Microsoft Azure Fundamentals

Is Availability Zone different from Zone?
Yes. Availability Zone is different from Zone.
Zone is a geographical grouping of Azure Regions for billing purpose. Data transfer pricing is based on the Zones. For Zone details, please refer to FAQ below.
Availability Zone is an isolated location inside of an Azure Region, and has its own independent power source, network, and cooling. The physical and logical separation of Availability Zones within an Azure region protects applications and data from zone-level failures. Availability Zone data transfer pricing is based on Availability Zones.
Which regions correspond to Zone 1, Zone 2, Zone 3 and DE Zone 1?
A sub-region is the lowest level geo-location which you may select to deploy your applications and associated data. For data transfers (except CDN), the following regions correspond to Zone 1, Zone 2, Zone 3 and DE Zone 1.
Zone 1—Australia Central, Australia Central 2, Canada Central, Canada East, North Europe, West Europe, France Central, France South, Germany North (Public), Germany West Central (Public), Norway East, Norway West, Switzerland North, Switzerland West, UK South, UK West, Central US, East US, East US 2, North Central US, South Central US, West US, West US 2, West Central US
Zone 2—East Asia, Southeast Asia, Australia East, Australia Southeast, Central India, South India, West India, Japan East, Japan West, Korea Central, Korea
Zone 3—Brazil South, South Africa North, South Africa West, UAE Central, UAE North
DE Zone 1—Germany Central (Sovereign), Germany Northeast (Sovereign)
For more details : https://azure.microsoft.com/en-in/pricing/details/bandwidth/

Why the correct answer is right:
Azure CDN caches large static content — including video files — at edge locations (Points of Presence) worldwide. When a user requests a video, it's served from the nearest edge server rather than the origin server, dramatically reducing latency and buffering. This provides the best video playback experience for global users.

→ Why the other options are wrong:

Option A – Network interface: A network interface enables a VM to communicate with networks. It plays no role in delivering web content or improving video playback for end users.

Option B – Azure Traffic Manager: Traffic Manager uses DNS-based routing to direct users to the best-performing region. It can reduce latency but would require hosting your app in multiple regions — much more complex and costly than CDN.

Option C – Application Gateway: Application Gateway is a Layer 7 load balancer with WAF. It improves application availability and security but does not cache or distribute video content globally.

Quick Memory Tip 🧠
→ "Global users + Big video files = CDN. Cache content at the edge. Less distance = Faster playback!"

❌ Incorrect. Review the explanation below.

Azure Data Explorer is a fast and highly scalable data exploration service for log and telemetry data. It helps you handle the many data streams emitted by modern software, so you can collect, store, and analyze data. Azure Data Explorer is ideal for analyzing large volumes of diverse data from any data source, such as websites, applications, IoT devices, and more. This data is used for diagnostics, monitoring, reporting, machine learning, and additional analytics capabilities. Azure Data Explorer makes it simple to ingest this data and enables you to perform complex ad hoc queries on the data in seconds.
For more info : https://docs.microsoft.com/en-in/azure/data-explorer/data-explorer-overview

Why the correct answer is right:
The Azure Basic support plan includes only billing and subscription management support, access to documentation, and community forums. It does NOT include any technical support from engineers via phone or email. To get phone or email access to technical support engineers, you need at minimum the Developer plan (email only) or Standard plan (email + phone).

→ Why the other options are wrong:

Option A – Yes: This is incorrect. Basic plan has zero technical engineer support. The company's requirement for phone or email support cannot be met with a Basic plan.

Quick Memory Tip 🧠
→ "Basic = No tech support. Need engineer help? Minimum = Developer (email) or Standard (phone + email)!"

❌ Incorrect. Review the explanation below.

❌ Incorrect. Review the explanation below.

Why Option A is right:
Each service has a distinct role. DevOps Services is the full developer collaboration suite. App Service is a PaaS hosting platform. DevTest Labs spins up sandbox environments quickly. Logic Apps automates workflows without code. All four definitions are unique and precise.

→ Why the other options are wrong:

Options B, C, D: All shuffle the definitions incorrectly — most commonly swapping DevOps Services with App Service, or mixing DevTest Labs with Logic Apps.

