Question bank
Microsoft Certified: Azure Administrator Associate
42 Microsoft Certified: Azure Administrator Associate questions with the correct answer and a written explanation, organised across 5 exam domains.
- 42 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Deploy and manage Azure compute resources
11 questions in this domain
- Question 1Single Choice
Which Azure compute offering provides full control over the operating system, applications, and configuration as an IaaS service?
- AAzure virtual machineCorrect answer
- BVirtual machine scale set
- CAzure Container Instances
- DAzure App Service
Why this is the answer
A virtual machine is Azure's IaaS offering that provides control over the OS and applications. A scale set is a collection of identical VMs, but the definition of a single VM emphasizes full configuration control.
- Question 2Multiple Select
Which two statements correctly describe Azure Virtual Machine Scale Sets (VMSS)?
- AA VMSS can automatically scale out and scale in based on metrics such as CPU or custom metrics.Correct answer
- BA VMSS requires each instance to run a different operating system image.
- CVMSS instances are identical and are often placed behind an Azure Load Balancer or Application Gateway.Correct answer
- DA VMSS provides built-in disaster recovery replication to a secondary region.
Why this is the answer
VMSS deploys identical VMs and supports autoscaling based on metrics. It is commonly integrated with load balancers or application gateways. It does not require different images and does not provide built-in disaster recovery.
- Question 3Interactive
What does running this Azure CLI command accomplish?
- ACreates a Linux virtual machine and generates SSH keysCorrect answer
- BCreates a Windows virtual machine with a password
- CCreates a virtual machine scale set
- DDeletes an existing virtual machine and its SSH keys
Why this is the answer
The command creates an Ubuntu Linux VM and uses --generate-ssh-keys to create SSH keys for authentication.
- Question 4Single Choice
Which high availability option provides physical separation within an Azure region by using separate buildings and offers a 99.99% VM SLA?
- AAvailability ZonesCorrect answer
- BAvailability Sets
- CRecovery Services vault
- DAzure Site Recovery
Why this is the answer
Availability Zones are physically separate locations within an Azure region and provide a 99.99% SLA for VMs. Availability Sets protect against failures inside a single datacenter.
- Question 5Multiple Select
Which two statements about Azure Backup are true?
- AAzure Backup can provide automated failover to a secondary region.
- BAzure Backup stores recovery points in a Recovery Services vault.Correct answer
- CAzure Backup supports soft delete by default to protect against accidental deletion.Correct answer
- DAzure Backup replicates VMs continuously with a recovery point objective of seconds.
Why this is the answer
Azure Backup stores recovery points in a Recovery Services vault and has soft delete enabled by default. Automated failover and continuous replication are features of Azure Site Recovery.
- Question 6Interactive
What is the purpose of the Bicep code shown?
- ADeploys a storage account with locally redundant storageCorrect answer
- BDeploys a virtual machine with a public IP
- CDeploys an App Service plan
- DDeploys a virtual network and subnet
Why this is the answer
The Bicep code declares a Microsoft.Storage/storageAccounts resource with the Standard_LRS SKU and StorageV2 kind, so it deploys a storage account.
- Question 7Single Choice
Which is the minimum App Service plan tier required for autoscaling?
- AFree
- BBasic
- CStandardCorrect answer
- DIsolated
Why this is the answer
Autoscaling is available from the Standard App Service plan tier and above. Basic supports only manual scaling, and Free does not support autoscaling.
- Question 8Multiple Select
Which two statements about App Service deployment slots are correct?
- ADeployment slots are available in Standard, Premium, and Isolated tiers.Correct answer
- BSwapping between slots is performed with zero downtime.Correct answer
- CDeployment slots are automatically created in the Free tier.
- DSlot-sticky settings are moved to the other slot during a swap.
Why this is the answer
Deployment slots are available from Standard tier upward and swapping can be done with zero downtime. Slot-sticky settings remain with their original slot and are not moved during a swap.
- Question 9Interactive
What can be inferred about the storage account name generated by this Bicep code?
- AIt includes the environment name and a unique string based on the resource group ID.Correct answer
- BIt is always exactly 'appdev'.
- CIt is the same for every resource group in the subscription.
- DIt must be manually set as a template parameter with no default.
Why this is the answer
The Bicep variable constructs the name from the 'app' prefix, the environment parameter, and uniqueString(resourceGroup().id), which creates a resource-group-specific unique name.
