Advanced Azure test (Advanced)

Sample questions

5 sample questions from the Advanced Azure test, with the answers. Samples are taken out of the live test, so you will not meet these when you sit it.

1. Which of the following accurately describes the event retention policies of Event Grid and Service Bus?

   1. Event Grid and Service Bus both do not retain events by default.
   2. Event Grid and Service Bus both retain events for a configurable period.
   3. Event Grid retains events for 7 days by default, whereas Service Bus does not retain messages.
   4. Event Grid does not retain events by default, whereas Service Bus retains messages for a configurable period.

   Answer: D. Event Grid does not retain events by default, whereas Service Bus retains messages for a configurable period.

   Event Grid is designed for event-driven architectures and does not natively retain events. If event retention is required, Service Bus or Azure Storage can be used as alternatives. Service Bus, on the other hand, provides built-in message retention for a configurable duration, making it suitable for scenarios where event persistence is necessary.

2. When comparing Azure Key Vault's use of Role-Based Access Control (RBAC) with Azure Active Directory (AAD), which statement accurately describes their roles and when to choose each for securing Key Vault resources?

   1. Azure Key Vault uses Azure Active Directory (AAD) for all access controls, including secrets, keys, and certificates, whereas RBAC is used for managing access to virtual machines and other compute resources. Both RBAC and AAD are equally effective for securing Key Vault resources.
   2. Azure Key Vault uses Role-Based Access Control (RBAC) to manage access to secrets, keys, and certificates, whereas Azure Active Directory (AAD) provides identity and access management at the user and group level. RBAC is more granular for resource-level access, making it ideal for securing Key Vault resources, while AAD is better suited for managing user identities and application access at a higher level.
   3. Azure Key Vault uses Azure Active Directory (AAD) for all access controls, including secrets, keys, and certificates, whereas RBAC is used for managing access to virtual machines and other compute resources. AAD is more granular for resource-level access, making it ideal for securing Key Vault resources.
   4. Azure Key Vault uses Azure Active Directory (AAD) for all access controls, including secrets, keys, and certificates, whereas RBAC is used for managing access to virtual machines and other compute resources. RBAC is more granular for resource-level access, making it ideal for securing Key Vault resources.

   Answer: B. Azure Key Vault uses Role-Based Access Control (RBAC) to manage access to secrets, keys, and certificates, whereas Azure Active Directory (AAD) provides identity and access management at the user and group level. RBAC is more granular for resource-level access, making it ideal for securing Key Vault resources, while AAD is better suited for managing user identities and application access at a higher level.

   Azure Key Vault uses RBAC to enforce granular access control at the resource level, which is more suitable for securing sensitive data stored in Key Vault. Azure Active Directory (AAD) focuses on identity and access management for users and applications, making it a complementary but less granular approach for Key Vault-specific access. RBAC should be chosen when precise control over Key Vault resources is required.

3. Which of the following statements accurately describes the behavior of role-based access control (RBAC) in Azure Key Vault when a user is assigned a specific role?

   1. Azure Key Vault uses role-based access control (RBAC) to manage access to secrets, keys, and certificates. When a user is assigned the 'Key Vault Administrator' role at the Key Vault scope, they can manage all aspects of the Key Vault, including creating, deleting, and listing secrets, keys, and certificates.
   2. Azure Key Vault uses role-based access control (RBAC) to manage access to secrets, keys, and certificates. When a user is assigned the 'Key Vault Key User' role at the Key Vault scope, they can manage all aspects of the Key Vault, including creating, deleting, and listing secrets, keys, and certificates.
   3. Azure Key Vault uses role-based access control (RBAC) to manage access to secrets, keys, and certificates. When a user is assigned the 'Key Vault Reader' role at the Key Vault scope, they can manage all aspects of the Key Vault, including creating, deleting, and listing secrets, keys, and certificates.
   4. Azure Key Vault uses role-based access control (RBAC) to manage access to secrets, keys, and certificates. When a user is assigned the 'Key Vault Secrets User' role at the Key Vault scope, they can manage all aspects of the Key Vault, including creating, deleting, and listing secrets, keys, and certificates.

   Answer: A. Azure Key Vault uses role-based access control (RBAC) to manage access to secrets, keys, and certificates. When a user is assigned the 'Key Vault Administrator' role at the Key Vault scope, they can manage all aspects of the Key Vault, including creating, deleting, and listing secrets, keys, and certificates.

   The 'Key Vault Administrator' role grants full access to manage all aspects of the Key Vault. Other roles like 'Key Vault Reader' only allow read access, 'Key Vault Secrets User' allows access to secrets only, and 'Key Vault Key User' allows access to keys only. Therefore, the correct option is the one that states the 'Key Vault Administrator' role provides full management capabilities.

4. Which of the following is the best practice for optimizing costs under the Cost Optimization pillar of the Well-Architected Framework?

   1. Implement Azure Cache for Redis to improve application performance.
   2. Use Azure Functions with a 10-minute timeout to reduce execution costs.
   3. Deploy resources in a single availability zone to reduce costs.
   4. Use Azure Advisor to identify underutilized resources and optimize them.

   Answer: D. Use Azure Advisor to identify underutilized resources and optimize them.

   Azure Advisor is a tool that provides recommendations to optimize costs by identifying underutilized resources. This aligns with the Cost Optimization pillar of the Well-Architected Framework. The other options either focus on performance (not cost) or are not directly aligned with cost optimization strategies.

5. Which statement accurately describes the behavior of Key Vault access policy inheritance in Azure?

   1. Azure RBAC assignments override Key Vault access policies.
   2. Key Vault access policies are inherited by resource groups automatically.
   3. Key Vault access policies are applied uniformly across all resources in a subscription.
   4. Key Vault access policies are inherited from management groups by default.

   Answer: A. Azure RBAC assignments override Key Vault access policies.

   Azure RBAC (Role-Based Access Control) assignments take precedence over Key Vault access policies. This is a common mistake where users assume Key Vault access policies are the only way to control access, but Azure RBAC provides a more granular and flexible method of managing permissions. If a user is assigned a role via Azure RBAC that grants access to Key Vault, it will override any conflicting access policies defined within Key Vault itself.