Microsoft Certified: Azure Administrator Associate practice questions

Question 1

The infrastructure architect at a gaming studio is designing selection of a managed container-image registry and must choose the option that matches the Microsoft Learn guidance. Which option matches?

Accepted Answer

Azure Container Registry is a managed registry service based on the open-source Docker platform.

Answer

Azure Container Registry is a managed object-storage service and is not based on Docker.

Answer

Azure Container Registry is an unmanaged self-hosted Docker daemon and is not a managed registry service.

Answer

Azure Container Registry is a managed code repository for source files and is not a Docker image registry.

Question 2

Given a scenario where a media platform is rolling out a tiered Conditional Access scope hierarchy across regions, the Azure operations team must align with the published Azure documentation. Which option matches?

Accepted Answer

For the security group type, you can add an existing group to another group (also known as nested groups). Nested groups can be used for membership and Conditional Access scopes.

Answer

Microsoft Entra security groups disallow nesting, so each group must contain only direct user members and cannot include another group as a member.

Answer

Nested security groups in Microsoft Entra ID are not honored as Conditional Access scopes and only flatten for Exchange Online distribution scenarios.

Answer

Nested security groups in Microsoft Entra ID require a Microsoft Entra ID P2 license tier and are not available in the free or P1 license tiers.

Question 3

A retail enterprise is migrating workloads into Azure for subnet-based access control to a storage account from a VNet and the platform team is being asked to confirm how this capability is defined. Per the Microsoft Learn documentation, which option matches?

Accepted Answer

Virtual network rules: Allow traffic from specific subnets within Azure Virtual Networks.

Answer

Virtual network rules on a storage account allow traffic from any subnet in any virtual network in the same Microsoft Entra tenant.

Answer

Virtual network rules on a storage account allow traffic only from peered virtual networks and not from the local virtual network's own subnets.

Answer

Virtual network rules on a storage account allow traffic from specific public IP ranges and are not subnet-scoped.

Question 4

The platform team at a retail enterprise is splitting work across teams to deliver a private-IP integration design for Azure PaaS resources. Per the Microsoft Learn documentation for this capability, which option matches?

Accepted Answer

A private endpoint is a network interface that uses a private IP address from your virtual network.

Answer

A private endpoint is a public IP address that exposes an Azure PaaS resource over the internet.

Answer

A private endpoint is a DNS record only and does not consume any IP address from the virtual network.

Answer

A private endpoint is a routing rule rather than a network interface, with no IP address allocated.

Question 5

A government agency is rolling out a hybrid connection-monitor topology spanning Azure and on-prem and the IT operations lead must decide based on the published Azure documentation. Which option matches?

Accepted Answer

Supported source endpoints enabled with Network Watcher extension: Azure VMs, Azure virtual machine scale sets, and Arc enabled on-premises hosts.

Answer

Connection monitor supports only Azure VMs as source endpoints; scale sets and Arc-enabled hosts are not supported sources.

Answer

Connection monitor supports only Azure App Service web apps as source endpoints; virtual machines are not supported.

Answer

Connection monitor supports only on-premises hosts that connect via ExpressRoute; Azure VMs and Arc-enabled hosts are not supported sources.

Question 6

A energy company is rolling out an audit of App Service plan attributes before procurement and the cloud governance lead must decide based on the published Azure documentation. Which option matches?

Accepted Answer

Each App Service plan defines: Operating system (Windows, Linux). Region (West US, East US, and so on). Number of virtual machine (VM) instances. Size of VM instances (small, medium, large). Pricing tier (Free, Shared, Basic, Standard, Premium, PremiumV2, PremiumV3, PremiumV4 IsolatedV2).

Accepted Answer

An Azure App Service plan defines a set of compute resources for a web app to run.

Answer

An App Service plan defines only the pricing tier and the region; the operating system and VM size are configured on each web app individually.

Answer

An App Service plan defines only the operating system and pricing tier; the region and number of instances are inherited from the resource group according to the documented Azure behavior described in the Microsoft Learn reference cited above.

Question 7

At a education provider, the site reliability engineer is rolling out a deeply nested management-group hierarchy for global subsidiaries and must align with the documented Azure guidance. Per the Microsoft Learn documentation, which option matches?

Accepted Answer

A management group tree can support up to six levels of depth.

Answer

A management group tree can support unlimited levels of depth with no documented maximum.

Answer

A management group tree can support up to three levels of depth, including the root and the subscription levels.

Answer

A management group tree can support up to ten levels of depth, of which the root and the subscription levels are excluded from the count.

Question 8

Before deployment, the DevOps engineer at a logistics company is hardening a high-availability redundancy choice for a regional workload and must verify the documented behavior. Which option matches?

Accepted Answer

Azure Storage always stores multiple copies of your data to protect it from planned and unplanned events.

