A. Azure Site Recovery. Option B. availability zones. Option C. application groups. Option D. availability sets. Pause the video now if you want time to think about the answer.
The correct answer is B. availability zones. Microsoft offers a 99.99 percent virtual machine connectivity SLA when two or more instances are deployed across two or more availability zones in the same region. Each zone is a physically separate datacenter location with independent power, cooling, and networking, so the loss of an entire datacenter leaves the other instances of App1 running. Placing the App1 virtual machines in availability zones is therefore the high availability design that meets the required SLA. Now, why are the other options incorrect? Option A is incorrect. Azure Site Recovery replicates virtual machines for disaster recovery failover and does not provide a 99.99 percent availability SLA for running instances. Option C is incorrect. Application groups are an Azure Virtual Desktop construct for publishing apps and desktops, not a virtual machine availability feature. Option D is incorrect. Availability sets spread VMs across fault and update domains within one datacenter and carry a 99.95 percent SLA, which is below the 99.99 percent requirement. Therefore, B, availability zones, is the correct answer.
Play from 2:02:39 Question 55. You are designing a SQL database solution. The solution will include 20 databases that will be 20 GB each and have varying usage patterns. You need to recommend a database platform to host the databases. The solution must meet the following requirements: • The solution must meet a Service Level Agreement (SLA) of 99.99% uptime. • The compute resources allocated to the databases must scale dynamically. • The solution must have reserved capacity. Compute charges must be minimized. What should you include in the recommendation? Here are the options. Option A. an elastic pool that contains 20 Azure SQL databases. Option B. 20 databases on a Microsoft SQL server that runs on an Azure virtual machine in an availability set. Option C. 20 databases on a Microsoft SQL server that runs on an Azure virtual machine. Option D. 20 instances of Azure SQL Database serverless. Pause the video now if you want time to think about the answer.
The correct answer is A. an elastic pool that contains 20 Azure SQL databases. Twenty databases of 20 GB with varying usage patterns is the textbook case for an elastic pool: the databases share a pool of compute, so a quiet database releases capacity to a busy one and the total compute purchased is far less than provisioning each database separately. Azure SQL Database carries a 99.99 percent SLA, and reserved capacity can be purchased against the pool to minimise the compute charge. Now, why are the other options incorrect? Option B is incorrect. SQL Server on a virtual machine in an availability set gives a 99.95 percent SLA, which falls short of the requirement, and compute does not scale dynamically across the databases. Option C is incorrect. A single virtual machine has an even lower SLA and no dynamic scaling between databases. Option D is incorrect. Twenty serverless databases each scale independently but cannot share capacity with each other, and serverless is not eligible for reserved capacity. Therefore, A, an elastic pool that contains 20 Azure SQL databases, is the correct answer.
Play from 2:05:21 Question 56. You plan to develop, deploy, and maintain 100 React-based web apps that will NOT require server-side rendering. You need to recommend a hosting solution for the apps. The solution must meet the following requirements: • Automatically deploy new versions of the apps when changes to the apps' source code are committed in Azure Repos. • Automatically stage a preview version of an app when a pull request is processed. • Support Azure API Management by using the /api path. • Minimize costs. What should you include in the recommendation? Here are the options. Option A. Azure Blob Storage static sites. Option B. Azure App Service web apps. Option C. an Azure function. Option D. Azure Static Web Apps. Pause the video now if you want time to think about the answer.
The correct answer is D. Azure Static Web Apps. Azure Static Web Apps is built for client-rendered frameworks such as React. It connects to a repository in Azure Repos through an Azure Pipelines task, so every commit triggers an automatic build and deployment, and it can stage a pre-production environment for a pull request (with Azure Repos, by configuring a named environment in the pipeline) so changes are reviewed before they reach production. Requests to the /api route can be served by a linked backend, including Azure API Management, without any extra proxy configuration. Because the static content is served from a globally distributed platform with a Free plan and a low-cost Standard plan, hosting 100 apps this way costs far less than running compute for each app. Now, why are the other options incorrect? Option A is incorrect. Blob Storage static websites only serve files; they provide no built-in pull request preview environments and no /api route integration with API Management. Option B is incorrect. App Service web apps run dedicated compute that is unnecessary for apps without server-side rendering, so hosting 100 apps this way does not minimize costs. Option C is incorrect. Azure Functions runs event-driven backend code and is not a hosting platform for a React front end with commit-based deployment and pull request previews. Therefore, D, Azure Static Web Apps, is the correct answer.
Play from 2:08:06 Question 57. You plan to move a web app named App1 from an on-premises datacenter to Azure. App1 depends on a custom COM component that is installed on the host server. You need to recommend a solution to host App1 in Azure. The solution must meet the following requirements: • App1 must be available to users if an Azure datacenter becomes unavailable. • Costs must be minimized. What should you include in the recommendation? Here are the options. Option A. In two Azure regions, deploy a load balancer and a web app. Option B. In two Azure regions, deploy a load balancer and a virtual machine scale set. Option C. Deploy a load balancer and a virtual machine scale set across two availability zones. Option D. In two Azure regions, deploy an Azure Traffic Manager profile and a web app. Pause the video now if you want time to think about the answer.
The correct answer is C. Deploy a load balancer and a virtual machine scale set across two availability zones. The custom COM component has to be registered on the host, which rules out App Service and forces virtual machines. The requirement is only that the app survives a datacenter becoming unavailable, and an availability zone is a physically separate datacenter within a region. Spreading a scale set across two zones behind a load balancer therefore meets the availability requirement at a much lower cost than running a second region. Now, why are the other options incorrect? Option A is incorrect. A web app cannot host a custom COM component that must be installed on the server. Option B is incorrect. Two regions would work but is more expensive than two zones, and the requirement only calls for surviving a datacenter failure. Option D is incorrect. This again relies on web apps, which cannot host the COM component. Therefore, C, Deploy a load balancer and a virtual machine scale set across two availability zones, is the correct answer.
