Intermediate
Certification Prep
#azure
#az-900
#az-104
#aks
Azure Vocabulary
5 exercises — VNets and NSGs, Entra ID and Conditional Access, AKS autoscaling, ARM templates, and managed identities for Azure certification exams.
0 / 25 completed
1 / 25
An AZ-104 practice question asks: "A company needs to isolate network traffic between two departments within the same Azure subscription, while still allowing controlled communication between them." Which Azure construct is being described?
VNet (Virtual Network) is Azure's software-defined network boundary — the foundation for network isolation. A VNet is divided into subnets, and traffic between subnets or VNets is controlled by Network Security Groups (NSGs), which act as a stateful firewall with allow/deny rules based on IP, port, and protocol.
VNet peering connects two VNets so resources in each can communicate using private IP addresses, without traversing the public internet — commonly used exactly for this scenario: separate network boundaries per department/environment, with explicit, auditable rules for any cross-boundary traffic.
Exam vocabulary distinction: an Azure AD tenant is about identity and access management, not network isolation — a common AZ-104 distractor that tests whether you can tell network-layer concepts apart from identity-layer concepts.
VNet peering connects two VNets so resources in each can communicate using private IP addresses, without traversing the public internet — commonly used exactly for this scenario: separate network boundaries per department/environment, with explicit, auditable rules for any cross-boundary traffic.
Exam vocabulary distinction: an Azure AD tenant is about identity and access management, not network isolation — a common AZ-104 distractor that tests whether you can tell network-layer concepts apart from identity-layer concepts.
2 / 25
You see this term in Azure documentation: "Configure Conditional Access policies in Entra ID to require MFA for users signing in from outside the corporate network." What is Entra ID, and what does this sentence describe?
Entra ID is Microsoft's rebrand of Azure Active Directory (Azure AD) — the identity platform behind sign-in, user/group management, and access control across Microsoft 365 and Azure resources. Many exam questions and real-world docs still use "Azure AD" interchangeably with "Entra ID" — recognise both terms.
Conditional Access is a policy engine that evaluates signals (user, device, location, application, sign-in risk) and applies controls (require MFA, block access, require a compliant device) accordingly. "Outside the corporate network" is a common condition — it means requests not coming from a defined trusted IP range.
MFA (Multi-Factor Authentication) — requiring more than one proof of identity (e.g. password plus a phone app code) — is the most common control paired with Conditional Access policies in both AZ-900 and AZ-104 exam scenarios.
Conditional Access is a policy engine that evaluates signals (user, device, location, application, sign-in risk) and applies controls (require MFA, block access, require a compliant device) accordingly. "Outside the corporate network" is a common condition — it means requests not coming from a defined trusted IP range.
MFA (Multi-Factor Authentication) — requiring more than one proof of identity (e.g. password plus a phone app code) — is the most common control paired with Conditional Access policies in both AZ-900 and AZ-104 exam scenarios.
3 / 25
An AKS (Azure Kubernetes Service) exam scenario states: "The cluster should scale the number of nodes automatically based on pending pod resource demands." Which Azure feature satisfies this requirement, and how is it distinct from Horizontal Pod Autoscaler?
AKS exam questions frequently test the distinction between scaling pods and scaling nodes — these solve different problems and are easy to conflate.
Horizontal Pod Autoscaler (HPA) — increases or decreases the number of pod replicas for a deployment based on metrics like CPU or custom metrics, within the capacity of existing nodes.
Cluster Autoscaler — watches for pods that can't be scheduled because no node has enough free capacity ("pending" pods) and adds new nodes to the node pool to accommodate them; it also removes underutilised nodes when safe to do so, to control cost.
In practice these work together: HPA decides "we need more pod replicas," and if the existing nodes don't have room, Cluster Autoscaler provisions more nodes so those new pods can actually be scheduled. A scenario mentioning "pending pods" and "adding nodes" specifically points to Cluster Autoscaler, not HPA.
