Question bank
Azure Solutions Architect Expert
42 Azure Solutions Architect Expert questions with the correct answer and a written explanation, organised across 4 exam domains.
- 42 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Design business continuity solutions
8 questions in this domain
- Question 1Single Choice
Which Azure service is the native orchestration solution for workload replication, failover, and failback in a disaster recovery design?
- AAzure Site RecoveryCorrect answer
- BAzure Backup
- CAzure Storage
- DAzure Monitor
Why this is the answer
Azure Site Recovery performs continuous replication and automated failover/failback, while Azure Backup provides point-in-time data protection.
- Question 2Multiple Select
Which two statements correctly describe Read-Access Geo-Redundant Storage (RA-GRS)?
- ARead access to data in the secondary regionCorrect answer
- BWrite access to the secondary region
- CAsynchronous replication to a paired secondary regionCorrect answer
- DSynchronous replication to two secondary regions
Why this is the answer
RA-GRS provides read-only access to asynchronously replicated data in a paired secondary region, after local synchronous replication in the primary.
- Question 3Interactive
The code block contains Azure CLI commands for configuring a backup management entity. Which entity is being provisioned?
- ARecovery Services VaultCorrect answer
- BBackup Vault
- CSite Recovery Vault
- DStorage Sync Service
Why this is the answer
The commands use the Azure CLI backup vault group, which provisions a Recovery Services Vault for Azure Backup workloads.
- Question 4Single Choice
What does Recovery Point Objective (RPO) define in a business continuity plan?
- AMaximum acceptable data loss measured in timeCorrect answer
- BMaximum duration of downtime after a disaster
- CMinimum time required to test backups
- DTime interval for automatic failover
Why this is the answer
RPO is the maximum acceptable data loss expressed as time; RTO is the maximum acceptable duration of downtime.
- Question 5Multiple Select
Which two capabilities are provided by Azure Site Recovery?
- AContinuous replication to a secondary locationCorrect answer
- BOrchestrated failover and failbackCorrect answer
- CLong-term compliance archiving
- DImmutable storage for audit logs
Why this is the answer
Azure Site Recovery focuses on replication and orchestrated failover or failback; long-term archiving is handled by Azure Backup.
- Question 6Interactive
An architect is reviewing the code block, which defines an Azure compute resource. Which service is represented by the resource block?
- AVirtual Machine Scale SetCorrect answer
- BAvailability Set
- CApp Service plan
- DAzure Site Recovery vault
Why this is the answer
The resource block defines a Linux Virtual Machine Scale Set in Flexible orchestration mode with instances distributed across three zones.
- Question 7Single Choice
What is the primary purpose of Azure App Service deployment slots?
- AStage and swap application releases with zero downtimeCorrect answer
- BReplicate VMs to a secondary region
- CAuto-scale backend virtual machines
- DProvide geo-redundant storage for application data
Why this is the answer
Deployment slots host different application versions for staging and allow an immediate swap with the production slot to avoid downtime.
- Question 8Multiple Select
Which two statements accurately describe Geo-Redundant Storage (GRS)?
- ASynchronous triple replication within the primary regionCorrect answer
- BAsynchronous replication to a paired secondary regionCorrect answer
- CRead access to paired secondary by default
- DWrite access to secondary region for failover
Why this is the answer
GRS synchronously maintains three copies in the primary region and then asynchronously replicates to a secondary region; RA-GRS adds read access.
Design data storage solutions
9 questions in this domain
- Question 9Single Choice
Which Azure Cosmos DB consistency level provides the strongest data consistency guarantee for globally distributed applications?
- AStrongCorrect answer
- BBounded Staleness
- CEventual
- DSession
Why this is the answer
Strong consistency provides the strongest data guarantee by ensuring reads always return the latest committed write in Azure Cosmos DB.
- Question 10Multiple Select
Which two Azure Storage redundancy options replicate your data to a secondary Azure region for disaster recovery? Select two.
- ALocally redundant storage (LRS)
- BGeo-redundant storage (GRS)Correct answer
- CGeo-zone-redundant storage (GZRS)Correct answer
- DZone-redundant storage (ZRS)
Why this is the answer
Geo-redundant storage (GRS) and geo-zone-redundant storage (GZRS) replicate data to a secondary Azure region, while LRS and ZRS do not.
- Question 11Interactive
The code block shows a JSON document with user preferences and order details. Which Azure service should store this semi-structured document with global low-latency access?
