Azure Fundamentals (AZ-900) Practice Questions¶
40 practice questions covering all exam domains.
Exam Domain Breakdown: - Describe cloud concepts (25-30%) - 11 questions - Describe Azure architecture and services (35-40%) - 15 questions - Describe Azure management and governance (30-35%) - 14 questions
Cert page: exams/azure/az-900/
Describe Cloud Concepts (25-30%)¶
Question 1¶
Scenario: A company wants to avoid large upfront investments in hardware and instead pay only for the computing resources they use. Which cloud benefit describes this?
A. Geo-distribution, which places resources in datacenters near users around the world B. Scalability, the ability to add resources as the load grows C. Consumption-based pricing D. High availability, which keeps services running through failures
Answer
**Correct: C** **Why:** Consumption-based pricing (pay-as-you-go) means you only pay for the resources you use, eliminating large capital expenditures. High availability is about uptime. Scalability is about adjusting resources. Geo-distribution is about global presence. **Key Concept:** [Cloud Economics](https://azure.microsoft.com/en-us/overview/what-is-cloud-computing/)Question 2¶
Scenario: A retail company's website experiences 5x normal traffic during holiday sales but returns to normal afterward. What cloud characteristic allows them to handle this efficiently?
A. Elasticity, scaling up and down with demand B. Disaster recovery, recovering the service after a major outage C. High availability D. Agility
Answer
**Correct: A** **Why:** Elasticity is the ability to automatically scale resources up or down based on demand. This allows handling traffic spikes without over-provisioning. Agility is about quick deployment. High availability is about uptime. Disaster recovery is about recovering from failures. **Key Concept:** [Elasticity in Cloud](https://docs.microsoft.com/en-us/azure/architecture/framework/scalability/design-scale)Question 3¶
Scenario: A company wants to use a service where they manage applications and data, but the cloud provider manages everything else including runtime, middleware, and operating system. Which cloud service model is this?
A. Function as a Service (FaaS) B. Infrastructure as a Service (IaaS) C. Software as a Service (SaaS) D. Platform as a Service (PaaS), where the provider runs the runtime and OS
Answer
**Correct: D** **Why:** PaaS provides a platform where users manage applications and data while the provider manages the infrastructure, OS, middleware, and runtime. IaaS requires managing the OS up. SaaS manages everything. FaaS is a subset of PaaS for functions. **Key Concept:** [Cloud Service Models](https://azure.microsoft.com/en-us/overview/types-of-cloud-computing/)Question 4¶
Scenario: A financial services company must comply with strict data residency requirements and wants to keep some data on their own servers while using cloud services for other workloads. Which cloud model should they use?
A. Public cloud B. Community cloud, shared by organizations with common concerns C. Hybrid cloud, combining on-premises and public D. Private cloud
Answer
**Correct: C** **Why:** Hybrid cloud combines on-premises infrastructure (or private cloud) with public cloud, allowing data to stay on-premises while other workloads run in the cloud. Public cloud is fully hosted by the provider. Private cloud is entirely on-premises. Community cloud is shared by organizations with common concerns. **Key Concept:** [Hybrid Cloud](https://azure.microsoft.com/en-us/solutions/hybrid-cloud-app/)Question 5¶
Scenario: A company is comparing the total cost of running their IT infrastructure on-premises versus in the cloud. What is this type of analysis called?
A. Total Cost of Ownership (TCO) B. Cost allocation, which distributes shared costs among departments or projects C. Break-even analysis, which finds when an investment has earned back its cost D. Return on Investment (ROI), which measures the gain from an investment against its cost
Answer
**Correct: A** **Why:** Total Cost of Ownership (TCO) compares all costs of on-premises infrastructure (hardware, software, labor, facilities) against cloud costs. Azure provides a TCO Calculator for this purpose. Cost allocation is about distributing costs. ROI measures returns. Break-even analysis determines when investment pays off. **Key Concept:** [Azure TCO Calculator](https://azure.microsoft.com/en-us/pricing/tco/calculator/)Question 6¶
Scenario: Which of the following is a characteristic of a public cloud deployment?