Play from 2:10:37 Question 58. You need to recommend a storage solution for the records of a mission critical application. The solution must provide a Service Level Agreement (SLA) for the latency of write operations and the throughput. What should you include in the recommendation? Here are the options. Option A. Azure Data Lake Storage Gen2. Option B. Azure Blob Storage. Option C. Azure SQL. Option D. Azure Cosmos DB. Pause the video now if you want time to think about the answer.
The correct answer is D. Azure Cosmos DB. Azure Cosmos DB is the only Azure data service whose SLA covers latency and throughput as well as availability. It guarantees single-digit millisecond latency at the 99th percentile for reads and writes and guarantees the provisioned throughput, which is what a mission critical application with a write latency commitment needs. Now, why are the other options incorrect? Option A is incorrect. Data Lake Storage Gen2 has an availability SLA but makes no latency or throughput guarantee. Option B is incorrect. Blob Storage likewise carries an availability SLA only. Option C is incorrect. Azure SQL guarantees uptime but does not commit to a write latency figure or a throughput level. Therefore, D, Azure Cosmos DB, is the correct answer.
Play from 2:12:24 Question 59. You have an application that is used by 6,000 users to validate their vacation requests. The application manages its own credential store. Users must enter a username and password to access the application. The application does NOT support identity providers. You plan to upgrade the application to use single sign-on (SSO) authentication by using an Azure Active Directory (Azure AD) application registration. Which SSO method should you use? Here are the options. Option A. header-based. Option B. SAML. Option C. password-based. Option D. OpenID Connect. Pause the video now if you want time to think about the answer.
The correct answer is C. password-based. The application manages its own credential store and supports no identity provider, so it cannot be changed to accept a federated token. Password-based SSO is the method for exactly that case: Azure AD stores the credentials for each user and replays them into the app's own sign-in form, so users get single sign-on without the application being modified. Now, why are the other options incorrect? Option A is incorrect. Header-based SSO requires the app to trust an HTTP header for identity, which is a change to how it authenticates. Option B is incorrect. SAML requires the application to act as a service provider and consume assertions, which an app with no identity provider support cannot do. Option D is incorrect. OpenID Connect likewise requires the application to implement a federation protocol. Therefore, C, password-based, is the correct answer.
Play from 2:14:24 Question 60. You have SQL Server on an Azure virtual machine. The databases are written to nightly as part of a batch process. You need to recommend a disaster recovery solution for the data. The solution must meet the following requirements: • Provide the ability to recover in the event of a regional outage. • Support a recovery time objective (RTO) of 15 minutes. • Support a recovery point objective (RPO) of 24 hours. • Support automated recovery. • Minimize costs. What should you include in the recommendation? Here are the options. Option A. Azure virtual machine availability sets. Option B. Azure Disk Backup. Option C. an Always On availability group. Option D. Azure Site Recovery. Pause the video now if you want time to think about the answer.
The correct answer is D. Azure Site Recovery. Site Recovery replicates the whole virtual machine to a second region and can fail it over with an automated recovery plan, which covers the regional outage, the automation requirement, and an RTO well inside 15 minutes. Because the databases are only written nightly, the generous 24 hour RPO is easily met, and replication is far cheaper than running a second live SQL environment. Now, why are the other options incorrect? Option A is incorrect. An availability set protects against failures inside a single datacenter. It offers nothing when the whole region is lost. Option B is incorrect. Azure Disk Backup takes disk snapshots. Restoring from them is a manual rebuild, so neither the RTO nor the automation requirement is met. Option C is incorrect. An Always On availability group across regions would meet the objectives but requires a second running SQL environment plus cluster configuration, which costs more and adds administration the batch workload does not justify. Therefore, D, Azure Site Recovery, is the correct answer.
Play from 2:16:42 Question 61. You have an on-premises line-of-business (LOB) application that uses a Microsoft SQL Server instance as the backend. You plan to migrate the on-premises SQL Server instance to Azure virtual machines. You need to recommend a highly available SQL Server deployment that meets the following requirements: • Minimizes costs Minimizes failover time if a single server fails What should you include in the recommendation? Here are the options. Option A. an Always On availability group that has premium storage disks and a virtual network name (VNN). Option B. an Always On Failover Cluster Instance that has a virtual network name (VNN) and a standard file share. Option C. an Always On availability group that has premium storage disks and a distributed network name (DNN). Option D. an Always On Failover Cluster Instance that has a virtual network name (VNN) and a premium file share. Pause the video now if you want time to think about the answer.
The correct answer is C. an Always On availability group that has premium storage disks and a distributed network name (DNN). An availability group keeps a synchronous secondary with its own copy of the data on locally attached premium disks, so failover is fast and no shared storage is needed. Using a distributed network name rather than a virtual network name removes the Azure Load Balancer that a VNN listener requires, which cuts both the cost and the failover time, since clients connect straight to the replica rather than waiting for a load balancer probe to move the endpoint. Now, why are the other options incorrect? Option A is incorrect. A virtual network name listener needs an internal load balancer in front of it, which adds cost and slows failover compared with a DNN. Option B is incorrect. A failover cluster instance depends on shared storage, and a standard file share cannot deliver the performance a SQL Server workload needs. Option D is incorrect. A failover cluster instance on a premium file share still fails over by remounting shared storage on the other node, which takes longer than an availability group failover. Therefore, C, an Always On availability group that has premium storage disks and a distributed network name (DNN), is the correct answer.
