Free Microsoft Certified: Azure Fundamentals (AZ-900) Sample Questions

Correct answer: B — Public Cloud and Operational Expenditure (OpEx)

• A. Incorrect. A private cloud involves dedicated infrastructure for a single organization, which typically requires a significant upfront Capital Expenditure (CapEx) to purchase hardware. This is the opposite of the startup's requirement to avoid upfront costs.
• B. Correct. A public cloud provides on-demand, shared infrastructure managed by a cloud provider. This allows a company to launch immediately without buying hardware. This aligns perfectly with the Operational Expenditure (OpEx) model, where you pay only for the resources you consume (pay-as-you-go), which matches the startup's requirements.
• C. Incorrect. A hybrid cloud combines public and private clouds. The private cloud component would still require an upfront Capital Expenditure (CapEx) for hardware, which contradicts the startup's goal of avoiding initial spending.
• D. Incorrect. While the Operational Expenditure (OpEx) model is desired, a private cloud is the wrong model. A private cloud is fundamentally based on dedicated infrastructure that requires an upfront capital investment, even if ongoing management costs are operational. Therefore, it does not meet the requirement to avoid initial hardware costs.

Correct answer: C — Hybrid Cloud

• A. Incorrect. A public cloud model involves hosting all infrastructure and services with a third-party provider like Azure. Since a critical component, the database server, remains on-premises, this is not a pure public cloud deployment.
• B. Incorrect. A private cloud model involves computing resources used exclusively by a single business or organization, typically hosted on-premises. This scenario explicitly uses a public cloud provider (Azure) for the web front-end, so it is not a pure private cloud.
• C. Correct. A hybrid cloud is a computing environment that combines on-premises infrastructure (a private cloud) with public cloud services. This scenario is a classic example, where the company leverages the public cloud for scalability (web front-end) while keeping sensitive data on-premises to meet regulatory requirements.
• D. Incorrect. Software as a Service (SaaS) is a cloud service model for consuming fully managed applications over the internet. The question describes an infrastructure deployment model (where components are hosted), not a service consumption model.

Correct answer: C — The responsibility for identity and access management is shared between the customer and provider.

• A. Incorrect. In a public cloud model, the cloud provider (Microsoft) is always responsible for the physical security of its datacenters. This includes securing the buildings, servers, and other hardware. The customer does not manage or have access to the physical infrastructure.
• B. Incorrect. Data classification, protection, and accountability are primarily the customer's responsibility. The customer owns the data they store in the cloud and must ensure it meets their compliance and security requirements. Microsoft provides tools and controls, but the ultimate responsibility for the data lies with the customer.
• C. Correct. Identity and access management is a key area of shared responsibility. The cloud provider (Microsoft) is responsible for securing the underlying identity platform and infrastructure (like Microsoft Entra ID). The customer is responsible for managing their identities, configuring access controls, defining roles, and enforcing strong authentication policies like MFA.
• D. Incorrect. The physical aspects of the datacenter, including power, cooling, and networking, are the sole responsibility of the cloud provider. This is a fundamental aspect of the Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) models.

Correct answers: B, C — A startup needs to deploy a web application globally with minimal startup costs.; A business needs to handle unpredictable spikes in web traffic.

• A. Incorrect. Storing highly classified data with a requirement for no internet access (an air-gapped system) is a scenario that requires a private cloud or a secure on-premises data center, not a public cloud, due to extreme security and compliance needs.
• B. Correct. The public cloud is ideal for startups because it eliminates the need for large upfront capital expenditure on hardware. The pay-as-you-go model and the cloud provider's global infrastructure allow a startup to deploy applications worldwide quickly and cost-effectively.
• C. Correct. Public cloud platforms excel at providing elasticity and rapid scalability. Features like autoscaling and load balancing allow applications to automatically scale resources up to handle traffic spikes and then scale down as traffic subsides, ensuring performance and cost-efficiency.
• D. Incorrect. In a public cloud model, the cloud provider owns and manages the physical infrastructure. A requirement for complete control over the physical servers and their location is a key driver for an on-premises or private cloud deployment.

