Azure Solutions Architect Expert · 27% of the exam

Design identity, governance, and monitoring solutions: free practice questions

5 sample questions from our 15-question bank for this domain — answers and explanations included. These are the same scenario-based style as the real Azure exam.

1. An application needs to store and rotate TLS certificates and database connection secrets centrally, with access controlled by RBAC and auditing. Which Azure service should the design use?

  • A. Azure Key Vault✓ Correct
  • B. Azure Blob Storage
  • C. Azure Table Storage
  • D. A plain text file in a storage account
Explanation

Azure Key Vault centrally stores secrets, keys, and certificates with RBAC-controlled access, rotation, and audit logging. Blob (B) and Table storage (C) are general data stores without secret-management features, and a plain-text file (D) is an insecure anti-pattern.

2. An architect must design authorization so a support team can restart VMs in one resource group but cannot modify networking or delete resources. Which approach follows least privilege?

  • A. Assign a built-in role scoped to VM operations (e.g., Virtual Machine Contributor) at that resource group✓ Correct
  • B. Assign Owner at the subscription scope
  • C. Assign Contributor at the management group scope
  • D. Share the subscription admin account
Explanation

Least privilege means the narrowest role at the narrowest scope: a VM-focused role at the specific resource group grants restart without networking or delete rights across everything. Owner at subscription (B) and Contributor at management group (C) grant far too much, and sharing an admin account (D) destroys accountability.

3. A design needs application-level telemetry — request rates, dependency calls, exceptions, and end-to-end transaction traces — for a web app to diagnose performance issues. Which monitoring solution should the architect recommend?

  • A. Application Insights (part of Azure Monitor)✓ Correct
  • B. Azure Policy
  • C. Azure Key Vault
  • D. Azure Site Recovery
Explanation

Application Insights instruments application code to capture requests, dependencies, exceptions, and distributed traces for performance diagnosis. Azure Policy (B) governs configuration, Key Vault (C) stores secrets, and Site Recovery (D) is disaster recovery — none provides application performance telemetry.

4. A regulated workload requires that resource configurations are continuously assessed against a compliance standard, with non-compliant resources reported and, where possible, automatically remediated. Which solution should the architect design?

  • A. Azure Policy with initiatives (policy sets) and remediation tasks✓ Correct
  • B. Manual quarterly spreadsheet audits
  • C. Resource locks on all resources
  • D. Conditional Access policies
Explanation

Azure Policy — grouped into initiatives mapped to a compliance standard — continuously audits resources, reports compliance, and can auto-remediate via remediation tasks. Manual spreadsheets (B) don't scale or continuously assess, resource locks (C) only prevent changes, and Conditional Access (D) governs sign-in, not resource configuration.

5. The architecture team wants a governance hierarchy that separates production and non-production workloads for billing and access, while applying common security policy above both. Which design is appropriate?

  • A. A management group containing separate 'prod' and 'non-prod' subscriptions, with policy assigned at the management group✓ Correct
  • B. A single subscription with everything mixed together
  • C. One resource group spanning multiple subscriptions
  • D. Assigning policy only at individual resource scope
Explanation

A management group over separate prod/non-prod subscriptions gives billing/access separation per subscription while common policy assigned at the management group inherits to both. A single mixed subscription (B) loses separation, a resource group can't span subscriptions (C), and resource-level-only policy (D) doesn't scale or enforce consistently.

10 more questions in this domain

Practice the full bank with instant grading, flashcards, and a timed mock exam.

Start practicing free