Play from 2:19:26 Question 62. You have an on-premises sales app named App1 that notifies users when orders are created or deleted. When an order is created or deleted, App1 immediately sends an email notification. You plan to migrate App1 to Azure. After the migration, order creation and deletion operations will be submitted to an Azure endpoint by using another app. You need to recommend a solution that will trigger the email workflow immediately when an order is created or deleted. The solution must minimize costs. What should you include in the recommendation? Here are the options. Option A. Azure Container Apps. Option B. Azure Functions. Option C. Azure Kubernetes Service (AKS). Option D. Azure WebJobs. Pause the video now if you want time to think about the answer.
The correct answer is B. Azure Functions. Azure Functions runs code in response to events, so an HTTP-triggered function can act as the Azure endpoint that receives order creation and deletion requests from the other app and immediately start the email workflow. On the Consumption plan you pay only for executions and resources used, and the platform scales automatically, so there is no idle compute to pay for between orders. This serverless, event-driven model meets the requirement to trigger notifications immediately while minimizing costs. Now, why are the other options incorrect? Option A is incorrect. Azure Container Apps requires packaging and running the notification logic as a container, which adds more overhead than a single function for a simple event-triggered task. Option C is incorrect. Azure Kubernetes Service requires a continuously running cluster of nodes, which is far more expensive and complex than needed to send email notifications. Option D is incorrect. Azure WebJobs run inside an App Service plan that is billed whether or not orders arrive, so they cost more than a consumption-based function. Therefore, B, Azure Functions, is the correct answer.
Play from 2:21:53 Question 63. You have an Azure subscription that contains an Azure Cosmos DB for NoSQL account named account1 and an Azure Synapse Analytics workspace named Workspace1. The account1 account contains a container named Contained that has the analytical store enabled. You need to recommend a solution that will process the data stored in Contained in near-real-time (NRT) and output the results to a data warehouse in Workspace1 by using a runtime engine in the workspace. The solution must minimize data movement. Which pool in Workspace1 should you use? Here are the options. Option A. Apache Spark. Option B. serverless SQL. Option C. dedicated SQL. Option D. Data Explorer. Pause the video now if you want time to think about the answer.
The correct answer is A. Apache Spark. Synapse Link exposes the Cosmos DB analytical store to the workspace, and an Apache Spark pool is the runtime engine that can read it directly, process the records in near real time, and write the results into a dedicated SQL pool acting as the data warehouse. Because Spark reads the analytical store in place, the data is not copied out first, which is what minimises data movement. Now, why are the other options incorrect? Option B is incorrect. Serverless SQL can query the analytical store but it is a query service over data in place and is not the runtime engine for writing results into a data warehouse. Option C is incorrect. A dedicated SQL pool is the data warehouse that receives the output. It is the destination rather than the engine that processes the Cosmos DB data. Option D is incorrect. A Data Explorer pool is for log and telemetry analytics and does not read the Cosmos DB analytical store through Synapse Link. Therefore, A, Apache Spark, is the correct answer.
Play from 2:24:09 Question 64. You have an Azure subscription that contains 10 Azure SQL databases in an elastic pool. Each database is 600 GB. You need to ensure that you can increase the size of each database to 15 TB. The solution must minimize database downtime. What should you do? Here are the options. Option A. Enable geo-replication for each database. Option B. Remove the elastic pool. Update each database to the Hyperscale service tier. Option C. Update the elastic pool to the Premium service tier. Option D. Remove the elastic pool. Update each database to the Business Critical service tier. Pause the video now if you want time to think about the answer.
The correct answer is B. Remove the elastic pool. Update each database to the Hyperscale service tier. Each database must grow to 15 TB, which exceeds the maximum size of the General Purpose and Business Critical service tiers (4 TB) and of the DTU-based tiers. The Hyperscale service tier uses a distributed architecture in which compute is separated from page servers that hold the data, so a single database can grow up to 128 TB. Moving each database out of the pool and converting it to Hyperscale is an online operation: the database remains available during the data copy and only a brief disconnection occurs at the final cutover, which keeps downtime to a minimum. Now, why are the other options incorrect? Option A is incorrect. Geo-replication creates readable secondaries for disaster recovery and does not raise the maximum database size. Option C is incorrect. The Premium tier caps database size well below 15 TB, so the databases still could not grow to the required size. Option D is incorrect. Business Critical databases are limited to 4 TB, which is far below the 15 TB requirement. Therefore, B, Remove the elastic pool. Update each database to the Hyperscale service tier, is the correct answer.
Play from 2:26:35 Question 65. You have an Azure subscription. You need to recommend an Azure Kubernetes Service (AKS) solution that will use Linux nodes. The solution must meet the following requirements: • Minimize the time it takes to provision compute resources during scale-out operations. • Support autoscaling of Linux containers. • Minimize administrative effort. Which scaling option should you recommend? Here are the options. Option A. horizontal pod autoscaler. Option B. cluster autoscaler. Option C. virtual nodes. Option D. Virtual Kubelet. Pause the video now if you want time to think about the answer.
The correct answer is C. virtual nodes. Virtual nodes schedule pods onto Azure Container Instances instead of onto cluster virtual machines, so a pod starts in seconds with no node to provision. That is the fastest scale-out available, it supports Linux containers, and because there is no node pool to size or patch for that capacity, it is also the lowest administrative effort. Now, why are the other options incorrect? Option A is incorrect. The horizontal pod autoscaler scales replicas within existing capacity and cannot add compute. Option B is incorrect. The cluster autoscaler works but has to provision a whole virtual machine and join it to the cluster, which is minutes rather than seconds. Option D is incorrect. Virtual Kubelet is the underlying open source project. In AKS the supported, managed form of it is the virtual nodes feature. Therefore, C, virtual nodes, is the correct answer.