Correct answer: B — Adding a second Virtual Machine to a Scale Set to handle traffic

• A. This describes vertical scaling (also known as scaling up). Vertical scaling involves increasing the capacity of a single resource, such as adding more RAM or CPU to an existing virtual machine.
• B. This is a classic example of horizontal scaling (also known as scaling out). Horizontal scaling involves adding more instances of a resource, like adding a second virtual machine, to distribute the load and handle increased traffic. Azure Virtual Machine Scale Sets are a service designed specifically for this purpose.
• C. This describes a migration or geographic relocation of a resource. This action is typically performed for disaster recovery, compliance reasons, or to reduce latency for users in a different region, but it is not a scaling operation.
• D. This is another example of vertical scaling (scaling up). It involves increasing the resources (in this case, storage capacity) of a single existing server, rather than adding more servers to the system.

Correct answer: A — True

• A. The statement is true because manageability in the cloud refers to the ease of administering, monitoring, and maintaining resources. Azure Cloud Shell is a browser-accessible, pre-configured command-line interface with essential tools like Azure CLI and PowerShell already installed. This simplifies administrative tasks, removes the need for local setup and maintenance, and provides a consistent management experience from any device, which is a clear example of the manageability benefit.
• B. The statement is false because Azure Cloud Shell is a core feature that enhances the manageability of Azure. It simplifies resource administration by providing a ready-to-use, browser-based shell with pre-installed management tools, eliminating the need for local configuration. This directly aligns with the cloud benefit of manageability.

Correct answer: B — False

• A. The statement is false. High Availability is a design principle that aims to maximize service uptime. An SLA guaranteeing 99.99% downtime would mean the service is unavailable for almost the entire duration, which is the direct opposite of a highly available system.
• B. The statement is true. High Availability is a key cloud benefit, and its goal is to minimize downtime. A Service Level Agreement (SLA) for a highly available system would specify a high percentage of *uptime* (e.g., 99.99%). The question incorrectly refers to 99.99% *downtime*, which represents extremely poor availability, thus making the original statement false.

Correct answer: C — Subscribe to Microsoft Dynamics 365 (SaaS)

• A. Incorrect. This represents an Infrastructure as a Service (IaaS) model. With IaaS, you are responsible for managing the virtual machine's operating system, patching, backups, and the installation and updates of the CRM software. This contradicts the requirement for zero infrastructure management and automatic updates.
• B. Incorrect. This represents a Platform as a Service (PaaS) model. While Azure App Service manages the underlying infrastructure, your team would still be responsible for developing, deploying, and maintaining the custom CRM application code, including any updates. This does not meet the requirement for a fully managed solution with automatic software updates.
• C. Correct. Microsoft Dynamics 365 is a Software as a Service (SaaS) solution. In the SaaS model, the cloud provider (Microsoft) manages the entire stack, including the infrastructure, platform, and the application software. This means updates are handled automatically by the provider, and there is no infrastructure for your IT team to manage, perfectly aligning with the requirements.
• D. Incorrect. Deploying a container is a form of PaaS (or Containers as a Service). Although it simplifies deployment, you are still responsible for managing the container image, updating the application within the container, and configuring the service. This does not provide the zero-management, automatically updated solution required.

Correct answer: B — False

• A. The statement is false. In any public cloud service model (IaaS, PaaS, or SaaS), the cloud provider is always responsible for the physical security of their datacenters. This includes physical access controls, surveillance, and environmental protections for the servers and networking hardware.
• B. The statement is true. The core premise of the Platform as a Service (PaaS) model is that the cloud provider manages the underlying platform and infrastructure. This management scope explicitly includes the physical security of the datacenters. The customer's responsibility begins with their applications and data.

