AZ-104 Practice Test

Answer: C
Read-access geo-zone-redundant storage exposes a distinct secondary endpoint, identified by a -secondary suffix on the account hostname, that serves read requests from the secondary region, and an application must be coded to redirect to that endpoint (typically after detecting failures against the primary) to keep reading during a primary-region outage. Requests to the normal primary endpoint will fail during a primary-region outage; there is no automatic silent redirection to the secondary without the application using the distinct secondary hostname. A full account failover changes which region is primary and is a heavier, explicit administrative action; RA- redundancy specifically allows read access to the secondary without requiring a failover first. Switching to LRS removes all geographic redundancy and eliminates the secondary region and its read endpoint entirely, the opposite of what is needed.

Answer: C
Container soft delete specifically protects against accidental container deletion by retaining the deleted container, and the blobs inside it, in a recoverable state for a configured retention window, allowing an undelete operation to restore the whole container. Manual snapshots protect individual blobs, not the container as a structural object, and would not exist automatically unless someone had taken them beforehand for every blob. The archive tier only changes how a blob is stored and billed; it has no effect on preventing or reversing container deletion. A resource lock must be applied before the deletion to have any effect; applying one afterward cannot undo an action that has already completed.

Answer: D
Blob versioning, once enabled on the storage account, automatically preserves every prior state of a blob as a new version each time it is overwritten or deleted, with no manual action required at write time, directly matching the need to recover any prior revision automatically. Snapshots capture a blob's state at a specific point, but they must be created explicitly (manually or via a script) at the time worth preserving; they are not created automatically on every write. Soft delete protects against deletion, not overwrites; it does not preserve the previous content each time an existing blob is overwritten in place. The cool tier only affects storage cost and access latency; it has no relationship to preserving prior blob content across overwrites.

Answer: A
Lifecycle management policies define rules that automatically transition blobs between access tiers, and eventually delete them, based on conditions like days since modification or days since last access, which removes the need for any manual monthly review and matches the fully automated tiering and deletion described. Manually reviewing logs and moving blobs by hand is exactly the manual, recurring effort the team wants to eliminate. The premium block blob tier is a high-performance tier for latency-sensitive workloads and does not automatically demote data to cheaper tiers over time; that is lifecycle management's job regardless of starting tier. A ReadOnly lock only restricts who can modify the storage account's configuration; it has no effect on billing or automated tiering.

Answer: C
A blob snapshot captures a read-only, point-in-time state of a blob on demand and is billed only for the blocks that are unique to that snapshot compared to the base blob, which matches both the on-demand timing and the space-efficient billing described. Copying the blob to a separate container does preserve its state, but the copy is billed as a fully independent blob rather than sharing storage with the original the way a snapshot does. Versions are created automatically whenever the blob is next modified rather than on demand at a moment the developer chooses, so relying on the next overwrite would not guarantee the exact pre-batch state is captured deliberately. An immutability policy enforces write-once-read-many behavior and would block or complicate the batch job's own writes rather than simply preserving a prior state for reference.

Answer: B
Storage Explorer is a graphical desktop application designed for browsing and interacting with blobs, queues, tables, and files across multiple storage accounts and subscriptions, including simple drag-and-drop operations, which matches an administrator's need for visual, occasional, small-scale interaction rather than a scripted bulk job. AzCopy is a command-line tool optimized for large, repeatable, scriptable transfers; it has no graphical browsing interface at all. Azure Data Box is a physical device service for shipping large offline data sets into Azure and is not an interactive browsing tool. The Import/Export service ships physical disks to a datacenter for bulk data movement; it has no drag-and-drop portal experience for casual file management.

Answer: A
The change feed provides an ordered, guaranteed, and durable log of changes to blobs in an account that downstream consumers can read sequentially, which is exactly the kind of reliable change stream an analytics pipeline needs instead of repeatedly listing and diffing a container. Lifecycle management defines tiering and expiration rules; it does not produce a change log for consumers to process. The Activity log records subscription-level control-plane operations such as resource creation and configuration changes; it does not capture individual blob data-plane writes by default. Diagnostic settings sending only aggregate metrics provide numeric counters over time, not a per-blob, ordered record of individual operations suitable for driving a processing pipeline.

Answer: B
Azure Files share snapshots capture a read-only, point-in-time state of the entire share that can be mounted and browsed to restore individual files, functioning much like Windows Previous Versions, which matches the described requirement precisely. Soft delete for file shares protects a deleted share as a whole for a retention period, but it is not the mechanism for restoring an individual file from a point-in-time browsable capture. Blob versioning applies specifically to blobs in blob containers and does not extend to Azure file shares, which use a different protocol and feature set. Geo-redundant storage protects against regional failure by replicating data; it provides no browsable, point-in-time, per-file restore experience for end users.

Answer: C
Storage account firewall settings let an administrator deny public network access by default and add virtual network rules that permit specific subnets (via service endpoint), which directly implements the network-level allow-list described. Storage accounts do not have their own network interface that an NSG attaches to in this way; NSGs secure subnets and VM NICs, not the storage account's public endpoint. SAS tokens control who can authenticate to specific resources but do nothing to block network-level access if public access remains enabled. An audit-effect policy only reports on non-compliant accounts after the fact; it does not itself restrict network access from the internet.

Answer: D
A private endpoint provisions a network interface with a private IP address from the VNet for the storage account, and traffic to it stays on the Microsoft backbone without touching the account's public endpoint, matching the requirement for strictly private-IP access. A service endpoint optimizes routing and can restrict access to selected subnets, but the storage account's public endpoint still exists and traffic still traverses it; it does not create a private IP for the storage service the way a private endpoint does. Storage accounts do not accept a directly assigned VNet-only public IP address as a way to hide the public endpoint. A NAT gateway provides outbound internet connectivity for a subnet; it does not create inbound private connectivity to a PaaS service.

Answer: A
Object replication asynchronously copies block blobs between a designated source and destination storage account and requires change feed enabled on the source plus blob versioning enabled on both accounts, and unlike geo-redundancy, both accounts remain separately accessible and writable, matching the two-account, independently-writable design described. GRS replicates to a secondary region for disaster recovery, but that secondary copy is not independently writable or even readable without RA-GRS and a failover; it is not a second, independently usable storage account. A lifecycle rule changes access tiers on a schedule; it does not copy data between two separate storage accounts. Running AzCopy hourly as a full-account copy is a manual, inefficient substitute that does not provide the built-in, near-continuous per-blob replication object replication offers.

Answer: B
Customer-managed keys let an organization supply and control the key used for Azure Storage encryption from its own Azure Key Vault or Managed HSM, including rotation and the ability to revoke access to the key, which matches full customer control of key lifecycle. Microsoft-managed keys are generated, rotated, and stored by Microsoft, not the customer, so they do not satisfy a requirement for the security team to control the keys directly. Azure Disk Encryption is a VM disk encryption feature using BitLocker or DM-Crypt and is unrelated to Azure Storage account encryption at rest. A SAS token is a delegated access credential for storage operations; it has no role in configuring encryption-at-rest key management.

Answer: B
A stored access policy defines shared constraints such as permissions and expiry on the server side, and SAS tokens issued against that policy can all be invalidated together by modifying or deleting the policy, without needing to rotate the account keys or wait out each token's individual expiry, which is exactly the instant, bulk-revocation capability requested. Manually tracking expiry dates in a spreadsheet provides no way to revoke tokens early; it only tells you when they will eventually lapse on their own. Regenerating the account key would invalidate every SAS derived from that key, including ones used by unrelated applications, and is a blunt, disruptive substitute for scoped revocation. Public container access removes access control altogether and is the opposite of a controlled, revocable delegation mechanism.

