Examkin

All practice questions

620 questions

All types1,186Multiple choice620Multiple select228True / False291Matching47
Question 1Question →

An enterprise administrator is designing a governance and access strategy for a newly created Azure subscription. The strategy must satisfy two requirements:

1. A security compliance team must be able to view all resource configurations and inspect active role assignments, but they must not be allowed to modify resources or alter permissions.
2. A development team must be permitted to create and manage virtual machines within a resource group named RG-Web, but they must be prevented from deploying any virtual machines that lack a 'Department' tag.

Which solution should the administrator implement?

Show answer & explanation

Answer: Assign the Reader role to the security compliance team at the subscription scope; assign the Virtual Machine Contributor role to the development team at the resource group scope; and assign an Azure Policy that requires the 'Department' tag on virtual machines.

Answer

Assign the Reader role to the security compliance team at the subscription scope; assign the Virtual Machine Contributor role to the development team at the resource group scope; and assign an Azure Policy that requires the 'Department' tag on virtual machines.
The correct solution uses the Reader role to grant the security compliance team read-only access to resource configurations and permissions at the subscription level. It uses the Virtual Machine Contributor role to grant the development team the ability to manage virtual machines within the specific resource group (RG-Web). Finally, it uses Azure Policy to enforce the presence of the 'Department' tag on virtual machines, separating access control from resource compliance.

Step-by-Step Solution

1
Analyze the access requirement for the security compliance team.
The team must view resource settings and role assignments but cannot modify them or change permissions. The built-in Reader role provides read-only access to resources and permissions at the assigned scope.
Choosing the Reader role prevents unauthorized modifications or permission alterations while satisfying the auditing requirement.
2
Analyze the resource management requirement for the development team.
The team needs to create and manage virtual machines inside a specific resource group (RG-Web). The built-in Virtual Machine Contributor role allows managing virtual machines without granting access to the underlying virtual network or storage account, or the ability to manage permissions.
Using a scoped role like Virtual Machine Contributor at the resource group level ensures the principle of least privilege is followed.
3
Analyze the governance requirement to block virtual machines without a specific tag.
Enforcing resource properties or compliance rules (like requiring a 'Department' tag) must be done using Azure Policy.
Azure RBAC manages identity-based access, whereas Azure Policy controls the properties of the resources being deployed.

Key Concept

Azure RBAC roles (Reader, Virtual Machine Contributor) manage access permissions based on identities and scope, while Azure Policy enforces compliance and resource properties.
Estimated Time:2m 0s
Question 2Question →

A company is establishing connectivity between its on-premises headquarters and an Azure Virtual Network. The connection must bypass the public internet to ensure predictable performance and security. Additionally, the company's internal compliance policy mandates that all data in transit must be encrypted at the network layer using IPsec. Which solution satisfies all of these requirements?

Show answer & explanation

Answer: A Site-to-Site VPN gateway connection configured over an Azure ExpressRoute private peering connection

Answer

A Site-to-Site VPN gateway connection configured over an Azure ExpressRoute private peering connection
The correct option is the Site-to-Site VPN gateway connection configured over an Azure ExpressRoute private peering connection. ExpressRoute provides a dedicated, private connection that does not traverse the public internet, ensuring predictable performance. Since ExpressRoute does not natively encrypt traffic, configuring a VPN tunnel over the private peering allows the traffic to be encrypted using IPsec, meeting both constraints.

Step-by-Step Solution

1
Analyze the connectivity requirements.
The solution requires bypassing the public internet (satisfied by Azure ExpressRoute) and encrypting traffic at the network layer using IPsec (satisfied by VPN Gateway).
This establishes the dual constraints of private dedicated routing and cryptographic encryption.
2
Evaluate the combined capability of VPN and ExpressRoute.
A Site-to-Site VPN can be configured to run over an ExpressRoute private peering circuit, creating an encrypted tunnel over a private connection.
This specific hybrid architecture satisfies both security and performance constraints.

Key Concept

Azure Virtual Networks, ExpressRoute, and VPN Gateway hybrid design
Question 3Question →

An Azure administrator needs to prevent users from accidentally deleting a virtual machine named VM-Prod. However, users must still be able to start, stop, and resize the virtual machine. Which configuration should the administrator apply to VM-Prod?

