Question 1 of 40Cloud Concepts
Which statement BEST describes the difference between scalability and elasticity?
A ✓Scalability is the ability to increase capacity; elasticity is doing so automatically in response to demand
BScalability is automatic; elasticity requires manual intervention
CThey are identical concepts with different names
DScalability applies only to storage; elasticity only to compute
Explanation: Scalability is the capability to grow (or shrink) resources. Elasticity is the automatic, dynamic version — scaling in response to real-time demand without human intervention. All elastic systems are scalable, but not all scalable systems are elastic.
Question 2 of 40Cloud Concepts
A software vendor wants to offer its accounting product to customers as a subscription accessed via browser, with the vendor managing all infrastructure and updates. Which model is the vendor providing to its customers?
AIaaS
BPaaS
C ✓SaaS
DHybrid cloud
Explanation: The vendor delivers finished software over the internet on subscription — the definition of SaaS from the customer's perspective. Customers manage nothing but their data and users. The vendor may build ON IaaS/PaaS, but what they provide is SaaS.
Question 3 of 40Cloud Concepts
An engineering firm runs simulation software 4 hours per month. Buying a powerful server would cost $50,000 with most capacity idle. What cloud principle makes Azure more economical here?
A ✓Paying only for compute consumed during those 4 hours per month
BCloud servers are always cheaper than physical servers
CAzure offers free compute for engineering workloads
DReserved instances reduce the upfront hardware cost
Explanation: The consumption model shines for intermittent workloads: pay for 4 hours monthly instead of owning idle hardware. Cloud isn't always cheaper — steady 24/7 workloads can favour ownership — but bursty usage is the clearest cloud economics win. Reservations suit constant, not intermittent, workloads.
Question 4 of 40Cloud Concepts
In IaaS, which of the following is the CUSTOMER responsible for?
APhysical network cabling in the datacentre
B ✓Operating system patching and application configuration
CServer hardware replacement
DDatacentre cooling systems
Explanation: In IaaS, the provider handles everything physical (buildings, hardware, host networking); the customer manages everything from the operating system upward — OS patches, middleware, runtime, applications, and data.
Question 5 of 40Cloud Concepts
A government agency requires that its cloud infrastructure be used exclusively by government organisations with shared compliance requirements. Which deployment model does this describe?
APublic cloud
BPrivate cloud
C ✓Community cloud (e.g. Azure Government)
DMulti-cloud
Explanation: A community cloud serves a specific community with shared concerns — Azure Government is the classic example, physically isolated and available only to verified government entities. Private cloud serves ONE organisation; public serves anyone.
Question 6 of 40Cloud Concepts
Which is a key benefit of the cloud's 'agility' characteristic?
A ✓Resources can be provisioned in minutes rather than the weeks required for hardware procurement
BData is automatically encrypted
CApplications never experience downtime
DCosts are always lower than on-premises
Explanation: Agility means rapid provisioning — spin up resources in minutes versus weeks of procurement, racking, and configuration. This accelerates experimentation and time-to-market. Encryption is security; zero downtime and guaranteed lower cost are not promises the cloud makes.
Question 7 of 40Cloud Concepts
After migrating to PaaS, a development team no longer performs OS patching. Under the shared responsibility model, who patches the OS, and who secures the application code?
A ✓Microsoft patches the OS; the customer secures their application code
BThe customer does both
CMicrosoft does both
DThe customer patches the OS; Microsoft secures the code
Explanation: In PaaS, the platform (including OS) is Microsoft's responsibility; the customer remains responsible for their application code, data, and identities. Responsibility for the application layer never transfers to the provider.
Question 8 of 40Cloud Concepts
What does a Service Level Agreement (SLA) define?
AThe maximum price Azure can charge per month
B ✓Microsoft's formal uptime and connectivity commitments for a service, with service credits if unmet
CThe customer's obligation to use services for a minimum term
DThe datacentre locations where services run
Explanation: An SLA is Microsoft's formal commitment to service uptime/connectivity (e.g. 99.9%), with financial service credits if breached. Composite applications have effective SLAs derived from multiplying component SLAs.
