Domain 3: Deploy and Manage Azure Compute Resources (20-25%)
What this domain actually covers
Virtual Machines. VM sizes and families (B, D, E, F, M, N, H), Marketplace + custom + shared image gallery (SIG), managed disks (Ultra, Premium SSD v2, Premium SSD, Standard SSD, Standard HDD), disk snapshots + images, disk encryption (SSE, ADE, Encryption at Host, CMK), NICs, availability sets vs zones, proximity placement groups, VM extensions (Custom Script, DSC, AAD Login, Azure Monitor Agent), backup/restore basics.
Virtual Machine Scale Sets (VMSS). Uniform vs Flexible orchestration, autoscale (metric-based, schedule-based), upgrade policy (manual, rolling, automatic), zone deployments, mixed SKUs (Flexible), spot instances.
App Service. Service plan tiers (Free/Shared/Basic/Standard/PremiumV2/PremiumV3/Isolated), deployment slots (swap, auto-swap, slot settings), scale-up vs scale-out, custom domains + TLS, VNet integration, backups, App Service Environment (ASE) at a passing level.
Containers. Azure Container Instances (single containers, per-second billing), Azure Container Apps (serverless container platform on KEDA), AKS at a passing level (know when it is the answer, when it is not).
Templates + IaC. ARM templates (JSON) at a working level (parameters, variables, resources, outputs, mode: incremental vs complete, linked/nested templates), Bicep basics (declarative syntax, modules, existing keyword, decorators).
Automation. Custom Script Extension, cloud-init, DSC, Automation Runbooks, Azure Update Manager (replacement for retired Update Management).
Questions
Q1
Which VM redundancy option protects against a single datacenter failure within a region?- A. Availability set
- B. Availability zone
- C. Proximity placement group
- D. VMSS with single-zone deployment
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real availability grouping: sets spread fault/update domains but do not guarantee protection from a whole datacenter outage.
✓ Correct choice
Real isolation boundary: distribute redundant VMs across zones to survive a zone/datacenter failure; one VM in one zone is insufficient.
Why this is not the answer
Real placement feature: proximity placement favors low latency through co-location, rather than failure isolation.
Why this is not the answer
Real scale-set deployment: putting all replicas in one zone leaves that zone as a shared failure boundary.
The reasoning
Availability sets protect against rack (fault domain) and update-domain failures within a single datacenter. Zones are separate physical datacenters within a region; redundant deployment across zones protects the application against a full-datacenter outage. For maximum protection, deploy a VMSS across multiple zones. Not all regions have zones.
Q2
Deploy 100 identical Linux web servers that autoscale between 10 and 200 based on CPU. Best resource?- A. Availability set of 100 VMs
- B. Virtual Machine Scale Set (Uniform orchestration)
- C. App Service plan Premium V3
- D. AKS deployment
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real grouping: an availability set does not itself create or autoscale a fleet from a shared VM model.
✓ Correct choice
Real VM orchestration: a scale set manages a replicated VM fleet and integrates with metric-based autoscale.
Why this is not the answer
Real managed-web hosting: App Service hosts applications rather than giving this fleet of administrator-managed Linux servers.
Why this is not the answer
Real Kubernetes platform: AKS orchestrates containers; it adds a different workload model and operational requirements.
The reasoning
VMSS is purpose-built for identical, elastically scaling VMs. Uniform orchestration is the classic mode where every instance comes from a single model. Flexible is the newer mode that allows mixed sizes and manual per-VM management. App Service and AKS are legitimate for web workloads but the stem specifies VMs.
Q3 (multi-answer)
Which are TRUE only for VMSS FLEXIBLE (not Uniform)?- A. Supports mixing different VM sizes in one scale set
- B. Instances are Fault Domain-aware and can span availability zones
- C. Automatic OS image upgrades behave identically to Uniform
- D. Manual instance management is supported (add/remove named VMs)
- E. Faster horizontal scale-out than Uniform
Show answer & explain every option
Correct: A, D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real Flexible capability: mixed supported VM sizes can coexist in a Flexible scale set.
Why this is not the answer
Real shared capability: fault domains/zones are not exclusive to Flexible, so this does not answer ONLY Flexible.
Why this is not the answer
False equivalence: OS upgrade support and orchestration behavior differ; do not assume identical mode capabilities.
✓ Correct choice
Real Flexible management: standard VM resources can be individually managed and associated with the set.
Why this is not the answer
Unsupported performance guarantee: orchestration mode alone does not universally guarantee faster scale-out.
The reasoning
Flexible allows heterogeneous sizes and manual per-VM management. Uniform requires all instances to share one model. Both support zones (B is a shared trait). Automatic OS image upgrade behaves differently in Flexible (C is false as written). E is not a general rule. Microsoft's guidance since 2023: use Flexible for new scale sets; Uniform is deemphasized.
Q4
Which disk type supports sub-millisecond latency and up to 400,000 IOPS per disk?- A. Standard HDD
- B. Standard SSD
- C. Premium SSD
- D. Ultra Disk
Show answer & explain every option
Correct: D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real disk tier: Standard HDD targets economical, less demanding workloads rather than sub-millisecond high-IOPS performance.
Why this is not the answer
Real disk tier: Standard SSD improves consistency over HDD but does not meet the stated Ultra Disk performance target.
Why this is not the answer
Real disk tier: Premium SSD serves production workloads, but its per-disk limits differ from this Ultra Disk target.
✓ Correct choice
Real disk tier: Ultra Disk supports independently configured performance at the stated high end, subject to compatible VM/region limits.
The reasoning
Ultra Disk supports up to 400,000 IOPS and 10,000 MB/s throughput per disk, with IOPS/throughput configurable independent of size. Premium SSD v2 (newer, cheaper for many workloads) also decouples size/IOPS/throughput but tops out lower. Premium SSD ties performance to disk size (P1 through P80).
Q5
You want to encrypt a VM's OS and data disks using BitLocker with a key stored in Key Vault. Which feature?- A. Azure Disk Encryption (ADE)
- B. Server-Side Encryption with Customer-Managed Keys (SSE + CMK)
- C. Encryption at Host
- D. Confidential Compute VM
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real guest encryption: ADE uses BitLocker on Windows and integrates with Key Vault; check current lifecycle guidance before new deployments.
Why this is not the answer
Real storage-layer encryption: SSE with CMK protects managed disks using customer keys, but does not run BitLocker in the guest.
Why this is not the answer
Real host-layer protection: encryption at host covers disk data/cache/temp paths without being guest BitLocker encryption.
Why this is not the answer
Real confidential-computing technology: it protects supported workloads in use; it is not the requested BitLocker feature.
