Title: Azure Fundamentals — LearnCoachAssist

Q: What Azure term describes a geographic area containing one or more datacenters, such as 'East US'?
A: Region. A region is a set of datacenters deployed within a latency-defined geographic boundary and connected through a dedicated regional low-latency network.

Q: What is the purpose of an Azure Availability Zone?
A: Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking, used to protect workloads from datacenter failures.

Q: What Azure service provides serverless computing where you run code in response to events without managing servers?
A: Azure Functions. It is an event-driven, serverless compute service that lets you run code on demand without provisioning or managing infrastructure.

Q: Which Azure compute service offers managed Kubernetes clusters?
A: Azure Kubernetes Service (AKS). It simplifies deploying, managing, and operating containerized applications using Kubernetes as a managed service.

Q: What does Azure Virtual Machine Scale Sets provide?
A: VM Scale Sets let you deploy and manage a group of identical, load-balanced VMs that can automatically increase or decrease in number based on demand or a defined schedule.

Q: Which Azure storage service is best for storing unstructured data like images, videos, and backups?
A: Azure Blob Storage is optimized for storing massive amounts of unstructured object data such as images, videos, audio, and backups.

Q: What is the maximum size of a single Azure Blob (Block Blob)?
A: A single block blob in Azure Storage can be up to approximately 4.75 TB (50,000 blocks × 100 MB each, with the latest blocks up to 4000 GB via the 4000 MiB block size limit and append contexts).

Q: Which Azure storage redundancy option replicates data to a secondary region hundreds of miles away from the primary?
A: Geo-redundant storage (GRS) replicates data to a paired secondary region that is hundreds of miles from the primary region, providing cross-regional disaster recovery.

Q: What is the purpose of Azure Virtual Network (VNet)?
A: Azure Virtual Network is the fundamental building block for private networking in Azure, enabling Azure resources to securely communicate with each other, the internet, and on-premises networks.

Q: Which Azure service routes traffic optimally between users and services based on performance?
A: Azure Traffic Manager is a DNS-based load balancer that distributes traffic optimally to services across global Azure regions using routing methods such as priority, weighted, performance, or geographic.

Q: What is the role of Azure ExpressRoute?
A: ExpressRoute lets you create private connections between Azure datacenters and your on-premises infrastructure, bypassing the public internet for higher security, reliability, and lower latency.

Q: Which Azure service provides a private connection to specific Azure services without traversing the public internet?
A: Azure Private Endpoint enables a private, secure connection to specific Azure PaaS services (like Storage or SQL) using a private IP address inside your virtual network.

Q: What does Azure Active Directory (now Microsoft Entra ID) primarily manage?
A: Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based identity and access management service that handles authentication and authorization for users, applications, and resources.

Q: What is Azure role-based access control (RBAC)?
A: RBAC is an authorization system that provides fine-grained access management to Azure resources, allowing you to grant users only the permissions they need based on their role.

Q: What does the built-in Azure role 'Reader' permit a user to do?
A: The Reader role allows a user to view all resources but does not permit any modifications, making it useful for read-only auditing and monitoring scenarios.

Q: Which Azure service helps protect against distributed denial-of-service (DDoS) attacks?
A: Azure DDoS Protection provides enhanced DDoS mitigation capabilities that automatically detect and mitigate attacks against Azure resources.

Q: What is the purpose of Azure Key Vault?
A: Azure Key Vault safeguards cryptographic keys, secrets (like passwords), and certificates in a hardware-backed, centrally managed cloud service with access control and auditing.

Q: Which Azure service provides centralized policy management across subscriptions?
A: Azure Policy enables you to create, assign, and manage policies that enforce rules and effects over your resources, ensuring compliance with corporate standards.

Q: What is Azure Blueprints used for?
A: Azure Blueprints (deprecated for ARM Template Specs/landing zones, but historically) orchestrates the deployment of resource templates, role assignments, and policies to set up governed environments.

Q: Which Azure tool helps you estimate costs before deploying resources?
A: The Azure Pricing Calculator lets you estimate the cost of Azure products and services by configuring expected usage scenarios and combining different resource types.

Q: What is an Azure Service Level Agreement (SLA) typically expressed as?
A: An SLA is a formal agreement that defines the performance guarantees Microsoft commits to for an Azure service, usually expressed as a percentage of uptime (e.g., 99.9%).

Q: How is the composite SLA of a multi-service application calculated?
A: To find a composite SLA, multiply the individual SLAs (as decimals) of dependent services. For example, two services each with 99.9% availability yield a combined SLA of 99.8%.

Q: Which Azure support plan offers a 1-hour response for production-down critical issues?
A: Azure Premier or the top-tier Microsoft Unified (now Microsoft Premier) and Microsoft Unified Support plans typically offer the fastest response times; Azure's standard top paid tier, Microsoft Enterprise Agreement support, provides 1-hour response for Severity A issues.

Q: What Azure purchasing option offers the deepest discount in exchange for a 1- or 3-year commitment?
A: Reserved Instances (Azure Reservations) provide significant discounts, often up to 72%, compared to pay-as-you-go pricing, when you commit to a 1- or 3-year term.

Q: What does Azure Advisor recommend?
A: Azure Advisor analyzes your configurations and usage telemetry and provides personalized recommendations to improve cost, security, reliability, operational excellence, and performance.

Q: What is the Azure Well-Architected Framework based on five pillars?
A: The five pillars are Cost Optimization, Operational Excellence, Performance Efficiency, Reliability, and Security, providing best-practice guidance for building high-quality Azure solutions.

Q: Which Azure governance tool provides a unified view of compliance across your cloud environment?
A: Microsoft Defender for Cloud (formerly Azure Security Center) and Azure Policy together provide a unified view of regulatory compliance and security posture across your subscriptions.

Q: What is Azure Lighthouse used for?
A: Azure Lighthouse enables service providers to manage Azure resources across multiple customer tenants with delegated administration, providing automation, scalability, and governance.

Q: Which Azure service manages DNS domains and provides fast, reliable DNS resolution?
A: Azure DNS is a hosting service for DNS domains that provides name resolution using Microsoft's global infrastructure of DNS servers.

Q: What is the difference between Azure IaaS and PaaS?
A: IaaS (Infrastructure as a Service) provides raw compute, storage, and networking that you manage (e.g., Azure VMs), while PaaS (Platform as a Service) provides managed platforms for applications so you focus only on code and data (e.g., Azure SQL Database).

Q: Which Azure compute option is best for lifting a legacy application to the cloud with minimal code changes?
A: Azure Virtual Machines (IaaS) is typically the best choice for lift-and-shift migrations, as it provides full control over the OS and middleware without requiring application redesign.

Q: What does Azure Monitor collect and analyze?
A: Azure Monitor collects telemetry data (metrics and logs) from Azure and on-premises environments, providing visibility into performance, availability, and the overall health of applications and infrastructure.

