Examkin

All practice questions

1186 questions

All types1,186Multiple choice620Multiple select228True / False291Matching47
Question 101Question →

A city is deploying a traffic management system that receives real-time telemetry data from thousands of road sensors. The data is semi-structured and must be stored in a non-relational format. The development team wants to query this data using a Cassandra API, and requires a service where Microsoft automatically manages the database engine updates and operating system patching. Which Azure service should the city implement?

Show answer & explanation

Answer: Azure Cosmos DB

Answer

Azure Cosmos DB
The correct option is Azure Cosmos DB. It is a fully managed Platform as a Service (PaaS) database offering that supports multiple NoSQL APIs, including the Cassandra API. Because it is a PaaS service, Microsoft is responsible for managing the underlying hardware, operating system, and database software patching.

Step-by-Step Solution

1
Analyze the data structure and API requirements: the data is semi-structured (non-relational) and needs to be accessed via the Cassandra API.
This narrows the database choices to Azure services that support NoSQL multi-model capabilities, primarily Azure Cosmos DB.
Azure Cosmos DB is Microsoft's globally distributed, multi-model database service supporting NoSQL APIs like Cassandra.
2
Evaluate the management and patching requirements: the solution requires Microsoft to handle operating system and database engine patching.
This confirms that a Platform as a Service (PaaS) database offering is needed, ruling out Infrastructure as a Service (IaaS) Virtual Machines.
Under the shared responsibility model, PaaS offerings transfer the burden of OS updates and database patching to Microsoft.

Key Concept

Azure Cosmos DB is a fully managed PaaS NoSQL database service supporting multi-model APIs (such as Cassandra) and automatic patching.
Estimated Time:1m 0s
Question 102Question →

An organization has a production Azure subscription containing a resource group named RG-Backend. A ReadOnly resource lock is applied at the subscription level, and a CanNotDelete resource lock is applied directly to the RG-Backend resource group. Inside RG-Backend, there is an Azure App Service web app named WebApp-Prod and an Azure SQL database. An administrator with Owner role permissions needs to scale up the App Service plan for WebApp-Prod, delete the SQL database, and retrieve the publishing profile for WebApp-Prod. Which of the following describes the outcome of these three attempted actions?

Show answer & explanation

Answer: All three actions are blocked because the ReadOnly lock applied at the subscription level is inherited by all resources, preventing updates, deletions, and credential retrieval.

Answer

All three actions are blocked because the ReadOnly lock applied at the subscription level is inherited by all resources, preventing updates, deletions, and credential retrieval.
The correct option is correct because resource locks in Azure are inherited from parent scopes to child resources. Since a ReadOnly lock is applied at the subscription level, all resource groups and resources within that subscription inherit this lock. A ReadOnly lock prevents deleting resources, updating configurations (like scaling up an App Service plan), and performing POST operations such as retrieving publishing credentials or access keys.

Step-by-Step Solution

1
Determine the effective locks on the resources.
Both the subscription-level ReadOnly lock and the resource group-level CanNotDelete lock apply to the resources inside the resource group due to inheritance.
Azure resource locks are inherited from parent scopes (Subscription -> Resource Group -> Resource) and are additive.
2
Evaluate the permissions of the Owner role against the locks.
The Owner role cannot bypass the locks.
Resource locks apply to all users and roles, regardless of their Azure RBAC permissions.
3
Analyze the impact of the ReadOnly lock on the attempted actions.
Scaling up the App Service plan (update) is blocked, deleting the SQL database (delete) is blocked, and retrieving the publishing profile (POST action) is blocked.
A ReadOnly lock prevents all delete and update operations, and specifically blocks API POST operations that retrieve sensitive keys or credentials.

Key Concept

Azure Resource Lock inheritance and the restrictions of ReadOnly locks on control plane operations.
Question 103Question →

A healthcare provider has virtual machines and Kubernetes clusters hosted on-premises and in a third-party public cloud. The provider wants to use Azure Arc to simplify management. Which of the following capabilities are provided by Azure Arc for these external resources? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enforcing compliance guidelines across on-premises and third-party cloud servers using Azure Policy; Consolidating logging and performance tracking for non-Azure virtual machines within Azure Monitor

Answer

The correct options are: enforcing compliance guidelines across on-premises and third-party cloud servers using Azure Policy, and consolidating logging and performance tracking for non-Azure virtual machines within Azure Monitor.
Azure Arc acts as a bridge that projects resources outside of Azure into Azure Resource Manager. This enables administrators to apply Azure governance tools, such as Azure Policy, and monitoring tools, such as Azure Monitor, directly to on-premises and third-party cloud resources.