Correct answer: A — True

• A. The statement is true because Software as a Service (SaaS) is a software delivery model where applications are centrally hosted and licensed to customers. The most common pricing models for SaaS are subscription-based (e.g., a monthly or annual fee per user) and pay-as-you-go (based on usage). This approach replaces the traditional one-time perpetual license fee with predictable, recurring operational expenses. Popular examples include Microsoft 365 and Salesforce.
• B. The statement is false because the primary financial model for SaaS is based on recurring payments, not a one-time purchase. The subscription or pay-as-you-go model is a defining characteristic of SaaS, contrasting it with traditional on-premises software which typically involves a large, upfront perpetual license cost.

Correct answer: B — Azure Container Instances (ACI)

• A. Incorrect. Azure Kubernetes Service (AKS) is a managed container orchestration service based on Kubernetes. It simplifies deploying and managing containerized applications but still requires the management of a cluster and an orchestrator, which explicitly goes against the requirements. AKS is better suited for production-grade, scalable, and long-running workloads.
• B. Correct. Azure Container Instances (ACI) is the ideal service for this scenario. It is a serverless container solution that allows you to run containers directly without managing any underlying infrastructure like virtual machines, clusters, or orchestrators. This makes it perfect for quickly deploying single containers or simple applications for short-term tasks like testing.
• C. Incorrect. Azure Virtual Desktop is a desktop and application virtualization service. Its purpose is to deliver virtualized Windows desktops and applications to users and is not designed for hosting or running containerized applications.
• D. Incorrect. Azure Service Fabric is a distributed systems platform for building and managing microservices and containers. Similar to AKS, it requires the management of a cluster and is a more complex solution designed for stateful services and large-scale applications, not for quick, simple, short-term tests.

Correct answer: B — A Private Endpoint

• A. Incorrect. A Public Endpoint exposes the Azure SQL Database service over the public internet. This configuration does not meet the requirement to keep traffic private and within the Microsoft backbone network.
• B. Correct. A Private Endpoint, powered by Azure Private Link, creates a network interface within your Virtual Network (VNet) that is assigned a private IP address. This interface connects privately and securely to the Azure SQL Database, ensuring all traffic between your VM and the database remains on the Microsoft backbone network.
• C. Incorrect. A VPN Gateway is used to establish encrypted, cross-premises connections between your on-premises network and an Azure VNet. It does not provide a mechanism for a service within a VNet to privately connect to an Azure PaaS service like Azure SQL Database.
• D. Incorrect. An Azure DNS record is used for name resolution (translating a domain name to an IP address). While a private DNS zone is often used in conjunction with a Private Endpoint to resolve the service's name to its private IP, the DNS record itself does not create the private connection or secure the traffic.

Correct answer: B — False

• A. The statement is false. Traffic between peered virtual networks in the same region is routed exclusively over the Microsoft private backbone network. This provides a secure, low-latency, and high-performance connection that does not expose traffic to the public internet.
• B. The statement is false. Virtual network peering is specifically designed to route traffic between virtual networks using Microsoft's private global network. This ensures that the traffic remains private, secure, and benefits from low latency and high bandwidth, avoiding the public internet entirely.

Correct answer: C — Owner

• A. The Contributor role grants full permission to manage all resources within a scope, such as creating, modifying, and deleting them. However, it explicitly does not grant permission to manage access, meaning a Contributor cannot assign roles to other users. This makes it insufficient for the requirement.
• B. The Reader role provides read-only access to Azure resources. A user with this role can view resources but cannot make any changes, manage the resources, or assign permissions to others.
• C. The Owner role provides full access to all resources within the specified scope. This includes the permissions of a Contributor (to manage resources) plus the ability to manage access by assigning roles to other users. This role meets all the specified requirements.
• D. The User Access Administrator role is specifically designed to manage user access to Azure resources. While a user with this role can assign permissions to others, it does not grant them permissions to manage the resources themselves (e.g., create or delete a virtual machine). This role only fulfills part of the requirement.