Q: Which Azure service sends alerts based on metric or log query thresholds?
A: Azure Monitor Alerts allow you to configure rules that trigger notifications or automated actions when metric values or log query results meet specified thresholds.

Q: What is Azure Resource Manager (ARM)?
A: ARM is the deployment and management service for Azure that provides a consistent management layer enabling you to create, update, and delete resources in your Azure account via the portal, CLI, PowerShell, or templates.

Q: What is the purpose of an Azure Resource Group?
A: A Resource Group is a logical container that holds related Azure resources for an application. Resources in a group share the same lifecycle, permissions, and policies.

Q: Which Azure tool lets you deploy infrastructure as code using declarative JSON or Bicep templates?
A: ARM templates and Bicep files allow you to define and deploy Azure infrastructure declaratively using JSON (ARM) or the simplified Bicep domain-specific language.

Q: What is Azure App Service?
A: Azure App Service is a fully managed PaaS for building, deploying, and scaling web apps, REST APIs, mobile backends, and automated business processes using .NET, Java, Node.js, Python, PHP, or Ruby.

Q: What is Azure Cosmos DB optimized for?
A: Azure Cosmos DB is a globally distributed, multi-model NoSQL database service offering turnkey global distribution, elastic scaling, and guaranteed single-digit millisecond latency at any scale.

Q: Which Azure service provides a managed relational database with built-in high availability?
A: Azure SQL Database is a fully managed PaaS relational database based on the latest SQL Server engine, offering built-in high availability, automated backups, and intelligent performance tuning.

Q: What is the purpose of Azure Front Door?
A: Azure Front Door is a modern cloud CDN that provides global load balancing, SSL offloading, application acceleration, and WAF protection for delivering web applications with high availability and performance.

Q: How many availability zones does a typical Azure region contain?
A: Most Azure regions contain three availability zones, though the exact count varies. Each zone is one or more physically separate datacenters with independent power, cooling, and networking within the same region.

Q: What is the highest SLA percentage Microsoft publishes for a single Azure virtual machine using Availability Zones?
A: For a single VM using Availability Zones, Microsoft publishes an SLA of 99.99%. The non-zone VM SLA is 99.9%, so deploying across zones increases availability by an order of magnitude.

Q: Which Azure compute service runs containers without requiring you to manage servers or orchestrators?
A: Azure Container Instances (ACI) provides serverless containers. You supply the image and ACI provisions compute, with no VM or Kubernetes cluster management required, ideal for burst workloads or simple microservice deployments.

Q: What is the difference between Azure Functions Consumption plan and Premium plan?
A: The Consumption plan bills only for execution time and is fully serverless with cold starts. The Premium plan provides pre-warmed instances, no cold starts, VNet integration, and predictable performance, billed per second of execution.

Q: Which Azure storage tier is most cost-effective for rarely accessed data stored at least 180 days?
A: Archive tier offers the lowest storage cost for data accessed rarely and stored for at least 180 days. Retrieval is slow (hours) and incurs rehydration and retrieval fees, so it suits long-term backups and compliance archives.

Q: What is the purpose of Azure Blob object replication?
A: Object replication asynchronously copies blobs between a source and destination storage account across regions or within the same region. It supports scenarios like disaster recovery, data localization, and reducing latency for distributed users.

Q: Which Azure networking component provides stateful packet filtering at the network level?
A: Azure Firewall is a managed, cloud-based network security service that provides stateful packet filtering, application and network-level rules, threat intelligence, and high availability across Availability Zones.

Q: What is the difference between a public IP address and a private IP address in Azure?
A: Public IPs allow inbound/outbound internet connectivity to Azure resources and are billed. Private IPs communicate within a VNet or via VPN/ExpressRoute to on-premises networks. Private IPs are not routable on the public internet.

Q: What does Microsoft Entra Conditional Access evaluate before granting access to a resource?
A: Conditional Access evaluates signals such as user/group, location, device state, application, and real-time risk (e.g., sign-in risk from Identity Protection). Based on these, it enforces policies like MFA, compliant device, or blocks access.

Q: What is the purpose of Azure Bastion?
A: Azure Bastion provides secure RDP and SSH connectivity to VMs directly through the Azure portal over SSL, eliminating the need for public IPs on VMs. It is a fully managed PaaS deployed inside your VNet.

Q: Which Azure service protects secrets, keys, and certificates in an HSM-backed vault?
A: Azure Key Vault can store secrets, keys, and certificates. The Premium tier offers HSM-protected keys with FIPS 140-2 Level 3 validation, suitable for regulated workloads requiring hardware-backed key custody.

Q: What is the Azure spending limit, and which account type offers it?
A: The spending limit prevents Azure charges beyond a monthly credit on free trial and some legacy subscription types. It is not available on Pay-As-You-Go, Enterprise Agreement, or CSP subscriptions, which have no hard cap by default.

Q: What is the Azure Hybrid Benefit?
A: Azure Hybrid Benefit lets you apply existing on-premises Windows Server and SQL Server licenses with Software Assurance to Azure VMs and SQL Database, reducing compute charges by the license cost and lowering TCO.

Q: What is Azure Policy and how does it differ from Azure RBAC?
A: Azure Policy enforces organizational standards and assesses resource compliance (e.g., allowed SKUs, regions, tags). RBAC controls who can perform actions on resources. Policy focuses on what resources look like; RBAC focuses on who can act.

Q: Which resource lock level prevents resources from being deleted but still allows configuration changes?
A: The CanNotDelete lock prevents users from deleting resources but permits modifications. ReadOnly blocks both deletion and changes. Locks are inherited by child resources and apply regardless of RBAC permissions.

Q: What are the five pillars of the Azure Well-Architected Framework?
A: The five pillars are Cost Optimization, Operational Excellence, Performance Efficiency, Reliability, and Security. Each pillar contains design principles and trade-offs to help build high-quality cloud workloads.

Q: Which Azure service enables centralized log collection across Azure, on-premises, and multi-cloud sources?
A: Azure Monitor Log Analytics workspace ingests data from Azure resources, agents on on-premises machines, and other clouds. You query data using KQL and correlate logs for diagnostics, dashboards, and alerts.

Q: What is the purpose of Azure Service Health?
A: Azure Service Health provides personalized alerts and guidance for Azure service incidents, planned maintenance, and health advisories affecting your specific subscriptions and resources, helping you plan responses.

Q: What is Azure Advisor's 'High Availability' recommendation category about?
A: Advisor's High Availability category recommends actions like configuring Availability Zones, removing single points of failure, and enabling virtual machine scale sets to improve workload uptime and meet SLA targets.

