A company wants to ensure that no one, including Global Administrators, can accidentally delete a critical production Virtual Network. Which Azure feature should be implemented to provide the strongest protection against accidental deletion?

Your company has three separate Azure subscriptions. You need to apply a specific security compliance policy across all subscriptions simultaneously to ensure uniform governance. What is the most efficient way to organize these subscriptions?

A cloud administrator needs to grant a consultant the ability to manage virtual machines in a specific Resource Group, but the consultant should not be able to manage any other resources (like Storage Accounts) in that same group. Which RBAC role is most appropriate?

You need to create a group in Microsoft Entra ID (formerly Azure AD) that automatically adds or removes members based on their 'Department' attribute. What type of group and membership type should you use?

An organization wants to track costs by department for all resources deployed in Azure. Which feature should they use to categorize resources without affecting their functionality?

A developer needs to be able to view everything in a subscription but must not be able to make any changes or delete any resources. Which built-in RBAC role should be assigned?

You want to prevent users from creating any virtual machines larger than the 'Standard_D2s_v3' size within a specific Resource Group. What should you implement?

You have 10 Resource Groups. You apply a 'ReadOnly' lock to the subscription containing these groups. What is the effect on the Resource Groups?

In Microsoft Entra ID, you want to ensure that a user can only reset passwords for non-administrative users. Which role should you assign?

Which of the following is a key difference between Azure RBAC and Azure Policy?

An IT director wants to ensure that all new resources created in the 'Production' Resource Group must include a tag named 'Environment' with a value of 'Prod'. If a deployment lacks this tag, it should be blocked. Which Azure Policy 'effect' should be used in the policy definition?

An organization needs to delegate the ability to manage all resources within a specific subscription to a new lead engineer, but they must also ensure the engineer cannot assign or change permissions for other users. Which built-in RBAC role should be assigned?

A company is restructuring its Azure environment and needs to organize its 50 subscriptions into groups based on business units (HR, Finance, IT) to apply specific governance rules to each. What is the most appropriate Azure resource hierarchy component to use?

A company requires that all storage accounts created in their subscription must only allow HTTPS traffic. They want to ensure that even if a developer tries to create a storage account with HTTP enabled, Azure automatically fixes the setting to 'Enabled' for HTTPS during the creation process. Which Azure Policy effect is best suited for this?

A company plans to ensure that all new resource groups created in a specific subscription must have a tag named 'CostCenter'. If a user attempts to create a resource group without this tag, the creation must be blocked. Which Azure feature should you use?

A company plans to provide a help desk team with the ability to reset user passwords and manage support tickets, but they must not be able to delete users or modify global settings. You need to follow the principle of least privilege. Which role should you assign?

A company plans to enforce Multi-Factor Authentication (MFA) only when employees access the Azure portal from outside the corporate network. Which Azure AD feature should you implement?

A company plans to grant a developer the ability to manage all resources in a subscription, except for the ability to assign roles to other users. Which built-in role should you assign?

A company plans to create a new role that allows a security team to review resource configurations and read logs, but the built-in 'Reader' role is too restrictive and 'Log Analytics Reader' is not sufficient. You decide to create a Custom Role. What is the required format for the definition file?

A company plans to prevent the accidental deletion of a production virtual machine even by users with the 'Owner' role. What should you apply directly to the virtual machine resource?

A company plans to delegate the management of several subscriptions to a single department. You want to group these subscriptions together to apply policies and RBAC roles at a higher level than the subscription. What should you use?

A company plans to grant a user permission to view the password of an Azure Key Vault secret without granting permission to change the secret or manage the vault. In the 'Actions' section of a custom role, which syntax allows all read operations but excludes everything else?

A company plans to ensure that developers can only deploy 'D-series' virtual machines. If a developer attempts to deploy a 'G-series' VM, the deployment should be allowed but flagged in a compliance dashboard. Which Azure Policy effect should you use?

A company plans to limit the network locations from which the Azure portal can be accessed for administrative tasks. After defining the IP ranges in Named Locations, where should these locations be referenced to enforce the restriction?

A company plans to implement a temporary access strategy. You need to ensure that an administrator can only elevate their permissions to 'Subscription Owner' for a specific 4-hour window and must provide a business justification. Which feature should you implement?

A company plans to ensure that all storage accounts created within a specific management group use only the 'Locally-redundant storage (LRS)' replication type. If a storage account is created with 'Geo-redundant storage (GRS)', it must be automatically changed to 'LRS' during deployment. Which Azure Policy effect should you use?

A company plans to streamline resource deployment by ensuring that all virtual machines in a specific Resource Group automatically inherit the 'Department' tag value from the Resource Group itself. Which Azure Policy effect should you use to achieve this during resource creation?

A company plans to ensure that several teams can manage their own resources in separate subscriptions, but they want to centrally manage the allowed Azure regions for all deployments. Where should you assign the Azure Policy to ensure it applies to all current and future subscriptions within the department?

A company plans to grant a security auditor the ability to view all configurations and reports across an entire Azure subscription, but the auditor must be strictly prohibited from viewing any sensitive data, such as secrets stored in Key Vaults or connection strings. Which built-in role follows the principle of least privilege for this scenario?

