Home/Directory/azure

azure Practice Questions

Page 9 of 15 (1456 total questions)

You are configuring a deployment pipeline in Azure DevOps. The deployment requires a database connection string and an API key. These secrets must not be stored in plaintext in the YAML pipeline file or the repository. What is the most secure and natively integrated way to handle these secrets?
View Question & Answer ➔
You are deploying a new version of a critical web application to Azure App Service. You want to route 10% of your production traffic to the new version to monitor for errors before rolling it out to 100% of users. If errors spike, you want to immediately revert. Which deployment strategy is this?
View Question & Answer ➔
You are using Azure Resource Manager (ARM) templates to deploy infrastructure. Your pipeline fails occasionally because developers introduce changes that inadvertently delete existing resources. You need to preview exactly what an ARM template deployment will create, modify, or delete before actually applying it. Which feature should you use?
View Question & Answer ➔
Your organization is migrating its source code to GitHub Enterprise but will continue using Azure Boards for work item tracking. You need to ensure that when a developer creates a pull request in GitHub, it automatically links to the corresponding user story in Azure Boards. What should you configure?
View Question & Answer ➔
Your application is instrumented with Azure Application Insights. You want to be proactively notified if the application experiences a sudden, anomalous spike in HTTP 500 errors or performance degradation, without having to configure explicit static threshold alerts for every metric. Which feature provides this?
View Question & Answer ➔
You are building a Docker image in Azure Pipelines. You want to ensure the image is automatically pushed to Azure Container Registry (ACR), and you want ACR to automatically build and patch the image whenever the base OS image (e.g., Ubuntu) is updated in the public Docker Hub registry. Which feature achieves this?
View Question & Answer ➔
Your code is hosted in GitHub. A developer accidentally commits an Azure Storage Account access key directly into the repository. You need a system that immediately detects this exposed key and alerts the security team. Which feature should you enable?
View Question & Answer ➔
You are using Azure Pipelines environments to deploy to production. Before the deployment proceeds to the production environment, you need an external IT Service Management (ITSM) tool (like ServiceNow) to approve the change request ticket automatically. How do you implement this in Azure Pipelines?
View Question & Answer ➔
Your CI/CD pipeline runs a suite of automated unit tests using NUnit. You want to visualize the test results (pass/fail rates, duration) directly in the Azure DevOps pipeline summary dashboard. Which task must you include in your YAML pipeline after the test execution?
View Question & Answer ➔
Your team uses Terraform to deploy Azure infrastructure via Azure Pipelines. Multiple developers might trigger the pipeline simultaneously, which could lead to race conditions and corrupt the Terraform `.tfstate` file. What is the recommended way to prevent this?
View Question & Answer ➔
You are connecting Azure Pipelines to your Azure subscription to deploy resources. To improve security and eliminate the need to manage and rotate client secrets for service principals, which authentication method should you use for your Azure Resource Manager service connection?
View Question & Answer ➔
You are implementing DevSecOps practices. You need to scan your open-source dependencies (npm, NuGet) for known security vulnerabilities and licensing compliance issues during the CI build process. Which third-party tool natively integrates with Azure DevOps to provide this capability?
View Question & Answer ➔
You have a microservices application. You want to release a new feature in production but keep it hidden from users until marketing announces it. If the feature causes performance issues, you want to disable it instantly without redeploying the code. Which Azure service should you use?
View Question & Answer ➔
Your team uses Azure Boards. You are working on a massive project that spans multiple teams over several months. You need to visually track dependencies between epics and features, and forecast delivery timelines across multiple sprints. Which Azure Boards feature should you use?
View Question & Answer ➔
Your team is adopting a continuous integration model where developers commit to the main branch multiple times a day. Long-lived feature branches are banned. Features that are incomplete are hidden behind toggles. Which branching strategy are you implementing?
View Question & Answer ➔
Your organization has 50 different microservices, each with its own Azure Pipeline YAML file. All pipelines share the exact same 15-step security scanning and build process. You need to centralize this logic so that updating a security step applies to all microservices instantly without editing 50 files. What should you use?
View Question & Answer ➔