Horizontal Pod Autoscaler (HPA) — increases or decreases the number of pod replicas for a deployment based on metrics like CPU or custom metrics, within the capacity of existing nodes.
Cluster Autoscaler — watches for pods that can't be scheduled because no node has enough free capacity ("pending" pods) and adds new nodes to the node pool to accommodate them; it also removes underutilised nodes when safe to do so, to control cost.
In practice these work together: HPA decides "we need more pod replicas," and if the existing nodes don't have room, Cluster Autoscaler provisions more nodes so those new pods can actually be scheduled. A scenario mentioning "pending pods" and "adding nodes" specifically points to Cluster Autoscaler, not HPA.
4 / 25
You're reading an ARM template exam scenario: "Deploy the same set of resources consistently across dev, staging, and production environments, with environment-specific values for VM size and instance count." What Azure concept does this describe?
ARM templates are Azure's native Infrastructure-as-Code (IaC) format — a JSON document describing what resources to create and their configuration, submitted to the Azure Resource Manager API for deployment. Bicep is a newer, more readable domain-specific language that compiles down to ARM JSON — exam material increasingly favours Bicep syntax while still testing ARM concepts underneath.
Parameters let a single template be reused across environments: the resource definitions (what a VM looks like, how it's networked) stay identical, while values like
This pattern — "consistent structure, environment-specific values, avoid manual portal clicks" — is the core exam signal for "this is an IaC/ARM template question," regardless of which specific resource type the scenario describes.
Parameters let a single template be reused across environments: the resource definitions (what a VM looks like, how it's networked) stay identical, while values like
vmSize or instanceCount are injected per environment (e.g. Standard_B2s for dev, Standard_D4s_v5 for production).This pattern — "consistent structure, environment-specific values, avoid manual portal clicks" — is the core exam signal for "this is an IaC/ARM template question," regardless of which specific resource type the scenario describes.
5 / 25
An exam question describes: "The application needs to authenticate to Azure Key Vault to retrieve a database connection string, without storing any credentials in code or configuration files." Which Azure feature is being tested?
Managed identity is one of the most commonly tested AZ-104/AZ-900 security concepts, because it directly solves the classic "secret zero" problem: how does an application authenticate to get its other secrets, without itself needing a hardcoded secret?
Azure automatically creates and manages the identity's credentials behind the scenes — the developer never sees or stores a password/key. Two types: system-assigned (tied to the lifecycle of one resource, deleted when the resource is deleted) and user-assigned (a standalone identity that can be attached to multiple resources).
Once a managed identity is assigned to a resource, you grant it access via RBAC (e.g. "Key Vault Secrets User" role) — RBAC alone answers "what can this identity do," but the managed identity itself answers "how does the app authenticate without stored credentials," which is specifically what this question asks.
Azure automatically creates and manages the identity's credentials behind the scenes — the developer never sees or stores a password/key. Two types: system-assigned (tied to the lifecycle of one resource, deleted when the resource is deleted) and user-assigned (a standalone identity that can be attached to multiple resources).
Once a managed identity is assigned to a resource, you grant it access via RBAC (e.g. "Key Vault Secrets User" role) — RBAC alone answers "what can this identity do," but the managed identity itself answers "how does the app authenticate without stored credentials," which is specifically what this question asks.
6 / 25
John is referring to an *Azure Virtual Machine Scale Set* (VMSS), which is the core component of scaling groups in AKS. This construct automatically manages the number of nodes—in this case, virtual machines—running a service based on CPU utilization or other metrics. The key misconception might be that 'scaling group' always refers to Kubernetes itself; it's an Azure-managed system *within* Kubernetes that handles scaling. Option C is related to network security and D is the broader container orchestration platform.
7 / 25
Option A: A simple rollback mechanism if the new code introduces critical errors. Option B: A method for creating identical copies of an application (blue and green environments) and deploying updates to one at a time, ensuring minimal downtime during releases.