Show answer & explanation

Answer: A CanNotDelete resource lock

Answer

A CanNotDelete resource lock
The configuration utilizing a CanNotDelete resource lock is correct because it prevents users from deleting the virtual machine while still permitting them to modify its state (such as starting, stopping, or resizing).

Step-by-Step Solution

1
Identify the goal of the configuration, which is to block the deletion of the virtual machine while allowing modifications like starting, stopping, and resizing.
The requirement matches the behavior of the CanNotDelete resource lock.
Azure resource locks provide a way to restrict actions on resources. Specifically, CanNotDelete allows modifications but prevents deletion.
2
Evaluate the ReadOnly resource lock alternative.
The ReadOnly lock is ruled out because it blocks both deletion and modifications (including starting and stopping the VM).
ReadOnly prevents any updates to the resource, which violates the requirement to allow users to change its size or status.

Key Concept

Azure Resource Locks prevent accidental deletion or modification of critical Azure resources.
Question 4Question →

A company plans to connect its local office to an Azure virtual network. The connection must be secure, encrypted, and established quickly over the public internet. Which Azure service should the company use?

Show answer & explanation

Answer: Azure VPN Gateway

Answer

Azure VPN Gateway
Azure VPN Gateway is correct because it sends encrypted network traffic between an Azure virtual network and an on-premises location over the public internet, which allows for quick setup and secure communication.

Step-by-Step Solution

1
Identify the key requirements from the scenario: on-premises to Azure connectivity, encrypted transmission, quick setup, and routing over the public internet.
Recognize that the solution must be a hybrid connectivity service that traverses the public internet.
This helps eliminate internal-only services and those requiring dedicated physical lines.
2
Evaluate the remaining options to find the service that uses the public internet.
Determine that Azure VPN Gateway meets all the criteria, whereas ExpressRoute does not use the public internet.
VPN Gateway encrypts and routes traffic over the public internet, matching the quick and secure requirement.

Key Concept

Azure VPN Gateway establishes secure, encrypted connections over the public internet, while ExpressRoute uses private, dedicated connections.
Question 5Question →

A company is deploying an application on Azure Virtual Machines. The deployment has the following requirements:
- A storage solution to host the operating system disks for the virtual machines, where the company maintains full administrative control over operating system patching and configurations.
- A shared storage volume that can be mounted simultaneously by multiple virtual machines using the Server Message Block (SMB) protocol.

Which combination of Azure storage services should the company select?

Show answer & explanation

Answer: Azure Disk Storage for the operating system disks, and Azure Files for the shared volume

Answer

Azure Disk Storage for the operating system disks, and Azure Files for the shared volume
The correct solution uses Azure Disk Storage for the OS disks because it provides persistent block storage required for hosting VM operating systems, where the customer retains administrative control over patching and configuration. It uses Azure Files for the shared volume because it is a managed file share service that natively supports the SMB protocol for concurrent access by multiple VMs.

Step-by-Step Solution

1
Identify the storage service required for hosting the virtual machine operating system disks.
Azure Disk Storage provides persistent, high-performance block storage designed for virtual machine OS and data disks.
Other services like Azure Files or Blob Storage are not used as native OS disks for standard virtual machines.
2
Identify the service required for a shared volume that can be mounted concurrently using the SMB protocol.
Azure Files supports standard SMB and NFS protocols, allowing multiple virtual machines to mount the same share simultaneously.
Azure Disk Storage is primarily for single-VM attachment (unless using Shared Disks, which don't natively present an SMB file share), and Blob Storage is object storage.
3
Evaluate the administrative responsibilities and storage tier compatibility.
In IaaS (Virtual Machines), the customer is responsible for OS patching and configuration. Additionally, the Archive tier is offline and cannot be used for active disks or live shared shares.
This eliminates options that assume Microsoft manages VM OS patching or that attempt to use the Archive tier for active storage.

Key Concept

Selecting appropriate Azure Storage options (Disk Storage vs. Files) based on OS hosting requirements, access protocols, and the shared responsibility model.
Question 6Question →

An organization hosts a customer database on an Azure SQL Database instance. The database administrator wants to track the database's real-time CPU consumption to ensure there is enough processing capacity. Which Azure service should the administrator use to collect and visualize these resource-level performance metrics?

