AZ-900 and Azure fundamentals interview questions

Model answer

Cloud computing means using computing services such as servers, storage, databases and software over the internet from a provider like Microsoft, instead of buying and maintaining my own hardware. I create what I need on demand and usually pay only for what I use.

You

Gmail or Outlook.com is cloud software: I never install a mail server. For a business example, an online exam site can rent 50 extra servers during exam week and release them afterwards, paying only for that week.

Model answer

The NIST definition lists five: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. A rented server you order by email and pay for yearly is hosting, not cloud. Cloud means I can provision it myself through an API in minutes, scale it up or down quickly, and pay based on metered usage.

Model answer

No. Cloud changes the cost model from capital expense to operating expense and removes idle capacity, but a steady, always-on workload lifted as-is onto pay-as-you-go VMs can cost more than amortised hardware. The savings come from right-sizing, autoscaling, reservations, managed services that cut operational effort, and speed. I always frame it as total cost of ownership and business agility, not raw unit price.

You

Strict data residency or sovereignty rules that a cloud region cannot meet, ultra-low-latency needs next to factory machines, heavy recent hardware investment that is not yet depreciated, or legacy systems that cannot be moved. Often the answer is hybrid rather than all-or-nothing.

Model answer

This is the classic spiky workload. On-premises they would have to buy enough servers for results day and leave them idle for 364 days. In the cloud they can scale out automatically for the peak, or use a platform service that autoscales, and scale back in afterwards, paying for the extra capacity only on the busy day.

Model answer

Azure is Microsoft's public cloud. A company can rent virtual machines, host websites and APIs, store files and backups, run managed databases, build AI features and connect it all with secure networks, without buying hardware. It pays for what it uses and can deploy in many regions worldwide.

You

Through the Azure portal in a browser, the Azure CLI or PowerShell from a terminal, or as code with ARM templates, Bicep or Terraform. In real projects we prefer infrastructure as code so environments are repeatable.

Model answer

Common reasons are an existing Microsoft relationship (Microsoft 365, Windows Server, SQL Server licences that can be reused with Azure Hybrid Benefit), identity integration with Microsoft Entra ID, strong hybrid tooling such as Azure Arc, enterprise compliance offerings, and a broad AI portfolio. The technically honest answer is that all the major clouds can run most workloads. The decision is usually about skills, licensing, existing contracts and specific services.

Model answer

The global infrastructure (regions, availability zones, the Microsoft backbone network); the control plane, Azure Resource Manager, which every create, update and delete call goes through; the identity plane, Microsoft Entra ID, for who can do what; and the data plane of each service where the actual work happens. Thinking in those layers helps when you troubleshoot. A portal outage is a control-plane problem; your VM may still be serving traffic.

Model answer

No. They can host the web app on a managed platform such as Azure App Service, store data in a managed database, and put images in Blob Storage. Everything is created in minutes and billed by usage, so they can start small and scale as users grow. They should set a budget alert from day one.

Model answer

First, cost. No big up-front hardware purchase, and you pay for what you use. Second, speed. Servers are ready in minutes instead of weeks. Third, scale. You can handle traffic spikes and expand to new countries without building datacenters.

You

Yes. Costs can grow if nobody manages them, you depend on the provider and your internet connectivity, and you still own security for your data and identities. Moving also takes effort and new skills.

Model answer

I would avoid jargon and talk about outcomes. We can launch new ideas in days, we stop paying for idle servers, the website stays up on our busiest days, and our engineers work on features customers see instead of maintaining hardware. Then I would back it with numbers from a pilot or a TCO comparison.

Model answer

Lift-and-shift without right-sizing, so oversized VMs run 24/7. No tagging or ownership, so nobody is accountable for spend. Ignoring reservations and savings plans for steady workloads. Data egress and cross-region traffic left out of estimates. Keeping old operating models such as manual change tickets, so the agility gains never appear. FinOps practices and architecture changes towards managed services and autoscaling are what unlock the value.

Model answer

They can rent GPU capacity only for the weeks the analysis runs, use managed AI services, and store data in a region that meets healthcare compliance requirements. Buying GPU servers for a one-off project would be slow and expensive, and the hardware would sit idle afterwards.

Model answer

On-premises means the company owns and runs its own servers, so it handles purchasing, power, cooling, security and repairs. Cloud means renting those resources from a provider like Azure over the internet. The provider runs the physical side and the company pays for what it uses.

You

On-premises gives full control over hardware and the physical environment. The cloud trades some of that low-level control for speed, scale and less maintenance, while you still control your configuration, data and access.

Model answer

Power and cooling, floor space or datacenter leases, physical security, hardware support contracts, spare parts, the hardware refresh every few years, backup and disaster-recovery sites, software licences and, above all, staff time to run it. A server's purchase price is usually a small part of its total cost of ownership.

Model answer

When latency to on-site equipment is critical (manufacturing control systems), when data sovereignty or contractual rules cannot be met by any available region, when there is a large, steady workload on recently purchased hardware, or when the application is tightly coupled to mainframes or hardware that cannot move. Even then, I would look at hybrid patterns, managing on-premises servers with Azure Arc or running Azure services on-premises with Azure Local, to get cloud-style management.

Model answer

This is a classic trigger for migration. I would assess workloads with Azure Migrate, move the straightforward ones (lift and shift to VMs, or replatform to PaaS where cheap to do), retire unused systems, and keep anything that truly must stay on-premises in a smaller hybrid footprint. That avoids a costly hardware refresh and a new lease.

Model answer

A public cloud is computing infrastructure that a provider owns and runs, and that anyone can sign up to use over the internet. Microsoft Azure, AWS and Google Cloud are examples. You do not buy any hardware; you create resources when needed and pay for usage.

You

No. "Public" refers to who can become a customer, not who can see your data. Each customer's resources and data are isolated and protected by identity, encryption and network controls.

Model answer

Advantages are no capital expense, near-unlimited scale, a pay-as-you-go model, global reach, and no hardware maintenance. Disadvantages are less control over the physical infrastructure and its location, possible difficulty meeting very specific compliance requirements, dependency on the provider and on network connectivity, and costs that need active management.

Model answer

Providers isolate tenants at the hypervisor, network and storage layers and publish their isolation design. For workloads with strict requirements, Azure offers Dedicated Hosts, isolated VM sizes and confidential computing with hardware-based trusted execution environments, which protect data while it is in use. Performance noisy-neighbour effects are managed with resource governance, and premium tiers come with defined performance targets. The real risks in practice are much more often misconfiguration and weak identity than cross-tenant attacks.

Model answer

The public cloud. No capital spending, resources in minutes, pay only for what they use, and the ability to scale with growth. A private cloud would require hardware and skills they do not have.

Model answer

A private cloud is cloud infrastructure that only one organisation uses. Its teams get cloud features like self-service and automation, but the hardware is dedicated to that organisation, often in its own datacenter.

You

No. A server room where people raise tickets and wait days for a VM is just traditional on-premises IT. It becomes a private cloud when it offers on-demand self-service, pooled resources, automation and usage metering.

Model answer

Private cloud gives maximum control over hardware, location and configuration, but the organisation pays up front (CapEx), maintains everything and has limited capacity. Public cloud has no up-front cost, near-unlimited scale and no hardware maintenance, but less physical control.

Model answer

Building the cloud experience is hard. Self-service portals, APIs, metering, automation and fast provisioning take serious engineering, and many projects end up as virtualisation with a ticket system. They also keep the fixed-capacity problem and the hardware refresh cycle. That is why many organisations now prefer hybrid, using public cloud for elastic workloads and cloud-managed on-premises platforms such as Azure Local with Azure Arc for what must stay local.

Model answer

A private cloud for that sensitive workload, ideally one that is cloud-managed so developers get self-service and consistent tooling. Less sensitive workloads can still go to the public cloud, or a sovereign or government cloud, in a hybrid design.

