Azure Administrator Associate

Correct — The identity backbone for Azure and Microsoft 365.

Correct — Owner is an Azure RBAC role; Global Administrator is an Entra role.

Correct — Who, what permissions, and where (MG/sub/RG/resource).

Correct — Scope flows down: management group → subscription → RG → resource.

Correct — Both can create role assignments — a privilege to watch.

Correct — Apply governance across many subscriptions at once.

Correct — e.g. deny public IPs, require tags, auto-deploy diagnostics.

Correct — A guardrail against fat-finger deletes on critical resources.

Correct — Adaptive access based on context.

Correct — Attribute spend and target actions by tag.

Correct — Policy and RBAC inherit down this hierarchy.

Correct — Users reset securely; MFA blocks credential attacks.

Correct — Spread VMs so not all go down together.

Correct — Spread across zones for higher availability.

Correct — Elastic, self-healing VM capacity.

Correct — You deploy code; Azure runs and scales the platform.

Correct — You manage workloads; Azure manages the K8s control plane.

Correct — Pay per execution; no server management.

Correct — Fast, serverless containers for simple/bursty tasks.

Correct — Simpler, resilient VM disks with tiers for performance.

Correct — Match the family and size; right-size to utilization.

Correct — Apps run on the plan; the tier sets features and scale.

Correct — Add/remove instances as demand changes.

Correct — Prefer the least-operational option that fits the workload.

Correct — The top-level namespace for storage data.

Correct — How many copies and where they are kept.

Correct — Copies exist in a paired region.

Correct — Archive is cheapest but retrieval takes hours.

Correct — Cut cost on data you rarely touch.

Correct — Shared network drives in the cloud.

Correct — Delegate least-privilege access to specific resources.

Correct — Avoid distributing all-powerful account keys.

Correct — The container for Backup and Site Recovery data.

Correct — Only your VNet can reach it — no internet path.

Correct — Always encrypted; you can control the key with CMK.

Correct — A managed shared file system fits this need.

Correct — The foundation for connecting Azure resources securely.

Correct — Stateful, instance/subnet-level filtering.

Correct — High-performance L4 distribution.

Correct — Content-based routing and web protection.

Correct — Low-latency private connectivity over the Azure backbone.

Correct — Hybrid connectivity across the internet.

Correct — No open management ports to the internet.

Correct — The data plane stays on the Azure backbone.

Correct — Manage records for your domains.

Correct — Design rule order carefully.

Correct — Remove standing exposure of 3389/22.

Correct — Network observability and diagnostics.

Correct — Central observability for resources and apps.

Correct — The central log store Azure Monitor and Sentinel query.

Correct — Without them, most resource logs are not retained.

Correct — Alerts drive response.

Correct — Deep app-level observability, part of Azure Monitor.

Correct — Centralized, policy-based backup.

Correct — Business continuity for whole workloads.

Correct — Cost visibility and control.

Correct — Actionable best-practice guidance for your resources.

Correct — The core cost-optimization levers.

Correct — Alert on what indicates real problems.

Correct — One place to correlate, alert, and investigate.