AZ100 Microsoft Azure Infrastructure and Deployment Free Practice Test — 30 Questions

Question 1

A multinational corporation, \"Aetherial Dynamics,\" is implementing a new security standard across all its Azure subscriptions, mandating that all newly deployed Azure virtual machines must not possess a public IP address to mitigate potential attack vectors. A senior cloud engineer has configured an Azure Policy to enforce this standard, assigning it to the root management group with the \"Deny\" effect. During a critical project deployment, a junior administrator attempts to provision a web server virtual machine that, by design, requires a public IP address for external access. What is the immediate outcome of this attempted deployment?

Accepted Answer

The virtual machine provisioning will be blocked by Azure Policy, and the administrator will receive an error message indicating a policy violation.

Question 2

A cloud governance team is implementing Azure Policy to ensure all Azure Storage accounts across the organization are configured to send blob service logs to a central Log Analytics workspace for auditing. They have created a custom policy definition that utilizes the `DeployIfNotExists` effect. The `existenceCondition` within this policy definition is configured to check for the presence of a diagnostic setting that targets the `Microsoft.Storage/storageAccounts/blobServices` resource provider and routes logs to a specific Log Analytics workspace ID. If the condition is not met for a given storage account, the policy will attempt to deploy a new diagnostic setting. Considering a scenario where a storage account exists but has no diagnostic settings configured to send blob service logs to the specified Log Analytics workspace, what is the direct outcome of the Azure Policy evaluation and remediation process for this specific storage account?

Accepted Answer

A new diagnostic setting is deployed to the storage account, configuring it to send blob service logs to the specified Log Analytics workspace.

Question 3

A multinational corporation\'s critical e-commerce platform, hosted on Azure Infrastructure as a Service (IaaS), experiences sporadic periods of unresponsiveness. Users report that the application is sometimes accessible and other times inaccessible, with no clear pattern related to peak traffic times. The platform utilizes Azure Virtual Machines for its web servers, which are fronted by an Azure Standard Load Balancer configured to distribute incoming HTTP and HTTPS traffic. Diagnostic logs from the load balancer and backend VMs indicate that network connectivity to the VMs is generally stable, and CPU and memory utilization on the VMs are within acceptable ranges during these episodes. The IT operations team suspects that the load balancer\'s mechanism for determining backend instance health might be too sensitive to minor, transient application delays.

Which of the following actions would most effectively address the intermittent unavailability by refining the load balancer\'s health monitoring and traffic distribution strategy?

Accepted Answer

Configure Network Security Groups (NSGs) to explicitly allow inbound traffic on ports 80 and 443 for all backend virtual machines within the relevant virtual network subnets.

Question 4

A cloud architect is tasked with ensuring that all virtual machines deployed within a specific Azure subscription adhere to the organization\'s security standard of having a Network Security Group (NSG) associated with their primary network interface. The architect needs a robust and scalable mechanism to identify and potentially rectify any deviations from this standard across the entire subscription. What is the most effective Azure service and configuration to achieve this objective, ensuring continuous compliance monitoring?

Accepted Answer

Assign an Azure Policy at the subscription scope that audits virtual machines lacking an NSG on their primary network interface, with the potential to enable remediation tasks.

Question 5

A cloud security architect is tasked with mandating the deployment of the Microsoft Antimalware extension on all virtual machines within the \"Production-EU-West\" resource group to adhere to the company\'s stringent cybersecurity baseline, which includes regular threat scanning. The architect needs a scalable and automated solution to ensure this requirement is met for both existing and newly provisioned virtual machines. Which Azure management tool and action would most effectively achieve this objective?

Accepted Answer

Assign an Azure Policy definition that enforces the presence and configuration of the Microsoft Antimalware extension to the "Production-EU-West" resource group.

Question 6

A critical Azure virtual machine hosting a vital customer-facing application has become completely unresponsive. Users are reporting a complete outage. The IT operations team has been alerted and needs to act swiftly to restore functionality. What is the most appropriate initial action to take to address this situation?

Accepted Answer

Attempt to restart the virtual machine through the Azure portal or Azure CLI.