The reasoning
ADE uses BitLocker on Windows or dm-crypt on Linux inside the guest. It is distinct from storage-layer encryption and encryption at host. ADE cannot be enabled together with encryption at host, and ADE with SSE customer-managed keys is not supported. ADE is scheduled for retirement on September 15, 2028; use the documented migration guidance for existing deployments.
Q6
App Service deployment slots: what happens to app settings marked "slot setting" during a swap?- A. They swap with the app content
- B. They stay with the slot; they do not swap
- C. They are cleared
- D. They are duplicated to both slots
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
False swap behavior for sticky settings: ordinary swappable settings differ from settings explicitly marked slot-specific.
✓ Correct choice
Real sticky configuration: slot-specific settings remain associated with their destination slot through a swap.
Why this is not the answer
False deletion behavior: a slot swap does not clear slot-specific settings.
Why this is not the answer
False duplication behavior: settings are not permanently copied into both slots merely because a swap occurs.
The reasoning
Settings marked "slot setting" (sticky) remain attached to their slot even after a swap. That is how you keep production and staging configuration separate (connection strings, feature flags) without polluting either. Non-sticky settings move with content. Swap applies target-slot settings to the source instances and warms them before changing routing.
Q7
You need to move a VM from one resource group to another in the SAME subscription. Which is TRUE?- A. VM must be stopped first
- B. All attached resources (disks, NIC, PIP) move together automatically
- C. You must explicitly select attached resources to include in the move
- D. Move is not supported; you must redeploy
Show answer & explain every option
Listed key (under review): C
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Alternative · under review
Unsupported blanket requirement: a resource-group move does not universally require stopping the VM first.
Alternative · under review
False automatic-selection claim: Azure does not indiscriminately move every attached resource automatically.
Listed key · under review
Qualified move behavior: select resources being moved and validate dependencies; same-subscription moves do not necessarily require moving every attachment.
Alternative · under review
False universal restriction: supported VMs can move resource groups; eligibility and dependencies must be checked.
Original explanation · under review
ARM Move requires you to select all resources that make up the VM: VM, disks, NIC, public IP, NSG. Missing one produces an error. VM does not need to be stopped. Some resource types cannot move (certain VNet integrations, some managed services); check the "Move operation support" matrix per resource type.
Q8
What is the difference between theAz.Compute and Az.Resources PowerShell modules?
- A. Compute handles VMs/VMSS/disks; Resources handles subscription/RG/deployment operations
- B. Compute is legacy; Resources is the replacement
- C. They are aliases
- D. Compute is CLI only; Resources is PowerShell only
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real module split: Az.Compute handles compute resources; Az.Resources handles Resource Manager scopes, deployments and related administration.
Why this is not the answer
False replacement claim: both are current modules within Azure PowerShell rather than one replacing the other.
Why this is not the answer
False equivalence: the modules contain different cmdlets and resource-management responsibilities.
Why this is not the answer
False tool distinction: both names are PowerShell modules; Azure CLI uses az command groups.
The reasoning
The Az PowerShell module is split by service area. Az.Compute handles VMs. Az.Resources handles resource groups, template deployments, and resource-generic operations. On the exam you may need to identify which module owns a given cmdlet.
Field anchor: you use PowerShell Az. Exam trap: cmdlet verbs vary (New- vs Set- vs Update- vs Restart-); pick the wrong one and lose the point.
Q9
Which ARM template deployment mode leaves existing resources that are NOT declared in the template alone?- A. Complete
- B. Incremental
- C. Validate
- D. WhatIf
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real deployment mode: Complete can delete resources absent from the template at supported scopes, contrary to the requirement.
✓ Correct choice
Real deployment mode: Incremental preserves resources not declared in the template; redeclared resources can still be updated.
Why this is not the answer
Real validation operation: it checks a deployment, rather than being a mode that applies resources.
Why this is not the answer
Real preview operation: what-if predicts changes; it does not deploy resources as an alternative deployment mode.
The reasoning
Incremental (the default) leaves resources not in the template alone. Complete can delete omitted resources in the target RG, subject to documented exceptions (dangerous, but occasionally desired for enforcement). Validate runs a template syntax + reference check only. WhatIf shows planned changes without applying. Incremental deployment still reapplies declared resources and can reset omitted properties; it does not resolve every resource-name conflict.
Q10 (multi-answer)
Which are valid uses of ARM linked templates?- A. Break a large template into smaller reusable files
- B. Deploy resources across different subscriptions in one operation
- C. Bypass RBAC on the target RG
- D. Chain deployments where output of one is input to another
Show answer & explain every option
Listed key (under review): A, D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Listed key · under review
Real composition pattern: linked templates split deployments into reusable components.
Alternative · under review
Real scoped deployment capability: linked/nested deployments can address other authorized scopes; the original key's exclusion needs clarification.
Alternative · under review
False authorization bypass: linked deployments still require permissions on the target scope.
Listed key · under review
Real dependency pattern: outputs from one deployment can be inputs to another.
Original explanation · under review
(B is possible with nested/scoped deployments but not specific to linked; C is false)
Linked templates fetch a sub-template from a URI (must be reachable or SAS-signed). Nested templates are inline. Both support modularization and chaining outputs. Neither bypasses RBAC; the caller's permissions apply. Bicep supersedes both patterns for new work.
Q11
Which App Service tier is the MINIMUM required for deployment slots?- A. Free
- B. Basic
- C. Standard (5 slots)
- D. Premium V3 (20 slots)
Show answer & explain every option
Correct: C
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real hosting tier: Free does not provide deployment slots.
Why this is not the answer
Real hosting tier: Basic does not provide deployment slots even though it supports dedicated hosting features.
✓ Correct choice
Real hosting tier: Standard is the lowest listed tier supporting deployment slots.
Why this is not the answer
Real higher tier: Premium supports slots, but it is not the minimum tier needed.
The reasoning
Free/Shared/Basic do not support deployment slots. Standard supports up to 5 staging slots in addition to production. Premium V2 and V3 support up to 20. Isolated (ASE) also supports 20.
Q12
A VMSS usesRolling upgrade policy. What controls how many instances upgrade in parallel?
- A.
batchSizeproperty - B.
maxBatchInstancePercent(default 20%) - C.
pauseTimeBetweenBatches - D. B and C together
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Incorrect property name: the rolling-upgrade percentage control is maxBatchInstancePercent, not a generic batchSize field.
✓ Correct choice
Real rolling-upgrade setting: maxBatchInstancePercent limits the percentage of instances in an upgrade batch.
Why this is not the answer
Real timing setting: pauseTimeBetweenBatches controls waiting between batches, not how many instances upgrade together.