A. Resources have no internet access B. Resources are owned and operated by a single organization C. Resources require dedicated hardware for each customer organization D. Resources are shared among multiple organizations
Answer
**Correct: D** **Why:** Public cloud resources are shared among multiple organizations (multi-tenant) and accessed over the internet. Single organization ownership describes private cloud. Public cloud is accessed over the internet. Shared infrastructure (not dedicated) reduces costs. **Key Concept:** [Public Cloud](https://azure.microsoft.com/en-us/overview/what-is-a-public-cloud/)Question 7¶
Scenario: A company needs to ensure their application is available 99.99% of the time. Which cloud characteristic addresses this requirement?
A. Scalability, adding resources as the workload grows B. High availability C. Agility, releasing changes to the application quickly D. Elasticity, scaling resources up and down with demand
Answer
**Correct: B** **Why:** High availability ensures systems remain operational and accessible with minimal downtime, often measured as a percentage (99.99% uptime). Elasticity handles demand changes. Scalability is about growth. Agility is about rapid deployment. **Key Concept:** [High Availability](https://docs.microsoft.com/en-us/azure/architecture/framework/resiliency/reliability-patterns)Question 8¶
Scenario: A startup wants to focus on developing their application without managing servers, operating systems, or infrastructure. Which cloud model best suits their needs?
A. SaaS, a complete hosted application B. PaaS C. On-premises servers run by the startup D. IaaS, virtual machines the startup patches
Answer
**Correct: B** **Why:** PaaS allows developers to focus on application development while the cloud provider manages infrastructure, OS, middleware, and runtime. IaaS requires managing OS and up. SaaS provides complete applications. On-premises requires managing everything. **Key Concept:** [PaaS Benefits](https://azure.microsoft.com/en-us/overview/what-is-paas/)Question 9¶
Scenario: Under the shared responsibility model for IaaS, who is responsible for patching and maintaining the operating system?
A. Microsoft only, because Azure manages the host and everything that runs on it B. The customer, since the guest operating system on an IaaS virtual machine is theirs to patch C. Microsoft and the customer share it equally, with Microsoft applying operating system patches on a schedule D. No one, because Azure patches guest operating systems automatically on all virtual machines in the subscription
Answer
**Correct: B** **Why:** In IaaS, the customer is responsible for the operating system, including patching and maintenance. Microsoft manages the physical infrastructure. The responsibility shifts depending on the service model (IaaS, PaaS, SaaS). **Key Concept:** [Shared Responsibility Model](https://docs.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility)Question 10¶
Scenario: A company wants to deploy new features to their application multiple times per day. Which cloud benefit enables this rapid deployment?
A. Predictability B. Agility C. Disaster recovery D. Fault tolerance
Answer
**Correct: B** **Why:** Agility in cloud computing refers to the ability to rapidly develop, test, and deploy applications. Cloud services provide tools and infrastructure that enable fast iteration. Fault tolerance handles failures. Disaster recovery handles major incidents. Predictability is about consistent performance/cost. **Key Concept:** [Cloud Agility](https://azure.microsoft.com/en-us/overview/what-is-cloud-computing/)Question 11¶
Scenario: Which expense model represents cloud computing where you pay based on actual usage?
A. Capital Expenditure (CapEx), meaning large upfront purchases of hardware that are depreciated over time B. Sunk cost, meaning money already spent that cannot be recovered C. Fixed cost, meaning a charge that stays the same whatever the usage D. Operational Expenditure (OpEx)
Answer
**Correct: D** **Why:** Cloud computing follows an OpEx model where you pay for services as you use them, rather than making large upfront capital investments (CapEx). This provides flexibility and reduces financial risk. Fixed and sunk costs don't describe the cloud pricing model. **Key Concept:** [CapEx vs OpEx](https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/strategy/business-outcomes/fiscal-outcomes)Describe Azure Architecture and Services (35-40%)¶
Question 12¶
Scenario: A company needs to organize their Azure resources for different departments (HR, Finance, IT) with separate billing for each. What Azure feature should they use?