You are migrating from Azure Repos to GitHub. Your application relies heavily on third-party libraries. You want a tool that automatically creates Pull Requests to update these dependencies whenever a security patch or new version is released. Which GitHub feature should you use?
View Question & Answer ➔
You are writing a Bicep file to deploy an Azure SQL Database. You need to ensure that the administrator password provided during deployment is not exposed in deployment logs or output files. Which Bicep decorator should you use on the parameter?
View Question & Answer ➔
Your web application is globally distributed. You need to continuously test the application's responsiveness from multiple geographic locations. If the application takes more than 5 seconds to respond from any location, you want an alert generated. Which Azure Monitor feature provides this capability?
View Question & Answer ➔
You are using Azure DevOps Classic Release Pipelines. You want to deploy to the Production stage only after ensuring that there are no active High-severity bugs logged against the current release in Azure Boards. Which feature automates this check?
View Question & Answer ➔
You are modernizing an application to run in Azure Kubernetes Service (AKS). Developers use Windows 10 laptops. They want to write code, test it in a local container, and debug it as if it were running natively on their machines, without having to build and push the container image to ACR for every code change. Which tool should they use?
View Question & Answer ➔
You are using Azure Pipelines and want to run Static Application Security Testing (SAST) on your code. You configure the SonarQube tasks in your pipeline. In which exact order must the SonarQube tasks be placed for a .NET application?
View Question & Answer ➔
A user in your Azure AD tenant is reporting they can sign in successfully but cannot access a specific Azure resource even though they are a member of a group that has the Contributor role on that resource. What should you investigate first?
View Question & Answer ➔
Your organization requires that all Azure AD global administrator accounts use phishing-resistant MFA only. You must enforce this without creating per-user MFA settings and in a way that applies to all current and future global admins. What is the recommended approach?
View Question & Answer ➔
You need to allow an external vendor to access a specific Azure storage account for 30 days. The vendor uses a different Azure AD tenant. You want to avoid creating guest accounts and leverage their existing corporate identity. Which solution should you use?
View Question & Answer ➔
Azure AD Identity Protection has flagged a user account as 'High' risk due to detected leaked credentials. The user has been blocked from signing in. You investigate and confirm this was a false positive. What is the correct remediation action?
View Question & Answer ➔
You have a web application running on Azure VMs behind an Azure Application Gateway. You need to protect the application from SQL injection and cross-site scripting (XSS) attacks. Which feature of Application Gateway provides this?
View Question & Answer ➔
Your organization has multiple VNets across different Azure regions. You need to ensure all traffic between VNets is inspected by a centralized Azure Firewall before being forwarded. Which Azure networking topology supports this at scale?
View Question & Answer ➔
You need to allow Azure Virtual Machines in a subnet to access Azure Storage and Azure Key Vault without traversing the public internet, and without assigning public IP addresses to the VMs. Which Azure feature achieves this?
View Question & Answer ➔
An application running as an Azure App Service needs to retrieve secrets from Azure Key Vault. You want to avoid storing any credentials in the application code or configuration. What is the most secure approach?
View Question & Answer ➔
A developer accidentally deleted a secret from Azure Key Vault that is needed by a production application. The application is now failing. What is the quickest recovery action, assuming soft-delete is enabled on the vault?
View Question & Answer ➔
Your organization's compliance policy requires that encryption keys for Azure SQL Database are managed by the organization, not Microsoft. The keys must be stored in a Hardware Security Module (HSM). What should you implement?
View Question & Answer ➔
Microsoft Defender for Cloud shows several security recommendations but you are overwhelmed by the volume. You need to focus first on the recommendations that would have the greatest impact on your Secure Score. Which approach should you take?
View Question & Answer ➔
Microsoft Defender for Cloud has detected a brute force RDP attack on one of your Azure VMs. The VM is a development machine and you cannot immediately patch it. Which Defender for Cloud feature can you enable to reduce the attack surface immediately without shutting down the VM?
View Question & Answer ➔
You need to ensure all Azure VMs in a subscription have Microsoft Defender for Endpoint automatically installed as they are provisioned, including VMs created by other teams. You manage security centrally. Which Defender for Cloud feature provides this?
View Question & Answer ➔