Why this is not the answer
Incorrect combination: batch size is governed by the percentage setting; pause duration governs timing, not parallel instance count.
The reasoning
Rolling upgrade batches instances by maxBatchInstancePercent (default 20%), pauses between batches (pauseTimeBetweenBatches in ISO 8601 duration format), and respects maxUnhealthyInstancePercent thresholds, aborting if health signals indicate degradation. Health monitoring is required: Flexible uses Application Health Extension; Uniform uses a supported load balancer probe or that extension.
Q13
Primary purpose of a Proximity Placement Group (PPG)?- A. Force a set of VMs into the same datacenter for lowest inter-VM latency
- B. Ensure VMs are in different fault domains
- C. Provide geo-redundancy
- D. Enforce Azure Policy compliance
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real placement intent: a PPG co-locates compute for lower inter-VM latency; placement capacity constraints still apply.
Why this is not the answer
Real resilience concept: fault-domain separation is an availability design, not the PPG's primary purpose.
Why this is not the answer
Real resilience concept: regional redundancy requires separate regional deployments; proximity placement aims for locality.
Why this is not the answer
Real governance function: Azure Policy evaluates compliance; a PPG does not substitute for it.
The reasoning
PPGs constrain VMs (and optionally a VMSS) to a single datacenter for latency-sensitive scenarios (HPC, SAP HANA). Trade-off: reduced deployment flexibility (capacity may not exist in the pinned zone) and no resilience to loss of its datacenter/zone from the PPG alone.
Q14
Simplest way to run a single container for 10 minutes/day with a one-vCPU container group?- A. Azure Kubernetes Service (AKS)
- B. Azure Container Instances (ACI)
- C. Azure Container Apps
- D. Web App for Containers
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real orchestration platform: AKS is useful for managed Kubernetes but is unnecessarily complex for one short-lived container group.
✓ Correct choice
Real direct container hosting: ACI runs a container group without provisioning a cluster or web-hosting plan.
Why this is not the answer
Real serverless container platform: Container Apps supports apps/jobs, but introduces a different managed environment than the specified container-group model.
Why this is not the answer
Real web-hosting option: Web App for Containers targets continuously hosted web applications rather than a brief standalone container group.
The reasoning
ACI is per-second billed serverless container hosting for short jobs and single containers. AKS is a managed Kubernetes cluster (overkill for one job). Container Apps is serverless Kubernetes on Dapr/KEDA (good for microservices with scale-to-zero). Web App for Containers is App Service with a container image (long-running web apps).
Q15
Azure Backup for VMs: which is TRUE?- A. Backups run inside the guest via Windows Server Backup
- B. Disk-layer snapshots via the VM Snapshot extension, transferred to a Recovery Services Vault
- C. Always requires Azure Backup Server (MABS)
- D. VM must be shut down for backup
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real Windows backup feature, wrong mechanism: Azure VM Backup is not simply Windows Server Backup running as a scheduled guest task.
✓ Correct choice
Real VM-backup workflow: snapshots provide recovery points and backup data is transferred to the vault; consistency depends on workload support.
Why this is not the answer
Real backup server: MABS supports other backup scenarios but is not required for ordinary Azure VM Backup.
Why this is not the answer
False shutdown requirement: supported VM backups run without requiring routine VM shutdown.
The reasoning
Azure VM Backup can use the VM snapshot extension for application-consistent Windows backups through VSS and filesystem-consistent Linux backups. Linux application consistency requires supported pre/post scripts. Agentless crash-consistent backup is another supported option. Recovery points are managed through a Recovery Services vault without shutting down the VM.
Q16 (multi-answer)
Which are valid VMSS autoscale actions in a rule?- A. Increase count by X
- B. Decrease count by X percent
- C. Scale to a specific instance count
- D. Change VM SKU during scaling
Show answer & explain every option
Correct: A, B, C
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real autoscale action: ChangeCount can add a configured number of instances.
✓ Correct choice
Real autoscale action: PercentChangeCount can reduce instance count subject to minimum/maximum bounds.
✓ Correct choice
Real autoscale action: ExactCount targets a fixed number within the supported configuration.
Why this is not the answer
Different scaling dimension: ordinary autoscale instance-count rules do not change the VM size/SKU.
The reasoning
Autoscale can add/remove by fixed number, add/remove by percentage, or set an absolute target count. Changing VM SKU is not an autoscale action; you would redeploy the scale set or (in Flexible orchestration) declare mixed SKUs at deploy time.
Q17
What is a spot VM and its main constraint?- A. Discounted pricing (up to 90% off) but Azure can evict with 30 seconds notice when capacity is needed
- B. Standard pricing with a 1-year commitment
- C. Free tier limited to 750 hours/month
- D. Reserved capacity requiring a 3-year commit
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real spare-capacity offering: Spot discounts come with eviction risk and no availability guarantee; workloads must tolerate interruption.
Why this is not the answer
Real commitment concept: reserved pricing is different from interruptible Spot capacity.
Why this is not the answer
Real promotional-account concept: free-trial allowances do not define Spot VMs.
Why this is not the answer
Real reservation concept: a multi-year reservation is not the Spot model and does not imply eviction-based discounts.
The reasoning
Spot uses spare capacity. Eviction can be price-based (spot price exceeds your max) or capacity-based (Azure needs the hardware). Great for interruption-tolerant workloads (batch, dev/test, media rendering). Not suitable for SLA-bound tier-1 production. Available in single-VM, VMSS, and AKS spot node pools.
Q18
You need OS-level metrics (memory, disk free) from a VM in Azure Monitor. What must you install?- A. Nothing, they are collected by default
- B. Azure Monitor Agent (AMA), plus an associated Data Collection Rule for guest performance counters
- C. VM Insights extension
- D. Both B and C in the standard pattern
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
False default for guest counters: platform metrics do not automatically include every operating-system memory and filesystem metric.
✓ Correct choice
Real collection path: AMA plus an associated DCR selects and sends the required guest performance counters.
Why this is not the answer
Real monitoring solution name: VM Insights uses underlying agents/rules; a generic VM Insights extension alone is not the required collection configuration.
Why this is not the answer
Misleading combination: VM Insights is optional for the requested counters; AMA with the appropriate DCR is sufficient.
The reasoning
Guest memory and filesystem counters require guest data collection. AMA with an appropriate DCR provides this without requiring VM Insights. VM Insights can configure and visualize monitoring. The legacy Log Analytics agent retired on August 31, 2024; use AMA for supported collection.
Field anchor: you use Azure Monitor. MMA to AMA migration deadline for new deployments was August 2024; the exam may still surface either name.