Accepted Answer

Zone-redundant storage (ZRS) copies your data synchronously across three or more Azure availability zones in the primary region.

Answer

Zone-redundant storage copies your data synchronously to a single physical datacenter in the primary region.

Answer

Zone-redundant storage copies your data synchronously to one Azure availability zone in the primary region and asynchronously to another.

Question 9

The infrastructure architect at a gaming studio is designing an analysis of optional default routes added by specific Azure features and must choose the option that matches the Microsoft Learn guidance. Which option matches?

Accepted Answer

Azure creates default system routes for each subnet and adds more optional default routes to specific subnets, or every subnet, when you use specific Azure capabilities.

Answer

Azure creates a single fixed default route set for every subnet and never adds additional default routes regardless of which Azure capabilities are enabled.

Answer

Azure creates default system routes only on internet-facing subnets and never on internal subnets.

Answer

Azure creates default system routes only when ExpressRoute is provisioned and not for general-purpose virtual network subnets.

Question 10

At a education provider, the site reliability engineer has decided to standardize a query-language briefing for new Azure Monitor users and is reviewing the Microsoft Learn documentation. Which option matches?

Accepted Answer

Azure Monitor Logs is based on Azure Data Explorer and uses the same Kusto Query Language (KQL) to write log queries.

Answer

Azure Monitor Logs is based on Azure SQL Database and uses T-SQL to write log queries.

Answer

Azure Monitor Logs is based on Elasticsearch and uses Lucene query syntax to write log queries.

Answer

Azure Monitor Logs is based on PromQL semantics and does not support Kusto Query Language.

Question 11

The cloud engineer at a healthcare provider is designing a deployment-pipeline retry policy for Bicep files and must choose the option that matches the Microsoft Learn guidance. Which option matches?

Accepted Answer

Bicep files are idempotent, which means that you can deploy the same file many times and get the same resource types in the same state.

Answer

Bicep files are not idempotent and deploying the same file twice produces duplicated resources with appended suffixes.

Answer

Bicep files are idempotent only when deployed via the Azure CLI and not when deployed through the Azure portal or pipelines.

Answer

Bicep files are idempotent only for resources within a single resource group and produce drift when targeting subscription scope.

Question 12

An organization that runs a media platform is evaluating a tag-quota review before adding new chargeback keys, and the Azure operations team must answer per the documented Azure behavior. Which option matches?

Accepted Answer

Each resource, resource group, and subscription can have a maximum of 50 tag name-value pairs.

Answer

Each resource, resource group, and subscription can have a maximum of 15 tag name-value pairs.

Answer

Each resource, resource group, and subscription can have a maximum of 100 tag name-value pairs.

Answer

Each resource can have 50 tag name-value pairs, but resource groups and subscriptions are restricted to 10 tag name-value pairs each.

Question 13

At a healthcare provider, the cloud engineer has decided to standardize tooling standardization on the currently supported AzCopy version and is reviewing the Microsoft Learn documentation. Which option matches?

Accepted Answer

AzCopy v10 is the currently supported version of AzCopy.

Answer

AzCopy v8 is the currently supported version of AzCopy; v10 is in preview and not supported in production.

Answer

AzCopy v9 is the currently supported version of AzCopy; v10 has been retired in favor of an Azure Storage Explorer integration.

Answer

AzCopy v10 is deprecated and Microsoft recommends Azure CLI's az storage commands as the only supported alternative.

Question 14

A gaming studio is being onboarded to Azure and the infrastructure architect is tasked with documenting an optimized-route design from VNet to Azure PaaS services. Per the Microsoft Learn documentation, which option matches?

Accepted Answer

Azure virtual network service endpoints provide secure and direct connectivity to Azure services over an optimized route through the Azure backbone network.

Answer

Azure virtual network service endpoints route traffic to Azure services over the public internet rather than the Azure backbone.

Answer

Azure virtual network service endpoints provide connectivity only to third-party SaaS services and not to Azure services.

Answer

Azure virtual network service endpoints are equivalent to a site-to-site VPN tunnel and do not use the Azure backbone.

Question 15

A SaaS platform is rolling out a baseline metrics design relying on Azure platform metrics and the cloud center of excellence must decide based on the published Azure documentation. Which option matches?

Accepted Answer

Platform metrics are collected from Azure resources. They require no configuration and have no cost.

Answer

Platform metrics in Azure Monitor require per-resource configuration of a Data Collection Rule before any metric is collected.

Answer

Platform metrics in Azure Monitor are billed per metric stream at a flat hourly rate.

Answer

Platform metrics in Azure Monitor are available only for Premium-tier resources and not for free or standard SKUs.

Microsoft Certified: Azure Administrator Associate

Sample questions

Sources

Similar exams