Answer: C
Because a storage account has two independent access keys, applications can be switched to the secondary key first, and once none of them depend on the primary, the primary can be regenerated to invalidate the exposed key without any application losing connectivity at any point. Regenerating the primary key while applications still authenticate with it immediately breaks every one of those applications the moment the old key becomes invalid, causing an outage rather than avoiding one. Deleting and recreating the storage account destroys existing data and endpoints and is a drastic, unnecessary step when key rotation achieves the same security outcome without data loss. Leaving a known-exposed key active until a future maintenance window leaves the account vulnerable for an unacceptable period given the exposure has already been confirmed.

Answer: D
Microsoft Entra Kerberos authentication lets Azure Files authenticate hybrid and cloud-only Microsoft Entra identities directly over SMB without any on-premises AD DS or Microsoft Entra Domain Services dependency, and because a storage account supports only one identity source for Azure Files at a time, the AD DS source must be disabled before switching to it. Microsoft Entra Domain Services is a separate managed domain service that still represents a domain-joined dependency, which does not match the goal of retiring on-premises AD DS in favor of direct Entra ID authentication. A storage account can only have one Azure Files identity source enabled at a time, not AD DS and Entra Kerberos simultaneously. Anonymous access would remove authentication entirely rather than authenticate specific Entra ID identities, which is the opposite of the stated goal.

Answer: A
azcopy sync is purpose-built to make the destination match the source, transferring only changed or new files and, when the delete-destination option is used, removing files at the destination that no longer exist at the source, exactly matching a mirroring, delta-only nightly job. azcopy copy transfers files from source to destination but does not delete extraneous destination files by default and is not designed as a mirroring operation the way sync is. azcopy list only enumerates the contents of a location; it does not transfer or delete any data on its own. azcopy make simply creates a new container or file share resource; it performs no file comparison or copy operation at all.

Answer: B
Container soft delete preserves the deleted container as a recoverable unit, and because versioning had captured every prior state of each blob before deletion, those versions travel with the container into the soft-deleted state and become available again if the container is restored within the retention window. Container soft delete does not selectively discard older versions on deletion; it retains the container's contents, versions included, as they existed at the time of deletion. Blob versioning and container soft delete are independent, complementary features that are commonly enabled together, not mutually exclusive alternatives. Soft delete does apply at the container level (in addition to the blob level), which is precisely why the deleted container in this scenario is recoverable rather than gone immediately.

Answer: D
SFTP support for Azure Blob Storage requires hierarchical namespace to be enabled on the account, since SFTP is one of the protocols layered on top of the Data Lake Storage Gen2 hierarchical namespace, and local user identities are then used to scope per-folder access. The archive tier is unrelated and, in fact, is not even a valid default tier setting for a storage account. Blob versioning is an independent feature and has no dependency relationship with SFTP support. Storage accounts do not have their own attachable network interface for a NAT gateway; NAT gateways provide outbound connectivity for VNet subnets, not inbound SFTP protocol support for a PaaS storage endpoint.

Answer: A
Disabling Shared Key authorization at the storage account level rejects any request authenticated with the account key or a key-derived SAS, forcing every client to authenticate through Microsoft Entra ID and role-based access control, which is the documented way to eliminate the account-key attack surface entirely. Regenerating keys on a schedule still leaves a valid key usable between rotations; it reduces exposure window but does not eliminate key-based access as a method. Removing a connection string from one application's settings does not disable the key itself, which remains valid and could still be used elsewhere, including by an attacker who already has it. Soft delete protects against accidental deletion of data; it has no relationship to, and does not disable, Shared Key authorization.

Answer: D
The free App Service Managed Certificate explicitly does not support wildcard certificates, so a wildcard requirement must be met with a certificate purchased from a third-party certificate authority or otherwise brought in and uploaded (or referenced from Key Vault) to the App Service. The free managed certificate is documented as unsupported for wildcard domains, which directly contradicts using it for this scenario. The built-in *.azurewebsites.net default certificate only covers the platform's own default hostname, not a customer's custom apex or wildcard domain. Certificates for custom domains must be properly provisioned through App Service's certificate management (upload or Key Vault reference); simply placing a file in the app's file system is not how TLS bindings are configured.

Answer: B
Azure Spot Virtual Machines offer access to unused Azure capacity at a significantly reduced price with the tradeoff that Azure can evict the instance when it needs the capacity back, and the eviction policy can be set to Deallocate so the VM stops (retaining its disks) rather than being permanently deleted, letting it be restarted later once capacity is available again. Reserved Instances are a one- or three-year capacity and pricing commitment for steady-state workloads; they do not offer the deepest possible discount the way interruptible Spot capacity does, and they are not associated with an eviction policy at all. Setting the eviction policy to Delete removes the VM and its disks entirely on eviction, which is the opposite of preserving it for a later restart. Both Flexible and Uniform orchestration modes for scale sets can use Spot instances, so Spot pricing is not exclusive to Uniform mode.

Answer: A
Flexible orchestration is Microsoft's recommended mode for scale sets and explicitly supports mixing VM sizes and operating systems within the same set, while managing standard Azure IaaS VM resources that are directly compatible with standard VM APIs, Azure Resource Manager tagging, RBAC, and Azure Backup. Uniform orchestration is optimized for large-scale, identical instances and does not support mixing different VM sizes and operating systems in one scale set. Availability sets group VMs for fault- and update-domain distribution but provide no built-in autoscaling; that requires a scale set. Uniform orchestration's instances are managed through the separate Virtual Machine Scale Set VM API and are explicitly documented as incompatible with standard IaaS VM API commands, RBAC, and Azure Backup, the opposite of what is claimed.

Answer: B
Ultra Disk is designed for the most demanding, latency-sensitive workloads such as SAP HANA, offering sub-millisecond latency and the ability to independently adjust IOPS and throughput at runtime without changing the provisioned disk size, matching every requirement stated. Standard HDD is the lowest-performance, highest-latency managed disk tier, intended for infrequently accessed data, not high-IOPS latency-sensitive workloads. Standard SSD targets budget-friendly workloads with moderate, consistent performance; it is not marketed or suited for sub-millisecond, hundreds-of-thousands-of-IOPS scenarios. Premium SSD offers strong, predictable performance tied to disk size and tier, but unlike Ultra Disk, its IOPS and throughput are fixed by the selected disk size rather than independently and dynamically adjustable at runtime.

Answer: C
Encryption at host is a VM-level setting that extends the always-on server-side encryption to also cover temporary disks, disk caches, and the data as it flows between compute and storage, achieving end-to-end encryption without requiring any in-guest encryption agent like BitLocker or DM-Crypt. Standard server-side encryption with platform-managed keys is always on for OS and data disks, but it explicitly does not cover temp disks or disk caches, which is the gap this scenario needs closed. Azure Disk Encryption is precisely the option that relies on BitLocker (Windows) or DM-Crypt (Linux) running inside the guest, the opposite of what is being avoided here. Confidential disk encryption is restricted to specific confidential computing VM series, not available on every VM size without restriction.

Answer: D
Azure shared disks let a single managed disk (Ultra Disk, Premium SSD v2, Premium SSD, or Standard SSD) be attached to multiple VMs at once by setting the maxShares value to the number of nodes, with the clustered application, such as Windows Server Failover Clustering, coordinating write access through SCSI Persistent Reservations. Availability zones distribute resources for resilience but do not themselves make a single disk attachable to multiple VMs simultaneously; disk sharing is a distinct, separately configured capability. Encryption at host is a data-at-rest encryption feature unrelated to whether a disk can be attached to more than one VM. Host caching is explicitly not available on Premium SSDs configured with maxShares greater than 1, so enabling it is not a prerequisite for sharing; if anything, the two features are incompatible in that configuration.

