Examkin

All practice questions

1186 questions

All types1,186Multiple choice620Multiple select228True / False291Matching47
Question 541Question →

To comply with corporate security standards, a cloud engineering team must implement several compliance requirements across all subscriptions in their organization. These requirements include auditing unencrypted storage accounts, restricting virtual machine deployments to specific regions, and blocking the creation of public IP addresses. To streamline the management and assignment of these multiple compliance rules, which feature of Azure Policy should the team implement?

Show answer & explanation

Answer: A policy initiative

Answer

A policy initiative
A policy initiative is the correct component because it allows an organization to group multiple policy definitions together. This simplifies the assignment process, as the entire set of rules can be applied to a scope (such as a subscription or management group) in a single operation, and compliance can be tracked collectively.

Step-by-Step Solution

1
Identify that the requirement is to group multiple individual compliance rules (such as auditing, region restrictions, and public IP blocks) into a single administrative unit.
Recognized the need for a grouping mechanism rather than applying individual rules one by one.
This helps in selecting the correct Azure Policy component designed for logical grouping.
2
Recall that Azure Policy uses two main resource components: policy definitions (which define a single rule) and policy initiatives (which group multiple definitions).
Identified that a policy initiative is the container for multiple policy definitions.
This differentiates the single rule definition from the multi-rule grouping concept.
3
Determine that a policy initiative is the correct feature because it acts as a container for multiple policy definitions, allowing them to be assigned and tracked together.
Confirmed that a policy initiative meets all requirements of the scenario.
This completes the selection process by matching the target feature to the business requirement.

Key Concept

Azure Policy Initiatives
Question 542Question →

A cloud administrator needs to set up automated alerts to notify their operations team whenever the CPU usage of a specific virtual machine exceeds 90 percent. Determine whether the following statement is true or false: The administrator must configure these alerts using Azure Service Health.

Show answer & explanation

Answer: False

Answer

The statement is false. The administrator must configure these alerts using Azure Monitor, not Azure Service Health.
The correct answer is false because monitoring resource-specific performance metrics, such as CPU utilization, is a function of Azure Monitor. Azure Service Health is designed to report on broad Azure service incidents, planned maintenance, and health advisories that affect your subscription.

Step-by-Step Solution

1
Identify the metric to be monitored (CPU usage exceeding 90 percent on a specific virtual machine).
CPU usage is an individual resource performance metric.
To determine whether the requirement relates to resource-level telemetry or platform-level service health.
2
Recall the purpose of Azure Service Health.
Azure Service Health tracks platform-wide events, outages, and planned maintenance affecting subscriptions and regions.
To verify if Azure Service Health supports monitoring individual resource telemetry.
3
Recall the purpose of Azure Monitor.
Azure Monitor collects and analyzes performance metrics (like CPU and memory usage) and logs for specific resources.
To identify the correct tool for resource performance alerts.
4
Evaluate the truth value of the statement.
The statement is false because the administrator must use Azure Monitor instead of Azure Service Health.
To reach the final correct answer.

Key Concept

Differentiating Azure Service Health from Azure Monitor for resource metrics
Question 543Question →

A development team is preparing to deploy an application consisting of a Web App, an Azure SQL Database, and a Storage Account. A developer suggests writing a step-by-step PowerShell script to create the resources in a specific sequence to prevent dependency conflicts during deployment.

Which of the following describes how Azure Resource Manager (ARM) templates or Bicep files handle this requirement?

Show answer & explanation

Answer: ARM templates are declarative, allowing ARM to analyze defined dependencies and deploy resources in parallel or the correct order automatically.

Answer

ARM templates are declarative, allowing ARM to analyze defined dependencies and deploy resources in parallel or the correct order automatically.
The correct option is correct because ARM templates and Bicep use a declarative syntax. You define the desired end state of the infrastructure, and Azure Resource Manager determines the correct order to deploy the resources, utilizing parallel execution where possible and resolving dependencies dynamically.

Step-by-Step Solution

1
Identify the core deployment model of ARM templates and Bicep.
They are declarative rather than imperative, meaning you specify the desired end state rather than step-by-step commands.
This establishes that sequential scripts are not required for provisioning order.
2
Analyze how ARM manages resource orchestration.
ARM evaluates dependencies (explicitly defined or implicitly derived) to build a dependency graph.
This enables ARM to safely deploy independent resources in parallel and dependent resources in their correct sequence.