Question 9 of 40Cloud Concepts
A CTO argues against cloud adoption: 'We lose all control and Microsoft can see our data.' Which fact BEST counters this concern?
A ✓Customers retain ownership and control of their data, with encryption options where only the customer holds the keys
BMicrosoft guarantees it never stores customer data
CCloud data is safer because it cannot be encrypted
DOn-premises data is always less secure than cloud data
Explanation: Customers own their data. Azure provides customer-managed keys (via Key Vault) where Microsoft cannot decrypt content. Azure holds extensive compliance certifications for data handling. Absolutes like 'always less secure' aren't accurate arguments.
Question 10 of 40Cloud Concepts
Which scenario is the BEST fit for a private cloud?
AA startup wanting minimal upfront investment
B ✓An organisation with strict regulatory requirements needing complete control over infrastructure and data locality
CA blog with unpredictable viral traffic
DA company wanting to eliminate all IT staff
Explanation: Private cloud suits organisations needing complete infrastructure control — typically for regulation or data sovereignty — and willing to bear the cost. Startups and variable workloads favour public cloud economics; private cloud requires MORE IT capability, not less.
Question 11 of 40Azure Architecture & Services
An application deployed in one Azure region must fail over to another region during a regional disaster. Which Azure concept ensures the second region is a deliberate, distance-separated partner receiving prioritised recovery?
AAvailability sets
B ✓Region pairs
CResource groups
DEdge zones
Explanation: Azure region pairs are deliberately matched regions (like Australia East + Australia Southeast) at least 300 miles apart where possible, with sequential updates and prioritised recovery during broad outages. Availability sets protect within a datacentre, not across regions.
Question 12 of 40Azure Architecture & Services
What is a resource group in Azure?
A ✓A logical container holding related resources that share a lifecycle, permissions, and policies
BA physical cluster of servers
CA billing account for multiple subscriptions
DA group of user accounts with the same role
Explanation: A resource group is a logical container for related resources — typically deployed, managed, and deleted together. Deleting the group deletes everything inside. It's a management construct, not physical infrastructure or billing.
Question 13 of 40Azure Architecture & Services
A team needs to run Docker containers for a short-lived batch job without managing any orchestration or virtual machines. Which is the SIMPLEST Azure service for this?
AAzure Kubernetes Service
B ✓Azure Container Instances (ACI)
CAzure Virtual Machines with Docker installed
DAzure DevTest Labs
Explanation: ACI runs containers directly — no VMs to manage, no orchestrator to configure, per-second billing. It's the fastest, simplest way to run a container. AKS adds orchestration complexity suited to large multi-container applications, not single batch jobs.
Question 14 of 40Azure Architecture & Services
Which Azure service hosts web applications with built-in load balancing, auto-scaling, and support for multiple languages — without managing servers?
A ✓Azure App Service
BAzure Virtual Machines
CAzure ExpressRoute
DAzure DNS
Explanation: App Service is Azure's PaaS web hosting — deploy code in .NET, Java, Node.js, Python and more, with automatic OS management, scaling, load balancing, and deployment slots. The platform layer is fully managed.
Question 15 of 40Azure Architecture & Services
Users worldwide complain that images and videos on your site load slowly from your single Australia East deployment. Which service caches content at locations near users globally?
A ✓Azure Content Delivery Network (CDN)
BAzure Load Balancer
CExpressRoute
DAvailability Zones
Explanation: A CDN caches static content (images, video, scripts) at edge points-of-presence worldwide, serving users from nearby locations rather than the origin region. Load Balancer distributes traffic within a region; it doesn't cache globally.
Question 16 of 40Azure Architecture & Services
Which Azure storage service provides fully managed file shares accessible via the SMB protocol, mountable like a network drive?
AAzure Blob Storage
B ✓Azure Files
CAzure Queue Storage
DAzure Disk Storage
Explanation: Azure Files provides managed SMB (and NFS) file shares that mount like traditional network drives — ideal for lift-and-shift apps expecting file shares. Blobs are object storage via REST; Disks attach to single VMs; Queues hold messages.