Quick Memory Tip 🧠
→ DevOps = Pipelines + Git + Boards | App Service = Host web apps | DevTest = Test environments | Logic Apps = Automate workflows 🔄

The Data Migration Assistant (DMA) helps you upgrade to a modern data platform by detecting compatibility issues that can impact database functionality in your new version of SQL Server or Azure SQL Database. DMA recommends performance and reliability improvements for your target environment and allows you to move your schema, data, and uncontained objects from your source server to your target server.
For more info : https://docs.microsoft.com/en-us/sql/dma/dma-overview?view=sql-server-ver15

❌ Incorrect. Review the explanation below.

Why the correct answer is right:
Azure Virtual Machines are an IaaS (Infrastructure as a Service) offering. You are responsible for managing the OS, patching, scaling, and configuration. This is the opposite of serverless — VMs require significant server management. The correct serverless option for running scripts and code is Azure Functions, which requires zero infrastructure management.

→ Why the other options are wrong:

Option A – Yes: This is incorrect. Serverless means you write code and the platform handles all infrastructure automatically. VMs require you to provision, configure, and maintain the underlying server.

Quick Memory Tip 🧠
→ "VM = IaaS = You manage the server = NOT serverless. Serverless = Azure Functions. No server = No management!"

Azure Time Series Insights Preview is an end-to-end platform-as-a-service (PaaS) offering. You can use it to collect, process, store, analyze, and query data at Internet of Things (IoT) scale–data that’s highly contextualized and optimized for time series.
Time Series Insights is designed for ad hoc data exploration and operational analysis. It’s an extensible and customized service offering that meets the broad needs of industrial IoT deployments.
Since this is clearly mentioned in the documentation, all other options are incorrect.
For more information on Azure Time Series Insights, please visit the below URL
https://docs.microsoft.com/en-us/azure/time-series-insights/time-series-insights-update-overview

References: https://docs.microsoft.com/en-us/azure/information-protection/compliance https://docs.microsoft.com/en-us/azure/information-protection/quickstart-label-dnf-protectedemail

Since this is clearly mentioned in the documentation, all other options are incorrect

Why Metadata is right:
Azure Tags store metadata about resources. A tag is a name-value pair — for example, Environment: Production or Department: Finance. This metadata helps with organizing, filtering, and billing analysis across your Azure resources. Tags don't enforce rules or grant permissions — they simply describe and label.

→ Why the other options are wrong:

Option B: Role defines what actions a user can perform on a resource (RBAC) — not what a tag is.

Option C: Permission is the outcome of a role assignment — it grants or denies access to resources.

Option D: Policy enforces rules and standards on resources — it's not what a tag represents.

Quick Memory Tip 🧠
→ Tags = Name + Value = Metadata = "Labels that describe your resources!" 🏷️

Why A and B are right:
Elasticity is the ability to automatically increase or decrease resources based on demand. Option A captures the cost-saving side — you remove servers during off-peak hours and stop paying for idle capacity. Option B captures the performance side — during peak traffic, Azure automatically adds capacity to serve more users without degradation.

→ Why the other options are wrong:

• Option C: Backup frequency and recovery points are related to Reliability and Disaster Recovery — not elasticity. Elasticity doesn't control backup schedules.
• Option D: Microsoft managing failed hardware is about Azure's standard infrastructure responsibility — it has nothing to do with elasticity as a customer benefit.

Quick Memory Tip 🧠
→ Elasticity = "Scale up in rush hour, scale down at midnight — pay only for what you use!" 💡

Why Multiplying is right:
A Composite SLA is calculated by multiplying the individual SLAs together. For example:

• App Service: 99.95%
• Azure SQL Database: 99.99%
• Composite SLA = 99.95% × 99.99% ≈ 99.94%

The result is always lower than either individual SLA because any single failure brings the whole application down.

→ Why the other options are wrong:

Option A: Taking the lowest SLA would underestimate reliability — it ignores the probability calculation.

Option B: Taking the highest SLA would overestimate reliability — it's mathematically incorrect for dependent services.

Option C: Averaging the SLAs is also incorrect and not how Microsoft calculates Composite SLA.

Composite SLA Formula:

Composite SLA = SLA₁ × SLA₂ × SLA₃ …
"The more services you add, the lower your composite SLA becomes!"

Quick Memory Tip 🧠
→ Composite SLA = Multiply all individual SLAs = "More services = more risk = lower combined SLA!" 📉

Why Azure Policy is right:
Azure Policy allows you to define rules that automatically enforce compliance across your environment. By creating a policy that specifies allowed VM SKU sizes, Azure will block non-compliant VMs from being deployed at creation time AND evaluate existing VMs. This ensures governance without manual oversight.