Key Concept

Declarative nature and dependency orchestration of Azure Resource Manager (ARM) templates
Estimated Time:1m 0s
Question 544Question →

A logistics company hosts a customized delivery-tracking application on Azure App Service (PaaS). The IT team decides to migrate the application's features to a standard Software-as-a-Service (SaaS) cloud application to eliminate custom maintenance. Which of the following describes how the responsibility for network controls shifts after this migration?

Show answer & explanation

Answer: Responsibility shifts from being shared between the company and Microsoft to being the sole responsibility of Microsoft.

Answer

The responsibility for network controls shifts from being shared between the company and Microsoft under the PaaS model to being the sole responsibility of Microsoft under the SaaS model.
Under a Platform as a Service (PaaS) model, network controls are shared between the customer (who configures network security rules or endpoints) and the cloud provider (who manages the physical network). In a Software as a Service (SaaS) model, the cloud provider assumes full responsibility for network controls, leaving the customer responsible only for endpoints and data access.

Step-by-Step Solution

1
Analyze the resource's hosting model before and after the migration.
The application shifts from Azure App Service (Platform as a Service - PaaS) to a Software-as-a-Service (SaaS) application.
Identifying the source and destination cloud service models determines the starting and ending responsibility baselines.
2
Compare the ownership of network controls between PaaS and SaaS.
In PaaS, network controls are shared (the customer configures endpoints and firewall rules, while Microsoft manages underlying infrastructure). In SaaS, network controls are completely managed by Microsoft.
Determining how the responsibility boundaries differ for network controls between PaaS and SaaS reveals the shift direction.

Key Concept

Shared Responsibility Model transitions between PaaS and SaaS
Estimated Time:1m 15s
Question 545Question →

An energy provider needs to execute custom Python code whenever a wind turbine telemetry event is received. The execution must occur on-demand, scale dynamically to handle thousands of concurrent events, and incur no costs when the code is not running. Which service and hosting plan combination meets these requirements?

Show answer & explanation

Answer: Azure Functions on the Consumption plan

Answer

Azure Functions on the Consumption plan
The correct answer is Azure Functions on the Consumption plan. Azure Functions is Azure's serverless compute service designed for executing custom code blocks (such as Python) on-demand. When hosted on the Consumption plan, it automatically scales compute resources to meet load and dynamically scales down to zero instances when idle, meaning the user is billed only for active execution time.

Step-by-Step Solution

1
Analyze the custom logic requirement
The requirement specifies executing custom Python code, which indicates a code-first serverless service (Azure Functions) rather than a designer-first workflows service (Azure Logic Apps).
This narrows down the service choice between Azure Functions and Azure Logic Apps.
2
Evaluate the scaling and billing constraints
The requirement states the solution must scale dynamically and incur zero cost when not running. This points to the serverless Consumption plan.
Dedicated plans and Virtual Machines charge continuous flat rates regardless of activity.
3
Identify the management model responsibilities
Virtual Machines represent an Infrastructure-as-a-Service (IaaS) model where the customer is responsible for operating system updates, which does not fit the serverless requirement.
Ensures the chosen solution leverages full cloud provider platform management.

Key Concept

Azure serverless compute options and hosting plans
Estimated Time:1m 0s
Question 546Question →

An organization is planning to migrate its legacy intranet document management system, which is currently hosted on several Azure Virtual Machines (IaaS) with an on-VM SQL Server database. The security architecture team is comparing two migration paths:

- Path X (PaaS): Replatform the web tier to Azure App Service and migrate the database to Azure SQL Database.
- Path Y (SaaS): Replace the entire system with Microsoft 365 SharePoint Online.

Which of the following statements correctly describes the shift in responsibility for network controls and operating system patching when moving from the current IaaS state to either Path X or Path Y?

Show answer & explanation

Answer: For Path X, the responsibility for operating system patching transfers entirely to Microsoft, while network controls become a shared responsibility. For Path Y, the responsibility for both operating system patching and network controls transfers entirely to Microsoft.