Question 17 of 40Azure Architecture & Services
Compliance requires archived records be retained for 7 years but they will almost never be accessed. Which Blob access tier minimises cost?
AHot tier
BCool tier
C ✓Archive tier
DPremium tier
Explanation: Archive tier offers the lowest storage cost for rarely accessed data tolerating hours of retrieval latency — perfect for long-term compliance retention. Hot is for frequent access; Cool for infrequent (30+ days); Premium is high-performance.
Question 18 of 40Azure Architecture & Services
What is the primary purpose of Azure Load Balancer?
A ✓Distributing incoming network traffic across multiple healthy VMs to improve availability
BEncrypting traffic between regions
CReducing storage costs through tiering
DTranslating domain names to IP addresses
Explanation: Load Balancer distributes traffic across multiple VM instances and routes only to healthy ones (via health probes), improving both availability and throughput. DNS translation is Azure DNS; encryption in transit is handled elsewhere.
Question 19 of 40Azure Architecture & Services
Remote employees need encrypted access to the company's Azure VNet from home over the internet. Which service enables individual user connections?
AExpressRoute
B ✓VPN Gateway with point-to-site connections
CAzure Firewall
DNetwork Security Groups
Explanation: Point-to-site VPN connects individual devices to an Azure VNet over encrypted internet tunnels — designed for remote workers. Site-to-site connects whole networks; ExpressRoute is private circuits for organisations, not individual users at home.
Question 20 of 40Azure Architecture & Services
Which database service should you choose to run PostgreSQL in Azure with automated patching, backups, and high availability?
A ✓Azure Database for PostgreSQL
BSQL Server on an Azure VM
CAzure Cosmos DB
DAzure Cache for Redis
Explanation: Azure Database for PostgreSQL is the managed PaaS offering for PostgreSQL — automated patching, backups, HA. Azure offers equivalent managed services for MySQL and MariaDB. Running database software on a VM means YOU manage everything.
Question 21 of 40Azure Architecture & Services
A company wants to consolidate security signals from Azure, on-premises, and other clouds into one intelligent system that detects and responds to threats using AI. Which service is designed for this?
A ✓Microsoft Sentinel (cloud-native SIEM)
BAzure Key Vault
CAzure DDoS Protection
DNetwork Security Groups
Explanation: Microsoft Sentinel is the cloud-native SIEM/SOAR — aggregating security data across environments, applying AI-driven analytics to detect threats, and automating responses. Key Vault stores secrets; DDoS Protection and NSGs are network-layer controls.
Question 22 of 40Azure Architecture & Services
What is the function of Microsoft Defender for Cloud?
A ✓Continuously assessing security posture and protecting workloads across Azure, hybrid, and multi-cloud environments
BManaging user passwords
CProviding antivirus for employee laptops only
DBacking up virtual machines
Explanation: Defender for Cloud is the cloud security posture management (CSPM) and workload protection platform — secure score, hardening recommendations, and threat protection for servers, storage, databases and containers across clouds.
Question 23 of 40Azure Architecture & Services
An admin must RDP into production VMs, but security policy prohibits exposing RDP ports to the internet. Which service provides browser-based secure access without public IPs on the VMs?
A ✓Azure Bastion
BPoint-to-site VPN for every admin
COpening port 3389 with an NSG rule
DAzure Front Door
Explanation: Azure Bastion provides secure RDP/SSH through the Azure portal over TLS — VMs need no public IPs and no exposed management ports. Opening 3389 to the internet is precisely what policy prohibits.
Question 24 of 40Azure Architecture & Services
Which Entra ID feature allows users to sign in once and access multiple applications without re-authenticating?
A ✓Single sign-on (SSO)
BMultifactor authentication
CConditional Access
DPrivileged Identity Management
Explanation: SSO lets one authentication grant access to multiple applications — fewer passwords, better experience, centralised control. MFA adds verification factors; Conditional Access applies context-based policies; PIM manages just-in-time admin roles.