- Question 10Single Choice
An application must fail over to a secondary Azure region automatically with an RTO of minutes. Which Azure service should be used?
- AAzure Site RecoveryCorrect answer
- BAzure Backup
- CAvailability Sets
- DAzure Monitor
Why this is the answer
Azure Site Recovery replicates VMs to a secondary region and supports automated failover with a recovery time objective of minutes. Azure Backup is for data protection and does not provide automated DR failover.
- Question 11Multiple Select
Which two capabilities are provided by Azure Kubernetes Service (AKS)?
- AAutomatic scaling using the horizontal pod autoscalerCorrect answer
- BPer-second billing with zero cluster management
- CRolling updates controlled by deployment strategiesCorrect answer
- DBuilt-in automatic scaling of Azure Container Instances
Why this is the answer
AKS supports the horizontal pod autoscaler and rolling updates through deployment strategies. Per-second billing with no cluster management describes Azure Container Instances, not AKS.
Implement and manage storage
8 questions in this domain
- Question 12Single Choice
Which storage account kind is the recommended default when you need support for blobs, files, queues, tables, and all access tiers?
- AGeneral-purpose v2Correct answer
- BBlobStorage
- CFileStorage
- DBlockBlobStorage
Why this is the answer
General-purpose v2 is the recommended default because it supports all storage services and all access tiers.
- Question 13Multiple Select
Which replication options are supported for premium block blob and premium Azure file share accounts?
- ALocally Redundant Storage (LRS)Correct answer
- BZone-Redundant Storage (ZRS)Correct answer
- CGeo-Redundant Storage (GRS)
- DRead-Access Geo-Redundant Storage (RA-GRS)
Why this is the answer
Premium block blob and premium file share accounts only support LRS and ZRS; GRS and RA-GRS are not available.
- Question 14Interactive
Review the Azure CLI command in the code block. If a blob is uploaded without an explicit access tier, which tier will be assigned?
- AHotCorrect answer
- BCool
- CArchive
- DPremium
Why this is the answer
The account is created with --access-tier Hot, so blobs uploaded without an explicit tier use the Hot tier.
- Question 15Single Choice
Which storage replication option provides 11 nines of durability?
- ALocally Redundant Storage (LRS)Correct answer
- BZone-Redundant Storage (ZRS)
- CGeo-Redundant Storage (GRS)
- DGeo-Zone-Redundant Storage (GZRS)
Why this is the answer
LRS copies data three times in a single datacenter and provides 11 nines durability.
- Question 16Multiple Select
Which two statements about Azure Blob storage access tiers are correct?
- ACool tier has a 30-day minimum storage duration.Correct answer
- BArchive tier can require up to 15 hours to retrieve a blob.Correct answer
- CArchive tier is an account-level setting.
- DHot tier has the lowest storage cost per GB.
Why this is the answer
Cool has a 30-day minimum, Archive rehydration can take up to 15 hours; Archive is blob-level and Hot has highest storage cost.
- Question 17Interactive
The code block generates a SAS token for a container. Which permissions does the token grant?
- ARead and ListCorrect answer
- BRead and Write
- CWrite and Delete
- DFull control
Why this is the answer
The --permissions rl parameter grants read (r) and list (l) access only.
- Question 18Single Choice
Which SAS option lets you immediately revoke all tokens without regenerating the storage account key?
- AStored access policyCorrect answer
- BUser delegation key
- CAzure AD role assignment
- DStorage firewall rule
Why this is the answer
A stored access policy allows SAS tokens to be revoked immediately by modifying or deleting the policy.
- Question 19Multiple Select
Which two items can Azure Backup protect?
- AAzure VMsCorrect answer
- BSQL ServerCorrect answer
- CAzure Site Recovery replication
- DStorage account access keys
Why this is the answer
Azure Backup protects Azure VMs, on-premises machines, Azure Files, SQL Server, and SAP HANA; ASR replication and access keys are not backup workloads.
Implement and manage virtual networking
6 questions in this domain
- Question 20Single Choice
How many usable IP addresses does a /24 Azure subnet provide after Azure reserves its required addresses?
- A251Correct answer
- B256
- C253
- D252
Why this is the answer
Azure reserves five IP addresses per subnet, so a /24 subnet with 256 total addresses leaves 251 usable addresses.
