All practice questions

1186 questions

Question 441Question

A company is setting up monitoring and health tracking for their Azure virtual machines. They need to understand the difference between Azure Monitor and Azure Service Health.

Which of the following statements correctly describe these services? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Azure Monitor collects and analyzes performance metrics, such as CPU and memory utilization, from your Azure resources.; Azure Service Health alerts you about regional outages, planned maintenance, and health advisories that affect your Azure subscription.

Answer

Azure Monitor collects and analyzes performance metrics from Azure resources, and Azure Service Health alerts you about regional outages and planned maintenance.
Azure Monitor is used to gather resource-specific telemetry (like CPU and memory metrics), while Azure Service Health provides information about Microsoft Azure service issues, outages, and planned maintenance affecting your resources.

Step-by-Step Solution

1
Identify the purpose of Azure Monitor.
Azure Monitor is responsible for resource-level telemetry, including metrics like CPU/memory usage and logs.
This helps determine which options accurately describe resource-level performance tracking.
2
Identify the purpose of Azure Service Health.
Azure Service Health is responsible for notifying users about Azure service outages, planned maintenance, and service advisories that affect their subscriptions.
This distinguishes global or service-level health tracking from resource-level monitoring.

Key Concept

Azure Monitor and Azure Service Health serve distinct purposes: Azure Monitor tracks individual resource performance (metrics and logs), whereas Azure Service Health tracks the health and status of Azure services and infrastructure.
Estimated Time:1m 0s
Question 442Question

A company needs to deploy a database in Azure that supports traditional relational database constraints, ACID transactions, and structured schemas. To minimize administration, the company wants to avoid managing the underlying virtual machines and operating systems. Which Azure service should the company select?

Show answer & explanation

Answer: Azure SQL Database

Answer

Azure SQL Database
Azure SQL Database is a fully managed Platform as a Service (PaaS) database engine. It provides native support for relational constraints, structured schemas, and ACID transactions while offloading all underlying operating system and software maintenance, backups, and patching to Microsoft.

Step-by-Step Solution

1
Identify the data structure requirement.
The application requires a database that supports traditional relational database constraints, ACID transactions, and structured schemas.
This rules out non-relational database services such as Azure Cosmos DB.
2
Identify the management and administrative requirements.
The company wants to avoid managing the underlying virtual machines and operating systems.
This dictates a Platform as a Service (PaaS) database option, ruling out Infrastructure as a Service (IaaS) solutions like running SQL Server on Virtual Machines.
3
Select the service that meets both requirements.
Azure SQL Database is a relational database service provided as a fully managed PaaS.
It offers full SQL Server relational capabilities while Microsoft manages all hardware, VM patching, and operating system updates.

Key Concept

Azure relational database services and their management models (PaaS vs. IaaS)
Estimated Time:1m 0s
Question 443Question

A company plans to deploy a custom-built web application to Azure. The application does not require containerization. The company's primary requirement is to minimize administrative effort by ensuring that Microsoft automatically handles all operating system patching, load balancing, and runtime environment updates. Which Azure service should the company select to host the web application?

Show answer & explanation

Answer: Azure App Service

Answer

Azure App Service
Azure App Service is the correct choice because it is a Platform as a Service (PaaS) solution designed specifically for hosting web applications. Microsoft handles the underlying infrastructure, operating system patching, load balancing, and middleware updates, which aligns perfectly with the goal of minimizing administrative effort.

Step-by-Step Solution

1
Analyze the hosting requirements for the web application.
The application requires hosting without containerization, with minimal administrative overhead, and with automatic operating system patching, load balancing, and runtime management.
This establishes that the company needs a Platform as a Service (PaaS) compute offering suitable for web applications.
2
Compare the available Azure compute options against these requirements.
Azure App Service is a fully managed PaaS web hosting service that handles OS patching, scaling, and load balancing automatically, whereas Azure Virtual Machines requires OS management (IaaS), Azure Kubernetes Service requires containerization and cluster management, and Microsoft 365 is a SaaS product for end-users.
This identifies the service that fulfills the requirements while minimizing management complexity.