Q19
An App Service is scaled to 3 instances. The application stores session state in process and ARR Affinity is disabled. A user reports session state loss between requests. What is happening?- A. Load balancer sends each request to a different instance
- B. The application's in-process session state is not shared across instances
- C. Both A and B
- D. App Service does not scale
Show answer & explain every option
Correct: C
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real routing behavior: without affinity, requests may reach different instances; they are not guaranteed to alternate on every request. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
Real application limitation: in-process session data exists only in the instance holding it unless explicitly shared. This is part of the answer; the combined choice includes the other applicable statements too.
✓ Correct choice
Valid combined cause: requests can reach other instances, and their process memory lacks the user's existing session; use an appropriate shared session store.
Why this is not the answer
False scaling claim: App Service supports multiple instances; application state management must accommodate them.
The reasoning
App Service scales out behind an internal load balancer. The application's in-process session state is local to each worker, so different instances see different sessions. Solutions: ARR Affinity (sticky sessions, on by default) OR externalize state to Redis Cache or SQL. Turning ARR Affinity off improves scale-out performance but requires external state.
Q20
Which Bicep construct declares an existing resource (referenced, not created)?- A.
resource foo 'type@version' = { ... } - B.
resource foo 'type@version' existing = { name: 'foo' } - C.
import foo from 'type' - D.
reference foo = 'name'
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real resource declaration: without existing, Bicep deploys/manages the resource rather than only referring to it.
✓ Correct choice
Valid Bicep declaration: existing references a resource by name/scope without redeploying it.
Why this is not the answer
Real language concept, wrong form: Bicep imports are not this syntax for referring to an already deployed Azure resource.
Why this is not the answer
Invented declaration form: reference foo = is not Bicep's existing-resource syntax.
The reasoning
The existing keyword makes Bicep resolve a resource by name without adding it to the deployment. Useful for looking up an existing Key Vault, storage account, etc., to read properties. Standard resource declarations without existing create or update.
Q21 (scenario)
Patch 200 Windows VMs on the second Tuesday of each month, respect maintenance windows, report compliance. Best tool?- A. Manual RDP
- B. Azure Update Manager with a maintenance configuration and periodic assessment
- C. Azure Automation State Configuration
- D. Azure Batch job
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real administrative access, poor fleet management: manual RDP does not provide consistent scheduled patching and reporting.
✓ Correct choice
Real patch orchestration: Update Manager maintenance configuration and assessment support planned patch windows and compliance visibility.
Why this is not the answer
Real legacy desired-state service: configuration convergence is not the current dedicated fleet patch-management solution.
Why this is not the answer
Real batch compute service: Azure Batch schedules compute jobs rather than providing this VM patch governance workflow.
The reasoning
Update Manager (formerly Update Management) manages patch scheduling, maintenance windows, and reporting for Azure and Arc-enabled machines. It replaced the older Automation-based Update Management (retired 2024). State Configuration handles desired state, not patching. Batch is for HPC-style parallel jobs.
Q22
Max number of VMs in a single availability set?- A. 5
- B. 20
- C. 100
- D. 200
Show answer & explain every option
Correct: D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Numeric distractor: 5 is not the maximum VM count in an availability set.
Why this is not the answer
Different limit confusion: update-domain counts are separate from how many VMs an availability set can contain.
Why this is not the answer
Numeric distractor: 100 is not the documented availability-set maximum.
✓ Correct choice
Documented limit: an availability set supports up to 200 VMs; scale-set limits are a different concept.
The reasoning
Availability set holds up to 200 VMs. Fault domains: 2 or 3 (region dependent). Update domains: up to 20. SLA examples depend on qualifying configurations: a single VM with eligible Premium disks, multiple VMs in one availability set, or multiple VMs across zones. A lone zonal VM does not get a multi-zone guarantee.
Q23
Which is TRUE about VM backup instant restore snapshot retention with a Standard backup policy?- A. Retained by default 2 days; configurable 1-5 days
- B. Retained 30 days by default
- C. Not available, only vault-stored backups can be restored
- D. Retained forever
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real Standard-policy behavior: instant restore snapshots default to two days and allow the stated 1–5-day retention range.
Why this is not the answer
Wrong policy/default claim: 30 days is not the Standard policy's default instant-restore retention.
Why this is not the answer
False feature claim: instant-restore snapshots do exist alongside vault recovery points.
Why this is not the answer
False retention claim: snapshots are retained according to policy, not automatically forever.
The reasoning
Standard policy retains Instant Restore snapshots for 2 days by default, configurable from 1 to 5 days. Enhanced policy defaults to 7 days and permits 1–30 days. These snapshots enable fast recovery before or without reading vault data and incur snapshot storage charges.
Q24
You want a Linux VM to pull a script from GitHub and execute during post-deployment provisioning. Which extension?- A. Custom Script Extension
- B. DSC Extension
- C. VM Agent Extension
- D. Cloud-init only
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real extension: Custom Script downloads and runs scripts for post-deployment configuration, with the necessary network access.
Why this is not the answer
Real Windows configuration extension: DSC applies desired-state configuration and is not the straightforward Linux script runner here.
Why this is not the answer
Real agent concept, imprecise feature name: the VM Agent enables extensions but is not itself this script-download/run extension.
Why this is not the answer
Real Linux provisioning mechanism: cloud-init can run first-boot scripts, but it is not the requested VM extension and is not the only option.
The reasoning
CustomScript Extension supports both Windows and Linux, fetches a script from Azure Storage, GitHub, or public URL, and executes. Cloud-init is also valid on Linux and runs on first boot; it can be paired with CustomScript. DSC is desired-state configuration and is heavier weight.
Q25 (multi-answer)
Which two VM diagnostic options require the classic Diagnostics Extension?- A. Boot diagnostics (screenshot + serial log)
- B. Guest-level metrics (memory, per-disk IO)
- C. Guest-level event logs (Windows event log, syslog)
- D. Host-level metrics (host CPU, host network)
Show answer & explain every option
Listed key (under review): B, C
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Alternative · under review
Real boot diagnostic: platform screenshots/serial logs do not require the classic guest Diagnostics Extension.
Listed key · under review
Real guest metric category: current AMA/DCR can collect these counters, so the claim that a classic extension is required is outdated.
Listed key · under review
Real guest log category: AMA/DCR supports guest log collection; classic extension exclusivity is outdated.
Alternative · under review
Real platform telemetry: host-side metrics do not require the classic guest extension.
Original explanation · under review
(A needs only a storage account or managed; D is host-side and free)
Boot diagnostics is a platform feature. Guest metrics and event logs require the Diagnostic Extension (IaaSDiagnostics on Windows, LinuxDiagnostic on Linux). Modern replacement path: Azure Monitor Agent + DCRs.