Answer

For Path X (PaaS), the responsibility for operating system patching transfers entirely to Microsoft, while network controls become a shared responsibility. For Path Y (SaaS), the responsibility for both operating system patching and network controls transfers entirely to Microsoft.
Under the Azure Shared Responsibility Model, transitioning from Infrastructure as a Service (IaaS) to Platform as a Service (PaaS) or Software as a Service (SaaS) shifts various management tasks to Microsoft. In PaaS (Path X), Microsoft manages the physical infrastructure, virtualization, and the operating system (including OS patching), while network controls (like configuring virtual network integration or IP restrictions) are a shared responsibility between the customer and Microsoft. In SaaS (Path Y), Microsoft manages the entire stack except for information/data, devices, and accounts/identities, meaning both operating system patching and network controls are fully managed by Microsoft.

Step-by-Step Solution

1
Analyze the starting state (IaaS on Azure Virtual Machines).
In IaaS, the customer is fully responsible for operating system patching and configuring network controls (e.g., Network Security Groups, route tables).
Establishing the baseline responsibilities is necessary to evaluate the shift.
2
Evaluate the shift for Path X (PaaS using Azure App Service and Azure SQL Database).
In PaaS, the cloud provider (Microsoft) handles the physical infrastructure and the operating system (including OS patching). Network controls become a shared responsibility (e.g., the customer configures App Service networking integrations, firewall rules, and private endpoints, while Microsoft secures the underlying network infrastructure).
Determines the specific responsibility profile for the PaaS path.
3
Evaluate the shift for Path Y (SaaS using SharePoint Online).
In SaaS, Microsoft manages almost the entire stack, including physical hosts, network controls, operating systems, and applications. The customer only retains responsibility for information/data, devices, and accounts/identities.
Determines the specific responsibility profile for the SaaS path.
4
Compare the evaluation results with the options to identify the correct statement.
The statement describing Path X as having Microsoft-managed OS patching with shared network controls, and Path Y as having both OS patching and network controls fully managed by Microsoft, is correct.
Matches the logical analysis of the responsibility transitions to the correct option.

Key Concept

Shared Responsibility Model Transitions (IaaS to PaaS and SaaS)
Question 547Question →

A retail company is migrating its inventory tracking system from a custom application hosted on Azure Virtual Machines (IaaS) to Azure Blob Storage (PaaS) for unstructured data management. Under the Azure Shared Responsibility Model, how does the responsibility for operating system patching and physical host security change after this migration?

Show answer & explanation

Answer: Microsoft assumes responsibility for operating system patching, and Microsoft remains responsible for physical host security.

Answer

Microsoft assumes responsibility for operating system patching, and Microsoft remains responsible for physical host security.
The correct answer is that Microsoft assumes responsibility for operating system patching, and Microsoft remains responsible for physical host security. Under the Shared Responsibility Model, migrating from an IaaS model (Virtual Machines) to a PaaS model (Azure Blob Storage) shifts the responsibility of operating system patching from the customer to Microsoft. However, the responsibility for securing the physical host resides with Microsoft in all cloud service models.

Step-by-Step Solution

1
Identify the service models involved in the migration.
The migration shifts the workload from Azure Virtual Machines (Infrastructure as a Service - IaaS) to Azure Blob Storage (Platform as a Service - PaaS).
Identifying the source and target service models is required to analyze how responsibilities partition between the customer and Microsoft.
2
Determine the allocation of operating system patching responsibility before and after migration.
In IaaS, operating system patching is a customer responsibility, whereas in PaaS, Microsoft assumes responsibility for managing and patching the operating system.
Operating system and middleware management shifts to the cloud provider when transitioning from IaaS to PaaS.
3
Determine the allocation of physical host security responsibility before and after migration.
In both IaaS and PaaS models, physical host security remains the sole responsibility of Microsoft.
Physical security of the datacenters, hardware, and infrastructure is managed entirely by the cloud provider across all service types.

Key Concept

Shared Responsibility Model
Question 548Question →

A university is preparing a budget proposal to migrate its student registration portal from its local university-owned server room to Microsoft Azure. To justify the migration, the finance team needs to estimate the potential cost savings over a five-year period by comparing on-premises operational expenses—including server virtualization software licenses and IT labor—against running equivalent workloads in the cloud. Which tool should the university use to perform this comparison?

Show answer & explanation

Answer: Azure Total Cost of Ownership (TCO) Calculator

Answer

Azure Total Cost of Ownership (TCO) Calculator
The correct tool is the Azure Total Cost of Ownership (TCO) Calculator because it is designed to build a comparison report between existing on-premises server room workloads (including licensing, labor, and facilities costs) and equivalent Azure resources over a multi-year period to estimate potential savings.

