Exam Traps Scenarios

A company needs an encrypted office-to-Azure tunnel over the internet. Which service?

Azure VPN Gateway using site-to-site VPN. ExpressRoute uses private provider connectivity instead of the public internet.

A single employee working at home needs VPN access to an Azure VNet. Which connection?

Point-to-site (P2S) VPN through Azure VPN Gateway. Site-to-site connects entire networks, not just a roaming laptop.

A bank needs a private provider circuit to Azure, not public-internet routing. Which service?

Azure ExpressRoute. Unlike VPN Gateway, it doesn't rely on public internet paths and is not encrypted by default.

Two Azure VNets need private network communication. Which feature?

VNet peering. It connects Azure virtual networks; it's not the product for connecting an office network to Azure.

VNet A peers B, and B peers C. Can A automatically reach C?

No. Azure VNet peering is non-transitive; A and C require extra connectivity/configuration.

A storage service must have a private IP in a VNet. Which feature?

Private endpoint with Azure Private Link. A service endpoint still uses the service's public destination endpoint.

Traffic must stay on Azure backbone but Storage keeps its public endpoint. Which feature?

Virtual network service endpoint. It extends subnet identity to the service; it does not create a private NIC on the service.

A company needs a private DNS name resolved by two VNets. What must be configured?

Link the appropriate VNets to the Azure Private DNS zone (or configure suitable DNS forwarding). Peering alone doesn't automatically expose every private DNS zone.

New VMs must NOT deploy in unapproved regions. Which control?

Azure Policy with Deny. RBAC controls which users may act; Policy prevents noncompliant deployments.

You need to report existing noncompliance without blocking new deployments. Which effect?

Azure Policy Audit. Deny blocks matching noncompliant operations instead of only reporting.

An admin can edit a VM but must not delete it. Which lock?

CanNotDelete lock. ReadOnly would restrict management modifications too.

An admin needs view-only access to all resources in one resource group. Which role?

Reader assigned at that resource group's scope. Contributor can change resources; Owner also manages access.

One person can manage resources but cannot grant permissions. Which built-in role?

Contributor. Owner can manage role assignments, while Reader only views.

Several subscriptions need shared policy. What should contain them?

Azure management group. The hierarchy is management group > subscription > resource group > resource.

A firm wants estimated Azure VM costs before deployment. Which tool?

Azure Pricing Calculator. Cost Management primarily analyses or budgets cloud consumption; TCO is broader on-premises/cloud comparison.

The Azure budget reaches 100%. Will resources stop automatically?

No. A budget alerts on thresholds, but resources can continue incurring charges without separately configured automation.

Finance wants to attribute cloud costs to each department without separate subscriptions. What feature?

Azure resource tags, such as Department=Finance. Tags are for organisation/reporting, not access control.

A production VM suddenly shows Unavailable. Which health view checks this resource?

Azure Resource Health. Service Health provides platform incident/maintenance information; Advisor gives improvement tips.

Microsoft plans maintenance that may affect your subscription. Which view?

Azure Service Health. Resource Health examines individual resource health.

An app has slow SQL calls and failed web requests. Which monitoring feature?

Application Insights. It tracks application performance, requests, errors, and dependencies.

You need KQL over logs from many Azure resources. Which tool?

Azure Monitor Log Analytics. Metrics Explorer charts numeric metrics; Application Insights specialises in app telemetry.

You need to chart a VM's CPU percentage for the last day. Which tool?

Azure Monitor Metrics Explorer. KQL and Log Analytics focus on log records rather than basic metric charts.

You have physical servers outside Azure but want Azure governance. Which service?

Azure Arc. Azure Migrate moves workloads toward Azure; Lighthouse provides cross-tenant delegated Azure management.

A service provider manages multiple customer Azure subscriptions. Which service?

Azure Lighthouse. Azure Arc is for extending Azure management to resources outside Azure.

The company wants to assess and move its on-premises VMs into Azure. Which service?

Azure Migrate. Arc manages resources where they are; Migrate helps plan and execute migration.

A huge dataset cannot be uploaded quickly over a slow internet connection. Which solution?