Q26
A Windows VM's OS disk is 128 GiB. You want to expand it to 256 GiB. Correct approach?- A. Deallocate the VM, resize disk in portal to 256 GiB, start VM, extend the volume in Disk Management
- B. Live-resize while the VM is running (Premium SSD supports live disk expand as of 2023)
- C. Both A and B are valid; B avoids downtime for Premium SSD/Premium SSD v2
- D. Not supported; you must deploy a larger VM
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real OS-disk expansion procedure: stop/deallocate as required, expand the managed disk, then extend the guest partition/filesystem.
Why this is not the answer
Real capability for eligible data disks, wrong disk role: live data-disk expansion does not establish live expansion of this OS disk.
Why this is not the answer
Incorrect combination: Premium SSD v2 is not an OS-disk option, and eligible data-disk rules do not make this OS procedure valid live.
Why this is not the answer
False restriction: expanding a supported managed OS disk does not inherently require deploying a different VM.
The reasoning
Deallocate the VM before expanding its OS disk, then restart and extend the Windows partition/filesystem. Expansion without downtime applies to eligible data disks, not OS disks. Premium SSD v2 does not support use as an OS disk.
Q27
Workload must span mixed VM SIZES (some D-series, some E-series). Which VMSS orchestration mode?- A. Uniform
- B. Flexible
- C. Either; SKU mixing is not tied to orchestration
- D. Uniform with multiple VMSS behind one load balancer
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real orchestration mode: Uniform uses a shared scale-set VM model rather than the requested mixed-size Flexible design.
✓ Correct choice
Real orchestration mode: Flexible supports managing standard VMs with mixed supported configurations within a scale set.
Why this is not the answer
False equivalence: orchestration mode affects VM configuration and management capabilities.
Why this is not the answer
Real multi-set architecture: separate Uniform sets could use different sizes, but that is not mixed sizes inside one scale set.
The reasoning
Uniform requires all instances share one VM model. Flexible supports mixed VM sizes and models. Flexible is Microsoft's recommended default for new scale sets; consult the feature matrix for individual capabilities.
Q28
What is the minimum dedicated App Service tier supporting regional VNet integration (App Service to a VNet subnet)?- A. Free
- B. Basic
- C. Standard, Premium V2, Premium V3
- D. Only Isolated
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real shared hosting tier: Free does not support the requested dedicated regional VNet integration.
✓ Correct choice
Real dedicated tier: Basic is the minimum listed tier supporting regional VNet integration, subject to platform constraints.
Why this is not the answer
Real higher tiers: these support integration but are not the minimum available option.
Why this is not the answer
Real isolated hosting tier: Isolated supports private-network scenarios, but integration is not exclusive to it.
The reasoning
Regional VNet integration is available Basic through Premium (though newer capabilities cluster in Standard+). Free and Shared do not have VNet integration. Isolated (ASE) uses fundamentally different networking (dedicated deployment in your VNet, with external or internal ingress configurations).
Q29
In Bicep, which construct outputs a value from a deployment?- A.
output myValue string = resource.properties.value - B.
return myValue - C.
export const myValue - D.
emit myValue
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Valid Bicep syntax: output declares a named, typed value returned in deployment outputs.
Why this is not the answer
Real keyword in other languages: return is not Bicep deployment-output syntax.
Why this is not the answer
Real JavaScript-style declaration: export const is not the Bicep output construct.
Why this is not the answer
Invented Bicep construct: emit is not the declaration used to expose a deployment output.
The reasoning
Bicep uses output <name> <type> = <expression> at file scope. Outputs surface after deployment (az deployment group show --query properties.outputs). Modules consume other modules' outputs via <module>.outputs.<name>.
Q30
A VM has a NIC in subnet A (with NSG A) and is joined to an ASG. You must allow HTTP from a fleet of frontends. Most maintainable NSG rule pattern?- A. Rule per frontend IP
- B. Rule with source = ASG "webfrontends" and destination = ASG "backends"
- C. Rule with source =
Internetand destination = subnet A - D. Add a public IP and rely on Cloudflare
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real NSG pattern, costly maintenance: separate IP rules require updates as the frontend fleet changes.
✓ Correct choice
Real logical grouping: ASGs let supported NICs be grouped by application role, making NSG rules easier to maintain.
Why this is not the answer
Real service tag, excessive access: Internet is much broader than the specified frontend fleet.
Why this is not the answer
Real external proxy idea, incomplete control: adding public access does not implement the required internal source/destination NSG policy.
The reasoning
ASGs let you group VMs logically (by role) and reference the group in NSG rules. Adding/removing frontends is a membership change, not a rule edit. Microsoft-recommended pattern.
Scenario-Style Questions
Real-exam-style stems. Multi-sentence context, judgment or troubleshooting. Each has doc links so you can drill into the source.
S1
Deploy 50 identical Windows 2022 IIS VMs behind a Standard LB with autoscale 10-100 based on CPU + a maintenance window every Sunday 2 AM. Architecture?- A. 50 discrete VMs + manual scale
- B. VMSS Flexible across 3 zones, Windows 2022 image, IIS via extension, Standard LB, autoscale on Percentage CPU, Update Manager Maintenance Configuration for patching
- C. AKS
- D. 50 App Service plans
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real VM deployment, wrong operations model: manual capacity changes do not provide the requested autoscaling and centralized maintenance.
✓ Correct choice
Real combined architecture: zones, scale sets, load balancing, autoscale and scheduled patch maintenance address the distinct requirements.
Why this is not the answer
Real Kubernetes service: it changes the workload into container orchestration rather than this Windows IIS VM design.
Why this is not the answer
Real hosting resource: App Service plans are not a direct replacement for administrator-managed Windows VM instances.
The reasoning
Flexible + zone spread gives 99.99% VM SLA. Standard LB required for zonal frontends. Autoscale on Percentage CPU + min/max. Maintenance Configuration ties patching to the scale set.
Docs: VMSS Flexible orchestration | Autoscale rules | Maintenance configurations
S2
VM stuck in "Updating" state 4 hours. Safe recovery?- A. Delete VM immediately
- B. Check Activity Log for the operation; Redeploy from portal (moves VM to a new host); only Deallocate + Reallocate if truly unreachable with no in-progress ops
- C. Force reboot the underlying host
- D. Change subscription
Show answer & explain every option
Listed key (under review): B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Alternative · under review
Real destructive operation, unsafe first step: deleting the VM can lose configuration/data and bypasses diagnosis.
Listed key · under review
Real diagnostic/recovery tools: inspect the active operation first; redeploy is conditional and disruptive, not guaranteed safe while Updating.