Correct answer: B — Microsoft Entra Domain Services

• A. Incorrect. Microsoft Entra ID is Azure's cloud-based identity and access management service, but it focuses on modern authentication protocols like SAML, OAuth 2.0, and OpenID Connect. It does not natively support legacy protocols such as LDAP and Kerberos, which are required by the applications in this scenario.
• B. Correct. Microsoft Entra Domain Services is a managed service designed specifically for this use case. It provides managed domain services, including domain join, Group Policy, LDAP, and Kerberos/NTLM authentication. This allows organizations to migrate legacy applications that depend on these traditional protocols to Azure without deploying and managing their own domain controller virtual machines.
• C. Incorrect. Azure Bastion is a security service that provides secure and seamless RDP and SSH access to virtual machines directly through the Azure portal. Its purpose is to secure administrative connections, not to provide application authentication services like LDAP or Kerberos.
• D. Incorrect. Azure SQL Database is a fully managed Platform as a Service (PaaS) for relational databases. It is a data storage service and is unrelated to providing domain authentication protocols like LDAP or Kerberos.

Correct answer: B — Microsoft Defender for Cloud

• A. Incorrect. Azure Monitor is a service for collecting, analyzing, and acting on telemetry data such as metrics and logs. It focuses on performance monitoring and operational observability, not providing a 'Secure Score' or a dedicated security posture dashboard.
• B. Correct. Microsoft Defender for Cloud (formerly Azure Security Center) is specifically designed for security posture management. It provides a centralized dashboard that includes a 'Secure Score', which assesses your resources and offers actionable, prioritized recommendations to harden your security posture.
• C. Incorrect. Azure Sentinel (now Microsoft Sentinel) is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. Its purpose is to detect, investigate, and respond to threats, not to provide a 'Secure Score' or posture-hardening recommendations.
• D. Incorrect. Network Security Groups (NSGs) are a network-level control used to filter inbound and outbound traffic for subnets and network interfaces. They are a specific security configuration, not a centralized dashboard or assessment tool that calculates a 'Secure Score'.

Correct answer: C — Place them in the same Resource Group

• A. Incorrect. Availability Zones are physically separate locations within an Azure region designed to protect applications and data from datacenter failures, providing high availability. They are a component of infrastructure resilience, not a logical container for managing the lifecycle of a group of resources.
• B. Incorrect. Region Pairs consist of two Azure regions within the same geography used primarily for disaster recovery purposes. They enable features like geo-redundant storage replication but do not function as a grouping mechanism for simultaneously deleting resources.
• C. Correct. A Resource Group is the fundamental logical container in Azure for grouping related resources for a solution. It serves as a unit for management, billing, and lifecycle. Deleting a resource group is a single action that deletes all the resources contained within it, making it the perfect solution for this scenario.
• D. Incorrect. Management Groups are a governance tool that provides a scope above subscriptions. They are used to organize subscriptions and apply governance controls like policies and access management at scale, but they do not directly contain or manage individual resources for deletion.

Correct answer: B — regional low-latency network

• A. Incorrect. Datacenters within an Azure Region are connected via a private, dedicated network, not the public internet. Using the public internet would not provide the necessary security, high throughput, and guaranteed low latency required for intra-region communication.
• B. Correct. This is the definition of an Azure Region. It consists of multiple datacenters interconnected by a dedicated, private, high-speed network with very low latency. This ensures reliable and predictable performance for services operating within that region.
• C. Incorrect. A VPN Gateway is a specific Azure networking service used to create secure, encrypted connections between an Azure Virtual Network and an on-premises network (site-to-site) or between different virtual networks (VNet-to-VNet). It is a service, not the fundamental physical infrastructure connecting datacenters.
• D. Incorrect. An Availability Set is a logical grouping construct for virtual machines that protects against localized hardware failures and planned maintenance within a datacenter. It is a high-availability feature for compute resources, not a network that connects entire datacenters.