- AAzure Cosmos DBCorrect answer
- BAzure SQL Database
- CAzure Blob Storage
- DAzure Data Factory
Why this is the answer
Azure Cosmos DB is the recommended multi-model NoSQL service for globally distributed, schema-less JSON documents that require low-latency access.
- Question 12Single Choice
Which feature must be enabled when creating an Azure Storage account to support Azure Data Lake Storage Gen2 functions?
- AHierarchical namespaceCorrect answer
- BSoft delete
- CBlob versioning
- DInfrastructure encryption
Why this is the answer
The hierarchical namespace must be enabled during Azure Storage account creation because it cannot be added later to an existing standard storage account.
- Question 13Multiple Select
Which two access control mechanisms can be used to secure Azure Storage accounts and their data? Select two.
- ARole-Based Access Control (RBAC)Correct answer
- BShared Access Signatures (SAS)Correct answer
- CAzure SQL firewall rules
- DAzure Databricks clusters
Why this is the answer
RBAC and Shared Access Signatures are Azure Storage security mechanisms that control access to data without exposing account keys.
- Question 14Interactive
The SQL query in the code block uses joins to combine relational data. Which Azure data architecture is best suited to run this workload?
- AAzure SQL DatabaseCorrect answer
- BAzure Cosmos DB
- CAzure Blob Storage
- DAzure Data Lake Storage Gen2
Why this is the answer
Azure SQL Database is designed for structured relational data with SQL joins, foreign keys, and ACID transactional guarantees.
- Question 15Single Choice
Which Azure Cosmos DB design consideration must be controlled to avoid hot partitions and request rate limiting?
- APartition key selectionCorrect answer
- BConsistency level
- CRedundancy option
- DData lifecycle policy
Why this is the answer
Proper partition key design distributes request units evenly across Azure Cosmos DB physical partitions, preventing hot spots and 429 throttling errors.
- Question 16Multiple Select
Which two statements about Azure Data Factory are correct for data integration workloads? Select two.
- AADF orchestrates low-code ETL/ELT pipelines.Correct answer
- BADF uses Self-Hosted IR for on-premises access.Correct answer
- CADF is optimized for machine learning model training.
- DADF is best for high-throughput IoT telemetry ingestion.
Why this is the answer
Azure Data Factory is a low-code orchestration service, and its Self-Hosted Integration Runtime enables secure hybrid data movement to on-premises sources.
- Question 17Interactive
The JSON code block describes high-throughput telemetry from IoT sensors. Which Azure service should ingest the event stream for real-time processing?
- AAzure Event HubsCorrect answer
- BAzure Data Factory
- CAzure SQL Database
- DAzure Table Storage
Why this is the answer
Azure Event Hubs is designed for high-throughput telemetry and event ingestion, supporting millions of events per second from IoT devices.
Design identity, governance, and monitoring solutions
12 questions in this domain
- Question 18Single Choice
Which Microsoft Entra ID capability applies context-aware access rules based on user, device, location, and risk signals?
- AConditional AccessCorrect answer
- BAzure Policy
- CPrivileged Identity Management
- DManagement Groups
Why this is the answer
Conditional Access is the Entra ID engine that evaluates contextual signals before granting access. Azure Policy and management groups address governance, and PIM governs privileged roles.
- Question 19Multiple Select
Which two capabilities are core components of Microsoft Entra ID Privileged Identity Management (PIM)? Select two.
- AJust-in-time privileged role activationCorrect answer
- BTime-bound role assignments with approval workflowsCorrect answer
- CContinuous enforcement of resource tags
- DBlocking legacy authentication protocols by default
Why this is the answer
PIM provides just-in-time, time-bound access to privileged roles. Tag enforcement is Azure Policy, and conditional access controls legacy authentication.
- Question 20Interactive
The policy rule in the code block defines a condition and an effect. Which effect blocks resource creation outside approved regions?
- ADenyCorrect answer
- BAudit
- CDeployIfNotExists
- DAppend
Why this is the answer
Deny prevents the resource creation request when the policy condition is met. Audit only logs compliance, while DeployIfNotExists and Append modify existing or new resources.
- Question 21Single Choice
Which Microsoft Entra ID synchronization method validates users by sending the on-premises password hash to Microsoft Entra ID for authentication?
- APassword Hash SynchronizationCorrect answer
- BPass-Through Authentication
- CActive Directory Federation Services
- DAzure Policy
Why this is the answer
Password Hash Synchronization replicates password hashes to Microsoft Entra ID and validates sign-in in the cloud. Pass-through and federation validate on-premises.