Question 25 of 40Azure Architecture & Services
Security wants sign-ins from unfamiliar countries to require MFA, while office sign-ins proceed normally. Which Entra ID capability implements this context-aware policy?
A ✓Conditional Access
BPassword writeback
CAzure Policy
DResource locks
Explanation: Conditional Access applies if-then policies using signals like location, device, and risk: if sign-in comes from an unfamiliar location, then require MFA. Azure Policy governs resources, not sign-ins.
Question 26 of 40Azure Architecture & Services
In the defence-in-depth model, which layer does encrypting data at rest belong to?
A ✓The data layer — the innermost layer the other layers protect
BThe perimeter layer
CThe physical security layer
DThe network layer
Explanation: Defence in depth layers protections: physical, identity, perimeter, network, compute, application, and data at the centre. Encryption at rest protects the data layer itself — the asset every other layer exists to defend.
Question 27 of 40Azure Architecture & Services
A media company needs to convert uploaded videos into multiple formats using AI-powered speech-to-text captioning. Which category of Azure services provides pre-built AI capabilities like this without training your own models?
A ✓Azure AI services (e.g. Speech, Vision, Language)
BAzure Virtual Machines
CAzure DNS
DAzure Storage Explorer
Explanation: Azure AI services offer pre-built, API-accessible AI — speech-to-text, vision, translation, language understanding — without building or training models. You call the API; Microsoft maintains the models.
Question 28 of 40Azure Architecture & Services
What is Azure Marketplace?
A ✓An online store of certified third-party and Microsoft solutions deployable directly into Azure subscriptions
BA physical store selling Azure hardware
CThe billing portal for Azure invoices
DA code repository for open-source projects
Explanation: Azure Marketplace offers thousands of certified solutions — VM images, applications, services from Microsoft and partners — deployable directly into your subscription, often with integrated billing.
Question 29 of 40Management & Governance
A production database was accidentally deleted by a junior admin. Which Azure feature could have PREVENTED the deletion while still allowing normal read/write use?
A ✓A CanNotDelete resource lock
BA resource tag marked 'production'
CAzure Advisor
DA budget alert
Explanation: A CanNotDelete lock permits normal use but blocks deletion until the lock is explicitly removed — even Owners must consciously remove it first. Tags are informational only; Advisor and budgets don't control actions.
Question 30 of 40Management & Governance
Which tool lets you manage Azure resources using a command-line experience directly in the browser, with no local installation?
A ✓Azure Cloud Shell
BRemote Desktop
CVisual Studio Code only
DWindows Admin Center
Explanation: Cloud Shell provides Bash or PowerShell in the browser (or mobile app) with Azure CLI and Azure PowerShell pre-installed and authenticated — no local setup. Accessible from the portal toolbar.
Question 31 of 40Management & Governance
An organisation with 40 subscriptions wants one security policy applied to ALL of them without configuring each individually. What should they use?
A ✓Management groups — applying policy at a scope above subscriptions
BCopy-pasting the policy into each subscription
CA resource lock on each subscription
DTags on every resource
Explanation: Management groups organise subscriptions hierarchically; policies and RBAC assigned at a management group inherit to every subscription beneath it — one assignment governs all 40. Manual duplication invites drift and error.
Question 32 of 40Management & Governance
What is the difference between Azure Policy and role-based access control (RBAC)?
A ✓Policy controls WHAT can be deployed and how resources must be configured; RBAC controls WHO can perform actions
BThey are interchangeable
CRBAC controls resource properties; Policy controls user access
DPolicy applies only to storage accounts
Explanation: RBAC = who can do what (identity permissions). Policy = what is allowed to exist and how it must be configured (resource compliance). A user with RBAC deploy rights can still be blocked by Policy if the deployment violates rules.
Question 33 of 40Management & Governance
Your dev/test VMs run 24/7 but are used only 9am–6pm weekdays. Azure Advisor flags them as underutilised. What is the MOST cost-effective remediation?