Answer: A
Azure Resource Mover is the dedicated service for moving supported resources, including VMs and their dependencies, from one Azure region to another, orchestrating the process and reducing manual rebuild effort. The standard move-resources operation relocates resources between resource groups or subscriptions within the same region; it does not move a resource's underlying deployment to a different Azure region. A CanNotDelete lock only prevents deletion of a resource; it has no relationship to enabling or performing a cross-region move. Azure Advisor issues recommendations for administrators to act on, such as suggesting cost or reliability improvements; it does not automatically relocate VMs between regions on its own.

Answer: B
Scaling out increases the number of instances running the App Service plan, distributing load across more machines, which is the appropriate response when a single instance's CPU is not maxed but overall throughput needs to grow, and it can be automated with autoscale rules tied to metrics like CPU or request queue length. Scaling up changes the tier or size of the underlying instance (more CPU/RAM per instance) rather than adding instances, which is a different axis of scaling from what was requested. A deployment slot is a separate staging environment for release management, such as swap-based deployments; it does not add compute capacity to the running production app. App Service plans support multiple instances natively (the count is a configurable setting, not fixed at one), so moving to a different compute service is not required to add capacity.

Answer: C
Swap with preview (multi-phase swap) applies the target slot's settings to a clone of the source slot first, allowing the app to warm up and be validated, including custom warm-up logic or health checks, before the team completes the swap and sends live traffic to it, directly matching the requirement to avoid a cold start for the first users. A standard swap does perform some default warm-up of the swapped app, but it completes the traffic switch immediately afterward without a pause for the team to validate custom health checks before go-live, which is the gap swap with preview closes. Deployment slot backup is not a feature that pre-warms an application; backup and restore address data protection, not swap warm-up behavior. Scaling out production adds instance count for capacity; it does not itself add a warm-up-and-validate step to the swap process.

Answer: B
The Custom Script Extension downloads and executes a specified script inside the VM's guest operating system after deployment, which is the standard Azure mechanism for post-provisioning configuration tasks like installing and registering an agent without an interactive RDP session. Encryption at host is a disk encryption feature for data at rest and has no scripting or automation capability. Resource locks only control whether a resource can be deleted or modified through Azure Resource Manager; they do not execute anything inside a guest operating system. Changing availability set membership is a placement and fault-domain operation; it has no mechanism for running scripts inside a VM.

Answer: C
The Azure Monitor Agent is the current, actively developed agent for collecting telemetry such as performance counters and event logs, deployed as a VM extension and governed by data collection rules that define exactly what is collected and where it is sent, such as a Log Analytics workspace for KQL querying. The legacy Log Analytics (MMA/OMS) agent is the one Azure Monitor Agent supersedes and is being retired, so it is not the recommended path going forward. The Custom Script Extension can run arbitrary scripts but is not a purpose-built, supported telemetry pipeline with structured data collection rules the way Azure Monitor Agent is. A NAT gateway provides outbound internet connectivity for a subnet and has no role in collecting or shipping VM telemetry.

Answer: D
A VM can sometimes be resized to another size in the same cluster while running, but moving to a size in a different series or one unavailable on the current hardware cluster typically requires the VM to be stopped and deallocated so Azure can reallocate it to compatible hardware, after which it is resized and restarted. Resizing does not always complete instantly without any possibility of downtime; cross-cluster or cross-series moves specifically can require a stop/start cycle. Resizing across VM series and families is supported, provided the target size is available in the region and cluster; it is not restricted to staying within the same series. A dynamic public IP is released on deallocation and a new one may be assigned on restart, but a static public IP (Standard SKU) is retained across a stop/deallocate and resize cycle, so a permanent loss is not the general rule.

Answer: D
Azure availability sets default to two fault domains, representing groups of hardware that share a common power source and network switch, though the maximum configurable fault domain count can be up to three depending on the region, which is distinct from the default update domain count. Five is the default number of update domains, not fault domains, so conflating the two produces the wrong figure here. Fault domains are not something that must be manually enabled from a starting value of one; every availability set is created with a fault domain configuration already in effect by default. Twenty is the default (and maximum) number of update domains configurable for an availability set, not a fault domain figure.

Answer: B
Bicep modules encapsulate a set of resource definitions in a separate file that a parent Bicep file can reference with inputs and outputs, and modules can be published to a registry, making them the construct for versioned, reusable deployment logic across projects. A parameter file only supplies input values for a deployment; it contains no reusable resource-definition logic of its own. ARM template functions like resourceId() compute values such as resource IDs within a template; they are not a packaging mechanism for entire blocks of reusable deployment logic. Resource groups are a management and deployment scope for resources, not a code-reuse construct within Bicep or ARM authoring.

Answer: C
The resourceId() function computes the fully qualified resource ID for a resource based on its type and name (and optionally subscription and resource group), which is the standard, portable way to reference a resource without manually hardcoding subscription or resource group values into a string. Manually concatenating a hardcoded string is fragile, error-prone, and defeats the purpose of a portable, parameterized template. The outputs section returns values from a completed deployment for use by the caller or a linked template; it is not itself a function for computing a resource ID inline within properties. apiVersion specifies which version of a resource provider's schema to use for a resource definition; it has no role in generating a resource ID string.

Answer: D
The Bicep CLI's decompile command takes an existing ARM JSON template and produces an equivalent Bicep file, giving the team a starting point they can refine rather than hand-translating every resource block. The build command does the opposite conversion, compiling a Bicep file down into ARM JSON for deployment, not converting ARM into Bicep. Deployment commands like az deployment group create submit a template for deployment; they do not convert a template's authoring language from one format to another. Azure Policy remediation tasks bring existing resources into compliance with a policy's effect; they have no function for converting template file formats.

Answer: A
VNet integration lets an App Service app make outbound calls into a virtual network, such as reaching a database on a private subnet, while a private endpoint gives the app itself a private IP address in a VNet so inbound clients on that network can reach it without using its public endpoint, so the two features cover the outbound and inbound directions respectively as the scenario requires. Swapping them (private endpoint for outbound, VNet integration for inbound) reverses their actual purposes, since a private endpoint is about inbound reachability of the app, not the app reaching out. VNet integration only affects outbound connectivity from the app; it does not provide inbound private access to the app itself, so it cannot satisfy both halves. A NAT gateway provides outbound internet connectivity for a subnet, not app-to-database VNet reachability, and Azure Bastion is a browser-based RDP/SSH jump host for VMs, unrelated to private inbound access to an App Service app.

Answer: B
Automatic backups, with their fixed 30-day retention schedule, are supported starting at the Basic tier and above (Basic, Standard, Premium, Isolated); the Free and Shared tiers are not included, so the plan must first be scaled up to at least Basic before automatic backups become available. Automatic backups are explicitly not available on every tier; Free and Shared are excluded, so assuming they are already active there is incorrect. Custom backups also require a supported pricing tier (Basic or higher) and a storage account to hold the backup files; they are not a Free-tier workaround that skips the tier and storage requirements. Deployment slots are a separate feature for staged releases and have no role in unlocking or enabling the backup feature.