Step-by-Step Solution

1
Identify the primary business objective.
The objective is to compare on-premises infrastructure costs (including labor and licensing) against Azure cloud costs to estimate five-year savings.
This determines whether the tool needs to evaluate current on-premises assets or future cloud resources.
2
Evaluate the capabilities of the available Azure cost tools.
The Total Cost of Ownership (TCO) Calculator ingests on-premises variables (hardware, software, electricity, labor) and generates a comparative savings report, whereas the Pricing Calculator only estimates cloud service costs.
Matching the scenario requirements (comparing on-premises to cloud) to the specific tool purpose identifies the correct choice.

Key Concept

Azure Pricing Calculator vs. TCO Calculator
Question 549Question →

A DevOps engineer notices that multiple Azure SQL Databases within their subscription are suddenly experiencing connection timeouts. The engineer needs to determine if this is a widespread Microsoft-managed infrastructure issue affecting their subscription's services in the region, rather than a problem with their application code or database configuration. Which Azure service should the engineer inspect to view incidents, planned maintenance, and health advisories specifically filtered to the services and regions active in their subscription?

Show answer & explanation

Answer: Azure Service Health

Answer

Azure Service Health
Azure Service Health provides a personalized dashboard that displays platform incidents, planned maintenance, and health advisories affecting only the specific Azure services and regions utilized by your subscription. This allows the engineer to quickly determine if database connection timeouts are due to a platform-level issue.

Step-by-Step Solution

1
Analyze the requirement to determine the source of the database connection timeouts.
The engineer needs to verify if there is an active Microsoft-managed platform incident or scheduled maintenance affecting their active Azure subscription services and regions.
This helps rule out local application or configuration errors before troubleshooting individual resource metrics.
2
Compare the capabilities of the available Azure management and monitoring services.
Azure Service Health is the designated service that filters platform health alerts and planned maintenance events specifically for the services and regions used by the subscription. Azure Monitor focuses on telemetry of the customer's own resources, while Azure Advisor provides configuration recommendations.
Choosing the service that provides personalized platform health tracking ensures the engineer gets the correct status without sorting through unrelated global updates.

Key Concept

Azure Service Health personalized platform monitoring
Question 550Question →

A company is evaluating its deployment strategy for two workloads:

- Workload 1: A proprietary database hosted on dedicated physical hardware that the company leases and manages inside a third-party vendor's datacenter. The hardware is not shared with any other tenants.
- Workload 2: A customer portal hosted on shared virtual machines on Microsoft Azure.

The company establishes a secure virtual private network (VPN) connection between the two workloads to allow database queries from the customer portal.

Which cloud model represents the hosted environment of Workload 1, and which cloud model represents the combined architecture of both workloads?

Show answer & explanation

Answer: Workload 1 is hosted in a private cloud, and the combined architecture is a hybrid cloud.

Answer

Workload 1 is hosted in a private cloud, and the combined architecture is a hybrid cloud.
The correct option is the one stating that Workload 1 is hosted in a private cloud and the combined architecture is a hybrid cloud. Workload 1 is a private cloud because it is built on dedicated hardware used exclusively by one organization, regardless of the fact that it is hosted in a third-party datacenter. The combined environment is a hybrid cloud because it establishes network connectivity and data sharing between this private cloud and Microsoft Azure, which is a public cloud.

Step-by-Step Solution

1
Analyze Workload 1 infrastructure ownership and access model.
Since the physical hardware is dedicated exclusively to one tenant and not shared, it is classified as a private cloud, despite being physically located in a third-party vendor's datacenter.
Private clouds can be hosted either in an on-premises datacenter or by a third-party service provider, as long as the organization has exclusive use of the isolated hardware.
2
Analyze Workload 2 deployment model.
Workload 2 runs on shared virtual machines on Microsoft Azure, which is a public cloud provider.
Public cloud services are owned and operated by a third-party cloud provider and share resources among multiple tenants.
3
Evaluate the combined architecture connecting Workload 1 and Workload 2.
The integration of a private cloud (Workload 1) and a public cloud (Workload 2) via a VPN connection results in a hybrid cloud model.
Hybrid cloud is defined by the combination of public and private cloud models, enabling data and applications to be shared and communicated between them.

