Question 280 An organization deploys managed PaaS and says identity roles are the cloud vendor's exclusive responsibility. What is wrong? Every application user becomes an infrastructure administrator by design Customer authorization remains necessary even when hosts are managed The data center provider controls all tenant business policies All managed PaaS services require direct host administration Explanation Correct Answer B:PaaS does not decide which employees should access business data. Incorrect Answers A:Access roles must be assigned, not assumed. C:Provider operational control does not own tenant authorization decisions. D:PaaS abstracts the host.
Question 281 A vendor-hosted CRM is down for a day, disrupting sales. What continuity decision remains with the customer? Plan alternate workflows and assess vendor service commitments Physically replace the CRM provider's servers itself Assume a SaaS purchase guarantees uninterrupted business activity Use only a new user password as the recovery method Explanation Correct Answer A:Outsourcing hosting does not outsource all business continuity consequences. Incorrect Answers B:The vendor operates its infrastructure. C:Hosted applications can still experience outages. D:Credential changes do not restore a vendor-wide service outage.
Question 282 A business wants its Azure workload hosted near customers in a particular geography. What Azure concept identifies a deployment location? An Azure region An Azure role assignment A resource tag A resource lock Explanation Correct Answer A:A region is a geographic area containing one or more datacenters for Azure services. Incorrect Answers B:RBAC controls who may perform operations, not where infrastructure resides. C:A tag is metadata, not a physical deployment location. D:A lock restricts deletion or modification but does not select geography.
Question 283 A regulated application requires its primary compute deployment in an approved Azure geography. Which setting should planners examine? A management group display name Supported Azure regions for the selected services An Azure role named Reader A billing resource tag alone Explanation Correct Answer B:Region placement determines the physical area of many service resources and must match residency needs. Incorrect Answers A:Management group identity does not determine datacenter geography. C:A permission assignment does not choose a hosting region. D:Tags categorize resources but do not place data.
Question 284 A team designs a system for a specific region but finds one Azure service cannot be deployed there. What should it check? Regional availability for the service and SKU Whether a management group has a cost center tag Whether the resource group name contains the product name Change only the subscription resource-group location field Explanation Correct Answer A:Not every Azure product or tier is offered in every region. Incorrect Answers B:Governance metadata cannot add regional service capacity. C:Group naming does not enable unavailable services. D:A resource-group metadata location does not make an unsupported regional SKU or service available.
Question 285 An API in a distant Azure region has slow response times for local users. Which deployment factor should be evaluated? Choose a supported region closer to the users and dependencies Scale up the existing distant-region VM without evaluating network distance Increase the resource group name length Assume all Azure regions have identical network latency to clients Explanation Correct Answer A:Network distance and routes can affect latency. Incorrect Answers B:Additional CPU may improve server-side processing but does not eliminate round-trip delay due to region geography. C:Logical names do not shorten network round trips. D:Geography and paths matter.
Question 286 An architect asks why Azure design documentation discusses region pairs. What concept is most relevant? Two VMs on the same physical host Two subnets within one virtual network Two tags with the same value Geographically related regions for certain platform resilience and recovery considerations Explanation Correct Answer D:Region pairs are part of Azure regional strategy, but individual service behavior and residency must be checked. Incorrect Answers A:A host pair is not a region pair. B:Subnets are network segmentation, not paired geographic regions. C:Metadata does not define region relationships.
Question 287 A company assumes choosing a region causes every resource to replicate automatically into its paired region. Which statement is correct? Every VM is instantly duplicated into its paired region Cross-region replication depends on the service and selected redundancy or deployment design An Azure resource group is always created in two regions A paired region guarantees all applications have zero data loss Explanation Correct Answer B:Region pairing is not a universal automatic replica for tenant resources. Incorrect Answers A:VMs require explicit redundancy or recovery arrangements. C:Resource groups have a metadata location and do not duplicate resource deployments. D:Recovery behavior varies by architecture.
Question 288 A government agency must evaluate an Azure cloud offering with specialized isolation and jurisdiction requirements. Which concept is pertinent? A resource lock applied to a commercial VM A VM scale set running only on one customer workstation Create a standard public Azure resource group with a government-related label Azure sovereign or government cloud environments where offered Explanation Correct Answer D:Specialized environments can address requirements beyond an ordinary public region. Incorrect Answers A:Deletion protection does not create sovereignty boundaries. B:Local VM count does not establish cloud sovereignty. C:A label does not change cloud residency, isolation boundaries or the sovereign environment.
Question 289 An organization has strict sovereign-cloud eligibility rules. Why is selecting a similarly named public Azure region insufficient? Tags convert a region into a different legal cloud boundary Every public region is a sovereign cloud by definition Enabling autoscale changes personnel screening requirements The sovereign cloud environment has distinct access and compliance boundaries Explanation Correct Answer D:Dedicated cloud offerings differ from ordinary region labels and must be selected explicitly. Incorrect Answers A:Metadata does not change the service environment. B:Sovereign environments are specialized offerings. C:Capacity management does not create a sovereign compliance perimeter.
Question 290 A service must tolerate loss of a datacenter site within one supported Azure region. Which construct helps? Resource tags A single large virtual machine A shared resource group name Availability zones Explanation Correct Answer D:Zones are physically separated locations within supported regions. Incorrect Answers A:Metadata does not provide datacenter separation. B:One VM is still one runtime failure point. C:Grouping does not force physical redundancy.