Play from 2:28:36 Question 66. You are designing a microservices architecture that will be hosted in an Azure Kubernetes Service (AKS) cluster. Apps that will consume the microservices will be hosted on Azure virtual machines. The virtual machines and the AKS cluster will reside on the same virtual network. You need to design a solution to expose the microservices to the consumer apps. The solution must meet the following requirements: • Ingress access to the microservices must be restricted to a single private IP address and protected by using mutual TLS authentication. • The number of incoming microservice calls must be rate-limited. • Costs must be minimized. What should you include in the solution? Here are the options. Option A. Azure App Gateway with Azure Web Application Firewall (WAF). Option B. Azure API Management Standard tier with a service endpoint. Option C. Azure Front Door with Azure Web Application Firewall (WAF). Option D. Azure API Management Premium tier with virtual network connection. Pause the video now if you want time to think about the answer.
The correct answer is D. Azure API Management Premium tier with virtual network connection. Only the Premium tier of API Management supports full virtual network injection, which places the gateway inside the virtual network with a single private IP address and no public exposure. API Management also terminates mutual TLS by validating client certificates, and its rate-limit policies cap the number of incoming calls, so all three functional requirements are met by one service. Now, why are the other options incorrect? Option A is incorrect. Application Gateway with WAF can do mutual TLS but has no built-in per-consumer rate limiting for API calls. Option B is incorrect. A service endpoint keeps traffic on the Azure backbone but does not give the gateway a private IP inside the virtual network, so the ingress would still be public. Option C is incorrect. Front Door is a global public entry point, which is the opposite of restricting ingress to a single private address. Therefore, D, Azure API Management Premium tier with virtual network connection, is the correct answer.
Play from 2:31:08 Question 67. You have multiple Azure subscriptions. You need to ensure that you are notified of planned maintenance in your Azure region if the maintenance will affect the resources in the subscriptions. The solution must minimize administrative effort. What should you use? Here are the options. Option A. Azure Monitor. Option B. Microsoft Defender for Cloud. Option C. Azure Advisor. Option D. Azure Service Health. Pause the video now if you want time to think about the answer.
The correct answer is D. Azure Service Health. Azure Service Health gives a personalized view of service issues, planned maintenance, and health advisories that affect the resources and regions you actually use. You can create Service Health alerts for the planned maintenance event type, scoped to the relevant subscriptions, regions, and services, and route them through action groups to email, SMS, push notifications, or webhooks. Because Service Health already filters events to your own resources and alerts are configured once per subscription with no custom queries or code, it meets the requirement with the least administrative effort. Now, why are the other options incorrect? Option A is incorrect. Azure Monitor provides metrics, logs, and alerting for resource telemetry, but planned maintenance events are surfaced through Service Health rather than through general Azure Monitor configuration. Option B is incorrect. Defender for Cloud assesses security posture and detects threats; it does not announce planned platform maintenance. Option C is incorrect. Azure Advisor gives best-practice recommendations for cost, reliability, security, and performance, not notifications of upcoming regional maintenance. Therefore, D, Azure Service Health, is the correct answer.
Play from 2:33:13 Question 68. You have an Azure subscription that contains an Azure Blob Storage account named store1. You have an on-premises file server named Server1 that runs Windows Server 2016. Server1 stores 500 GB of company files. You need to store a copy of the company files from Server1 in store1. Which two possible Azure services achieve this goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. an Azure Logic Apps integration account. Option B. an Azure Import/Export job. Option C. Azure Data Factory. Option D. an Azure Analysis services On-premises data gateway. Option E. an Azure Batch account. Pause the video now if you want time to think about the answer.
The correct answers are B. an Azure Import/Export job, and C. Azure Data Factory. Both options move bulk file data from an on-premises server into a blob container as a complete solution. An Azure Import/Export job ships the data physically on disks and Microsoft loads it into the account, and Azure Data Factory copies it over the network using a self-hosted integration runtime installed on the on-premises network. Either one gets the 500 GB into store1. Now, why are the other options incorrect? Option A is incorrect. An integration account stores B2B artifacts such as trading partners and schemas for Logic Apps. It is not a data transfer mechanism. Option D is incorrect. An on-premises data gateway lets Azure services query on-premises sources for reporting. It does not copy files into a storage account. Option E is incorrect. Azure Batch runs large-scale compute jobs. It is not a data movement service. Therefore, B and C are the correct answers.
Play from 2:35:29 Question 69. You need to design a solution that will execute custom C# code in response to an event routed to Azure Event Grid. The solution must meet the following requirements: • The executed code must be able to access the private IP address of a Microsoft SQL Server instance that runs on an Azure virtual machine. • Costs must be minimized. What should you include in the solution? Here are the options. Option A. Azure Logic Apps in the Consumption plan. Option B. Azure Functions in the Premium plan. Option C. Azure Functions in the Consumption plan. Option D. Azure Logic Apps in the integrated service environment. Pause the video now if you want time to think about the answer.
The correct answer is B. Azure Functions in the Premium plan. Reaching a private IP address inside a virtual network requires virtual network integration, which the Consumption plan for Functions does not provide. The Premium plan does, while keeping the serverless programming model and event-driven scale, so it can run the C# handler for the Event Grid event and connect privately to the SQL Server instance. Among the options that can reach the private address, it is the cheapest. Now, why are the other options incorrect? Option A is incorrect. Logic Apps in the Consumption plan cannot run custom C# code and has no virtual network integration. Option C is incorrect. The Consumption plan for Functions runs the code but cannot join a virtual network, so the private IP is unreachable. Option D is incorrect. An integration service environment gives Logic Apps virtual network access but is markedly more expensive and still does not execute custom C#. Therefore, B, Azure Functions in the Premium plan, is the correct answer.