Key Concept

Cloud Models (Public, Private, Hybrid, Multi-cloud)
Question 551Question →

A company is migrating its operations to Microsoft Azure. To ensure proper administration, the IT team needs to map specific tasks to their correct ownership classification under the Azure Shared Responsibility Model. How should the team pair each administrative task with its corresponding responsibility classification?

Click a left item, then click its matching right item

Items

Patching the guest operating system for an Azure Virtual Machine (IaaS)
Upgrading the database engine software for Azure SQL Database (PaaS)
Configuring identity and access management for Microsoft 365 (SaaS)

Matches

Show answer & explanation

Answer

Patching the guest operating system for an Azure Virtual Machine (IaaS) matches with a responsibility that remains solely with the customer. Upgrading the database engine software for Azure SQL Database (PaaS) matches with a responsibility shifted to Microsoft. Configuring identity and access management for Microsoft 365 (SaaS) matches with a customer responsibility even in a fully managed SaaS solution.
Patching the guest operating system of an Azure Virtual Machine is a customer responsibility because IaaS leaves OS control to the user. Upgrading database engine software for Azure SQL Database is Microsoft's responsibility since PaaS abstracts platform management. Configuring identity and access management for Microsoft 365 is the customer's responsibility because user access and identities are always managed by the customer regardless of the cloud model.

Step-by-Step Solution

1
Analyze the virtual machine task
Patching a guest OS on an Azure Virtual Machine (IaaS) is identified as a customer duty, because IaaS gives the customer control over the operating system.
To determine ownership of operating system maintenance in Infrastructure as a Service.
2
Analyze the database service task
Upgrading the database engine for Azure SQL Database (PaaS) is identified as a Microsoft duty, as PaaS removes the platform maintenance burden from the customer.
To determine ownership of database platform management in Platform as a Service.
3
Analyze the SaaS application task
Configuring identity and access policies for Microsoft 365 (SaaS) is identified as a customer duty, as user access control is never transferred to the cloud provider.
To determine ownership of identity and access management in Software as a Service.

Key Concept

Under the Azure Shared Responsibility Model, physical infrastructure management shifts to Microsoft, while data, endpoints, accounts, and access management always remain the responsibility of the customer. Responsibility for applications, network controls, and operating systems shifts between Microsoft and the customer depending on the service model (IaaS, PaaS, or SaaS).
Question 552Question →

A company is planning to migrate its workloads to Azure. The finance department wants to understand the cash flow impact of moving from their traditional on-premises data center to a consumption-based cloud model. Which of the following describes a key financial characteristic of this transition?

Show answer & explanation

Answer: The company shifts from paying upfront capital expenditures (CapEx) to paying ongoing operational expenditures (OpEx) based on usage.

Answer

The company shifts from paying upfront capital expenditures (CapEx) to paying ongoing operational expenditures (OpEx) based on usage.
The correct option is correct because migrating to a consumption-based cloud model removes the need for upfront capital investment in physical infrastructure (CapEx) and replaces it with ongoing, usage-based operational expenses (OpEx).

Step-by-Step Solution

1
Identify the nature of expenses in on-premises data centers.
On-premises data centers require buying physical hardware upfront, which is a Capital Expenditure (CapEx).
This establishes the starting financial state before migrating to the cloud.
2
Identify the nature of expenses in a consumption-based cloud model.
Azure consumption-based resources are billed as they are used, representing an Operational Expenditure (OpEx).
This defines the target financial state after the migration.
3
Compare the two states to find the correct transition direction.
The transition represents a shift from upfront CapEx (on-premises hardware) to consumption-based OpEx (cloud resources).
This directly answers the question about the financial characteristic of the transition.

Key Concept

Consumption-based models shift costs from CapEx to OpEx
Question 553Question →

An organization is designing a storage strategy in Azure for two specific needs:

1. A shared file repository that must be concurrently accessed by multiple virtual machines using the SMB protocol.
2. Security audit logs that are accessed less than once a year, where latency is not a concern but storage cost must be minimized.

Which two of the following configurations should the organization select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Azure Files to support the shared file repository using the SMB protocol; Azure Blob Storage using the Archive access tier to store the security audit logs

Answer

Azure Files to support the shared file repository using the SMB protocol, and Azure Blob Storage using the Archive access tier to store the security audit logs.
Azure Files is correct because it supports concurrent access via the SMB protocol for multiple virtual machines, while Azure Blob Storage Archive tier is correct for the audit logs because it offers the lowest storage cost for rarely accessed data that does not require immediate retrieval.