- Question 22Multiple Select
Which two actions are correctly implemented with Azure Policy rather than Azure RBAC? Select two.
- AEnforcing mandatory tags on resourcesCorrect answer
- BRestricting resource creation to approved Azure regionsCorrect answer
- CGranting a user Contributor access to a resource group
- DReviewing user access to applications with access reviews
Why this is the answer
Azure Policy governs resource configuration, such as tags and allowed regions. RBAC grants identity permissions, and access reviews belong to identity governance.
- Question 23Interactive
The command in the code block creates which Azure governance structure?
- AManagement GroupCorrect answer
- BAzure Policy Initiative
- CLog Analytics Workspace
- DResource Group
Why this is the answer
The Azure CLI command creates a management group, which can organize subscriptions and inherit policy and RBAC assignments.
- Question 24Single Choice
Which Azure service acts as the central data plane for collecting and analyzing telemetry from Azure and hybrid resources?
- AAzure MonitorCorrect answer
- BAzure Application Insights
- CLog Analytics
- DMicrosoft Sentinel
Why this is the answer
Azure Monitor is the unified monitoring pipeline. Application Insights provides APM, Log Analytics stores logs, and Sentinel is a SIEM.
- Question 25Multiple Select
Which two components are required in an Azure Monitor alerting strategy? Select two.
- AAn alert rule that defines a conditionCorrect answer
- BAn action group that receives notificationsCorrect answer
- CA management group hierarchy
- DA connection string from Application Insights
Why this is the answer
An alert rule defines the signal and condition, and an action group defines the notification or automated response. The other options do not directly form the alert strategy.
- Question 26Interactive
In which Azure Monitor component should you run the query shown in the code block?
- ALog Analytics workspaceCorrect answer
- BAzure Policy
- CPrivileged Identity Management
- DManagement Group
Why this is the answer
Log Analytics workspaces store and query Azure log data using KQL. The other choices are governance or identity tools.
- Question 27Single Choice
Which Azure service provides code-level application performance monitoring and distributed tracing?
- AAzure Application InsightsCorrect answer
- BAzure Monitor Metrics
- CLog Analytics workspace
- DAzure Policy
Why this is the answer
Application Insights is Azure Monitor's application performance monitoring component for code-level telemetry and distributed tracing.
- Question 28Multiple Select
Which two benefits are provided by Azure Management Groups? Select two.
- AInheritance of Azure Policy assignments to subscriptionsCorrect answer
- BInheritance of Azure RBAC assignments to subscriptionsCorrect answer
- CDirectly changing resource properties on existing VMs
- DDefining user authentication rules
Why this is the answer
Management groups enable subscription-level inheritance for policies and role assignments. They do not change resource configuration or authentication behavior.
- Question 29Interactive
The command in the code block routes diagnostic data to which destination?
- AA Log Analytics workspaceCorrect answer
- BAn Azure Storage account
- CAn Azure Event Hub
- DAn Azure Automation account
Why this is the answer
Diagnostic settings can stream logs to Log Analytics, storage, or Event Hubs; this command specifies a Log Analytics workspace with the workspace parameter.
Design infrastructure solutions
13 questions in this domain
- Question 30Single Choice
Which Azure compute service provides the highest level of control over the operating system and underlying hardware configuration?
- AVirtual MachinesCorrect answer
- BAzure App Service
- CAzure Container Instances
- DAzure Kubernetes Service
Why this is the answer
Virtual Machines are an IaaS service that gives architects full control over the operating system and underlying hardware, making them ideal for custom configurations and legacy migrations.
- Question 31Multiple Select
Which two statements accurately describe Azure App Service?
- AFully managed PaaS for web apps and APIsCorrect answer
- BBuilt-in scaling tiers and integrated SSLCorrect answer
- CAbsolute control over the OS kernel
- DBest for isolated batch tasks
Why this is the answer
Azure App Service is a fully managed PaaS with built-in scaling and SSL. OS kernel control belongs to VMs, and isolated batch tasks are a fit for Container Instances.
- Question 32Interactive
An architect runs the command in the code block to deploy a container. Which Azure compute service is being used?
- AAzure Container InstancesCorrect answer
- BAzure Kubernetes Service
- CAzure App Service
- DVirtual Machines
Why this is the answer
The command uses az container create, which is the Azure CLI command for Azure Container Instances, the fastest managed option for running containers.