Show answer & explanation

Answer: Azure Monitor

Answer

Azure Monitor
Azure Monitor is the correct service because it is specifically designed to collect, analyze, and visualize telemetry data, such as real-time CPU utilization metrics and diagnostic logs, from individual Azure resources like Azure SQL Database.

Step-by-Step Solution

1
Determine the monitoring requirement.
The requirement is to collect, track, and visualize real-time CPU performance telemetry for a specific database resource hosted inside Azure.
Identifying the scope of monitoring (individual resource performance vs. global service status) helps isolate the correct management service.
2
Evaluate the capabilities of the primary monitoring service.
Azure Monitor collects numeric performance metrics and logs from Azure resources, enabling administrators to analyze trends and set up alerts.
This matches the requirement to monitor and visualize database CPU consumption.
3
Rule out alternative management and governance services.
Azure Service Health tracks platform-wide events, Azure Policy enforces compliance standards, and Azure Arc handles hybrid resource management.
Ensures that other management tools are not confused with telemetry collection services.

Key Concept

Using Azure Monitor to collect and visualize performance metrics of Azure resources.
Question 7Question →

A financial services company is migrating a core transaction processing application to Microsoft Azure. The systems architect must ensure the solution complies with two strict operational requirements:

1. The application must survive the complete outage of a primary Azure region, with a maximum recovery time (RTO) of 44 hours and a maximum data loss (RPO) of 1515 minutes.
2. The application's compute resources must maintain consistent query response times (predictability) during sudden, short-lived spikes in traffic, and automatically scale down capacity to minimize cost when transaction volume decreases.

Which combination of cloud design concepts and capabilities must the architect implement to satisfy these requirements?

Show answer & explanation

Answer: Disaster recovery using cross-region replication to meet the recovery objectives, and cloud elasticity to automatically scale compute resources to maintain predictable performance.

Answer

Disaster recovery using cross-region replication to meet the recovery objectives, and cloud elasticity to automatically scale compute resources to maintain predictable performance.
The correct answer combines disaster recovery via cross-region replication to satisfy the recovery objectives (RTO/RPO) for regional outages, and cloud elasticity to automatically adjust resources to handle traffic spikes and scale down to minimize cost. This directly fulfills both parts of the business requirements.

Step-by-Step Solution

1
Analyze the first requirement regarding surviving a complete primary Azure region outage within specific recovery metrics (44 hours RTO and 1515 minutes RPO).
Determine that local redundancy or single-region high availability (such as Availability Zones) is insufficient for regional outages. A disaster recovery (DR) strategy with cross-region replication is required.
Disaster recovery addresses recovery from catastrophic regional events, whereas High Availability focuses on localized failures within a single region.
2
Analyze the second requirement regarding maintaining consistent performance during traffic surges while minimizing cost during low-demand periods.
Determine that cloud elasticity is required to dynamically scale compute capacity up and down automatically in response to varying workloads.
Elasticity provides the automation needed to scale down resources to optimize costs, distinguishing it from static scaling or manual scaling.
3
Synthesize the requirements to identify the option that correctly pairs disaster recovery (with cross-region replication) and elasticity.
Select the correct combination that matches disaster recovery and elasticity.
Only this option addresses both regional disaster survival and automated cost-efficient performance scaling.

Key Concept

Distinguishing between Disaster Recovery (cross-region resilience) and High Availability (intra-region resilience), and between Elasticity (dynamic auto-scaling) and Scalability (static or manual provisioning).
Estimated Time:2m 0s
Question 8Question →

A company is planning to migrate its operations to Azure. The migration requirements specify:

- The finance team must run a legacy desktop application that requires local administrative rights and a dedicated, persistent operating system state where changes are saved across sessions.
- The customer support team needs access to shared desktop sessions where multiple users run concurrent sessions on the same underlying virtual machine resources to optimize licensing and compute costs.

Which configuration should the company implement to meet these requirements?

Show answer & explanation

Answer: Deploy Azure Virtual Desktop using a personal host pool for the finance team, and a pooled host pool for the customer support team.

Answer

Deploy Azure Virtual Desktop using a personal host pool for the finance team, and a pooled host pool for the customer support team.
Azure Virtual Desktop supports two main types of host pools: personal host pools and pooled host pools. A personal host pool assigns a dedicated virtual machine to each user, which is ideal for workloads like the finance team's application that requires administrative privileges and a persistent state. A pooled host pool allows multiple users to share a single virtual machine's resources concurrently (multi-session), which is ideal for cost optimization for teams like customer support.