Step-by-Step Solution

1
Identify the primary purpose of Azure Arc.
Azure Arc is designed to extend the Azure Resource Manager (ARM) control plane to resources located outside of Azure (on-premises, edge, and multi-cloud).
This allows administrators to manage external servers, Kubernetes clusters, and databases as if they were running inside Azure.
2
Determine which management capabilities are extended by Azure Arc to external resources.
Capabilities like Azure Policy configuration auditing and Azure Monitor logging are extended, while native Azure migration or restricting management only to Azure-native resources are incorrect.
This confirms the valid options showing governance (Azure Policy) and monitoring (Azure Monitor) capabilities.

Key Concept

Azure Arc extends Azure management, governance, and monitoring capabilities to resources hosted on-premises, at the edge, or in multi-cloud environments.
Question 104Question →

A company is developing a global IoT application that must store non-relational telemetry data with low latency. The application needs to query this data using MongoDB and Cassandra APIs. Additionally, the company wants to minimize administrative effort by ensuring that Microsoft manages database engine updates and operating system patching. Which Azure database service should the company select to meet these requirements?

Show answer & explanation

Answer: Azure Cosmos DB, which is a Platform as a Service (PaaS) database that supports multi-model NoSQL APIs and automatically handles all operating system patching and software updates.

Answer

Azure Cosmos DB, which is a Platform as a Service (PaaS) database that supports multi-model NoSQL APIs and automatically handles all operating system patching and software updates.
The correct option identifies Azure Cosmos DB as a Platform as a Service (PaaS) database that supports multi-model NoSQL APIs (MongoDB, Cassandra) and handles all database updates and operating system patching automatically. This aligns with the company's requirement for a non-relational database with minimal administrative overhead.

Step-by-Step Solution

1
Analyze the data model and API requirements.
The application requires a non-relational (NoSQL) database that supports MongoDB and Cassandra APIs.
This requirement points directly to Azure Cosmos DB, which is Azure's multi-model NoSQL database service.
2
Determine the cloud service model and patching responsibilities.
The company requires Microsoft to manage database updates and operating system patching, indicating a PaaS model.
In the PaaS shared responsibility model, the cloud provider manages the underlying infrastructure, operating system, and database engine updates.
3
Combine the NoSQL API and PaaS management criteria to select the correct service.
Azure Cosmos DB matches both requirements as it is a fully managed PaaS NoSQL database supporting the specified APIs.
It eliminates administrative overhead by automating updates and patching, while natively supporting MongoDB and Cassandra workloads.

Key Concept

Azure Cosmos DB features and the PaaS shared responsibility model for databases.
Question 105Question →

A multinational corporation is planning to connect its local infrastructure to resources inside an Azure Virtual Network. The network architect must satisfy the following three connectivity requirements:

1. The primary on-premises datacenter requires a private, high-bandwidth connection of 10 Gbps10\text{ Gbps} that bypasses the public internet entirely.
2. A remote branch office requires a secure, encrypted connection to Azure over the public internet on a limited budget.
3. Remote employees working from home must be able to securely connect their individual laptops directly to the Azure Virtual Network over the internet without requiring any on-premises hardware.

Which combination of Azure connectivity services should the company implement?

Show answer & explanation

Answer: An Azure ExpressRoute connection for the datacenter, a Site-to-Site VPN connection for the remote branch office, and a Point-to-Site VPN connection for the remote employees.

Answer

An Azure ExpressRoute connection for the datacenter, a Site-to-Site VPN connection for the remote branch office, and a Point-to-Site VPN connection for the remote employees.
The combination featuring an Azure ExpressRoute connection for the datacenter, a Site-to-Site VPN connection for the remote branch office, and a Point-to-Site VPN connection for the remote employees is correct. ExpressRoute meets the datacenter's need for a private connection bypassing the public internet. Site-to-Site VPN provides a cost-effective encrypted tunnel over the internet for the branch office. Point-to-Site VPN allows individual remote laptops to securely connect directly to the virtual network without any specialized hardware on-premises.