Alternative · under review
Unsupported customer action: Azure controls the physical host; tenants cannot simply force-reboot it.
Alternative · under review
Real scope change, wrong repair: moving subscriptions does not resolve an in-progress compute operation and may itself be blocked.
Original explanation · under review
Activity Log tells you which op is running. Redeploy migrates to a new host and typically clears stuck state. Cancelling a legitimate in-progress op mid-flight can leave the VM in a worse state.
Docs: Redeploy VM | VM Activity Log
S3
VMSS Uniform automatic OS upgrade rolls to 30% of instances, then stalls. Why?- A. Autoscale conflict
- B. Health probes (Application Health Extension or LB) report new instances unhealthy above
maxUnhealthyInstancePercent; upgrade halts to protect availability - C. Not enough disk quota
- D. Image is corrupt
Show answer & explain every option
Correct: B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real potential interaction, unproven cause: autoscaling alone does not explain a rolling upgrade stopped by health thresholds.
✓ Correct choice
Real safety gate: rolling upgrades pause when configured instance-health thresholds are exceeded; inspect health and upgrade status.
Why this is not the answer
Real quota concept, insufficient evidence: disk quota is not established merely by the percentage of upgraded instances.
Why this is not the answer
Possible image problem, not established: unhealthy instances might involve the image, but inspect the actual health-gate failure first.
The reasoning
Automatic OS upgrade requires healthy signals. Above threshold, upgrade pauses. Diagnostics: Instance Health status, App Health Extension logs, LB probe response, orchestration events.
Docs: Automatic OS image upgrade | Application Health Extension
S4
App Service Premium V3, 50K req/min, occasional 502 Bad Gateway. First diagnosis?- A. App Service Diagnostics blade > HTTP Server Errors detector; check Always On is enabled; SNAT port exhaustion (initial allocation of 128 per instance; assess actual connection reuse and outbound configuration); backend timeout or thread starvation
- B. Scale up immediately
- C. Rebuild the app
- D. Disable HTTPS
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real diagnostic tools: inspect detectors, app/backend logs, connection reuse and resource pressure before choosing a repair.
Why this is not the answer
Real scaling action, premature: extra capacity may not fix a bad backend, connection leak or timeout.
Why this is not the answer
Real but disruptive change: rebuilding without evidence can preserve the fault and adds deployment risk.
Why this is not the answer
Real TLS setting, wrong remedy: disabling HTTPS weakens transport security and does not diagnose gateway failures.
The reasoning
502 usually means the front-end got no response from the worker. Common causes: worker recycled (Always On off), thread starvation, SNAT exhaustion, backend timeout. App Service Diagnostics is Microsoft's built-in triage.
S5
Migrate on-prem VMware VM to Azure. Which service handles replication?- A. Azure Migrate: Migration and modernization (agentless VMware replication through the Azure Migrate appliance, or a supported agent-based path)
- B. Azure Backup
- C. AzCopy
- D. Data Box
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real migration service: Azure Migrate provides supported VMware replication/migration paths into Azure.
Why this is not the answer
Real protection service: Azure Backup provides recovery points, not the dedicated VMware migration-replication workflow.
Why this is not the answer
Real data-copy tool: AzCopy moves storage data, not an entire live VMware machine's migration lifecycle.
Why this is not the answer
Real bulk-transfer appliance: Data Box carries data offline but does not orchestrate VM replication/cutover.
The reasoning
Azure Migrate: Server Migration replicates VMware / Hyper-V / physical VMs with minimal downtime. Discovery + assessment happens first via Azure Migrate: Discovery and Assessment.
S6
Bicep deployment: nested module fails on second run "resource already exists." Cause?- A. Deployment mode should be Complete
- B. Module tries to CREATE a resource that already exists out of band; use
existingkeyword to reference instead - C. Wrong subscription
- D. Bicep needs re-installation
Show answer & explain every option
Listed key (under review): B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Alternative · under review
Real deployment mode, risky assumption: Complete can delete undeclared resources and does not generally fix an already-exists conflict.
Listed key · under review
Real Bicep keyword, conditional fix: existing is appropriate when referencing rather than managing a resource; repeated deployment itself should be idempotent.
Alternative · under review
Real scope issue, possible but unproven: the precise provider error must establish a subscription/name conflict.
Alternative · under review
Real local installation, unsupported diagnosis: a service-reported resource conflict does not imply Bicep needs reinstalling.
Original explanation · under review
Bicep uses idempotent PUT for most types, so "already exists" usually means a resource was created out of band OR the module is trying to create where it should reference. Fix with existing keyword.
Docs: Bicep existing keyword | Bicep modules
S7
VMSS instance protection: some instances refuse to scale in even at low CPU. Reason?- A.
protectFromScaleInorprotectFromScaleSetActionsset on specific instances (protects stateful ones) - B. LB rule stuck
- C. RBAC on VMSS
- D. Zone imbalance
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real protection flags: per-instance protection can prevent autoscale or scale-set actions from deleting protected instances.
Why this is not the answer
Real load-balancer component, wrong control: a load-balancing rule is not the instance scale-in protection mechanism.
Why this is not the answer
Real access control, different symptom: RBAC can block management calls, but does not explain intentional per-instance protection behavior.
Why this is not the answer
Real placement concern: zone balance can influence scaling decisions, but is not the named per-instance protection control.
The reasoning
Instance protection flags mark specific instances as excluded from scale-in or from scale set actions (upgrades, deletes). Common for cluster leaders. Portal: VMSS > Instances > select > Protection policy.
Docs: Instance protection
S8
AKS cluster needs GPU workloads only during batch jobs. Cost-effective setup?- A. Dedicated GPU node pool with autoscaler min=0 (scale-to-zero); taint GPU nodes so only pods with matching toleration schedule; consider spot GPU nodes
- B. All nodes GPU
- C. Provision on-demand outside AKS
- D. CPU only
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real cost-control pattern: a GPU user pool can scale to zero; taints/tolerations isolate GPU scheduling, and Spot adds interruption risk.
Why this is not the answer
Real but expensive design: GPU hardware for every node pays for specialized capacity even when only ordinary workloads run.
Why this is not the answer
Real alternative compute approach: it does not directly satisfy scheduling these jobs inside the AKS cluster.
Why this is not the answer
Real node type, wrong hardware: CPU-only nodes cannot supply the GPU required by the workload.
The reasoning
Multi-nodepool AKS with min=0 lets the pool scale to zero when idle. Taints prevent CPU pods from landing. Spot GPU nodes can offer substantial discounts, varying by SKU, region and current price for interruption-tolerant batch.