A. Management Groups, which organize multiple subscriptions into a hierarchy B. Resource Groups C. Subscriptions, each with its own billing D. Azure Regions
Answer
**Correct: C** **Why:** Subscriptions provide billing boundaries and access control at a higher level. Each department can have its own subscription with separate billing. Resource Groups organize resources within a subscription. Management Groups manage multiple subscriptions. Regions are geographic locations. **Key Concept:** [Azure Subscriptions](https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-setup-guide/organize-resources)Question 13¶
Scenario: An organization has multiple Azure subscriptions across different business units. They want to apply consistent policies across all subscriptions. What should they use?
A. Azure Advisor, which recommends improvements to existing resources B. Management Groups, applied above subscriptions C. Resource Groups D. Resource Tags
Answer
**Correct: B** **Why:** Management Groups allow organizing multiple subscriptions and applying policies across them hierarchically. Resource Groups organize resources within subscriptions. Tags are for metadata. Advisor recommends improvements but does not apply policy. **Key Concept:** [Management Groups](https://docs.microsoft.com/en-us/azure/governance/management-groups/overview)Question 14¶
Scenario: A company needs to host virtual machines that require the highest level of isolation for security compliance. Which Azure compute option should they use?
A. Azure Virtual Machine Scale Sets B. Azure Dedicated Host, physical servers reserved for one customer C. Azure Container Instances D. Azure Virtual Machines
Answer
**Correct: B** **Why:** Azure Dedicated Host provides physical servers dedicated to your organization, ensuring no other customers share the hardware. This addresses compliance requirements for workload isolation. Regular VMs share physical hosts. Scale Sets are for scaling. Container Instances are for containers. **Key Concept:** [Azure Dedicated Host](https://docs.microsoft.com/en-us/azure/virtual-machines/dedicated-hosts)Question 15¶
Scenario: A developer needs to run code in response to HTTP requests without managing servers. The code runs only when triggered and billing is based on execution time. What service should they use?
A. Azure Functions, serverless code that runs on triggers B. Azure Kubernetes Service, managed container orchestration for clusters C. Azure App Service D. Azure Virtual Machines
Answer
**Correct: A** **Why:** Azure Functions is a serverless compute service that runs code on-demand in response to triggers (like HTTP requests) with consumption-based billing. VMs require server management. App Service is for web apps. AKS is for container orchestration. **Key Concept:** [Azure Functions](https://docs.microsoft.com/en-us/azure/azure-functions/functions-overview)Question 16¶
Scenario: A company needs to store large amounts of unstructured data like documents, images, and videos. Which Azure storage service should they use?
A. Azure SQL Database B. Azure Blob Storage, object storage C. Azure Queue Storage, a message queue for application components D. Azure Table Storage, a NoSQL key-attribute store
Answer
**Correct: B** **Why:** Azure Blob Storage is designed for storing large amounts of unstructured data including documents, images, videos, and backups. SQL Database is for relational data. Table Storage is for structured NoSQL data. Queue Storage is for message queuing. **Key Concept:** [Azure Blob Storage](https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction)Question 17¶
Scenario: An application needs to connect securely to Azure SQL Database from an Azure Virtual Network without traffic going over the public internet. What should be configured?
A. Network Security Group B. Load Balancer C. Service Endpoint, extending the VNet identity to the Azure service D. Public IP address
Answer
**Correct: C** **Why:** Service Endpoints extend your VNet private address space to Azure services, keeping traffic on the Azure backbone network. Public IP would expose the database. Load Balancer distributes traffic. NSG controls network traffic flow but doesn't provide private connectivity. **Key Concept:** [Virtual Network Service Endpoints](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview)Question 18¶
Scenario: A company wants to deploy a fully managed relational database with automatic backups, patching, and high availability without managing the underlying infrastructure. What service should they use?