Model answer

It is a mix of public cloud and private or on-premises infrastructure that work together. For example, a company keeps its customer database in its own datacenter but runs its website in Azure, and the two are securely connected.

You

Usually with a site-to-site VPN over the internet (Azure VPN Gateway) or a private dedicated connection (Azure ExpressRoute). Identity is often unified too, with Microsoft Entra ID synchronised from on-premises Active Directory.

Model answer

Hybrid is about combining on-premises or private infrastructure with public cloud. Multi-cloud is about using more than one public cloud provider. An organisation can be both, with on-premises servers plus Azure and AWS.

Model answer

Fragmentation. Different consoles, policies, identity systems, monitoring and skill sets for each environment, which leads to inconsistent security. I would standardise identity on one provider, use a single control plane where possible (Azure Arc to project on-premises and other-cloud servers and Kubernetes into Azure, then apply Azure Policy, Defender for Cloud and Azure Monitor consistently), and use infrastructure as code with tools such as Terraform for multi-cloud deployments. Also be deliberate. Multi-cloud for its own sake doubles complexity.

You

Sometimes, but it has a price. To be truly portable you limit yourself to the lowest common denominator and give up many managed services. A pragmatic approach is to pick a primary cloud, use its managed services, and design for portability only where the business risk justifies it.

Model answer

Cloud bursting. The order system keeps running on-premises normally, and during the peak extra application instances run in Azure, connected back to on-premises over VPN or ExpressRoute. They pay for the cloud capacity only during the peak.

Model answer

IaaS means renting basic computing infrastructure, such as virtual machines, disks and networks, from a cloud provider. The provider manages the physical hardware; I manage the operating system, software and data. Azure Virtual Machines is the main example.

You

The OS and its patches, installed software and runtimes, the application, data, network configuration such as NSG rules, identities and access, and backup choices. Microsoft manages the physical server, storage hardware, network and datacenter.

Model answer

When I need full control of the OS (custom drivers, specific versions, agents), when migrating an existing app quickly without changes (lift and shift), when the software is not supported on a PaaS offering, or for workloads like custom databases or legacy line-of-business apps. The trade-off is that I take on patching, scaling and high-availability design.

Model answer

Right-size using Azure Advisor and actual utilisation, shut down or schedule non-production VMs, buy reservations or a savings plan for steady ones, and use Azure Hybrid Benefit for Windows and SQL licences. Automate patching with Azure Update Manager, protect with Azure Backup, and standardise with policy. Then plan a modernisation path, moving web tiers to App Service or containers and databases to Azure SQL, so the platform team stops managing OSes it does not need to.

Model answer

IaaS, an Azure VM with that Windows Server image. PaaS would not allow the custom installation. The company can modernise later, but IaaS gets it into Azure now with full control of the OS.

Model answer

PaaS is a cloud service where the provider manages the servers, operating system and runtime, and I just deploy my application and manage my data. Azure App Service for hosting web apps and APIs, and Azure SQL Database for managed databases, are examples.

You

My application code and its configuration, my data, who has access (identities and permissions), and some settings like network access rules. Microsoft handles OS patching, the runtime and the underlying infrastructure.

Model answer

Benefits are faster development, no OS patching, built-in scaling, high availability, backups and deployment slots, and often lower total cost because less operations work is needed. Limitations are less control over the environment (you cannot install anything on the OS), supported runtimes and versions only, platform-specific features that can increase lock-in, and service limits you must design around.

Model answer

Dependencies on the local machine (file system writes, the Windows registry, GAC components, installed COM libraries, local scheduled tasks), session state stored in memory (move it to Redis), configuration and secrets (move to app settings and Key Vault with managed identity), outbound IP and firewall needs, private connectivity to databases (VNet integration, private endpoints), and the right plan tier for scale-out and slots. Then I would set up deployment slots for zero-downtime releases.

Model answer

PaaS. App Service for the API and Azure SQL Database for data. They avoid OS patching, get autoscaling and backups built in, and can spend their time on features.

Model answer

SaaS is software you use over the internet without installing or managing it. The provider runs and updates everything. Examples are Microsoft 365 (Outlook, Teams, Word online) and Dynamics 365. Many consumer apps like web email are also SaaS.

You

The customer is still responsible for its data, the user accounts and who has access, the devices people use, and settings like multifactor authentication and sharing policies. Most SaaS security incidents come from weak passwords or over-sharing, not from the provider's infrastructure.

Model answer

Limited customisation (you work within the vendor's features), dependency on the vendor's roadmap and availability, data stored in the vendor's systems (check residency and export options), subscription costs that grow with users, and integration constraints set by the vendor's APIs.

Model answer

I would ask whether the CRM is a source of competitive advantage. If our sales process is standard, buy SaaS (for example Dynamics 365) and configure it. That is faster, cheaper to run and continuously updated. Build only the parts that truly differentiate us, perhaps as extensions on PaaS integrated through APIs. I would also weigh data residency, integration needs, total cost per user over five years, and exit strategy (data export).

Model answer

A SaaS productivity suite such as Microsoft 365. Nothing to install or maintain, available immediately, predictable per-user pricing. Turn on MFA for every account from day one.

Model answer

IaaS means renting virtual servers that you manage yourself. PaaS means renting a ready platform where you just deploy your code. SaaS means using finished software over the internet that the provider runs completely.

You

IaaS is Azure Virtual Machines. PaaS is Azure App Service or Azure SQL Database. SaaS is Microsoft 365.

Model answer

Yes, and most do. A company might use Microsoft 365 for email (SaaS), host its customer API on App Service with Azure SQL Database (PaaS), and run a legacy reporting server on a VM (IaaS). You choose per component, not per company.

Model answer

I use a "most managed first" rule. Can a SaaS product do it? If not, can it run as serverless or PaaS (Functions, App Service, Container Apps)? If it needs more control or portability, containers on AKS. Only fall back to VMs when there is a concrete reason, such as OS dependencies, licensing or specialised hardware. Each step down gives more control but adds operational cost, so the burden of proof is on going lower.

Model answer

Legacy app, IaaS (lift and shift to VMs). Customer portal, PaaS (App Service plus a managed database). Staff email, SaaS (Microsoft 365).

Model answer

It explains who looks after what in the cloud. Microsoft secures the physical side: buildings, servers and network. I am responsible for my data, my user accounts and the devices that access them. The tasks in the middle, like the operating system or applications, depend on whether I use IaaS, PaaS or SaaS.

You

Yes. Data, devices, and accounts and identities. If a user with a weak password and no MFA gets phished, that is a customer-side failure, not Microsoft's.

Model answer

On-premises and IaaS, the customer owns the OS, including patching and hardening. In PaaS and SaaS, the provider manages the OS. That is a big part of why PaaS reduces operational effort.

Model answer

Almost always on the customer side. Leaked credentials and no MFA, over-privileged identities, storage accounts or databases exposed publicly, unpatched IaaS VMs with open management ports, secrets in source code. The provider's side is rarely the weak point. That is why a cloud security programme focuses on identity (Entra ID, Conditional Access, least privilege), configuration posture (Defender for Cloud, Azure Policy) and data protection.

You

Guardrails, not guidelines. Azure Policy to deny public endpoints and require encryption or tags, management groups to apply them across subscriptions, Defender for Cloud secure score to track posture, and infrastructure as code reviewed in pull requests so misconfigurations are caught before deployment.

Model answer

The customer's. Azure SQL Database is PaaS. Microsoft manages the database engine, OS and infrastructure, but network access configuration, identities and the data are the customer's responsibility.

Model answer

It means I do not manage the servers. The cloud provider runs them, scales them and patches them. I only write the code that runs when an event happens, and usually pay only when it runs.

You

Azure Functions. For example, a function that creates a thumbnail every time someone uploads a photo to Blob Storage. It runs only when a photo arrives.