Docs: Multiple node pools | Spot node pool | GPU node pool
S9
Custom Script Extension worked on VM #1, subsequent deployments fail with HTTP 403 on the script URL. Common cause?- A. Script hosted on private blob with SAS that expired; or storage account key rotated and the SAS was signed by the old key
- B. VM size too small
- C. Extension version deprecated
- D. Wrong region
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real authorization failure: an expired or invalidated SAS can make a formerly accessible private script return HTTP 403.
Why this is not the answer
Real compute constraint, wrong symptom: VM size does not by itself change authorization at a script URL.
Why this is not the answer
Real version concern, unproven: extension compatibility is separate from a server explicitly denying the script request.
Why this is not the answer
Real deployment setting, unproven: region alone does not normally invalidate an otherwise authorized HTTPS script URL.
The reasoning
CustomScript downloads via HTTP(S). Expired or invalidated SAS causes an authorization failure, commonly HTTP 403. Fix: regenerate SAS with fresh expiry each deployment, or use managed identity via the managedIdentity property in newer extension versions.
Docs: Custom Script Extension (Windows) | Custom Script Extension (Linux)
S10
VM data disk 4 TB is 95% full. Options to expand?- A. Deallocate + resize disk + extend partition (all disk types)
- B. Live-resize an eligible data disk + extend filesystem, observing disk-type and 4-TiB boundary restrictions
- C. Detach + attach a bigger disk + copy data
- D. All of the above where the disk configuration supports the selected method
Show answer & explain every option
Correct: D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real offline expansion method: deallocate, enlarge within supported disk limits, then extend the guest filesystem. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
Real online capability: eligible data disks can expand live, but disk type, capacity boundaries and VM support must be checked. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
Real migration technique: copy to a larger disk and switch attachments, with a suitable consistency/downtime plan. This is part of the answer; the combined choice includes the other applicable statements too.
✓ Correct choice
Valid qualified combination: each method can work in an eligible configuration; none overrides the disk's maximum capacity or filesystem limits.
The reasoning
Eligible Standard HDD, Standard SSD and Premium data disks can expand without downtime. Expanding a Standard HDD/SSD or Premium SSD from 4 TiB or smaller to above 4 TiB requires deallocation and detachment; Premium SSD v2/Ultra have different restrictions. Extend the guest filesystem afterward.
Docs: Expand disks | Live resize
S11
Deploy the same Bicep template to 10 subscriptions from one Azure DevOps pipeline. Structure?- A. Loop stage over an array of sub IDs; use
az deployment sub createoraz deployment mg create; one service principal with rights across all subs (MG-scoped Contributor) - B. Duplicate template 10 times
- C. Use a Runbook
- D. Not supported
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real deployment structure: reuse parameterized Bicep across authorized subscriptions and scopes; the identity needs rights at each target scope.
Why this is not the answer
Real but brittle duplication: ten copies can drift and do not provide a maintainable reusable deployment model.
Why this is not the answer
Real automation tool: a runbook could orchestrate deployment, but merely naming it omits the required multi-subscription structure/permissions.
Why this is not the answer
False limitation: Azure supports deployments across authorized subscription scopes through pipelines and scoped modules.
The reasoning
Pipeline matrix or each iterates over sub IDs. Subscription-scoped deployments fit "deploy X to sub N." One SP at MG scope minimizes service connection sprawl. Deployment Stacks (newer) can enforce a bundle across scopes.
Docs: Deployment scopes | Deployment Stacks
S12
VMSS Flexible with 6 instances across 3 zones. Fault domain distribution guarantee?- A.
platformFaultDomainCount= 1 for a zone-spanning Flexible scale set; configure and inspect zone distribution - B. Same FD as any other VMSS
- C. No FD in Flexible
- D. Random
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real Flexible setting: zone-spanning scale sets use the documented fault-domain configuration; separately verify actual zone distribution.
Why this is not the answer
False equivalence: fault-domain behavior depends on orchestration and placement settings rather than matching every other scale set.
Why this is not the answer
False absence claim: Flexible has fault-domain placement controls even though its VM model differs from Uniform.
Why this is not the answer
Misleading placement description: Azure follows configured placement rules; random is not an availability guarantee.
The reasoning
Flexible supports up to three platform fault domains for regional nonzonal deployments, depending on region. Zonal and zone-spanning Flexible deployments use a fault-domain count of one (maximum spreading). Do not infer a guaranteed two-per-zone placement merely from six instances.
Docs: Flexible orchestration mode | Availability zones for VMSS
S13
Container App scale-to-zero causes cold-start latency. Mitigation?- A. Set
minReplicas = 1(always warm; lose scale-to-zero savings but avoid ordinary scale-from-zero latency) - B. "Always On" (not a thing in Container Apps)
- C. Move to AKS
- D. Longer request timeout
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real scale setting: keeping at least one replica avoids ordinary zero-to-one startup, at the cost of idle resource usage.
Why this is not the answer
Real App Service setting, wrong product: Always On is not the Container Apps control for minimum replicas.
Why this is not the answer
Real platform alternative, excessive change: migrating to AKS is not required just to keep a Container Apps replica warm.
Why this is not the answer
Real timeout setting, incomplete remedy: waiting longer tolerates latency but does not remove the cold start itself.
The reasoning
Scale-to-zero saves money when idle but adds cold-start (image pull + container start). minReplicas = 1 keeps one replica running under normal conditions; new revisions, restarts, and scale-out can still start new replicas. For cold-start-sensitive SLAs, keep min at 1-2.
Docs: Container Apps scaling | KEDA scalers
S14
App Service deployment slot swap succeeded, production returns HTTP 500. Immediate rollback?- A. Swap slots back (staging <-> production); after checking the prior version remains healthy
- B. Redeploy previous artifact
- C. Restart production
- D. Roll back the RG
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real fast rollback: swapping back restores the previous slot version if it remains healthy; database changes may need separate recovery.
Why this is not the answer
Real rollback alternative: redeploying an older artifact can work, but is generally slower than an intact reverse slot swap.
Why this is not the answer
Real operation, insufficient rollback: restarting leaves the newly deployed code/configuration in place.
Why this is not the answer
Invented generic rollback: a resource group is a scope, not a built-in application-version rollback mechanism.
The reasoning
Swap is bidirectional and warm. Swapping back restores the prior production content; completion depends on warm-up and configuration. Primary reason to use slots: near-instant rollback. Follow up with root cause on sticky slot settings.