You are setting up Microsoft Sentinel to monitor your Azure environment. You need to automatically create an incident and notify the security team when Defender for Cloud raises a high-severity alert. What is the correct Sentinel component to configure?
View Question & Answer ➔
Microsoft Sentinel has generated a high-priority incident. Your team is investigating and needs to automatically isolate a compromised VM from the network as soon as an incident with the tag 'VM Compromise' is created. Which Sentinel feature enables this automated response?
View Question & Answer ➔
You need to ensure that Azure Blob Storage containers in a storage account can never be made publicly accessible, even by storage account owners or administrators. Which Azure feature enforces this at the organizational level?
View Question & Answer ➔
A third-party vendor needs read-only access to specific blobs in a container for exactly 48 hours. You must not give them any Azure credentials or permanent access. Which approach should you use?
View Question & Answer ➔
Your security team needs to ensure that all new Azure resources across the organization are tagged with 'CostCenter' and 'Environment' tags. Resources without these tags must be blocked from deployment. Which Azure feature enforces this?
View Question & Answer ➔
You need to investigate which Azure AD user made changes to an Azure RBAC role assignment two weeks ago. Which service provides this audit trail?
View Question & Answer ➔
Your Azure VMs run Windows Server. You need to ensure that only approved applications can run on these VMs and any unknown executables are blocked. Which Defender for Cloud feature provides this application control?
View Question & Answer ➔
A security audit reveals that Azure VMs in your environment have public IP addresses with RDP port 3389 open to the internet in their NSGs. You need to provide emergency access for administrators while eliminating the persistent exposure. What is the recommended solution?
View Question & Answer ➔
Your organization must comply with ISO 27001. You need to continuously assess your Azure environment against ISO 27001 controls and get a compliance score with evidence. Which Defender for Cloud feature provides this?
View Question & Answer ➔
You need to retain Azure Activity Logs for 2 years to meet compliance requirements. The default 90-day retention is insufficient. What is the most cost-effective Azure-native solution?
View Question & Answer ➔
You need to scan container images in Azure Container Registry (ACR) for known vulnerabilities before they are deployed to Azure Kubernetes Service (AKS). You also want to block vulnerable images from being deployed to AKS. What is the recommended approach?
View Question & Answer ➔
Your organization wants to enforce that no permanent Global Administrator assignments exist in Azure AD. All Global Admin access must be time-bound, require approval, and trigger a notification. Which Azure AD feature provides these controls?
View Question & Answer ➔
You are designing a serverless microservices architecture for a new startup. The application needs to handle unpredictable traffic spikes without managing any underlying infrastructure. Which compute service should you use?
View Question & Answer ➔
You need to host a static website (HTML, CSS, JS) with the lowest possible cost and high durability. You do not need server-side processing. Which storage solution should you choose?
View Question & Answer ➔
You need to grant developers read-only access to Azure Blob Storage buckets without giving them access to other services. What's the best approach using Azure Active Directory (Entra ID)?
View Question & Answer ➔
A financial application requires a relational database that supports high availability and automated backups. The database must be fully managed to reduce operational overhead. Which service fits these requirements?
View Question & Answer ➔
Your application generates millions of clickstream events per second. You need a service to ingest and buffer this data in real-time before processing it. Which service fits this need?
View Question & Answer ➔
You are analyzing petabytes of data for business intelligence reports. You need a fully managed, serverless enterprise data warehouse that supports SQL queries. Which service is best suited for this task?
View Question & Answer ➔
Your media company streams video content to users globally. Users in different regions are experiencing high latency. You need to improve performance by caching content closer to the users. Which service should you implement?
View Question & Answer ➔
Your public-facing web application is under a Distributed Denial of Service (DDoS) attack. You need a managed service to detect and mitigate these attacks automatically. What should you enable?
View Question & Answer ➔
Company policy requires that all database encryption keys be managed centrally and rotated annually. You need a secure, durable service to store and manage these cryptographic keys. Which service should you use?
View Question & Answer ➔
A law firm wants to digitize millions of scanned contracts. You need an AI service to extract text, forms, and tables from these PDF documents automatically. Which service is designed for this?
View Question & Answer ➔
You are building a customer support chatbot that needs to understand natural language intent (e.g., 'book a flight'). Which service provides Natural Language Understanding (NLU) capabilities?
