Describe Azure Architecture and Services practice questions

Answer: A) Azure Backup with a Recovery Services vault

Azure Backup is Azure's policy-based backup and restore service. It keeps recovery points in an isolated vault so you can recover from deletion, corruption, or ransomware. Site Recovery is for failover, and storage redundancy copies deletions to every replica.

• ACorrect. Azure Backup uses policies that set the backup schedule and how long copies are kept. It stores recovery points in a Recovery Services vault that is isolated from production, and it supports Azure VMs and SQL Server databases. Microsoft lists protection against accidental deletion, corruption, and ransomware as its main uses.
• BIncorrect. Site Recovery continuously replicates workloads to a secondary location so you can fail over and keep apps running during an outage. Microsoft's docs say to use Azure Backup for data protection and Site Recovery for disaster recovery and failover orchestration.
• CIncorrect. Storage redundancy keeps copies of the current state of the data. Deletions and overwrites are applied to every replica, so it protects against hardware or regional failures but can't bring back data that was accidentally deleted or corrupted.
• DIncorrect. Azure Migrate is a hub for assessing workloads and migrating them to Azure. It doesn't provide ongoing backups with retention or point-in-time restore.

Answer: A) Azure VPN Gateway with a site-to-site connection

For an encrypted connection between an on-premises network and an Azure virtual network over the public internet, use a site-to-site connection on Azure VPN Gateway. ExpressRoute is the private connection that doesn't use the internet.

• ACorrect. VPN Gateway sends encrypted traffic between an Azure virtual network and on-premises locations over the public internet. A site-to-site connection uses an IPsec/IKE tunnel between the VPN gateway and an on-premises VPN device.
• BIncorrect. ExpressRoute extends on-premises networks into Azure over a private connection through a connectivity provider and does not go over the public internet. It is a dedicated circuit, not the internet-based encrypted tunnel this scenario describes.
• CIncorrect. Virtual network peering connects Azure virtual networks to each other. It does not create a connection from an on-premises network to Azure.
• DIncorrect. Azure Bastion gives secure RDP/SSH access to individual VMs. It does not create a network-to-network connection between an on-premises site and Azure.

Answer: A) Azure Virtual Desktop

Azure Virtual Desktop is the Azure service that delivers full Windows desktops (including Windows 11 multi-session) and RemoteApp apps to users on any device, with Microsoft managing the gateway and broker roles. Bastion, VPN Gateway, and Scale Sets provide connectivity or compute, not desktop virtualization.

• ACorrect. Azure Virtual Desktop is a desktop and app virtualization service that runs on Azure. It delivers full Windows 11/10 desktops, including multi-session, or individual apps through RemoteApp. Users can connect from any device with a native client or an HTML5 web client, and Microsoft manages the gateway and broker roles.
• BIncorrect. Azure Bastion provides secure RDP/SSH connectivity over TLS to existing VMs in a virtual network, mainly for administrative access. It is not a desktop and app virtualization service, and it does not provide multi-session Windows hosts, app publishing, or user assignment to desktops.
• CIncorrect. A point-to-site VPN only creates an encrypted network tunnel between a device and a virtual network. It does not provide hosted Windows desktops or published apps. The company would still need to build and manage the desktop infrastructure.
• DIncorrect. Scale sets create and autoscale groups of identical, load-balanced VMs for applications. They don't provide user desktop assignment, RemoteApp publishing, or the managed connection brokering that end-user desktop delivery needs.

Answer: A) Azure App Service

• AAzure App Service is a fully managed platform for hosting web applications, APIs, and mobile backends — the customer deploys their code, and Azure handles the underlying VM/OS management, patching, and scaling infrastructure.
• BRunning a VM with manually installed web server software requires the customer to manage the OS and patching themselves — the opposite of the fully managed hosting experience being described.
• CAzure Container Registry stores and manages container images; it doesn't itself host and run a web application the way App Service does.
• DA resource group is a logical organizational container, not a web hosting service.

Answer: A) Azure HDInsight

• AAzure HDInsight provides managed clusters running popular open-source big data frameworks — including Hadoop, Spark, Hive, and Kafka — directly, letting a team with existing expertise in those specific open-source tools continue using them in a managed Azure environment, rather than needing to adopt an entirely different analytics platform.
• BAzure SQL Database is a general-purpose relational database, not a managed open-source big data cluster service.
• CBlob Storage is unstructured object storage; it isn't itself a managed open-source big data cluster/processing service.
• DA resource group is a logical organizational container, not a big data cluster service.