Docs: Deployment slots | Swap operation
S15
VM ADE-encrypted OS disk. An administrator has lost access to the Key Vault encryption material. Recovery options?- A. If Key Vault key intact + accessible, decrypt normally; if the key was deleted past soft-delete/purge protection, disk data is cryptographically unrecoverable
- B. Microsoft support can decrypt
- C. Restore from Azure Backup taken pre-encryption
- D. A or C
Show answer & explain every option
Correct: D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Why this is not the answer
Real encryption dependency: recovery requires usable key material; permanently lost keys can render the encrypted disk unrecoverable. This is part of the answer; the combined choice includes the other applicable statements too.
Why this is not the answer
False decryption promise: support cannot simply bypass strong encryption when the required key material is permanently lost.
Why this is not the answer
Real separate recovery route: a verified usable pre-encryption backup can restore an earlier state, losing later changes. This is part of the answer; the combined choice includes the other applicable statements too.
✓ Correct choice
Qualified combination: either recover required key access or restore a usable earlier unencrypted backup; neither guarantees zero data loss.
The reasoning
ADE keys live in Key Vault. Key intact = normal decrypt. Key deleted + purged = data unrecoverable (design intent). Pre-encryption Azure Backup restore is the alternative.
S16
Take crash-consistent snapshots of 5 VMs at the same instant. Tool?- A. Azure Backup coordinates within a single VM only
- B. AzCopy
- C. Only PowerShell scripting
- D. Azure Site Recovery Multi-VM Consistency Groups (replication + recovery plans)
Show answer & explain every option
Listed key (under review): D
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Alternative · under review
Real scope limitation: ordinary Azure VM Backup recovery points do not automatically coordinate a simultaneous consistency group across five VMs.
Alternative · under review
Real data-transfer tool: AzCopy cannot coordinate guest/disk consistency across running virtual machines.
Alternative · under review
Real scripting tool, false exclusivity: scripts can trigger operations but independent calls do not guarantee identical consistent timestamps.
Listed key · under review
Real cross-VM recovery feature: Site Recovery supports multi-VM consistency groups in eligible scenarios; this is coordinated replication recovery, not arbitrary instant snapshots.
Original explanation · under review
Multi-VM consistency requires ASR replication with a Multi-VM Consistency Group. Azure Backup does not natively coordinate cross-VM snapshots.
S17
Automation Account Runbook fails at 3 AM daily. Uses Run As account, no visible error. Which legacy authentication issue should you investigate, and what is the migration path?- A. Check for an expired Run As certificate; Run As accounts retired on September 30, 2023; migrate to system-assigned managed identity on the Automation Account
- B. Timezone bug
- C. VM was off
- D. Cron issue
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real retired authentication model: expiring Run As certificates can break legacy jobs; migrate to managed identity with the required role assignments.
Why this is not the answer
Possible scheduling issue, unproven: the legacy credential model provides a specific diagnostic lead before assuming time-zone failure.
Why this is not the answer
Possible dependency issue, unproven: a runbook can execute independently of a particular VM; inspect its actual job/credential errors.
Why this is not the answer
Real Unix scheduler, wrong platform: Automation schedules are not simply local cron entries.
The reasoning
Inspect job errors and the service principal certificate expiry instead of inferring a cause from the clock time. Run As accounts are retired. Migrate to an Automation managed identity and grant only the required Azure RBAC permissions.
S18
VMSS Flexible with mixed VM sizes (D2s + D4s). Autoscale on Percentage CPU targets what?- A. Weighted average by instance size
- B. Arithmetic average across all instances (mixed sizes weighted equally)
- C. Sum
- D. Only primary size
Show answer & explain every option
Listed key (under review): B
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
Alternative · under review
Possible aggregation concept, not a universal rule: mixed VM sizes do not by themselves establish CPU-weighted autoscale behavior.
Listed key · under review
Unverified blanket claim: arithmetic aggregation depends on the configured metric source/statistic; the question does not specify enough to guarantee it.
Alternative · under review
Real aggregation operation, not implied: Sum must be appropriate/configured for the metric; it is not inferred from mixed VM sizes.
Alternative · under review
Unsupported primary-size rule: a scale set's primary SKU does not inherently exclude other instances from every metric aggregation.
Original explanation · under review
Percentage CPU is the arithmetic average. A D4s at 50% is doing more absolute work than a D2s at 50%, but the metric weighs them equally. Can trigger under- or over-scaling in mixed pools; consider a custom metric or size-uniform pool.
S19
App Service certificate expires in 7 days. Cert is in Key Vault. Auto-renewal path?- A. App Service Managed Certificate (free, auto-renewed) for supported scenarios; OR App Service Certificate + Key Vault import; verify the Microsoft.Azure.WebSites service principal has the documented Key Vault certificate/secret permissions
- B. Manual re-upload yearly
- C. Certs never expire on App Service
- D. Delete and recreate
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real certificate paths: supported managed certificates renew automatically; Key Vault imports require correct source renewal, permissions and synchronization.
Why this is not the answer
Real manual process: it can replace a certificate but does not supply reliable automatic renewal.
Why this is not the answer
False lifetime claim: App Service certificates do expire and require a functioning renewal/update process.
Why this is not the answer
Real destructive action, unnecessary: deleting the application is not the normal certificate-renewal procedure.
The reasoning
App Service Managed Certificate handles most cases free with auto-renewal. Wildcard / multi-domain uses App Service Certificate + Key Vault: renew ASC, App Service picks up the new secret when the App Service resource-provider service principal has the required vault permissions.
Docs: App Service Managed Certificate | Bind cert from Key Vault
S20
Windows VM won't boot after in-place upgrade. Console shows startup repair loop. Recovery?- A. Inspect boot diagnostics; repair the OS disk offline on a repair VM (using
az vm repair), or restore from a suitable Azure Backup recovery point - B. Delete and redeploy
- C. Run sfc /scannow externally
- D. Contact Microsoft
Show answer & explain every option
Correct: A
Understand every option
A wrong choice can name a real feature. Here is what each option means and how it fits this question.
✓ Correct choice
Real recovery workflow: diagnose boot output, repair the attached OS disk safely or restore a known-good backup point.
Why this is not the answer
Real destructive approach, premature: rebuilding may discard recoverable configuration or data without diagnosing the boot failure.
Why this is not the answer
Real repair utility, incomplete instruction: offline SFC requires the correct attached Windows image paths and does not replace diagnosis.
Why this is not the answer
Real escalation route: Microsoft support can assist, but the listed diagnostics and repair/restore tools provide actionable recovery steps.
The reasoning
Serial Console SAC requires the Windows OS to be running; Azure Serial Console does not provide WinRE. Inspect boot diagnostics and use an offline repair VM for boot-configuration repairs. az vm repair automates creation of a repair VM and attachment of a copy of the OS disk. Restoring a known-good Azure Backup recovery point is an alternative, subject to the resulting data loss.
Docs: Serial Console | az vm repair extension