Examkin

All practice questions

1186 questions

All types1,186Multiple choice620Multiple select228True / False291Matching47
Question 81Question →

Determine if the following statement is true or false:

A developer who is assigned the Owner role for an Azure resource group can successfully create Azure SQL databases in that resource group, even if an Azure Policy is assigned at the parent subscription level to deny the creation of SQL databases.

Show answer & explanation

Answer: False

Answer

The statement is false. Azure Policy restrictions are evaluated at resource deployment and take precedence over Azure Role-Based Access Control (RBAC) permissions, meaning even a user with the Owner role cannot create a resource that violates a Deny policy.
The statement is false. Azure Policy evaluates resource creation requests and applies restrictions independently of Azure RBAC permissions. An Owner role grants permissions under RBAC, but it does not grant the authorization to bypass active Azure Policy deny rules.

Step-by-Step Solution

1
Determine the user's authorization level under Azure RBAC.
The user has the Owner role on the resource group, which grants full management rights to all resources inside that resource group, including creation rights.
To evaluate what actions the user is authorized to attempt.
2
Determine the policy scope and restriction.
An Azure Policy denying SQL database creation is applied at the subscription level, which is a parent scope that automatically inherits down to the resource group.
To identify active policy rules that apply to the resource group.
3
Compare the precedence of RBAC and Azure Policy rules.
During resource deployment, Azure Policy is evaluated first. If a Deny policy is violated, the deployment is blocked even if the user has the RBAC permissions to create the resource.
To resolve conflicts between RBAC access permissions and Azure Policy constraints.

Key Concept

Azure RBAC vs. Azure Policy precedence
Question 82Question →

An enterprise Azure subscription has a `ReadOnly` lock applied at the subscription level. Within this subscription, a resource group named `RG-CoreServices` contains an Azure Cosmos DB account named `cosmos-orders` and an Azure Storage account named `stbackups`. A `CanNotDelete` lock is applied directly to `RG-CoreServices`.

An administrator with the Owner role at the subscription level needs to perform maintenance. Which two of the following actions can the administrator successfully complete without modifying or removing any resource locks? (Select two.)

Select all that apply

Show answer & explanation

Answer: Upload a database backup file to an existing blob container in `stbackups` using a pre-existing Shared Access Signature (SAS).; Delete an existing log file stored as a blob in a container within `stbackups` using direct data plane access.

Answer

The administrator can upload a database backup file to an existing blob container using a pre-existing Shared Access Signature (SAS), and delete an existing log file stored as a blob using direct data plane access.
The correct options are uploading a backup file and deleting a log file. Both operations are data plane tasks interacting directly with the storage container contents rather than modifying the Azure Resource Manager (ARM) configuration of the resource. Resource locks only restrict control plane operations.

Step-by-Step Solution

1
Determine the scope and inheritance of the applied locks.
The ReadOnly lock applied at the subscription level inherits down to all resource groups and resources in the subscription, making them effectively read-only. The CanNotDelete lock on the resource group prevents deletion of the resource group and its resources.
Resource locks are inherited by all child resources.
2
Distinguish between control plane and data plane operations.
Resource locks apply strictly to the Azure Resource Manager control plane (operations managing resources). They do not restrict data plane operations (reading, writing, or deleting data within the resources).
This determines which operations bypass resource locks.
3
Evaluate each action against the lock restrictions.
Creating a resource group, modifying firewall rules, and listing access keys are all control plane operations blocked by the ReadOnly lock. Uploading a blob and deleting a blob are data plane operations and are permitted.
To identify which actions will succeed without removing the locks.

Key Concept

Azure Resource Locks restrict control plane operations (such as configuration changes and resource deletion) but do not block data plane operations (such as manipulating data inside a storage account or database). ReadOnly locks also block operations that retrieve keys (like listKeys) because keys grant write access.
Question 83Question →

A logistics company has SQL Server instances running on edge servers across several regional distribution centers. The company wants to use the Azure Portal to manage, audit compliance, and configure security policies for these external SQL Server instances using Azure Policy and Microsoft Defender for Cloud.

Which Azure service enables the company to extend these Azure management and governance capabilities to their distribution center SQL Server instances?

Show answer & explanation

Answer: Azure Arc

Answer

Azure Arc
Azure Arc is the correct choice because it acts as a bridge that projects non-Azure resources (such as on-premises physical/virtual servers, Kubernetes clusters, and SQL Server instances) into Azure Resource Manager. This enables organizations to manage and govern these hybrid resources using native Azure tools like Azure Policy and Microsoft Defender for Cloud directly from the Azure Portal.