Q: What is Azure Resource Manager (ARM) and how does it differ from the classic deployment model?
A: ARM is the management layer that organizes resources into resource groups and supports declarative templates, RBAC, tags, and policies. Classic deployment is the older model without resource groups, which lacks RBAC and template consistency.

Q: What is the maximum size of an Azure managed disk?
A: Azure managed disks currently support up to 64 TiB for Ultra Disks and Premium SSD v2, with higher sizes available on specific disk types. Standard SSDs and older Premium SSDs have lower per-disk limits.

Q: Which Azure service provides global load balancing with TLS termination and WAF capabilities?
A: Azure Front Door is a global Layer-7 load balancer with TLS/SSL offload, WAF integration, URL-path routing, and acceleration via Microsoft backbone. It is designed for HTTP/HTTPS global applications, distinct from regional load balancers.

Q: What is Azure Traffic Manager and what routing methods does it support?
A: Traffic Manager is a DNS-based global load balancer that directs traffic using methods: Priority, Weighted, Performance, Geographic, Multivalue, and Subnet. It balances across regions but operates at DNS, not Layer 7.

Q: What is the purpose of Azure Virtual WAN?
A: Azure Virtual WAN is a networking service that provides optimized, automated branch-to-branch connectivity through hubs that integrate VPN, ExpressRoute, and point-to-site connections with routing managed by Microsoft.

Q: Which Azure service provides serverless event-driven messaging with at-least-once delivery and dead-letter queues?
A: Azure Service Bus and Event Grid support event-driven messaging. Service Bus queues/topics provide advanced features like dead-lettering, sessions, transactions, and at-least-once delivery for enterprise messaging scenarios.

Q: What is Azure Dedicated Host?
A: Azure Dedicated Host provides physical servers dedicated to a single customer, ensuring no other organizations share the hardware. It supports compliance requirements, predictable performance, and license benefits like Windows Server and SQL BYOL.

Q: What is the difference between horizontal scaling and vertical scaling in Azure?
A: Horizontal scaling (scale out/in) adds or removes instances, ideal for distributed apps. Vertical scaling (scale up/down) changes instance size (CPU/RAM). Azure Autoscale and VM Scale Sets enable horizontal; resizing a VM enables vertical.

Q: Which Azure database service is designed for globally distributed, multi-model NoSQL workloads with multi-region writes?
A: Azure Cosmos DB is a globally distributed NoSQL service offering turnkey global distribution with multi-master writes, consistency models, and sub-10 ms latency for key-value, document, column-family, and graph APIs.

Q: What is Azure SQL Managed Instance and how does it differ from Azure SQL Database?
A: Azure SQL Managed Instance offers near-100% compatibility with on-premises SQL Server, including features like cross-database queries, SQL Agent, and CLR. Azure SQL Database is a lighter PaaS offering for new cloud-native applications.

Q: What is the purpose of Azure Update Manager?
A: Azure Update Manager centralizes assessment and patching of Windows and Linux VMs across Azure, on-premises, and multicloud environments, replacing the legacy Update Management in Automation.

Q: Which Azure networking feature lets you filter traffic between subnets within a VNet?
A: Network Security Groups (NSGs) contain security rules with priority, source, destination, port, and protocol. NSGs attached to subnets or NICs allow or deny traffic, providing stateful filtering inside a VNet.

Q: What is Azure Private Endpoint and what does it provide?
A: A Private Endpoint brings Azure PaaS services (Storage, SQL, Cosmos DB, etc.) into your VNet via a private IP, so traffic stays on the Microsoft backbone and is not exposed publicly. It enhances data exfiltration protection.

Q: What is Azure Lighthouse used for in a multi-tenant scenario?
A: Azure Lighthouse enables service providers to manage customer tenants at scale using delegated admin access, ARM templates, and cross-tenant monitoring. Customers retain visibility and control via Azure delegated resource management.

Q: Which Azure service provides a managed Apache Spark and Hadoop analytics cluster?
A: Azure HDInsight offers managed clusters for Hadoop, Spark, Kafka, HBase, and more. You deploy clusters on demand, integrate with Azure storage, and choose open-source frameworks for big data analytics.

Q: What is Azure Synapse Analytics?
A: Azure Synapse Analytics combines enterprise data warehousing, Spark pool data lake analytics, and data integration pipelines in a single service, enabling querying across relational and big data workloads with serverless or dedicated options.

Q: Which Azure role-based access control role allows a user to create and manage all resource types but cannot grant access to others?
A: The built-in Contributor role permits creating and managing all Azure resources but does not allow granting access via RBAC. Owner additionally can grant access to other principals within the scope.

Q: What is the Azure SLA for Azure Active Directory Free?
A: Microsoft Entra ID Free (Azure AD Free) provides a 99.9% SLA. Premium P1/P2 offer 99.99% SLA for identity services, and specific workloads like Azure SQL or VMs have different SLA percentages.

Q: What is Azure Reservations and how do they differ from Savings Plans?
A: Reservations are commitments (1 or 3 years) for specific VM SKUs, regions, and other resources, offering up to ~72% discount. Savings Plans are flexible commitments for compute spend across regions/VMs, with up to ~65% discount.

Q: What is Azure Cost Management + Billing used for?
A: Cost Management + Billing provides cost analysis, budgets, alerts, and recommendations for Azure spend. It helps organizations monitor usage, forecast costs, enforce budgets, and export data for chargeback or showback reporting.

Q: What is the purpose of Azure Landing Zones?
A: Landing Zones are pre-architected environments that combine subscription design, networking, identity, governance, and operations to host workloads in a scalable, secure, and compliant manner as part of the Cloud Adoption Framework.

Q: What Azure construct is a logical container used to group related resources for management and billing purposes?
A: An Azure resource group. It holds resources like VMs, storage accounts, and databases that share a common lifecycle, permissions, and policies, and it can contain resources deployed across multiple Azure regions.

Q: What is the maximum size of an Azure managed disk (Premium SSD) as of current platform limits?
A: Azure Premium SSD managed disks currently support a maximum size of 64 TiB (65,536 GiB) per disk, available through the P50 and larger disk SKUs.

Q: Which Azure service provides a managed NoSQL key-value and document store optimized for low-latency reads and writes?
A: Azure Cosmos DB. It offers globally distributed, multi-model APIs (SQL, MongoDB, Cassandra, Gremlin, Table) with single-digit-millisecond latency and tunable consistency levels.

Q: What is Azure Virtual WAN?
A: Azure Virtual WAN is a networking service that provides optimized, automated branch-to-branch connectivity through Azure. It hubs together VPN, ExpressRoute, and point-to-site user VPN connections with routing managed by Microsoft.

Q: What is the purpose of Azure Dedicated Host?
A: Azure Dedicated Host provides physical servers dedicated to a single customer's workloads, giving control over maintenance windows, VM placement, and compliance, while also enabling use of existing on-premises Windows Server or SQL Server licenses through Azure Hybrid Benefit.