Key Concept

Azure compute options and shared responsibility in PaaS models
Estimated Time:1m 0s
Question 444Question

A regional accounting firm needs to connect its local office network to resources in an Azure Virtual Network to perform weekly database synchronization. The connection must encrypt all data in transit, route over the public internet, and represent the lowest cost option without requiring a dedicated private circuit. Which Azure service should the firm implement?

Show answer & explanation

Answer: Azure VPN Gateway

Answer

Azure VPN Gateway
The correct option is Azure VPN Gateway. A VPN Gateway allows the establishment of a Site-to-Site VPN connection that encrypts all network traffic and routes it over the public internet, providing a highly cost-effective and secure hybrid networking option for low-frequency tasks.

Step-by-Step Solution

1
Analyze the requirements for the connection
The solution requires hybrid connectivity (on-premises to Azure), encrypted data transit, transport over the public internet, and low cost.
This helps filter out services that do not support hybrid connectivity or have different transport mechanisms.
2
Evaluate the available Azure networking options against the requirements
Azure VPN Gateway meets all requirements by utilizing the public internet for encrypted Site-to-Site connections at a low cost. ExpressRoute is eliminated because it uses a private connection. VNet Peering and Azure Bastion do not provide network-to-network hybrid connectivity.
Matching requirements to specific service capabilities identifies the correct architecture.

Key Concept

Hybrid network connectivity options in Azure
Question 445Question

An organization plans to automate the deployment of its cloud infrastructure using Azure Resource Manager (ARM) templates. Which two statements describe benefits of using ARM templates? (Select two.)

Select all that apply

Show answer & explanation

Answer: They use declarative syntax, which allows you to define the desired configuration of resources without writing the step-by-step commands to create them.; They ensure repeatability, allowing you to deploy the template multiple times and get the same resources deployed in the same state.

Answer

The correct benefits are that ARM templates use declarative syntax to define resources without step-by-step commands, and they ensure repeatability across deployments.
The correct options describe the fundamental benefits of ARM templates: they are declarative, meaning they define the resource configuration without requiring programming commands, and they are repeatable, ensuring consistent deployments.

Step-by-Step Solution

1
Analyze the benefits of Azure Resource Manager (ARM) templates.
Identify that ARM templates are declarative (specifying 'what' rather than 'how') and idempotent (ensuring repeatability).
This establishes the correct characteristics of ARM templates.
2
Evaluate the distractors regarding resource group hierarchy and scripting style.
Confirm that resource groups cannot be nested and that templates do not use imperative execution scripts.
This rules out the incorrect options based on Azure governance and template design rules.

Key Concept

Azure Resource Manager (ARM) Templates use declarative syntax to provision and manage resources repeatedly and consistently.
Question 446Question

A healthcare provider is deploying an application in Azure that must access patient records stored in a database server at their physical clinic. Due to strict compliance regulations, the network path between the clinic and Azure must be completely isolated from the public internet. Which Azure service should be used to establish this connection?

Show answer & explanation

Answer: ExpressRoute

Answer

ExpressRoute
ExpressRoute is the correct option because it establishes a dedicated, private connection between physical infrastructure and Azure. Because this private link is facilitated by a connectivity provider, the traffic bypasses the public internet completely, satisfying the security and compliance requirements.

Step-by-Step Solution

1
Analyze the connectivity requirements in the scenario.
The network connection must link a physical clinic (on-premises) to Azure resources, and the network path must be completely isolated from the public internet.
Understanding the constraints is necessary to filter out unsuitable Azure networking services.
2
Evaluate the candidate services against the public internet isolation constraint.
VPN Gateway solutions (Site-to-Site and Point-to-Site) encrypt traffic but still use the public internet. Virtual Network Peering only connects networks internal to Azure. ExpressRoute provides a dedicated, private connection that does not use the public internet.
Comparing service specifications to client requirements allows identification of the correct Azure hybrid connection model.

Key Concept

Azure hybrid networking connectivity options and their public internet usage
Estimated Time:1m 0s
Question 447Question

An organization is establishing governance and operational procedures for its Microsoft Azure environment. The administration team needs to align specific operational requirements with the correct Azure management tools. Match each operational requirement on the left to the corresponding Azure service or tool on the right.

