Section 10 of 14
After hundreds of practice questions, patterns emerge. This section catalogs the recurring scenarios and the specific traps Microsoft sets. Recognizing the pattern is half the battle.
Train your brain to map specific keywords to specific answers:
| When the question says... | The answer usually involves... |
|---|---|
| Least privilege | RBAC with a more specific role - Reader over Contributor, Network Contributor over generic Contributor |
| Lowest cost / minimize cost | Spot VMs, Archive tier, Reserved Instances, LRS (not GRS) |
| Highest availability | Availability Zones (99.99%) - not Availability Sets (99.95%) |
| No public internet exposure | Private Endpoint (not Service Endpoint) |
| Avoid public internet for security | ExpressRoute (not site-to-site VPN) |
| Automatically scale | VMSS with autoscale - not resizing a single VM |
| Zero-downtime deployment | App Service Deployment Slots with swap |
| Restrict admin scope to a location/dept | Administrative Units (not just RBAC) |
| Automate config for a specific department | Dynamic Groups + Conditional Access |
| Replicate VMs to another region | Azure Site Recovery (ASR) |
| Replicate storage to another region | GRS or GZRS storage redundancy |
| Granular file recovery / accidental deletion | Azure Backup (not ASR) |
| Consistent repeatable deployment | ARM Templates or Bicep (IaC) |
| Store passwords/secrets | Azure Key Vault + access policy |
| Custom domain to App Service | Create a DNS record FIRST (CNAME for subdomain, A for apex) |
| Logically group VMs for NSG rules | Application Security Groups (ASGs) |
| Roll up billing by department | Resource Tagging (not Resource Groups) |
| Internal-facing LOB app | Internal Load Balancer (not Public) |
| Web app needing OWASP protection | Application Gateway with WAF or Front Door with WAF |
| Route based on URL path | Application Gateway path-based routing |
| Bulk add internal users | Bulk Create |
| Bulk add external/guest users | Bulk Invite |
| Software installed on VMSS instances | DSC extension or Custom Script Extension |
| Alert on Windows Event Log errors | Log Analytics workspace + agent + alert on workspace |
| Alert in System Center Service Manager | ITSM Connector (deploy first) |
When a question asks 'what should you do FIRST', the answer is rarely the main task. It is usually a prerequisite - a vault to create, a service to enable, a verification record to add, a sync to configure.
Implement a backup solution - create Recovery Services Vault first
Add a custom domain to App Service - create a DNS record first
Move a disk between VMs with minimum downtime - detach the data disk first (no stop needed)
Move a custom application to a different VNet - delete the VM first (retaining the disk), then recreate in the new VNet
Configure SSPR - configure authentication methods first
Delete a resource that has a lock - remove the lock first
Enable ITSM alerting - deploy the ITSM Connector first
Microsoft will list two SKUs side by side. One is enough. The other is overkill or insufficient. Read the requirements carefully.
App Service Backups - Standard tier minimum (NOT Basic)
App Service Deployment Slots - Standard tier minimum
Azure Bastion features - Basic vs Standard (cross-VNet, RDP-to-Linux, AzCLI access need Standard)
Standard Load Balancer requires Standard Public IP
Identity Protection and PIM need P2 (P1 is not enough)
SSPR with writeback to on-prem AD needs P1
| Don**'**t confuse... | With... |
|---|---|
| Service Endpoint | Private Endpoint |
| Availability Set | Availability Zone |
| Application Gateway | Azure Load Balancer |
| Application Gateway | API Management |
| Application Security Group | Network Security Group |
| Application Security Group | Active Directory Security Group |
| Azure AD (Entra) | Active Directory Domain Services |
| Azure Backup | Azure Site Recovery |
| VNet Peering | ExpressRoute |
| Site-to-Site VPN | Point-to-Site VPN |
| Reserved Instances | Spot Instances |
| Owner role | Contributor role |
| GRS | GZRS or RA-GRS |
| Bulk Create | Bulk Invite |
| Microsoft Entra ID P1 | Microsoft Entra ID P2 |
Case studies and long scenarios often include data that is NOT relevant to the question. Information about VMs, regions, network configs, and users can be sprinkled in just to confuse. Focus only on what the question actually asks.
Strategy for case study questions Read the question first. Then go back to the scenario and find only the sections that answer THAT question. Microsoft does not tell you which section applies - you have to map them yourself.
When a question gives specific numbers (120 VMs, 95% memory, 30 days, $1000 budget), pay attention - the numbers are right at a boundary that changes the correct answer.
Backup policy maximum: 100 VMs per policy → 120 VMs need 2 policies
Budget alert thresholds: 50%, 80%, 90%, 100% - check spend rate against budget reset
Lifecycle minimums: 30 days (Cool), 90 days (Cold), 180 days (Archive)
Premium Files - billed on provisioned size, not actual data