Option C: A process for automatically scaling resources based on real-time traffic demands within the Azure environment. Option D: A technique for encrypting sensitive data stored in Azure Storage accounts using Azure Key Vault.
David is referring to a blue/green deployment strategy, a common practice in minimizing downtime during software releases. This involves creating two identical environments – 'blue' (the current production environment) and 'green' (a new environment with the updated code). By deploying updates to the green environment first, the team can thoroughly test the changes without affecting users on the blue system, and then switch traffic over when everything is verified. The incorrect options represent other Azure deployment or security techniques, not the core concept of parallel deployments for reduced risk.
8 / 25
During a standup update, Mark describes the team's recent work on deploying a new Azure App Service. He says, 'We're using deployment slots – one for staging and one for production. We deploy to staging first, test it thoroughly, and then swap the running slot with the production slot when we're ready.' Considering this scenario, what is Mark primarily referring to when he mentions 'deployment slots'?
Mark is referring to deployment slots, a key feature of Azure App Service that allows for zero-downtime deployments. These slots represent separate instances of the same application, enabling developers to test updates in staging before switching them over to production. This minimizes disruption and provides a straightforward rollback mechanism if needed – the correct answer.
9 / 25
During a code review of a new Azure Function app deployed to Consumption Plan, Emily notices the following error in the application logs: 'Function timeout exceeded. Configuration settings indicate a maximum execution time of 5 minutes.' John, a senior developer, explains to her that 'auto scale' is configured for this function app. What does John primarily mean when he refers to 'auto scale' in this context regarding the Azure Function's behavior?
John is referring to the Consumption Plan's dynamic scaling capabilities. This plan automatically adjusts the resources allocated to the function app – primarily its CPU – based on incoming requests. The key difference from other plans like Premium is that auto-scale is built into the consumption model, dynamically responding to load without requiring manual intervention. Incorrect options represent other Azure features or behaviors related to function apps.
10 / 25
During a code review of a new Azure App Service, Alex comments in the PR description: 'We've configured this app to automatically scale up based on incoming HTTP requests. This ensures we can handle peak loads without manually adjusting resources.' Considering this scenario, what does Alex primarily mean when he refers to 'automatic scaling' in relation to the Azure App Service?
Alex is referring to Azure's auto-scaling feature, which automatically adjusts the number of instances running the App Service based on real-time demand. This contrasts with options A (restart after failure), C (maintenance windows), and D (load balancing) – those are distinct Azure capabilities. Option B accurately describes the core function of automatic scaling: dynamically increasing capacity to meet fluctuating workloads.
11 / 25
John is referring to an *Azure Virtual Machine Scale Set* (VMSS), which is the core component of scaling groups in AKS. This construct automatically manages the number of nodes—in this case, virtual machines—running a service based on CPU utilization or other metrics. The key misconception might be that 'scaling group' always refers to Kubernetes itself; it's an Azure-managed system *within* Kubernetes that handles scaling. Option C is related to network security and D is the broader container orchestration platform.
12 / 25
Option A: A simple rollback mechanism if the new code introduces critical errors. Option B: A method for creating identical copies of an application (blue and green environments) and deploying updates to one at a time, ensuring minimal downtime during releases.
Option C: A process for automatically scaling resources based on real-time traffic demands within the Azure environment. Option D: A technique for encrypting sensitive data stored in Azure Storage accounts using Azure Key Vault.
David is referring to a blue/green deployment strategy, a common practice in minimizing downtime during software releases. This involves creating two identical environments – 'blue' (the current production environment) and 'green' (a new environment with the updated code). By deploying updates to the green environment first, the team can thoroughly test the changes without affecting users on the blue system, and then switch traffic over when everything is verified. The incorrect options represent other Azure deployment or security techniques, not the core concept of parallel deployments for reduced risk.