→ Why the other options are wrong:

Option A: Manual inspection is reactive, not preventative. It won't stop non-compliant VMs from being deployed — it only catches them after the fact.

Option B: Azure RBAC controls who can perform actions — not what resources they can create. RBAC cannot restrict VM SKU sizes; only Azure Policy can enforce that.

Quick Memory Tip 🧠
→ Enforce resource rules automatically = Azure Policy = "Set the rules, Azure does the enforcement!" 📏

Why the correct answer is right:
Azure Firewall is a fully managed, stateful network security service that can be deployed centrally in a hub VNet and filter traffic across multiple spoke VNets and subscriptions via hub-spoke topology. You can create, enforce, and log application and network connectivity policies centrally — making it the ideal solution for enterprise-wide traffic filtering across multiple subscriptions.

→ Why the other options are wrong:

Option B – Application Security Group (ASG): ASGs allow you to group VMs logically and define NSG rules based on those groups. They operate within a single VNet and cannot span multiple subscriptions.

Option C – Azure DDoS Protection: DDoS Protection defends against large-scale volumetric attacks. It does not filter or control regular application or network traffic flows.

Option D – Network Security Group (NSG): NSGs apply allow/deny rules at the subnet or NIC level within a single VNet. They cannot centrally manage traffic filtering across multiple subscriptions and VNets.

Quick Memory Tip 🧠
→ "Azure Firewall = Central filtering across multiple VNets + subscriptions. NSG = Single VNet only. DDoS = Attack protection only."

❌ Incorrect. Review the explanation below.

Why the correct answer is right:
In Private Preview, an Azure feature is available to select customers only for evaluation purposes. You must apply to Microsoft (usually via a nomination or sign-up form) and be approved before gaining access. This is different from Public Preview where anyone can use the feature freely.

→ Why the other options are wrong:

Option A – You must agree to terms of use first: Agreeing to terms of use is part of Public Preview access — not the defining characteristic of Private Preview. Private Preview requires an application and approval.

Option C – Available in the marketplace: Features in the marketplace are generally available (GA) or Public Preview. Private Preview features are not publicly listed in the marketplace.

Option D – You cannot use private preview services: This is false. You CAN use Private Preview services — but only after being accepted through the application process.

Quick Memory Tip 🧠
→ "Private Preview = Apply first, wait for approval. Public Preview = Available to everyone. GA = Fully released!"

Why the correct answer is right:
An Azure Subscription is the billing and access boundary that must exist before any resource can be deployed. Every Azure resource — VMs, storage, networks — must belong to a subscription so that billing can be processed. Without a subscription, you cannot create resource groups, virtual networks, or any other Azure service. It is always the first step.

→ Why the other options are wrong:

Option B – Resource Group: A Resource Group is a logical container for resources, but it must be created inside a subscription. You cannot have a Resource Group without a subscription first.

Option C – Virtual Network: A Virtual Network is a networking resource that requires both a subscription and a resource group to exist before it can be created.

Option D – Management Group: Management Groups are used to organize multiple subscriptions. You still need a subscription first — Management Groups sit above subscriptions in the hierarchy.

Quick Memory Tip 🧠
→ "Azure hierarchy: Management Group → Subscription → Resource Group → Resource. Subscription is ALWAYS step one!"

Why 2 is right:
Microsoft Azure Germany consists of two physically isolated regions — Germany Central (Frankfurt) and Germany Northeast (Magdeburg). These regions are specifically designed to comply with German data privacy regulations (GDPR and German-specific laws), ensuring all customer data stays within Germany under German law governance.

→ Why the other options are wrong:

Options A, B, C: None of these are correct. Azure Germany has exactly 2 dedicated sovereign regions — not 1, 3, or 4.

Quick Memory Tip 🧠
→ Azure Germany = 2 regions = "One pair — Frankfurt + Magdeburg — for German data sovereignty!" 🇩🇪

For products governed by the Modern Lifecycle Policy, Microsoft will provide a minimum of 12 months’ notification prior to ending support if no successor product or service is offered—excluding free services or preview releases.
For more info : https://support.microsoft.com/en-us/help/30881/modern-lifecycle-policy
Hence option B is correct and rest all options are not valid in regard to Modern Lifecycle Policy for Azure services.

Why Option D is right:
An Azure Region is a geographical area containing one or more datacenters that are in close proximity and networked together with a low-latency network. This ensures fast communication between datacenters within the same region. Azure currently has 60+ regions worldwide — not limited to countries with Microsoft offices.

