Azure Architecture and Services

Regions, Zones and the Management Hierarchy

Half of this domain is structural: where things physically live, and how the management scopes nest. Both drive later questions about policy inheritance, availability and data residency.

Exam tip. Availability zones protect within a region. Protecting against losing an entire region needs a second region, which is what region pairs exist for.

Entra ID, RBAC and the Security Models

Identity questions turn on one distinction: authentication proves who you are, authorisation decides what you may do. Entra ID handles the first, Azure RBAC the second, and Conditional Access sits between them.

Exam tip. Azure Policy and Azure RBAC both sound like governance. RBAC is about who may act; Policy is about what configuration is allowed, and it can deny an owner.

Choosing Between Azure Compute, Networking and Storage Services

The exam gives you a scenario and expects one obvious service. The trick is recognising the phrase that pins it down: OS control, containerised, event-driven, private circuit, SMB share, and so on.

Exam tip. Data Box for very large offline transfers, File Sync for keeping on-premises file servers synchronised, AzCopy and Storage Explorer for ordinary network transfers. Match the tool to the constraint in the scenario.

Azure Storage: Which Service, Which Redundancy, Which Tier

Storage questions have three independent dimensions and the exam mixes them deliberately. Decide the service first, then the redundancy, then the access tier.

Exam tip. Redundancy is an account-level decision, but access tier can be set per blob. That asymmetry is why lifecycle management rules exist.

Azure's Security Services and What Each One Sees

Azure's security surface splits into identity, network and posture. Knowing which layer a service operates at answers most of these questions directly.

Exam tip. Zero Trust and defence in depth are principles, not products. Questions naming them want the principle stated back.

Matching an Azure Service to the Phrase in the Question

Most service-selection questions contain one giveaway phrase. This is the mapping from phrase to service, which is faster than reasoning from first principles under time pressure.

Exam tip. Read for the constraint before reading the options. The constraint usually names exactly one service.

Identity Is the New Perimeter, and Where Each Piece Fits

Identity questions get easier once you separate proving who someone is, deciding what they may do, and controlling when they may do it.

Exam tip. Zero Trust means verify explicitly, least privilege, assume breach. Questions naming it want that phrase, not a product.

1. What is an Azure region?

• A. A billing boundary that groups subscriptions
• B. A logical container for resources within a subscription
• C. A set of datacentres deployed within a latency-defined perimeter and connected by a dedicated regional networkcorrect
• D. A single physical datacentre building

A region is a group of datacentres inside a latency boundary linked by a dedicated network. A single building is a datacentre, subscriptions are the billing boundary, and a resource group is the logical container for resources.