Step-by-Step Solution

1
Analyze the requirements for the finance team.
The finance team requires a dedicated, persistent environment with local admin rights, which aligns with the personal host pool feature of Azure Virtual Desktop.
A personal host pool maps a single user to a single session host, preserving user state and configuration.
2
Analyze the requirements for the customer support team.
The customer support team requires shared, concurrent sessions on the same compute resources to optimize costs, which aligns with the pooled host pool feature of Azure Virtual Desktop.
A pooled host pool supports multi-session Windows client environments, allowing multiple users to run isolated sessions on the same virtual machine.
3
Evaluate the management and OS support constraints.
Confirm that multi-session Windows 11 client is supported only within Azure Virtual Desktop, and that OS patching remains a customer responsibility for the underlying IaaS session hosts.
This rules out standard VM scale sets and options that offload OS patching responsibilities to Microsoft.

Key Concept

Azure Virtual Desktop host pool types (personal vs. pooled) and deployment capabilities.
Question 9Question →

An enterprise is designing its Azure governance model. The compliance department requires that a specific security policy be applied to all resources deployed across the company's 12 Azure subscriptions. The IT team wants to apply this policy efficiently without configuring it on each subscription individually. Which Azure management boundary should the IT team use to group these subscriptions and apply the policy?

Show answer & explanation

Answer: Management groups

Answer

Management groups should be used to group the subscriptions and apply the policy, as they provide a governance scope above subscriptions that propagates down via inheritance.
Management groups provide a level of scope above subscriptions. When a policy is assigned to a management group, that policy automatically inherits down to all subscriptions grouped under it, as well as the resource groups and resources within those subscriptions.

Step-by-Step Solution

1
Identify the requirement to apply an Azure Policy across multiple subscriptions simultaneously.
Recognized that individual subscription assignment is inefficient.
The organization wants to manage 12 subscriptions collectively rather than individually.
2
Determine the correct Azure containment hierarchy level that sits above subscriptions.
Identified management groups as the container for subscriptions.
Management groups are specifically designed to group subscriptions and apply policies or access controls that inherit downward.
3
Evaluate and rule out resource groups and tags as containers for subscriptions or policy enforcement boundaries.
Confirmed that resource groups cannot contain subscriptions, cannot be nested, and tags do not enforce policy inheritance.
Eliminating invalid configurations ensures compliance with Azure architectural rules.

Key Concept

Azure Management Groups inheritance and subscription organization hierarchy
Question 10Question →

A multi-national retail corporation plans to migrate its supply chain forecasting platform to Microsoft Azure. The platform's workload is highly variable, requiring 22 virtual machines (VMs) during off-peak periods, but scaling up to 150150 VMs during major seasonal sales events. The company's financial team is evaluating the transition from their existing on-premises data center model to the Azure consumption-based model.

Which of the following represents the correct financial and operational impact of adopting the consumption-based model for this workload?

Show answer & explanation

Answer: The company eliminates the risk of upfront capital investment for peak capacity, pays only for the compute resources consumed, and classifies these costs as operational expenditures (OpEx).

Answer

The company eliminates the risk of upfront capital investment for peak capacity, pays only for the compute resources consumed, and classifies these costs as operational expenditures (OpEx).
The correct option correctly describes the core benefit of the consumption-based model. Under this model, there are no upfront costs, and organizations pay only for the resources they actually consume (e.g., VM running hours). Because there is no ownership of physical infrastructure, these expenses are classified as operational expenditures (OpEx) and can be fully deducted in the tax year they are incurred, eliminating the risk of over-provisioning hardware for peak periods.

Step-by-Step Solution

1
Analyze the workload pattern and migration scenario.
The workload is highly variable, requiring between 22 and 150150 VMs, which represents a typical fluctuating demand pattern.
Understanding the workload behavior helps evaluate the efficiency of pay-as-you-go pricing versus purchasing fixed hardware.
2
Differentiate between Capital Expenditure (CapEx) and Operational Expenditure (OpEx) in a cloud context.
On-premises hardware acquisition requires upfront spending on physical assets (CapEx) that depreciate over time. In contrast, Azure virtual machines billed on usage have no upfront costs and are treated as operational expenses (OpEx) deducted in the year they are incurred.
This distinction determines how the migration impacts the balance sheet and tax treatment.
3
Evaluate the consumption-based model characteristics.
The consumption-based model offers cost flexibility with no upfront costs, no need to purchase or manage costly infrastructure that might go unused, and billing based solely on the resources consumed.
Identifying these characteristics allows selection of the option that correctly maps the financial impact of the cloud migration.

