| Interpret an ARM template or Bicep file |
- Questions present a Bicep file and ask you to determine the outcome of deploying it — for example, whether a resource's name is derived from a parameter or is a literal string, whether two subnet declarations within a valid address space will both provision successfully, and whether deploying the same template multiple times will cause errors (Bicep deployments are idempotent).
- You need to read the file closely, distinguishing between hardcoded values and parameter-driven values, and understand the declarative nature of Bicep/ARM deployments.
- Questions test ARM templates that use copy loops with `copyIndex()` to create multiple resources — given a template with a count and a naming function, you need to determine the exact names and count of resources created, and understand that the resource location in the template applies to the created resources (not the deployment location).
|
| Modify an existing ARM template or Bicep file |
- Questions present a Bicep file and ask which property you must modify to meet a specific requirement — for example, changing the deployment target scope so that a resource deploys to a specific resource group rather than the default. You need to know the purpose of each top-level Bicep property and which one controls deployment targeting.
|
| Deploy resources by using an ARM template or Bicep file |
- Questions require you to complete ARM templates by identifying the correct function, property, or value for a given placeholder — scenarios include deploying multiple instances using iteration, joining a VM to an Active Directory domain using an extension, deploying Azure Bastion with its required subnet configuration, and specifying the correct ARM function in a dependsOn block or the correct storage profile property for a VM's OS image.
- Questions also test which tools or extensions to include in a VMSS ARM template to ensure software is installed on all VMs at deployment time — you need to know which VM extension enables declarative configuration management and which PowerShell cmdlet is used alongside it.
- Questions test where to locate the ARM template used for a specific past deployment — given a subscription with multiple resource groups and storage containers, you need to identify which blade or resource holds the deployment history and its associated template.
- Questions test which PowerShell cmdlet to use based on the deployment scope — deploying a subscription-level template (such as one that creates a resource group) requires a different cmdlet than deploying to an existing resource group, and you need to know which cmdlet corresponds to which scope.
- Questions test which deployment mode and parameter to specify when you need to deploy to a resource group while removing all pre-existing resources — you need to know the parameter that specifies the target resource group and the deployment mode that enforces a clean state.
- Questions present a PowerShell deployment command and ask you to complete both the cmdlet name and the parameter that identifies the deployment target — you need to know which cmdlet deploys from a template URI and which parameter name passes the resource group name, distinguishing it from parameters for management groups, subscriptions, or tags.
|
| Create a virtual machine |
- Questions test VM state prerequisites — given a deallocated VM and a task that requires the VM to be running (such as enabling an extension), you need to identify the correct first action. You need to know which VM operations require the VM to be in a running state versus which can be performed while the VM is stopped or deallocated.
- Questions test what settings can and cannot be changed when deploying a new VM from a saved ARM template — the resource group and administrator credentials can be configured at deployment time, but settings baked into the captured image (such as the operating system and VM size) cannot be changed during deployment from the template.
|
| Configure Azure Disk Encryption |
- Questions test which PowerShell cmdlet is used to enable disk encryption with a key encryption key, and which VMs in a given environment meet the prerequisites to be encrypted. You need to know what makes a VM eligible for encryption and how the key encryption key fits into the process.
- Questions ask you to select the correct encryption method given a multi-part requirement — for example, needing to store the encryption key in a Key Vault, maintain encryption if the VM is moved or downloaded from Azure, and encrypt both OS and data disks. You need to know how Azure Disk Encryption, customer-managed keys, encryption at host, and confidential disk encryption differ in what they protect and where the key is held.
|
| Move a virtual machine to another resource group, subscription, or region |
- When notified that a VM will be affected by planned maintenance, questions test whether you know the correct action to immediately move it to a different host — you need to distinguish between actions that actually change the underlying host and those that simply relocate the resource within Azure's management structure.
- Questions also test which associated resources must be moved with a VM when moving it to a different subscription — not all dependent resources can or must be moved, and some resource types (such as virtual networks) cannot be moved cross-subscription.
|
| Manage virtual machine sizes |
- Questions test what you must do before resizing a VM when the target size is not available — you need to know the required preparation step and why it is necessary.
- Questions also test which VM configuration changes require downtime — given a list of planned changes, you need to identify which specific action will cause the VM to restart or be deallocated, as opposed to changes that can be applied without interruption.
