Azure Fundamentals · 38% of the exam

Describe Azure architecture and services: free practice questions

5 sample questions from our 20-question bank for this domain — answers and explanations included. These are the same scenario-based style as the real Azure exam.

1. A company wants employees to access full Windows desktops from personal laptops and tablets, with the desktops running in Azure rather than on the devices. Which service provides this?

  • A. Azure Container Instances
  • B. Azure Virtual Desktop✓ Correct
  • C. Azure App Service
  • D. Azure Functions
Explanation

Azure Virtual Desktop is Azure's desktop and application virtualization service — full Windows desktops and apps hosted in Azure, streamed to nearly any device. Container Instances (A) run containers, App Service (C) hosts web applications, and Functions (D) runs event-driven code; none delivers a virtualized Windows desktop experience.

2. A company requires a private, dedicated connection from its on-premises datacenter to Azure that does NOT traverse the public internet, with predictable bandwidth for large data volumes. Which option meets this requirement?

  • A. Point-to-site VPN
  • B. Site-to-site VPN over the internet
  • C. ExpressRoute✓ Correct
  • D. Azure DNS
Explanation

ExpressRoute provides a private, dedicated circuit between on-premises infrastructure and Azure through a connectivity provider — it never touches the public internet and offers predictable, high bandwidth. Point-to-site (A) connects individual devices over the internet; site-to-site VPN (B) is encrypted but still rides the public internet with variable performance. Azure DNS (D) resolves names; it's not a connectivity service.

3. A company must deploy an application in Azure so that it survives the failure of an entire datacenter within the same geographic area, with synchronous low-latency replication between locations. What should they use?

  • A. Deploy across multiple availability zones within one region✓ Correct
  • B. Deploy to a single availability zone with premium storage
  • C. Deploy to two regions in different geographies
  • D. Deploy two VMs in the same availability set
Explanation

Availability zones are physically separate datacenters within the same region, connected by high-speed low-latency links — designed exactly for surviving a datacenter failure while keeping synchronous replication practical. Option B leaves a single-datacenter point of failure. Option C protects against regional disasters but the inter-region distance makes synchronous low-latency replication impractical. Option D (availability sets) protects only against rack/host failures within one datacenter, not the loss of the whole datacenter.

4. A new administrator must be able to manage virtual machines in one resource group but must NOT be able to manage anything else in the subscription. What is the BEST way to grant this access?

  • A. Assign the Owner role at the subscription scope
  • B. Assign the Virtual Machine Contributor role scoped to the resource group✓ Correct
  • C. Share the subscription administrator's credentials
  • D. Assign a Conditional Access policy to the resource group
Explanation

Azure RBAC follows least privilege: pick the narrowest role (Virtual Machine Contributor) at the narrowest scope needed (the resource group). Option A grants far too much — full control of the entire subscription. Option C is a serious security violation and destroys accountability. Option D misapplies the tool: Conditional Access governs sign-in conditions for identities, and it isn't assigned to resource groups.

5. Users complain about entering passwords repeatedly across company applications, and IT wants to reduce password-related attacks. Which TWO Microsoft Entra ID capabilities directly address these goals? (Select 2)

  • A. Single sign-on (SSO), so one authentication grants access to multiple applications✓ Correct
  • B. Passwordless authentication methods such as Windows Hello, FIDO2 keys, or the Authenticator app✓ Correct
  • C. Storing all passwords in a shared spreadsheet
  • D. Disabling authentication entirely for internal apps
  • E. Azure DNS private zones
Explanation

SSO removes repeated password prompts by letting one sign-in grant access to multiple applications, and passwordless methods (Hello, FIDO2, Authenticator) remove the password as an attack surface. Options C and D are dangerous anti-practices, not capabilities. Option E is a name-resolution feature with no relation to authentication.

15 more questions in this domain

Practice the full bank with instant grading, flashcards, and a timed mock exam.

Start practicing free