Key Concept

Consumption-Based Model (CapEx vs OpEx)
Estimated Time:1m 30s
Question 11Question →

A retail company is preparing for its annual peak shopping season. Historically, they purchased physical servers to handle peak traffic, which remained idle for the rest of the year. The company is migrating these workloads to Azure to adopt a consumption-based model. How does this transition to a consumption-based model affect the company's financial cash flow and tax treatment?

Show answer & explanation

Answer: The company avoids upfront hardware acquisition costs, paying only for active cloud resource usage, which is treated as an operational expense that can be fully deducted in the tax year it is incurred.

Answer

The transition allows the company to avoid upfront hardware acquisition costs, paying only for active cloud resource usage, which is treated as an operational expense that can be fully deducted in the tax year it is incurred.
The correct option is correct because the consumption-based model in Azure is categorized under Operational Expenditure (OpEx). Under OpEx, organizations avoid paying large upfront capital costs for physical hardware. Instead, they pay recurring operational costs based on actual consumption, and these expenses are deducted from tax liability within the same tax year.

Step-by-Step Solution

1
Analyze the financial transition from on-premises hardware to cloud resources.
On-premises hardware represents Capital Expenditure (CapEx) with upfront costs, whereas Azure cloud resources operate under a consumption-based Operational Expenditure (OpEx) model.
Understanding the core difference between CapEx and OpEx is necessary to evaluate the financial impact of the migration.
2
Evaluate the cash flow implications of the consumption-based model.
The company only pays for the actual compute resources used during the peak season and stops paying when the resources are deprovisioned, eliminating idle hardware costs.
This shows how operational cash flow is directly tied to business demand under the consumption model.
3
Determine the tax treatment of the operational cloud expenses.
Operating expenses (OpEx) are treated as recurring business expenses and can be fully deducted on tax returns in the year the expense was incurred, rather than being depreciated over time.
This establishes the correct financial and tax categorization of cloud billing.

Key Concept

Consumption-Based Model (CapEx vs OpEx)
Question 12Question →

An administrator needs to deploy a new Azure Virtual Machine in the West Europe region. The administrator wants to organize this virtual machine under an existing resource group named RG-Finance, which is located in the North Europe region.

Which of the following statements correctly describes how the administrator should proceed?

Show answer & explanation

Answer: Deploy the virtual machine to the West Europe region and place it in the RG-Finance resource group.

Answer

Deploy the virtual machine to the West Europe region and place it in the RG-Finance resource group.
The correct option is to deploy the virtual machine to West Europe and assign it to the RG-Finance resource group. In Azure, resources do not need to share the same region as the resource group they reside in. The resource group's region only determines where its metadata is stored.

Step-by-Step Solution

1
Identify the resource deployment region (West Europe) and the existing resource group's location (North Europe).
The target resource is in West Europe; the resource group is in North Europe.
To evaluate if there are any location matching requirements or constraints.
2
Recall the Azure rules regarding resource group locations and resource locations.
Resources do not need to be in the same region as their containing resource group.
A resource group serves as a logical container and its location only dictates where the resource metadata is stored.
3
Recall the rules regarding resource group hierarchy and nesting.
Azure does not support nesting resource groups.
Resource groups are flat containers within a subscription.

Key Concept

Resource Group location vs Resource location and lack of nesting in Azure Resource Groups
Question 13Question →

A company plans to migrate its on-premises email and collaboration suite to Microsoft 365, which is a Software as a Service (SaaS) offering. Under the Microsoft shared responsibility model, which of the following duties remains the responsibility of the customer?

Show answer & explanation

Answer: Configuring user access permissions and protecting organization data

Answer

Configuring user access permissions and protecting organization data
The correct answer is configuring user access permissions and protecting organization data. Under the shared responsibility model, regardless of the cloud deployment type (IaaS, PaaS, or SaaS), the customer always retains ownership and responsibility for their data, endpoints, accounts, and access management.