- Question 21Multiple Select
Which two statements correctly describe VNet peering behavior in Azure?
- AVNet peering is non-transitive by default.Correct answer
- BGlobal peering connects VNets across Azure regions.Correct answer
- CPeering requires overlapping address spaces.
- DPeered VNets share the same DNS servers automatically.
Why this is the answer
VNet peering is non-transitive and can be regional or global. Overlapping address spaces prevent peering, and DNS configuration is not automatically shared.
- Question 22Interactive
You run the subnet creation command shown in the code block. What is the direct result of this command?
- ACreates a /27 subnet with 27 usable addresses.Correct answer
- BCreates a /27 subnet with 32 usable addresses.
- CDelegates the subnet to Azure Container Instances.
- DCreates a /27 subnet with 5 usable addresses.
Why this is the answer
The command creates a subnet named GatewaySubnet using a /27 prefix. A /27 has 32 total addresses; Azure reserves five, leaving 27 usable.
- Question 23Single Choice
Which Network Watcher tool verifies the allow or deny decision for a single packet based on effective NSG rules?
- AIP Flow VerifyCorrect answer
- BNext Hop
- CConnection Monitor
- DPacket Capture
Why this is the answer
IP Flow Verify evaluates a single packet against NSGs and routes, returning the allow or deny decision and the rule that caused it.
- Question 24Multiple Select
Which two options are valid Traffic Manager routing methods?
- APriorityCorrect answer
- BWeightedCorrect answer
- CURL path-based
- DCookie-based affinity
Why this is the answer
Traffic Manager supports priority, weighted, performance, geographic, subnet, and multivalue routing. URL path-based routing and cookie affinity belong to Application Gateway.
- Question 25Interactive
You run the PowerShell script shown in the code block. What does the script accomplish?
- AAssociates NSG1 with the web subnet.Correct answer
- BCreates a new NSG named NSG1.
- CDeletes the web subnet from VNet1.
- DAssigns NSG1 to a VM network interface.
Why this is the answer
The script gets the virtual network, subnet, and NSG, sets the subnet's NetworkSecurityGroup property to NSG1, and saves the updated configuration.
Manage Azure identities and governance
11 questions in this domain
- Question 26Single Choice
Which Azure AD object serves as the identity for an application to authenticate and access Azure resources?
- AService principalCorrect answer
- BUser
- CSecurity group
- DManagement group
Why this is the answer
Service principals are Azure AD identities created for applications, services, and automation tools to authenticate to Azure resources.
- Question 27Multiple Select
Which two membership types can be configured for Azure AD groups?
- AAssignedCorrect answer
- BDynamicCorrect answer
- CSecurity
- DMicrosoft 365
Why this is the answer
Azure AD groups support assigned and dynamic membership. Security and Microsoft 365 are group types, not membership types.
- Question 28Interactive
What is the effect of the command shown in the code block?
- AAssigns the Contributor role to a user at the Finance resource groupCorrect answer
- BCreates a new custom role named Contributor
- CCreates a new Azure AD group
- DApplies an Azure Policy to the subscription
Why this is the answer
This Azure CLI command creates a role assignment that grants the specified user the Contributor role at the Finance resource group scope.
- Question 29Single Choice
Which Azure capability should you use to enforce a rule that virtual machines can only be deployed in West Europe?
- AAzure PolicyCorrect answer
- BAzure RBAC
- CAzure AD roles
- DManagement groups
Why this is the answer
Azure Policy enforces resource configuration rules, such as allowed locations, using effects like Deny. RBAC controls identity permissions, not resource properties.
- Question 30Multiple Select
Which two built-in RBAC roles can delegate access by assigning roles to other users?
- AOwnerCorrect answer
- BUser Access AdministratorCorrect answer
- CContributor
- DReader
Why this is the answer
Only Owner and User Access Administrator can manage role assignments. Contributor can manage resources but cannot delegate access.
- Question 31Interactive
Which statement best describes the effect of the command shown in the code block?
- AAdds a subscription to the Production management groupCorrect answer
- BCreates a new management group named Production
- CDeletes the Production management group
- DAssigns an Azure policy to the subscription
Why this is the answer
The command adds the specified subscription to the Production management group, making it a child of that group.
- Question 32Single Choice
Which Azure AD role must be assigned at the root management group scope to delegate tenant-wide RBAC management?
