Practice Test #7

A complete migration to the public cloud can reduce CapEx by eliminating on-prem hardware purchases and can lower some OpEx through managed services. However, “complete migration” is not always the most cost-minimizing recommendation when an organization already has substantial on-premises investment and only needs extra capacity. Migration projects also introduce transition costs, time, and potential refactoring.

An additional data center increases both CapEx and OpEx. You must purchase land/space, servers, networking, and storage, and you must pay ongoing costs for power, cooling, physical security, maintenance, and staffing. This directly conflicts with the requirement to minimize capital and operational expenditure and does not provide the elasticity benefits of cloud.

A private cloud provides cloud-like management and virtualization but is still owned and operated by the organization (or dedicated hosting). It typically requires significant upfront investment in hardware and ongoing operational management, so it does not minimize CapEx/OpEx compared to using public cloud resources on demand. It also lacks the same elasticity and pay-as-you-go economics.

Premier support can provide architectural guidance and extensive proactive services, so it would satisfy the technical requirement. However, it is a high-end enterprise support offering intended for organizations needing broad, ongoing support management and proactive engagement. Because the question specifically asks to minimize costs, Premier is more expensive than necessary. Professional Direct provides the needed architectural advisory capability at a lower cost.

Developer support is intended for trial, development, and non-production use cases rather than enterprise architectural review needs. It offers limited support scope and does not include the advisory architecture services implied by a formal architectural review request. Although it is cheaper, it does not meet the requirement. Cost minimization only applies after the functional requirement is satisfied.

Standard support provides technical support for production workloads, including faster response and 24/7 access for certain severities, but it is primarily a reactive support plan. It does not include the advisory or architecture review services associated with Professional Direct. The question is specifically about requesting an architectural review from Microsoft, which requires more than standard technical support. Therefore, Standard is insufficient even though it costs less.

The statement is incorrect because Azure Key Vault is not used to store secrets for Azure AD user accounts (for example, user passwords). User authentication credentials are managed by Azure AD/Entra ID and are not intended to be stored and retrieved as Key Vault secrets. Key Vault is primarily for application/service secrets, keys, and certificates, not end-user credential storage. Leaving the text unchanged preserves the incorrect implication about user account secrets.

Even for Azure AD administrative accounts, Key Vault is not the system of record for their credentials (passwords/MFA methods). Administrative accounts are still user identities whose authentication data is managed within Azure AD/Entra ID, not stored as retrievable secrets in Key Vault. While admins may manage Key Vault, that does not mean their account secrets belong there. The option does not correct the fundamental mismatch between Key Vault’s purpose and user account credential storage.

Azure Key Vault is not intended as a general repository for Personally Identifiable Information (PII). Although Key Vault can store small secret values, PII is typically stored in databases or storage services with appropriate encryption, access controls, and data governance features, while Key Vault manages cryptographic material and application secrets. Using Key Vault for PII at scale is not its primary design and does not match the statement’s context about “secrets for Azure AD user accounts.” This option shifts the topic but does not accurately describe Key Vault’s core use case.

Answering "No" incorrectly assumes that Azure CLI commands cannot be run from the PowerShell version of Azure Cloud Shell. In reality, Cloud Shell PowerShell includes the Azure CLI alongside the Az PowerShell module, so `az` commands are supported there as well. While Bash is commonly used in examples, it is not a requirement for Azure CLI execution in Cloud Shell. Therefore, saying the solution does not meet the goal is technically inaccurate.

Azure Security Center, now called Microsoft Defender for Cloud, is a security posture management and workload protection service. It helps identify security risks, provide recommendations, and monitor threats across Azure and hybrid environments. It does not serve as a repository for storing certificates, secrets, or private keys, so it is not the correct answer here.

An Azure Storage account can store any file type (including certificate files like .pfx or .cer) as blobs, but it is not designed for secure certificate lifecycle management. While you can apply encryption and access controls, it lacks certificate-specific features such as controlled retrieval patterns for apps, rotation/renewal workflows, and dedicated secret auditing. For exam purposes, Storage is not the correct service for certificate storage.

Azure Information Protection (AIP) focuses on classifying, labeling, and protecting documents and emails using rights management and encryption policies. It helps prevent data leakage and enforce access to information, but it is not a service for storing certificates or private keys. AIP is about protecting content, not managing cryptographic assets for applications and infrastructure.

Azure Logic Apps is a low-code workflow automation service used to integrate apps, data, and services with connectors and triggers. It can orchestrate steps around an AI solution (e.g., call an ML endpoint, route results, send notifications), but it does not provide capabilities to build, train, test, and deploy predictive models. It’s primarily for process automation and integration, not machine learning development.

Azure Batch is a service for running large-scale parallel and high-performance computing (HPC) workloads. While it can be used to execute compute-intensive tasks (including parts of data processing or model training scripts), it does not provide the managed ML lifecycle features such as experiment tracking, model registry, evaluation modules, or straightforward deployment to real-time endpoints. It’s compute orchestration, not an ML platform.

Azure Cosmos DB is a globally distributed NoSQL database for low-latency data storage and replication. It can store application data or even features used by ML systems, but it is not used to build, test, or deploy predictive analytics models. In AI architectures, Cosmos DB is typically a data layer component, whereas Azure Machine Learning is the model development and deployment layer.

An Azure AD role is used for Azure role-based access control (RBAC), which governs what actions an identity can perform on Azure resources (management plane), such as starting/stopping a VM or modifying settings. It does not control network connectivity or which TCP/UDP ports are open to the Internet. Port control is a networking function handled by NSGs, firewalls, or similar network security services.

An Azure AD group is a collection of users/devices used to assign permissions via RBAC or to manage access to applications and resources. While groups can simplify authorization (who can manage or access something), they do not enforce network-layer rules like opening or closing ports to a VM. Network access control for VM ports is implemented with NSGs (and optionally Azure Firewall/WAF).

Azure Key Vault is designed to securely store and manage secrets, encryption keys, and certificates, supporting scenarios like TLS certificate management and application secret storage. Although Key Vault can be protected with access policies/RBAC and network controls for the vault itself, it does not control inbound/outbound ports to virtual machines. VM port exposure to the Internet is controlled by NSGs and related network security controls.