Step-by-Step Solution

1
Analyze the requirement for the primary datacenter connection.
Azure ExpressRoute is identified as the correct service because it provides a dedicated, private connection that bypasses the public internet entirely, supporting high bandwidth up to 100 Gbps100\text{ Gbps}.
Site-to-Site VPN routes traffic over the public internet and does not meet the requirement to bypass the internet.
2
Analyze the requirement for the remote branch office.
Site-to-Site VPN is selected because it provides a secure, encrypted (IPsec) connection over the public internet, which is cost-effective and suitable for a branch office.
An ExpressRoute circuit would be too expensive and complex for a remote branch office on a limited budget.
3
Analyze the requirement for the remote employees.
Point-to-Site VPN is selected because it enables secure connections directly from individual client devices (laptops) over the internet to the Azure Virtual Network, without requiring any on-premises VPN hardware.
Azure Bastion is for secure RDP/SSH access to VMs via a browser, not for general hybrid network connectivity from remote client laptops.

Key Concept

Azure hybrid networking options differ in privacy, bandwidth, cost, and target client configuration.
Question 106Question →

An Azure administrator manages a subscription containing a resource group named `rg-data-pipeline`. The administrator applies a `ReadOnly` resource lock to `rg-data-pipeline`. Within this resource group, there is a stopped Azure Virtual Machine named `vm-processor`. Is the statement 'A user with the Owner role can successfully start the `vm-processor` virtual machine while the `ReadOnly` lock is active' true or false?

Show answer & explanation

Answer: False

Answer

False
The statement is false because a ReadOnly lock prevents starting, stopping, or restarting a virtual machine, and this restriction applies to all users including Owners.

Step-by-Step Solution

1
Analyze the type of resource lock applied.
A ReadOnly lock is applied at the resource group level (`rg-data-pipeline`).
Resource locks are inherited by child resources, meaning the virtual machine (`vm-processor`) inherits the ReadOnly lock.
2
Determine the impact of a ReadOnly lock on control plane operations.
ReadOnly locks block all modification operations (PUT/DELETE) and POST operations like starting or stopping virtual machines.
This prevents configuration or state changes to the resource.
3
Evaluate the role permission and lock override rules.
The Owner role has full access but is still restricted by the resource lock.
Resource locks apply to all users, including Owners and Administrators, and cannot be bypassed unless the lock is deleted.

Key Concept

Resource lock inheritance and operational limits
Estimated Time:1m 0s
Question 107Question →

A financial company hosts its customer databases on several Linux servers in an on-premises datacenter. The company wants to enforce security compliance settings on these servers using Azure Policy and view their status in the Azure Portal, without migrating the workloads to Azure. Which Azure service should the company use to project these on-premises servers into Azure for centralized management?

Show answer & explanation

Answer: Azure Arc

Answer

Azure Arc
Azure Arc is correct because it projects external resources (such as on-premises physical or virtual servers) into the Azure Resource Manager (ARM) fabric. Once projected, these resources can be managed, organized, and governed using Azure native services, including Azure Policy and Azure Monitor, without requiring migration.

Step-by-Step Solution

1
Identify the organization's requirements
The company needs to manage and apply Azure Policy to Linux servers located outside of Azure (on-premises) without migrating them.
This establishes that the solution must extend Azure's management plane to external resources.
2
Evaluate Azure services that bridge external resources to Azure Resource Manager
Azure Arc is identified as the service designed to extend Azure management and governance to on-premises, edge, and multi-cloud environments.
Azure Arc installs an agent on the external servers to represent them as resources within the Azure portal, enabling Azure Policy to be applied directly.

Key Concept

Azure Arc extends Azure governance, management, and services to on-premises, multi-cloud, and edge environments.
Estimated Time:45s
Question 108Question →

An organization is designing a serverless automated pipeline to process customer feedback. The pipeline must ingest customer comments from an external web portal immediately via HTTP webhooks, coordinate a multi-step workflow that passes the comment to a custom Python data-cleaning script, update a database, and conditionally send an email alert via Office 365. The custom Python script requires specialized open-source libraries. The organization wants to minimize administrative overhead and dynamically scale compute resources with zero cost when there is no traffic. Which of the following statements correctly describe how Azure Serverless services should be implemented for this architecture? (Select two)

Select all that apply

Show answer & explanation

Answer: Azure Logic Apps should be used to coordinate the end-to-end workflow, using its designer-first interface to manage integration triggers and conditional control paths.; Azure Functions should be used to host and execute the custom Python script, running on a Consumption plan to support serverless scaling and zero-idle cost.