Correct answers: A, C — Platform updates are rolled out sequentially to the pair to minimize downtime.; They provide automatic replication for certain services like Geo-Redundant Storage (GRS).

• A. This is a key benefit. To minimize the risk of a widespread outage due to a faulty update, Azure rolls out planned platform updates sequentially to paired regions. This staggered approach ensures that one region in the pair remains available while the other is being updated.
• B. This is incorrect. Azure Region Pairs are intentionally located in separate physical datacenters, often hundreds of miles apart within the same geography. This physical separation is crucial for disaster recovery, protecting against events like natural disasters that could affect an entire building or local area.
• C. This is a primary benefit of region pairs. Certain Azure services, most notably Geo-Redundant Storage (GRS), leverage the region pair to automatically replicate data to the secondary region. This provides data durability and enables failover in the event of a regional outage.
• D. This is incorrect. The purpose of a region pair is to provide physical isolation and redundancy. Therefore, resources in paired regions are hosted on completely separate physical hardware and infrastructure to prevent a single point of failure.
• E. This is incorrect. Resource Groups are a logical construct for organizing, managing, and billing Azure resources. They are entirely independent of the physical architecture concepts like regions and region pairs. Using region pairs does not affect the need for Resource Groups.

Correct answer: C — Geo-redundant storage (GRS)

• A. Incorrect. Locally-redundant storage (LRS) replicates your data three times within a single physical data center in the primary region. It protects against server rack or drive failures but does not protect against a datacenter-level or regional outage.
• B. Incorrect. Zone-redundant storage (ZRS) replicates your data synchronously across three Azure availability zones within the primary region. This protects against failures of an entire data center or availability zone, but not a complete regional outage.
• C. Correct. Geo-redundant storage (GRS) is designed specifically for this scenario. It copies your data synchronously three times within a single physical location in the primary region (using LRS) and then asynchronously replicates your data to a secondary region that is hundreds of miles away, thus providing protection against a complete regional outage.
• D. Incorrect. Premium_LRS refers to a performance tier (using solid-state drives for low latency) that uses locally-redundant storage (LRS). As it is a form of LRS, it only replicates data within a single data center and does not offer protection against regional outages.

Correct answer: A — Azure Data Box

• A. Correct. Azure Data Box is a physical appliance designed for large-scale, offline data transfers. Microsoft ships the device to your datacenter, you copy the data to it locally, and then ship it back. This method is ideal for scenarios involving terabytes of data and limited or no network bandwidth, making it the perfect solution for this 50 TB migration.
• B. Incorrect. AzCopy is a command-line utility for transferring data to and from Azure Storage over the network. While efficient, it relies entirely on available internet bandwidth and is not suitable for migrating 50 TB of data when connectivity is very limited.
• C. Incorrect. Azure Storage Explorer is a graphical user interface (GUI) tool for managing Azure storage resources. It is designed for smaller-scale data transfers and management tasks, not for a bulk migration of 50 TB, especially in a low-bandwidth environment.
• D. Incorrect. Azure File Sync is a service for synchronizing and caching files between on-premises Windows Servers and Azure Files. It is not designed for a one-time, large-scale initial data migration and requires ongoing network connectivity to function, making it unsuitable for this scenario.

Correct answer: A — True

• A. The statement is true. Azure Storage Explorer is a client application designed to manage Azure Storage resources across multiple subscriptions. You can sign in to multiple accounts and subscriptions simultaneously. As long as you have the appropriate permissions for both the source storage account in one subscription and the destination storage account in another, you can use the tool to copy, paste, or drag-and-drop files between them.
• B. The statement is false. Azure Storage Explorer fully supports managing resources, including transferring data, across different subscriptions. An inability to move files between subscriptions would typically be due to insufficient permissions on either the source or destination storage account, not a limitation of the tool itself.