Q: Which Azure service provides a managed relational database with built-in high availability and automatic patching?
A: Azure SQL Database is the fully managed PaaS relational database with built-in HA, automatic backups, point-in-time restore, and automatic patching. Alternatives include Azure Database for PostgreSQL, MySQL, and MariaDB flexible servers.

Q: What is the highest SLA percentage Microsoft publishes for a single Azure Virtual Machine?
A: Microsoft publishes a 99.99% SLA for single-instance VMs using Premium SSD or Ultra Disk. Standard HDDs/SSDs only provide a 99.5% single-instance VM SLA when deployed using Availability Zones.

Q: Which Azure storage tier is most cost-effective for rarely accessed data stored for at least 180 days?
A: The Archive tier offers the lowest storage cost for data accessed rarely and stored for at least 180 days. It has higher retrieval latency and costs compared to Cool and Cold tiers, and read/write operations cost more.

Q: Which Azure networking component provides stateful packet filtering at the network level using rules?
A: Azure Network Security Group (NSG). It contains inbound and outbound security rules based on 5-tuple (source/destination IP, port, protocol) and can be associated with subnets or individual VM NICs.

Q: Which resource lock level prevents resources from being deleted but still allows updates?
A: The CanNotDelete (Read-only for delete) lock. Only owners and users with explicit lock-authorization can delete the resource, but ordinary RBAC-permitted update operations still work.

Q: Which Azure service enables centralized log collection across Azure, on-premises, and other cloud resources?
A: Azure Monitor Logs (Log Analytics workspace). It ingests data from Azure resources, agents, and connectors, and supports KQL queries, alerts, workbooks, and dashboards, often paired with Microsoft Sentinel for security analytics.

Q: Which Azure service provides serverless event-driven messaging with at-least-once delivery and advanced features?
A: Azure Service Bus (topics/subscriptions, AMQP 1.0) and Azure Event Grid (event routing with publish/subscribe and filtering). Service Bus offers FIFO, transactions, and sessions; Event Grid offers near real-time event distribution with retry and dead-lettering.

Q: Which Azure database service is designed for globally distributed, multi-model NoSQL workloads?
A: Azure Cosmos DB. It supports SQL API, MongoDB, Cassandra, Gremlin (graph), and Table APIs, with automatic multi-region writes/replication, five consistency levels, and guaranteed single-digit-ms latency at the 99th percentile.

Q: What is an Azure region pair?
A: Two Azure regions within the same geography (e.g., East US and West US) that Microsoft pairs for datacenter redundancy and disaster recovery. Services like geo-redundant storage use these pairs by default for cross-region replication.

Q: What is the purpose of Azure Proximity Placement Groups (PPG)?
A: PPGs co-locate Azure VMs, VM scale sets, and dedicated hosts within a single Azure region to minimize latency between them. They are ideal for low-latency workloads like HPC, gaming, or clustered databases.

Q: Which Azure service lets you build, train, and deploy machine learning models without managing infrastructure?
A: Azure Machine Learning is a cloud-based platform that provides tools for data preparation, model training (automated ML or designer), deployment as endpoints, and MLOps. It supports Python SDKs, ML Studio UI, and integration with MLflow.

Q: What is Azure Container Instances (ACI)?
A: ACI is a serverless offering that lets you run containers on-demand without provisioning virtual machines or orchestrators like Kubernetes. You simply upload a container image and specify CPU/memory; ideal for burst workloads, dev/test, or simple microservices.

Q: What are Azure Spot Virtual Machines?
A: Spot VMs use Azure's spare compute capacity at deep discounts (up to 90% off pay-as-you-go), but Microsoft can evict them with 30 seconds' notice when capacity is needed. Suitable for fault-tolerant workloads like batch processing, dev/test, or rendering.

Q: Which Azure storage service is optimized for semi-structured NoSQL data such as JSON documents?
A: Azure Cosmos DB is the recommended globally distributed, multi-model NoSQL database. It offers single-digit millisecond latency, automatic scaling, and supports SQL API, MongoDB, Cassandra, Gremlin, and Table APIs with multi-region writes.

Q: What is Azure Files and what protocol does it primarily use?
A: Azure Files provides fully managed SMB and NFS file shares in the cloud. It enables lift-and-shift of applications relying on file shares and supports hybrid scenarios via Azure File Sync for on-premises caching of cloud-resident files.

Q: What is the difference between Hot and Cool access tiers for Azure Blob Storage?
A: Hot tier has higher storage cost but lower access cost, optimized for frequent read/write. Cool tier has lower storage cost but higher access and longer retrieval latency (minutes), for data accessed less than once per month and stored at least 30 days.

Q: What is Azure Archive Storage tier best suited for?
A: Archive tier offers the lowest storage cost but highest access cost and several hours of retrieval latency. It is for rarely accessed data (less than once per year) that must be retained long-term, such as compliance backups, with flexible rehydration options.

Q: What is Azure Private Link?
A: Private Link provides private connectivity from a virtual network to Azure platform-as-a-service services (like Storage, SQL, Cosmos DB) over a private endpoint using a private IP. It eliminates public internet exposure and integrates with on-premises via ExpressRoute or VPN.

Q: What is a Network Security Group (NSG) in Azure?
A: An NSG contains security rules that allow or deny inbound or outbound network traffic to network interfaces, VMs, or subnets based on 5-tuple (source/destination IP, port, protocol). Rules are evaluated by priority and can use service tags or application security groups.

Q: What is the purpose of an Azure Application Gateway?
A: Application Gateway is a layer-7 load balancer providing HTTP/HTTPS routing, TLS termination, session affinity, cookie-based session persistence, URL-based routing, and Web Application Firewall (WAF). It operates at the application level for web traffic.

Q: What is Azure VPN Gateway?
A: VPN Gateway is a virtual network gateway that sends encrypted traffic across the public internet between Azure VNets and on-premises locations using IPsec/IKE protocols. It supports site-to-site, point-to-site (P2S), and VNet-to-VNet connections with active-active or active-passive modes.

Q: What is Azure Load Balancer and at which OSI layer does it operate?
A: Azure Load Balancer is a layer-4 (TCP/UDP) load balancer that distributes incoming traffic across healthy backend VMs using hash-based distribution. It supports both public (internet-facing) and internal (private) frontends with health probes.

Q: What is the difference between authentication and authorization in Microsoft Entra ID?
A: Authentication verifies identity (who a user/service is) using credentials, MFA, or certificates. Authorization determines what an authenticated identity is permitted to do, enforced via RBAC role assignments or conditional access policies within Entra ID.

Q: What is Multi-Factor Authentication (MFA) in Microsoft Entra ID?
A: MFA requires two or more verification methods (something you know/have/are), such as password plus phone authenticator, hardware token, or biometric. Entra ID supports time-based one-time passwords (TOTP), Microsoft Authenticator push notifications, and FIDO2 keys.