Step-by-Step Solution

1
Analyze the first requirement: a shared file repository accessible by multiple VMs simultaneously via the SMB protocol.
Identify Azure Files as the native service that provides SMB-based shared file systems in Azure.
Azure Files is designed for shared developer or application tools, utility shares, and department shares, allowing concurrent SMB access.
2
Analyze the second requirement: security audit logs accessed less than once a year, with high tolerance for latency and a need to minimize cost.
Identify Azure Blob Storage Archive tier as the appropriate solution.
The Archive tier offers the lowest storage cost but requires data rehydration before access, which fits the low-frequency and non-urgent latency requirements.
3
Evaluate the incorrect options to confirm they do not meet the constraints.
Discard the options suggesting direct reading from Archive tier or using the Archive tier with Azure Disk Storage.
Archive tier blobs are offline and cannot be read directly, and Azure Disk Storage does not feature access tiers like Archive.

Key Concept

Azure storage services (Files, Blobs, Disks) and access tiers (Archive) must be aligned to specific workload requirements for access protocols and cost/retention profiles.
Question 554Question →

To enforce configuration standards, a security team configures an Azure Policy definition with a Deny effect on a target resource group. Is the following statement true or false? Any pre-existing resources within the resource group that violate this policy will be automatically deleted by Azure Policy to maintain compliance.

Show answer & explanation

Answer: False

Answer

The statement is false. Azure Policy does not automatically delete existing resources that are non-compliant; it only flags them as non-compliant in the portal.
The correct answer is false because Azure Policy does not take destructive actions like deleting or stopping existing resources when a new policy definition is assigned. Instead, it identifies them as non-compliant in compliance reports, allowing administrators to perform remediation manually or via a remediation task for policies configured with remediation effects.

Step-by-Step Solution

1
Analyze the action of the Deny effect in Azure Policy.
The Deny effect prevents new resource deployments or updates to existing resources that do not comply with the policy definition.
This acts as a preventative guardrail for resource configuration.
2
Determine the impact of the policy on existing, pre-existing resources in the resource group.
Existing resources are evaluated against the policy and, if they violate it, their compliance state is reported as non-compliant. They are not modified, stopped, or deleted.
Azure Policy is designed to provide visibility and prevent new compliance issues without causing destructive actions or service disruptions to running resources.

Key Concept

Azure Policy evaluation of pre-existing resources and the preventative nature of the Deny effect.
Question 555Question →

A company wants to build a serverless workflow that automatically extracts data from an incoming email, updates records in a Dynamics 365 database, and sends a notification to a Slack channel. Azure Functions is the recommended primary service for this workflow because it provides a visual designer and pre-built connectors for Slack and Dynamics 365, eliminating the need to write custom integration code.

Show answer & explanation

Answer: False

Answer

False
The correct answer is False because the scenario describes a visual, connector-driven orchestration workflow, which is the primary use case for Azure Logic Apps. Azure Functions is a code-first service that requires writing custom code to implement logic.

Step-by-Step Solution

1
Analyze the requirements of the workflow in the scenario.
The workflow requires integrating multiple services (email, Dynamics 365, Slack) using a visual designer and pre-built connectors to avoid writing custom code.
Understanding whether the scenario calls for a code-first or a low-code/connector-first approach is key to choosing the correct serverless service.
2
Evaluate the capabilities of Azure serverless offerings against these requirements.
Azure Logic Apps provides a visual designer and hundreds of pre-built connectors for integration tasks. Azure Functions is code-first and requires writing custom code to execute logic and handle integrations.
This step distinguishes the primary use cases and interfaces of Azure Functions and Azure Logic Apps.
3
Determine if the statement correctly matches the service to the description.
The statement claims Azure Functions is the recommended service for this connector-first, visual workflow. This is incorrect, making the statement false.
Matching the logic allows us to determine the final true/false status of the statement.

Key Concept

Azure Serverless Compute: Azure Functions vs. Azure Logic Apps
Estimated Time:1m 0s
Question 556Question →

A news agency runs its website on an Azure Virtual Machine (IaaS). To eliminate the administrative effort of managing and patching the operating system, the agency migrates the website to Azure App Service (PaaS). Under the Microsoft Azure shared responsibility model, how does this migration change the responsibility for operating system patching?