Click a left item, then click its matching right item

Items

Analyze active resource utilization to receive recommendations for cost savings, reliability, performance, security, and operational excellence.
Define rules to enforce compliance standards across all subscriptions and prevent the deployment of non-compliant resources.
Collect and analyze diagnostic logs, platform metrics, and application telemetry to monitor real-time resource health.
Monitor cloud security posture across hybrid workloads, detect threats, and calculate a unified secure score.

Matches

Show answer & explanation

Answer

Analyzing utilization for recommendations matches Azure Advisor; defining rules for compliance matches Azure Policy; collecting telemetry matches Azure Monitor; and monitoring security posture matches Microsoft Defender for Cloud.
Matching the operational requirements to the tools correctly identifies the unique function of each tool. Azure Advisor is the correct match for analyzing resources to provide optimization recommendations across the five pillars. Azure Policy is the correct match for enforcing standards and blocking non-compliant resources. Azure Monitor is the correct match for logging and telemetry collection. Microsoft Defender for Cloud is the correct match for threat protection and generating a secure score.

Step-by-Step Solution

1
Identify the service that evaluates active resources against five pillars (cost, security, reliability, performance, operational excellence) to give personalized recommendations.
This aligns directly with Azure Advisor.
Azure Advisor is designed specifically to provide optimization recommendations across these core domains.
2
Identify the service used to enforce rules and prevent non-compliant deployments.
This aligns with Azure Policy.
Azure Policy evaluates resources and blocks non-compliant resource creation or updates.
3
Identify the service that acts as the central hub for collecting logs and metrics.
This aligns with Azure Monitor.
Azure Monitor gathers telemetry data from resources and allows querying and alerting.
4
Identify the service focused on hybrid threat detection, security posture, and the secure score.
This aligns with Microsoft Defender for Cloud.
Microsoft Defender for Cloud is dedicated to security posture assessment and threat protection.

Key Concept

Azure Management and Governance Service Boundaries
Question 448Question

Your company is deploying new resources to Azure and wants to implement a metadata strategy to organize resources and categorize billing data. Which of the following statements about Azure resource tags are correct? (Select two.)

Select all that apply

Show answer & explanation

Answer: Resources do not automatically inherit tags from the resource group to which they belong.; Tags can be used to group and filter cost data within Azure Cost Management.

Answer

Resources do not automatically inherit tags from the resource group to which they belong, and tags can be used to group and filter cost data within Azure Cost Management.
The correct options are that resources do not automatically inherit tags from their parent resource group, and tags can be used to filter and group costs within Azure Cost Management. In Azure, tagging is a manual or policy-driven action on individual resources, and tags do not automatically propagate from resource groups. Once applied, these tags are integrated with billing tools to facilitate cost classification.

Step-by-Step Solution

1
Identify the behavior of tag inheritance in Azure.
Confirm that tags applied at the resource group level do not inherit down to individual resources.
This determines which statements regarding tag inheritance are true or false.
2
Identify how tags are used in billing and cost management.
Confirm that tags are metadata keys and values used to categorize resources and group/filter costs in Azure Cost Management.
This identifies the correct statement regarding Azure Cost Management integration.

Key Concept

Azure resource tags behave as metadata applied directly to resources and do not support inheritance from resource groups, but they are critical for cost categorization and filtering in Azure Cost Management.
Question 449Question

A cloud engineer assigns a tag named Department with a value of Sales to an Azure resource group. The engineer then deploys an Azure Storage account inside this resource group without defining any tags. What is the tag status of the newly deployed storage account?

Show answer & explanation

Answer: The storage account has no tags applied.

Answer

The storage account has no tags applied.
The correct answer is correct because Azure resources do not inherit tags from the resource group in which they reside. When a storage account is deployed without tags into a tagged resource group, the storage account will have no tags.

Step-by-Step Solution

1
Analyze the relationship between the resource group and the resources inside it regarding tag inheritance.
Azure resource groups do not pass down or inherit their tags to resources contained within them.
This is a fundamental behavior of Azure Resource Manager (ARM) tagging policies designed to prevent unintentional tag overrides.
2
Determine the tag configuration of the newly deployed storage account.
Since no tags were specified during the storage account's deployment and there is no automatic inheritance from the resource group, the storage account will be created with zero tags.
Applying tags is an explicit operation that must be configured per resource or enforced via Azure Policy.