Answer: C
ACR Tasks can be configured with a source-code (Git) trigger so that a commit to a watched branch automatically kicks off a build of the container image and pushes the result to the registry, providing the described CI capability without a separate build server. Azure Container Instances is a runtime for running already-built container images; a restart policy governs whether a stopped container restarts, and has nothing to do with building images from source. A resource lock only affects whether a resource can be deleted or modified through Resource Manager; it has no relationship to triggering an image build. Azure Container Apps revisions represent a new deployed version of an already-built container image; creating a revision does not itself rebuild an image from source code.

Answer: D
The OnFailure restart policy restarts the container specifically when it exits with a failure (non-zero) status, and leaves it stopped after a successful, clean exit, which exactly matches the requirement to restart on crash but not after a completed one-time task. Always restarts the container regardless of how it exits, including after a successful completion, which is the opposite of the selective behavior wanted here. Never means the container is not automatically restarted under any circumstance, including after a crash, so it fails the requirement to restart on failure. A resource lock only controls whether the ACI resource itself can be deleted or modified through Azure Resource Manager; it has no relationship to a container's restart behavior.

Answer: A
Azure Container Apps is built on Kubernetes and KEDA under the hood and natively supports scaling rules driven by HTTP traffic, queue depth, or other event sources, including scaling all the way down to zero instances during idle periods and back up automatically as events arrive. Azure Container Instances runs one or more containers as a fixed group without a built-in KEDA-based autoscaling or scale-to-zero mechanism triggered by event sources. AKS node pools can use a cluster autoscaler to add or remove nodes based on pod scheduling pressure, but scaling application replicas to zero based on event sources still requires an add-on like KEDA configured explicitly, and it is not a default, zero-configuration behavior of a Standard node pool. App Service plans, including Basic tier, bill for allocated instance capacity continuously regardless of whether a request is actively being processed; only Consumption-based hosting models scale to true zero cost during idle time.

Answer: B
AKS creates a system node pool by default to host critical system pods like CoreDNS, and the recommended practice is to add separate user node pools dedicated to application workloads, isolating application scaling and resource needs from the components the cluster itself depends on. AKS fully supports creating additional user node pools beyond the initial system pool; running everything on a single system pool is possible but not the recommended separation of concerns. The system node pool should not be deleted, since it (or an equivalent system-mode pool) is required to host the critical system pods the cluster depends on to function. AKS does not require every node pool to be a system pool; user node pools are explicitly the recommended place for application workloads, distinct from system pools.

Answer: C
The Horizontal Pod Autoscaler adjusts the number of pod replicas based on metrics like CPU, but it has no ability to add compute capacity itself; when existing nodes are full, the cluster autoscaler is the component that adds nodes to the pool so the scheduler has room to place the additional replicas the HPA requested. The HPA operates purely at the pod-replica level and does not provision infrastructure; without the cluster autoscaler (or a manual node addition), extra replicas it creates would simply remain unschedulable. AKS pricing tiers (Free, Standard, Premium) affect the cluster management SLA and feature set, not whether nodes are automatically added for capacity; that is the cluster autoscaler's job regardless of tier. A resource lock only affects whether the node pool resource can be deleted or modified via Resource Manager; it has no relationship to pod scheduling capacity.

Answer: D
A rolling upgrade policy applies model changes to instances automatically in configurable batches, respecting settings like the maximum batch size and pause time between batches, which matches the requirement for automatic, controlled, staged updates rather than an all-at-once or fully manual process. Manual upgrade policy is the opposite of automatic: with it, each instance must be explicitly triggered by an administrator (or via API call) to pick up the latest model, so it does not batch-update automatically. Automatic upgrade policy applies changes to all instances essentially at once, without the batching and staged control that rolling upgrade provides, and does not require manual per-instance triggering the way the distractor describes. A resource lock only governs whether a resource can be deleted or modified through Resource Manager; it plays no role in how a scale set applies model upgrades to its instances.

Answer: A
A proximity placement group is specifically designed to co-locate VMs physically close together within an Azure datacenter to minimize the network latency between them, which is exactly what a latency-sensitive, tightly coupled workload like this trading application needs. An availability set groups VMs across fault and update domains for resiliency against hardware and maintenance failures; it does not optimize for physical proximity or minimal latency between instances, and can in fact spread them further apart. Availability zones intentionally place resources in physically separate datacenters within a region for fault tolerance, which increases inter-zone latency compared to co-location, the opposite of the goal here. A user-defined route changes the next hop for traffic; it cannot alter the physical distance or hardware placement that determines network latency between VMs.

Answer: D
Connection Monitor is built for continuous, scheduled monitoring of network connectivity and latency between endpoints (including hybrid on-premises to Azure paths) over time, with alerting on degraded reachability, matching the ongoing monitoring requirement rather than a single check. Connection troubleshoot performs a one-time, on-demand connectivity test between a source and destination and reports the result immediately; it is not a continuous, scheduled monitoring capability the way Connection Monitor is. IP flow verify checks whether a specific packet, given source, destination, port, and protocol, would be allowed or denied by NSG rules at a single point in time; it is a one-off diagnostic rather than an ongoing monitor. There is no separate Network Watcher feature named 'NSG diagnostics' serving as the continuous monitoring tool; continuous connectivity monitoring is Connection Monitor's specific role.

Answer: A
Traffic Analytics is a cloud-based solution built on top of NSG flow logs that processes the raw log data into rich visualizations, including top talkers, traffic distribution, and trends over time, exactly matching the analytical dashboard capability requested. NSG flow logs by themselves are raw JSON records of allowed and denied flows; they do not include built-in visualization or trend dashboards without Traffic Analytics processing that data. IP flow verify answers a single point-in-time question about whether a specific flow is allowed or denied; it does not aggregate historical flow logs into trend visualizations. Connection troubleshoot performs an on-demand connectivity test between two endpoints; it has no capability to visualize historical NSG flow log patterns across a subscription.

Answer: A
Sending diagnostic logs to a storage account is the most cost-effective option for long-term archival when logs are needed only occasionally for auditing rather than real-time analysis, and retention policies can be configured on the storage. Log Analytics workspaces provide powerful real-time querying but incur higher per-GB ingestion and retention costs, which is unnecessary if the logs are mainly for later compliance lookups. Sending to an Event Hub with no consumer just streams data without any retention or storage, so the logs would be lost. The Activity log captures control-plane subscription events and has its own fixed retention; it is not a destination for resource-level diagnostic logs like SQL Database query/audit logs.

Answer: A
Activity log alerts are specifically designed to fire based on the occurrence of a particular control-plane operation recorded in the Activity log, such as a new role assignment being created, matching the requirement to react to that administrative event rather than a metric threshold or log query result. Metric alerts evaluate numeric time-series signals like CPU percentage against a threshold; they are not built to detect discrete control-plane events like a role assignment. A log search alert can, in fact, be configured against Activity log data ingested into a Log Analytics workspace, so claiming it can never detect Activity log events is incorrect, though the purpose-built Activity log alert type is the more direct fit here. An action group defines the notification and automation actions an alert rule invokes; it is not itself a type of alert rule or a way to detect an event on its own.

Answer: B
Alert processing rules can be scoped to specific alerts or resources and configured with a schedule, such as a four-hour maintenance window, to suppress notifications during that period while leaving the underlying alert rules fully intact and automatically resuming notifications afterward. Deleting and recreating alert rules is a destructive, error-prone workaround that loses rule history and configuration, when a purpose-built suppression feature already exists for exactly this scenario. A CanNotDelete lock only prevents deletion of the locked resource; it has no relationship to whether an alert's notifications are suppressed. Disabling action groups permanently would stop all notifications indefinitely for every alert using them, not just for the maintenance window, and would require manual re-enabling rather than automatically resuming as requested.