View Question & Answer ➔
Your data science team needs a fully managed environment to build, train, and deploy custom machine learning models using TensorFlow. Which platform provides these end-to-end MLOps capabilities?
View Question & Answer ➔
You are designing a CI/CD pipeline. You need a service to compile source code, run tests, and produce software packages that are ready to deploy. Which service handles the build phase?
View Question & Answer ➔
Your team wants to automate the provisioning of infrastructure to ensure consistency across environments. You need to define your infrastructure as code (IaC) using declarative templates. Which service should you use?
View Question & Answer ➔
Your organization has multiple cloud accounts. Users in Account A need temporary access to resources in Account B. What Azure Active Directory (Entra ID) feature should you use?
View Question & Answer ➔
Your application requires high CPU performance for compute-intensive workloads like video encoding. Which Azure Virtual Machines instance type is optimized for this?
View Question & Answer ➔
Your application requires persistent block storage that survives Azure Virtual Machines instance termination. Which service should you use?
View Question & Answer ➔
You need to create a backup of your Azure Managed Disks volume for disaster recovery. What feature should you use?
View Question & Answer ➔
You need to create a logically isolated section of your cloud environment where you can launch resources in a virtual network that you define. Which service provides this?
View Question & Answer ➔
You need stateful firewall rules at the Azure Virtual Machines instance level. What should you configure?
View Question & Answer ➔
You need to explicitly deny traffic from a specific IP address to your Azure Virtual Machines instances. Can Network Security Groups (NSG) natively handle explicit deny rules?
View Question & Answer ➔
You need stateless firewall rules at the subnet level in your Azure Virtual Network. What should you configure?
View Question & Answer ➔
You need to monitor CPU utilization of your Azure Virtual Machines instances and set up alarms for automated actions. Which service should you use?
View Question & Answer ➔
Your application running on Azure Virtual Machines needs a central location for log aggregation and real-time analysis. Which Azure Monitor capability should you use?
View Question & Answer ➔
You need to route traffic to Azure Virtual Machines instances based on URL paths (e.g., '/api' vs '/static'). Which load balancer type should you use?
View Question & Answer ➔
Your high-traffic application requires ultra-low latency and needs to handle millions of requests per second at the network level. Which load balancer is best?
View Question & Answer ➔
Your High Performance Computing (HPC) workload requires low network latency between Azure Virtual Machines instances. What feature should you use?
View Question & Answer ➔
Your company uses Azure ExpressRoute to connect its on-premises data center to Azure. You need to access Azure Storage and Azure SQL Database over the ExpressRoute connection without sending traffic over the public internet. Which type of ExpressRoute peering should you configure?
View Question & Answer ➔
You have three VNets: Hub-VNet, Spoke1-VNet, and Spoke2-VNet. Both spokes are peered to the Hub. You need VMs in Spoke1 to communicate with VMs in Spoke2 routing through an Azure Firewall deployed in the Hub-VNet. What must you configure?
View Question & Answer ➔
You are designing an application delivery solution for an e-commerce website. You need SSL offloading, URL path-based routing (e.g., /images to one server pool and /video to another), and protection against SQL injection attacks. The application is hosted entirely in a single Azure region. Which service should you choose?
View Question & Answer ➔
Your organization requires a Site-to-Site (S2S) VPN connection to Azure with the highest possible availability. You must ensure that if one VPN tunnel fails, or if maintenance occurs on the Azure VPN Gateway, the connection remains active without manual intervention. How should you configure the gateway?
View Question & Answer ➔
Your Azure VMs need to securely upload data to an Azure Storage account. Security policies dictate that the Storage account must not be accessible via the public internet, and data must not traverse the Azure public backbone routing. You also need to access the storage account from on-premises over ExpressRoute. Which feature should you use?
View Question & Answer ➔
You are deploying a global web application. Users across Europe, Asia, and North America will access it. You need to ensure the lowest possible latency for users globally, provide global load balancing, and cache static content at the edge. Which Azure service is designed for this?
View Question & Answer ➔
You have an Azure Firewall deployed to protect outbound internet traffic. You want to allow your VMs to access 'github.com' and '*.microsoft.com' on port 443. Which type of rule should you create in Azure Firewall?
View Question & Answer ➔