Show answer & explanation

Answer: Responsibility for patching the operating system shifts from the customer to Microsoft.

Answer

Responsibility for patching the operating system shifts from the customer to Microsoft.
In Infrastructure as a Service (IaaS), such as Azure Virtual Machines, the customer is responsible for maintaining and patching the operating system. When migrating to a Platform as a Service (PaaS) offering like Azure App Service, Microsoft assumes responsibility for the operating system, hardware, and physical infrastructure, while the customer remains responsible for the applications and data they deploy.

Step-by-Step Solution

1
Identify the initial service model and its OS responsibility.
The website starts on an Azure Virtual Machine, which is an Infrastructure as a Service (IaaS) offering. In IaaS, the customer is responsible for managing, configuring, and patching the operating system.
To understand the change in responsibility, we must first establish the starting point.
2
Identify the target service model and its OS responsibility.
The website is migrated to Azure App Service, which is a Platform as a Service (PaaS) offering. In PaaS, Microsoft manages and patches the underlying operating system, runtime, and hardware.
Comparing the two models determines how the responsibility shifts.
3
Determine the direction of the responsibility shift.
Responsibility for OS patching shifts from the customer (in IaaS) to Microsoft (in PaaS).
This matches the migration described in the scenario.

Key Concept

Shared Responsibility Model
Estimated Time:45s
Question 557Question →

Match each business scenario to its corresponding cloud deployment model.

Click a left item, then click its matching right item

Items

A hospital hosts its public scheduling portal on Azure Web Apps and utilizes Azure Arc to manage databases running on dedicated physical servers in the hospital's own datacenter.
An online gaming platform deploys its matchmaking service on Azure Kubernetes Service (AKS) and its global player database on Google Cloud Spanner, without utilizing any on-premises hardware.
A national security agency hosts its databases on dedicated, physically isolated hardware managed by a third-party provider in a restricted facility, ensuring no other customer workloads share the infrastructure.
An analytics firm runs big data query workloads using Azure Synapse Analytics serverless pools, where the underlying physical hardware is dynamically shared with other organizations.

Matches

Show answer & explanation

Answer

Match the hospital using Azure Web Apps and local servers to Hybrid cloud; match the gaming platform using Azure AKS and GCP Spanner to Multi-cloud; match the national security agency using isolated hardware managed by a third party to Private cloud; and match the analytics firm using shared Synapse pools to Public cloud.
The correct matches align with the definitions of cloud models: combining public cloud and on-premises is Hybrid cloud; using multiple public cloud providers is Multi-cloud; using isolated, dedicated resources (even third-party hosted) is Private cloud; and using shared resources from a cloud provider is Public cloud.

Step-by-Step Solution

1
Analyze the hospital scenario (left_1).
It combines Azure Web Apps (public cloud) with physical servers in the hospital's datacenter (on-premises/private).
Identifying the combination of public cloud and private/on-premises resources determines a hybrid cloud deployment.
2
Analyze the gaming platform scenario (left_2).
It distributes workloads across Microsoft Azure (AKS) and Google Cloud (Spanner) without any on-premises footprint.
Identifying the use of multiple public cloud providers without on-premises integration determines a multi-cloud deployment.
3
Analyze the national security agency scenario (left_3).
It uses physically isolated, dedicated hardware owned/managed by a third-party hoster for exclusive access.
Identifying that the environment is single-tenant and isolated (regardless of location) determines a private cloud deployment.
4
Analyze the analytics firm scenario (left_4).
It runs serverless queries where hardware resources are dynamically shared across multiple clients.
Identifying dynamic resource sharing (multi-tenancy) provided by a cloud vendor determines a public cloud deployment.

Key Concept

Cloud Models (Public, Private, Hybrid, Multi-cloud)
Estimated Time:2m 0s
Question 558Question →

A media broadcasting company operates a custom media archive portal hosted on Azure App Service. To reduce development overhead, the company decides to migrate the entire system to Microsoft Dynamics 365 Content Services, which is a Software as a Service (SaaS) solution. During a pre-migration security assessment, the compliance officer evaluates how this transition alters their operational duties. Which of the following responsibilities will shift from a shared responsibility under the Platform as a Service (PaaS) model to the sole responsibility of Microsoft under the SaaS model?