Correct answers: A, B, C — Azure Portal; Azure Command-Line Interface (CLI); Azure PowerShell

• A. Correct. The Azure Portal provides a graphical user interface (GUI) for deploying ARM templates. You can use the 'Deploy a custom template' service to upload, paste, or edit the template, provide parameters, and then deploy the resources directly.
• B. Correct. The Azure Command-Line Interface (CLI) is a cross-platform command-line tool used to manage Azure resources. You can deploy ARM templates using commands like `az deployment group create`, making it ideal for scripting, automation, and integration into CI/CD pipelines.
• C. Correct. Azure PowerShell is a set of modules with cmdlets for managing Azure resources from the command line. You can deploy ARM templates using cmdlets such as `New-AzResourceGroupDeployment`. It is widely used for automation, especially in Windows-based environments.
• D. Incorrect. Microsoft Word is a word processing application. While you could write or view the JSON code of an ARM template in it, Word has no capability to connect to Azure or execute a deployment.
• E. Incorrect. The Windows Control Panel is a component of the Microsoft Windows operating system used for managing local computer settings. It cannot interact with cloud services like Azure and cannot be used to deploy ARM templates.

Correct answers: B, C — Version control of infrastructure files; Automated deployment pipelines

• A. Incorrect. Infrastructure as Code (IaC) is the practice of automating infrastructure management through code. Manual configuration of hardware is the exact opposite of this principle, as it is a manual, error-prone process that IaC aims to replace.
• B. Correct. A core principle of IaC is treating infrastructure configuration files as source code. This means storing them in a version control system (like Git) to track changes, enable collaboration among team members, review modifications, and roll back to previous versions if needed.
• C. Correct. IaC is commonly integrated with automated deployment pipelines (CI/CD) to provision and update infrastructure. These pipelines automatically apply the code definitions, ensuring that deployments are consistent, repeatable, and less prone to human error.
• D. Incorrect. Physical installation of servers is a manual hardware task that precedes the scope of IaC. IaC focuses on the programmatic definition and management of resources, typically in a virtualized or cloud environment, not the physical setup of hardware.
• E. Incorrect. IaC emphasizes managing infrastructure through code and scripting, not relying solely on a Graphical User Interface (GUI). While some tools offer GUIs, the primary practice of IaC is code-centric to ensure automation, repeatability, and versioning, which cannot be achieved through GUI-only management.

Correct answer: B — False

• A. The statement is false because the modern Azure PowerShell (Az module) is designed to be cross-platform. It is built on PowerShell 7 (formerly PowerShell Core), which allows it to be installed and run on multiple operating systems, including Windows, macOS, and various Linux distributions.
• B. The statement is false because Azure PowerShell is not restricted to the Windows operating system. It is a cross-platform tool that can be installed and used on Windows, macOS, and Linux, providing a consistent command-line experience for managing Azure resources across different environments.

Correct answers: A, B — Trigger an Azure Function; Send an Email/SMS

• A. Correct. Triggering an Azure Function is a valid action type. Action Groups can invoke Azure Functions, allowing you to run custom, serverless code to automate tasks and perform complex remediation in response to an alert.
• B. Correct. Sending notifications via Email, SMS, push notifications, and voice calls is a fundamental and common action type in an Action Group. This enables you to quickly notify relevant personnel and stakeholders when a critical alert is triggered.
• C. Incorrect. Rebooting a physical server is not a direct, built-in action type within an Action Group. While you could potentially orchestrate this action indirectly by triggering an Automation Runbook or a Logic App that interacts with a hybrid worker, it is not a native option.
• D. Incorrect. For safety reasons, deleting a resource group is not a native action type in an Action Group. Such a destructive operation would need to be implemented within a custom script, for example, in an Azure Function or an Automation Runbook, which is then triggered by the Action Group.
• E. Incorrect. Purchasing a Reserved Instance is a billing and commerce operation. Action Groups are designed for operational responses like notifications and automation, not for financial transactions or resource procurement.