Q: What is Microsoft Entra ID Protection?
A: Entra ID Protection is a security service that uses machine learning to detect risky sign-ins and compromised identities, assigns risk levels (low/medium/high), and can enforce conditional access policies to block or require password change/MFA for risky events.

Q: What is Azure DDoS Protection and its two tiers?
A: DDoS Protection defends Azure resources from volumetric and protocol DDoS attacks. Basic tier is automatically enabled free for all Azure services. Standard tier (paid) adds always-on traffic monitoring, adaptive tuning, mitigation analytics, and cost protection credits.

Q: What is Azure Defender (now Microsoft Defender for Cloud)?
A: Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP). It provides vulnerability assessments, security recommendations, compliance score against standards, and threat protection for VMs, SQL, Storage, and Kubernetes.

Q: What is Azure Information Protection (AIP)?
A: AIP (part of Microsoft Purview) classifies, labels, and protects documents and emails based on sensitivity. Labels can enforce encryption, watermarks, access restrictions, and visual markings across Office apps, with persistent protection regardless of location.

Q: What is Azure Cost Management + Billing?
A: A suite of tools for monitoring, allocating, and optimizing Azure spending. It provides cost analysis dashboards, budgets with email alerts, cost alerts, exports to CSV, and recommendations through Azure Advisor for reserved instances and rightsizing.

Q: What are Azure Reserved Instances (RIs)?
A: RIs are 1- or 3-year commitments for specific VM SKUs or Azure services in exchange for up to 72% discount versus pay-as-you-go. They can be scoped to a single subscription or shared across a billing group, with exchange and refund flexibility.

Q: What is the Azure Savings Plan for Compute?
A: A flexible 1- or 3-year commitment providing up to 65% discount on compute services (VMs, App Service, Container Instances, Functions premium plan) across any region or VM family. It auto-applies to eligible usage without requiring instance-size selection like RIs.

Q: What is the difference between Capital Expenditure (CapEx) and Operational Expenditure (OpEx) in cloud economics?
A: CapEx involves upfront spending on physical infrastructure depreciated over time. OpEx is ongoing consumption-based spending. Cloud computing converts CapEx to OpEx, providing scalability, eliminating hardware maintenance, and aligning costs with actual business usage.

Q: What is an Azure subscription?
A: A subscription is a logical unit of Azure services linked to an Azure account that defines billing boundaries, resource quotas, and access control. It enables management of resources, cost tracking, and policy enforcement, with multiple subscriptions per tenant possible.

Q: What is an Azure Management Group?
A: Management groups are containers that organize multiple subscriptions for unified governance. They support hierarchical policy and RBAC inheritance (up to 6 levels deep), enabling enterprise-wide compliance, cost reporting, and access control across many subscriptions.

Q: What are Azure tags and what are their limitations?
A: Tags are name/value pairs applied to resources for categorization (e.g., Environment:Production, CostCenter:1234). They appear on invoices for cost allocation, but are not inherited, cannot be used for access control, and are limited to 50 tags per resource with limited character set.

Q: What is Azure Blueprints (deprecated) and what replaced it?
A: Blueprints were used to orchestrate deployment of resource groups, policies, RBAC, and ARM templates as a repeatable package. Microsoft has replaced it with landing zone accelerators and recommends using Azure Deployments (Deployment Stacks) with ARM templates and policies.

Q: What is the purpose of Azure Log Analytics?
A: Log Analytics is a tool within Azure Monitor that collects, correlates, and queries log/telemetry data from Azure resources, on-premises machines, and agents using the powerful Kusto Query Language (KQL) for diagnostics, performance analysis, and custom alerts.

Q: What is Azure Application Insights?
A: Application Insights is an APM (Application Performance Monitoring) service that provides distributed tracing, performance counters, failure rates, dependency tracking, and usage analytics for web apps and services. It integrates with Application Performance Index (Apdex) scoring.

Q: What is Azure Service Health?
A: Service Health is a personalized dashboard showing Azure service incidents, planned maintenance, and health advisories affecting your subscriptions. It also includes Resource Health for individual resource status and an Action Groups integration for proactive notifications.

Q: What is the Azure SLA for Azure Active Directory Free tier?
A: Microsoft Entra ID Free tier provides 99.9% uptime SLA for authentication services, while Premium P1/P2 offers 99.99% SLA with advanced features. SLA credits are issued via the Azure portal when SLA is missed, based on monthly availability percentage.

Q: What is Azure Virtual Network (VNet) peering?
A: VNet peering connects two VNets (same or cross-region) using Microsoft's backbone infrastructure for low-latency, high-bandwidth private connectivity. Peered VNets appear as one for routing, support transitive gateway transit, and do not require public internet or encryption.

Q: What is Azure User Defined Routes (UDR)?
A: UDRs are custom route tables that override Azure's default system routes. They allow you to direct traffic through Network Virtual Appliances (NVAs), force tunnels, or block specific paths, applied at subnet level to control traffic flow within and outside a VNet.

Q: What is Azure Functions and what languages does it support?
A: Azure Functions is a serverless FaaS platform that runs event-driven code without managing infrastructure. It supports C#, JavaScript/TypeScript, Python, Java, PowerShell, and custom handlers, with triggers (HTTP, Timer, Queue, Blob, Event Grid) and bindings for integration.

Q: What are Azure Durable Functions?
A: Durable Functions is an extension of Azure Functions that enables stateful, long-running orchestrations using function chaining, fan-out/fan-in patterns, and async HTTP APIs. State is persisted in Azure Storage, allowing workflows that survive restarts and scale seamlessly.

Q: What is Azure API Management (APIM)?
A: APIM is a managed gateway for publishing, securing, transforming, and analyzing APIs. It provides developer portals, policy expressions for rewriting/injecting headers, rate limiting, OAuth/JWT validation, and analytics for backend APIs hosted anywhere.

Q: What is Azure Event Grid?
A: Event Grid is a serverless event routing service using a publish-subscribe model with built-in retry, dead-lettering, and at-least-once delivery. It connects Azure resources and custom topics to handlers like Functions, Logic Apps, Webhooks, or Service Bus.

Q: What is Azure Service Bus and how does it differ from Storage Queues?
A: Service Bus is a fully managed enterprise message broker supporting queues (point-to-point) and topics/subscriptions (pub-sub), with features like sessions, dead-lettering, transactions, and FIFO ordering. Storage Queues are simpler, REST-based, larger messages (up to 64KB) and lower cost.

Q: What is Azure Data Lake Storage (ADLS) Gen2?
A: ADLS Gen2 is built on top of Azure Blob Storage, providing hierarchical namespace, POSIX-compliant ACLs, and optimized performance for big data analytics workloads using Hadoop, Spark, and Data Lake Analytics. It combines cost-effective tiered storage with file-system semantics.

