Azure Architecture and Services

Regions, Zones and the Management Hierarchy

Half of this domain is structural: where things physically live, and how the management scopes nest. Both drive later questions about policy inheritance, availability and data residency.

Exam tip. Availability zones protect within a region. Protecting against losing an entire region needs a second region, which is what region pairs exist for.

Entra ID, RBAC and the Security Models

Identity questions turn on one distinction: authentication proves who you are, authorisation decides what you may do. Entra ID handles the first, Azure RBAC the second, and Conditional Access sits between them.

Exam tip. Azure Policy and Azure RBAC both sound like governance. RBAC is about who may act; Policy is about what configuration is allowed, and it can deny an owner.

Choosing Between Azure Compute, Networking and Storage Services

The exam gives you a scenario and expects one obvious service. The trick is recognising the phrase that pins it down: OS control, containerised, event-driven, private circuit, SMB share, and so on.

Exam tip. Data Box for very large offline transfers, File Sync for keeping on-premises file servers synchronised, AzCopy and Storage Explorer for ordinary network transfers. Match the tool to the constraint in the scenario.

Azure Storage: Which Service, Which Redundancy, Which Tier

Storage questions have three independent dimensions and the exam mixes them deliberately. Decide the service first, then the redundancy, then the access tier.

Exam tip. Redundancy is an account-level decision, but access tier can be set per blob. That asymmetry is why lifecycle management rules exist.

Azure's Security Services and What Each One Sees

Azure's security surface splits into identity, network and posture. Knowing which layer a service operates at answers most of these questions directly.

Exam tip. Zero Trust and defence in depth are principles, not products. Questions naming them want the principle stated back.

Matching an Azure Service to the Phrase in the Question

Most service-selection questions contain one giveaway phrase. This is the mapping from phrase to service, which is faster than reasoning from first principles under time pressure.

Exam tip. Read for the constraint before reading the options. The constraint usually names exactly one service.

Identity Is the New Perimeter, and Where Each Piece Fits

Identity questions get easier once you separate proving who someone is, deciding what they may do, and controlling when they may do it.

Exam tip. Zero Trust means verify explicitly, least privilege, assume breach. Questions naming it want that phrase, not a product.

1. What is the purpose of an Azure virtual network gateway subnet named GatewaySubnet?

• A. It is where network security groups are stored
• B. It provides outbound internet access for all other subnets
• C. It hosts the virtual network gateway used by VPN or ExpressRoute connectionscorrect
• D. It holds the virtual network's DNS servers

A virtual network gateway must live in a subnet with the exact name GatewaySubnet, which is reserved for it and cannot host ordinary resources. Outbound internet access comes from the default route or a NAT gateway. Network security groups are their own resources associated with subnets or interfaces, and DNS settings are a property of the virtual network rather than a subnet.

2. What is an Azure region?

• A. A billing boundary that groups subscriptions
• B. A logical container for resources within a subscription
• C. A set of datacentres deployed within a latency-defined perimeter and connected by a dedicated regional networkcorrect
• D. A single physical datacentre building

A region is a group of datacentres inside a latency boundary linked by a dedicated network. A single building is a datacentre, subscriptions are the billing boundary, and a resource group is the logical container for resources.

3. A deployment pipeline must create Azure resources with no human signing in. Which identity should it use?

• A. The personal account of the engineer who wrote the pipeline
• B. A shared account whose password is stored in the pipeline definition
• C. The tenant's Global Administrator account
• D. A service principal or managed identity granted only the roles the deployment needscorrect

Automation needs a non-human identity so the pipeline keeps working when people change jobs and so its actions are attributable to the pipeline rather than to a person. A service principal or managed identity is created for that purpose and given the narrowest role at the narrowest scope the deployment requires. A personal account ties production to one employee, an embedded password is a credential leak waiting to happen, and a directory administrator account is wildly over-privileged.

4. What is Azure Event Grid used for?

• A. Routing discrete events, such as a blob being created, to subscribers that should react to themcorrect
• B. Storing relational data with enforced schemas
• C. Delivering virtual desktops to users
• D. Assigning IP addresses within a subnet

Event Grid distributes individual notifications about things that have happened, such as a file being uploaded or a resource being created, to whatever subscribers should respond, which is the basis of event-driven architecture in Azure. Relational data belongs to a database service, virtual desktops come from Azure Virtual Desktop, and address assignment within a subnet is handled by the platform's networking.