- Questions test how to automate scheduled VM right-sizing — given a scenario where CPU peaks at predictable times and scale sets are not viable, you need to identify which runbook task achieves the resize and distinguish it from other options like adding agents, increasing quotas, or adding extensions.
|
| Manage virtual machine disks |
- Questions test how to select the right combination of disk type and host caching for a specific set of requirements — given constraints around performance tier, zone-level redundancy, and host-failure resilience, you need to identify which storage type (Premium vs Standard, LRS vs ZRS) and which caching mode meets all stated requirements. Understanding the trade-off between caching options and data durability is key.
|
| Deploy VMs to availability zones and availability sets |
- Questions present an ARM template or deployment configuration and ask you to determine what level of resilience is provided — whether the deployment protects against a single datacenter failure, a full regional outage, or neither.
- You need to understand how availability zones and availability sets differ in what they protect against, and how to read a deployment configuration to identify which protection model is in use.
- Questions test the distinction between update domains and fault domains in an availability set — fault domains protect against hardware failures, while update domains protect against planned maintenance. Given a requirement to ensure a minimum number of VMs remain running during planned maintenance, you need to calculate the correct number of update domains to configure.
- Questions present an ARM template for an availability set and ask you to complete the platformFaultDomainCount and platformUpdateDomainCount values — you need to know the valid range and maximum values for each, and which maximises resilience across the largest number of VMs.
- Questions present a real availability set configuration (shown as CLI output or portal exhibit) with specific fault and update domain counts, then add a number of VMs and ask how many can be unavailable during a hardware failure or planned maintenance event — you need to calculate the worst-case distribution of VMs across fault domains (hardware failure) or update domains (planned maintenance) to determine the maximum that could be affected simultaneously.
|
| Deploy and configure Azure Virtual Machine Scale Sets |
- Questions present a scale set autoscale configuration and ask you to calculate the resulting instance count at a specific point in time.
- Given a starting instance count, a CPU threshold, and a time window, you need to apply the scale-out or scale-in rules to determine how many instances will be running — testing your ability to read and reason through autoscale rule logic.
|
| Create and manage an Azure container registry |
- Questions test tier-based feature eligibility — you need to know which service tier is required to unlock specific capabilities such as ACR Tasks, private endpoints, and geo-replication, as well as which portal settings must be configured to enable advanced networking features like dedicated data endpoints.
- Questions also test which registry feature must be enabled to support pushing and pulling signed images — you need to know the specific setting that controls image signing and verification in the registry.
- Questions test the correct sequence of steps to push an image to a registry using the Azure CLI — after signing in, you need to know which action must be performed on the image before the push command can succeed.
- Questions test how the Admin user feature works when enabled on a registry — specifically what username is used to authenticate, which is the registry's own name (not a generic term like "admin" or "administrator").
|
| Provision a container by using Azure Container Instances |
- Questions test resource configuration within a container group, which Azure hosting services are valid for deploying a given container image, and which storage service to use when a container requires persistent storage.
- Questions test which container instances can be deployed together in a container group — you need to know the OS constraints that determine group eligibility.
- Questions also test which Azure container hosting services (Container Instances, Container Apps, App Service) support a given container image OS — Windows Server images are not supported by all three services, and you need to know which services accept which OS types.
- Questions test which container instances can have an Azure file share mounted to them — given containers in different regions and with different OS types, you need to know which combinations of region and OS are eligible for file share mounting.
- Questions present an ARM template for a container group and ask you to interpret configuration properties — for example, you need to know what the restartPolicy setting controls (whether the container restarts automatically on failure) and what the ipAddress type determines about internet accessibility.
- Questions test which container instance configuration to use when startup parameters must be passed securely — you need to know which mechanism delivers both configuration parameters and secure values at container startup, and distinguish it from other options like tags or customer-managed keys.
|
| Provision a container by using Azure Container Apps |
- Questions test how a containerised application accesses other Azure services securely. You need to know the correct identity mechanism to use when a container app needs to retrieve secrets from a Key Vault.
- Questions test the networking requirements for a Container Apps environment deployed into a custom VNet — you need to know the minimum subnet size required for the environment's dedicated subnet, and how to determine which existing VNets have sufficient remaining address space to accommodate a new subnet of that size.
|
| Manage sizing and scaling for containers |
- Questions test which Azure container hosting services support automatic scaling — you need to know which services (Container Apps, Container Instances, App Service) offer built-in autoscaling and which do not, and be able to identify the correct subset from a list of options.
|
| Provision an App Service plan |
- Questions test which existing App Service plans are valid hosts for a new web app — given a table of plans with different operating systems and regions, you need to identify which plans are compatible with the app's runtime stack and location. An App Service plan must match the web app's operating system (Windows vs Linux) and region, and certain runtime stacks are only available on specific OS types.