Step-by-Step Solution

1
Identify the cloud service model referenced in the scenario.
The scenario specifies Microsoft 365, which is a Software as a Service (SaaS) offering.
Determining the cloud model allows the application of the correct shared responsibility boundaries.
2
Analyze the customer responsibility boundaries for the identified SaaS model.
In SaaS, the cloud provider manages the physical infrastructure, operating systems, network controls, and application software. The customer remains responsible for data, endpoints (devices), and identity access management.
This isolates the tasks that the customer must perform from those managed by Microsoft.
3
Evaluate the choices to find the duty that belongs to the customer.
Configuring access permissions and securing organizational data is a customer duty, whereas patching operating systems, managing middleware, and upfront hardware CapEx are managed by the provider or apply to different cloud models.
This confirms that managing user access and protecting data is the correct customer responsibility.

Key Concept

Shared Responsibility Model in Software as a Service (SaaS)
Estimated Time:1m 0s
Question 14Question →

An organization is migrating its on-premises workloads to Microsoft Azure. Instead of purchasing physical servers and networking hardware upfront, the organization will pay a monthly bill based on the exact amount of cloud resources consumed. Which expenditure model does this monthly consumption-based billing represent?

Show answer & explanation

Answer: Operational Expenditure (OpEx)

Answer

Operational Expenditure (OpEx)
The operational expenditure model represents ongoing day-to-day costs where businesses pay for services or resources as they consume them, without any upfront physical hardware purchases.

Step-by-Step Solution

1
Analyze the financial characteristics of the scenario.
The organization is paying monthly based on consumption without purchasing physical assets upfront.
This establishes that the expenses are ongoing operational costs rather than upfront investments in physical property.
2
Differentiate between CapEx and OpEx definitions.
Operational Expenditure (OpEx) aligns with consumption-based billing models, whereas Capital Expenditure (CapEx) aligns with upfront physical infrastructure purchases.
To select the correct cloud expenditure model that avoids upfront costs.

Key Concept

Consumption-Based Model (CapEx vs OpEx)
Estimated Time:45s
Question 15Question →

A company decides to migrate its on-premises email and collaboration tools to a cloud-based service where the cloud provider manages all infrastructure, virtualization, operating systems, and the application itself. The company's employees will access their mailboxes through web browsers. Which cloud service model is the company adopting?

Show answer & explanation

Answer: Software as a Service (SaaS)

Answer

Software as a Service (SaaS)
The correct service model is Software as a Service (SaaS). In this model, the cloud provider hosts and manages the software application, its underlying infrastructure, and any maintenance such as software upgrades and security patching. Users connect to and use the application over the internet, which matches the scenario of accessing email through a web browser.

Step-by-Step Solution

1
Examine the cloud management responsibilities outlined in the scenario.
The cloud provider manages all layers of the stack, including infrastructure, operating systems, and the actual application, while the customer only uses the software.
Determining who manages the application and underlying infrastructure determines the correct cloud service model.
2
Map the management model to the correct definition of cloud service models.
A model where the provider delivers a fully functional, hosted application that users access directly over the internet is defined as Software as a Service (SaaS).
This matches the definition and responsibilities of the SaaS model.

Key Concept

Software as a Service (SaaS)
Estimated Time:45s
Question 16Question →

A company plans to migrate its e-commerce platform from an on-premises data center to Azure. The website experiences highly variable traffic, with major spikes during seasonal sales events and minimal traffic otherwise. By moving to Azure's consumption-based model, which of the following describes the financial impact on the company?

Show answer & explanation

Answer: The company transitions from Capital Expenditure (CapEx) to Operational Expenditure (OpEx), paying only for the computing resources they actively consume.

Answer

The company transitions from Capital Expenditure (CapEx) to Operational Expenditure (OpEx), paying only for the computing resources they actively consume.
Migrating to a consumption-based model in Azure allows the company to eliminate upfront infrastructure costs (CapEx) and instead pay for cloud resources as they are consumed (OpEx). This aligns their operational costs directly with the demand spikes and valleys of their e-commerce website.