Answer

The correct implementation is to use Azure Logic Apps to coordinate the workflow and Azure Functions to execute the custom Python script under a Consumption plan.
The workflow requires coordinating multiple endpoints, which is best solved using the designer-first workflow orchestration of Azure Logic Apps. The custom data-cleaning step requires running specialized Python code, which is best suited for Azure Functions under a serverless Consumption plan to allow scaling to zero and cost optimization.

Step-by-Step Solution

1
Analyze the custom scripting requirement.
The custom Python script requires specialized libraries, pointing to Azure Functions as the code-first serverless compute option.
Azure Functions allows running custom code with custom dependencies in a serverless model.
2
Analyze the orchestration and integration requirement.
The multi-step pipeline connects SaaS tools and databases, pointing to Azure Logic Apps as the designer-first workflow orchestrator.
Azure Logic Apps provides a visual designer and out-of-the-box connectors to orchestrate service integration easily.
3
Evaluate the scaling and cost constraints.
Azure Functions on a Consumption plan satisfies the requirement to scale to zero and minimize costs when idle, unlike WebJobs which runs under App Service plans.
Consumption plans enable serverless scale-to-zero pricing, whereas standard App Service plans charge continuously for reserved compute.
4
Assess service classification.
Both Logic Apps and Functions are Platform as a Service (PaaS) offerings, not Software as a Service (SaaS).
PaaS provides the development platform for building custom logic and workflows, whereas SaaS is end-user application software.

Key Concept

Differentiating between Azure Functions (code-first serverless compute) and Azure Logic Apps (connector-first workflow orchestrator), and their respective serverless characteristics.
Question 109Question →

An organization is evaluating Microsoft Azure database offerings to support different workloads. Match each Azure database service on the left to the description on the right that best represents its characteristics or engine support.

Click a left item, then click its matching right item

Items

Azure SQL Database
Azure Cosmos DB
Azure Database for PostgreSQL

Matches

Show answer & explanation

Answer

Azure SQL Database matches the description of a fully managed relational database service based on the Microsoft SQL Server engine. Azure Cosmos DB matches the description of a globally distributed NoSQL database service. Azure Database for PostgreSQL matches the description of a fully managed relational database service based on an open-source engine.
Azure SQL Database is built on the proprietary SQL Server engine. Azure Cosmos DB is a globally distributed NoSQL service supporting key-value, document, and graph models. Azure Database for PostgreSQL is an open-source relational service.

Step-by-Step Solution

1
Analyze Azure SQL Database characteristics.
Identify that Azure SQL Database is a managed relational database that uses the Microsoft SQL Server engine.
This links Azure SQL Database to the description of a fully managed relational database based on the SQL Server engine.
2
Analyze Azure Cosmos DB characteristics.
Identify that Azure Cosmos DB is a globally distributed, multi-model NoSQL database.
This links Azure Cosmos DB to the description of a globally distributed NoSQL database service.
3
Analyze Azure Database for PostgreSQL characteristics.
Identify that Azure Database for PostgreSQL is an open-source relational database option in Azure.
This links Azure Database for PostgreSQL to the description of a managed relational service based on an open-source engine.

Key Concept

Differentiating Azure database offerings by their relational vs. non-relational models and engine types.
Question 110Question →

An organization is evaluating cost estimation tools for a cloud migration project. Is the following statement regarding the Azure Pricing Calculator and the Azure Total Cost of Ownership (TCO) Calculator true or false?

'The Azure Pricing Calculator can be used to estimate the cost of Azure resources using your organization's specific Microsoft Customer Agreement (MCA) or Enterprise Agreement (EA) discounted pricing by signing in, whereas the Azure TCO Calculator only provides cost comparisons based on standard retail (pay-as-you-go) rates.'

Show answer & explanation

Answer: True

Answer

The statement is true because the Azure Pricing Calculator supports personalized enterprise pricing agreements when logged in, whereas the Azure TCO Calculator uses standard retail pricing for its estimates.
The statement is true. The Azure Pricing Calculator integrates with Azure portal authentication, allowing enterprise customers under agreements like EA or MCA to see customized discount pricing. In contrast, the TCO Calculator only uses standard retail rates for its comparison models and does not pull custom account agreements.