- Question 33Single Choice
Which Azure compute capability provides centralized management and auto-scaling of identical virtual machines for fault-tolerant architectures?
- AVirtual Machine Scale SetsCorrect answer
- BAzure App Service
- CAzure Container Instances
- DAzure Kubernetes Service
Why this is the answer
Virtual Machine Scale Sets manage identical VMs, support custom scaling based on metrics, and provide automatic healing across Availability Zones.
- Question 34Multiple Select
Which two statements correctly describe Azure Load Balancer?
- ALayer 4 TCP and UDP balancingCorrect answer
- BSSL termination and URL routing
- CInternal and public-facing endpointsCorrect answer
- DFQDN-based outbound filtering
Why this is the answer
Azure Load Balancer operates at Layer 4 and supports internal or public endpoints. SSL termination and URL routing belong to Application Gateway, and FQDN filtering belongs to Azure Firewall.
- Question 35Interactive
The code block contains an inbound rule that denies traffic to a database port from a specific subnet. Which Azure component is defined by this configuration?
- ANetwork Security GroupCorrect answer
- BAzure Firewall
- CApplication Gateway
- DAzure DNS
Why this is the answer
The rule filters by source IP, protocol, port, and direction at the network layer, which is characteristic of a Network Security Group.
- Question 36Single Choice
Which Azure service provides centralized stateful inspection from Layer 4 through Layer 7 with FQDN filtering and threat intelligence?
- AAzure FirewallCorrect answer
- BNetwork Security Group
- CAzure Load Balancer
- DApplication Gateway
Why this is the answer
Azure Firewall is a managed cloud security service that provides centralized Layer 4 through Layer 7 inspection, FQDN filtering, and threat intelligence.
- Question 37Multiple Select
Which two capabilities are provided by Azure Application Gateway?
- ALayer 7 HTTP and HTTPS managementCorrect answer
- BCookie affinity and URL path routingCorrect answer
- CTCP and UDP packet forwarding
- DFQDN filtering and threat intelligence
Why this is the answer
Application Gateway is a dedicated Layer 7 web traffic load balancer with cookie affinity, URL path routing, and WAF; TCP/UDP forwarding belongs to Load Balancer.
- Question 38Interactive
The command in the code block creates a hub-side VNet peering. Which parameter must be added to the spoke-side peering so the spoke can use the hub gateway?
- A--use-remote-gatewaysCorrect answer
- B--allow-forwarded-traffic
- C--allow-gateway-transit
- D--no-wait
Why this is the answer
For a spoke VNet to reach on-premises through a hub gateway, the spoke-side peering must enable the use of remote gateways.
- Question 39Single Choice
Which statement best describes Azure DNS Private Zones?
- ADNS within VNets without custom serversCorrect answer
- BForces traffic through a security appliance
- CBalances TCP and UDP traffic
- DFilters traffic by fully qualified domains
Why this is the answer
Azure DNS Private Zones provide reliable DNS resolution inside virtual networks and across peered networks without the need for custom DNS server deployments.
- Question 40Multiple Select
Which two scenarios justify selecting Azure Kubernetes Service over Azure App Service?
- AComplex microservices with advanced networkingCorrect answer
- BSimple single-container web app
- CMulti-tenant isolation and declarative deploymentsCorrect answer
- DOne-off batch job
Why this is the answer
AKS is for complex microservices, advanced networking, declarative deployments, and multi-tenant isolation; simple apps and one-off jobs are better on App Service or Container Instances.
- Question 41Interactive
The container command in the code block is most appropriate for which workload scenario?
- ACI/CD build agents and simple tasksCorrect answer
- BMulti-container microservices with service mesh
- CLegacy Windows Server custom registry workloads
- DEnterprise portal with integrated SSL
Why this is the answer
Azure Container Instances is ideal for isolated containers, batch processing, low-complexity event-driven tasks, and CI/CD build agents.
- Question 42Single Choice
Which common architectural mistake is made when selecting compute for a simple single-container web app?
- AAKS for a simple single-container web appCorrect answer
- BVirtual Machines instead of AKS
- CACI instead of Virtual Machines
- DApp Service instead of AKS for microservices
Why this is the answer
A single-container workload does not require Kubernetes. Azure App Service or Azure Container Instances deliver the solution more cost-effectively with lower management overhead.
Frequently asked questions
Everything about the Azure Solutions Architect Expert question bank and how to use it.