Question 7

A cloud governance team at a global financial services firm is tasked with enhancing the security posture of their Azure environment. A critical requirement is to ensure that every new virtual machine deployed within the production resource groups automatically inherits a predefined network security group (NSG) that enforces stringent inbound and outbound traffic rules. Furthermore, any existing subnets within the production virtual networks that are not currently associated with this specific NSG must also be brought into compliance. The team needs a solution that is scalable, auditable, and can proactively enforce this network security standard without manual intervention for each deployment or a complex scripting approach for existing resources.

Accepted Answer

Implement a custom Azure Policy with the "deployIfNotExists" effect to audit subnets for NSG association and remediate non-compliant ones by associating the required NSG.

Question 8

Following a critical incident where a production application on an Azure virtual machine requires immediate troubleshooting by a specialized engineer, the security team needs to grant temporary administrative access to this specific VM. The engineer is not a permanent member of the infrastructure team and should only have elevated privileges for a limited, defined period, with clear auditing of their actions. The organization adheres to strict security policies that prohibit the permanent assignment of broad administrative roles to individuals who do not require them on an ongoing basis. Which Azure Identity and Access Management feature should be implemented to fulfill this requirement in the most secure and compliant manner?

Accepted Answer

Configure Azure AD Privileged Identity Management (PIM) to grant the engineer eligible access to a role that permits VM administration, requiring them to activate the role for a specified duration.

Question 9

A critical business application hosted on Azure, utilizing Azure Virtual Machines within a custom Virtual Network (VNet) and fronted by an Azure Load Balancer, is experiencing intermittent connectivity failures. Users report being unable to reach the application for brief periods, after which connectivity is restored spontaneously. Azure Monitor metrics for the Virtual Machines show no significant resource exhaustion (CPU, memory, disk I/O), and application logs indicate no direct application errors during these outages. The Azure Service Health dashboard currently shows no platform-wide incidents impacting the region or the specific services used. What systematic diagnostic approach should the Azure administrator prioritize to effectively identify and resolve the root cause of these intermittent connectivity disruptions?

Accepted Answer

Utilize Azure Network Watcher's Connection Troubleshoot and IP Flow Verify tools, analyze VNet routing tables, and review Network Security Group (NSG) and Azure Firewall rules for any anomalies or misconfigurations that might be intermittently blocking traffic, alongside a review of the Load Balancer's health probes and backend pool configurations.

Question 10

An organization\'s primary e-commerce application, hosted on Azure virtual machines within a custom virtual network, is experiencing sporadic and unpredictable network disruptions. Users report occasional inability to access the application\'s web front-end. The lead Azure administrator has already verified the Network Security Group (NSG) rules applied to the VM\'s network interface and confirmed that inbound traffic on port 443 is permitted from the internet. Additionally, basic connectivity checks to other internal Azure resources from the affected VMs appear functional, though also intermittent. The administrator suspects a more complex routing or filtering issue affecting the specific ingress path. Which Azure Network Watcher capability would provide the most granular and actionable insights to diagnose the root cause of these intermittent connectivity failures for the web front-end?

Accepted Answer

Connection Troubleshoot

Question 11

A cloud administrator for a global e-commerce platform observes an unusual spike in inbound traffic to a critical customer-facing web application hosted on Azure Virtual Machines. Network logs indicate that this traffic originates from a range of unexpected IP addresses and is attempting to exploit known vulnerabilities in the application\'s presentation layer. The platform operates under strict data privacy regulations, requiring robust security measures for all customer-facing services. What is the most effective initial step the administrator should take to mitigate this unauthorized access?

Accepted Answer

Review and reconfigure Network Security Groups (NSGs) associated with the virtual network hosting the web application.

Question 12

A financial services firm is undertaking a strategic initiative to modernize its core trading platform by migrating a critical legacy application from its on-premises data center to Microsoft Azure. This application, which processes real-time market data and executes trades, relies on a shared file system where multiple instances of the application, running on separate virtual machines, frequently read and write configuration parameters. The firm mandates that all application instances must access the most up-to-date configuration with minimal latency to ensure trading accuracy and responsiveness. Furthermore, the solution must offer robust high availability and fault tolerance, as downtime is unacceptable. While cost optimization is a consideration, it is secondary to performance and reliability. Given these requirements, which Azure storage service would be the most suitable for hosting the application\'s shared configuration data, enabling a seamless transition and meeting the stringent operational demands?