Play from 2:37:39 Question 70. You have an on-premises network and an Azure subscription. The on-premises network has several branch offices. A branch office in Toronto contains a virtual machine named VM1 that is configured as a file server. Users access the shared files on VM1 from all the offices. You need to recommend a solution to ensure that the users can access the shared files as quickly as possible if the Toronto branch office is inaccessible. What should you include in the recommendation? Here are the options. Option A. a Recovery Services vault and Windows Server Backup. Option B. Azure blob containers and Azure File Sync. Option C. a Recovery Services vault and Azure Backup. Option D. an Azure file share and Azure File Sync. Pause the video now if you want time to think about the answer.
The correct answer is D. an Azure file share and Azure File Sync. An Azure file share holds the authoritative copy of the data in the cloud, and Azure File Sync keeps servers in the branch offices synchronised with it. If the Toronto office becomes unreachable the file share and the other synced endpoints still hold the data, so users continue to work, and because each office has a local cache they get fast access rather than pulling everything across the network. Now, why are the other options incorrect? Option A is incorrect. Windows Server Backup with a Recovery Services vault protects the data but recovery is a restore operation, so users cannot simply carry on working. Option B is incorrect. Azure File Sync synchronises with an Azure file share, not with blob containers, so this pairing does not work. Option C is incorrect. Azure Backup again provides recovery of data rather than continuous availability of the shares. Therefore, D, an Azure file share and Azure File Sync, is the correct answer.
Play from 2:40:01 Question 71. You have a landing zone that contains multiple Azure subscriptions. You need to automate the deployment of resources to the subscriptions. The solution must meet the following requirements: • Support parameters. • Support versioning and source control. Which two options can you use? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. Azure Policy. Option B. Azure Automation. Option C. Azure Resource Manager (ARM) templates. Option D. Bicep files. Option E. Azure Functions. Pause the video now if you want time to think about the answer.
The correct answers are C. Azure Resource Manager (ARM) templates, and D. Bicep files. ARM templates and Bicep files are declarative infrastructure-as-code definitions for Azure resources. Both support parameters, so the same definition can be deployed to different subscriptions with environment-specific values, and both are plain text files that can be stored in a Git repository for versioning, pull request review, and source control. They can be deployed at subscription and management group scope and integrated into Azure Pipelines or GitHub Actions to automate deployments across a landing zone. Bicep compiles to an ARM template, so either option is a complete solution. Now, why are the other options incorrect? Option A is incorrect. Azure Policy evaluates and enforces rules on resources; it is a governance tool, not a parameterized, version-controlled deployment mechanism for the resources themselves. Option B is incorrect. Azure Automation runs runbooks for operational tasks; it is not a declarative deployment format designed for versioned resource definitions. Option E is incorrect. Azure Functions runs event-driven application code and is not a resource deployment technology. Therefore, C and D are the correct answers.
Play from 2:42:23 Question 72. You plan to deploy an application named App1 that will run on five Azure virtual machines. Additional virtual machines will be deployed later to run App1. You need to recommend a solution to meet the following requirements for the virtual machines that will run App1: • Ensure that the virtual machines can authenticate to Azure Active Directory (Azure AD) to gain access to an Azure key vault, Azure Logic Apps instances, and an Azure SQL database. • Avoid assigning new roles and permissions for Azure services when you deploy additional virtual machines. • Avoid storing secrets and certificates on the virtual machines. • Minimize administrative effort for managing identities. Which type of identity should you include in the recommendation? Here are the options. Option A. a system-assigned managed identity. Option B. a service principal that is configured to use a certificate. Option C. a service principal that is configured to use a client secret. Option D. a user-assigned managed identity. Pause the video now if you want time to think about the answer.
The correct answer is D. a user-assigned managed identity. A user-assigned managed identity is created once as its own resource, granted the required access to the key vault, the logic apps, and the SQL database once, and then attached to each virtual machine that runs App1. Adding a machine later means attaching the existing identity, with no new role assignments to make. Azure manages the credential, so nothing is stored on the machines. Now, why are the other options incorrect? Option A is incorrect. A system-assigned identity is tied to one virtual machine and dies with it, so every additional machine would need its own set of role assignments. Option B is incorrect. A service principal using a certificate means placing and rotating a certificate on each machine, which the requirements forbid. Option C is incorrect. A service principal using a client secret likewise requires storing a secret on the machines and managing its expiry. Therefore, D, a user-assigned managed identity, is the correct answer.
Play from 2:44:54 Question 73. You have an on-premises storage solution. You need to migrate the solution to Azure. The solution must support Hadoop Distributed File System (HDFS). What should you use? Here are the options. Option A. Azure Data Lake Storage Gen2. Option B. Azure NetApp Files. Option C. Azure Data Share. Option D. Azure Table storage. Pause the video now if you want time to think about the answer.
The correct answer is A. Azure Data Lake Storage Gen2. Azure Data Lake Storage Gen2 adds a hierarchical namespace to Blob Storage and exposes an ABFS driver that is compatible with the Hadoop Distributed File System, so Hadoop and Spark workloads read and write it as though it were HDFS. That is exactly the compatibility the migration requires. Now, why are the other options incorrect? Option B is incorrect. Azure NetApp Files serves NFS and SMB shares. It is not an HDFS-compatible store. Option C is incorrect. Azure Data Share is a service for sharing data with external organisations, not a storage platform. Option D is incorrect. Table storage is a key-value store with no file system semantics at all. Therefore, A, Azure Data Lake Storage Gen2, is the correct answer.
