Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 3
An admin creates a single VM in the Azure portal. Which three resources does the VM need in order to run and communicate on a network? (Choose THREE.)
AA virtual network
BA network interface (NIC)
CA public IP address
DAn operating system disk
EA load balancer
FAn availability set
Show the answer and why
AA virtual network
Correct
The virtual network gives the VM the ability to communicate with other resources.
BA network interface (NIC)
Correct
The NIC connects the VM to the virtual network.
CA public IP address
Incorrect
A VM always gets a private IP address and only sometimes a public one; a public IP is needed only for direct internet access.
DAn operating system disk
Correct
Every VM has an operating system disk, which holds the operating system it boots from.
EA load balancer
Incorrect
A load balancer spreads traffic across several instances. A single VM doesn't need one.
FAn availability set
Incorrect
Availability sets group VMs for resiliency. A single VM can run without one.
Creating a VM also creates the resources that support it: a virtual network, a network interface, a private IP address and an operating system disk, plus optional items such as a public IP address and data disks. Load balancers and availability sets are added only when you group VMs for scale or resilience.
Three VMs in an availability set run a web front end. The team's worry is planned Azure maintenance that reboots hosts, not hardware failure. Which availability set concept keeps the three VMs from being rebooted at the same time during that maintenance?
AFault domains
BUpdate domains
CAutoscale rules
DAvailability zones
Show the answer and why
AFault domains
Incorrect
Fault domains group VMs that share a power source and network switch, guarding against hardware failure rather than planned reboots.
BUpdate domains
Correct
Update domains group VMs that can be rebooted together during planned maintenance, so Azure reboots one update domain at a time.
CAutoscale rules
Incorrect
Autoscale rules don't control when Azure reboots hosts for planned maintenance.
DAvailability zones
Incorrect
Availability zones aren't part of an availability set; they're a separate way to spread VMs.
An availability set spreads VMs across update domains and fault domains. Update domains handle planned maintenance: only one is rebooted at a time. Fault domains handle unplanned hardware failures by separating VMs that share power and networking.
A team builds a REST API in Python and wants to deploy it straight from its GitHub repository, with automatic scaling and no operating system to manage. Which Azure service fits?
AAzure Virtual Machines
BAzure Batch
CAzure App Service
DAzure Container Instances
Show the answer and why
AAzure Virtual Machines
Incorrect
VMs could host the API, but the team would manage the operating system and build its own deployment and scaling.
BAzure Batch
Incorrect
Batch runs large parallel and compute-intensive jobs, not an always-available web API.
CAzure App Service
Correct
App Service hosts web apps and REST APIs in many languages, deploys from GitHub and other repos, and scales without the team managing infrastructure.
DAzure Container Instances
Incorrect
Container Instances runs container images, so the team would first have to build and publish the API as an image and handle scaling itself.
Azure App Service is an HTTP-based service for web apps, REST APIs and mobile back ends. It supports Python and other languages, integrates deployment from GitHub, Azure DevOps or any Git repo, and offers automatic scaling and high availability.
A bank needs a connection between its datacenter and Azure that doesn't travel over the public internet and gives consistent latency for large daily data transfers. Which service should it use?
AA site-to-site VPN through Azure VPN Gateway
BAzure ExpressRoute
CVirtual network peering
DA point-to-site VPN
Show the answer and why
AA site-to-site VPN through Azure VPN Gateway
Incorrect
A site-to-site VPN runs over the public internet, so it can't promise consistent latency.
BAzure ExpressRoute
Correct
ExpressRoute is a private connection through a connectivity provider that bypasses the public internet, with faster speeds and more consistent latency.
CVirtual network peering
Incorrect
Peering connects virtual networks to each other inside Azure. It doesn't connect an on-premises datacenter.
DA point-to-site VPN
Incorrect
A point-to-site VPN also runs over the public internet, which the bank wants to avoid.
ExpressRoute extends an on-premises network into the Microsoft cloud over a private connection called a circuit. Because it bypasses the public internet, it offers more reliability, faster speeds and more consistent latency than internet-based links such as VPNs.
VMs in a virtual network must reach an Azure SQL database through a private IP address taken from the VNet's own address space, so that public access to the database can be turned off. What should be created?
AA private endpoint for the database in the virtual network
BA virtual network service endpoint for Azure SQL
CA public endpoint with a firewall rule for the VMs' outbound address
DA VPN gateway in the virtual network
Show the answer and why
AA private endpoint for the database in the virtual network
Correct
A private endpoint is a network interface with a private IP address from the VNet that connects privately to the service.
BA virtual network service endpoint for Azure SQL
Incorrect
A service endpoint gives the service your VNet's identity so that it can be locked to that VNet, but the database gets no private IP address from the VNet.
CA public endpoint with a firewall rule for the VMs' outbound address
Incorrect
A public endpoint has a public IP address and is reachable from the internet, which is what the company wants to turn off.