Your enterprise has 50 branch offices globally. You want to simplify the connectivity between all branches and Azure, as well as branch-to-branch connectivity. You want Microsoft to manage the hub routing and connectivity automatically. Which Azure service should you adopt?
View Question & Answer ➔
A user reports that they cannot connect from their Azure VM to a specific on-premises IP address over an ExpressRoute connection. You need to determine exactly which hop or security rule is blocking the traffic. Which Network Watcher tool should you use?
View Question & Answer ➔
You deploy an Azure Private DNS zone named 'corp.local' and link it to your VNet. You have 'Auto-registration' enabled on the virtual network link. What does this configuration achieve?
View Question & Answer ➔
You are configuring an Azure Standard Load Balancer. You want traffic arriving on port 80 to be distributed across your backend VMs, but you also want to ensure that packets from the same client IP address always go to the same backend VM. What should you configure?
View Question & Answer ➔
Your VNet has 100 VMs that need to download updates from the internet. To prevent SNAT port exhaustion and ensure all VMs use a single, predictable public IP address for outbound traffic without exposing them to inbound internet traffic, what is the best solution?
View Question & Answer ➔
Your company has two ExpressRoute circuits: one in London and one in Tokyo, both connecting back to your global on-premises network. You want your on-premises network in London to communicate directly with your on-premises network in Tokyo by utilizing the Microsoft backbone. Which feature enables this?
View Question & Answer ➔
You use Azure Traffic Manager to direct users to two regions: East US and West Europe. You want users to be directed to the region that provides them the lowest network latency. Which Traffic Manager routing method should you use?
View Question & Answer ➔
You need to provide secure RDP access to VMs in your VNet for remote administrators. You deploy Azure Bastion. What networking requirements must be met for Azure Bastion to function correctly?
View Question & Answer ➔
A subnet has an NSG applied. You want to allow inbound SSH (port 22) from a specific on-premises IP address, but you want to block SSH from all other sources, including other VNets. By default, there is a rule allowing VNet-to-VNet traffic. What should you configure?
View Question & Answer ➔
You deploy a third-party SD-WAN Network Virtual Appliance (NVA) in your VNet. You want the NVA to dynamically exchange BGP routes with the Azure VNet so you do not have to manually manage User-Defined Routes (UDRs) every time an on-premises subnet changes. Which Azure service enables this?
View Question & Answer ➔
Your security team requires that all outbound HTTPS traffic from your VNets to the internet must be decrypted, inspected for malicious payloads, and re-encrypted before leaving Azure. Which service must you deploy to achieve this?
View Question & Answer ➔
You are configuring a Point-to-Site (P2S) VPN for remote workers. The company requires that users authenticate using their Azure Active Directory (Entra ID) credentials and enforce Conditional Access policies (like MFA). Which tunnel type must you select?
View Question & Answer ➔
VNet-A is in East US and VNet-B is in West Europe. You want to connect them using Global VNet Peering. What happens to the network traffic between the two VNets?
View Question & Answer ➔
You have an ExpressRoute circuit connected to a virtual network gateway. You notice high latency between your on-premises servers and Azure VMs because traffic is being processed by the virtual network gateway. How can you bypass the gateway and send traffic directly to the VMs?
View Question & Answer ➔
You have a single subnet with 50 VMs: 25 Web servers and 25 Database servers. You want to create NSG rules that allow traffic from the Web servers to the Database servers without specifying 25 individual IP addresses or breaking them into multiple subnets. What feature should you use?
View Question & Answer ➔
You need to log the source IP, destination IP, port, and whether traffic was allowed or denied by an NSG for compliance auditing. You also want to visualize this traffic in Power BI. Which Azure feature should you enable?
View Question & Answer ➔
You need to load balance TCP traffic across VMs across multiple availability zones in a region. You require the highest level of SLA, support for Outbound Rules, and diagnostic metrics via Azure Monitor. Which Load Balancer SKU must you select?
View Question & Answer ➔
Your Application Gateway is returning HTTP 502 (Bad Gateway) errors to clients. You suspect the backend servers are not responding correctly. Where should you look first to determine why Application Gateway considers the backend servers unhealthy?
View Question & Answer ➔
Your company has an on-premises Active Directory Domain Services (AD DS) environment. You want to sync users to Azure AD (Entra ID) using Azure AD Connect. Security policies dictate that user passwords must never be synchronized to the cloud, even in hashed form, but users must still be able to sign in to Microsoft 365 using their on-premises passwords. Which authentication method should you configure?
View Question & Answer ➔