→ Why the other options are wrong:

Option A: Azure regions exist on every continent and in many countries — not limited to Europe and the Americas only.

Option B: "No change needed" is wrong because the bracketed statement about subsidiary offices is factually incorrect.

Option C: "High-latency network" is completely wrong — Azure regions use low-latency connections between datacenters. High latency would defeat the purpose of having a regional cluster.

Quick Memory Tip 🧠
→ Azure Region = "One or more datacenters + low-latency network = fast, close, connected!" ⚡

Why the correct answer is right:
Azure Cosmos DB is a fully managed, globally distributed NoSQL database — Microsoft handles all infrastructure management including patching, scaling, backups, and replication. It also provides single-digit millisecond latency for reads and writes worldwide. Cosmos DB includes a Table API that supports Azure Table Storage-compatible workloads, making it perfect for hosting tables with zero administration and low latency.

→ Why the other options are wrong:

Option B – No: This is incorrect. Cosmos DB is a fully managed service (zero administration) with guaranteed low latency — it meets both requirements perfectly.

Quick Memory Tip 🧠
→ "Cosmos DB = Fully managed + Low latency + Global distribution. Tables, JSON, graphs — all supported. Zero admin!"

❌ Incorrect. Review the explanation below.

Why the correct answer is right:
Azure Firewall is a managed, cloud-based network security service that controls inbound and outbound internet connectivity for Azure resources. By creating an application rule or network rule in Azure Firewall to allow HTTP (port 80) traffic to myVM's IP address, you enable internet access over HTTP. Azure Firewall operates centrally and can protect multiple VMs and VNets.

→ Why the other options are wrong:

Option B – You modify a DDoS protection plan: DDoS Protection defends against large-scale volumetric attacks. It does not control or configure which ports or protocols are allowed for internet access to a VM.

Option C – You modify an Azure Traffic Manager profile: Traffic Manager is a DNS-based global load balancer that routes users to the best regional endpoint. It does not manage firewall rules or control HTTP access to individual VMs.

Quick Memory Tip 🧠
→ "Allow internet HTTP to VM = Azure Firewall rules. DDoS = Protect from attacks. Traffic Manager = Route global traffic."

Why 99.95% is right:
For Virtual Machines deployed across two or more instances in an Availability Set, Microsoft guarantees 99.95% uptime. Availability Sets protect against hardware failures and planned maintenance within a single datacenter by using Fault Domains and Update Domains.

→ Why the other options are wrong:

Option A: 99.99% = This is the SLA for VMs deployed across two or more Availability Zones in the same region — a higher SLA due to greater physical separation.

Option C: 99.90% = This is the SLA for a single VM using Premium SSD or Ultra Disk — lower than Availability Set.

Option D: 99.94% = This is an example of a Composite SLA result (Availability Set + SQL Database) — not a standalone VM SLA tier.

Azure VM SLA Cheat Sheet:

Quick Memory Tip 🧠
→ Availability Set = 99.95% | Availability Zones = 99.99%
→ "More separation = higher SLA!" 📶

→ Why Azure Pipelines is right:
Azure Pipelines is a CI/CD (Continuous Integration / Continuous Deployment) automation service. It builds, tests, and deploys code automatically. It has no feature for assigning work items or tasks to individual developers — that's not its purpose.

→ Why the other options are wrong:

Option A: GitHub has lightweight project management features — including Issues and Projects — that allow task assignment to users.

Option B: Azure Boards is a full project management tool with Kanban boards, sprints, backlogs, and work items — specifically designed to assign tasks to individual developers.

Quick Memory Tip 🧠
→ Azure Pipelines = "Build and deploy — NOT a task manager!"
→ Task assignment = Azure Boards ✅ | GitHub ✅ | Azure Pipelines ❌

❌ Incorrect. Review the explanation below.

❌ Incorrect. Review the explanation below.

❌ Incorrect. Review the explanation below.

Why A and C are right:
Azure App Service is a fully managed PaaS platform for hosting web and mobile apps. Azure SQL Database is a fully managed PaaS relational database. Azure Storage Accounts are also PaaS — Microsoft manages the underlying infrastructure. All three are valid PaaS services that meet the migration requirement.

→ Why the other options are wrong:

Option B: Azure Virtual Machines are IaaS — you manage the OS and runtime. This violates the PaaS-only requirement.

Option D: Azure Virtual Machines with SQL Server installed = IaaS again. Even though App Service is PaaS, the VM component disqualifies this option.