Azure Data Box, which uses physical transfer equipment. AzCopy is a command-line online data transfer tool.

Copy many files to Azure Storage from a terminal or script. Which tool?

AzCopy. Storage Explorer is graphical; Azure File Sync synchronises Windows Server shares.

Browse blobs and file shares from a desktop GUI. Which tool?

Azure Storage Explorer. AzCopy is the command-line transfer option.

Keep frequently used files on Windows Server while syncing to Azure Files. Which service?

Azure File Sync, with cloud tiering if desired. It differs from one-time AzCopy file transfers.

Run code after a Blob upload or on a timer. Which compute service?

Azure Functions. App Service is best known for continuously hosted web apps.

Host a managed website without maintaining the server OS. Which compute service?

Azure App Service (PaaS). VMs require guest OS management.

Need guest OS control and custom system software. Which service model?

IaaS, for example Azure Virtual Machines. PaaS abstracts away the managed host operating system.

An app needs dozens of identical VMs that auto-scale with CPU. Which service?

Azure Virtual Machine Scale Sets. An availability set reduces shared failure risk but doesn't itself autoscale VM count.

You need traditional LDAP, Kerberos, and domain join but no self-managed DCs. Which service?

Microsoft Entra Domain Services. Entra ID alone does not supply all traditional AD DS protocols as a managed domain.

You need to sync identities from on-premises AD to Entra ID. Which tool?

Microsoft Entra Connect Sync. Domain Services instead provides managed traditional AD capabilities for Azure workloads.

Guest staff from a supplier need access using external identities. Which capability?

Microsoft Entra B2B collaboration / External ID capabilities. It is not the managed LDAP/Kerberos domain service.

Employees outside a trusted location must complete MFA. Which control?

Microsoft Entra Conditional Access. It enforces sign-in conditions; it doesn't grant RBAC management rights.

Security staff need to correlate suspicious events and investigate attacks. Which product?

Microsoft Sentinel, a SIEM/SOAR service. Purview deals with data governance, not primary incident detection.

A team needs to classify and catalogue sensitive documents across systems. Which product?

Microsoft Purview. Defender for Cloud focuses on cloud security posture and workloads.

An administrator wants cloud misconfiguration and threat-protection recommendations. Which product?

Microsoft Defender for Cloud. Advisor covers wider Azure optimisation recommendations; Sentinel is security-event analytics.

Three synchronous copies within one datacentre. Which redundancy?

LRS (Locally Redundant Storage). It does not survive every datacentre-wide catastrophe.

Three or more synchronous availability-zone copies in one region. Which redundancy?

ZRS (Zone-Redundant Storage). It does not also copy to a second region.

Local copies plus asynchronous copy to a second region, with secondary reads. Which redundancy?

RA-GRS. GRS alone doesn't expose a secondary read endpoint before failover.

Primary-zone replication plus a secondary region AND secondary read access. Which redundancy?

RA-GZRS. GZRS without RA lacks the extra secondary read-access capability.

A company needs cheap storage for rarely used data but immediate online access. Which tier?

Usually Cool or Cold depending on access frequency and costs, NOT Archive. Archive needs rehydration before normal reads.

Data can wait hours before retrieval and is rarely accessed. Which tier?

Archive Blob tier. It is offline and typically cheapest to store but requires rehydration.

A VM is running but its application has zero users. Is compute free?

No. A provisioned/running pay-as-you-go VM can still incur compute charges even when its application is idle.

A deployment template describes desired infrastructure and handles dependencies. What is it?

An ARM template or Bicep definition using declarative Infrastructure as Code. ARM processes the deployment.

Redeploying the same ARM config shouldn't create new duplicates. What property?

Idempotence: repeated deployments converge on the desired state rather than blindly duplicating resources.

Failure of one datacentre zone must not take down an app. What design helps?

Deploy redundant instances across Azure availability zones with appropriate routing/data design. Merely selecting a region isn't enough.

A disaster wipes out an Azure region; recovery is planned in another region. What concept?

Disaster recovery, not simply horizontal scaling or elasticity. HA and DR can complement each other.