Show answer & explanation

Answer: Maintaining, updating, and securing the core application software and framework.

Answer

Maintaining, updating, and securing the core application software and framework.
In the PaaS model (Azure App Service), application security and maintenance is a shared responsibility because the customer is responsible for the custom application code they deploy, while Microsoft manages the hosting environment. When migrating to a SaaS model (Dynamics 365), Microsoft assumes complete management of the application software, updates, and codebase security, shifting this responsibility entirely to the cloud provider.

Step-by-Step Solution

1
Identify the initial and target cloud deployment models in the scenario.
The initial model is Platform as a Service (PaaS) via Azure App Service, and the target model is Software as a Service (SaaS) via Microsoft Dynamics 365.
Understanding the boundary transition is essential to map the responsibilities.
2
Analyze the customer's application-level responsibilities in PaaS.
In PaaS, the customer is responsible for developing, maintaining, and securing their own application code and configuration.
This establishes what application duties the customer initially held.
3
Analyze how application-level responsibilities change in SaaS.
In SaaS, the vendor (Microsoft) provides the fully functional application, including its code, updates, and built-in security.
This determines which duties shift to the cloud provider.
4
Verify other areas (OS patching, database config, and data governance) to rule out incorrect options.
OS patching is already Microsoft's job in PaaS. Data classification is always the customer's job in all models. Database middleware configuration does not apply as a customer task shifting from PaaS to SaaS.
This ensures the selected answer is the unique and correct responsibility shift.

Key Concept

Shared Responsibility Model (PaaS to SaaS transition)
Estimated Time:2m 0s
Question 559Question →

Determine whether the following statement is true or false: In a consumption-based cloud model, organizations must pay upfront costs for purchasing and setting up physical hardware before deploying services.

Show answer & explanation

Answer: False

Answer

False
The statement is false because a consumption-based cloud model eliminates the need for upfront capital expenses (CapEx) for physical infrastructure, allowing organizations to pay for resources as they are used (OpEx).

Step-by-Step Solution

1
Analyze the financial characteristics of a consumption-based cloud model.
Under a consumption-based model, users are billed only for what they use (pay-as-you-go), which aligns with operational expenditure (OpEx).
To determine how expenses are structured and when payments occur in the cloud.
2
Evaluate the statement regarding upfront payments for physical infrastructure.
Upfront payments for physical hardware (like buying servers) are characteristic of a capital expenditure (CapEx) model, not a consumption-based cloud model.
To verify if the statement accurately describes the consumption-based model.

Key Concept

Under a consumption-based model, organizations do not pay upfront costs for physical infrastructure; instead, they pay for resources as they consume them (OpEx).
Question 560Question →

An organization is planning to decommission their physical secondary datacenter used for disaster recovery. They want to compare the five-year cost of maintaining the physical servers, power, cooling, and virtualization licensing in their own datacenter against the projected cost of running the disaster recovery workloads in Microsoft Azure. Which tool should the organization use to generate this comparative financial analysis?

Show answer & explanation

Answer: Total Cost of Ownership Calculator

Answer

Total Cost of Ownership Calculator
The Total Cost of Ownership Calculator is the correct tool because it allows organizations to input their current on-premises infrastructure details (such as server configurations, storage, electricity, and IT labor) and compare those expenses with the equivalent services in Azure over a multi-year period to build a financial case for migration.

Step-by-Step Solution

1
Identify the primary objective of the scenario.
The goal is to compare the cost of running workloads on-premises (secondary datacenter) versus in Microsoft Azure over a five-year period.
This establishes that we need a comparative cost tool that accounts for on-premises capital and operational expenses.
2
Evaluate the available tools against the requirement.
The Total Cost of Ownership Calculator is the tool designed to compare on-premises costs (including physical servers, power, cooling, and licensing) with Azure service costs, whereas other tools focus on estimating new cloud-only deployments or managing existing cloud resources.
Choosing the correct tool requires distinguishing between pre-migration comparative analysis and post-deployment monitoring or standalone service estimation.

Key Concept

Distinguishing between Azure cost estimation and optimization tools, specifically comparing on-premises TCO with cloud costs.
Estimated Time:1m 15s
PreviousPage 28 / 60Next
All practice questions — Microsoft Azure Fundamentals (AZ-900) | Examkin