Key Concept

Azure resource tags are not inherited from resource groups to resources inside them.
Question 450Question

A company wants to track the CPU usage of a critical virtual machine and receive a notification automatically if the usage exceeds 85%. Which Azure service should the company use to configure these performance alerts?

Show answer & explanation

Answer: Azure Monitor

Answer

Azure Monitor
The correct option is Azure Monitor because it is the primary service designed to collect, analyze, and act on telemetry from Azure resources, which includes tracking CPU metrics and configuring alerts.

Step-by-Step Solution

1
Analyze the monitoring requirement.
The requirement is to collect performance telemetry (CPU usage) from an individual virtual machine and trigger alerts when it exceeds a threshold.
Understanding whether the request is for individual resource telemetry versus global infrastructure health allows you to rule out service-wide status tools.
2
Evaluate the capabilities of each option against the requirement.
Azure Monitor tracks resource metrics and handles alerting; Azure Service Health tracks global outages; Azure Policy enforces compliance configurations; Resource Locks prevent deletions/modifications.
Matching the features of each service ensures the selection of the correct service dedicated to resource performance metrics.

Key Concept

Azure Monitor collects and analyzes telemetry data, including performance metrics like CPU utilization, and provides alerting capabilities for individual Azure resources.
Question 451Question

An organization migrating its on-premises file shares to the cloud can use Azure Files to mount the file shares concurrently across multiple Azure virtual machines using the Server Message Block (SMB) protocol.

Show answer & explanation

Answer: True

Answer

The statement is true.
Azure Files enables fully managed file shares in the cloud that are accessible via the industry-standard Server Message Block (SMB) protocol and can be mounted concurrently by multiple virtual machines.

Step-by-Step Solution

1
Identify the primary storage service required for migrating shared file systems with SMB support.
Azure Files is the service designed for shared file systems using SMB or NFS protocols.
This determines if the specified scenario aligns with the capabilities of Azure Files.
2
Check if Azure Files supports concurrent mounting by multiple virtual machines.
Azure Files allows multiple virtual machines to mount the same share concurrently.
This verifies the concurrency requirement mentioned in the statement.

Key Concept

Azure Files SMB support and concurrent mounting capabilities
Question 452Question

An organization is standardizing its cross-platform scripting tools to automate resource management in Azure. The administration team uses a mix of Windows, macOS, and Linux workstations. The team wants to install the tools locally on each workstation to run command-line administrative scripts.

Which two tools can be installed locally on Windows, macOS, and Linux to run these scripts?

Select all that apply

Show answer & explanation

Answer: Azure CLI; Azure PowerShell

Answer

Azure CLI and Azure PowerShell are the correct tools because both can be installed locally on Windows, macOS, and Linux workstations to run administrative scripts.
Both Azure CLI and Azure PowerShell are fully cross-platform command-line tools that can be installed locally on Windows, macOS, and Linux. This enables administrators to run scripts across different operating systems locally.

Step-by-Step Solution

1
Identify the environment requirements: The scripts must run locally on Windows, macOS, and Linux workstations without using a web browser.
Limits the options to locally installed command-line tools rather than web-hosted consoles or cloud-based shells.
This filters out Azure Portal and Azure Cloud Shell, which are browser-based.
2
Evaluate the cross-platform capabilities of the remaining command-line tools.
Both Azure CLI and Azure PowerShell (via PowerShell Core) are compatible and supported on Windows, macOS, and Linux.
Ensures the selected tools can be installed locally on all three specified operating systems.

Key Concept

Cross-platform support and local installation capability of Azure management tools (Azure CLI and Azure PowerShell).
Question 453Question

An organization is evaluating database migration options and new application deployments in Microsoft Azure. How should the organization match each application workload requirement to the most appropriate Azure database service?

