Microsoft Azure Solutions Architect Expert Flashcards

A company needs to ensure that Azure VMs in a production subscription cannot be created without a specific tag. Which Azure feature enforces this?

Answer: Azure Policy with deny effect

Azure Policy with a 'deny' effect blocks resource creation that doesn't meet defined tag requirements.

Which Azure storage redundancy option provides the highest availability by replicating data across two regions and three availability zones in the primary region?

Answer: Geo-zone-redundant storage (GZRS)

GZRS combines zone-redundant replication in the primary region with geo-replication to a secondary region for maximum durability.

An architect must design a solution where Azure Functions can securely access Azure Key Vault without storing credentials in code. What is the recommended approach?

Answer: Use a system-assigned managed identity

A system-assigned managed identity allows Azure Functions to authenticate to Key Vault without any stored credentials.

A solution requires a globally distributed NoSQL database with multi-region writes and automatic failover. Which Azure service best fits this requirement?

Answer: Azure Cosmos DB

Azure Cosmos DB supports multi-region writes with configurable consistency levels and automatic failover.

When designing an Azure Virtual Network, which component is used to control inbound and outbound traffic at the subnet level?

Answer: Network Security Group (NSG)

Network Security Groups are applied at the subnet or NIC level to filter traffic using allow/deny rules.

A company wants to migrate 200 on-premises VMs to Azure with minimal downtime. Which Azure service replicates VMs continuously and enables a cutover with minimal data loss?

Answer: Azure Site Recovery

Azure Site Recovery provides continuous replication and orchestrated failover, minimizing downtime during migration.

Which Azure Active Directory feature allows an architect to require MFA only when a sign-in is flagged as risky?

Answer: Azure AD Identity Protection sign-in risk policy

Azure AD Identity Protection's sign-in risk policy evaluates risk signals and can require MFA for risky sign-ins automatically.

An architect needs to design a hybrid network connection between on-premises and Azure that provides consistent low latency with guaranteed bandwidth. Which service should be used?

Answer: Azure ExpressRoute

Azure ExpressRoute provides a private, dedicated connection with predictable latency and guaranteed bandwidth SLAs.

Which Azure service should an architect choose to cache frequently read data and reduce load on an Azure SQL Database backend?

Answer: Azure Cache for Redis

Azure Cache for Redis provides an in-memory data store that dramatically reduces database query load for frequently accessed data.

A multi-tier application needs to scale its web tier independently from its business logic tier. Which design pattern best addresses this in Azure?

Answer: Use Azure Service Bus to decouple tiers and scale independently

Using Azure Service Bus decouples tiers so each can be scaled independently based on its own demand.

An organization must ensure that Azure resources are deployed only to approved regions. Which governance tool enforces this at scale across all subscriptions?

Answer: Azure Policy assigned at the Management Group level

Azure Policy assigned at the Management Group level propagates the allowed-locations policy to all child subscriptions automatically.

A company runs a stateless web application that must handle unpredictable traffic spikes automatically. Which Azure compute option provides the best auto-scaling without managing infrastructure?

Answer: Azure Functions with Consumption plan

Azure Functions on the Consumption plan automatically scales to zero and out based on events with no infrastructure management required.

Which Azure networking feature allows you to route traffic between VNets and on-premises networks through a central hub VNet?

Answer: Hub-and-spoke topology with Azure Firewall or NVA

A hub-and-spoke topology centralizes shared services (firewall, VPN gateway) in the hub and connects spoke VNets via peering.

An architect needs to provide secure, browser-based RDP and SSH access to Azure VMs without exposing public IP addresses. Which service should be used?

Answer: Azure Bastion

Azure Bastion provides browser-based RDP/SSH directly in the Azure portal without requiring VMs to have public IPs.

A company needs a recovery point objective (RPO) of near-zero and a recovery time objective (RTO) of under 15 minutes for its Azure SQL Database. Which configuration meets these requirements?

Answer: Active geo-replication with auto-failover group

Auto-failover groups with active geo-replication provide near-zero RPO with asynchronous replication and sub-15-minute automated failover.

Which Azure Monitor feature should an architect configure to automatically notify the operations team when CPU utilization exceeds 90% for more than 5 minutes?

Answer: Azure Monitor Metric Alert

Azure Monitor Metric Alerts evaluate metric values on defined frequency and fire when thresholds are breached for the configured window.

An architect needs to ensure that secrets stored in Azure Key Vault are rotated automatically. Which Azure feature supports automatic secret rotation?

Answer: Key Vault Event Grid integration with Azure Functions

Azure Key Vault emits events via Event Grid when secrets are near expiry, which can trigger an Azure Function to rotate and update the secret.

A company wants to control egress traffic from Azure VMs to the internet, with full Layer 7 filtering and threat intelligence. Which Azure service provides this?

Answer: Azure Firewall Premium

Azure Firewall Premium provides Layer 7 filtering with IDPS, TLS inspection, and threat intelligence for egress traffic control.

Which Azure service allows an architect to run containerized workloads without managing Kubernetes control plane or nodes?

Answer: Azure Container Instances (ACI)

Azure Container Instances runs containers on-demand without any cluster or node management, ideal for simple or burst workloads.

An architect is designing a data pipeline where large amounts of IoT telemetry must be ingested and processed in real time. Which combination of Azure services is most appropriate?

Answer: Azure Event Hubs + Azure Stream Analytics

Azure Event Hubs handles high-throughput telemetry ingestion while Azure Stream Analytics processes the stream in real time with SQL-like queries.