Answer: B
VM insights combines the Azure Monitor Agent for performance and log telemetry with the Dependency Agent, which specifically discovers process-level network connections between machines, to render a visual map of dependencies correlated with performance data, matching the scenario precisely. The Azure Monitor Agent alone collects metrics, logs, and events, but it does not by itself discover inter-process network dependencies; that discovery is the Dependency Agent's specific job as part of VM insights. Network Watcher's topology view visualizes the layout of network resources like VNets, subnets, and NICs within a resource group; it does not build a process-level, performance-correlated dependency map across VMs. Azure Advisor issues best-practice recommendations for cost, reliability, security, and performance; it does not generate a visual dependency map of VM communications.

Answer: A
The where operator filters rows based on a condition such as Computer == 'WebVM01', and summarize with an aggregation function like count() grouped by a column such as OSType produces the requested grouped counts, which together match the two required steps exactly. project selects which columns to keep or computes new ones; it does not filter rows based on a condition, so it cannot perform the Computer-equality filter. take (or limit) returns a specified number of rows from the result set without any filtering condition, and distinct returns unique combinations of specified columns rather than counts grouped by a column. join combines rows from two tables based on matching keys and is unrelated to single-table row filtering, while render only affects how results are visualized, not how they are aggregated.

Answer: B
project explicitly selects a subset of columns to return, such as TimeGenerated and Computer, and take (or limit) restricts the result set to a specified number of rows, such as 20, which together produce exactly the narrowed, row-limited output requested. summarize aggregates data into summary rows based on grouping and aggregation functions; it does not simply pass through a chosen subset of original columns, and where filters rows by condition rather than limiting a row count. extend adds new computed columns to the result rather than restricting to only the chosen existing columns, and distinct removes duplicate rows rather than capping the total row count. render is a visualization-only operator that has no filtering or projection effect, and join merges two tables together rather than limiting a single result set's row count.

Answer: D
Azure Monitor metrics are a lightweight, time-series data type collected and stored in a way that supports evaluation and alerting on a near-real-time basis, typically within a minute or two, making them the right choice when detection speed matters more than deep analytical flexibility. Logs sent to a Log Analytics workspace generally have higher and more variable ingestion latency than metrics, so assuming identical near-real-time latency to metrics is inaccurate for this use case. The Activity log records control-plane management operations like resource creation or deletion; it does not capture VM-level performance data such as CPU utilization at all. Diagnostic settings sending data to a storage account are intended for low-cost archival and are the slowest, least suitable option for near-real-time alerting, not the fastest.

Answer: D
A newly created Log Analytics workspace defaults to 30 days of retention for most Analytics tables, with specific exceptions such as the Usage and AzureActivity tables (and several Application Insights tables) that default to 90 days of free retention, which is the documented out-of-the-box behavior. Not every table defaults to 90 days; that duration applies only to the specifically documented exception tables, while most tables default to 30 days. 7 days is not the default retention period for a new workspace's Analytics tables, and would understate the actual documented default significantly. Retention is not unlimited by default; a defined default period (30 or 90 days depending on the table) applies from the start, and any extension beyond that requires explicit configuration up to the supported maximum.

Answer: D
Azure Backup uses Backup vaults for newer workloads such as Azure Blob, Azure Database for PostgreSQL flexible server, and Azure Disk backup, which are distinct from the Recovery Services vault used for VMs, SQL Server in a VM, SAP HANA in a VM, and Azure Files, so the PostgreSQL and disk backups belong in a Backup vault rather than the existing Recovery Services vault. A single Recovery Services vault does not support every workload type Azure Backup offers; newer datasource types specifically require a Backup vault instead. Recovery Services vaults have not been retired and continue to be used for their supported workloads like VMs and SQL Server in a VM; the reason PostgreSQL and disks go elsewhere is workload-type routing, not deprecation of Recovery Services vaults. Both Azure Database for PostgreSQL flexible server and managed disks are explicitly supported Azure Backup datasource types, just through the Backup vault rather than a Recovery Services vault.

Answer: A
Azure Backup policies support layered retention tiers so that within one policy, daily, weekly, monthly, and yearly recovery points can each be kept for a different configured length of time, which is exactly the structure described. Instant restore refers to a short-term, snapshot-based capability that enables fast restores without immediately moving data to the vault; it is a distinct mechanism from the long-term daily/weekly/monthly/yearly retention tier structure of the policy. Soft delete protects backup data from accidental or malicious deletion by retaining it recoverably for a period after a delete request; it is not the feature that defines differentiated retention lengths per recovery point cadence. Cross Region Restore allows restoring from a secondary region's replicated recovery points; it does not define or structure the daily/weekly/monthly/yearly retention tiers within a policy.

Answer: B
Azure Site Recovery provides built-in alerting and notification capability tied to replication health and RPO thresholds, so the team can configure alerts that fire proactively when replication falls behind its target objective, rather than discovering the gap only during an actual failover attempt. A resource lock only controls whether the VM resource can be deleted or modified via Resource Manager; it has no monitoring or alerting relationship to replication health or RPO. Blob lifecycle management governs tiering and expiration of blob data in a storage account; it has no connection to Site Recovery replication monitoring. A stored access policy defines shared SAS constraints for blob or file access; it has no role in reporting on Site Recovery replication health or RPO status.

Answer: C
A test failover creates and runs the recovery plan in an isolated network that does not interfere with ongoing replication or the live production environment, which is precisely the safe, non-disruptive validation exercise the team wants to perform before a real failover. An unplanned failover is used for actual disaster scenarios (such as an unexpected outage) and does affect the live environment and ongoing replication; it is not a validation-only exercise. A planned failover is used for expected, orchestrated failovers such as scheduled maintenance and does involve the real environment and typically requires stopping the source VMs, rather than running in an isolated test network by default. A resource lock only prevents deletion or modification of the locked resource via Resource Manager; it has no capability to simulate or perform a failover of any kind.

Answer: C
The effective security rules feature evaluates every NSG applied at both the subnet and the NIC for a given network interface and presents the combined, prioritized ruleset that actually governs its traffic, exactly the aggregated view the administrator wants instead of manually cross-referencing two rule sets. IP flow verify answers whether one specific described packet (a given source, destination, port, and protocol) would be allowed or denied; it is a targeted test of one flow, not a static aggregated listing of every effective rule on the NIC. Connection Monitor performs ongoing, scheduled reachability and latency checks between endpoints; it does not compute or display a NIC's combined NSG rule set. NSG flow logs record which individual rule matched each observed traffic flow over time; they show outcomes for actual traffic that occurred, not a precomputed, complete combined rule listing for the NIC independent of any specific traffic.

Answer: A
Global VNet peering connects VNets across regions using the Microsoft backbone network, enabling low-latency private IP communication without traversing the public internet, which is exactly what's needed here. A site-to-site VPN, while it can connect networks, typically uses IPsec tunnels over the public internet (or ExpressRoute) and is more commonly used for on-premises-to-Azure connectivity, adding unnecessary encryption/tunneling overhead compared to native peering for VNet-to-VNet in the same cloud. NAT gateways provide outbound internet connectivity for private resources; they do not establish private connectivity between two VNets. Assigning public IPs to VMs and exposing them via NSG rules routes traffic over the public internet and increases the attack surface, which conflicts with the requirement to avoid the public internet.