Click a left item, then click its matching right item

Items

An application requiring a globally distributed NoSQL database that can scale throughput and storage across multiple regions with multi-model API support.
An enterprise application requiring a fully managed relational database with built-in high availability, built on the Microsoft SQL Server engine without operating system-level control.
A legacy SQL Server database migration requiring host-level operating system access to run custom third-party database agents and shared disk configurations.
An open-source web application stack requiring a fully managed relational database engine compatible with schema-based PostgreSQL queries.

Matches

Show answer & explanation

Answer

The correct pairings match Azure Cosmos DB with the globally distributed NoSQL workload, Azure SQL Database with the fully managed relational SQL Server workload without OS access, SQL Server on Azure Virtual Machines with the legacy SQL Server workload requiring OS access, and Azure Database for PostgreSQL with the open-source PostgreSQL workload.
The pairings are correct because Azure Cosmos DB provides globally distributed NoSQL capabilities. Azure SQL Database provides a managed PaaS experience for SQL Server relational databases. SQL Server on Azure Virtual Machines provides full OS access under the IaaS model. Azure Database for PostgreSQL provides a managed database service for open-source PostgreSQL workloads.

Step-by-Step Solution

1
Analyze the requirements for the first workload: a globally distributed NoSQL database with multi-model API support.
Identify that Azure Cosmos DB is the only Azure NoSQL database offering global distribution and multiple API compatibilities (such as MongoDB, Cassandra).
Cosmos DB is designed for horizontal scale-out NoSQL workloads across regions.
2
Analyze the requirements for the second workload: a fully managed relational database using the SQL Server engine without OS access.
Identify that Azure SQL Database is the Platform as a Service (PaaS) offering for SQL Server that abstracts the underlying OS.
PaaS database services like Azure SQL Database handle patching and administration without exposing the operating system.
3
Analyze the requirements for the third workload: a legacy database needing SQL Server with host-level OS access.
Identify that SQL Server on Azure Virtual Machines (IaaS) provides complete administrative control over both the SQL Server instance and the underlying operating system.
Host-level configurations and custom third-party agents require the Infrastructure as a Service (IaaS) model.
4
Analyze the requirements for the fourth workload: a managed relational database for open-source PostgreSQL.
Identify that Azure Database for PostgreSQL is the dedicated fully managed relational service for PostgreSQL engines.
It matches the relational open-source requirements of PostgreSQL.

Key Concept

Selecting appropriate Azure database services based on relational vs. non-relational, PaaS vs. IaaS, and engine requirements.
Estimated Time:1m 30s
Question 454Question

A company assigns an Azure Policy definition that restricts the deployment of virtual machines to specific allowed sizes. A developer attempts to deploy a virtual machine size that is not in the allowed list. What occurs when the developer attempts this deployment?

Show answer & explanation

Answer: The deployment is blocked, and the virtual machine is not created.

Answer

The deployment is blocked, and the virtual machine is not created.
The correct option states that the deployment is blocked, and the virtual machine is not created. When a policy restricts resource configurations (such as VM sizes) and a user attempts to deploy a resource that violates these rules, Azure Resource Manager (ARM) blocks the deployment request immediately, preventing the resource from being provisioned.

Step-by-Step Solution

1
Analyze the policy constraint and the user's action.
The policy restricts virtual machine sizes, and the user is attempting to deploy an unapproved size.
To determine the enforcement outcome, we must look at how Azure Policy evaluates new resource creation requests.
2
Determine the enforcement behavior of Azure Policy for new resources.
Azure Policy intercepts the deployment request during the Azure Resource Manager (ARM) evaluation phase.
Azure Policy acts as a gatekeeper during resource provisioning, evaluating properties before resources are deployed.
3
Identify the resulting action on the deployment.
The deployment is blocked, and the resource creation is prevented.
Since the resource properties violate the policy rule, the request is rejected and no resource is created.

Key Concept

Azure Policy deployment enforcement and compliance checks
Estimated Time:45s
Question 455Question

An organization plans to deploy two new workloads to Azure:

1. A batch processing application that runs within a single Docker container, executes once a day for less than an hour, and must run without virtual machine management or container orchestration setup.
2. A large-scale microservices application consisting of multiple containers that requires automated scaling, service discovery, and advanced networking configuration.

Which two Azure services should the organization choose to host these workloads? (Select two.)