Step-by-Step Solution

1
Analyze the financial characteristics of the current on-premises data center model.
On-premises infrastructure requires buying physical hardware upfront, which is classified as Capital Expenditure (CapEx).
To establish the baseline financial model before migration.
2
Analyze the financial characteristics of the Azure consumption-based model.
Azure resources do not require upfront hardware purchases. Instead, they are billed based on actual usage, which is classified as Operational Expenditure (OpEx).
To identify the target financial model after migration.
3
Compare the on-premises model with the Azure consumption-based model under a variable workload.
The company shifts spending from upfront hardware (CapEx) to a pay-as-you-go model (OpEx), aligning costs directly with traffic peaks and valleys.
To determine the correct financial impact described in the choices.

Key Concept

Under a consumption-based model, organizations do not pay upfront costs for physical infrastructure. Instead, they classify cloud spending as Operational Expenditure (OpEx), aligning costs directly with resource consumption.
Estimated Time:1m 0s
Question 17Question →

An administrator is planning the deployment of a new application in Azure. The application requires virtual machines to be deployed in the East US region and a storage account to be deployed in the West US region. The administrator wants to manage all of these resources together as a single logical unit and is considering nesting resource groups to represent different application tiers. Which of the following statements correctly describes how Azure resource groups can be used to meet these requirements?

Show answer & explanation

Answer: The administrator can place all resources in a single resource group regardless of their region, but resource groups cannot be nested.

Answer

The administrator can place all resources in a single resource group regardless of their region, but resource groups cannot be nested.
The statement expressing that resources can be placed in a single resource group regardless of their region, while noting that resource groups cannot be nested, is correct. Azure Resource Groups provide a flat logical container structure that does not support nesting. However, they allow resources from different geographical regions to be grouped together for lifecycle management.

Step-by-Step Solution

1
Evaluate the requirement for nesting resource groups in Azure.
Azure does not support nesting resource groups; a resource group cannot contain another resource group.
This is a fundamental design limitation of Azure Resource Manager (ARM) resources.
2
Evaluate the requirement for deploying resources in different regions within the same resource group.
Resources in a resource group can reside in any Azure region; they do not need to match the resource group's location.
The resource group location is used to store metadata about the resources, not to restrict the deployment region of the resources themselves.
3
Combine these constraints to identify the correct administrative approach.
All application resources (in East US and West US) can be grouped into one resource group, but the tiers cannot be organized using nested resource groups.
This configuration respects both the flat structure of resource groups and the regional flexibility of individual resources.

Key Concept

Azure Resource Group structure, nesting constraints, and resource location independence.
Estimated Time:1m 30s
Question 18Question →

A company currently hosts a legacy web application on Azure Virtual Machines. To reduce administrative overhead, the IT team plans to migrate the application to Azure App Service.

How does the responsibility for operating system patching change after this migration is complete?

Show answer & explanation

Answer: The responsibility for patching the operating system shifts entirely from the customer to Microsoft.

Answer

The responsibility for patching the operating system shifts entirely from the customer to Microsoft.
In the Shared Responsibility Model, the boundary of responsibility shifts depending on the cloud service type. In Infrastructure as a Service (IaaS), such as Azure Virtual Machines, the customer has control over and is responsible for patching and configuring the operating system. In Platform as a Service (PaaS), such as Azure App Service, Microsoft manages the operating system, middleware, and runtime, shifting the responsibility of patching the operating system entirely to Microsoft.

Step-by-Step Solution

1
Identify the service models involved in the transition.
The application is migrating from Azure Virtual Machines (Infrastructure as a Service, or IaaS) to Azure App Service (Platform as a Service, or PaaS).
Understanding the service models is necessary to apply the Shared Responsibility Model rules.
2
Analyze the responsibility for operating system patching in IaaS.
In IaaS, the customer is responsible for managing and patching the guest operating system.
Determines the baseline responsibility before migration.
3
Analyze the responsibility for operating system patching in PaaS.
In PaaS, the cloud provider (Microsoft) manages the operating system, including patching, while the customer manages applications and data.
Determines the new responsibility allocation after migration.
4
Compare the change in responsibility to identify the correct description.
Responsibility for patching shifts from the customer to Microsoft.
Selects the option that correctly describes this shift.

Key Concept

Shared Responsibility Model
Estimated Time:1m 0s
Question 19Question →

A multinational enterprise is transitioning its legacy customer relationship management (CRM) system and corporate email to a cloud-based Software as a Service (SaaS) model. As part of this migration, the Chief Information Security Officer (CISO) is updating the company's compliance registry to map operational responsibilities. Under the Microsoft shared responsibility model for SaaS, which of the following sets of tasks remains the sole responsibility of the enterprise's IT department?

