All practice questions

A healthcare provider plans to automate their patient discharge notification system. The system must orchestrate a multi-step workflow that triggers whenever a patient's status changes in an Azure SQL Database. The workflow must use pre-built connectors to send SMS alerts and update external records without requiring custom orchestration code. Additionally, the workflow must run a custom Python script to sanitize and format patient data to ensure regulatory compliance before transmission. The provider requires a fully managed serverless solution where they do not manage the underlying operating systems, and billing must follow a consumption-based model (Operational Expenditure, or OpEx) where costs are incurred only when the workflow and script are executed.

Which combination of Azure services and billing plans meets all of these requirements?

An Azure administrator configures a `CanNotDelete` resource lock on an Azure subscription. Within this subscription, another administrator applies a `ReadOnly` resource lock to a resource group named `rg-finance`. Inside `rg-finance`, there is a storage account named `safinance`.

A developer who is assigned the Owner role on the subscription attempts to perform the following operations:
1. Read a blob from a container in `safinance` using a pre-existing Shared Access Signature (SAS) token.
2. Regenerate the access keys for `safinance` using the Azure portal.
3. Update the configuration of `safinance` to disable public blob access.

Which of the operations will be successful?

A resource group named rg-analytics contains a virtual machine named VM1. An administrator applies a ReadOnly resource lock to rg-analytics. Which two operations on VM1 are blocked due to the inherited lock? Select two.

A company plans to migrate a legacy SQL Server database to Azure. The database relies on third-party, OS-level security agents and requires custom configurations to the underlying operating system that are not supported in fully managed services. Which Azure database option should the company select to meet these requirements?

An energy company operates wind farms with local edge servers running Windows Server. The company wants to manage and monitor these physical servers from the Azure portal and apply standard Azure Policy definitions, without migrating the workloads to the cloud. Which Azure service enables this management?

An organization wants to restrict its developers so they can only deploy virtual machines of a specific size. Is the statement that the administrator should assign a custom Azure Role-Based Access Control (RBAC) role to enforce this resource size restriction true or false?

An administrator creates an Azure Resource Group named `RG-Production` and assigns a tag named `Department` with a value of `Finance`. The administrator then deploys an Azure Virtual Machine named `VM-Web` inside `RG-Production` without applying any tags directly to the Virtual Machine. Later, the administrator views Azure Cost Management and configures a Cost Analysis report filtered by the tag `Department` with the value `Finance`.

Which of the following describes how the costs associated with the virtual machine `VM-Web` will be represented in this Cost Analysis report?

A company needs to grant a database administrator permission to manage Azure SQL databases within a subscription, while ensuring they cannot modify any virtual networks in the same subscription. Which Azure governance feature should you use to implement this access control?

An organization plans to establish hybrid connectivity between its on-premises headquarters and an Azure Virtual Network (VNet). The IT security policy mandates that primary production traffic must not traverse the public internet and must have dedicated, high-speed bandwidth. Additionally, a cost-effective, encrypted backup connection that runs over the public internet is required.

Which two of the following hybrid networking options should the organization implement to satisfy these requirements? (Select two).

A financial organization is planning to host a new microservices-based application in Azure. The application architecture consists of 15 independent service components that require service-to-service discovery, internal load balancing, and dynamic scaling based on custom CPU thresholds. The security policy dictates that the cloud provider must handle all operating system patching, but the organization must retain full control over the deployment manifests and container orchestration configurations.

Which Azure service meets these requirements?

An organization is designing a governance and deployment strategy using Azure Resource Manager (ARM) templates to deploy web applications and database resources. The IT administrator wants to ensure that the deployment process is standardized, repeatable, and aligned with Azure best practices. Which of the following statements correctly describes how Azure Resource Manager (ARM) processes and deploys resources using templates?

A financial firm requires a hybrid connectivity solution to link its on-premises database to Azure. The security policy mandates that all data in transit must be encrypted using IPsec, and the network path must bypass the public internet entirely to minimize latency and exposure.

Determine whether the following statement is true or false:

To satisfy both requirements, the firm can configure an Azure ExpressRoute circuit with private peering and establish a Site-to-Site VPN connection that runs directly over this private peering path.

A company has an Azure Management Group named MG-Sales. You need to assign permissions to a security officer. The officer must be able to assign roles and delegate access permissions for all subscriptions within MG-Sales, but should not be allowed to create or modify virtual machines or databases. Which configuration should you assign to the security officer to meet these requirements?

An Azure subscription contains a resource group named `rg-corp-networks`. A `ReadOnly` resource lock is applied at the subscription level, and a `CanNotDelete` resource lock is applied directly to `rg-corp-networks`. The resource group contains an Azure Virtual Network named `vnet-prod`.

Which two operations can an administrator successfully perform on `vnet-prod`? Select two.

A company plans to migrate a complex microservices-based application to Azure. The application architecture requires advanced container management capabilities, including service discovery, internal load balancing, and coordinated scaling across dozens of container replicas. Is the statement that Azure Kubernetes Service (AKS) is the recommended service for this migration true or false?

An administrator is connecting two Azure virtual networks (VNets) by using virtual network peering (VNet peering). Is it true or false that traffic between these peered virtual networks is routed over the public internet?

A company is planning to migrate a legacy financial application to Azure. The application's database relies heavily on traditional relational features, including strict schema enforcement, foreign key constraints, and complex multi-table joins. A developer suggests migrating this database directly to Azure Cosmos DB using the SQL API. Why is Azure Cosmos DB with the SQL API unsuitable for this workload without a major redesign of the database?

An Azure subscription contains several existing storage accounts that do not have secure transfer enabled. An administrator who is assigned the Owner role at the subscription level applies a new Azure Policy to the subscription. The policy uses a 'Deny' effect to prevent the creation of storage accounts that have secure transfer disabled. The administrator then attempts to create a new storage account with secure transfer disabled. What is the outcome of the administrator's attempt to create the new storage account, and how are the existing storage accounts affected?

A university wants to link its local campus network to resources in a virtual network. The network team requires a connectivity option that bypasses the public internet entirely, provides high bandwidth, and ensures ultra-low latency. Is the following statement true?

'A VPN gateway connection over the internet will meet these requirements.'

An enterprise is planning to migrate its workloads to Microsoft Azure. The migration plan outlines three specific storage requirements:

1. An on-premises database will be hosted on an Azure Virtual Machine (IaaS). The database administrator must retain complete control over the database engine configuration and the operating system patching.
2. A legacy shared file share must be migrated to Azure to allow multiple virtual machines to access the files concurrently using the SMB protocol.
3. Approximately $200\text{ TB}$ of compliance logs must be retained for 7 years. These logs are rarely accessed but must be stored at the lowest possible cost, with an acceptable retrieval time of up to 14 hours.

To meet these requirements, the IT department designs a solution using Azure Managed Disks for the Virtual Machine, Azure Files (Cool tier) for the shared file share, and Azure Blob Storage (Archive tier) for the compliance logs.

After deployment, an administrator schedules a script that runs every month to read a random subset of the compliance logs directly from the Archive tier to verify data integrity.

Which of the following statements correctly evaluates this deployment and the administrator's script?