Step-by-Step Solution

1
Analyze the requirement to manage, secure, and govern SQL Server instances residing outside of Azure (on-premises edge distribution centers) from the Azure Portal.
The solution requires a service that extends Azure Resource Manager (ARM) capabilities to hybrid and multi-cloud environments.
Standard Azure tools cannot natively govern or apply policies to non-Azure resources without a bridge service.
2
Evaluate the capabilities of Azure Arc against the scenario.
Azure Arc projects external resources (such as servers, Kubernetes clusters, and SQL databases) into Azure as resources, enabling the use of Azure Policy and Defender for Cloud.
This matches the exact need of extending governance to distribution center SQL Server instances.

Key Concept

Azure Arc is designed to extend Azure management, governance, and security capabilities to resources located outside of Azure, including on-premises datacenters, edge locations, and other cloud providers.
Estimated Time:1m 0s
Question 84Question →

Match each Microsoft Azure database service to its primary description. To answer, drag the appropriate service from the column on the left to its description on the right.

Click a left item, then click its matching right item

Items

Azure SQL Database
Azure Cosmos DB
Azure Database for PostgreSQL

Matches

Show answer & explanation

Answer

Azure SQL Database matches with the Microsoft SQL Server engine description; Azure Cosmos DB matches with the globally distributed NoSQL service description; Azure Database for PostgreSQL matches with the fully managed community PostgreSQL engine description.
Azure SQL Database uses the Microsoft SQL Server engine; Azure Cosmos DB is a globally distributed NoSQL database supporting various APIs; Azure Database for PostgreSQL is an open-source relational database service.

Step-by-Step Solution

1
Identify the core database type (relational vs. non-relational) for each service.
Azure SQL Database and Azure Database for PostgreSQL are relational, while Azure Cosmos DB is non-relational (NoSQL).
This classification immediately isolates Azure Cosmos DB to the NoSQL description.
2
Distinguish between the two relational database engines based on their underlying platform.
Azure SQL Database is based on proprietary SQL Server, while Azure Database for PostgreSQL uses the open-source community PostgreSQL engine.
This resolves the remaining matches for the relational services.

Key Concept

Azure Database Services (Relational, Non-Relational, and Cosmos DB)
Estimated Time:1m 0s
Question 85Question →

An organization has an Azure subscription containing multiple resource groups. An administrator wants to ensure that no users can create virtual machines within the subscription. The administrator removes all Owner and Contributor role assignments at the subscription level.

Is the statement 'Removing these role assignments at the subscription level guarantees that no users can create virtual machines anywhere within the subscription' true or false?

Show answer & explanation

Answer: False

Answer

The statement is false.
The correct answer is false because Azure RBAC permissions are additive. Removing subscription-level roles does not prevent users from having roles assigned directly at the resource group scope, which would allow them to create virtual machines in those specific resource groups. Furthermore, enforcing resource compliance subscription-wide is a capability of Azure Policy, not Azure RBAC.

Step-by-Step Solution

1
Analyze the action taken by the administrator at the subscription scope.
All Owner and Contributor role assignments are removed at the subscription level, meaning no permissions are inherited from the subscription scope to child scopes for these roles.
To understand the baseline permissions inherited by resource groups.
2
Evaluate the possibility of RBAC role assignments at lower scopes.
Users can still be assigned roles like Contributor or Virtual Machine Contributor directly at the resource group scope.
Azure RBAC allows roles to be assigned at different levels (Management Group, Subscription, Resource Group, Resource), and permissions are additive.
3
Evaluate the role of Azure Policy vs. Azure RBAC for enforcing subscription-wide compliance rules.
Removing RBAC roles does not enforce a compliance rule; to guarantee that no virtual machines can be created subscription-wide, an Azure Policy with a Deny effect should be applied.
Azure Policy is designed for governing and enforcing resource creation standards, whereas RBAC is designed for managing identity-based permissions.

Key Concept

Azure RBAC inheritance and scope properties, and the distinction between Azure RBAC and Azure Policy.
Question 86Question →

A financial organization needs to establish network connectivity between its on-premises headquarters and resources inside an Azure virtual network. The organization's compliance team mandates that no data can traverse the public internet, and the application requires a dedicated connection with guaranteed bandwidth and sub-millisecond latency.

Which Azure service should the organization implement?