← PreviousPage 9 of 15Next →

azure Practice Questions

You are configuring a deployment pipeline in Azure DevOps. The deployment requires a database connection string and an API key. These secrets must not be stored in plaintext in the YAML pipeline file or the repository. What is the most secure and natively integrated way to handle these secrets?

You are deploying a new version of a critical web application to Azure App Service. You want to route 10% of your production traffic to the new version to monitor for errors before rolling it out to 100% of users. If errors spike, you want to immediately revert. Which deployment strategy is this?

Your code is hosted in GitHub. A developer accidentally commits an Azure Storage Account access key directly into the repository. You need a system that immediately detects this exposed key and alerts the security team. Which feature should you enable?

Your CI/CD pipeline runs a suite of automated unit tests using NUnit. You want to visualize the test results (pass/fail rates, duration) directly in the Azure DevOps pipeline summary dashboard. Which task must you include in your YAML pipeline after the test execution?

Your team uses Terraform to deploy Azure infrastructure via Azure Pipelines. Multiple developers might trigger the pipeline simultaneously, which could lead to race conditions and corrupt the Terraform `.tfstate` file. What is the recommended way to prevent this?

You are connecting Azure Pipelines to your Azure subscription to deploy resources. To improve security and eliminate the need to manage and rotate client secrets for service principals, which authentication method should you use for your Azure Resource Manager service connection?

You are implementing DevSecOps practices. You need to scan your open-source dependencies (npm, NuGet) for known security vulnerabilities and licensing compliance issues during the CI build process. Which third-party tool natively integrates with Azure DevOps to provide this capability?

You have a microservices application. You want to release a new feature in production but keep it hidden from users until marketing announces it. If the feature causes performance issues, you want to disable it instantly without redeploying the code. Which Azure service should you use?

Your team uses Azure Boards. You are working on a massive project that spans multiple teams over several months. You need to visually track dependencies between epics and features, and forecast delivery timelines across multiple sprints. Which Azure Boards feature should you use?

Your team is adopting a continuous integration model where developers commit to the main branch multiple times a day. Long-lived feature branches are banned. Features that are incomplete are hidden behind toggles. Which branching strategy are you implementing?

You are migrating from Azure Repos to GitHub. Your application relies heavily on third-party libraries. You want a tool that automatically creates Pull Requests to update these dependencies whenever a security patch or new version is released. Which GitHub feature should you use?

You are writing a Bicep file to deploy an Azure SQL Database. You need to ensure that the administrator password provided during deployment is not exposed in deployment logs or output files. Which Bicep decorator should you use on the parameter?

You are using Azure DevOps Classic Release Pipelines. You want to deploy to the Production stage only after ensuring that there are no active High-severity bugs logged against the current release in Azure Boards. Which feature automates this check?

You are using Azure Pipelines and want to run Static Application Security Testing (SAST) on your code. You configure the SonarQube tasks in your pipeline. In which exact order must the SonarQube tasks be placed for a .NET application?

A user in your Azure AD tenant is reporting they can sign in successfully but cannot access a specific Azure resource even though they are a member of a group that has the Contributor role on that resource. What should you investigate first?

Your organization requires that all Azure AD global administrator accounts use phishing-resistant MFA only. You must enforce this without creating per-user MFA settings and in a way that applies to all current and future global admins. What is the recommended approach?

You need to allow an external vendor to access a specific Azure storage account for 30 days. The vendor uses a different Azure AD tenant. You want to avoid creating guest accounts and leverage their existing corporate identity. Which solution should you use?

Azure AD Identity Protection has flagged a user account as 'High' risk due to detected leaked credentials. The user has been blocked from signing in. You investigate and confirm this was a false positive. What is the correct remediation action?

You have a web application running on Azure VMs behind an Azure Application Gateway. You need to protect the application from SQL injection and cross-site scripting (XSS) attacks. Which feature of Application Gateway provides this?

Your organization has multiple VNets across different Azure regions. You need to ensure all traffic between VNets is inspected by a centralized Azure Firewall before being forwarded. Which Azure networking topology supports this at scale?

You need to allow Azure Virtual Machines in a subnet to access Azure Storage and Azure Key Vault without traversing the public internet, and without assigning public IP addresses to the VMs. Which Azure feature achieves this?

An application running as an Azure App Service needs to retrieve secrets from Azure Key Vault. You want to avoid storing any credentials in the application code or configuration. What is the most secure approach?

A developer accidentally deleted a secret from Azure Key Vault that is needed by a production application. The application is now failing. What is the quickest recovery action, assuming soft-delete is enabled on the vault?

Your organization's compliance policy requires that encryption keys for Azure SQL Database are managed by the organization, not Microsoft. The keys must be stored in a Hardware Security Module (HSM). What should you implement?

Microsoft Defender for Cloud shows several security recommendations but you are overwhelmed by the volume. You need to focus first on the recommendations that would have the greatest impact on your Secure Score. Which approach should you take?