A. Azure Table Storage, a NoSQL key-attribute store B. SQL Server installed on an Azure VM C. Azure Cosmos DB, a NoSQL database D. Azure SQL Database
Answer
**Correct: D** **Why:** Azure SQL Database is a fully managed PaaS offering with automatic backups, patching, high availability, and scaling. SQL Server on VM requires managing the OS. Cosmos DB and Table Storage are NoSQL. **Key Concept:** [Azure SQL Database](https://docs.microsoft.com/en-us/azure/azure-sql/database/sql-database-paas-overview)Question 19¶
Scenario: A company needs to distribute network traffic across multiple virtual machines to ensure high availability. What Azure service should they use?
A. Azure Traffic Manager B. Azure Application Gateway C. Azure Front Door D. Azure Load Balancer, a layer 4 balancer for VMs
Answer
**Correct: D** **Why:** Azure Load Balancer distributes inbound traffic across VMs within a region at Layer 4 (TCP/UDP). Traffic Manager is DNS-based global load balancing. Application Gateway is Layer 7 load balancing with WAF. Front Door is global HTTP load balancing. **Key Concept:** [Azure Load Balancer](https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview)Question 20¶
Scenario: A company has resources in multiple Azure regions and wants to route users to the nearest region for better performance. What service should they use?
A. Azure ExpressRoute, which provides private connectivity to Azure from on-premises B. Azure Traffic Manager C. Azure Load Balancer, which distributes traffic among VMs within a single region D. Azure VPN Gateway, which connects virtual networks to other networks over encrypted tunnels
Answer
**Correct: B** **Why:** Azure Traffic Manager uses DNS-based routing to direct users to endpoints based on routing methods like performance (nearest region), priority, or geographic. Load Balancer works within a region. VPN Gateway connects networks. ExpressRoute is private connectivity. **Key Concept:** [Azure Traffic Manager](https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview)Question 21¶
Scenario: A company needs private, dedicated network connectivity between their on-premises data center and Azure that doesn't traverse the public internet. What should they use?
A. Azure ExpressRoute, a private link via a provider B. VNet Peering C. Point-to-Site VPN D. Site-to-Site VPN, an encrypted tunnel over the internet
Answer
**Correct: A** **Why:** Azure ExpressRoute provides private, dedicated connectivity through a connectivity provider, not traversing the public internet. Site-to-Site VPN uses encrypted tunnels over the internet. Point-to-Site VPN is for individual devices. VNet Peering connects Azure virtual networks. **Key Concept:** [Azure ExpressRoute](https://docs.microsoft.com/en-us/azure/expressroute/expressroute-introduction)Question 22¶
Scenario: A web application needs to cache frequently accessed data in memory to reduce database load and improve performance. What Azure service should be used?
A. Azure Blob Storage, which stores unstructured files such as images and documents B. Azure CDN, which caches static content at edge locations close to users C. Azure Cache for Redis D. Azure Queue Storage, which holds messages for asynchronous processing
Answer
**Correct: C** **Why:** Azure Cache for Redis provides an in-memory data store for caching frequently accessed data, reducing database load. Blob Storage is for files. CDN caches static content at edge locations. Queue Storage is for message queuing. **Key Concept:** [Azure Cache for Redis](https://docs.microsoft.com/en-us/azure/azure-cache-for-redis/cache-overview)Question 23¶
Scenario: A company needs to run containerized applications at scale with automatic orchestration, scaling, and management. What Azure service should they use?
A. Azure Container Instances, for single containers without orchestration B. Azure Kubernetes Service C. Azure Virtual Machines, with containers installed manually D. Azure Functions
Answer
**Correct: B** **Why:** Azure Kubernetes Service (AKS) provides managed Kubernetes for orchestrating containerized applications at scale. Container Instances is for simple container workloads without orchestration. Functions is serverless code execution. VMs require manual container management. **Key Concept:** [Azure Kubernetes Service](https://docs.microsoft.com/en-us/azure/aks/intro-kubernetes)Question 24¶
Scenario: What is the purpose of Azure Availability Zones?