Show answer & explanation

Answer: Azure ExpressRoute

Answer

Azure ExpressRoute
Azure ExpressRoute establishes a private connection between an on-premises infrastructure and Azure datacenters through a connectivity provider. Because this traffic does not go over the public internet, it ensures compliance with the strict security policy and provides highly predictable bandwidth and low latency.

Step-by-Step Solution

1
Analyze the business and technical requirements.
The solution must connect on-premises to Azure, bypass the public internet entirely, and provide dedicated bandwidth and ultra-low latency.
This filters out services that use the public internet or do not support hybrid connectivity.
2
Compare Azure hybrid networking options against the constraints.
Azure VPN Gateway uses the public internet. Azure ExpressRoute uses a dedicated private connection via a connectivity provider, bypassing the public internet.
To select the service that satisfies both the compliance and performance constraints.

Key Concept

Azure ExpressRoute private hybrid connectivity
Estimated Time:1m 30s
Question 87Question →

An organization is migrating a legacy web API to a cloud-native architecture. The API has been packaged as a single Docker container. The migration strategy mandates the following operational constraints:

1. The cloud platform must automatically manage and apply all operating system security updates and patches.
2. The platform must dynamically scale the container instances horizontally based on incoming HTTP request volume.
3. The organization must avoid the complexity of managing a container orchestrator, dedicated virtual cluster nodes, or custom auto-scaling scripts.

Which Azure service should the organization select to host this containerized application?

Show answer & explanation

Answer: Azure App Service

Answer

Azure App Service
Azure App Service (specifically Web App for Containers) is a Platform as a Service (PaaS) offering that hosts containerized web applications. It meets all three constraints: the platform automatically applies OS-level security updates, it supports native horizontal autoscaling based on HTTP request volume or CPU usage, and it hides the complexity of container orchestration or cluster management.

Step-by-Step Solution

1
Analyze the host management requirements.
Azure Virtual Machines is eliminated because OS patching must be managed automatically by the platform (PaaS), whereas Virtual Machines (IaaS) require customer patching.
To satisfy the constraint of automated OS security updates without customer maintenance.
2
Analyze the orchestration and scaling requirements.
Azure Kubernetes Service (AKS) is eliminated because the organization must avoid cluster orchestration management complexity.
To satisfy the constraint of minimizing operational complexity and avoiding container orchestrator management.
3
Analyze the auto-scaling capability for HTTP traffic.
Azure Container Instances (ACI) is eliminated because it lacks native, out-of-the-box automatic scaling based on HTTP request volumes without external integrations or custom automation scripts.
To satisfy the dynamic horizontal scaling requirement based on incoming traffic volume.
4
Identify the service that meets all criteria.
Azure App Service matches all requirements: it is PaaS (platform manages OS patching), scales dynamically based on HTTP requests, and requires zero orchestrator or cluster node management.
To select the host service that aligns with all three operational constraints.

Key Concept

Differentiating container hosting capabilities and management overhead among Azure App Service, Azure Container Instances (ACI), and Azure Kubernetes Service (AKS)
Question 88Question →

A company is designing an administrative strategy to manage its Azure environment. The strategy must accommodate a diverse IT team with the following requirements:

1. Administrators using macOS and Linux workstations must run automated deployment scripts locally using Azure PowerShell.
2. Field engineers using mobile devices must execute ad-hoc Azure CLI commands via a web browser.
3. All team members must have access to a shared, persistent workspace for shell scripts directly within their browser-based command-line interface.

Which configuration and tool combination should the company implement?

Show answer & explanation

Answer: Install PowerShell Core and the Az PowerShell module locally on macOS and Linux; have field engineers use Azure Cloud Shell (Bash or PowerShell), which mounts an Azure File share to persist scripts across sessions.

Answer

Install PowerShell Core and the Az PowerShell module locally on macOS and Linux; have field engineers use Azure Cloud Shell (Bash or PowerShell), which mounts an Azure File share to persist scripts across sessions.
The correct option correctly states that Azure PowerShell runs locally on macOS and Linux using PowerShell Core and the Az module. It also correctly identifies that Azure Cloud Shell provides browser-based CLI and PowerShell environments, and relies on an Azure File share to provide persistent storage for user files across sessions.