Answer: C
Private DNS zones resolve names within linked virtual networks and can register records automatically, keeping internal topology unpublished. C is correct. A is wrong because publishing private addresses in a public zone discloses internal network structure to anyone who queries it. B is wrong because maintaining hosts files by hand does not scale and drifts out of date immediately as addresses change. D is wrong because permitting DNS traffic through an NSG only allows queries to reach a resolver; it creates no records and provides no custom hostname resolution by itself.

Answer: C
Azure Private DNS zones allow custom domain names to be resolved within linked virtual networks without exposing those records to the public internet, and the same zone can be linked to multiple VNets for consistent internal name resolution. The default Azure-provided DNS only resolves Azure-internal hostnames automatically assigned to resources; it does not support custom private domain names like corp.internal. Public DNS zones are designed for internet-facing name resolution; there isn't a 'private visibility' toggle that turns a public zone into an internal-only one — that is what Private DNS zones are for. Simply opening port 53 outbound via an NSG rule does not create or host any DNS records; it only permits DNS traffic to flow, which is unrelated to actually defining the custom names.

Answer: C
VNet peering is explicitly non-transitive: a direct peering only connects the two VNets it was created between, so VNet-A having no direct peering with VNet-C means traffic does not automatically flow through VNet-B, and reaching VNet-C from VNet-A would require either a direct peering between them or a routing/NVA-based hub-and-spoke design. Peering is not transitive regardless of how many hops separate the VNets; each pair needs its own explicit peering relationship for direct connectivity. The date peerings were created has no bearing on whether traffic can transit through an intermediate VNet; transitivity is an architectural property of peering, not a time-based one. An NSG in VNet-B could additionally block traffic, but the connection already fails by default due to non-transitivity even before considering whether any NSG rules exist.

Answer: D
Health probes continuously check each backend instance, and the load balancer removes instances that fail the probe from the pool of eligible targets for new connections, distributing new traffic only among instances currently reporting healthy, which keeps the application available despite one failing instance. The load balancer does not ignore probe results; instances failing the probe are specifically excluded from receiving new connections, so an equal four-way split regardless of health status is incorrect. A single unhealthy backend instance does not take the entire frontend offline; the load balancer continues serving traffic through the remaining healthy instances. A Standard Load Balancer does not delete or replace VM instances itself; that kind of self-healing behavior belongs to constructs like a Virtual Machine Scale Set's instance repair policy, not the load balancer.

Answer: B
Application security groups let administrators group VM network interfaces under a logical name, such as WebTier or DataTier, and reference that group directly in NSG rules, so the rule's meaning stays correct automatically as VMs are added to or removed from the group, without hand-maintained IP lists. NSGs applied at the subnet level still filter by IP-based rules unless application security groups are used within them; subnet-level application alone does not create logical, name-based grouping. Route tables control next-hop routing for traffic and have no concept of referencing named security groups inside NSG rules. Availability sets are a compute placement construct for fault and update domain distribution; VM membership in one has no automatic effect on NSG rule grouping.

Answer: C
Microsoft documents that while a gateway subnet as small as /29 is possible, that minimum applies only to the Basic SKU, and all other gateway SKUs, including VpnGw2AZ, require a gateway subnet of /27 or larger, with a larger size recommended to leave room for future configurations such as ExpressRoute coexistence. A /29 subnet is only sufficient for the Basic SKU; using it for VpnGw2AZ would not meet the documented minimum for that SKU. Azure does not mandate an exact /24 size for zone-redundant SKUs; /27 or larger is the requirement, and /24 is simply one valid larger option, not a mandated exact size. GatewaySubnet does have documented minimum size requirements tied to the SKU in use; it is not unconstrained for non-Basic SKUs.

Answer: D
Policy-based and route-based gateways are built on different underlying platforms, and Microsoft's own guidance is explicit that a policy-based gateway cannot be converted to route-based in place; the existing gateway must be deleted and a new route-based gateway created to get route-based capabilities like point-to-site. There is no in-place settings toggle that converts the VPN type from policy-based to route-based; the platform difference means a new gateway resource is required. Point-to-site VPN specifically requires a route-based gateway, so enabling it on an unconverted policy-based gateway is not supported regardless of SKU. Changing the SKU alone does not change the underlying VPN type; SKU and VPN type (policy-based versus route-based) are separate settings, and no SKU change automatically performs the conversion.

Answer: A
Point-to-Site VPN is designed exactly for this scenario: individual client devices establish their own VPN connection into a virtual network on demand, without requiring a dedicated on-premises VPN device or fixed site-to-site tunnel, which fits 200 individually connecting home laptops. Site-to-Site VPN connects an entire on-premises network (behind a VPN device with a stable public IP) to a VNet as a persistent network-to-network tunnel; it is not designed for individual roaming laptops each acting as their own site. VNet-to-VNet connects two Azure virtual networks to each other using gateway-to-gateway connections; it has no role in connecting an individual client device to a VNet. ExpressRoute provides a private, dedicated circuit between on-premises infrastructure and Azure via a connectivity provider; it is not used for ad hoc individual client connections from home laptops.

Answer: B
The Standard public IP SKU supports availability zone placement and is secure by default, meaning inbound traffic must be explicitly allowed by an associated NSG rather than being open by default, matching both stated requirements. Basic SKU does not support the same zonal guarantees as Standard and is not secure by default in the same way; it is also being retired in favor of Standard. Basic SKU is not the one associated with default openness in a way that matters here, and it lacks the zonal support requested regardless. Standard SKU is documented as secure by default, requiring explicit NSG permission for inbound traffic, which is the opposite of allowing all inbound traffic unless explicitly blocked.

Answer: C
Front Door's Latency routing method selects origins within an acceptable latency sensitivity range of the fastest measured origin and then, if origins tie within that range, applies each origin's configured weight to split traffic between them, exactly matching the tie-breaking behavior described. Priority routing selects the highest-priority healthy origin as primary and only falls to a lower priority origin if the higher one is unavailable; it is not the mechanism that applies weights to origins tied on latency. Weighted routing alone distributes traffic purely by weight, without first narrowing the candidate origins by a latency sensitivity range, which is not what is described here. Session affinity keeps a given user's subsequent requests on the same origin they were first routed to; it is not itself a routing method based on measured latency to select the initial origin.

Answer: D
Azure Front Door is a global, layer-7 service offering HTTP/HTTPS routing, edge caching, and web application firewall capabilities, suiting the public-facing application, while Azure Traffic Manager works purely at the DNS level to direct clients to one of several endpoints without inspecting or proxying the actual traffic, suiting the internal, endpoint-agnostic DNS routing need. Swapping the two reverses their actual capabilities: Traffic Manager has no edge caching, WAF, or HTTP-layer routing, and Front Door does inspect and proxy traffic rather than being a pure DNS mechanism. Front Door operates as an HTTP-aware reverse proxy, not a DNS-only mechanism, so it does not fit a scenario explicitly requiring no Azure-side traffic inspection. Azure Load Balancer operates within a single region at layer 4 for backend pools in one VNet; it is not a global, cross-cloud DNS or HTTP routing service for independently managed endpoints.

Answer: A
Azure NAT Gateway explicitly takes precedence over other outbound connectivity methods, including a load balancer's outbound rules, instance-level public IPs, and default outbound access, for all new connections once it is attached to a subnet, so new flows use the NAT gateway. Load balancer outbound rules are documented as being superseded by an attached NAT gateway for new connections, not the other way around. Default outbound access is the lowest-precedence, implicit fallback and is overridden by any explicit outbound method, including a NAT gateway, once one is configured. Precedence among outbound methods is determined by which explicit methods are attached and Azure's documented precedence order, not by which was configured chronologically first.