Step-by-Step Solution

1
Analyze the pricing capability of the Azure Pricing Calculator.
The Azure Pricing Calculator supports authenticated sessions where enterprise customers (such as those under Enterprise Agreements or Microsoft Customer Agreements) can view estimates with their specific negotiated discounts applied.
To determine if the Pricing Calculator can display customized pricing.
2
Analyze the pricing capability of the Azure TCO Calculator.
The Azure TCO Calculator is designed for high-level, generic cost-benefit analysis of cloud migration. It does not authenticate users to pull specific active billing agreements and instead uses baseline retail rates combined with manual assumption inputs.
To determine if the TCO Calculator supports the same custom billing integrations.
3
Compare the two findings against the statement in the prompt.
The statement accurately describes the distinct capabilities of the two tools: the Pricing Calculator supports authenticated custom rates, while the TCO Calculator uses retail rates.
To determine the true/false value of the statement.

Key Concept

Pricing differences and custom agreement integration between the Azure Pricing Calculator and the Azure TCO Calculator.
Estimated Time:1m 30s
Question 111Question →

A software developer is creating a mobile application and needs to store user profiles as semi-structured JSON documents with different attributes. The developer requires a fully managed, non-relational database service that natively supports the MongoDB API. Which Azure database service should the developer choose?

Show answer & explanation

Answer: Azure Cosmos DB

Answer

Azure Cosmos DB
Azure Cosmos DB is the correct service because it is a fully managed, multi-model NoSQL database service that supports the MongoDB API, allowing developers to store semi-structured JSON documents without managing the underlying database infrastructure or operating system.

Step-by-Step Solution

1
Analyze the database requirements.
The application requires a non-relational (NoSQL) database that stores semi-structured JSON documents and supports the MongoDB API.
This determines that a relational database cannot be used.
2
Determine the management model requirement.
The service must be fully managed (Platform as a Service / PaaS).
This rules out Infrastructure as a Service (IaaS) options like running databases on Virtual Machines.
3
Select the service that meets all criteria.
Azure Cosmos DB is the only fully managed Azure NoSQL database service that natively supports the MongoDB API.
It matches both the technical NoSQL API requirement and the management model.

Key Concept

Azure Cosmos DB is a fully managed, globally distributed NoSQL database service that supports multiple open-source APIs (such as MongoDB and Cassandra) to store semi-structured, schema-flexible data.
Question 112Question →

An administrator wants to ensure that a newly hired auditor can view all configurations of the Azure resources within a resource group named 'Finance-RG', but cannot make any modifications to them. Which configuration should the administrator use to meet this requirement?

Show answer & explanation

Answer: Assign the Reader role to the auditor at the resource group scope.

Answer

Assign the Reader role to the auditor at the resource group scope.
Assigning the Reader role to the auditor at the resource group scope is correct because the built-in Reader role grants read-only access to all resources within the assigned scope. Because RBAC permissions are inherited by all child resources, assigning this role at the resource group level ensures the auditor can view all resources in the group without being able to modify them.

Step-by-Step Solution

1
Identify the primary goal of the request.
The requirement is to grant a specific user (the auditor) read-only access (viewing configurations without editing) to a specific resource group.
This establishes the scope (resource group) and the permission level (read-only) required.
2
Evaluate the management tools available in Azure for managing user permissions.
Azure Role-Based Access Control (RBAC) is the correct tool for managing who has what access to Azure resources.
Other governance features like Azure Policy, resource locks, and tags serve different purposes (compliance, accidental deletion prevention, and organization, respectively).
3
Select the appropriate built-in Azure RBAC role and scope.
The Reader role is a built-in role designed specifically to allow viewing of resources without making changes. Assigning it at the resource group scope applies this permission to all resources within that group.
This matches the requirement of granting read-only access to a specific resource group.

Key Concept

Azure Role-Based Access Control (RBAC) is used to manage user access and permissions to Azure resources by assigning built-in or custom roles at specific scopes.
Question 113Question →

A software development company wants to manage virtual machines hosted in their own on-premises datacenter. Is the statement that Azure Arc can be used to manage physical or virtual servers located outside of Microsoft Azure true?

Show answer & explanation

Answer: True

Answer

True
Azure Arc is designed to extend the Azure Resource Manager control plane to resources outside of Azure, allowing organizations to manage, govern, and secure physical and virtual servers running on-premises, at the edge, or in other cloud environments.

Step-by-Step Solution

1
Analyze the core capability of Azure Arc.
Azure Arc extends Azure services and management capabilities to resources located outside of Azure.
This is the primary function of Azure Arc, designed for hybrid and multi-cloud environments.
2
Determine if Azure Arc supports physical and virtual servers located in on-premises datacenters.
Azure Arc enables the projection of external physical and virtual servers (running Windows or Linux) into Azure Resource Manager.
This allows administrators to manage non-Azure servers using standard Azure tools.
3
Evaluate the statement in the question.
The statement is true because Azure Arc is specifically designed to manage physical and virtual servers outside of Azure.
To determine the final correct answer.