Accepted Answer

Azure Files Premium

Question 13

Consider a scenario where an organization mandates that all newly provisioned Azure virtual machines must have diagnostic settings configured to forward operating system logs to a specific Log Analytics workspace. A policy assignment using the `DeployIfNotExists` effect has been implemented at the subscription level to enforce this requirement. If a virtual machine is deployed without the requisite diagnostic settings, what is the primary Azure service responsible for detecting this non-compliance and initiating the deployment of the remediation ARM template to create the missing diagnostic configuration?

Accepted Answer

Azure Policy service

Question 14

A critical legacy financial reporting application, deployed on Azure Virtual Machines, has begun exhibiting unpredictable periods of unavailability. Business stakeholders report that the application randomly becomes unresponsive for several minutes at a time, with no clear pattern related to specific business hours or transaction volumes. Initial investigations by the operations team have confirmed that the underlying Azure network connectivity to the VM and the VM\'s operating system itself appear stable and healthy, with no obvious critical errors logged. The application team has also verified that no recent code deployments or significant configuration changes have been made that would directly explain these intermittent outages. The company operates under strict financial reporting regulations that mandate high availability and auditability. What is the most appropriate next step to diagnose and resolve the root cause of this application\'s intermittent availability problem?

Accepted Answer

Conduct a comprehensive performance analysis of the application and its underlying Azure resources, focusing on resource utilization patterns (CPU, memory, disk I/O) within the virtual machine and the performance characteristics of any dependent Azure services, to identify potential bottlenecks or contention issues.

Question 15

A cloud administrator is responsible for managing a fleet of Azure virtual machines that experience significant seasonal demand shifts. During peak periods, the VMs are heavily utilized, but during off-peak seasons, their utilization drops considerably. The organization aims to achieve substantial cost savings without compromising the ability to scale resources up or down as needed, and they are willing to make a moderate commitment to Azure services. The administrator must select the most appropriate Azure pricing model to balance cost efficiency with operational flexibility for this dynamic workload.

Accepted Answer

Azure Savings Plan for Compute

Question 16

Anya, an Azure administrator for a global financial services firm, is tasked with rapidly provisioning a cluster of identical virtual machines for a critical, time-sensitive analytics workload. The deployment must adhere to strict security baselines and networking configurations, including specific subnet assignments and NSG rules. Suddenly, a widespread, intermittent connectivity issue affects the Azure portal and several key Azure management APIs, rendering them unstable and unreliable for interactive use. Anya needs to ensure the VMs are deployed accurately and efficiently within the next hour to meet the business deadline, even with the ongoing service instability. Which method should Anya prioritize to achieve this deployment under the prevailing adverse conditions?

Accepted Answer

Utilize a pre-authored Bicep deployment script executed via Azure CLI, targeting the necessary resource group and parameters for the virtual machines and their associated network resources.

Question 17

Anya, a senior cloud administrator, is orchestrating the migration of a critical, legacy on-premises application to Azure. This application relies heavily on a specialized, proprietary network appliance for sophisticated inter-service communication and intelligent load balancing, functionalities that are deeply embedded in its architecture. Anya must select an Azure networking service that can effectively replicate these essential functions, ensuring robust performance and adhering to strict security principles, particularly the principle of least privilege. Which Azure networking service would be most appropriate for emulating the advanced, application-aware traffic management and load balancing capabilities of the proprietary appliance?

Accepted Answer

Azure Application Gateway

Question 18

Following a significant, unexpected disruption to a core customer-facing application hosted on Azure, which of the following Azure services, when proactively utilized and its recommendations actioned, would most effectively contribute to identifying potential underlying architectural vulnerabilities and resource misconfigurations that may have precipitated the incident, thereby bolstering long-term service resilience and preventing similar future occurrences?