13 / 25
During a standup update, Mark describes the team's recent work on deploying a new Azure App Service. He says, 'We're using deployment slots – one for staging and one for production. We deploy to staging first, test it thoroughly, and then swap the running slot with the production slot when we're ready.' Considering this scenario, what is Mark primarily referring to when he mentions 'deployment slots'?
Mark is referring to deployment slots, a key feature of Azure App Service that allows for zero-downtime deployments. These slots represent separate instances of the same application, enabling developers to test updates in staging before switching them over to production. This minimizes disruption and provides a straightforward rollback mechanism if needed – the correct answer.
14 / 25
During a code review of a new Azure Function app deployed to Consumption Plan, Emily notices the following error in the application logs: 'Function timeout exceeded. Configuration settings indicate a maximum execution time of 5 minutes.' John, a senior developer, explains to her that 'auto scale' is configured for this function app. What does John primarily mean when he refers to 'auto scale' in this context regarding the Azure Function's behavior?
John is referring to the Consumption Plan's dynamic scaling capabilities. This plan automatically adjusts the resources allocated to the function app – primarily its CPU – based on incoming requests. The key difference from other plans like Premium is that auto-scale is built into the consumption model, dynamically responding to load without requiring manual intervention. Incorrect options represent other Azure features or behaviors related to function apps.
15 / 25
During a code review of a new Azure App Service, Alex comments in the PR description: 'We've configured this app to automatically scale up based on incoming HTTP requests. This ensures we can handle peak loads without manually adjusting resources.' Considering this scenario, what does Alex primarily mean when he refers to 'automatic scaling' in relation to the Azure App Service?
Alex is referring to Azure's auto-scaling feature, which automatically adjusts the number of instances running the App Service based on real-time demand. This contrasts with options A (restart after failure), C (maintenance windows), and D (load balancing) – those are distinct Azure capabilities. Option B accurately describes the core function of automatic scaling: dynamically increasing capacity to meet fluctuating workloads.
16 / 25
John is referring to an *Azure Virtual Machine Scale Set* (VMSS), which is the core component of scaling groups in AKS. This construct automatically manages the number of nodes—in this case, virtual machines—running a service based on CPU utilization or other metrics. The key misconception might be that 'scaling group' always refers to Kubernetes itself; it's an Azure-managed system *within* Kubernetes that handles scaling. Option C is related to network security and D is the broader container orchestration platform.
17 / 25
Option A: A simple rollback mechanism if the new code introduces critical errors. Option B: A method for creating identical copies of an application (blue and green environments) and deploying updates to one at a time, ensuring minimal downtime during releases.
Option C: A process for automatically scaling resources based on real-time traffic demands within the Azure environment. Option D: A technique for encrypting sensitive data stored in Azure Storage accounts using Azure Key Vault.
David is referring to a blue/green deployment strategy, a common practice in minimizing downtime during software releases. This involves creating two identical environments – 'blue' (the current production environment) and 'green' (a new environment with the updated code). By deploying updates to the green environment first, the team can thoroughly test the changes without affecting users on the blue system, and then switch traffic over when everything is verified. The incorrect options represent other Azure deployment or security techniques, not the core concept of parallel deployments for reduced risk.
18 / 25
During a standup update, Mark describes the team's recent work on deploying a new Azure App Service. He says, 'We're using deployment slots – one for staging and one for production. We deploy to staging first, test it thoroughly, and then swap the running slot with the production slot when we're ready.' Considering this scenario, what is Mark primarily referring to when he mentions 'deployment slots'?
Mark is referring to deployment slots, a key feature of Azure App Service that allows for zero-downtime deployments. These slots represent separate instances of the same application, enabling developers to test updates in staging before switching them over to production. This minimizes disruption and provides a straightforward rollback mechanism if needed – the correct answer.