Select all that apply

Show answer & explanation

Answer: Azure Container Instances; Azure Kubernetes Service

Answer

Azure Container Instances and Azure Kubernetes Service are the correct options to host the workloads.
Azure Container Instances is the correct choice for the first workload because it runs single containers on demand without orchestrator or virtual machine management. Azure Kubernetes Service is the correct choice for the second workload because it provides full container orchestration, automated scaling, and service discovery needed for complex microservices.

Step-by-Step Solution

1
Analyze the requirements for workload 1.
Workload 1 requires running a single Docker container occasionally with no virtual machine management or orchestration overhead.
This matches Azure Container Instances, which is designed for fast, serverless container execution without VM or orchestrator management.
2
Analyze the requirements for workload 2.
Workload 2 requires automated scaling, service discovery, and advanced networking for a multi-container microservices application.
This matches Azure Kubernetes Service, which is a dedicated managed Kubernetes container orchestration platform.
3
Select the correct combination of services.
The correct services are Azure Container Instances for workload 1 and Azure Kubernetes Service for workload 2.
This choice satisfies all application requirements while avoiding unnecessary administrative overhead or functionality gaps.

Key Concept

Selecting container hosting services on Azure based on management overhead and orchestration requirements.
Estimated Time:1m 30s
Question 456Question

Which term describes the syntax style used by Azure Resource Manager (ARM) templates, where you define the desired state of your infrastructure rather than the sequence of programming commands to create it?

Show answer & explanation

Answer: Declarative syntax

Answer

Declarative syntax
The correct answer is declarative syntax. With declarative syntax, you define the target state of the resources (such as virtual machines, storage accounts, or virtual networks) you want to create, along with their properties, and Azure Resource Manager manages the orchestration and deployment steps. You do not need to write procedural code or sequence commands.

Step-by-Step Solution

1
Analyze the requirements described in the question.
The question asks for the deployment approach where the user defines the desired final state of resources rather than sequencing step-by-step commands.
This establishes the fundamental distinction between declarative and imperative models of infrastructure management.
2
Identify the configuration model utilized by Azure Resource Manager (ARM) templates.
ARM templates (and Bicep templates) use declarative syntax, letting the orchestration engine handle the deployment mechanics.
Identifying declarative syntax directly matches the scenario requirements.

Key Concept

Azure Resource Manager (ARM) templates use declarative syntax to define infrastructure.
Question 457Question

A financial company is planning a hybrid cloud deployment. The company needs to connect its main office to an Azure virtual network. This connection must be a private, dedicated circuit that does not use the public internet, ensuring high bandwidth and low latency. Additionally, the company needs to connect several remote employees working from home to the same virtual network securely. Which two of the following solutions should the company implement to meet these requirements? (Select two)

Select all that apply

Show answer & explanation

Answer: An ExpressRoute connection for the main office; A Point-to-Site (P2S) VPN connection for the remote employees

Answer

An ExpressRoute connection for the main office and a Point-to-Site (P2S) VPN connection for the remote employees
The correct options are the ones implementing an ExpressRoute connection for the main office and a Point-to-Site (P2S) VPN connection for the remote employees. ExpressRoute satisfies the requirement for a private, high-speed, and low-latency hybrid connection that does not traverse the public internet. Point-to-Site (P2S) VPN is designed to allow individual remote clients to connect securely to the Azure Virtual Network over the internet from anywhere.

Step-by-Step Solution

1
Determine the hybrid networking service that meets the requirements for a private connection bypassing the public internet.
ExpressRoute is selected.
ExpressRoute provides dedicated, high-speed, low-latency private connectivity to Azure that does not use the public internet.
2
Determine the connectivity option suitable for individual remote workers accessing the virtual network from home.
Point-to-Site (P2S) VPN is selected.
Point-to-Site VPN allows secure, encrypted connections from individual client computers to Azure Virtual Networks over the internet.

Key Concept

Azure hybrid networking components: ExpressRoute for dedicated private office connection, and Point-to-Site VPN for secure remote client access.
Question 458Question

A development firm wants to review its active production workloads in Microsoft Azure to identify underutilized resources and obtain recommendations to improve cost-efficiency. Which Azure tool should the firm use to view these personalized recommendations?