Accepted Answer

Azure Advisor

Question 19

A global e-commerce platform relies on a mission-critical Azure Virtual Machine for processing real-time transactions. During a routine maintenance window, an unforeseen storage subsystem failure in the primary Azure region renders the VM inaccessible, causing significant business disruption. The organization has a strict Recovery Point Objective (RPO) of no more than 5 minutes for this VM. Which Azure disaster recovery strategy, when implemented with the most aggressive replication setting, would best satisfy this RPO requirement?

Accepted Answer

Azure Site Recovery configured with continuous replication to a secondary Azure region.

Question 20

A development team is tasked with migrating a critical legacy application to Azure. This application relies on a proprietary database system that has specific operating system dependencies and is not compatible with Azure SQL Database or Azure Database for PostgreSQL. The team\'s primary objectives are to ensure the application\'s continued functionality with minimal code modification, achieve high availability, and establish a robust disaster recovery strategy. Which combination of Azure services would best meet these requirements for the database component of the migration?

Accepted Answer

Deploy the proprietary database on Azure Virtual Machines configured within an Availability Set, with a disaster recovery replica in a secondary Azure region.

Question 21

A critical legacy application, undergoing migration to Azure, relies heavily on sub-10-millisecond latency between its front-end and back-end components, both hosted on separate virtual machines within the same Azure Virtual Network. Initial deployment utilized standard Azure Virtual Machines with Standard SSD managed disks and default Network Security Groups. Post-deployment performance tests revealed that the inter-VM latency frequently surpassed the required threshold, impacting the application\'s real-time data processing capabilities. What strategic infrastructure adjustment should the deployment team prioritize to directly mitigate this observed network latency issue between the virtual machines?

Accepted Answer

Migrate the virtual machines to utilize Premium SSD managed disks.

Question 22

A multinational corporation\'s mission-critical web application, hosted on Azure Virtual Machines with an Azure SQL Database backend, is scheduled for a significant infrastructure upgrade that necessitates a temporary Azure region shutdown for maintenance. The application experiences peak traffic during the planned maintenance window. To ensure continuous operation and meet stringent Service Level Agreements (SLAs) that mandate less than 5 minutes of downtime, which Azure service, when properly configured, would best facilitate a seamless transition to an alternate operational state with minimal disruption?

Accepted Answer

Azure Site Recovery

Question 23

A global e-commerce platform operating on Azure App Service is experiencing significant performance degradation and intermittent connection failures during its daily promotional events, which cause a surge in user traffic. The current deployment consists of a single, manually scaled instance of the App Service Plan. The operations team needs to implement a solution that automatically adjusts the application\'s capacity to match user demand, ensuring continuous availability and a seamless user experience, especially when the backlog of incoming requests begins to grow rapidly.

Which configuration strategy would best address this challenge by dynamically scaling the App Service based on real-time demand indicators?

Accepted Answer

Implement an auto-scale rule that increases the number of App Service instances when the HTTP Queue Length exceeds a predefined threshold, up to a specified maximum.

Question 24

A cloud administrator is tasked with enabling secure remote desktop protocol (RDP) access to Azure virtual machines for a newly established security operations center (SOC) team, whose IP address range is 192.168.10.0/24. Currently, inbound RDP traffic on port 3389 is permitted only from an existing IT management subnet (10.0.0.0/24) via a network security group (NSG) rule with priority 100. A broader rule with priority 200 explicitly denies RDP from all other IP address ranges to enhance security. The administrator needs to ensure the SOC team can connect without compromising the existing access for the IT management team, and crucially, without inadvertently allowing RDP from other unauthorized sources. Which modification to the NSG configuration would best satisfy these requirements?

Accepted Answer

Insert a new inbound security rule with priority 150 that allows RDP (TCP port 3389) from the source IP address range 192.168.10.0/24.

Question 25

A global logistics firm is undertaking a strategic initiative to modernize its IT infrastructure by integrating its existing on-premises Active Directory Domain Services (AD DS) with Azure Active Directory (Azure AD). The firm aims to enable seamless single sign-on (SSO) for its employees accessing cloud-based productivity suites and internal SaaS applications, while also enforcing multi-factor authentication (MFA) for enhanced security. Furthermore, they intend to manage device identities and enforce conditional access policies for a growing remote workforce. Given these objectives, which Azure service is the most fundamental and directly applicable for establishing and managing this hybrid identity environment, ensuring the synchronization of user, group, and device objects between the on-premises AD DS and Azure AD?