Q: What Azure component allows you to group multiple VMs in the same region across different fault domains to improve availability?
A: An Azure Availability Set groups two or more VMs across separate Update Domains and Fault Domains within a single datacenter region. Update domains allow staggered reboots, while fault domains provide separate power, network, and cooling, ensuring at least one VM stays available during planned or unplanned maintenance events.

Q: What is the difference between Azure paired regions and Azure geo-redundant storage?
A: Paired regions are two Azure regions within the same geography that Microsoft replicates certain platform services between (like Azure AD, Geo-Redundant Storage uses three copies within the primary region and asynchronously replicates to a paired secondary region hundreds of miles away. Paired regions also enable DR orchestration.

Q: Which Azure compute service lets you run event-driven code without provisioning or managing servers and supports multiple programming languages?
A: Azure Functions is a serverless compute service that runs code in response to triggers such as HTTP requests, queue messages, or timers. It supports languages including C#, JavaScript, Python, Java, and PowerShell, and you pay only for execution time measured in gigabyte-seconds.

Q: What is Azure Virtual Desktop (AVD) and what primary benefit does it provide?
A: Azure Virtual Desktop is a cloud-based virtual desktop infrastructure (VDI) service that delivers Windows desktops and applications to users from Azure. Benefits include multi-session Windows 10/11, reduced licensing costs via Microsoft 365, simplified management, and global access through any modern device.

Q: Which Azure storage service is optimized for massive amounts of semi-structured or unstructured NoSQL data such as IoT telemetry or game telemetry?
A: Azure Cosmos DB is optimized for globally distributed, multi-model NoSQL data with millisecond latency, automatic scaling, and turnkey global distribution across Azure regions. It offers multiple APIs including SQL, MongoDB, Cassandra, Gremlin, and Table for flexible data modeling.

Q: What is the purpose of Azure Files and which protocol does it use for mounting?
A: Azure Files offers fully managed file shares in the cloud accessible via the Server Message Block (SMB) protocol or Network File System (NFS). It enables lift-and-shift scenarios by replacing or supplementing on-premises file servers with cloud-based shares accessible from Windows, Linux, and macOS clients.

Q: What is Azure Queue Storage used for, and what is the maximum size of a single queue message?
A: Azure Queue Storage is a messaging service for storing large numbers of messages that can be accessed from anywhere via authenticated HTTP or HTTPS calls. The maximum size of a single queue message is 64 KB, and a queue can contain millions of messages up to the storage account capacity limit.

Q: What Azure networking component allows inbound and outbound traffic rules for network traffic at the subnet level?
A: Azure Network Security Groups (NSGs) contain security rules that filter network traffic flowing in and out of network interfaces and subnets. Rules use five-tuple parameters (source, source port, destination, destination port, protocol) and can be configured with default or custom priorities.

Q: What is the purpose of an Azure Private Endpoint?
A: An Azure Private Endpoint is a network interface that connects you privately and securely to a service powered by Azure Private Link. It uses a private IP address from your VNet, effectively bringing the service into your VNet and eliminating exposure over the public internet.

Q: What is Azure Virtual Network (VNet) peering and what does it enable?
A: Azure VNet peering connects two Azure virtual networks seamlessly, treating them as one network for connectivity purposes. Traffic between peered networks uses Microsoft's private backbone infrastructure, supporting low-latency, high-bandwidth communication without gateways, encryption, or public internet traversal.

Q: Which Azure service provides a managed, cloud-native firewall with built-in high availability and unrestricted scalability?
A: Azure Firewall is a managed, cloud-based network security service that protects Azure Virtual Network resources. It offers built-in high availability, auto-scaling, application and network-level filtering, threat intelligence-based filtering, and integrates with Azure Monitor for logging and analytics.

Q: What is the purpose of Azure DDoS Protection, and what are its two tiers?
A: Azure DDoS Protection safeguards Azure resources from Distributed Denial-of-Service attacks by monitoring traffic at the network layer and mitigating attacks in real time. Two tiers are available: DDoS Protection Basic (free, automatic) and DDoS Protection Standard (paid, with additional mitigation capabilities and telemetry).

Q: What does Microsoft Entra ID (formerly Azure Active Directory) use to enable single sign-on (SSO) across SaaS applications?
A: Microsoft Entra ID uses industry-standard protocols including SAML 2.0, OpenID Connect, and OAuth 2.0 to enable single sign-on across thousands of pre-integrated SaaS applications. It centrally manages user identities and access, reducing password fatigue and improving security posture across cloud and on-premises environments.

Q: What is the purpose of Microsoft Entra Multifactor Authentication (MFA)?
A: Microsoft Entra MFA requires users to provide two or more verification methods—such as something they know (password), something they have (phone), or something they are (biometric)—to gain access. It significantly reduces the risk of compromised credentials by adding layers of protection beyond just a password.

Q: What is Azure Privileged Identity Management (PIM)?
A: Azure PIM is a service that enables just-in-time (JIT) privileged access to Azure resources and Entra ID. Users can activate privileged roles only when needed for a limited time, reducing standing administrative access and providing detailed audit logs for compliance and security review purposes.

Q: What is Microsoft Defender for Cloud and what does it provide?
A: Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP). It provides continuous assessment of Azure, on-premises, and multicloud resources, security recommendations, vulnerability scanning, and advanced threat protection for servers, containers, storage, and SQL.

Q: What is the purpose of Azure Information Protection (AIP)?
A: Azure Information Protection (now part of Microsoft Purview Information Protection) helps organizations classify, label, and protect documents and emails based on sensitivity. It applies persistent protection regardless of where data travels, including encryption, access restrictions, and visual markings like headers and footers.

Q: What is the Azure Enterprise Agreement (EA) and who typically uses it?
A: The Azure Enterprise Agreement is a purchasing option designed for large organizations with significant Azure spending. It offers customized pricing, flexibility to use Azure services across multiple departments, access to EA Portal for reporting and management, and committed spend discounts based on annual monetary commitments.

Q: What is the Azure Free Account and what does it include?
A: The Azure Free Account provides new customers $200 in Azure credit for 30 days plus 12 months of select free services (such as 750 hours of B1S Linux VM per month, 5 GB Blob storage, and 250 GB SQL Database) and always-free services including Azure Kubernetes Service and Azure Functions with monthly quotas.

Q: What is the difference between Azure reserved instances and savings plans?
A: Azure Reservations require commitment to specific VM size and region for 1 or 3 years, offering up to 72% discount. Savings Plans are more flexible, committing to hourly spend across regions and VM families for 1 or 3 years, offering up to 65% discount while allowing flexibility in resource selection.