Play from 2:46:39 Question 74. You have an on-premises VMware environment that contains a vCenter instance. You have an Azure subscription. You need to recommend a solution to migrate the virtual machines from the VMware environment to Azure. The solution must meet the following requirements: • Make configuration recommendations for the Azure virtual machines. • Ensure access to the on-premises VMware environment. • Estimate Azure workload costs. • Minimize administrative effort. What should you include in the recommendation? Here are the options. Option A. Microsoft Assessment and Planning (MAP) Toolkit. Option B. Azure Monitor for VM insights. Option C. Azure VMware Solution. Option D. Azure Migrate. Pause the video now if you want time to think about the answer.
The correct answer is D. Azure Migrate. Azure Migrate is the central hub for discovering, assessing, and migrating on-premises servers to Azure. For VMware, you deploy the Azure Migrate appliance in the vCenter environment, which connects to vCenter Server to discover virtual machines agentlessly and collect configuration and performance data. The assessment uses that data to recommend Azure virtual machine sizes and disk types and to estimate monthly compute and storage costs. The same project can then perform agentless migration of the VMware virtual machines to Azure. Because discovery, assessment, cost estimation, and migration run from one integrated service without installing agents on each server, it minimizes administrative effort. Now, why are the other options incorrect? Option A is incorrect. The MAP Toolkit is a legacy, locally installed inventory tool. It does not perform the migration and does not provide the integrated Azure sizing, cost estimation, and migration workflow that Azure Migrate offers. Option B is incorrect. VM insights monitors the performance and dependencies of virtual machines. It does not assess VMware virtual machines for Azure, estimate migration costs, or migrate them. Option C is incorrect. Azure VMware Solution runs VMware environments natively in Azure rather than converting the workloads to Azure virtual machines, so it does not provide Azure virtual machine configuration recommendations. Therefore, D, Azure Migrate, is the correct answer.
Play from 2:49:28 Question 75. You plan to deploy an app that will use an Azure Storage account. You need to deploy the storage account. The storage account must meet the following requirements: • Store the data for multiple users. • Encrypt each user's data by using a separate key. • Encrypt all the data in the storage account by using customer-managed keys. What should you deploy? Here are the options. Option A. files in a premium file share storage account. Option B. blobs in a general purpose v2 storage account. Option C. blobs in an Azure Data Lake Storage Gen2 account. Option D. files in a general purpose v2 storage account. Pause the video now if you want time to think about the answer.
The correct answer is B. blobs in a general purpose v2 storage account. Encryption scopes are a blob feature. They let a single storage account hold data encrypted under different keys, so each user's data can be assigned its own scope backed by its own customer-managed key, while the account default also uses a customer-managed key. A general purpose v2 account with blobs supports encryption scopes and therefore meets all three requirements. Now, why are the other options incorrect? Option A is incorrect. Encryption scopes are not available for file shares, so a premium file share account cannot give each user a separate key. Option C is incorrect. Data Lake Storage Gen2 adds a hierarchical namespace for analytics workloads. It does not provide the per-user key separation asked for here. Option D is incorrect. Files in a general purpose v2 account have the same limitation as option A: no encryption scopes, so no separate key per user. Therefore, B, blobs in a general purpose v2 storage account, is the correct answer.
Play from 2:51:38 Question 76. You have an Azure subscription. The subscription contains a tiered app named App1 that is distributed across multiple containers hosted in Azure Container Instances. You need to deploy an Azure Monitor monitoring solution for App. The solution must meet the following requirements: • Support using synthetic transaction monitoring to monitor traffic between the App1 components. • Minimize development effort. What should you include in the solution? Here are the options. Option A. Network insights. Option B. Application Insights. Option C. Container insights. Option D. Log Analytics Workspace insights. Pause the video now if you want time to think about the answer.
The correct answer is B. Application Insights. Synthetic transaction monitoring is delivered by Application Insights availability tests, which issue requests on a schedule from selected locations and record the result. A standard or custom test can walk the path between App1's components without the application code being instrumented for it, which keeps development effort down. Now, why are the other options incorrect? Option A is incorrect. Network insights visualises network resources and their health. It does not run synthetic transactions. Option C is incorrect. Container insights collects performance and log data from container workloads. It observes what happens rather than generating traffic. Option D is incorrect. Log Analytics Workspace insights reports on the health and usage of the workspace itself. Therefore, B, Application Insights, is the correct answer.
Play from 2:53:36 Question 77. You have an Azure subscription that contains a third-party app service app named App1. App1 uses Microsoft Entra for authentication and is licensed on a per-user basis. The owners of App1 report that the licensing costs for App1 are higher than expected. You need to recommend a solution that will enable the App1 owners to monitor which users have access to App1 each month. The solution must meet the following requirements: ● Follow the principle of least privilege. ● Minimize administrative effort. What should you include in the recommendation? Here are the options. Option A. Conditional Access policies. Option B. Privileged Identity Management (PIM). Option C. access reviews. Option D. managed identities. Pause the video now if you want time to think about the answer.
The correct answer is C. access reviews. Access reviews in Microsoft Entra ID let you schedule recurring reviews of who has access to an enterprise application, such as a monthly review of the users assigned to App1. The App1 owners can be set as the reviewers, so they can see every user with access and deny access for users who no longer need it, without being granted any administrative role in the tenant. Because the reviews recur automatically and can apply results automatically, the solution follows the principle of least privilege and minimizes administrative effort while directly addressing the per-user licensing costs. Now, why are the other options incorrect? Option A is incorrect. Conditional Access policies control the conditions under which users can sign in to App1, but they provide no periodic report or review of which users have been granted access. Option B is incorrect. Privileged Identity Management manages just-in-time activation of privileged roles; it is not designed to review ordinary user assignments to a third-party app. Option D is incorrect. Managed identities give Azure resources an identity to authenticate to other services and have nothing to do with tracking which users can access App1. Therefore, C, access reviews, is the correct answer.