Model answer

Benefits are no infrastructure management, automatic scaling (including to zero), pay-per-execution pricing that is very cheap for spiky or low traffic, and fast development of event-driven features. Drawbacks are cold-start latency on some plans, execution time limits, harder local debugging and observability across many small functions, and costs that can exceed a dedicated service under constant high load.

Model answer

For long-running or stateful processing that does not fit function timeouts (unless Durable Functions fits), for steady high-throughput APIs where an always-on App Service or Container Apps is cheaper and has predictable latency, for latency-critical endpoints that cannot tolerate cold starts (unless I pay for pre-warmed instances), and when the team needs full control of the runtime environment. I would also be careful with chatty function-to-function designs that are hard to trace.

You

Use the Flex Consumption or Premium plan with always-ready or pre-warmed instances, keep the deployment package small, avoid heavy start-up work, and choose a language runtime with fast start-up.

Model answer

Serverless. An Azure Function triggered by the Blob Storage upload, or a Logic App with a ready-made email connector, runs only when a file arrives. There is no server to patch and the cost is close to nothing between uploads.

Model answer

It means paying for cloud resources based on how much you actually use, like an electricity bill. If I run a VM for ten hours, I pay for ten hours. If I delete it, I stop paying for it.

You

No up-front costs, no paying for idle capacity, the ability to experiment cheaply, and costs that grow and shrink with the business.

Model answer

Each service has meters. VMs are billed per second of running time by size, storage per GB per month plus operations, Azure Functions on consumption plans per execution and GB-seconds of memory, bandwidth per GB of egress, and databases by provisioned compute units or by serverless usage.

Model answer

Budgets with alerts in Microsoft Cost Management at subscription and resource-group level, tagging policies so every cost has an owner, auto-shutdown for dev/test, Azure Advisor cost recommendations, anomaly alerts, and regular reviews of the biggest meters. Watch hidden meters like egress, log ingestion, premium storage transactions and orphaned disks or public IPs after VMs are deleted.

Model answer

Under the consumption model they are billed for every hour it was running, which can be very expensive for GPU sizes. The fix is to stop (deallocate) or delete it, set a budget alert, and use auto-shutdown schedules.

Model answer

Pay-as-you-go (no commitment, standard price), reservations (commit for one or three years for a big discount), the savings plan for compute (commit to an hourly spend for a flexible discount), Spot VMs (cheap spare capacity that can be taken away), and Azure Hybrid Benefit to reuse existing licences.

You

Spot is usually the lowest price, but it can be evicted, so it only suits interruptible work. For steady workloads, reservations or savings plans give the best reliable discount.

Model answer

A reservation commits to a specific resource, such as a VM family and region, and gives the deepest discount if you use exactly that. A savings plan commits to a dollar amount per hour of compute and applies automatically across VM sizes, regions and some other compute services. It is a slightly smaller discount but much more flexible if your workloads change.

Model answer

Measure the steady baseline over a few months. Cover the very stable, predictable part with reservations (often databases and long-lived VMs), cover the remaining stable compute with a savings plan for flexibility, leave the variable portion on pay-as-you-go with autoscale, and push batch and fault-tolerant jobs to Spot. Apply Azure Hybrid Benefit wherever licences allow. Review utilisation of commitments monthly, because unused commitment is wasted money. Advisor and Cost Management show recommendations and utilisation.

Model answer

Spot VMs. Rendering is interruptible and restartable, so the deep discount far outweighs the risk of eviction. Use Scale Sets with Spot priority and checkpointing.

Model answer

CapEx is a big up-front purchase of something you own, like buying servers for a datacenter. OpEx is ongoing spending for things as you use them, like paying a monthly cloud bill. Cloud computing is mainly OpEx.

You

Buying a delivery van is CapEx. Renting a van by the day, or paying a courier per parcel, is OpEx.

Model answer

No large up-front cash outlay, costs match actual usage and revenue, no risk of stranded assets if needs change, and spending can be adjusted month by month. It also makes it easier to attribute costs to products or teams.

Model answer

Not always. Steady workloads on pure pay-as-you-go can cost more over time than owned hardware, and OpEx is less predictable if engineering does not manage it. Some organisations have capital budgets that are easier to approve than operating budget increases. Reservations and savings plans sit in between, a commitment that buys a discount. The right framing is total cost of ownership and flexibility, not OpEx versus CapEx as an ideology.

Model answer

The array is CapEx, a large immediate cash outlay, a depreciating asset, fixed capacity, and a refresh in five years. Azure Backup and Blob Storage are OpEx, paid monthly by usage, scaling with data, with no hardware to refresh. If cash flow and flexibility matter, OpEx is attractive. The decision should compare five-year TCO including staff, power and space.

Model answer

High availability means a system keeps working with very little downtime even when parts of it fail. For example, running two web servers behind a load balancer so if one crashes, the other keeps serving users.

You

With Service Level Agreements (SLAs) that state a guaranteed uptime percentage for each service, like 99.95% or 99.99%. If Microsoft misses it, customers can claim service credits.

Model answer

About 43.8 minutes per month for 99.9%, and about 4.4 minutes for 99.99%. Every additional nine cuts allowed downtime by a factor of ten.

Model answer

Both must work, so you multiply, 0.9995 × 0.9999 ≈ 99.94%, which is lower than either part. To raise it, deploy zone-redundant tiers in a region with availability zones, or run active-active in two regions behind Azure Front Door with geo-replicated data. That raises availability because a failure must hit both paths at once. Also remember the SLA is the provider's commitment for its part. Your own code, deployments and dependencies affect real availability too.

You

No. Start from the business impact of downtime. If an hour of outage costs little, a multi-region active-active design may cost more than it saves. Define availability targets with the business, then design to them.

Model answer

At least two instances of each tier spread across availability zones, zone-redundant database and storage, a load balancer or Front Door in front, health probes so unhealthy instances are removed, and deployment slots to avoid downtime during releases. Optionally a secondary region for regional failure.

Model answer

Scalability is being able to add or remove resources as demand changes. Vertical scaling makes one machine bigger or smaller, for example more CPU or memory. Horizontal scaling adds or removes machines, for example going from two web servers to six.

You

Horizontal scaling is usually preferred in the cloud because there is no upper limit set by the biggest machine, it adds redundancy, and it can happen without downtime. Vertical scaling is simple and useful for things like databases that are hard to split, but it has a ceiling and often needs a restart.

Model answer

Scalability is the ability to grow or shrink resources to handle load, which can be done manually or on a schedule. Elasticity is scalability that happens automatically and rapidly in response to real-time demand, for example autoscale adding instances when CPU goes above 70%.

Model answer

Make the tier stateless. Move session state to a distributed cache like Redis, store uploads in Blob Storage instead of local disk, externalise configuration, and make background jobs idempotent so they can run on any instance. Then check downstream bottlenecks. Scaling the web tier often just moves the bottleneck to the database, so consider read replicas, caching, partitioning or queue-based load levelling.

You

First vertically (more vCores), then with read replicas for read-heavy loads, caching, and finally partitioning or sharding, or a horizontally scalable service such as Azure SQL Hyperscale or Azure Cosmos DB, depending on the data model.

Model answer

Scale out the web and API tiers ahead of the sale (scheduled autoscale), with autoscale rules on top to handle surprises; scale up the database tier for the sale; warm the cache; and scale back in afterwards so they stop paying for the extra capacity.

Model answer

Elasticity means the cloud automatically adds resources when demand goes up and removes them when demand goes down, without anyone doing it manually. Like a rubber band that stretches and shrinks back.

You

Scalability is the ability to change resources to meet demand, which can be manual. Elasticity is when that scaling happens automatically and quickly in response to real-time demand.