A company plans to restrict access to the Azure portal so that it can only be accessed from a specific range of corporate public IP addresses. You have already defined the 'Named Location' in Microsoft Entra. What is the next step to enforce this restriction using Conditional Access?

A company plans to use a Custom Role to allow a junior administrator to restart virtual machines, but they must not be allowed to perform any other actions on the virtual machines or the network. When defining the 'actions' in the JSON role definition, which permission string should you include?

A company plans to ensure that any Azure SQL Database created in a specific subscription is always configured with Transparent Data Encryption (TDE) enabled. If a database is deployed without it, the deployment must not be blocked, but the system should automatically enable TDE immediately. Which Azure Policy effect is best suited for this task?

A company plans to delegate the task of managing role assignments across several resource groups to a lead developer. You must ensure the developer can assign permissions to others but cannot create or delete any actual Azure resources (like Virtual Machines or Storage Accounts). Following the principle of least privilege, which built-in role should you assign?

Which Azure AD feature allows you to group users based on rules such as "department equals Sales" so that group membership is updated automatically?

What is the primary factor used to calculate the cost of a basic Azure Storage account?

When configuring an Azure Virtual Machine, which component is required to allow the VM to communicate with the internet or other Azure resources?

Which service should you use to assess the impact of a planned maintenance event on your Azure resources?

Under the Azure Policy framework, what is an 'Initiative'?

In Azure Networking, what is the default behavior for traffic between two different Virtual Networks (VNets)?

Which redundancy option provides the highest level of availability by copying data across three separate data centers within a single region?

Which Azure AD role should you assign to a user who only needs to manage passwords and reset them for non-administrators?

Which tool provides a command-line experience for managing Azure resources and can be run directly in a web browser?

What is the maximum number of tags you can apply to a single Azure resource?

Which metric is used to denote the throughput of an Azure File share when considering scaling?

To ensure that a Virtual Machine is available during a hardware failure in a single data center, which feature should you use?

What is the purpose of an Azure Lock with the 'ReadOnly' scope?

Which Azure Monitoring feature is best suited for collecting and analyzing telemetry from your web applications?

What is the base level of the Azure hierarchy where resources are actually deployed?

You need to connect two VNets in different Azure regions. Which solution provides a low-latency, high-bandwidth connection using the Microsoft backbone network?

Your company has multiple Azure subscriptions. You need to apply a single policy across all subscriptions. What should you use?

A user needs to maintain a persistent disk that can be detached from one VM and attached to another. What type of storage should be used?

Which load balancing solution works at Layer 7 (HTTP/HTTPS) and supports Web Application Firewall (WAF) integration?

Scenario: You have a VM in Subnet A and a Database in Subnet B. You want to restrict traffic so only the VM can talk to the Database. What should you implement?

Scenario: You are designing a backup strategy for an Azure Virtual Machine. You need to ensure the backup is stored in a different geographic region to protect against a regional disaster, but you also need the ability to restore the VM in the secondary region even if the primary region is completely unavailable. Which Recovery Services vault setting should you use?

Scenario: You have a mission-critical web application running on multiple Azure Virtual Machines. You need to ensure that the VMs are protected against the failure of a single data center within an Azure region that supports Availability Zones. To maintain the highest availability and minimize latency between the web tier and the data tier, what should you implement?

Scenario: You are the administrator of an Azure environment with dynamic scaling requirements. You need to ensure that as the CPU load of your web server farm increases, additional VM instances are automatically added to handle the traffic, and instances are removed when the load decreases. Which Azure resource should you implement?

Scenario: Your company needs to connect its on-premises office to an Azure Virtual Network. The connection must be encrypted over the public internet and should be established quickly without requiring a dedicated fiber line from a service provider. Which solution should you implement?

Scenario: You have an Azure Virtual Machine named VM1 and an Azure Storage account named Storage1. You need to ensure that VM1 can access Storage1 by using a private IP address over the Microsoft backbone network, without the traffic traversing the public internet. What should you configure?

Scenario: You are managing a large-scale application and need to ensure that a set of 10 virtual machines are never on the same physical rack to avoid a single point of failure in the hardware. If you are using an Availability Set, which component manages this physical separation?

Scenario: Your organization has an Azure subscription with multiple Resource Groups. You need to ensure that a specific group of users can only create Virtual Machines of certain sizes (SKUs) such as B-series or D-series to maintain budget control. What is the most efficient way to enforce this across the subscription?

Scenario: You are configuring a hub-and-spoke network topology in Azure. You have a central Hub VNet containing a Firewall and several Spoke VNets. You need to ensure that traffic from the Spoke VNets is routed through the Firewall in the Hub VNet before reaching the internet. What should you create in the Spoke VNets?

Scenario: You are configuring a point-to-site VPN to allow remote employees to access an Azure Virtual Network. The security team requires that employees authenticate using their existing corporate Azure AD credentials with Multi-Factor Authentication (MFA). Which protocol and authentication method must be used?