A ✓Auto-shutdown schedules outside business hours
BPurchasing 3-year reservations for them
CMoving them to a more expensive VM size
DIgnoring the recommendation
Explanation: Auto-shutdown eliminates ~75% of compute hours for business-hours-only workloads. Reservations commit you to paying for 24/7 capacity — the opposite of what intermittent dev/test usage needs.
Question 34 of 40Management & Governance
Which factors affect the cost of an Azure virtual machine? (Select the BEST answer)
A ✓VM size, region, operating system licensing, running hours, and attached storage
BOnly the VM size
COnly the number of users connecting to it
DThe colour assigned to its resource group
Explanation: VM cost is multi-factor: size (CPU/RAM), region (prices vary by geography), OS licensing (Windows costs more unless using Hybrid Benefit), hours running, plus disks and networking. Stopping (deallocating) a VM stops compute charges; disks still bill.
Question 35 of 40Management & Governance
A company owns Windows Server licences with Software Assurance. How can they reduce Azure Windows VM costs using these existing licences?
A ✓Azure Hybrid Benefit — applying on-premises licences to Azure VMs
BSpot instances
CBuying duplicate licences from Azure Marketplace
DLicences cannot be reused in the cloud
Explanation: Azure Hybrid Benefit lets you apply existing Windows Server (and SQL Server) licences with Software Assurance to Azure VMs, removing the licensing component from the VM price — savings up to ~40%, stackable with reservations.
Question 36 of 40Management & Governance
What does Azure Monitor's Application Insights feature specifically provide?
A ✓Deep application performance monitoring — request rates, response times, failures, and dependency tracking
BPhysical datacentre camera feeds
CBilling forecasts
DUser password resets
Explanation: Application Insights (part of Azure Monitor) instruments applications for APM: request/response telemetry, failure diagnostics, dependency maps, and usage analytics — telling you how the app itself behaves, beyond infrastructure metrics.
Question 37 of 40Management & Governance
Before a compliance audit, you must prove which Azure services meet ISO 27001 and where audit reports can be downloaded. Which portal provides Microsoft's compliance documentation and audit reports?
A ✓Microsoft Service Trust Portal
BAzure Marketplace
CAzure Cloud Shell
DMicrosoft Store
Explanation: The Service Trust Portal publishes Microsoft's compliance materials — audit reports (ISO, SOC), penetration test results, and compliance guides. It's the evidence source for customer audits of Microsoft's side of shared responsibility.
Question 38 of 40Management & Governance
Which statement about Azure subscriptions is TRUE?
A ✓A subscription is a billing and access-control boundary; an organisation can have multiple subscriptions
BEach organisation is limited to exactly one subscription
CSubscriptions physically isolate hardware
DDeleting a subscription keeps all its resources running
Explanation: Subscriptions are logical billing/access boundaries — organisations commonly use several (per department, environment, or project) grouped under management groups. They don't isolate physical hardware, and their resources stop when cancelled.
Question 39 of 40Management & Governance
A team repeatedly deploys the same 12-resource environment for each new client. Deployments must be identical, reviewable, and repeatable. Which approach is BEST?
A ✓Define the environment in a Bicep/ARM template deployed per client
BA detailed step-by-step portal instructions document
CCloning VMs manually each time
DScreenshots of each configuration screen
Explanation: Infrastructure as Code (Bicep/ARM) makes deployments declarative, version-controlled, code-reviewed, and perfectly repeatable — eliminating the drift and human error inherent in manual portal steps, however well documented.
Question 40 of 40Management & Governance
What is the Microsoft Cloud Adoption Framework for Azure?
A ✓Proven guidance, best practices, and tools for planning and implementing cloud adoption
BA mandatory certification for Azure administrators
CA billing discount programme
DA physical migration appliance
Explanation: The Cloud Adoption Framework is Microsoft's structured guidance — strategy, plan, ready, adopt, govern, manage — helping organisations navigate cloud adoption with proven practices, templates, and assessment tools.