A. Provide isolation from datacenter failures within a region B. Distribute traffic across regions so users reach the nearest healthy deployment C. Connect Azure regions over a private backbone D. Provide content caching at edge locations
Answer
**Correct: A** **Why:** Availability Zones are physically separate locations within an Azure region, each with independent power, cooling, and networking. This protects against datacenter-level failures. Region pairs connect regions. Traffic Manager distributes traffic. CDN provides edge caching. **Key Concept:** [Availability Zones](https://docs.microsoft.com/en-us/azure/availability-zones/az-overview)Question 25¶
Scenario: A company needs to deploy a web application with automatic scaling, custom domains, and SSL certificates without managing virtual machines. What should they use?
A. Azure Batch B. Azure Container Instances C. Azure Virtual Machines D. Azure App Service
Answer
**Correct: D** **Why:** Azure App Service is a PaaS offering for web applications with built-in auto-scaling, custom domains, SSL, and deployment slots - all without managing VMs. VMs require infrastructure management. Container Instances is for simple containers. Batch is for large-scale parallel processing. **Key Concept:** [Azure App Service](https://docs.microsoft.com/en-us/azure/app-service/overview)Question 26¶
Scenario: A company needs to store data that must be replicated across multiple regions for disaster recovery. Which storage redundancy option should they choose?
A. Geo-Redundant Storage (GRS) B. Zone-Redundant Storage (ZRS), across zones in one region C. Premium Storage D. Locally Redundant Storage (LRS), within one datacenter
Answer
**Correct: A** **Why:** Geo-Redundant Storage (GRS) replicates data to a secondary region hundreds of miles away, providing disaster recovery capability. LRS replicates within a datacenter. ZRS replicates across availability zones in one region. Premium Storage is a performance tier. **Key Concept:** [Azure Storage Redundancy](https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy)Describe Azure Management and Governance (30-35%)¶
Question 27¶
Scenario: A company wants to ensure all deployed resources have a "CostCenter" tag for billing purposes. How can they enforce this automatically?
A. Azure Management Groups B. Azure Advisor C. Azure Resource Groups D. Azure Policy, which enforces rules on resources
Answer
**Correct: D** **Why:** Azure Policy can enforce tagging requirements, either denying resources without required tags or automatically adding them. Resource Groups organize resources. Advisor only recommends improvements. Management Groups manage subscriptions. Policy enforces compliance rules. **Key Concept:** [Azure Policy](https://docs.microsoft.com/en-us/azure/governance/policy/overview)Question 28¶
Scenario: A company needs to track all changes to their Azure resources for compliance auditing. What Azure feature should they use?
A. Azure Advisor B. Azure Activity Log C. Azure Monitor, which collects metrics and logs D. Azure Service Health, which reports Azure outages
Answer
**Correct: B** **Why:** Azure Activity Log records all control plane operations (who did what and when) on resources, essential for compliance auditing. Monitor collects performance data. Advisor provides recommendations. Service Health shows Azure service status. **Key Concept:** [Azure Activity Log](https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log)Question 29¶
Scenario: An administrator needs to get personalized recommendations for improving security, reliability, performance, and reducing costs across their Azure resources. What tool should they use?
A. Azure Monitor B. Cost Management, which analyzes and budgets spend C. Azure Advisor, a recommendation engine D. Azure Service Health, which reports Azure incidents
Answer
**Correct: C** **Why:** Azure Advisor analyzes your resources and provides personalized recommendations across five categories: Cost, Security, Reliability, Operational Excellence, and Performance. Monitor collects data. Service Health shows Azure status. Cost Management focuses only on costs. **Key Concept:** [Azure Advisor](https://docs.microsoft.com/en-us/azure/advisor/advisor-overview)Question 30¶
Scenario: A company wants to estimate their monthly Azure costs before deploying resources. What tool should they use?