Step-by-Step Solution

1
Evaluate local workstation requirements for macOS and Linux users who need to run Azure PowerShell.
Determine that Azure PowerShell is cross-platform when installed with PowerShell Core and the Az module, allowing local script execution on macOS and Linux without Windows virtualization.
To verify if local Azure PowerShell execution is possible on non-Windows platforms.
2
Evaluate browser-based CLI access for field engineers using mobile devices.
Identify Azure Cloud Shell as the browser-based environment that provides both Azure CLI and Azure PowerShell tools without requiring local installations.
To satisfy the requirement of running ad-hoc Azure CLI commands from a web browser.
3
Determine the persistence mechanism for browser-based shell scripts.
Identify that Azure Cloud Shell requires mounting an Azure File share to persist a user's home directory and files across sessions, rather than using browser storage or OneDrive.
To satisfy the requirement of accessing a shared, persistent workspace for scripts in the web-based shell.

Key Concept

Cross-platform compatibility of Azure management tools (Azure PowerShell, CLI) and Azure Cloud Shell persistence mechanisms.
Estimated Time:1m 30s
Question 89Question →

A logistics company is designing its hybrid network architecture. The primary datacenter requires a dedicated connection that bypasses the public internet to ensure predictable latency for real-time data replication. A remote warehouse needs a cost-effective, encrypted connection to manage virtual machines within an Azure Virtual Network. Which of the following Azure networking services should the company implement to meet these requirements? Select two.

Select all that apply

Show answer & explanation

Answer: An Azure ExpressRoute circuit for the primary datacenter connection; An Azure VPN Gateway for the remote warehouse connection

Answer

The logistics company should configure an Azure ExpressRoute circuit for the primary datacenter and an Azure VPN Gateway for the remote warehouse.
The correct options are the deployment of an Azure ExpressRoute circuit for the primary datacenter and an Azure VPN Gateway for the remote warehouse. Azure ExpressRoute provides a dedicated, private connection to Azure resources that does not traverse the public internet, offering high reliability and predictable latency for real-time replication. Azure VPN Gateway establishes an encrypted tunnel over the public internet, making it a secure and cost-effective solution for management traffic from remote locations.

Step-by-Step Solution

1
Analyze the requirements for the primary datacenter connection, which calls for a dedicated connection that bypasses the public internet and provides predictable latency.
Identify Azure ExpressRoute as the service designed for private, dedicated connectivity that does not traverse the public internet.
ExpressRoute connects on-premises networks directly to Microsoft services over a private peering connection.
2
Analyze the requirements for the remote warehouse, which asks for a cost-effective, encrypted connection to manage virtual machines.
Identify Azure VPN Gateway as the appropriate service for establishing secure, encrypted IPsec tunnels over the public internet.
VPN Gateways are highly cost-effective and provide secure communication over the public internet, suitable for remote management.

Key Concept

Azure hybrid connectivity services (VPN Gateway and ExpressRoute)
Question 90Question →

An administrator needs to configure permissions for a junior auditor. The auditor must be able to view the configuration of all resources in an Azure resource group named RG-Analytics, but must not be allowed to create, modify, or delete any resources. Other administrators must still be able to fully manage and edit resources within RG-Analytics. Which configuration should the administrator apply to the junior auditor?

Show answer & explanation

Answer: Assign the Reader role to the junior auditor at the RG-Analytics scope

Answer

Assign the Reader role to the junior auditor at the RG-Analytics scope
Assigning the Reader role to the junior auditor at the RG-Analytics scope allows the auditor to view all resources in the resource group but prevents them from making changes. It does not affect other administrators who have higher permissions (like Contributor or Owner) on the resource group.

Step-by-Step Solution

1
Identify the goal: allow a specific user to view resources but not modify them, while keeping other administrators' access intact.
Requires user-specific authorization control rather than a global resource restriction.
This determines that Azure Role-Based Access Control (RBAC) is the correct feature to use, rather than resource locks or Azure Policy.
2
Select the appropriate built-in Azure RBAC role that matches the read-only requirement.
The Reader role provides read-only access to resources at the specified scope.
The Reader role allows viewing resources but prevents any creation, modification, or deletion, satisfying the requirements without affecting other users.

Key Concept

Azure Role-Based Access Control (RBAC) allows administrators to assign specific permissions to users, groups, or service principals at different scopes (Management Groups, Subscriptions, Resource Groups, or Resources) using built-in roles like Reader, Contributor, and Owner.
Estimated Time:45s
Question 91Question →

An administrator is designing a hybrid cloud connectivity solution for a retail company. The company requires a secure connection for lower-bandwidth workloads, and a separate dedicated, high-speed connection for production database synchronization. Which two of the following statements correctly describe the Azure hybrid networking options for these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: A Site-to-Site VPN gateway sends encrypted traffic over the public internet, making it suitable for lower-bandwidth hybrid connectivity.; Azure ExpressRoute provides a dedicated, private connection to Azure resources without routing traffic over the public internet.