Quick Memory Tip 🧠
→ PaaS services = App Service + Azure SQL Database + Storage Accounts
→ "If it has a VM — it's IaaS, not PaaS!" ❌🖥️

Why the correct answer is right:
Each Azure DevOps tool has a distinct purpose: Repos = source code management (like GitHub). Boards = work item and sprint tracking (like Jira). Artifacts = package management for build outputs (like NuGet/npm feeds). Test Plans = manual and automated testing in CI/CD pipelines. Together they form a complete DevOps toolchain.

→ Why the other options are wrong:

Option A: Incorrectly maps Repos to "agile PM" (that's Boards) and Boards to "source code" (that's Repos) — swapped definitions.

Option C: Incorrectly assigns Artifacts to "source-code repository" — Artifacts hosts build packages, not raw source code.

Option D: Assigns Repos to "automated test tool" — that belongs to Test Plans.

Quick Memory Tip 🧠
→ "Repos = Code. Boards = Tasks. Artifacts = Packages. Test Plans = Testing. Remember: R-B-A-T!"

Azure policies can be used to define requirements for resource properties during deployment and for already existing resources. Azure Policy controls properties such as the types or locations of resources. Azure Policy is a service in Azure that you use to create, assign, and manage policies. These policies enforce different rules and effects over your resources, so those resources stay compliant with your corporate standards and service level agreements. In this question, we would create an Azure policy assigned to the resource group that denies the creation of virtual machines in the resource group. You could place a read-only lock on the resource group. However, that would prevent the creation of any resources in the resource group, not virtual machines only. Therefore, an Azure Policy is a better solution.
References: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-lock-resources

ExpressRoute lets you extend your on-premises networks into the Microsoft cloud over a private connection facilitated by a connectivity provider. With ExpressRoute, you can establish connections to Microsoft cloud services, such as Microsoft Azure and Office 365.
Connectivity can be from an any-to-any (IP VPN) network, a point-to-point Ethernet network, or a virtual cross-connection through a connectivity provider at a co-location facility. ExpressRoute connections do not go over the public Internet. This allows ExpressRoute connections to offer more reliability, faster speeds, consistent latencies, and higher security than typical connections over the Internet. For information on how to connect your network to Microsoft using ExpressRoute, see ExpressRoute connectivity models.

Apache Hadoop was the original open-source framework for distributed processing and analysis of big data sets on clusters. The Hadoop ecosystem includes related software and utilities, including Apache Hive, Apache HBase, Spark, Kafka, and many others.
Azure HDInsight is a fully managed, full-spectrum, open-source analytics service in the cloud for enterprises. The Apache Hadoop cluster type in Azure HDInsight allows you to use HDFS, YARN resource management, and a simple MapReduce programming model to process and analyze batch data in parallel.
To see available Hadoop technology stack components on HDInsight, see Components and versions available with HDInsight. To read more about Hadoop in HDInsight, see the Azure features page for HDInsight.
For more info : https://docs.microsoft.com/en-us/azure/hdinsight/hadoop/apache-hadoop-introduction

Why the correct answer is right:
Azure CDN (Content Delivery Network) is a service for caching and delivering web content (like images, videos, and static files) from edge locations closer to users. It is a networking/content delivery service — not a compute or serverless platform. It cannot execute scripts or run application code. The correct serverless service for running scripts is Azure Functions.

→ Why the other options are wrong:

Option A – Yes: This is incorrect. CDN has no capability to execute code or run scripts. It purely serves cached content to end users.

Quick Memory Tip 🧠
→ "CDN = Deliver content fast, NOT run code. Serverless code execution = Azure Functions only!"

Why "No change needed" is right:
During Public Preview, an Azure feature or service is made available to all Azure customers for evaluation. Anyone with an Azure subscription can test it. This is exactly what the statement describes — so the answer is correct as written, and no change is needed.

→ Why the other options are wrong:

• Option A: Enterprise Agreement (EA) subscription is a billing/purchasing model — it doesn't control which preview stage a service is in.
• Option B: Private Preview is available to only a limited, invited set of customers — not all Azure users. This would make the statement wrong.
• Option C: "Development" is not a valid Azure service release stage at all.

Azure Release Cycle:

Private Preview (limited users) → Public Preview (all customers) → General Availability / GA (fully supported, production-ready)

Quick Memory Tip 🧠
→ Available to ALL customers = Public Preview | Limited users only = Private Preview | Fully released = GA 🚀

Why Access control (IAM) is right:
Access control (IAM) is the Azure portal blade used to assign RBAC roles to users, groups, or service principals for specific resources. You can assign the Virtual Machine Contributor role (or a custom role) to grant specific users only the ability to stop the VM — without giving them broader access.