Key Concept

Azure Arc management of hybrid resources
Estimated Time:45s
Question 114Question →

If a ReadOnly resource lock is applied to an Azure resource group, administrators are still permitted to start, stop, or restart any virtual machines within that resource group.

Show answer & explanation

Answer: False

Answer

The statement is false. A ReadOnly lock applied at the resource group level blocks control-plane POST operations, which prevents administrators from starting, stopping, or restarting any virtual machines in that group.
Applying a ReadOnly lock to a resource group blocks all delete and write actions, including POST requests, on all inherited resources. Since starting, stopping, and restarting virtual machines are executed via POST requests in the Azure Resource Manager control plane, these actions are blocked.

Step-by-Step Solution

1
Determine the resource lock type and its target scope.
A ReadOnly lock is applied at the resource group level.
This establishes the scope and policy context for all resources inside the group.
2
Apply the lock inheritance rules to the child resources.
The ReadOnly lock is inherited by all virtual machines within the resource group.
Azure resource locks propagate down to all nested resources within the locked parent container.
3
Classify the virtual machine power operations (start, stop, and restart).
These operations represent POST actions directed to the Azure Resource Manager control plane.
A ReadOnly lock blocks all write and POST requests at the control plane level, thereby blocking these power actions.

Key Concept

ReadOnly Lock Scope Restrictions on Control Plane POST Operations
Question 115Question →

An organization is evaluating its database architecture strategy in Microsoft Azure. Match each specific workload or deployment requirement on the left to the most appropriate Azure database service or hosting model on the right.

Click a left item, then click its matching right item

Items

A fully managed relational database service that automatically handles patching, backups, and high availability, without allowing direct operating system access.
A globally distributed NoSQL database service that provides single-digit millisecond read and write latencies and support for multiple open-source APIs.
A fully managed relational database service built specifically for applications requiring compatibility with the community edition of the PostgreSQL engine.
An Infrastructure as a Service (IaaS) deployment model that provides full administrative control over the operating system and SQL Server configurations.

Matches

Show answer & explanation

Answer

The correct matches pair the relational, fully managed workload with Azure SQL Database; the low-latency, globally distributed NoSQL workload with Azure Cosmos DB; the open-source community engine compatibility requirement with Azure Database for PostgreSQL; and the workload requiring full OS and database instance administrative control with SQL Server on Azure Virtual Machines.
Matching the database requirements to their respective deployment models requires distinguishing between Platform as a Service (PaaS) databases, Infrastructure as a Service (IaaS) databases, and non-relational versus relational models. Azure SQL Database and Azure Database for PostgreSQL represent fully managed PaaS relational engines. Azure Cosmos DB represents a globally distributed NoSQL PaaS engine. SQL Server on Azure VMs represents an IaaS database deployment where the customer retains full control over the OS and database server configuration.

Step-by-Step Solution

1
Analyze the first requirement: a fully managed relational database with automated patching and no OS access.
This maps to Azure SQL Database, which is a relational PaaS database service.
Azure SQL Database handles all database maintenance automatically while restricting direct OS-level administrative access.
2
Analyze the second requirement: a globally distributed NoSQL database with low latency and multiple APIs.
This maps to Azure Cosmos DB.
Azure Cosmos DB is the primary multi-model NoSQL service in Azure offering global distribution and single-digit millisecond latency.
3
Analyze the third requirement: a fully managed relational database requiring PostgreSQL engine compatibility.
This maps to Azure Database for PostgreSQL.
Azure Database for PostgreSQL provides a fully managed community-compliant version of PostgreSQL.
4
Analyze the fourth requirement: an IaaS model with full administrative control over the OS and database engine.
This maps to SQL Server on Azure Virtual Machines.
Hosting databases on virtual machines represents an IaaS model where the user manages the OS and configurations.

Key Concept

Distinguishing between Azure relational databases (Azure SQL Database, Azure Database for PostgreSQL), non-relational databases (Azure Cosmos DB), and virtual machine hosted databases (SQL Server on Azure VMs).
Estimated Time:2m 0s
Question 116Question →

An organization is designing a hybrid network architecture to connect their on-premises office to two Azure Virtual Networks (VNets). The design must meet the following criteria:

* A primary connection with dedicated, high-speed bandwidth that does not use the public internet.
* A secondary, encrypted backup connection that is cost-effective and routes over the public internet.
* Internal, low-latency communication directly between the two Azure VNets.