Answer: B
A user-defined route (UDR) that targets the 0.0.0.0/0 address prefix with the NVA's private IP address as the next hop overrides the subnet's default system route to the internet, forcing all outbound traffic through the appliance for inspection, which is the standard forced-tunneling pattern. The built-in system default route sends traffic with destination 0.0.0.0/0 directly to the internet; it does not route through an NVA unless a UDR explicitly overrides it. An NSG rule can block or allow traffic based on rules, but it cannot redirect traffic to a different next hop; only routing constructs like UDRs control the path traffic takes. Service endpoints optimize and secure routing to specific Azure PaaS services over the Microsoft backbone; they do not implement general-purpose forced tunneling of all outbound traffic through an NVA.

Answer: C
Custom port configuration, native client support, and the shareable link feature are all documented as requiring the Standard SKU or higher; the Basic SKU does not include them. Basic SKU is the entry-level tier and explicitly lacks custom ports, native client connectivity, and shareable links, so it does not meet the stated requirements. Because these are Standard-and-above features, they are not available on every SKU including Basic, contradicting that claim directly. The Developer SKU is a lightweight, browser-only offering intended for individual quick access scenarios and does not carry the full premium feature set (like shareable links or session recording) the way Standard or Premium tiers do.

Answer: B
Augmented security rules let a single NSG rule specify multiple source and destination IP prefixes, multiple ports or port ranges, and multiple application security groups together, collapsing what would otherwise require many near-duplicate rules into one, matching the scenario exactly. Classic (non-augmented) rules are limited to a single source prefix, destination prefix, and port per rule, so they do not support combining three application security groups, two IP ranges, and two ports in one entry. Effective security rules is a reporting view that shows the combined result of NSGs applied at subnet and NIC level for a given VM; it is not an authoring capability for writing rules with multiple values. Service tags represent a predefined group of IP prefixes for an Azure service, such as Storage or Sql; a service tag alone does not provide the ability to combine multiple ports and multiple application security groups in a single rule.

Answer: A
When an Azure DNS public zone is created, Azure assigns a set of name servers, and the domain must be delegated to Azure DNS by updating the NS records at the domain registrar to those assigned name servers, which is what allows global resolvers to find and query the zone. Registrar-side delegation is required; without updating the NS records at the registrar, global resolvers have no way to know that Azure DNS is authoritative for the domain. An A record maps a name to an IPv4 address and is not how delegation to a different DNS zone/name server set is configured; delegation is done via NS records, not a resource-ID-based A record. Private DNS zones are for name resolution within linked virtual networks and have no registrar delegation mechanism at all, since they are not intended to be resolvable from the public internet.

Answer: B
A private endpoint provisions a network interface with a private IP address from the VNet's address space for the PaaS resource, letting it be reached over a private IP, while a service endpoint instead optimizes routing and restricts access over the service's existing public IP to only the selected subnets, without giving the service a private VNet address. A service endpoint explicitly does not give the PaaS service a private IP; it keeps traffic on the service's public endpoint while tightening which subnets can reach it, the opposite of what's claimed. The two mechanisms behave differently with respect to private IP addressing, so they are not functionally equivalent for this specific requirement. The distinguishing factor relevant to this scenario is the private-IP-addressing capability, not relative cost, and cost is not the reason a private endpoint is required here.

Answer: A
Cross-tenant access settings let two Microsoft Entra tenants define organization-level trust and collaboration defaults, including B2B direct connect for seamless access without individual invitations, which is the intended mechanism for ongoing, mutually governed access between partner organizations. Inviting each user individually as a guest is the standard B2B flow for smaller-scale, ad hoc collaboration, but it does not scale to an organization-wide trust relationship and still requires per-person invitations. Granting Global Administrator in each other's tenant is a severe overprivilege that has nothing to do with establishing collaborative trust and would violate least-privilege principles. Merging into a single shared tenant is a drastic identity consolidation, not a form of cross-tenant collaboration, and is not what was requested.

Answer: C
External collaboration settings control who in the tenant is allowed to invite B2B guest users, and can be restricted to admins and users in specific roles, or to members of a designated group such as Partnerships, which matches the requirement precisely. Conditional access governs sign-in conditions for identities that already exist and does not control who is authorized to send an invitation. A ReadOnly management group lock only blocks changes to Azure resource configuration, not directory invitation permissions. A Policy deny effect on role assignments blocks RBAC changes on Azure resources and has no bearing on Entra ID guest invitations.

Answer: D
Cost Management budgets let an administrator define a spending amount and one or more percentage-based alert conditions, such as 80 percent, that trigger an email notification (optionally through an action group) as soon as the threshold is crossed, which is exactly the proactive alerting requested. Azure Advisor generates best-practice and cost-optimization recommendations for review; it does not send threshold-crossing alerts tied to a specific budget amount. A CanNotDelete lock only prevents resource deletion; it does not track spending or stop new charges from accruing. Azure Policy audits resource configuration against rules; it has no native concept of a monthly spending threshold or budget alert.

Answer: A
Administrative units restrict a directory role, such as Helpdesk Administrator or User Administrator, to a defined subset of users or groups, which is exactly the department-scoped delegation requested. A dynamic group with a subscription-level Contributor role controls Azure resource management, not Entra ID user and license administration, and does not scope directory roles. Global Administrator has no per-department scoping option and would grant tenant-wide control, far exceeding the requirement. Management groups organize Azure subscriptions for governance and have no relationship to Microsoft Entra directory role delegation over users.

Answer: B
Group-based licensing lets an administrator assign a license product to a security group, so Microsoft Entra ID automatically licenses members added to the group and removes the license when they are removed, matching the automatic add and remove requirement exactly. Conditional access policies control sign-in requirements such as MFA and have no mechanism to assign product licenses. Azure Policy governs Azure resource compliance and deployment, not Microsoft 365 or Entra ID license assignment. A quarterly script would not react to membership changes in real time and defeats the automatic requirement.

Answer: C
The SSPR policy separately configures how many authentication methods a user must register and how many of those registered methods must be verified at the moment of reset, so raising the reset-time requirement to two methods forces a stronger check without touching registration. Registration count only determines how many methods are on file; it does not by itself change how many are challenged during an actual reset unless the reset requirement is also raised. Password expiration controls how often a password must change, not how a reset is authenticated. Sign-in frequency affects how often Conditional Access re-prompts for authentication to an application, not the SSPR verification requirement itself.

Answer: D
Bulk operations import a CSV file of user attribute changes and apply them in one pass, which is the supported, auditable way to update thousands of accounts from an HR export. Editing 3,000 profiles individually in the portal is not a reasonable bulk method and multiplies the chance of manual error. Azure Policy with a modify effect operates on Azure Resource Manager resources like virtual machines and storage accounts, not on Microsoft Entra ID user object attributes. Renaming administrative units changes a container's display name, not the department or office attributes stored on user objects.

Answer: B
Azure RBAC supports assigning a role at the individual resource scope, and doing so grants access to only that resource, which is the narrowest and correct scope for a contractor who should touch nothing else in the resource group. Assigning at the resource group would grant Contributor over every resource in that group, exceeding the stated need. Azure has no built-in mechanism to retroactively narrow a subscription-scoped assignment down to one resource after the fact; the scope must be chosen correctly when the assignment is created. Assigning at the tenant root management group is the broadest possible scope and would cascade far beyond a single storage account, the opposite of least privilege.

