Mock Exam Section 2: Azure Architecture and Services

Welcome to Mock Exam Section 2: Azure Architecture and Services. This is the largest domain of AZ-900, weighted at approximately 35–40% of total marks. Questions cover Azure regions, compute, storage, networking, databases, AI, and DevOps services. You will practice identifying the right service for each scenario and explain the architecture concepts that underpin it. Give yourself 20–25 minutes for this section.

Scenario: A company deploys two VMs to handle web requests. They want to protect against hardware failures within an Azure data centre while remaining in the same region. Both VMs must be in different fault domains. Which Azure feature should they use?

A) Availability Sets — B) Availability Zones — C) Region Pairs — D) Azure Load Balancer

Answer: A — Availability Sets. An Availability Set distributes VMs across separate fault domains (different hardware racks with separate power) and update domains (preventing simultaneous reboots during maintenance). This provides 99.95% SLA within a single data centre. Availability Zones provide higher protection (99.99%) across separate data centres within a region — more than the scenario requires. The key word 'fault domains' maps directly to Availability Sets, not Zones.

Scenario: A company needs to store millions of product images that are accessed frequently by a web application. The images are unstructured binary files and need fast HTTP access. The team prefers the lowest-cost storage option for this use case. Which Azure storage service should they use?

A) Azure Blob Storage (Hot tier) — B) Azure Table Storage — C) Azure Queue Storage — D) Azure Files

Answer: A — Azure Blob Storage (Hot tier). Azure Blob Storage is designed for unstructured object data like images, videos, and documents. The Hot tier provides the lowest latency for frequently accessed data. Azure Table Storage is for structured NoSQL key-value data, not binary files. Queue Storage is for message queuing between application components. Azure Files provides SMB/NFS file shares. Key signal: unstructured binary files + HTTP access → Blob Storage.

Scenario: A startup is building a social media application with users worldwide. Data must be available in multiple regions simultaneously with writes accepted in all regions and read latency under 10 milliseconds. Which Azure database service should they use?

A) Azure Cosmos DB — B) Azure SQL Database — C) Azure Database for PostgreSQL — D) Azure Cache for Redis

Answer: A — Azure Cosmos DB. Cosmos DB is Azure's globally distributed, multi-model database with multi-region write support and guaranteed single-digit millisecond read latency at P99. Azure SQL Database supports geo-replication but with read-only replicas in secondary regions (not multi-master writes). PostgreSQL has limited global distribution. Azure Cache for Redis is an in-memory cache, not a primary database. Key signals: globally distributed + multi-region writes + sub-10ms reads → Cosmos DB.

Scenario: A company has a VNet with a web tier subnet and a database subnet. They need to ensure the database subnet can only receive traffic from the web tier subnet and block all other inbound traffic. The solution must operate at Layer 4 (IP/port rules). Which Azure resource should they configure?

A) Network Security Group (NSG) — B) Azure Firewall — C) Application Gateway WAF — D) Azure DDoS Protection Standard

Answer: A — Network Security Group (NSG). An NSG contains inbound and outbound rules that control traffic at the subnet or NIC level using port, IP, and protocol rules (Layer 4). Azure Firewall is a managed Layer 7 firewall — powerful but overkill and more expensive for this simple subnet isolation requirement. Application Gateway WAF is for HTTP/HTTPS web traffic protection, not subnet-to-subnet access control. DDoS Protection defends against volumetric attacks, not routing rules. Key signal: Layer 4 subnet rules → NSG.

Scenario: A company runs 200 identical web servers that need to scale in and out automatically based on CPU usage. All servers must run the same application image and be load-balanced. Which Azure compute option is most appropriate?

A) Virtual Machine Scale Sets (VMSS) — B) Individual Azure VMs — C) Azure App Service — D) Azure Container Instances

Answer: A — Virtual Machine Scale Sets (VMSS). VMSS is specifically designed for managing groups of identical, auto-scaling VMs with integrated load balancing. Individual Azure VMs cannot autoscale as a group without VMSS. App Service is PaaS and does not use VMs directly. Azure Container Instances are best for single-container runs, not a fleet of 200 servers. Key signals: 200 identical VMs + auto-scaling + load-balanced → VMSS. This is a high-frequency compute scenario in AZ-900.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this section you practiced: Availability Sets for fault-domain protection within a data centre, Blob Storage for unstructured binary objects, Cosmos DB for globally distributed multi-master NoSQL, NSG for Layer 4 subnet traffic filtering, and VMSS for auto-scaling identical VM fleets. Review any missed questions by revisiting the corresponding lesson. Next up: Section 3 drills security, governance, and cost topics.