Answer

A Site-to-Site VPN gateway sends encrypted traffic over the public internet, and Azure ExpressRoute provides a dedicated, private connection to Azure resources without routing traffic over the public internet.
The correct options are the statements describing that a Site-to-Site VPN gateway sends encrypted traffic over the public internet, and that Azure ExpressRoute provides a dedicated, private connection to Azure resources without routing traffic over the public internet. These are standard features of Azure hybrid connectivity services.

Step-by-Step Solution

1
Analyze the requirements for lower-bandwidth and dedicated high-speed connections.
Identify that the lower-bandwidth requirement aligns with VPN Gateway, and the dedicated high-speed requirement aligns with ExpressRoute.
This helps filter the correct service characteristics.
2
Evaluate the connectivity path for both services.
VPN Gateway routes encrypted traffic over the public internet, while ExpressRoute routes traffic over a private dedicated connection, bypassing the public internet.
This distinguishes between the public internet transit of VPN and the private transit of ExpressRoute.

Key Concept

Azure hybrid networking options, specifically the differences in internet routing and privacy between VPN Gateway and ExpressRoute.
Question 92Question →

A company is planning to deploy two different containerized workloads to Azure:

* Workload 1: A simple batch processing task packaged as a single container that runs once daily for 15 minutes.
* Workload 2: A complex application composed of 25 interconnected containerized microservices that require service discovery, horizontal autoscaling, and coordinated rolling updates.

The company wants to minimize both administrative effort and operational costs.

Which two Azure services should the company select to host these workloads?

Select all that apply

Show answer & explanation

Answer: Azure Container Instances; Azure Kubernetes Service

Answer

Azure Container Instances and Azure Kubernetes Service
Azure Container Instances is the ideal choice for running a single container for a brief period on demand, as it provides a serverless platform with no virtual machine management overhead and charges only for the execution duration. Azure Kubernetes Service is the correct choice for hosting a large, multi-container microservices application because it provides the required orchestration features, such as automated service discovery, rolling updates, and scale management, while still being a managed service that minimizes infrastructure administration compared to self-managed Kubernetes.

Step-by-Step Solution

1
Analyze the requirements for Workload 1.
Workload 1 is a single container running for only 15 minutes daily. This is a short-lived, task-based workload that does not require container orchestration. Azure Container Instances is the most cost-effective and low-overhead service for this case.
It runs containers on-demand with per-second billing and zero infrastructure management.
2
Analyze the requirements for Workload 2.
Workload 2 consists of 25 interconnected microservices requiring container orchestration capabilities such as service discovery, load balancing, autoscaling, and coordinated rollouts. Azure Kubernetes Service is the native managed orchestrator in Azure.
It provides full Kubernetes orchestration while reducing management overhead compared to self-managed Kubernetes deployments.
3
Evaluate the distractors against the goal to minimize management effort and operational costs.
Azure Virtual Machines increase administrative effort due to OS patching, and Azure App Service does not natively support complex multi-container orchestration with service discovery for 25 microservices.
This rules out the incorrect options.

Key Concept

Azure container hosting services comparison
Estimated Time:1m 30s
Question 93Question →

An administrator assigns User1 the Reader role at the subscription scope. Within this subscription, there is a resource group named Dev-RG. The administrator assigns User2 the Contributor role at the scope of Dev-RG. Which of the following statements about their inherited permissions are correct? (Select TWO)

Select all that apply

Show answer & explanation

Answer: User1 can view all resources within the subscription, including those inside Dev-RG.; User2 can create and delete resources within Dev-RG, but cannot grant other users access to the resource group.

Answer

The correct statements are that User1 can view all resources within the subscription, and User2 can manage resources within Dev-RG without being able to grant access to others.
The correct statements are that the user with the Reader role at the subscription scope can view all resources in the subscription, and the user with the Contributor role at the resource group scope can create and delete resources within that resource group. Reader permissions inherit downwards from the subscription to all resource groups. The Contributor role grants full resource management rights but does not permit role assignments.

Step-by-Step Solution

1
Evaluate the permissions and scope of User1.
User1 is assigned the Reader role at the subscription level. Due to hierarchical inheritance, this permission flows down to all resource groups (like Dev-RG) and resources within the subscription, permitting read-only access to all of them.
To determine what resources User1 can access and what actions they can perform.
2
Evaluate the permissions and scope of User2.
User2 is assigned the Contributor role at the Dev-RG resource group level. This allows User2 to create, manage, and delete resources within Dev-RG, but they cannot assign permissions to others because the Contributor role lacks authorization write privileges.
To determine the capabilities of User2 within their assigned resource group scope.
3
Evaluate the incorrect options regarding nesting and policy enforcement.
Azure does not support nesting resource groups, so nested group creation is invalid. Enforcing configuration compliance is managed by Azure Policy rather than Azure RBAC.
To rule out the distractors by identifying resource group hierarchy limits and the boundary between RBAC and Azure Policy.