Model answer

Enable autoscale on the App Service plan with a minimum and maximum instance count, a scale-out rule (for example CPU above 70% for 10 minutes, add 2 instances), a matching scale-in rule (CPU below 30%, remove 1), and cool-down periods. Optionally add schedule-based profiles for known peaks, or use automatic scaling, which scales on HTTP traffic.

Model answer

Flapping, where rules that are too sensitive or have no cool-down scale out and in repeatedly. Slow start-up, where new instances take minutes to warm up, so the peak passes first (use pre-warming, minimum instances or scheduled scale-out). Missing scale-in rules, so costs never come down. Scaling on the wrong metric, such as CPU when the real bottleneck is a queue length or database. And downstream overload, where scaling out the front end overwhelms a database that cannot scale as fast. You also need quota headroom in the region.

Model answer

Elasticity. Capacity must grow automatically within minutes and shrink straight afterwards so they do not pay for idle servers. Combine autoscale with a scheduled scale-out just before the sale opens, plus a queue for orders.

Model answer

Reliability means a system can recover from failures and keep working. Azure helps because it has regions and availability zones all over the world, so I can run copies of my app and data in more than one place and fail over if one has a problem.

You

They are related but not the same. High availability is about maximising uptime. Reliability is broader. It is about the system recovering from failures and working correctly over time, including recovering data and restoring service after a disaster.

Model answer

RTO is how quickly service must be restored after a failure; RPO is how much data loss is acceptable, measured in time. They drive design and cost. An RPO of zero needs synchronous replication; an RTO of minutes needs a warm or active standby. Backups alone give longer RTO and RPO but cost far less.

Model answer

Test failure on purpose. Run regular failover drills, restore backups into a clean environment, and use fault injection with Azure Chaos Studio to kill instances, add latency or simulate a zone outage. Observe with health models and alerts. Document runbooks and automate failover where possible. A DR plan that has never been tested is a hope, not a plan.

Model answer

RTO of one hour and RPO of five minutes. Replicate the database to a second region with asynchronous geo-replication (for example Azure SQL failover groups), keep the app deployable in the secondary region via infrastructure as code (or a warm standby), use Azure Site Recovery for any VMs, put Azure Front Door in front for traffic switching, and test the failover regularly.

Model answer

It means being able to predict how the system will perform and how much it will cost. For performance, things like autoscaling and load balancing keep the experience consistent. For cost, tools like the pricing calculator and budgets help forecast and track spending.

You

The Azure pricing calculator. After deployment, Microsoft Cost Management helps track actual and forecast spend.

Model answer

Estimate up front with the pricing calculator, set budgets with alerts in Cost Management, use cost analysis and forecasts, tag resources by owner and project, buy reservations or savings plans for steady workloads to lock in prices, and put guardrails with Azure Policy such as allowed VM sizes or regions.

Model answer

Set clear performance targets (for example p95 latency), load-test against them, autoscale on the metrics that matter, isolate noisy tenants (separate pools or throttling per tenant), use provisioned-throughput or premium tiers where consistent latency is required, cache hot data, and watch dependencies with Application Insights. The Performance Efficiency and Cost Optimization pillars of the Well-Architected Framework provide the checklists.

Model answer

A pricing calculator estimate for the planned architecture, a Cost Management budget with alerts at 50/80/100% and forecast-based alerts, cost analysis views by department using tags, and reservations covering the steady baseline so most of the bill is fixed.

Model answer

Microsoft spends heavily on security: guarded datacenters with strict physical access, protection against attacks like DDoS, encryption, a large security team, and automatic patching for managed services. Most companies could not afford that themselves. But I still have to secure my own data, accounts and configuration.

You

With IaaS I control and must patch the OS, which gives more control and more work. With PaaS and SaaS, Microsoft patches the platform, so I focus on identities, access and data.

Model answer

Microsoft Entra ID for identity with MFA and Conditional Access, Microsoft Defender for Cloud for posture and threat protection, Azure Key Vault for secrets and keys, network security groups and Azure Firewall for traffic control, Azure DDoS Protection, and private endpoints to keep PaaS traffic off the public internet.

Model answer

First, phishing-resistant MFA and Conditional Access for every identity, especially admins, because identity is the most attacked layer. Second, least privilege with Azure RBAC and Privileged Identity Management for just-in-time admin access. Third, guardrails with Azure Policy and Defender for Cloud to block public exposure of storage and databases and to surface misconfigurations. Those three prevent most real-world cloud breaches, which are identity and configuration failures, not provider failures.

Model answer

All Azure resources get basic infrastructure-level DDoS protection automatically. For stronger, tuned protection with telemetry and rapid-response support, they can enable Azure DDoS Protection on the virtual network, or put the site behind Azure Front Door with Web Application Firewall to filter malicious requests at the edge.

Model answer

Governance means having rules for how the cloud is used and making sure they are followed. For example, only allowing certain regions, requiring tags for cost tracking, or making sure storage is encrypted. In Azure, tools like Azure Policy check and enforce these rules automatically.

You

Because everything is created through software and APIs, rules can be checked and enforced automatically at creation time, and audits can run continuously instead of once a year.

Model answer

Azure Policy enforces and audits rules on resources; resource locks prevent accidental deletion or changes; management groups apply policies and access across many subscriptions; tags organise resources for cost and ownership; Microsoft Purview governs data, including discovery, classification and lineage; and Microsoft Cost Management with budgets governs spending.

Model answer

Use guardrails rather than gates. Design a management group hierarchy (for example from Azure landing zones), assign policy initiatives at the top so every subscription inherits them, use deny only for the critical rules (public exposure, allowed regions), use audit and deployIfNotExists for the rest so things are fixed automatically, and give teams self-service subscriptions inside those boundaries. Make compliance visible on a dashboard and treat policy as code in a repository with reviews.

Model answer

Assign an Azure Policy "Allowed locations" rule at the management group level, listing only EU regions. Any attempt to create a resource elsewhere is denied, and the compliance dashboard shows existing resources that violate it.

Model answer

It means the cloud is easier to manage. On one side, resources can scale automatically, be deployed from templates, be monitored and send alerts. On the other side, I can manage everything through a web portal, command-line tools or APIs from anywhere.

You

The Azure portal in a browser, Azure CLI and Azure PowerShell (also available in Azure Cloud Shell), REST APIs and SDKs, and infrastructure-as-code tools like Bicep, ARM templates and Terraform.

Model answer

The portal suits learning, exploring and one-off tasks. The CLI or PowerShell suit scripting and repeatable admin tasks. Infrastructure as code (Bicep, ARM or Terraform) is for anything that must be consistent across environments or reviewed, especially production. You declare the desired state in source control and deploy through a pipeline.

Model answer

It makes environments reproducible and reviewable. Changes go through pull requests, drift can be detected, new regions or environments are a parameter change, and disaster recovery can include redeploying infrastructure from code. Combined with CI/CD, policy-as-code and tagging conventions, it turns manual operations into an auditable engineering process.

Model answer

Automate it. A short Azure CLI or PowerShell script run on a schedule, using Azure Automation or a timer-triggered Azure Function with a managed identity. Better still, check whether the restart is needed at all, or whether the batch job could run on a Scale Set or serverless service.

Model answer

A region is a geographic area with one or more Azure datacenters, like West Europe. I choose a region close to my users for low latency, one that meets data residency rules, one that offers the services I need, and I compare prices because they differ by region.

You

No. Newer or preview services often launch in a few regions first, so always check service availability by region before choosing.

Model answer

Planned platform updates roll out to one region of a pair at a time, so a bad update is less likely to affect both. If there is a broad outage, Microsoft prioritises recovering one region in each pair. Paired regions are usually in the same geography for data residency and, where possible, hundreds of kilometres apart. Some services, such as geo-redundant storage, replicate to the paired region.