Show answer & explanation

Answer: Configuring user access controls, managing device enrollment policies for corporate endpoints, and classifying data stored within the cloud applications.

Answer

Configuring user access controls, managing device enrollment policies for corporate endpoints, and classifying data stored within the cloud applications.
Under the Microsoft shared responsibility model for SaaS, the cloud customer always retains responsibility for three areas: information and data, devices (mobile and PCs), and accounts and identities. Configuring user access controls, managing device enrollment policies, and classifying data directly map to these three customer-owned areas.

Step-by-Step Solution

1
Analyze the cloud service model presented in the scenario.
The scenario specifies a migration to a Software as a Service (SaaS) model.
Responsibilities vary significantly depending on whether the service model is IaaS, PaaS, or SaaS.
2
Apply the shared responsibility model rules for SaaS.
Identify that in a SaaS model, the cloud provider manages the physical hosts, network, datacenter, operating system, middleware, and application runtime.
This narrows down the customer's responsibility to data, endpoints, accounts, and identities.
3
Evaluate the options against the customer's SaaS responsibilities.
The option containing user access controls, device enrollment, and data classification falls entirely within the customer's scope of responsibility.
Information/data, devices, and accounts/identities are always managed by the customer regardless of the cloud model.

Key Concept

Under the Microsoft shared responsibility model for Software as a Service (SaaS), the customer always retains responsibility for data classification, endpoints (devices), and accounts and access management, while the cloud provider manages the physical infrastructure, operating system, middleware, and application layer.
Question 20Question →

A multinational retail company is planning to migrate its on-premises customer ordering platform to Microsoft Azure. The platform experiences highly volatile demand: it requires a steady baseline of 10 virtual machines year-round, but spikes to over 50 virtual machines during seasonal sales events. The Chief Financial Officer (CFO) mandates that the migration must minimize Capital Expenditure (CapEx) to preserve cash flow, maximize cost savings for the predictable baseline, and maintain flexibility for temporary demand spikes without any long-term financial commitments for those spikes.

Which of the following cloud migration and billing strategies best satisfies the CFO's requirements while ensuring all cloud resources are classified under the operational expenditure (OpEx) model?

Show answer & explanation

Answer: Deploy the baseline workload using 3-year Azure Reserved VM Instances with monthly payment terms, and scale out using Pay-As-You-Go Virtual Machines for seasonal spikes.

Answer

Deploy the baseline workload using 3-year Azure Reserved VM Instances with monthly payment terms, and scale out using Pay-As-You-Go Virtual Machines for seasonal spikes.
The correct strategy combines 3-year Azure Reserved VM Instances with monthly payments for the baseline workload and Pay-As-You-Go for the dynamic spikes. This satisfies all constraints: Reserved Instances reduce the cost of the steady baseline, monthly billing preserves cash flow, Pay-As-You-Go handles the seasonal spikes flexibly, and all resources are billed as operational expenditures (OpEx) since Microsoft owns and maintains the physical assets.

Step-by-Step Solution

1
Analyze the financial constraints and operational demands of the workload.
The baseline workload (10 VMs) needs cost predictability and maximum savings. The peak workload (40 additional VMs) requires high flexibility with no long-term commitment. All resources must be classified as OpEx (no physical asset ownership).
This establishes the criteria for selecting the appropriate Azure billing mechanisms.
2
Evaluate the financial classification of cloud consumption models.
Cloud expenditures are operational expenditures (OpEx) because the customer pays for a service and does not own the physical servers or infrastructure, which avoids capital expenditures (CapEx).
This eliminates options involving physical hardware ownership or leasing.
3
Select the optimal combination of Azure pricing models.
Azure Reserved VM Instances (with monthly payment options) provide the necessary discount for the baseline workload while remaining OpEx. Pay-As-You-Go virtual machines are ideal for dynamic spikes because they charge only for active usage without upfront fees.
This identifies the correct combination of Reserved Instances and Pay-As-You-Go billing.

Key Concept

Consumption-Based Model (CapEx vs OpEx)
Page 1 / 31Next
All practice questions — Microsoft Azure Fundamentals (AZ-900) | Examkin