Key Concept

Azure Role-Based Access Control (RBAC) inheritance and scope boundaries, and its distinction from Azure Policy.
Question 94Question →

An administrator is configuring access and governance for an Azure subscription. The administrator needs to determine whether to use Azure Role-Based Access Control (RBAC) or Azure Policy for different requirements.

Which of the following scenarios are best addressed by using Azure RBAC? (Select two correct options.)

Select all that apply

Show answer & explanation

Answer: Allowing a database administrator to manage SQL databases but not the virtual machines that host them.; Allowing an external auditor to view the configuration settings of all resources in a resource group without making changes.

Answer

Azure RBAC is best suited for allowing a database administrator to manage SQL databases but not virtual machines, and allowing an external auditor to view resource configurations without making changes.
Azure RBAC is designed for user access management. Allowing a database administrator to manage SQL databases and allowing an auditor to view resource configurations are access-control permissions managed through RBAC roles (such as SQL DB Contributor and Reader).

Step-by-Step Solution

1
Analyze the purpose of Azure RBAC.
Azure RBAC focuses on user access management, specifying who (user, group, service principal) has what access (Owner, Contributor, Reader) to which resources.
This establishes the boundary of Azure RBAC capabilities.
2
Analyze the purpose of Azure Policy.
Azure Policy focuses on resource properties and compliance, ensuring that deployed resources adhere to organizational standards (e.g., tags, allowed regions, VM sizes).
This distinguishes Azure Policy from Azure RBAC.
3
Evaluate the scenarios against the capabilities of each tool.
Managing SQL databases (a permissions action) and viewing resource configurations (a read permission) are user access scenarios managed by Azure RBAC. Requiring tags and restricting VM sizes are resource property constraints managed by Azure Policy.
This identifies the correct options.

Key Concept

Azure Role-Based Access Control (RBAC) vs Azure Policy
Question 95Question →

An organization needs to run a temporary, event-driven data analysis tool that is packaged as a single container. The container must start immediately when triggered by an API call, run for less than five minutes, and then shut down. The organization wants to avoid managing virtual machines or container orchestrators, and they want to pay only for the exact CPU and memory resources consumed during the container's active execution. Which Azure service should the organization use?

Show answer & explanation

Answer: Azure Container Instances

Answer

Azure Container Instances is the correct service because it allows running a single container on-demand with per-second billing and zero virtual machine or orchestrator management overhead.
Azure Container Instances is correct because it is a serverless compute service that enables you to package and run containers on-demand without managing virtual servers or orchestrators. It provides per-second billing, making it the most cost-effective and low-overhead option for a single container running for only a few minutes.

Step-by-Step Solution

1
Analyze the workload characteristics
The workload consists of a single container that runs for a very short duration (less than five minutes) and is triggered on-demand.
This rules out complex container orchestrators like Azure Kubernetes Service, which are designed for multi-container deployments and continuous scaling.
2
Evaluate management and billing requirements
The organization wants to avoid managing virtual machines and only wants to pay for the exact CPU and memory consumed during active execution.
This rules out Azure Virtual Machines (which require operating system management and continuous billing) and Azure App Service (which requires a continuously billed App Service plan).
3
Identify the service that matches all criteria
Azure Container Instances provides serverless, on-demand container execution with per-second billing and zero infrastructure management.
Azure Container Instances is the standard Azure service designed specifically for isolated, short-lived container tasks.

Key Concept

Azure Container Instances is a serverless container hosting service that allows users to deploy containers without provisioning virtual machines or managing container orchestrators.
Question 96Question →

An enterprise manages its resources using an Azure Management Group named Group-Main. Inside Group-Main, there is a subscription named Sub-Prod, which contains a resource group named RG-App. RG-App contains a virtual machine named VM-Web. You need to configure access for an auditor named Auditor1 to meet the following requirements:
1. Auditor1 must be able to view the configuration of all existing and future resources across all subscriptions under Group-Main.
2. Auditor1 must be able to assign and revoke RBAC roles for VM-Web only.
3. Auditor1 must not be able to modify the resource configuration or delete VM-Web.
4. The solution must minimize administrative effort and follow the principle of least privilege.