Model answer

Not necessarily. Pairs matter for services that replicate only to the pair, such as GRS storage, and for sequential updates. But some newer regions have no pair and rely on availability zones, and you might choose a different secondary for capacity, latency, service availability or cost. For services where you control replication, such as Cosmos DB or Azure SQL geo-replication, pick the secondary that best fits your requirements.

Model answer

Azure Government, a sovereign region that is physically isolated from public Azure and operated by screened US personnel, designed for US government agencies and their partners.

Model answer

It is a physically separate datacenter location inside an Azure region, with its own power, cooling and network. Regions with zones have at least three, so I can run copies of my app in different zones and survive one datacenter failing.

You

The zones themselves are free, but you pay for the extra resources you run, and for some services there are small charges for data transferred between zones.

Model answer

Zonal means I pin a resource to a specific zone, like a VM in zone 1, and I design redundancy myself by deploying more instances in other zones. Zone-redundant means Azure replicates the service across zones automatically, like zone-redundant storage or a zone-redundant SQL database.

Model answer

Zones protect against datacenter-level failures with low latency between zones, so synchronous replication is practical. A second region protects against regional disasters, but adds latency, data replication complexity and cost. Most production workloads start zone-redundant in one region, and add a second region only for critical systems with strict recovery objectives.

Model answer

Spread the VMs across availability zones behind a zone-redundant load balancer, and use zone-redundant tiers for the database and storage. Then a single datacenter power failure no longer takes the app down.

Model answer

It is a physical building full of servers, storage and network equipment that run Azure. I cannot choose a specific datacenter. I choose a region, and optionally an availability zone, and Azure places my resources in a datacenter there.

Model answer

Datacenters are the physical buildings. One or more datacenters with independent power, cooling and networking form an availability zone. Several zones, or one or more datacenters in regions without zones, form a region.

Model answer

Microsoft is always responsible for physical datacenter security under the shared responsibility model. For evidence I would use the Microsoft Service Trust Portal, which provides third-party audit reports such as ISO 27001 and SOC reports, rather than trying to inspect the facilities myself.

Model answer

It is a container that holds related Azure resources, like the VM, database and storage for one app. I can manage access, apply policies, view costs and delete everything in it together.

You

No. A resource belongs to exactly one resource group at a time, although it can be moved to another group.

Model answer

A resource is in only one group; groups cannot be nested; resources in a group can be in different regions from the group itself; deleting a group deletes everything in it; and access and policies applied to a group are inherited by its resources.

Model answer

Mainly by lifecycle and ownership. Things deployed and deleted together, owned by the same team, go together, for example one group per application per environment such as rg-shop-prod and rg-shop-dev. Shared networking often lives in its own group managed by a platform team. This keeps RBAC, cost reporting and clean-up simple.

Model answer

If they are all in one test resource group, delete the group. Everything inside is deleted in one operation. That is why grouping by lifecycle is so useful.

Model answer

It is the container that links Azure resources to billing. Everything I create lives in a subscription, and I can control who has access and see costs at the subscription level.

Model answer

To separate environments such as production and development, to separate departments or projects for billing, to apply different access and policies, and to stay within subscription limits and quotas.

Model answer

Subscriptions are the unit of scale and isolation. A landing zone typically gives each workload, or each workload environment, its own subscription, placed under management groups that apply shared policies. Platform subscriptions hold shared services such as connectivity and identity. This keeps blast radius small and billing clear.

Model answer

A container for subscriptions. If I apply a policy or permission to a management group, every subscription inside it gets that setting automatically.

Model answer

They contain subscriptions or other management groups, can be nested up to six levels deep (not counting the root and subscription levels), each management group or subscription has only one parent, and a directory can have up to 10,000 management groups. Everything sits under one root management group.

Model answer

Keep it shallow and based on governance needs, not the org chart. A common pattern from Azure landing zones is root, then Platform (identity, connectivity, management) and Landing Zones (corp, online), plus Sandbox and Decommissioned. Policies such as allowed regions and required tags go high up, with exceptions applied lower.

Model answer

Management groups at the top, then subscriptions, then resource groups, then resources. Anything I set at a level, like a policy or permission, flows down to the levels below.

Model answer

Everything inside that subscription: all its resource groups and resources, because role assignments are inherited down the hierarchy.

Model answer

At the highest management group that covers all subscriptions, usually the root or a top-level landing zone group, so every current and future subscription inherits it. I would start in audit mode, then move to deny or modify once teams have adapted.

Model answer

A VM is a whole computer with its own operating system that I manage. A container is a lightweight package of just my app and its dependencies that shares the host's OS, so it starts quickly. A function is a small piece of code that runs only when an event happens, with no servers to manage at all.

Model answer

VMs virtualise hardware, so each one boots a full guest OS. Containers virtualise the operating system: they share the host kernel and only package the app and its libraries. That makes them smaller, faster to start and denser on the same hardware.

Model answer

Functions for event-driven glue and short tasks. Container Apps for containerised microservices when I want serverless scaling, including to zero, without running Kubernetes myself. AKS when I need full Kubernetes control, custom networking, operators or very large scale and have the skills to run it. I would start with the most managed option that meets the requirements.

Model answer

It is a computer in the cloud that I control completely, including the operating system. I would use one for lift-and-shift migrations, custom or legacy software, or when I need full control of the environment.

You

At least an OS disk, a network interface and a virtual network with a subnet. Usually also a public IP address and a network security group.

Model answer

Stopping from inside the OS powers it off but keeps the hardware allocated, so compute billing continues. Deallocating, by using Stop in the portal or az vm deallocate, releases the hardware and stops compute charges. Disks still incur storage costs either way.

Model answer

Run at least two instances across availability zones or an availability set behind a load balancer, use managed disks with backup, automate builds with images and infrastructure as code, patch with Azure Update Manager, close management ports and use Azure Bastion, enable Defender for Servers, and right-size with reservations or a savings plan for steady load.

Model answer

A group of identical VMs that Azure can add or remove automatically as demand changes, usually behind a load balancer.

Model answer

A fault domain is a group of hardware that shares power and networking, like a rack. An update domain is a group of VMs that can be rebooted at the same time for maintenance. An availability set spreads VMs across up to three fault domains and multiple update domains, so failures and updates never hit all VMs at once.

Model answer

Availability sets protect against rack and maintenance failures within one datacenter. Zones protect against a whole datacenter failing, with a higher SLA, and are preferred where available. Scale sets add elastic scaling and can themselves be spread across zones. For new workloads I would use a zone-spanning scale set.

Model answer

It is a service that gives users a Windows desktop and apps running in Azure. They can connect from a laptop, tablet or browser, and company data stays in the cloud rather than on their device.

Model answer

Data stays in Azure, not on personal devices, so a lost laptop does not leak files. Access is protected with Microsoft Entra ID, multifactor authentication and Conditional Access, and session hosts do not need to be exposed to the internet.

Model answer

Windows multi-session lets several users share one session host VM, so you need fewer VMs than one-per-user. Combined with autoscaling host pools that shut down hosts after hours, it can significantly cut compute costs for task workers.

Model answer

A PaaS service for hosting websites and APIs. I upload my code and Azure runs it on servers it manages, including OS updates, scaling and HTTPS.

Model answer

The plan defines the region, the instance size and the number of instances. I pay for the plan, not per app, so several apps can share one plan. Tiers range from Free and Basic to Standard and Premium, which add features such as autoscale, deployment slots and VNet integration.

Model answer

Deploy to a staging deployment slot, warm it up and test it, then swap it with production. The swap is near-instant, and if something goes wrong I swap back. Slot-specific settings keep things like connection strings separate.

Model answer

A serverless service that runs small pieces of code when something happens, like a file upload or an HTTP request, without me managing any servers.

Model answer

A trigger is what starts the function, and every function has exactly one. Bindings are optional input and output connections to other services, like reading a blob or writing to a queue, declared in configuration instead of written in code.