Microsoft Defender for Cloud has detected a brute force RDP attack on one of your Azure VMs. The VM is a development machine and you cannot immediately patch it. Which Defender for Cloud feature can you enable to reduce the attack surface immediately without shutting down the VM?

You need to ensure all Azure VMs in a subscription have Microsoft Defender for Endpoint automatically installed as they are provisioned, including VMs created by other teams. You manage security centrally. Which Defender for Cloud feature provides this?

You are setting up Microsoft Sentinel to monitor your Azure environment. You need to automatically create an incident and notify the security team when Defender for Cloud raises a high-severity alert. What is the correct Sentinel component to configure?

Microsoft Sentinel has generated a high-priority incident. Your team is investigating and needs to automatically isolate a compromised VM from the network as soon as an incident with the tag 'VM Compromise' is created. Which Sentinel feature enables this automated response?

You need to ensure that Azure Blob Storage containers in a storage account can never be made publicly accessible, even by storage account owners or administrators. Which Azure feature enforces this at the organizational level?

A third-party vendor needs read-only access to specific blobs in a container for exactly 48 hours. You must not give them any Azure credentials or permanent access. Which approach should you use?

Your security team needs to ensure that all new Azure resources across the organization are tagged with 'CostCenter' and 'Environment' tags. Resources without these tags must be blocked from deployment. Which Azure feature enforces this?

You need to investigate which Azure AD user made changes to an Azure RBAC role assignment two weeks ago. Which service provides this audit trail?

Your Azure VMs run Windows Server. You need to ensure that only approved applications can run on these VMs and any unknown executables are blocked. Which Defender for Cloud feature provides this application control?

A security audit reveals that Azure VMs in your environment have public IP addresses with RDP port 3389 open to the internet in their NSGs. You need to provide emergency access for administrators while eliminating the persistent exposure. What is the recommended solution?

Your organization must comply with ISO 27001. You need to continuously assess your Azure environment against ISO 27001 controls and get a compliance score with evidence. Which Defender for Cloud feature provides this?

You need to retain Azure Activity Logs for 2 years to meet compliance requirements. The default 90-day retention is insufficient. What is the most cost-effective Azure-native solution?

You need to scan container images in Azure Container Registry (ACR) for known vulnerabilities before they are deployed to Azure Kubernetes Service (AKS). You also want to block vulnerable images from being deployed to AKS. What is the recommended approach?

Your organization wants to enforce that no permanent Global Administrator assignments exist in Azure AD. All Global Admin access must be time-bound, require approval, and trigger a notification. Which Azure AD feature provides these controls?

You are designing a serverless microservices architecture for a new startup. The application needs to handle unpredictable traffic spikes without managing any underlying infrastructure. Which compute service should you use?

You need to host a static website (HTML, CSS, JS) with the lowest possible cost and high durability. You do not need server-side processing. Which storage solution should you choose?

You need to grant developers read-only access to Azure Blob Storage buckets without giving them access to other services. What's the best approach using Azure Active Directory (Entra ID)?

A financial application requires a relational database that supports high availability and automated backups. The database must be fully managed to reduce operational overhead. Which service fits these requirements?

Your application generates millions of clickstream events per second. You need a service to ingest and buffer this data in real-time before processing it. Which service fits this need?

You are analyzing petabytes of data for business intelligence reports. You need a fully managed, serverless enterprise data warehouse that supports SQL queries. Which service is best suited for this task?

Your media company streams video content to users globally. Users in different regions are experiencing high latency. You need to improve performance by caching content closer to the users. Which service should you implement?

Your public-facing web application is under a Distributed Denial of Service (DDoS) attack. You need a managed service to detect and mitigate these attacks automatically. What should you enable?

Company policy requires that all database encryption keys be managed centrally and rotated annually. You need a secure, durable service to store and manage these cryptographic keys. Which service should you use?

A law firm wants to digitize millions of scanned contracts. You need an AI service to extract text, forms, and tables from these PDF documents automatically. Which service is designed for this?

You are building a customer support chatbot that needs to understand natural language intent (e.g., 'book a flight'). Which service provides Natural Language Understanding (NLU) capabilities?

Your data science team needs a fully managed environment to build, train, and deploy custom machine learning models using TensorFlow. Which platform provides these end-to-end MLOps capabilities?

You are designing a CI/CD pipeline. You need a service to compile source code, run tests, and produce software packages that are ready to deploy. Which service handles the build phase?