Play from 2:56:04 Question 78. You have an Azure Functions microservice app named App1 that is hosted in the Consumption plan. App1 uses an Azure Queue Storage trigger. You plan to migrate App1 to an Azure Kubernetes Service (AKS) cluster. You need to prepare the AKS cluster to support App1. The solution must meet the following requirements: • Use the same scaling mechanism as the current deployment. • Support kubenet and Azure Container Networking Interface (CNI) networking. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct answer is worth one point. Here are the options. Option A. Configure the horizontal pod autoscaler. Option B. Install Virtual Kubelet. Option C. Configure the AKS cluster autoscaler. Option D. Configure the virtual node add-on. Option E. Install Kubernetes-based Event Driven Autoscaling (KEDA). Pause the video now if you want time to think about the answer.
The correct answers are A. Configure the horizontal pod autoscaler, and E. Install Kubernetes-based Event Driven Autoscaling (KEDA). The function scales today on the depth of a storage queue, and Kubernetes-based Event Driven Autoscaling is what reproduces that on AKS: KEDA watches the queue and drives the replica count from the backlog. It does that by managing a horizontal pod autoscaler, which is why the autoscaler has to be configured as well. Neither depends on the networking model, so kubenet and Azure CNI both work. Now, why are the other options incorrect? Option B is incorrect. Virtual Kubelet schedules pods onto Azure Container Instances. It is a placement mechanism rather than the queue-driven scaling trigger. Option C is incorrect. The cluster autoscaler adds nodes when pods cannot be scheduled. It reacts to pending pods, not to queue length. Option D is incorrect. The virtual node add-on is not supported with kubenet networking, so it fails the second requirement. Therefore, A and E are the correct answers.
Play from 2:58:35 Question 79. You have an app named App1 that uses an Azure Blob Storage container named app1data. App1 uploads a cumulative transaction log file named File1.txt to a block blob in app1data once every hour. File1.txt only stores transaction data from the current day. You need to ensure that you can restore the last uploaded version of File1.txt from any day for up to 30 days after the file was overwritten. The solution must minimize storage space. What should you include in the solution? Here are the options. Option A. container soft delete. Option B. blob snapshots. Option C. blob soft delete. Option D. blob versioning. Pause the video now if you want time to think about the answer.
The correct answer is D. blob versioning. Blob versioning automatically preserves a version of the blob every time it is overwritten, so each hourly upload keeps the one it replaced and any previous state can be restored. Combined with a lifecycle rule that deletes versions older than 30 days, it meets the retention window while storing only the changed blocks, which is what keeps the space use down. Now, why are the other options incorrect? Option A is incorrect. Container soft delete restores a deleted container. It does nothing when a blob inside a live container is overwritten. Option B is incorrect. Snapshots would work but each one has to be created explicitly by the application, so the solution stops being automatic. Option C is incorrect. Blob soft delete recovers a deleted or overwritten blob for a retention period, but it is aimed at accidental deletion recovery rather than keeping an addressable version of each day's file. Therefore, D, blob versioning, is the correct answer.
Play from 3:00:46 Question 80. You have 12 on-premises data sources that contain customer information and consist of Microsoft SQL Server, MySQL, and Oracle databases. You have an Azure subscription. You plan to create an Azure Data Lake Storage account that will consolidate the customer information for analysis and reporting. You need to recommend a solution to automatically copy new information from the data sources to the Data Lake Storage account by using extract, transform and load (ETL). The solution must minimize administrative effort. What should you include in the recommendation? Here are the options. Option A. Azure Data Factory. Option B. Azure Data Explorer. Option C. Azure Data Share. Option D. Azure Data Studio. Pause the video now if you want time to think about the answer.
The correct answer is A. Azure Data Factory. Azure Data Factory connects to SQL Server, MySQL, and Oracle through a self-hosted integration runtime installed on the on-premises network, and copies from all 12 sources into Data Lake Storage on a schedule. Mapping data flows handle the transform step, and because it is a managed service with built-in connectors and triggers, the administrative effort is far lower than building the movement by hand. Now, why are the other options incorrect? Option B is incorrect. Azure Data Explorer is an analytics engine for telemetry. It is a query destination rather than an ETL orchestrator. Option C is incorrect. Azure Data Share publishes datasets to other organisations. It does not extract from on-premises databases. Option D is incorrect. Azure Data Studio is a desktop client for querying and managing databases. Therefore, A, Azure Data Factory, is the correct answer.
Play from 3:02:54 Question 81. You have multiple on-premises locations. The locations host IoT endpoints that generate real-time telemetry data. You have an Azure subscription. You need to process the telemetry data and provide real-time insights. The solution must minimize development effort. What should you use? Here are the options. Option A. Azure Data Factory. Option B. Azure Data Lake Analytics. Option C. Log Analytics. Option D. Azure Stream Analytics. Pause the video now if you want time to think about the answer.
The correct answer is D. Azure Stream Analytics. Azure Stream Analytics is a fully managed, real-time stream processing engine that reads continuous data from inputs such as Azure IoT Hub and Azure Event Hubs. Processing logic is written in a SQL-like query language with built-in windowing and aggregation functions, so insights such as rolling averages or anomaly detection need no custom code. Results can be sent directly to outputs such as Power BI dashboards, databases, or alerts with low latency. Because no infrastructure must be managed and queries replace application code, it provides real-time insights from the telemetry with minimal development effort. Now, why are the other options incorrect? Option A is incorrect. Data Factory orchestrates batch data movement and transformation pipelines; it does not analyze streaming telemetry in real time. Option B is incorrect. Data Lake Analytics ran batch U-SQL jobs over stored data, so it cannot deliver real-time insights, and the service has been retired. Option C is incorrect. Log Analytics queries collected log data after ingestion; it is not a stream processing engine for real-time IoT telemetry. Therefore, D, Azure Stream Analytics, is the correct answer.