Q: What is Azure Spot Virtual Machines and what is its main tradeoff?
A: Azure Spot VMs use unused Azure compute capacity at deep discounts (up to 90% off pay-as-you-go prices). The tradeoff is that Azure may reclaim these VMs with as little as 30 seconds notice when capacity is needed elsewhere, making them suitable only for fault-tolerant, interruptible workloads like batch processing.

Q: What is Azure Cost Management + Billing and what does it help you do?
A: Azure Cost Management + Billing helps organizations monitor, allocate, and optimize Azure spending. It provides cost analysis, budgets, alerts, and recommendations. Free for Azure customers, it offers usage data via APIs, exports, and dashboards, enabling FinOps practices and chargeback/showback across teams and projects.

Q: What is Azure Resource Graph and what is it used for?
A: Azure Resource Graph is a query service optimized for exploring Azure resources at scale across subscriptions. It uses Kusto Query Language (KQL) to retrieve information about resource configuration, changes, and relationships quickly—ideal for governance, compliance auditing, and identifying misconfigurations across large environments.

Q: What is the purpose of Azure Resource Mover?
A: Azure Resource Mover is a service that simplifies the process of moving Azure resources between Azure regions (cross-region move) or between availability zones. It handles dependencies, coordinates the move, and provides a single pane of glass for orchestrating complex resource migrations with minimal downtime.

Q: What is Azure Arc and what does it extend to on-premises and multicloud environments?
A: Azure Arc extends Azure management and services to any infrastructure including on-premises servers, edge devices, and other clouds (AWS, Google Cloud). It enables consistent management, governance, and security across environments using Azure Resource Manager, Azure Policy, Azure Monitor, and supports running Azure data services anywhere.

Q: What is Azure VMware Solution (AVS)?
A: Azure VMware Solution delivers VMware vSphere-based private clouds in Azure, allowing customers to run VMware workloads natively on Azure infrastructure. It provides seamless migration of VMware environments, preserves existing tooling, and integrates with Azure networking, storage, and identity services for hybrid scenarios.

Q: What are Azure VM scale sets and how do they support autoscaling?
A: Azure Virtual Machine Scale Sets are groups of identical, load-balanced VMs that can automatically increase or decrease in count based on demand or schedule. They integrate with Azure Autoscale to add or remove instances based on metrics like CPU usage or queue length, enabling elastic compute for applications.

Q: What is Azure Container Instances (ACI) and when is it most useful?
A: Azure Container Instances is a serverless container service offering fast, isolated containers without managing underlying VMs. It's ideal for short-lived or burst workloads, event-driven processing, simple deployments, and scenarios where you want container execution without the orchestration overhead of Kubernetes clusters.

Q: What is the purpose of Azure Container Registry (ACR)?
A: Azure Container Registry is a managed, private Docker registry service for storing and managing container images and artifacts. It integrates with AKS, ACI, and App Service, supports geo-replication, webhooks, image scanning via Microsoft Defender, and provides private network access via Private Link for secure deployments.

Q: What is the difference between Azure SQL Database, Azure SQL Managed Instance, and SQL Server on Azure VMs?
A: Azure SQL Database is fully managed PaaS for new cloud-native apps. Azure SQL Managed Instance offers near-100% SQL Server compatibility for lift-and-shift migrations. SQL Server on Azure VMs is IaaS giving full OS-level control for legacy applications needing specific SQL Server features or custom configurations.

Q: What is Azure Data Factory (ADF)?
A: Azure Data Factory is a fully managed, serverless data integration service for orchestrating and automating data movement and transformation at scale. It supports 90+ built-in connectors, visual ETL authoring, SSIS package execution, and hybrid data flows between on-premises and cloud sources and sinks.

Q: What is Azure Event Grid used for?
A: Azure Event Grid is a fully managed event routing service that uses a publish-subscribe model to deliver events reliably between applications and services. It supports millions of events per second, integrates with Azure services like Functions and Logic Apps, and enables reactive programming with near real-time event delivery.

Q: What is Azure Logic Apps used for?
A: Azure Logic Apps is a serverless workflow automation service that connects apps, data, services, and systems with low-code/no-code visual designers. It offers 400+ built-in connectors, enterprise integration capabilities, and is ideal for orchestrating business processes, EAI scenarios, and integrating SaaS platforms without writing code.

Q: What is Azure DevOps and what services does it include?
A: Azure DevOps is a set of development tools supporting the entire DevOps lifecycle. It includes Azure Boards (work tracking), Azure Repos (Git repositories), Azure Pipelines (CI/CD), Azure Test Plans (testing), and Azure Artifacts (package management). It integrates with GitHub and supports any language or platform.

Q: What is Azure Load Balancer and what types of traffic does it distribute?
A: Azure Load Balancer is a high-performance, low-latency Layer-4 load balancer that distributes inbound and outbound TCP/UDP traffic across healthy service instances. It supports both public load balancing (internet-facing) and internal load balancing (private VNet), and provides high availability for applications.

Q: What is Azure Application Gateway and what features does it provide?
A: Azure Application Gateway is a Layer-7 web traffic load balancer with TLS termination, URL-based routing, cookie-based session affinity, and Web Application Firewall (WAF). It's designed for web applications requiring advanced routing decisions based on HTTP attributes and provides centralized SSL management at the gateway.

Q: What is Azure Virtual WAN and what does it consolidate?
A: Azure Virtual WAN is a networking service that brings together networking, security, and routing functions into a unified operation. It consolidates branch, user, and Internet connectivity across Azure regions and consolidates site-to-site VPN, ExpressRoute, point-to-site VPN, and intra-cloud transit through hubs.

Q: What is Azure DNS and what does it offer?
A: Azure DNS is a hosting service for DNS domains that uses Azure's global infrastructure to provide fast, reliable DNS resolution. It supports both public DNS zones for internet-facing resources and private DNS zones for internal VNet name resolution, integrated with Azure RBAC and management tools for seamless administration.

Q: What is the purpose of Azure proximity placement groups?
A: Proximity placement groups colocate Azure resources to ensure low-latency communication between them by keeping VMs and related services physically near each other within a data center.

Q: Which Azure compute service is best for running batch jobs or parallel high-performance computing workloads?
A: Azure Batch is the ideal service for running large-scale parallel and high-performance computing batch jobs efficiently across a managed pool of virtual machines.

Q: What is Azure Container Instances (ACI) best suited for?
A: ACI is best suited for running isolated containers quickly without managing servers, ideal for simple applications, task automation, and burst workloads with per-second billing.

Q: What is the difference between Azure Files and Azure Blob Storage?
A: Azure Files provides fully managed SMB and NFS file shares for cloud or on-premises access, while Blob Storage offers object storage optimized for massive amounts of unstructured data.

Q: What is the access tier called for Azure Blob Storage that has the lowest storage cost but highest retrieval cost?
A: The Archive tier offers the lowest storage cost for Azure Blob Storage but has the highest retrieval cost and latency because data is stored offline.