Model answer

Use Durable Functions, which add orchestrations with checkpoints and replay, patterns such as function chaining, fan-out/fan-in and human interaction, and survive restarts. For very long or heavy jobs, consider Container Apps jobs or Batch instead.

Model answer

Azure Container Instances. I give it an image and it runs, with no VMs or cluster to manage, and I pay per second while it runs.

Model answer

When I have many containers that need orchestration: automatic scaling, rolling updates, self-healing, service discovery and load balancing. ACI is for single containers or short tasks; AKS is for complex, long-running microservice systems.

Model answer

Between the two. It runs microservices on Kubernetes under the hood, with KEDA autoscaling, Dapr and revisions, but without exposing the cluster. It suits teams that want microservices and scale to zero without becoming Kubernetes operators. AKS is for when you need the full Kubernetes API and ecosystem.

Model answer

It is my private network in Azure. My VMs and other resources inside it can talk to each other privately, and I control whether they can reach the internet or my office network.

You

To divide the network into sections, like keeping web servers and databases apart, and apply different security rules to each section.

Model answer

Isolation and segmentation, communication with the internet, communication between Azure resources, communication with on-premises resources through VPN or ExpressRoute, routing of network traffic, filtering with network security groups, and connecting virtual networks with peering.

Model answer

Avoid overlapping ranges with on-premises networks and other VNets you may peer with, because overlapping address spaces cannot be connected. Leave room to grow, remember Azure reserves five IP addresses in every subnet, and plan dedicated subnets for services that need them, such as VPN gateways (GatewaySubnet) or Azure Bastion.

Model answer

It connects two Azure virtual networks so they behave like one network for traffic between them. It is private, fast and uses Microsoft's backbone, not the internet.

Model answer

No. If VNet A is peered with B, and B with C, A and C cannot talk unless they are peered directly or traffic goes through a hub with routing, for example a firewall or Virtual WAN hub.

Model answer

When many workload VNets (spokes) need shared services such as a firewall, VPN or ExpressRoute gateway and DNS in a central hub. Spokes peer to the hub, use gateway transit and route through the firewall. At larger scale, Azure Virtual WAN can manage the hub for you.

Model answer

It is a list of firewall rules for Azure networks. Each rule allows or blocks traffic based on where it comes from, where it goes, the port and the protocol.

Model answer

By priority. The lowest number is checked first, and processing stops at the first rule that matches. Default rules allow traffic within the VNet and from the Azure load balancer, and deny other inbound traffic from the internet.

Model answer

NSGs are free, distributed, layer 3 and 4 filters on subnets and NICs, ideal for segmentation. Azure Firewall is a managed, stateful, centralised firewall with FQDN filtering, threat intelligence and logging, used in a hub to control traffic between networks and the internet. Most designs use both.

Model answer

It creates an encrypted tunnel over the internet between Azure and my office, or between Azure and individual laptops, so traffic is private even though it crosses the public internet.

Model answer

Site-to-site connects a whole network, like an office, using a VPN device on-premises. Point-to-site connects individual computers, like remote workers, using a VPN client on each device.

Model answer

When you need predictable latency, very high bandwidth or traffic that never touches the internet, for example large data transfers or strict compliance. Then use ExpressRoute, often with a VPN as a backup path.

Model answer

A private, dedicated connection between my company's network and Microsoft's cloud, provided by a telecom partner. It does not use the public internet.

Model answer

Traffic stays off the internet, latency is consistent, bandwidth is higher, and reliability is backed by an SLA with redundant connections. It can also connect to Microsoft services such as Microsoft 365 as well as Azure.

Model answer

Use circuits in two different peering locations, connect them to zone-redundant gateways, and keep a site-to-site VPN as a failover path. For multi-region estates, consider ExpressRoute Global Reach or Virtual WAN for site-to-site transit.

Model answer

It hosts my domain's DNS records on Azure, so when someone types my website name, Azure DNS answers with the right IP address.

You

No. Azure DNS hosts domains. You buy the domain from a registrar (or through App Service domains) and point its name servers to Azure DNS.

Model answer

Reliability and performance from a global network of name servers using anycast, security through Azure RBAC, activity logs and resource locks, ease of use with the same portal, CLI and APIs, private DNS zones for VNets, and alias records that track Azure resources.

Model answer

A private endpoint gives a PaaS service a private IP in your VNet. Private DNS zones make the service's normal name resolve to that private IP inside the VNet, so applications connect privately without code changes.

Model answer

A public endpoint can be reached from the internet. A private endpoint gives the service a private address inside my virtual network, so only my network can reach it.

Model answer

To keep database traffic off the internet, to disable public access entirely and reduce the attack surface, and to let on-premises networks reach the database privately over VPN or ExpressRoute.

Model answer

DNS. Use private DNS zones so the service's normal hostname resolves to the private IP inside the VNet and from connected networks. Then disable public network access, and review NSG and routing policies for the private endpoint subnet.

Model answer

It spreads incoming traffic across several servers and stops sending traffic to any server that fails a health check, so the app stays fast and available.

Model answer

Load Balancer for non-HTTP or high-performance layer-4 traffic in one region. Application Gateway for web apps in one region needing URL routing, TLS offload or WAF. Front Door for global web apps that need users routed to the closest healthy region, with caching and WAF at the edge.

Model answer

Yes. A common pattern is Front Door globally, routing to Application Gateway or directly to App Service in each region, with internal Load Balancers in front of VM-based back-end tiers. Front Door handles global failover; regional services handle local distribution.

Model answer

A managed service that connects all my offices, remote users and Azure networks through central hubs that Microsoft runs, instead of me building a complicated network myself.

Model answer

In a customer-managed hub-and-spoke I build the hub VNet, gateways, firewall and routing. Virtual WAN provides the hub as a managed service with automatic routing, any-to-any transit and easy branch onboarding, which suits large, multi-region estates.

Model answer

For a small estate with a handful of VNets in one region and one VPN. A simple hub-and-spoke with peering is cheaper and easier there. Virtual WAN shines with many branches, many regions or SD-WAN integration.

Model answer

It is the container for my Azure Storage data, like blobs, file shares, queues and tables. It has a globally unique name, a region and a redundancy setting.

You

Because it becomes part of public URLs, such as name.blob.core.windows.net, and no two accounts can share a URL.

Model answer

Standard general-purpose v2 for most scenarios, supporting blobs, files, queues and tables. Premium block blobs for high transaction rates and low latency. Premium file shares for high-performance file shares. Premium page blobs for page blobs such as unmanaged disks.

Model answer

Require secure transfer (HTTPS), set a minimum TLS version, disable anonymous blob access, prefer Microsoft Entra authorisation over shared keys, use private endpoints and disable public network access where possible, enable soft delete and versioning, and pick redundancy based on recovery needs. Azure Policy can enforce these.

Model answer

Storing files of any type: pictures, videos, documents, backups and logs. Apps can read and write them over HTTPS from anywhere.

Model answer

Hot has the highest storage cost but lowest access cost, for data used often. Cool and Cold are cheaper to store but cost more to read, with minimum storage durations of 30 and 90 days. Archive is the cheapest to store but offline. You must rehydrate it before reading, which can take hours, and it has a 180-day minimum.

Model answer

Use lifecycle management rules: move blobs to Cool after 30 days without access, to Archive after 180 days, and delete them after the retention period. Watch early-deletion charges and rehydration costs for archived data.

Model answer

Azure Files for shared folders that many computers map as a drive. Queues for passing work messages between parts of an app. Tables for simple NoSQL data such as user settings. Managed Disks for the hard drives of virtual machines.

Model answer

To decouple components. The front end drops a message on the queue and returns quickly, and back-end workers process messages at their own pace. If workers are slow or down, messages wait instead of being lost, which smooths out traffic spikes.