Your team wants to automate the provisioning of infrastructure to ensure consistency across environments. You need to define your infrastructure as code (IaC) using declarative templates. Which service should you use?

Your organization has multiple cloud accounts. Users in Account A need temporary access to resources in Account B. What Azure Active Directory (Entra ID) feature should you use?

Your application requires high CPU performance for compute-intensive workloads like video encoding. Which Azure Virtual Machines instance type is optimized for this?

Your application requires persistent block storage that survives Azure Virtual Machines instance termination. Which service should you use?

You need to create a backup of your Azure Managed Disks volume for disaster recovery. What feature should you use?

You need to create a logically isolated section of your cloud environment where you can launch resources in a virtual network that you define. Which service provides this?

You need stateful firewall rules at the Azure Virtual Machines instance level. What should you configure?

You need to explicitly deny traffic from a specific IP address to your Azure Virtual Machines instances. Can Network Security Groups (NSG) natively handle explicit deny rules?

You need stateless firewall rules at the subnet level in your Azure Virtual Network. What should you configure?

You need to monitor CPU utilization of your Azure Virtual Machines instances and set up alarms for automated actions. Which service should you use?

Your application running on Azure Virtual Machines needs a central location for log aggregation and real-time analysis. Which Azure Monitor capability should you use?

You need to route traffic to Azure Virtual Machines instances based on URL paths (e.g., '/api' vs '/static'). Which load balancer type should you use?

Your high-traffic application requires ultra-low latency and needs to handle millions of requests per second at the network level. Which load balancer is best?

Your High Performance Computing (HPC) workload requires low network latency between Azure Virtual Machines instances. What feature should you use?

Your company uses Azure ExpressRoute to connect its on-premises data center to Azure. You need to access Azure Storage and Azure SQL Database over the ExpressRoute connection without sending traffic over the public internet. Which type of ExpressRoute peering should you configure?

You have three VNets: Hub-VNet, Spoke1-VNet, and Spoke2-VNet. Both spokes are peered to the Hub. You need VMs in Spoke1 to communicate with VMs in Spoke2 routing through an Azure Firewall deployed in the Hub-VNet. What must you configure?

You are deploying a global web application. Users across Europe, Asia, and North America will access it. You need to ensure the lowest possible latency for users globally, provide global load balancing, and cache static content at the edge. Which Azure service is designed for this?

You have an Azure Firewall deployed to protect outbound internet traffic. You want to allow your VMs to access 'github.com' and '*.microsoft.com' on port 443. Which type of rule should you create in Azure Firewall?

Your enterprise has 50 branch offices globally. You want to simplify the connectivity between all branches and Azure, as well as branch-to-branch connectivity. You want Microsoft to manage the hub routing and connectivity automatically. Which Azure service should you adopt?

A user reports that they cannot connect from their Azure VM to a specific on-premises IP address over an ExpressRoute connection. You need to determine exactly which hop or security rule is blocking the traffic. Which Network Watcher tool should you use?

You deploy an Azure Private DNS zone named 'corp.local' and link it to your VNet. You have 'Auto-registration' enabled on the virtual network link. What does this configuration achieve?

You are configuring an Azure Standard Load Balancer. You want traffic arriving on port 80 to be distributed across your backend VMs, but you also want to ensure that packets from the same client IP address always go to the same backend VM. What should you configure?

Your VNet has 100 VMs that need to download updates from the internet. To prevent SNAT port exhaustion and ensure all VMs use a single, predictable public IP address for outbound traffic without exposing them to inbound internet traffic, what is the best solution?

You use Azure Traffic Manager to direct users to two regions: East US and West Europe. You want users to be directed to the region that provides them the lowest network latency. Which Traffic Manager routing method should you use?

You need to provide secure RDP access to VMs in your VNet for remote administrators. You deploy Azure Bastion. What networking requirements must be met for Azure Bastion to function correctly?

A subnet has an NSG applied. You want to allow inbound SSH (port 22) from a specific on-premises IP address, but you want to block SSH from all other sources, including other VNets. By default, there is a rule allowing VNet-to-VNet traffic. What should you configure?

You deploy a third-party SD-WAN Network Virtual Appliance (NVA) in your VNet. You want the NVA to dynamically exchange BGP routes with the Azure VNet so you do not have to manually manage User-Defined Routes (UDRs) every time an on-premises subnet changes. Which Azure service enables this?