- AUser Access AdministratorCorrect answer
- BGlobal Administrator
- CApplication Administrator
- DPassword Administrator
Why this is the answer
User Access Administrator at the root scope is needed to assign roles and manage tenant-wide RBAC.
- Question 33Multiple Select
Which two statements about Azure Policy are correct?
- AA Deny effect can block creation of non-compliant resources.Correct answer
- BAzure Policy evaluates resource configuration, not user permissions.Correct answer
- CA Deny effect can prevent resource deletion.
- DPolicy assignments are not inherited by child scopes.
Why this is the answer
Azure Policy enforces configuration rules and can block non-compliant creation with Deny, but it cannot block deletion and assignments inherit to child scopes.
- Question 34Interactive
What is the purpose of the command shown in the code block?
- ACreates a custom RBAC role definitionCorrect answer
- BAssigns a custom role to a user
- CDeletes an existing role definition
- DCreates an Azure Policy definition
Why this is the answer
New-AzRoleDefinition creates a custom role from a JSON file that defines permissions and assignable scopes.
- Question 35Single Choice
In Azure AD Privileged Identity Management, what is an eligible assignment?
- AEligible assignmentCorrect answer
- BActive assignment
- CDirect assignment
- DPermanent assignment
Why this is the answer
An eligible assignment gives the user a role they can activate for a limited time, following PIM activation settings.
- Question 36Multiple Select
Which two access controls can a Conditional Access policy enforce?
- ARequire multi-factor authenticationCorrect answer
- BRequire a compliant deviceCorrect answer
- CAssign an Azure RBAC role
- DCreate a management group
Why this is the answer
Conditional Access grant controls can require MFA and device compliance, but they do not assign RBAC roles or create management groups.
Monitor and maintain Azure resources
6 questions in this domain
- Question 37Single Choice
Which Azure service provides the foundational monitoring platform for collecting, analyzing, and acting on telemetry from cloud and hybrid environments?
- AAzure MonitorCorrect answer
- BAzure Advisor
- CAzure Service Health
- DAzure Cost Management
Why this is the answer
Azure Monitor is the foundational monitoring platform for Azure, providing telemetry collection, analysis, and alerts for cloud and hybrid resources.
- Question 38Multiple Select
Which of the following action types can be configured in an Azure action group? Select all that apply.
- AEmailCorrect answer
- BSMSCorrect answer
- CWebhookCorrect answer
- DAzure Policy assignment
Why this is the answer
Action groups support email, SMS, voice, webhook, ITSM, Azure Function, Logic App, and Automation runbook actions. Azure Policy assignment is not an action group action type.
- Question 39Interactive
Examine the KQL query in the code block. What is the output of this sign-in log query?
- AFailed sign-ins grouped into 15-minute intervalsCorrect answer
- BSuccessful sign-ins grouped into 15-minute intervals
- CAll sign-ins where ResultType is zero
- DA count of all sign-in events by user
Why this is the answer
The query filters SigninLogs to non-zero ResultType values, then uses summarize count() by bin(TimeGenerated, 15m) to count failed sign-ins in 15-minute intervals.
- Question 40Single Choice
Which component of Azure Service Health provides the health state of an individual Azure resource, such as a specific virtual machine?
- AResource HealthCorrect answer
- BAzure Status
- CService Health
- DAzure Advisor
Why this is the answer
Resource Health gives status for individual Azure resources such as a VM. Azure Status and Service Health focus on platform and subscription-level events.
- Question 41Multiple Select
Which two storage tiers are used by Azure VM backup to retain restore points? Select two.
- ASnapshot tierCorrect answer
- BVault tierCorrect answer
- CArchive tier
- DHot tier
Why this is the answer
Azure VM backup uses snapshot (instant restore) tier and vault-standard tier for long-term retention. Archive and Hot are storage tiers for other services.
- Question 42Interactive
Analyze the KQL query in the code block. Which two statements accurately describe the results produced?
- AFilters for error events from the Event tableCorrect answer
- BGroups the count of errors by ResourceGroupCorrect answer
- CReturns all warnings generated in the last hour
- DCounts every event regardless of level
Why this is the answer
The query filters Event for EventLevelName 'Error' and uses summarize count() by ResourceGroup, producing an error count per resource group. It does not include warnings or all events.
Frequently asked questions
Everything about the Microsoft Certified: Azure Administrator Associate question bank and how to use it.