Correct answer: B — Availability Tests

• A. Incorrect. Live Metrics Stream provides a near-real-time view of telemetry data, such as requests, exceptions, and performance counters, for live debugging and diagnostics. It does not perform synthetic requests from multiple locations to test availability.
• B. Correct. Availability Tests are specifically designed for synthetic monitoring. This feature sends periodic HTTP requests (URL ping tests or multi-step web tests) from various Azure locations around the world to your application to check its responsiveness and availability, helping you meet high-availability requirements.
• C. Incorrect. Smart Detection automatically analyzes your application's telemetry to identify performance anomalies and failure patterns. It proactively warns you of potential issues but does not involve sending synthetic requests to test availability.
• D. Incorrect. The Snapshot Debugger is a debugging tool that captures a snapshot of your application's state, including source code and variables, when an exception occurs in a production environment. Its purpose is to diagnose issues, not to test availability.

Correct answer: A — Azure Dashboards

• A. Azure Dashboards are the correct tool for this requirement. They provide a highly customizable 'single pane of glass' where you can pin and arrange various data visualizations, such as metrics charts and log query results, from multiple Azure resources and even different subscriptions. These dashboards are designed to be shared with teams using Azure's role-based access control (RBAC).
• B. Azure Advisor is a recommendation engine that provides personalized best-practice guidance to optimize your Azure resources across categories like cost, performance, security, and reliability. It does not provide a customizable dashboard for visualizing operational data.
• C. The Activity Log records subscription-level events, specifically control-plane operations like creating a VM or modifying a network security group. While it is a critical source for auditing and troubleshooting, it is not a tool for creating a consolidated, shareable visualization of data from multiple resources.
• D. Azure Service Health provides information on the health of Azure services themselves, including platform-wide incidents, planned maintenance, and health advisories that might affect your resources. It is not used for visualizing performance metrics or logs from your own applications and resources.

Correct answer: C — Security

• A. Incorrect. The Operational Excellence category provides recommendations related to process and workflow efficiency, resource manageability, and deployment best practices, not direct security threats like malware.
• B. Incorrect. The Performance category focuses on improving the speed, responsiveness, and scalability of your Azure resources. A recommendation about malware protection does not relate to performance optimization.
• C. Correct. The Security category provides recommendations to help you prevent, detect, and respond to threats. Recommendations about protecting virtual machines from malware, addressing security vulnerabilities, and enabling endpoint protection fall directly under this category. These recommendations are often integrated from Microsoft Defender for Cloud.
• D. Incorrect. The Cost category provides recommendations to optimize and reduce your overall Azure spending, such as identifying idle resources or purchasing reserved instances. Malware protection is a security measure, not a cost-saving one.

Correct answer: B — A CanNotDelete resource lock

• A. Incorrect. Azure Policy is used to enforce organizational rules and compliance at scale. While a policy could potentially be created to deny delete actions, it is not the primary or most direct tool for this purpose. Resource locks are specifically designed to protect individual resources from accidental deletion.
• B. Correct. A CanNotDelete resource lock is the ideal solution for this scenario. It specifically prevents the resource from being deleted, even by users with administrative permissions. The resource can still be read and modified. To delete the resource, an authorized user must first take the explicit step of removing the lock, which effectively prevents accidental deletion.
• C. Incorrect. A ReadOnly resource lock prevents both modifications and deletions. While it would satisfy the requirement to prevent deletion, it is too restrictive for a production database that likely requires ongoing maintenance and updates. The CanNotDelete lock is more appropriate as it allows modifications.
• D. Incorrect. Role-Based Access Control (RBAC) manages user permissions, defining who can perform which actions. However, it does not prevent a user who has the delete permission (like an administrator) from accidentally using it. Resource locks apply on top of RBAC permissions to provide an additional layer of protection against accidental actions.