Accepted Answer

Azure AD Connect

Question 26

A mid-sized enterprise is planning a phased migration of its IT infrastructure to Microsoft Azure. A critical component of this migration involves enabling seamless access to various SaaS applications hosted in Azure for its employees, who currently authenticate against an on-premises Active Directory Domain Services (AD DS) environment. The organization\'s primary objective is to achieve a single sign-on (SSO) experience for these cloud-based applications without requiring users to manage separate credentials. Furthermore, they want to ensure that the on-premises AD DS remains the authoritative source for user identity information throughout this transition. Considering these requirements, which Azure identity synchronization and authentication method would best facilitate this objective while minimizing the complexity of the initial setup and ongoing management?

Accepted Answer

Implement Azure AD Connect with password hash synchronization.

Question 27

A global e-commerce platform, hosted on Azure, is experiencing a complete outage of its primary customer-facing portal due to an unforeseen configuration error in its core network gateway service. This has halted all transactions and customer interactions across multiple continents. The existing architecture relies on a single active deployment in one Azure region, with a secondary standby environment in another region that has not been tested for automated failover in over a year. The incident response team has identified the configuration error but is struggling to manually initiate a seamless transition to the secondary region due to complex, undocumented dependencies. Which of the following strategic adjustments would most effectively address both the immediate crisis and prevent future occurrences of such widespread service disruption?

Accepted Answer

Immediately re-architect the application to a multi-region active-active deployment utilizing Azure Traffic Manager for intelligent DNS-based traffic routing and implement automated health probes for seamless failover, while concurrently conducting a thorough post-mortem to identify and remediate the root cause of the configuration error and its propagation.

Question 28

Aether Dynamics, a cloud-native enterprise, is implementing a robust security posture for its sensitive customer data residing in Azure Blob Storage. They have configured a Microsoft Entra ID conditional access policy with the following stipulations: access is granted only to Hybrid Azure AD joined or Azure AD joined devices that are marked as compliant by Microsoft Intune. Furthermore, access is permitted from any location, with the explicit exclusion of predefined trusted network locations (corporate IP ranges). Consider a scenario where Anya, a senior consultant, attempts to access a customer dataset within Azure Blob Storage using her personal, unmanaged Windows laptop while working remotely from a coffee shop.

What is the most likely outcome of Anya\'s access attempt?

Accepted Answer

Anya will be prompted to register her device with Intune and join it to Azure AD before gaining access.

Question 29

A cloud security architect is tasked with strengthening the inbound network security posture across a critical Azure subscription. To comply with a new internal security mandate, it is imperative that every network security group (NSG) associated with virtual machines within this subscription must explicitly deny all inbound traffic destined for port 22 (SSH) originating from any IP address. The architect needs to implement a mechanism that proactively identifies and prevents any deviation from this rule. Which of the following Azure Policy definitions would most effectively enforce this requirement?

Accepted Answer

An Azure Policy definition with a `Deny` effect, targeting `Microsoft.Network/networkSecurityGroups`, and utilizing an `existenceCondition` to verify the presence of a security rule with `direction` as `Inbound`, `destinationPortRange` as `22`, `sourceAddressPrefix` as `*`, and `access` as `Deny`.

Question 30

An organization is migrating sensitive financial applications to Azure and must adhere to strict Payment Card Industry Data Security Standard (PCI DSS) requirements. A key compliance objective is to ensure that all newly deployed Azure Virtual Network Gateways utilize only approved, robust encryption protocols for VPN connections. The security team has identified that certain legacy configurations might be inadvertently selected during deployment, posing a compliance risk. Which Azure Policy approach is most effective in proactively preventing the deployment of Virtual Network Gateways with non-compliant VPN client protocols?

Accepted Answer

Implementing a custom Azure Policy definition that audits or denies the creation of Virtual Network Gateways if their configured VPN client protocols do not align with the organization's defined secure protocol list.

AZ100 Microsoft Azure Infrastructure and Deployment Free Practice Test — 30 Questions

A lot more is already mapped out

About the AZ100 Microsoft Azure Infrastructure and Deployment Certification