Which configuration should you implement?

Show answer & explanation

Answer: Assign the Reader role to Auditor1 at the Group-Main scope, and assign the User Access Administrator role to Auditor1 at the VM-Web scope.

Answer

Assign the Reader role to Auditor1 at the Group-Main scope, and assign the User Access Administrator role to Auditor1 at the VM-Web scope.
Assigning the Reader role at the Management Group level ensures the auditor can view all current and future resources across all subscriptions due to inheritance. Assigning the User Access Administrator role at the virtual machine level grants the ability to manage role assignments on that specific resource without providing permissions to modify or delete the resource itself.

Step-by-Step Solution

1
Analyze the viewing requirement for all resources under the Management Group.
Assign the Reader role at the Group-Main management group scope. This ensures access is inherited by all subscriptions, resource groups, and resources underneath.
Azure RBAC permissions propagate down the management hierarchy through inheritance.
2
Analyze the permission management requirement for the specific virtual machine.
Assign the User Access Administrator role at the VM-Web resource scope.
This role allows the user to manage role assignments (grant/revoke access) for VM-Web without granting administrative control over the resource itself.
3
Apply the principle of least privilege and verify restrictions.
Ensure the Auditor1 does not receive Owner or Contributor roles at scopes higher than VM-Web, preventing unauthorized configuration changes or deletion of VM-Web.
The Owner role at any scope covering VM-Web would allow deletion and configuration modifications, which violates the security constraints.

Key Concept

Azure Role-Based Access Control (RBAC) scopes and role inheritance
Question 97Question →

An organization is planning to migrate two application workloads to Azure with the following requirements:

* Workload 1: A containerized event-driven task that runs periodically for less than ten minutes. It must execute immediately upon triggering without requiring the setup or billing of virtual servers when idle.
* Workload 2: A web application hosting multiple containers that share a common lifecycle. It requires built-in deployment slots and automated operating system patching managed entirely by Microsoft.

Which Azure services should you recommend to support these workloads? (Select two.)

Select all that apply

Show answer & explanation

Answer: Azure Container Instances for Workload 1; Azure App Service for Workload 2

Answer

The correct recommendations are Azure Container Instances for Workload 1 and Azure App Service for Workload 2.
Azure Container Instances is the correct recommendation for Workload 1 because it provides a serverless container environment that spins up instantly and bills only for the duration of execution. Azure App Service is the correct recommendation for Workload 2 because it is a platform-as-a-service (PaaS) offering that automates operating system patching and includes built-in deployment slots.

Step-by-Step Solution

1
Analyze the requirements for Workload 1.
Workload 1 is an event-driven container running for less than ten minutes that needs to execute immediately without server management or idle costs.
Azure Container Instances (ACI) is a serverless container hosting service that fits this pattern perfectly by scaling to zero and running containers without VM provisioning.
2
Analyze the requirements for Workload 2.
Workload 2 is a multi-container web application needing deployment slots and automated OS patching managed by Microsoft.
Azure App Service is a PaaS hosting option that automatically manages OS patching, supports multi-container groups sharing a lifecycle, and features native deployment slots.
3
Evaluate the remaining options against the workloads.
Azure Kubernetes Service (AKS) adds complex orchestration management overhead, while Azure Virtual Machines (IaaS) requires manual OS patching and costs money even when idle.
Both AKS and Virtual Machines fail to meet the constraints of minimal operational overhead and automated OS management without idle billing.

Key Concept

Selecting appropriate Azure compute services (ACI, AKS, and App Service) based on operational overhead, orchestration needs, and billing models.
Estimated Time:2m 0s
Question 98Question →

An administrator needs to configure permissions and governance rules for an Azure resource group named RG1. The configuration must meet the following requirements:
- A user named Alex must be able to start, stop, and configure virtual machines in RG1, but must be prevented from granting access to other users.
- Only virtual machine resources can be deployed in RG1; all other resource types must be blocked, regardless of any user's permissions.

Which two actions should you perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Assign the Contributor role to Alex for RG1.; Create and assign an Azure Policy to RG1 that restricts the allowed resource types to virtual machines.

Answer

Assign the Contributor role to the user for the resource group, and create and assign an Azure Policy definition to the resource group that restricts allowed resource types.
Assigning the Contributor role ensures the user has full rights to manage virtual machines but cannot delegate permissions to others. Assigning an Azure Policy ensures that only virtual machines can be deployed, enforcing compliance regardless of any user's access level.