DA VPN gateway in the virtual network
Incorrect
A VPN gateway connects on-premises networks or devices to the VNet. It doesn't give a PaaS service a private address.
Public endpoints have a public IP address and can be reached from anywhere; private endpoints live inside a virtual network with a private IP address from its address space. A private endpoint brings a service such as Azure SQL Database into the VNet so its public access can be disabled.
A team wants to keep many isolated instances of an app running on a single host, start and stop each one in seconds, and avoid managing a separate operating system for each instance. Which option fits?
AA virtual machine for each instance on the host
BA container for each instance on the host
CAn Azure Functions app for each instance
DAn App Service app scaled out per instance
Show the answer and why
AA virtual machine for each instance on the host
Incorrect
Several VMs can share a physical host, but each VM runs its own operating system that you manage, which is heavier and slower to start than the team wants.
BA container for each instance on the host
Correct
Many containers run on one physical or virtual host, you don't manage an operating system for each, and they're designed to be created, scaled out and stopped dynamically.
CAn Azure Functions app for each instance
Incorrect
Functions is event-driven: an event wakes the code, which suits work that finishes within seconds, and resources are released afterward, so it doesn't keep app instances running on a host.
DAn App Service app scaled out per instance
Incorrect
An App Service app runs across the VM instances of its App Service plan, so each added instance is another VM in the plan, not another isolated copy on the same host.
Containers are a virtualization environment: like VMs on one physical host, many containers run on one host, but you don't manage an operating system for each. They're designed to be created, scaled out and stopped dynamically, and restart quickly after a crash. Azure Functions runs event-triggered code rather than long-running instances, and an App Service app scales out across the VM instances of its plan.
A support company hires contractors who work from their own laptops and tablets. It wants each shift to work in the same Windows environment and apps, hosted in Azure, so company data doesn't stay on the contractors' devices. Which service fits?
AAzure Bastion
BAzure Virtual Desktop
CAzure App Service
DMicrosoft Entra External ID
Show the answer and why
AAzure Bastion
Incorrect
The contractors would still have no shared, Azure-hosted Windows environment with the company's apps to work in from their own devices.
BAzure Virtual Desktop
Correct
Azure Virtual Desktop delivers Windows desktops and apps from Azure to many device types, keeping apps and data in Azure-hosted sessions.
CAzure App Service
Incorrect
App Service hosts web apps and APIs, not full Windows desktops.
DMicrosoft Entra External ID
Incorrect
External ID is an identity service; it doesn't host Windows desktops or apps.
Azure Virtual Desktop is a desktop and application virtualization service. It centralizes desktop delivery in Azure, integrates with Microsoft Entra ID for access control and reduces data exposure on local devices because apps and data stay in Azure-hosted sessions.
A web tier runs on identical VMs behind a load balancer. The team is tired of keeping their configuration in step by hand and wants instances added and removed automatically as traffic changes. What should it use?
AAn availability set
BAzure Virtual Desktop host pools
CAzure Virtual Machine Scale Sets
DA larger VM size for each instance
Show the answer and why
AAn availability set
Incorrect
Availability sets spread VMs for resilience. They don't create or remove instances.
BAzure Virtual Desktop host pools
Incorrect
Host pools serve desktops to users, not a load-balanced web tier.
CAzure Virtual Machine Scale Sets
Correct
Scale sets create and manage groups of identical, load-balanced VMs and add or remove instances automatically as demand changes.
DA larger VM size for each instance
Incorrect
Resizing scales each VM up but leaves configuration and instance count to be managed by hand.
Azure Virtual Machine Scale Sets centralize the configuration of identical VMs, integrate with load balancing and scale the instance count automatically. Without them, the team would keep configurations consistent and adjust instance counts manually.
A branch office wants its whole network to reach an Azure virtual network over an encrypted tunnel across the internet, using the VPN device it already owns. Which connection should it set up?
AA site-to-site VPN connection to an Azure VPN gateway
BA point-to-site VPN connection
CAn Azure Bastion host in the virtual network
DVirtual network peering
Show the answer and why
AA site-to-site VPN connection to an Azure VPN gateway
Correct
Site-to-site VPN links an on-premises VPN device to an Azure VPN gateway over an encrypted tunnel across the internet.
BA point-to-site VPN connection
Incorrect
Point-to-site connects individual computers, each starting its own VPN, rather than a whole office network.
CAn Azure Bastion host in the virtual network
Incorrect
The branch network still wouldn't be connected: no tunnel would run from its VPN device to Azure.
DVirtual network peering
Incorrect
Peering joins Azure virtual networks to one another. It doesn't link an on-premises network.
Azure VPN Gateway supports site-to-site connections from on-premises datacenters or offices, point-to-site connections from individual devices and network-to-network connections. All of them encrypt data in a private tunnel as it crosses the internet.