Model answer

Azure Files if existing software expects a file system path or SMB share, or for lift-and-shift of file servers. Blob Storage for new cloud-native apps reading through HTTP APIs or SDKs, which is cheaper and more scalable, with tiers and events.

Model answer

LRS keeps three copies in one datacenter, protecting against disk or rack failures. ZRS spreads three copies across availability zones, so data survives a whole datacenter failure.

Model answer

When data must survive both a datacenter failure (zones) and a regional disaster (secondary region). It suits critical data with high availability needs. Add RA- if applications must read from the secondary during an outage.

Model answer

Replication to the secondary is asynchronous, so the latest writes may be lost in a disaster. The recovery point is not zero. Without RA-, the secondary is not readable until a failover. After a customer-initiated failover, the account becomes LRS in the new primary until you reconfigure it.

Model answer

AzCopy is a command-line tool, which is great for scripts and automation. Storage Explorer is a desktop app with a graphical interface for browsing and copying files by clicking. Storage Explorer actually uses AzCopy underneath.

Model answer

It keeps a Windows file server synchronised with an Azure file share. Users keep using the local server, while Azure holds the full copy. Cloud tiering keeps only hot files locally, and multiple servers can sync to the same share.

Model answer

AzCopy in a scheduled script or pipeline, using sync or copy with Microsoft Entra authentication. It is fast and supports resuming. For tens or hundreds of terabytes on a slow link, consider Data Box instead.

Model answer

A hub in Azure that helps move on-premises systems to the cloud. It discovers what you have, assesses readiness and cost, and helps perform the migration, all tracked in one dashboard.

Model answer

When I need to move a very large amount of data and the network would take too long or cost too much. Examples are a one-time datacenter migration, an initial bulk upload before ongoing sync, or exporting data out of Azure. After upload, Microsoft wipes the device securely.

Model answer

Seed the bulk of the data with Data Box, then use AzCopy, Azure File Sync or replication to transfer the changes made while the device was in transit. That avoids weeks of network transfer while keeping data current.

Model answer

Azure SQL Database is a relational database with tables and SQL queries. Cosmos DB is a NoSQL database for flexible JSON-style data that can be replicated globally with very low latency.

Model answer

When migrating existing SQL Server databases that rely on instance-level features such as SQL Agent jobs, cross-database queries or CLR, and you want PaaS with minimal changes.

Model answer

When you need OS-level access, a specific SQL Server version or feature not available in PaaS, third-party software installed alongside, or full control of patch timing. The trade-off is that you manage patching, backups and high availability yourself.

Model answer

Microsoft's cloud identity service. It stores users and groups and handles sign-in to Azure, Microsoft 365 and other apps, with features like single sign-on and multifactor authentication.

You

No. On-premises AD Domain Services uses Kerberos, LDAP and Group Policy inside a corporate network. Entra ID is a cloud service using modern protocols like OAuth and SAML over the internet. They are often connected with Entra Connect.

Model answer

When I move legacy applications to Azure that need traditional domain features such as domain join, Group Policy, LDAP or Kerberos, and I do not want to deploy and patch my own domain controllers in Azure.

Model answer

Sync identities with Entra Connect or Cloud Sync, choose password hash sync (simplest and most resilient) or pass-through authentication, enable seamless SSO, enforce MFA and Conditional Access in Entra ID, and gradually move apps to modern authentication so dependence on on-premises AD shrinks.

Model answer

Authentication checks who you are, like showing your ID. Authorization checks what you are allowed to do, like which rooms your ID card opens.

Model answer

Passwords get phished, guessed or leaked. MFA adds a second factor, like an app approval or fingerprint, so a stolen password alone is not enough. Microsoft reports that MFA blocks the vast majority of account-compromise attacks.

Model answer

Phishing-resistant methods first: FIDO2 security keys or passkeys, and Windows Hello for Business. Then the Microsoft Authenticator app with number matching. Avoid SMS and voice calls where possible because they can be intercepted or SIM-swapped.

Model answer

A way for people outside my company, like partners or customers, to access my apps using their own accounts, so I don't have to create and manage passwords for them.

Model answer

B2B collaboration is for partners working with your internal apps; they appear as guest users in your directory. Customer identity (Entra External ID for customers) is for consumers signing up to your public apps, at large scale, with custom branding and social sign-in.

Model answer

Use access reviews to remove stale guests, apply Conditional Access with MFA for guests, limit guest permissions and invitations, and use entitlement management access packages with expiry dates.

Model answer

A set of rules in Microsoft Entra ID that decides how someone can sign in based on conditions. For example, if they sign in from outside the office, they must use MFA.

Model answer

Require MFA for all administrators. Block sign-ins from countries where the company does not operate. Require a compliant or company-managed device to access sensitive apps.

Model answer

Start in report-only mode to see the impact, exclude emergency break-glass accounts, target pilot groups first, use the What If tool, and monitor sign-in logs before switching policies on for everyone.

Model answer

The way Azure controls who can do what. I assign a role, like Reader, to a person or group at a scope, like a resource group, and they get exactly those permissions there.

Model answer

Owner (full access, including assigning access), Contributor (create and manage resources but not grant access), Reader (view only), and User Access Administrator (manage access only).

Model answer

RBAC controls who can perform actions. Policy controls what resources may look like. A Contributor can create a VM, but Policy can still deny it if it is in a non-approved region or size. Together they enforce both permissions and standards.

Model answer

Never trust, always verify. Every request is checked, even if it comes from inside the company network, instead of trusting everything behind the firewall.

Model answer

Verify explicitly, use least privilege access, and assume breach.

Model answer

Entra ID with MFA and Conditional Access to verify explicitly; RBAC and Privileged Identity Management for least privilege; and segmentation, private endpoints, encryption and Defender for Cloud monitoring to assume breach and limit blast radius.

Model answer

Using many layers of security instead of one, like a castle with a moat, walls, guards and a locked vault, so an attacker who gets past one layer still faces the next.

Model answer

Physical (Microsoft datacenter security), identity and access (Entra ID, MFA), perimeter (DDoS Protection, Azure Firewall), network (NSGs, segmentation), compute (patching, Defender for Servers, Bastion), application (secure code, WAF, Key Vault secrets) and data (encryption, access controls).

Model answer

They complement each other. Defense in depth describes layering controls; Zero Trust describes how each access decision is made at every layer. A Zero Trust architecture is implemented as layered controls.

Model answer

A security service that checks my cloud resources for weaknesses, gives me a secure score and recommendations to fix them, and alerts me to attacks.

Model answer

Azure natively, on-premises and other datacenters through Azure Arc, and other public clouds such as Amazon Web Services and Google Cloud Platform through connectors.

Model answer

Track secure score as a KPI, assign recommendations to owners, use the regulatory compliance dashboard for standards such as ISO 27001 or PCI DSS, enable Defender plans for critical workloads, and stream alerts to Microsoft Sentinel. Use Azure Policy to enforce the fixes so issues don't come back.

Model answer

What you deploy and how big it is, how long it runs, which region it's in, how much data leaves Azure, whether you clean up unused resources, your subscription type and any Marketplace products you buy.

Model answer

Region (local costs and taxes differ), OS licensing (Windows costs more than Linux unless using Azure Hybrid Benefit), size and series, pricing model (pay-as-you-go, reservation, savings plan or Spot) and how long it runs.

Model answer

Egress and cross-region traffic, orphaned disks and public IPs, log ingestion and retention in Log Analytics, premium storage transactions, idle App Service plans, and Marketplace licences billed through Azure.

Model answer

A free website where I add the Azure services I plan to use, choose sizes and regions, and see an estimated monthly cost before building anything.

Model answer

The pricing calculator estimates the cost of Azure services you plan to use. The TCO calculator compares the total cost of running workloads on-premises versus in Azure, including things like hardware, power and staff.