Play from 3:05:04 Question 82. You store web access logs data in Azure Blob Storage. You plan to generate monthly reports from the access logs. You need to recommend an automated process to upload the data to Azure SQL Database every month. What should you include in the recommendation? Here are the options. Option A. Microsoft SQL Server Migration Assistant (SSMA). Option B. Data Migration Assistant (DMA). Option C. AzCopy. Option D. Azure Data Factory. Pause the video now if you want time to think about the answer.
The correct answer is D. Azure Data Factory. Azure Data Factory is the managed service for scheduled data movement. A pipeline with a copy activity reads the access logs from Blob Storage and writes them into Azure SQL Database, and a monthly trigger runs it automatically, which is exactly the automated process the requirement describes. Now, why are the other options incorrect? Option A is incorrect. SQL Server Migration Assistant converts schemas and data from other database engines during a one-time migration. Option B is incorrect. Data Migration Assistant assesses a SQL Server estate for migration blockers. It is an assessment tool, not a recurring pipeline. Option C is incorrect. AzCopy copies data to and from storage from the command line, and it has no scheduler and no path into a SQL database. Therefore, D, Azure Data Factory, is the correct answer.
Play from 3:06:52 Question 83. You plan to provision a High Performance Computing (HPC) cluster in Azure that will use a third-party scheduler. You need to recommend a solution to provision and manage the HPC cluster node. What should you include in the recommendation? Here are the options. Option A. Azure Automation. Option B. Azure CycleCloud. Option C. Azure Purview. Option D. Azure Lighthouse. Pause the video now if you want time to think about the answer.
The correct answer is B. Azure CycleCloud. Azure CycleCloud is the service for provisioning and managing HPC clusters in Azure, and its distinguishing feature is that it supports third-party schedulers such as Slurm, PBS Pro, LSF, and Grid Engine. It creates the cluster, autoscales the node count against the scheduler's queue, and manages the node lifecycle, which is exactly what is being asked for. Now, why are the other options incorrect? Option A is incorrect. Azure Automation runs runbooks for operational tasks. Building HPC cluster management on it would be a custom project. Option C is incorrect. Azure Purview, now Microsoft Purview, is a data governance and cataloguing service. Option D is incorrect. Azure Lighthouse lets a service provider manage a customer's tenant. It provisions no compute. Therefore, B, Azure CycleCloud, is the correct answer.
Play from 3:08:37 Question 84. You are building an app named App1 that will store structured and unstructured data by using the Azure Table storage REST API. You need to recommend a solution that meets the following requirements: • Provides dedicated throughput and the fastest possible read and write times for the data. • Minimizes storage costs. What should you include in the recommendation? Here are the options. Option A. an Azure Cosmos DB database. Option B. a standard storage account. Option C. a premium storage account. Option D. Azure Cache for Redis. Pause the video now if you want time to think about the answer.
The correct answer is A. an Azure Cosmos DB database. Azure Cosmos DB for Table is compatible with the Azure Table storage REST API and SDKs, so App1 can use the same code while gaining Cosmos DB capabilities. Cosmos DB provides dedicated throughput through provisioned request units and offers single-digit millisecond latency for reads and writes backed by SLAs, which standard Table storage does not guarantee. Because App1 stores structured and unstructured data as flexible entities, Cosmos DB for Table also indexes all properties automatically for fast queries. To keep throughput costs low, the account can use autoscale throughput, which scales provisioned request units down to 10 percent of the maximum when demand is low, so you avoid paying for peak capacity while idle. Among the options, it is the only one that meets the throughput and latency requirements through the Table API. Now, why are the other options incorrect? Option B is incorrect. Table storage in a standard storage account uses shared, multi-tenant throughput with no dedicated capacity or latency guarantees, so it does not provide the fastest possible read and write times. Option C is incorrect. Premium storage accounts are available for block blobs, page blobs, and file shares, not for Table storage, so they cannot host data accessed through the Table storage REST API. Option D is incorrect. Azure Cache for Redis is an in-memory cache with its own protocol, not a persistent store that supports the Table storage REST API, and holding all data in memory raises costs. Therefore, A, an Azure Cosmos DB database, is the correct answer.
Play from 3:11:29 Question 85. You need to recommend an Azure Storage solution that meets the following requirements: • The storage must support 1 PB of data. • The data must be stored in blob storage. • The storage must support three levels of subfolders. • The storage must support access control lists (ACLs). What should you include in the recommendation? Here are the options. Option A. a premium storage account that is configured for block blobs. Option B. a general purpose v2 storage account that has hierarchical namespace enabled. Option C. a premium storage account that is configured for page blobs. Option D. a premium storage account that is configured for file shares and supports large file shares. Pause the video now if you want time to think about the answer.
The correct answer is B. a general purpose v2 storage account that has hierarchical namespace enabled. Enabling the hierarchical namespace on a general purpose v2 account turns it into Azure Data Lake Storage Gen2. That gives real directories, so subfolders nest to any depth, and POSIX-style access control lists on files and directories, while the data still lives in blob storage and scales well beyond a petabyte. Now, why are the other options incorrect? Option A is incorrect. A premium block blob account is fast but without the hierarchical namespace it has only a flat namespace and no ACLs. Option C is incorrect. Page blobs back virtual machine disks and are not the right storage for this at all. Option D is incorrect. A file share is not blob storage, which the requirement explicitly calls for. Therefore, B, a general purpose v2 storage account that has hierarchical namespace enabled, is the correct answer.