A. Cost Management B. Azure TCO Calculator, comparing on-premises costs C. Azure Advisor, which recommends optimizations D. Azure Pricing Calculator
Answer
**Correct: D** **Why:** Azure Pricing Calculator helps estimate costs for specific Azure services and configurations before deployment. TCO Calculator compares on-premises vs. cloud costs. Cost Management analyzes existing spending. Advisor provides optimization recommendations. **Key Concept:** [Azure Pricing Calculator](https://azure.microsoft.com/en-us/pricing/calculator/)Question 31¶
Scenario: A company needs to set spending limits and receive alerts when costs exceed a threshold. What should they use?
A. Azure Cost Management + Billing B. Azure Advisor C. Azure Monitor D. Azure Pricing Calculator
Answer
**Correct: A** **Why:** Azure Cost Management + Billing provides budgets, alerts, and cost analysis for controlling and monitoring Azure spending. Pricing Calculator estimates costs. Advisor gives recommendations. Monitor tracks performance metrics. **Key Concept:** [Azure Cost Management](https://docs.microsoft.com/en-us/azure/cost-management-billing/cost-management-billing-overview)Question 32¶
Scenario: A company wants to grant a user permission to manage virtual machines in a specific resource group but not other resources. How should they implement this?
A. Assign Owner role at subscription level B. Assign Contributor role at subscription level C. Assign Virtual Machine Contributor role at resource group level D. Create a custom role at management group level
Answer
**Correct: C** **Why:** Assigning Virtual Machine Contributor at the resource group level follows least privilege - the user can only manage VMs in that specific resource group. Subscription-level roles grant broader access. Management group level is even broader. **Key Concept:** [Azure RBAC](https://docs.microsoft.com/en-us/azure/role-based-access-control/overview)Question 33¶
Scenario: Which Azure service provides threat protection across hybrid cloud workloads?
A. Microsoft Defender for Cloud B. Azure DDoS Protection C. Azure Firewall D. Azure Key Vault
Answer
**Correct: A** **Why:** Microsoft Defender for Cloud (formerly Azure Security Center) provides threat protection, security posture management, and recommendations across Azure, on-premises, and other clouds. Firewall filters traffic. DDoS protects against DDoS attacks. Key Vault stores secrets. **Key Concept:** [Microsoft Defender for Cloud](https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction)Question 34¶
Scenario: A company needs to securely store and manage secrets, keys, and certificates used by applications. What Azure service should they use?
A. Azure Storage B. Microsoft Entra ID C. Azure Policy D. Azure Key Vault, a store for secrets, keys, and certificates
Answer
**Correct: D** **Why:** Azure Key Vault securely stores and manages secrets, encryption keys, and certificates with access control and auditing. Storage is for data files. Azure AD manages identities. Policy enforces compliance rules. **Key Concept:** [Azure Key Vault](https://docs.microsoft.com/en-us/azure/key-vault/general/overview)Question 35¶
Scenario: An organization needs to implement multi-factor authentication (MFA) for all users accessing Azure resources. What service provides this capability?
A. Azure Policy B. Azure Monitor C. Azure Key Vault D. Microsoft Entra ID (Azure AD)
Answer
**Correct: D** **Why:** Microsoft Entra ID (formerly Azure Active Directory) provides identity management including multi-factor authentication. Key Vault stores secrets. Policy enforces resource compliance. Monitor tracks performance. **Key Concept:** [Azure MFA](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks)Question 36¶
Scenario: A company wants to standardize deployments by defining a repeatable set of Azure resources, including VMs and networking, as code. What should they use?
A. Azure Policy B. ARM templates or Bicep files, which declare the resources to deploy C. Azure Advisor, which gives recommendations on existing resources and workloads D. Azure Resource Groups, which are containers that organize related resources
Answer
**Correct: B** **Why:** ARM templates (and Bicep, which compiles to ARM templates) declare Azure resources as code, so the same deployment can be repeated with the same result. Azure Policy enforces rules. Azure Advisor only gives recommendations. Resource Groups organize resources but do not define them. Azure Blueprints, which once packaged this, is being retired. **Key Concept:** [ARM templates overview](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/overview)Question 37¶
Scenario: What is the primary purpose of Azure Resource Manager (ARM)?