Step-by-Step Solution

1
Evaluate the access requirements for managing virtual machines without access delegation.
Identify that the Contributor role grants full permissions to manage resources (like starting and stopping VMs) but prevents the user from managing access permissions.
Unlike the Owner role, the Contributor role does not grant User Access Administrator permissions.
2
Evaluate the governance requirement to restrict the types of resources that can be deployed.
Determine that Azure Policy is the correct tool to enforce compliance rules (such as allowed resource types) across a scope.
Azure RBAC only controls user permissions, whereas Azure Policy controls resource properties and compliance rules regardless of user permissions.
3
Assess the applicability of resource locks.
Determine that a ReadOnly lock is inappropriate because it blocks all administrative modification and control actions.
ReadOnly locks block virtual machine management operations such as starting or stopping the machines.

Key Concept

Azure RBAC vs Azure Policy, Contributor Role, and Resource Locks
Estimated Time:2m 0s
Question 99Question →

To prevent a specific user from deleting virtual machines in an Azure resource group, you should assign an Azure Policy definition that denies the delete action on virtual machines.

Show answer & explanation

Answer: False

Answer

False
The correct answer is False because controlling what actions a specific user can perform, such as preventing them from deleting virtual machines, is managed through Azure Role-Based Access Control (RBAC) rather than Azure Policy. Azure Policy focuses on resource governance and properties at a scope, and does not target specific users.

Step-by-Step Solution

1
Identify the goal of the governance requirement.
The goal is to restrict a specific user from performing a management action, which is deleting virtual machines.
Determining whether the goal is user authorization or resource compliance helps select the correct Azure service.
2
Evaluate the role of Azure Policy.
Azure Policy is used to enforce resource properties and compliance at a scope (e.g., ensuring resource tags exist or restricting VM sizes) and applies to all actions within that scope regardless of the user.
This rules out Azure Policy for user-specific permission control.
3
Evaluate the role of Azure Role-Based Access Control (RBAC).
Azure RBAC manages user authorization by defining who (users, groups, service principals) can perform what actions (read, write, delete) on Azure resources.
Since the requirement is to restrict a specific user's delete action, Azure RBAC (such as assigning the Reader role or a custom role lacking delete permissions) must be used.

Key Concept

Azure Role-Based Access Control (RBAC) manages user authorization, whereas Azure Policy manages resource properties and compliance.
Question 100Question →

A company is designing a transaction auditing system that requires strict relational schemas, foreign key constraints, and complex multi-table SQL queries. The database administrator proposes using Azure Cosmos DB with the API for NoSQL to meet these requirements. Which statement correctly evaluates this proposal?

Show answer & explanation

Answer: The proposal is incorrect because Azure Cosmos DB is a non-relational database designed for semi-structured data; its API for NoSQL queries JSON documents and does not support traditional relational database constraints and joins.

Answer

The proposal is incorrect because Azure Cosmos DB is a non-relational database designed for semi-structured data; its API for NoSQL queries JSON documents and does not support traditional relational database constraints and joins.
The correct answer is correct because Azure Cosmos DB is fundamentally a non-relational database. The API for NoSQL provides a familiar SQL-like syntax to query semi-structured JSON document files, but it does not support relational constraints, foreign keys, or traditional relational multi-table JOIN operations.

Step-by-Step Solution

1
Analyze the database requirements of the transaction auditing system.
The system requires strict relational schemas, foreign key constraints, and complex multi-table SQL queries.
These are core characteristics of relational databases (SQL databases).
2
Evaluate the database model and capabilities of Azure Cosmos DB.
Azure Cosmos DB is a globally distributed, non-relational (NoSQL) database engine.
Understanding the database model helps determine if it fits the relational requirements.
3
Analyze the function of the Azure Cosmos DB API for NoSQL (formerly SQL API).
The API for NoSQL allows developers to query JSON documents using SQL-like syntax, but does not enforce relational constraints or native multi-table joins.
This resolves the misconception that a SQL-like query interface makes a database relational.
4
Determine the validity of the proposal based on model compatibility.
The proposal is incorrect because Azure Cosmos DB cannot natively satisfy the strict relational and schema constraints required by the system.
Matching requirements to database capabilities leads to the correct evaluation.

Key Concept

Azure Cosmos DB is a NoSQL (non-relational) database service, and its API for NoSQL is used for querying JSON document structures, not for enforcing traditional relational database constraints.
PreviousPage 5 / 60Next
All practice questions — Microsoft Azure Fundamentals (AZ-900) | Examkin