Answer: A) Azure Static Web Apps

Azure Static Web Apps combines globally distributed static content hosting, an integrated API through managed Azure Functions, and automatic build and deployment from GitHub or Azure DevOps in a single service. Blob Storage static websites, containers, and VMs each lack parts of that integrated workflow.

• ACorrect. Static Web Apps hosts static content from globally distributed points and provides integrated API support through managed Azure Functions. It integrates with GitHub and Azure DevOps so that pushes to a watched branch automatically build and deploy the app and its API.
• BIncorrect. Blob Storage can serve static files from its $web container, but it has no integrated managed API and no built-in build-and-deploy workflow from a repository. Microsoft's documentation points to Static Web Apps when you need its fully managed CI/CD workflow from GitHub.
• CIncorrect. Container Instances runs containers that you package and deploy yourself. It doesn't distribute static files globally, provide a managed Functions API, or build and deploy automatically from a GitHub branch.
• DIncorrect. Scale Sets run groups of identical VMs that the team must configure, patch, and deploy to. That is IaaS server infrastructure, the opposite of the serverless, repository-driven hosting the team wants.

Answer: A) Azure Arc

• AAzure Arc extends Azure's management capabilities — like Azure Policy, resource tagging, and RBAC — to resources running outside Azure, including on-premises servers and resources in other clouds, letting an organization manage them through a single, consistent Azure-based control plane.
• BAzure Migrate assesses and plans moving on-premises workloads into Azure itself; it doesn't project and manage resources that remain outside Azure the way Azure Arc does.
• CAzure DNS handles domain name resolution, unrelated to extending Azure's management plane to non-Azure resources.
• DA resource group is a logical organizational container within Azure itself, not a mechanism for extending management to resources outside Azure.

Answer: A) Azure DDoS Protection

Azure DDoS Protection gives always-on monitoring and automatic mitigation of layer 3/4 DDoS attacks on public-facing resources in a virtual network. Firewalls and NSGs filter traffic by rule but aren't built to absorb volumetric attacks.

• ACorrect. Azure DDoS Protection monitors traffic around the clock and automatically mitigates distributed denial-of-service attacks at layers 3 and 4 for public IPs of resources in a virtual network. It's built to handle very large volumetric attacks.
• BIncorrect. Azure Firewall is a stateful firewall that filters traffic based on rules. Microsoft lists it as a separate network security service from DDoS Protection, and it doesn't provide the auto-tuned volumetric attack mitigation described here.
• CIncorrect. Network security groups allow or deny traffic using rules based on source, destination, port and protocol. They don't detect or absorb large-scale traffic floods.
• DIncorrect. Azure Bastion provides secure RDP/SSH access to VMs without exposing them on public IPs. It doesn't defend public endpoints against traffic floods.

Answer: A) Zone support depends on the region, so the architect should confirm that the chosen region offers availability zones.

Availability zones are physically separate groups of datacenters within one region, each with independent power, cooling, and networking. Not every region offers them, so confirm zone support in the target region before designing a zone-redundant deployment.

• ACorrect. Microsoft says many Azure regions provide availability zones, and its region list shows some regions with none. A design that spreads VMs across zones therefore only works if the chosen region supports zones.
• BIncorrect. An availability zone is a group of one or more physically separate datacenters within a single region. Spreading VMs across zones keeps them in the same region.
• CIncorrect. Region pairing and availability zones are independent. Some regions with three zones, such as Austria East, have no paired region, and some paired regions, such as West US, have no zones.
• DIncorrect. Each availability zone has independent power, cooling, and networking infrastructure, so an outage in one zone doesn't take down the others.

Answer: A) Azure Container Registry

• AAzure Container Registry provides a private, managed registry for storing and managing container images, which services like AKS or Container Instances can then pull from securely when deploying, rather than relying on a public registry for private application images.
• BWhile technically capable of storing arbitrary files, Blob Storage isn't purpose-built for container image management the way Azure Container Registry specifically is, with registry-aware features like image tagging and vulnerability scanning.
• CAzure DNS handles domain name resolution, unrelated to storing container images.
• DA resource group is a logical organizational container, not a container image registry service.