A. Deploy and manage Azure resources B. Provide security recommendations for subscriptions C. Calculate Azure costs D. Monitor resource performance
Answer
**Correct: A** **Why:** Azure Resource Manager is the deployment and management service for Azure, handling all create, update, and delete operations for resources. It provides consistent management through templates, RBAC, and tagging. Monitor tracks performance. Pricing Calculator estimates costs. Advisor gives recommendations. **Key Concept:** [Azure Resource Manager](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview)Question 38¶
Scenario: A company needs to restrict which Azure regions can be used for resource deployment. How can they enforce this?
A. Azure Firewall, a network filter B. Resource Tags, which hold metadata C. Azure Policy D. Network Security Groups
Answer
**Correct: C** **Why:** Azure Policy can enforce allowed locations, denying deployments to unauthorized regions. Tags are for metadata. NSGs filter network traffic. Firewall protects network boundaries. **Key Concept:** [Azure Policy Built-in Definitions](https://docs.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies)Question 39¶
Scenario: How many levels of depth does a management group tree support, not counting the root level or the subscription level?
A. 3 levels B. 6 levels of management groups C. 10 levels D. Unlimited, with no stated cap on depth
Answer
**Correct: B** **Why:** A management group tree supports up to six levels of depth. This limit does not include the root level or the subscription level. A single directory can hold 10,000 management groups. Each management group or subscription can have only one parent. **Key Concept:** [Management group limits](https://learn.microsoft.com/en-us/azure/governance/management-groups/overview#important-facts-about-management-groups)Question 40¶
Scenario: Which tool allows administrators to manage Azure resources using command-line scripts that can be automated?
A. Azure CLI, a scriptable command-line tool B. Azure Mobile App, for monitoring resources on the go C. Azure Portal D. Azure Advisor
Answer
**Correct: A** **Why:** Azure CLI provides command-line management of Azure resources with scripts that can be automated. Azure Portal is graphical. Mobile App provides monitoring on-the-go. Advisor provides recommendations. **Key Concept:** [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/)Answer Key¶
| Question | Answer | Domain |
|---|---|---|
| 1 | C | Cloud Concepts |
| 2 | A | Cloud Concepts |
| 3 | D | Cloud Concepts |
| 4 | C | Cloud Concepts |
| 5 | A | Cloud Concepts |
| 6 | D | Cloud Concepts |
| 7 | B | Cloud Concepts |
| 8 | B | Cloud Concepts |
| 9 | B | Cloud Concepts |
| 10 | B | Cloud Concepts |
| 11 | D | Cloud Concepts |
| 12 | C | Architecture & Services |
| 13 | B | Architecture & Services |
| 14 | B | Architecture & Services |
| 15 | A | Architecture & Services |
| 16 | B | Architecture & Services |
| 17 | C | Architecture & Services |
| 18 | D | Architecture & Services |
| 19 | D | Architecture & Services |
| 20 | B | Architecture & Services |
| 21 | A | Architecture & Services |
| 22 | C | Architecture & Services |
| 23 | B | Architecture & Services |
| 24 | A | Architecture & Services |
| 25 | D | Architecture & Services |
| 26 | A | Architecture & Services |
| 27 | D | Management & Governance |
| 28 | B | Management & Governance |
| 29 | C | Management & Governance |
| 30 | D | Management & Governance |
| 31 | A | Management & Governance |
| 32 | C | Management & Governance |
| 33 | A | Management & Governance |
| 34 | D | Management & Governance |
| 35 | D | Management & Governance |
| 36 | B | Management & Governance |
| 37 | A | Management & Governance |
| 38 | C | Management & Governance |
| 39 | B | Management & Governance |
| 40 | A | Management & Governance |