Which of the following Azure networking features should the organization implement to meet these requirements? (Select three)

Select all that apply

Show answer & explanation

Answer: Azure ExpressRoute to establish the primary dedicated private connection; A Site-to-Site VPN Gateway to establish the encrypted backup connection over the public internet; Virtual Network (VNet) peering to enable direct, low-latency communication between the two VNets

Answer

To meet the specified criteria, the organization should implement Azure ExpressRoute for the primary private connection, a Site-to-Site VPN Gateway for the backup internet-based connection, and Virtual Network (VNet) peering for direct VNet-to-VNet connectivity.
The correct implementation involves three distinct services: Azure ExpressRoute fulfills the primary connection requirement by offering dedicated, private bandwidth that bypasses the public internet. A Site-to-Site VPN Gateway fulfills the backup connection requirement by encrypting traffic and routing it over the public internet in a cost-effective manner. Virtual Network (VNet) peering enables direct, low-latency connection between the two VNets using the private Microsoft backbone network.

Step-by-Step Solution

1
Analyze the primary connection requirement.
Azure ExpressRoute must be selected because the requirement specifies a dedicated, high-speed path that bypasses the public internet.
ExpressRoute establishes a private connection via a service provider directly to the Azure backbone.
2
Analyze the backup connection requirement.
A Site-to-Site VPN Gateway must be selected because the requirement specifies a cost-effective, encrypted connection routing over the public internet.
VPN Gateway encrypts traffic and routes it through the public internet, which is less expensive than ExpressRoute.
3
Analyze the VNet-to-VNet communication requirement.
Virtual Network (VNet) peering must be selected to allow direct, low-latency communication.
VNet peering routes traffic through Microsoft's private network without traversing the on-premises datacenter or the public internet.

Key Concept

Azure hybrid networking components (ExpressRoute, VPN Gateway, and VNet peering) and their transmission medium (private backbone vs. public internet).
Question 117Question →

An organization has a diverse IT administration team using workstations running Windows 11, macOS, and Ubuntu Linux. The team needs to implement scripting and management tools to automate resource deployments while minimizing local installation overhead and ensuring cross-platform compatibility.

Which two statements regarding Azure management tools are correct?

Select all that apply

Show answer & explanation

Answer: Azure Cloud Shell is a browser-based shell that offers both Bash and PowerShell environments, enabling administrators to run Azure CLI and Azure PowerShell commands from any operating system without local tool installation.; Both Azure CLI and Azure PowerShell are cross-platform tools that can be installed locally and run on Windows, macOS, and Linux systems.

Answer

The correct statements are: Azure Cloud Shell is a browser-based shell that offers both Bash and PowerShell environments, and both Azure CLI and Azure PowerShell are cross-platform tools that can be installed locally on Windows, macOS, and Linux.
The correct choices highlight the true cross-platform nature of Azure CLI, Azure PowerShell, and Azure Cloud Shell. Azure CLI and Azure PowerShell can be installed locally on Windows, macOS, and Linux. Azure Cloud Shell runs in a web browser, providing both Bash and PowerShell environments without any local tool installations or OS-specific shell restrictions.

Step-by-Step Solution

1
Analyze the cross-platform capabilities of local Azure management tools.
Both Azure CLI and Azure PowerShell are cross-platform and support Windows, macOS, and Linux.
Azure PowerShell relies on PowerShell Core (PowerShell 7+) for cross-platform execution, and Azure CLI has native installers for all major OS platforms.
2
Analyze the capabilities of Azure Cloud Shell.
Azure Cloud Shell runs entirely in a browser container and offers both Bash (with Azure CLI) and PowerShell environments regardless of the client OS.
Since it is container-based and browser-accessed, it requires no local installation or OS-based restriction.

Key Concept

Cross-platform compatibility and installation requirements of Azure Portal, CLI, PowerShell, and Cloud Shell
Estimated Time:1m 30s
Question 118Question →

An organization has an Azure subscription containing a resource group named rg-shipping-prod. A CanNotDelete lock is applied directly to the rg-shipping-prod resource group. An administrator with the Owner role needs to update the configuration of an Azure App Service plan named asp-shipping and delete an unused Azure Storage account named stshippinghistory, both of which are located inside rg-shipping-prod.

Which of the following statements correctly describes the outcome of these actions?