Model answer

Use realistic hours (not always 730 for dev/test), include bandwidth, storage transactions, backup and monitoring, compare pay-as-you-go with reservations and savings plans, apply Azure Hybrid Benefit, and check region price differences. Then validate with a small pilot and Cost Management data.

Model answer

All the costs of running something, not just the purchase price: servers, licences, power, cooling, building space, networking and the people who run it.

Model answer

When I want to compare the cost of keeping a workload on-premises against moving it to Azure. The pricing calculator only estimates Azure costs.

Model answer

Discover the real estate with Azure Migrate, use performance-based sizing, build its business case for TCO, cash flow and savings from Azure Hybrid Benefit and reservations, include staff and facility costs and migration effort, and validate assumptions with finance.

Model answer

To see how much I'm spending on Azure, what's costing the most, and to set budgets with alerts so I'm warned before going over.

Model answer

Budget alerts when spending reaches a threshold of a budget, credit alerts when monetary credits are being used up, and department spending quota alerts for enterprise agreements. Anomaly alerts can flag unusual spikes.

Model answer

Not by themselves. Budgets alert. To act automatically, connect budget alerts to action groups that trigger Logic Apps, Functions or Automation runbooks, for example to shut down dev VMs. Plan carefully so production is not stopped by accident.

Model answer

Labels made of a name and value, like department equals finance, that I put on resources to organise them and report costs.

Model answer

Cost allocation by department or project, identifying owners and environments, automation such as shutting down resources tagged env=dev at night, marking data sensitivity for security, and governance reporting.

Model answer

Define a small required set (owner, costCenter, env), enforce it with Azure Policy (deny or modify effects, and inherit tags from resource groups), set it in infrastructure as code templates, and report non-compliance.

Model answer

It helps organisations find and understand their data, wherever it lives, label sensitive information like personal data, and meet compliance rules.

Model answer

Risk and compliance solutions, which protect sensitive data across Microsoft 365 and other places, with features like data loss prevention and information protection, and unified data governance, which maps, catalogues and classifies data across on-premises, multi-cloud and SaaS sources.

Model answer

By scanning data sources to find and classify personal data, showing where it is stored and how it flows (lineage), applying sensitivity labels and data loss prevention policies, and providing reports for audits and data subject requests.

Model answer

A service that enforces rules on Azure resources, like only allowing certain regions or requiring tags, and shows which resources don't comply.

Model answer

A policy definition is a single rule. An initiative groups several related policies, for example everything needed for a regulatory standard, so you can assign and track them together.

Model answer

Assign with the Audit effect first, review compliance, communicate with teams, then switch critical rules to Deny. Use Modify or DeployIfNotExists with remediation tasks for settings that can be fixed automatically, and manage policies as code.

Model answer

A safety catch on an Azure resource that stops it from being deleted, or changed, by mistake.

Model answer

A Delete lock still lets you change the resource but not delete it. A ReadOnly lock stops both changes and deletion, making it effectively read-only.

Model answer

Some operations that look like reads are actually writes in Azure Resource Manager. For example, listing storage account keys is a POST, so a ReadOnly lock can block it. A ReadOnly lock on a resource group can also block scaling or creating resources inside it. Test locks before applying them broadly.

Model answer

The website at portal.azure.com where I can create, manage and monitor Azure resources by clicking, without writing commands.

Model answer

Create and manage resources, organise them, build custom dashboards, view monitoring data and costs, configure access control, and open Cloud Shell for commands.

Model answer

For repeatable or production changes. The portal is great for learning, exploring and troubleshooting, but production deployments should use infrastructure as code through pipelines, so changes are reviewed, consistent and reproducible.

Model answer

A command line in my browser, opened from the Azure portal, that already has Azure CLI and PowerShell installed and is signed in to my account. Nothing to install.

Model answer

Both can do the same things. Pick the one that fits your skills and environment: the CLI's az commands feel natural in Bash and Linux; PowerShell cmdlets suit teams already using PowerShell on Windows. Both run on Windows, macOS and Linux.

Model answer

Repeatability and automation. Scripts can be version-controlled, reviewed, scheduled and run in pipelines, and they produce the same result every time. They are also faster for bulk operations.

Model answer

A way to manage servers and clusters that are not in Azure, like on-premises machines or servers in AWS, from the Azure portal using the same Azure tools.

Model answer

Servers (Windows and Linux), Kubernetes clusters, Azure data services, SQL Server, and virtual machines in VMware vSphere or System Center VMM environments.

Model answer

One control plane and inventory across environments, consistent policy and security, Azure Update Manager and Defender coverage for on-premises servers, and in some cases licensing benefits such as pay-as-you-go Extended Security Updates, without migrating the workloads.

Model answer

Writing your cloud setup in code files, like a recipe, so you can create the same environment again and again exactly the same way.

Model answer

Declarative describes the desired end state, like "a VM of this size in this network", and the tool works out the steps. Imperative lists each step to run in order, like a CLI script. Bicep, ARM templates and Terraform are declarative.

Model answer

Templates live in Git, changes go through pull requests and automated validation (linting, what-if previews, policy checks), and pipelines deploy them to dev, test and production. This gives auditable, repeatable environments and makes drift and disaster recovery easier to handle.

Model answer

The layer that handles every request to create, change or delete Azure resources, whichever tool I use. It checks who I am and whether I'm allowed, then makes the change.

Model answer

Manage infrastructure with declarative templates; deploy, manage and monitor resources as a group; redeploy consistently; define dependencies so resources deploy in the right order; apply access control through RBAC; apply tags; and see costs by tag.

Model answer

Bicep. It has the same capabilities as ARM templates (it compiles to them) but with cleaner syntax, modules, type safety and better tooling. Existing ARM JSON can be decompiled into Bicep.

Model answer

It looks at the resources I've already deployed and suggests improvements, like resizing an underused VM to save money or turning on backup to improve reliability.

Model answer

Reliability, Security, Performance, Operational Excellence and Cost.

Model answer

Review Advisor score regularly, assign recommendations to resource owners, set up Advisor alerts for new high-impact recommendations, export them to work tracking, and automate common fixes, such as shutting down idle dev VMs. Cross-check cost recommendations against planned growth before acting.

Model answer

A service that tells me when Azure itself has a problem or planned maintenance that could affect my resources, and lets me set alerts for it.

Model answer

Azure status is the broad, public view of all of Azure. Service Health is personalised to the services and regions I use. Resource Health zooms in on one of my resources, like whether a particular VM is available.

Model answer

Create Service Health alerts scoped to the subscriptions, services and regions in use, route them through action groups to email, SMS, Teams or the incident tool, and use Resource Health alerts for critical resources. Keep the post-incident reports for root-cause reviews.

Model answer

Azure's monitoring service. It collects numbers like CPU and memory, and logs of what happened, from my resources and apps, so I can see problems, analyse them and get alerts.

Model answer

Log Analytics is where I write KQL queries against collected logs. Alerts watch metrics, logs or the activity log and notify me through action groups, or trigger automation, when a condition is met. Application Insights monitors live web apps: request rates, response times, failures, dependencies, page views and availability tests.

Model answer

Alert on symptoms users feel (error rate, latency) rather than every metric, use dynamic thresholds, group alerts by severity with clear owners, route critical ones to on-call and the rest to dashboards, and review alerts after incidents to tune or remove noisy ones.

Model answer

A promise from Microsoft about how much of the time a service will be available, like 99.9%. If Microsoft misses it, customers can claim service credits.

Model answer

Public preview lets everyone try a new feature, but it usually has no SLA and may change, so it is not recommended for production. General availability means the service is fully released, supported and typically covered by an SLA.

Model answer

Multiply the SLAs of services that all must work, which lowers the overall figure. Add redundancy, such as multiple regions, to increase it. Remember SLAs cover the platform, not your own code or deployments.