Task 2.1: Describe the core architectural components of Azure

• AAzure Virtual Machines

  Incorrect

  A VM is regional: its location decides where its virtual hard disks are stored and where it runs.

• BMicrosoft Entra ID

  Correct

  Microsoft lists Microsoft Entra ID among the global services that don't require selecting a region.

• CAzure DNS

  Correct

  Microsoft lists Azure DNS among the global services that don't require selecting a region.

• DAzure Storage accounts

  Incorrect

  A storage account is created in a primary region, which its redundancy options then build on.

• EAzure SQL Database

  Incorrect

  An Azure SQL database is deployed into a region that you choose when you create its logical server.

Most resources are regional. A few services are global and don't ask for a region; Microsoft names Microsoft Entra ID, Azure Traffic Manager and Azure DNS as examples.

• ATwo

  Incorrect

  Two zones would leave too little separation; Microsoft guarantees more than that in every zone-enabled region.

• BOne per datacenter in the region

  Incorrect

  A zone is made of one or more datacenters, so the zone count isn't tied to the number of datacenters.

• CSix

  Incorrect

  Six isn't the guaranteed minimum; the guaranteed number is lower.

• DThree

  Correct

  Every availability zone-enabled region has a minimum of three separate zones.

Availability zones are physically separate groups of datacenters within a region, each with independent power, cooling and networking. To ensure resiliency, a minimum of three zones is present in every zone-enabled region.

• AAzure moves the resources to the paired region automatically after an outage

  Incorrect

  Microsoft states that deploying to a region in a pair doesn't provide automatic high availability, disaster recovery or failover.

• BPairing alone gives no automatic failover; the company must plan its own recovery

  Correct

  Customers develop their own high availability and disaster recovery plans; a region pair doesn't move a workload by itself.

• CAzure moves the VMs automatically, but the databases must be configured

  Incorrect

  Neither resource type moves to the pair on its own; VMs need a recovery design just as the databases do.

• DAzure moves the workload once Azure Backup is enabled on its resources

  Incorrect

  Azure Backup copies data so it can be restored. It doesn't run the workload in another region on its own.

A small number of services use region pairs for geo-replication, but Microsoft is explicit that deploying into a pair doesn't make resources more resilient by itself or give automatic failover. The customer designs and configures recovery.

• AA resource group in each subscription that holds the assignments

  Incorrect

  A resource group sits inside one subscription, so this would need 30 separate sets of assignments.

• BA Microsoft Entra security group that contains the 30 subscriptions

  Incorrect

  Security groups contain users and other identities that roles are assigned to; they can't contain subscriptions.

• CA management group that contains the 30 subscriptions

  Correct

  Management groups sit above subscriptions, and policy and role assignments made on one are inherited by every subscription under it.

• DA parent subscription that the other 30 subscriptions are nested in

  Incorrect

  Subscriptions can't be nested. Grouping them is what management groups are for.

Management groups organize subscriptions into a hierarchy for unified policy and access management. All subscriptions in a management group inherit the conditions applied to it, so one assignment covers existing and future subscriptions placed under it.

• AAn Azure region pair inside the United States

  Incorrect

  Region pairs are ordinary regions of the main Azure instance; pairing doesn't isolate them or change who operates them.

• BAvailability zones in a U.S. commercial region

  Incorrect

  Availability zones separate datacenters within a commercial region. They don't create a separate, isolated instance of Azure.

• CAzure Government regions such as US Gov Virginia

  Correct

  US DoD Central, US Gov Virginia, US Gov Arizona and similar regions are network-isolated instances of Azure for U.S. government agencies and partners.

• DAzure regions operated by 21Vianet

  Incorrect

  The regions operated with 21Vianet are China's sovereign instance of Azure, not one for U.S. government agencies.

Sovereign regions are instances of Azure isolated from the main instance, used for compliance or legal reasons. The U.S. government regions are isolated physically and logically, run by screened U.S. personnel and carry additional compliance certifications.

• ABoth, as long as the groups are in the same subscription

  Incorrect

  Being in the same subscription doesn't change either rule.

• BNeither; a resource sits in exactly one group, and groups don't nest

  Correct

  Every resource belongs to exactly one resource group at a time, and resource groups can't contain other resource groups.

• CThe second, because resource groups can be nested in each other

  Incorrect

  Resource groups can't be nested. Grouping above them happens with subscriptions and management groups.

• DThe first, because a resource can be linked to two groups

  Incorrect

  A resource is associated with one group at a time; it can't be linked to a second.

Resource groups gather related resources. Each resource belongs to exactly one resource group, and resource groups can't be nested; grouping above them happens with subscriptions and management groups.

• AA resource group per department within one subscription

  Incorrect

  Resource groups organize resources, but they all bill to the subscription they belong to.

• BA management group per department

  Incorrect

  Management groups sit above subscriptions in the hierarchy; invoices are still produced per subscription.

• CA Microsoft Entra tenant per department

  Incorrect

  Tenants hold identities. Splitting them wouldn't by itself create separate invoices, and it would split sign-in as well.

• DA separate subscription for each department

  Correct

  A subscription is a billing boundary: Azure generates separate billing reports and invoices for each subscription.

Subscriptions are units of management, billing and scale. As a billing boundary, each subscription gets its own billing reports and invoices, so separate subscriptions per department or workload are a common way to separate costs.

• AUpdates are applied to both regions at the same moment to keep them identical

  Incorrect

  Updating both at once would put both copies of the app at risk from the same faulty update.

• BUpdates are skipped in paired regions until the customer approves them

  Incorrect

  Customers don't approve platform updates region by region; pairing changes their timing, not who approves them.

• CUpdates move the app's traffic to the pair automatically while they run

  Incorrect

  The pairing changes when each region is updated; it doesn't reroute the app's traffic while updates run.

• DUpdates are staggered so the regions in a pair aren't updated at the same time

  Correct

  Azure staggers planned updates across region pairs, which limits the impact of a faulty update and avoids downtime for apps using both.

Using a region's pair as the secondary brings sequential updating: Azure strives to stagger planned system updates across the regions in a pair. That reduces the impact of bugs or faulty updates and prevents downtime for solutions built to use both regions.