Show answer & explanation

Answer: Azure Advisor

Answer

Azure Advisor
The option stating 'Azure Advisor' is correct because Azure Advisor is designed to evaluate active resource configurations and usage history to offer personalized recommendations. These recommendations span five key pillars: Cost, Security, Reliability, Performance, and Operational Excellence.

Step-by-Step Solution

1
Identify the core requirement of the scenario: finding personalized recommendations to optimize cost-efficiency for already active Azure resources.
The target tool must evaluate active cloud usage and suggest optimization actions (such as right-sizing).
This helps rule out pre-migration tools and compliance scoping tools.
2
Compare the capabilities of Azure Advisor, TCO Calculator, Azure Policy, and Azure Monitor.
Azure Advisor is the dedicated tool that provides tailored best-practice recommendations for active resources, whereas the others are for pre-migration planning (TCO), compliance enforcement (Policy), or telemetry collection (Monitor).
Correctly identifying the tool boundaries ensures the right service is selected.

Key Concept

Azure Advisor personalized recommendations and tool boundaries
Estimated Time:1m 0s
Question 459Question

A cloud engineering lead needs to delegate access management for a resource group named Production-RG to a security analyst. The security analyst must be able to assign and remove roles for other team members, but must not have permissions to create, delete, or modify any resources within Production-RG. Is the following statement true or false? Assigning the Owner role to the security analyst at the resource group scope satisfies these requirements.

Show answer & explanation

Answer: False

Answer

The statement is false. The Owner role grants full resource management permissions in addition to access control, violating the requirement. The User Access Administrator role should be used instead.
The statement is false because the Owner role provides complete control over all resources in the resource group, including resource modification and deletion. The User Access Administrator role must be used to delegate access management without resource control.

Step-by-Step Solution

1
Analyze the security requirements for the resource group scope.
The security analyst must manage roles (assign and remove access) but must be prevented from creating, deleting, or modifying resources.
To define the minimum and maximum permission boundaries needed.
2
Evaluate the capabilities of the Azure RBAC Owner role.
The Owner role grants full control over all resources, including access management and resource management (read, write, delete).
To verify if the Owner role aligns with the restriction requirements.
3
Compare the Owner role capabilities to the principle of least privilege.
Since the Owner role allows resource modification, it fails the restriction requirement. The User Access Administrator role is the correct fit as it allows access management without resource modification rights.
To determine the truth value of the statement.

Key Concept

Azure RBAC Roles (Owner vs. User Access Administrator)
Question 460Question

Determine if the following statement is true or false: Azure Service Health is the service used to collect and analyze performance metrics, such as CPU and memory usage, for individual Azure Virtual Machines.

Show answer & explanation

Answer: False

Answer

The statement is false. Azure Monitor is the service that collects and analyzes resource-level performance metrics (such as CPU and memory usage) for individual virtual machines, whereas Azure Service Health provides information about Azure service outages, planned maintenance, and health advisories affecting Azure services globally or regionally.
The statement is false because individual resource performance monitoring (like CPU and memory metrics) is the responsibility of Azure Monitor. Azure Service Health is focused on the status of Azure services at a regional or global level, such as outages or planned maintenance.

Step-by-Step Solution

1
Identify the purpose of Azure Service Health.
Azure Service Health monitors the status of Azure services on a global and regional scale, notifying users about outages, planned maintenance, and service advisories.
To determine what level of monitoring Azure Service Health provides.
2
Identify the purpose of Azure Monitor.
Azure Monitor collects, analyzes, and acts on telemetry data (including performance metrics like CPU and memory utilization) from individual resources like Virtual Machines.
To determine which Azure service handles resource-specific performance telemetry.
3
Compare the statement's claim with the roles of both services.
The statement claims Azure Service Health monitors individual VM performance metrics, which is actually the role of Azure Monitor. Therefore, the statement is false.
To arrive at the final true/false evaluation.

Key Concept

Distinction between resource-level monitoring (Azure Monitor) and service-level health (Azure Service Health)
PreviousPage 23 / 60Next
All practice questions — Microsoft Azure Fundamentals (AZ-900) | Examkin