Answer: C
A policy initiative bundles multiple individual policy definitions into a single assignable set and reports one combined compliance percentage across all of them, matching the requirement for grouped tracking against a standard like ISO 27001. Assigning 12 policies separately works technically but produces 12 separate compliance results rather than the single combined score requested. A custom RBAC role controls who can perform which management actions and has no concept of policy compliance evaluation. A CanNotDelete lock only prevents deletion of resources; it does not evaluate configuration against encryption, network, or logging requirements.

Answer: D
The modify effect can add, update, or remove a specified property on a resource as it is created or updated, using a policy-assigned managed identity, which is exactly how an administrator would force HTTPS-only to be enabled automatically rather than just rejecting non-compliant requests. deny effects stop the deployment from happening at all if it violates the rule, which is not the same as silently fixing the property for the requester. audit effects only mark a resource as non-compliant in the compliance dashboard and take no corrective action. disabled effects turn off the policy rule entirely, which would evaluate and correct nothing.

Answer: B
auditIfNotExists evaluates whether a related resource, such as a VM extension, exists and marks the parent resource as non-compliant if it does not, without preventing the original deployment, which matches the requirement to flag rather than block. append only inserts a specified field or value into the request body during creation; it does not check for a separate related resource like an extension. deny would stop VM creation entirely until the extension is present, which is explicitly not wanted here. deployIfNotExists can deploy a related resource to fix non-compliance, but it does not correct anything automatically without an associated remediation task providing the permissions and trigger to run it.

Answer: B
Microsoft documents a management group hierarchy limit of six levels of depth, and that limit does not include the root level or the subscription level itself, so with five custom levels already in place, only one further level fits before the limit is reached. Azure does not support eight custom levels; the documented cap is six. The hierarchy is not unlimited in depth, unlike some other Azure grouping constructs. Five levels is not the maximum; up to six levels of custom management groups are supported before the limit is hit.

Answer: C
Built-in policy definitions with the modify effect can inherit a tag value from a parent scope, such as a resource group, and apply it automatically to resources as they are created, removing the need for manual tagging. Tags set on a subscription do not automatically propagate down to resource groups or resources; each Azure Resource Manager object holds its own independent set of tags. Renaming the resource group changes only its display name, not the tags attached to the resources created inside it. A ReadOnly lock prevents changes to the locked resource group itself and has no effect on tagging of newly created child resources.

Answer: A
Azure Advisor continuously analyzes resource utilization telemetry and surfaces cost recommendations such as resizing or shutting down virtual machines that are consistently underutilized, which is precisely the kind of proactive right-sizing guidance requested. The Activity log is an audit trail of control-plane operations that already happened; it does not analyze utilization or generate forward-looking suggestions. Policy compliance results show adherence to governance rules, not utilization-based cost recommendations. A Recovery Services vault's job history reports on backup and restore activity, unrelated to VM sizing or cost efficiency.

Answer: B
Changing a subscription's associated Microsoft Entra directory (transferring it to another tenant) keeps the subscription's resources intact, but role assignments, some resource-level Azure AD dependencies, and service principals tied to the original tenant do not automatically transfer and must be reviewed and recreated in the new tenant. A standard resource-group move operation works only within the same tenant hierarchy and cannot relocate a subscription to a different Microsoft Entra tenant. Subscriptions are explicitly bound to one Entra tenant at a time; they do not shift based on which account last signed in. Deleting and recreating every resource is unnecessarily destructive and risks data loss when a supported subscription transfer process exists.

Answer: C
DataActions is the dedicated section of an RBAC role definition for permissions on the data plane, such as reading or writing blob content, which is distinct from Actions covering control-plane management of the storage account resource itself, so granting blob read/write requires listing the relevant Microsoft.Storage/storageAccounts/blobServices/containers/blobs DataActions. Actions alone governs control-plane operations like creating or configuring the storage account and does not extend to the data inside it. AssignableScopes only restricts where the role definition can be assigned, such as a particular subscription; it has no bearing on what operations are permitted. NotActions subtracts permissions from what Actions grants; listing something there removes access rather than granting it.

Answer: D
Deny assignments, which Azure creates automatically for managed applications and some Blueprint-deployed resources, block specified actions on a scope even for principals who hold an Owner or Contributor role assignment there, which is how a vendor can protect a managed application's internals from the customer's own administrators. A ReadOnly lock is something administrators apply themselves and would not have been set up by the customer to restrict their own access unintentionally. RBAC role assignments do not expire automatically after 90 days by default; that is not how Owner permissions work. Custom roles do not silently override other role assignments; RBAC assignments are additive, and only an explicit deny assignment can block access that a role assignment would otherwise allow.

Answer: A
PIM for Groups extends just-in-time activation to group membership itself, so eligible members can activate membership in a group that already carries the Contributor role, with approval workflows and automatic expiration, meeting the requirement to manage this at the group level instead of five individual assignments. A dynamic group based on job title still grants standing, always-on membership and access, which is the opposite of time-limited elevation. Making five separate PIM-eligible role assignments on the subscription achieves just-in-time access but does not use the group-based approach the scenario asks for and multiplies administrative overhead. Conditional access controls sign-in conditions like device compliance; it does not provide time-limited activation or approval workflows for role or group membership.

Answer: D
Azure RBAC role assignments support security groups and mail-enabled security groups as principals, but plain distribution lists are not a supported principal type for role assignment, which explains why it does not appear as an option. RBAC assignment is not limited to individual users; security groups, service principals, and managed identities can all be assigned roles. Membership size is not the blocking factor for distribution lists; the group type itself is unsupported regardless of how many members it has. Conditional Access governs sign-in conditions and has no relationship to which group types can receive RBAC role assignments.

Answer: B
Dynamic membership groups evaluate a rule against user or device attributes, such as department equals Sales, and automatically add or remove members as those attributes change, which is exactly the hands-off, attribute-driven membership described. Assigned membership groups require an administrator to manually add or remove each member; they do not react to attribute changes on their own. A Microsoft 365 group configured only for email distribution is aimed at collaboration and mailing, not automated RBAC-style resource access management. An administrative unit with automatic membership disabled would require manual management, which again fails the automatic requirement.

Answer: C
A savings plan commits to a fixed hourly dollar amount rather than a specific VM size or region, and that commitment automatically applies across eligible compute usage as sizes or regions shift, which suits a team that wants savings without being locked to today's exact SKU. A one-year reserved instance for the exact D-series size does reduce cost, but it is scoped to that SKU and offers less flexibility if the workload later needs a different VM family or size. Spot pricing offers deep discounts but instances can be evicted with little notice, which is not appropriate for a workload that must run continuously. Azure Hybrid Benefit reduces licensing cost for eligible Windows Server or SQL Server workloads by reusing on-premises licenses; it does not itself provide a compute-usage discount the way a savings plan or reservation does.

Answer: D
A policy exemption excuses a specific scope, such as one subscription, from an inherited policy or initiative assignment, and can be given an expiration date so the exception automatically lapses after the pilot period, which precisely matches a time-limited, narrowly scoped exception. Deleting the assignment at the management group removes the location restriction for every subscription under it, far broader than intended and undermining governance elsewhere. A ReadOnly lock affects who can modify a resource; it has no relationship to Azure Policy evaluation and cannot override a policy's effect. Reassigning the same policy with a different effect at the subscription does not exempt it from the inherited management-group assignment, since both would still be evaluated together.

Answer: D
Contributor grants full read/write management of resources in scope but explicitly excludes the ability to modify role assignments, which matches the requirement. Owner includes everything Contributor has plus the ability to assign roles to other users, exceeding the requirement. Reader only allows viewing resources, not managing them. User Access Administrator manages role assignments but does not by itself grant broad resource management rights.