Q: What is Azure Queue Storage used for?
A: Azure Queue Storage is used for storing large numbers of messages that can be accessed asynchronously by applications, enabling reliable message passing between application components.

Q: What is the difference between Azure Table Storage and Azure Cosmos DB?
A: Azure Table Storage offers simple NoSQL key-value storage with limited features, while Cosmos DB provides globally distributed, multi-model NoSQL with guaranteed low latency and comprehensive SLAs.

Q: What does Azure ExpressRoute provide compared to a typical VPN connection?
A: ExpressRoute provides a private, dedicated network connection between on-premises infrastructure and Azure datacenters, offering more reliability, faster speeds, lower latency, and higher security than internet-based VPNs.

Q: What is an Azure Network Security Group (NSG) used for?
A: An NSG contains security rules that filter network traffic to and from Azure resources by IP address, port, and protocol, providing stateful packet filtering at the network level.

Q: What is the purpose of Azure Application Gateway?
A: Azure Application Gateway is a web traffic load balancer with OSI Layer 7 features including URL-based routing, SSL termination, cookie-based session affinity, and a Web Application Firewall (WAF).

Q: What does Azure Load Balancer operate at in the OSI model?
A: Azure Load Balancer operates at OSI Layer 4 (Transport layer), distributing inbound and outbound traffic among healthy backend instances based on IP address and port.

Q: What is Microsoft Entra ID's authentication protocol that supports passwordless sign-in?
A: Microsoft Entra ID supports passwordless authentication through protocols like FIDO2, Windows Hello for Business, and Microsoft Authenticator using standards such as WebAuthn.

Q: What is the purpose of Microsoft Entra ID Conditional Access?
A: Conditional Access enforces organization-wide policies that evaluate signals like user, location, device, and risk to automate access decisions and enforce security requirements such as MFA.

Q: What is Azure role-based access control (RBAC) built on?
A: Azure RBAC is built on Azure Resource Manager and provides fine-grained access management for Azure resources using role definitions, assignments, and scopes.

Q: What is the purpose of Microsoft Entra Privileged Identity Management (PIM)?
A: PIM provides just-in-time privileged access, requiring approval and providing time-bound elevation for privileged Entra ID roles to reduce standing administrative access risks.

Q: What is Microsoft Defender for Cloud used for?
A: Microsoft Defender for Cloud provides unified security management and advanced threat protection across Azure, hybrid, and multicloud environments, with security posture management and workload protection.

Q: What does Azure DDoS Protection offer beyond the basic DDoS protection?
A: Azure DDoS Protection Standard offers enhanced mitigation, real-time metrics, alerting, cost protection guarantees, and SLAs beyond the basic always-on protection included for free.

Q: What is Azure Bastion and what problem does it solve?
A: Azure Bastion is a fully managed PaaS service that provides secure RDP/SSH connectivity to VMs directly through the Azure portal over SSL, eliminating the need for public IP addresses.

Q: What is the purpose of Azure Service Trust Portal?
A: The Service Trust Portal provides access to Microsoft compliance documentation, including audit reports, certifications, and trust documents to help organizations meet regulatory requirements.

Q: What is Azure Cost Management and Billing?
A: Azure Cost Management and Billing helps monitor, allocate, and optimize cloud spending by providing cost analysis, budgets, alerts, and recommendations across subscriptions and resource groups.

Q: What is the difference between Azure Reservations and Savings Plans?
A: Azure Reservations offer discounts on specific VM SKUs, databases, and other services for 1- or 3-year terms, while Savings Plans offer flexible discounts across compute services in exchange for commit spending.

Q: What is the Azure Spot VM pricing model?
A: Azure Spot VMs allow users to purchase unused Azure compute capacity at deep discounts, but Azure can evict those VMs at any time when capacity is needed for pay-as-you-go workloads.

Q: What does an Azure SLA guarantee when a service fails to meet its published availability target?
A: An Azure SLA typically offers service credits as financial compensation, allowing customers to claim credits toward their bill when monthly uptime falls below the committed SLA percentage.

Q: What is Azure Service Health used for?
A: Azure Service Health provides personalized alerts and guidance when Azure service issues affect your resources, including planned maintenance, health advisories, and security incidents.

Q: What is the Azure free account, and what does it include?
A: The Azure free account provides $200 credit for 30 days, free access to popular services for 12 months, and always-free services for over 55 Azure products without charging the customer.

Q: What is Azure Resource Mover used for?
A: Azure Resource Mover simplifies moving Azure resources between regions or availability zones by handling the discovery, dependency mapping, and orchestrated movement of selected resources.

Q: What is the purpose of Azure Resource Graph?
A: Azure Resource Graph provides efficient exploration of Azure resources at scale using Kusto query language, enabling rapid querying across subscriptions for inventory, compliance, and analysis.

Q: What is the purpose of Azure Blueprints?
A: Azure Blueprints enable teams to define a repeatable set of Azure resources, policies, role assignments, and ARM templates that can be consistently deployed across subscriptions for governance.

Q: What does the Azure Well-Architected Framework 'Reliability' pillar emphasize?
A: The Reliability pillar emphasizes designing workloads that can recover from failures and continue functioning, including availability, recoverability, scalability, and disaster recovery planning.

Q: What does the Azure Well-Architected Framework 'Security' pillar recommend?
A: The Security pillar recommends protecting applications and data from threats using confidentiality, integrity, and availability principles, including identity management, encryption, and threat protection.

Q: What does the Azure Well-Architected Framework 'Cost Optimization' pillar focus on?
A: Cost Optimization focuses on delivering business value at the lowest price point by understanding costs, optimizing resource usage, reducing waste, and using pricing models effectively.

Q: What does the Azure Well-Architected Framework 'Operational Excellence' pillar emphasize?
A: Operational Excellence emphasizes running workloads reliably through standardized processes, monitoring, automation, continuous improvement, and DevOps practices across the application lifecycle.

Q: What does the Azure Well-Architected Framework 'Performance Efficiency' pillar recommend?
A: Performance Efficiency recommends using scalable architectures, choosing appropriate resource types, monitoring performance, and adapting to changes in demand to meet user experience goals.

Q: What is Azure Chaos Studio used for?
A: Azure Chaos Studio is a managed service that helps measure application resilience by injecting controlled faults into resources to test system behavior under failure conditions.

Q: What is the difference between Azure Monitor metrics and logs?
A: Azure Monitor metrics are lightweight numerical time-series data suited for real-time alerting, while logs are rich, structured or unstructured event records better for analysis and correlation.

Q: What is Azure Functions used for?
A: Azure Functions is a serverless compute service that runs event-driven code in response to triggers without requiring infrastructure management, supporting multiple programming languages and bindings.