- Questions test what must be deployed before a set of web apps when cost minimisation is the priority — multiple web apps can share a single App Service plan, so deploying one plan for all apps is the minimum-cost prerequisite, rather than creating one plan per app.
- Questions present a list of web apps with different runtime stacks and ask for the minimum number of App Service plans — some runtime stacks (like ASP.NET V4.8) are only available on Windows plans, while others (like Python) are only available on Linux plans. You need to group apps by OS requirement to determine the minimum number of plans needed.
|
| Configure scaling for an App Service plan |
- Questions test which scale-out method to configure when automatic scaling based on a performance metric is required — you need to distinguish between available scale-out methods and know which one enables metric-driven autoscaling.
- Questions also test which App Service plan pricing tiers support specific features — given a table of plans with different tiers and operating systems, you need to identify which plans support rule-based scale-out and which support zone redundancy, as these features have different tier and OS eligibility requirements.
- Questions present an autoscale configuration with defined metric thresholds, minimum/maximum instance limits, and a cool-down period — given a sustained CPU condition, you need to calculate the resulting instance count, and know the minimum time that must elapse before a second scale-out event can occur after the first.
|
| Configure certificates and TLS for an App Service |
- Questions test which certificates stored in a Key Vault are valid for binding to a specific web app configuration. You need to know the certificate requirements for App Service TLS bindings and how to identify which certificates meet those requirements.
|
| Map an existing custom DNS name to an App Service |
- Questions test the sequence of steps required to map a custom domain to an Azure web app. You need to know which DNS record type and name to create first to verify domain ownership before the mapping can be completed.
- Questions present a multi-requirement scenario combining custom domain support, autoscale capability, and cost minimisation — you need to identify the lowest App Service plan tier that satisfies all stated requirements, and know which DNS record type is used to verify domain ownership for that configuration.
|
| Configure backup for an App Service |
- Questions test what you must create first before configuring an App Service backup, and how to exclude specific folders from the backup scope.
- You also need to know which storage account type is the correct target for an App Service backup when minimising cost — not all storage account kinds are valid targets for this feature.
- Questions test how to interpret a backup configuration table — given retention days set to zero with "keep at least one backup" enabled, you need to determine how many backups are kept at any point in time. Questions also test that backup configuration applies per slot, not per app, meaning test slots do not inherit the production slot's backup settings.
- Questions test whether a backup taken from one deployment slot can be restored to a different slot — you need to know whether cross-slot restore is permitted within the retention window.
|
| Configure networking settings for an App Service |
- Questions test how to enable a web app to access resources hosted on an Azure virtual network.
- Given a scenario where an App Service needs to reach a VM on a VNet, you need to identify the correct networking configuration, and distinguish it from other options like load balancers or VNet peering that would not solve this connectivity requirement.
- Questions test which Azure networking resource to deploy when a web app needs to connect to an on-premises SMB file share — you need to know which service bridges the web app to the on-premises network and distinguish it from options like Application Gateway or Entra Application Proxy.
- Questions present a scenario with multiple web apps using different networking integration methods (VNet integration vs App Service Environment) and ask whether each app can reach VMs on specific subnets or peered VNets — you need to know that VNet-integrated apps can reach resources on the integrated VNet and its peers, while an ASE-deployed app is deployed directly into the subnet and behaves differently. NSG rules on the subnet control inbound traffic to an ASE-deployed app but not to a VNet-integrated app using outbound integration.
|
| Configure deployment slots for an App Service |
- Questions test access control for App Service deployments — specifically which role to assign to developers so they can deploy content using their Entra credentials, while following least privilege.
- Questions test the prerequisites for creating deployment slots — if the slot option is unavailable, you need to know which App Service plan action resolves this, distinguishing between scale-up and scale-out operations.
- Questions also test the fastest way to revert an App Service to a previous version after a problematic slot swap — you need to know which action restores the previous state most quickly.
|
Flash sale is here! Get Extra 25% off on ALL COURSES! Use coupon code FLASH25. Ends today.
This website uses cookies for proper functioning. Learn More