Correct answer: C — Azure Policy

• A. Incorrect. Azure Monitor is a service for collecting, analyzing, and acting on telemetry data from Azure and on-premises environments. While it can be used to alert on non-compliant resources, it cannot proactively prevent their creation in unapproved regions.
• B. Incorrect. Network Security Groups (NSGs) are used to filter network traffic to and from Azure resources within an Azure Virtual Network. They function at the network layer and do not have the capability to enforce rules about resource deployment locations.
• C. Correct. Azure Policy is the service designed to enforce organizational standards and assess compliance at-scale. You can use a built-in policy definition called 'Allowed locations' to specify that resources can only be deployed in the 'East US' region, thereby enforcing data sovereignty rules and preventing deployments elsewhere.
• D. Incorrect. Microsoft Purview is a unified data governance service that helps you manage and govern your on-premises, multi-cloud, and SaaS data assets. Its focus is on data cataloging, mapping, and lineage, not on enforcing infrastructure deployment constraints like resource location.

Correct answer: B — False

• A. The statement is false. Azure Policy provides continuous governance by not only checking resources at creation or update but also by performing regular compliance assessments on all existing resources within its scope.
• B. The statement is false. Azure Policy is designed for comprehensive compliance management. It evaluates resources when they are created or updated, and crucially, it also runs periodic compliance scans (typically every 24 hours) against all existing resources. Furthermore, policies can be applied retroactively, and remediation tasks can be triggered to fix non-compliant existing resources.

Correct answer: B — The costs may vary because Azure resource pricing differs by region.

• A. Incorrect. Azure pricing is not global. Prices for the same service can vary significantly between different Azure regions due to local factors.
• B. Correct. Azure resource pricing varies by region. Factors influencing these differences include local infrastructure costs (e.g., electricity, land), taxes, local market conditions, and regional demand. Therefore, deploying the same VM SKU in East US and West Europe will likely result in different costs. It is always best practice to use the Azure Pricing Calculator to estimate costs for specific regions.
• C. Incorrect. Deploying resources for redundancy across multiple regions increases the overall cost, as you are running and paying for resources in each location. Redundancy does not make any resource free.
• D. Incorrect. The cost of an Azure resource is primarily determined by the Azure region where it is deployed, not the physical location of the user managing it. While the user's billing address can affect final taxes, the base resource cost is tied to its deployment region.

Correct answers: A, B — Send an email alert to a list of recipients; Trigger an action group (e.g., Logic App or Automation Runbook)

• A. Correct. A primary function of Azure Budgets is to send email notifications to a configured list of recipients when a specified cost threshold is met. This allows stakeholders to be proactively informed about spending.
• B. Correct. Azure Budgets can be configured to trigger an action group when a threshold is reached. Action groups can then execute automated responses, such as starting a Logic App, running an Automation Runbook, or calling an Azure Function, to manage costs.
• C. Incorrect. Azure Budgets are a monitoring and alerting tool and do not have the native capability to delete resources. While an action group triggered by a budget could be configured to delete resources, the budget itself does not perform this action.
• D. Incorrect. Azure Budgets cannot change subscription types or tiers. Subscription management must be performed manually or through other automation tools, not directly through the budget service.
• E. Incorrect. Billing cycles are determined by the subscription's billing account settings and cannot be altered or reset by Azure Budgets. Budgets monitor costs within these predefined cycles.

Correct answer: B — False

• A. The statement is false because when a virtual machine is in the 'Stopped (deallocated)' state, Azure releases the compute resources such as vCPU and RAM. Consequently, you are no longer billed for these compute costs.
• B. The statement is false because stopping and deallocating an Azure Virtual Machine releases its assigned compute resources (vCPU, memory, etc.) back to the Azure infrastructure. This action stops the billing for compute costs. It's important to note, however, that you will continue to be charged for the storage costs associated with the VM's managed disks (both OS and data disks) as they are preserved.