→ Why the other options are wrong:

Option A: Tags are metadata labels for organizing and categorizing resources (e.g., Environment = Production) — they have no role in access control.

Option B: Networking controls how traffic flows to and from the VM — it does not manage user permissions.

Option C: Security in the Azure portal context covers threat protection settings — it does not grant or restrict user access to VM operations.

Quick Memory Tip 🧠
→ Grant/Restrict user access on a resource = Access control (IAM) = "IAM = Identity and Access Management!" 🔑

Why these three are right:

• Azure Portal is a web-based interface accessible from any browser on any device — including iPhones.
• Azure Cloud Shell is a browser-based command-line environment built into the Azure Portal — you can run CLI or PowerShell commands directly from a browser on your iPhone.
• Azure Mobile App is Microsoft's dedicated iOS and Android app for managing Azure resources — purpose-built for mobile management.

→ Why the other options are wrong:

• Option A: Azure CLI is a command-line tool that requires installation on a desktop OS (Windows, Linux, macOS) — it cannot run natively on an iPhone.
• Option D: Windows PowerShell requires a Windows operating system or PowerShell Core installed on a desktop/laptop — it cannot run on a mobile phone.

Quick Memory Tip 🧠
→ iPhone + Azure = Portal (browser) + Cloud Shell (browser terminal) + Mobile App (iOS app)
→ "If it needs a desktop install — it won't work on your phone!" 📱

❌ Incorrect. Review the explanation below.

Yes, this would give a cost breakdown for the resources being used in Azure.
An example is given below where you go to the Cost Analysis section in Cost Management.
For more information on Azure Cost Management, please visit the below URL

https://docs.microsoft.com/en-us/azure/cost-management/overview

References: https://azure.microsoft.com/en-us/blog/regulatory-compliance-dashboard-in-azure-security-center-now-available/

The Microsoft Azure Virtual Machine Agent (VM Agent) is a secure, lightweight process that manages virtual machine (VM) interaction with the Azure Fabric Controller. … VM Extensions enable post-deployment configuration of VM, such as installing and configuring software.
For more info : https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/agent-windows

❌ Incorrect. Review the explanation below.

Why Azure Cosmos DB is right:
Azure Cosmos DB is Azure's globally distributed, multi-model NoSQL database service. It supports five APIs: SQL (Core), MongoDB, Cassandra, Table, and Gremlin (Graph). The Gremlin API makes Cosmos DB the ideal choice for graph-based applications that model relationships between data points — like social networks, recommendation engines, and fraud detection.

→ Why the other options are wrong:

Option B: Azure SQL Database is a relational PaaS database — it does not support the Gremlin API or graph data models.

Option C: Azure Databricks is an analytics and big data processing platform (Apache Spark-based) — it's not a database service and doesn't support Gremlin.

Option D: Azure Database for PostgreSQL is a managed relational database for PostgreSQL workloads — it has no Gremlin API support.

Cosmos DB API Quick Reference:

Quick Memory Tip 🧠
→ Gremlin API = Graph database = Azure Cosmos DB = "Cosmos DB speaks 5 languages — Gremlin is one of them!" 🌐

Why the correct answer is right:
Separate Azure Virtual Networks (VNets) provide true network isolation. By placing FinServer in its own dedicated VNet, it is completely isolated from all other servers in the second VNet. By default, VNets cannot communicate with each other — FinServer is on a truly separate network segment, satisfying the compliance requirement.

→ Why the other options are wrong:

Option A – Separate resource groups: Resource groups provide logical organization only — not network isolation. Servers in different resource groups but the same VNet can still communicate freely.

Option C – VPN for FinServer: A VPN gateway is used for connecting on-premises networks to Azure over an encrypted tunnel. It does not create a separate network segment for a single server.

Option D – Resource lock for FinServer: A resource lock prevents deletion or modification of a resource. It has no impact on network communication between servers.

Quick Memory Tip 🧠
→ "Separate network = Separate VNet. Resource Group = Logical only. VNet = True network boundary!"

Since this is clearly mentioned in the documentation, all other options are incorrect.
For more information on DDoS protection, please visit the below URL
https://docs.microsoft.com/en-us/azure/virtual-network/ddos-protection-overview