Show answer & explanation

Answer: The update to the App Service plan is permitted, but the deletion of the Storage account is blocked.

Answer

The update to the App Service plan is permitted, but the deletion of the Storage account is blocked.
The correct answer is that the update to the App Service plan is permitted, but the deletion of the Storage account is blocked. A CanNotDelete lock allows authorized users to read and modify a resource but blocks its deletion. Since locks are inherited by child resources, both resources in the resource group are subject to this restriction, meaning the Storage account cannot be deleted while the App Service plan can be successfully updated.

Step-by-Step Solution

1
Determine the lock type applied and its scope.
A CanNotDelete lock is applied at the resource group level (rg-shipping-prod).
This establishes the scope and base restriction rule for all resources inside the resource group.
2
Evaluate lock inheritance for child resources.
Both the App Service plan (asp-shipping) and the Storage account (stshippinghistory) inherit the CanNotDelete lock.
Locks applied at the resource group level are automatically inherited by all resources within that group.
3
Apply the lock permissions to the proposed actions.
Modifying the App Service plan configuration is allowed, but deleting the Storage account is blocked.
A CanNotDelete lock permits updates (write actions) but restricts deletion (delete actions).

Key Concept

Azure Resource Locks restrict actions on resources regardless of user permissions. A CanNotDelete lock allows read and modify operations but blocks deletion, and is inherited by all child resources.
Question 119Question →

An Azure resource group owner can successfully deploy a resource that violates a subscription-level Azure Policy with a 'Deny' effect, because Role-Based Access Control (RBAC) owner permissions override Azure Policy enforcement at the resource level.

Show answer & explanation

Answer: False

Answer

False
The statement is false because Azure Policy is evaluated after Role-Based Access Control (RBAC). RBAC determines if a user has permission to perform an action, whereas Azure Policy ensures that the resource properties conform to defined rules. A policy with a 'Deny' effect will block any non-compliant deployment, even if initiated by a user with the Owner role.

Step-by-Step Solution

1
Analyze the relationship between Azure Role-Based Access Control (RBAC) and Azure Policy.
RBAC and Azure Policy are evaluated independently during resource deployment. RBAC checks if the user has permission to perform the action, while Azure Policy checks if the resource properties comply with corporate standards.
To determine whether permissions can bypass compliance rules.
2
Determine the sequence of evaluation during a deployment request.
The request is first authorized via RBAC. Once authorized, Azure Policy evaluates the resource properties against assigned policies before the resource provider processes the deployment.
To see if policy enforcement happens before or after RBAC checks are completed.
3
Evaluate the effect of a 'Deny' policy on an authorized user's deployment.
A 'Deny' policy blocks the creation or update of any resource that violates its rules, regardless of the user's RBAC role (including Owner). The deployment fails with a policy violation error.
To verify if the statement's claim that Owner permissions override the policy is correct.

Key Concept

Azure Policy is evaluated after RBAC permissions, and its enforcement cannot be bypassed by standard RBAC roles like Owner.
Question 120Question →

A company has deployed Azure ExpressRoute to connect its local corporate headquarters to an Azure Virtual Network. During an audit, a security analyst reviews the network configuration to ensure it complies with a corporate policy requiring that hybrid traffic bypass the public internet.

Which path does the network traffic take when using this ExpressRoute connection?

Show answer & explanation

Answer: It travels over a private, dedicated physical connection provided by a connectivity partner, completely bypassing the public internet.

Answer

It travels over a private, dedicated physical connection provided by a connectivity partner, completely bypassing the public internet.
The correct option is correct because Azure ExpressRoute establishes a private, dedicated physical connection between the customer's on-premises environment and Microsoft Azure. Because it does not traverse the public internet, it provides higher security, reliability, faster speeds, and lower latencies compared to typical connections over the internet.

Step-by-Step Solution

1
Identify the hybrid networking service deployed in the scenario.
The scenario specifies that the company has deployed Azure ExpressRoute.
Understanding the specific capabilities of the deployed service is necessary to determine its network path.
2
Analyze the routing characteristics of Azure ExpressRoute.
ExpressRoute routes traffic over a private connection provided by a partner network provider, completely bypassing the public internet.
This private routing model defines the core value proposition of ExpressRoute (security, reliability, speed).

Key Concept

Azure ExpressRoute private routing characteristics
PreviousPage 6 / 60Next
All practice questions — Microsoft Azure Fundamentals (AZ-900) | Examkin