19 / 25
During a code review of a new Azure Function app deployed to Consumption Plan, Emily notices the following error in the application logs: 'Function timeout exceeded. Configuration settings indicate a maximum execution time of 5 minutes.' John, a senior developer, explains to her that 'auto scale' is configured for this function app. What does John primarily mean when he refers to 'auto scale' in this context regarding the Azure Function's behavior?
John is referring to the Consumption Plan's dynamic scaling capabilities. This plan automatically adjusts the resources allocated to the function app – primarily its CPU – based on incoming requests. The key difference from other plans like Premium is that auto-scale is built into the consumption model, dynamically responding to load without requiring manual intervention. Incorrect options represent other Azure features or behaviors related to function apps.
20 / 25
During a code review of a new Azure App Service, Alex comments in the PR description: 'We've configured this app to automatically scale up based on incoming HTTP requests. This ensures we can handle peak loads without manually adjusting resources.' Considering this scenario, what does Alex primarily mean when he refers to 'automatic scaling' in relation to the Azure App Service?
Alex is referring to Azure's auto-scaling feature, which automatically adjusts the number of instances running the App Service based on real-time demand. This contrasts with options A (restart after failure), C (maintenance windows), and D (load balancing) – those are distinct Azure capabilities. Option B accurately describes the core function of automatic scaling: dynamically increasing capacity to meet fluctuating workloads.
21 / 25
John is referring to an *Azure Virtual Machine Scale Set* (VMSS), which is the core component of scaling groups in AKS. This construct automatically manages the number of nodes—in this case, virtual machines—running a service based on CPU utilization or other metrics. The key misconception might be that 'scaling group' always refers to Kubernetes itself; it's an Azure-managed system *within* Kubernetes that handles scaling. Option C is related to network security and D is the broader container orchestration platform.
22 / 25
Option A: A simple rollback mechanism if the new code introduces critical errors. Option B: A method for creating identical copies of an application (blue and green environments) and deploying updates to one at a time, ensuring minimal downtime during releases.
Option C: A process for automatically scaling resources based on real-time traffic demands within the Azure environment. Option D: A technique for encrypting sensitive data stored in Azure Storage accounts using Azure Key Vault.
David is referring to a blue/green deployment strategy, a common practice in minimizing downtime during software releases. This involves creating two identical environments – 'blue' (the current production environment) and 'green' (a new environment with the updated code). By deploying updates to the green environment first, the team can thoroughly test the changes without affecting users on the blue system, and then switch traffic over when everything is verified. The incorrect options represent other Azure deployment or security techniques, not the core concept of parallel deployments for reduced risk.
23 / 25
During a standup update, Mark describes the team's recent work on deploying a new Azure App Service. He says, 'We're using deployment slots – one for staging and one for production. We deploy to staging first, test it thoroughly, and then swap the running slot with the production slot when we're ready.' Considering this scenario, what is Mark primarily referring to when he mentions 'deployment slots'?
Mark is referring to deployment slots, a key feature of Azure App Service that allows for zero-downtime deployments. These slots represent separate instances of the same application, enabling developers to test updates in staging before switching them over to production. This minimizes disruption and provides a straightforward rollback mechanism if needed – the correct answer.
24 / 25
During a code review of a new Azure Function app deployed to Consumption Plan, Emily notices the following error in the application logs: 'Function timeout exceeded. Configuration settings indicate a maximum execution time of 5 minutes.' John, a senior developer, explains to her that 'auto scale' is configured for this function app. What does John primarily mean when he refers to 'auto scale' in this context regarding the Azure Function's behavior?
John is referring to the Consumption Plan's dynamic scaling capabilities. This plan automatically adjusts the resources allocated to the function app – primarily its CPU – based on incoming requests. The key difference from other plans like Premium is that auto-scale is built into the consumption model, dynamically responding to load without requiring manual intervention. Incorrect options represent other Azure features or behaviors related to function apps.
25 / 25
During a code review of a new Azure App Service, Alex comments in the PR description: 'We've configured this app to automatically scale up based on incoming HTTP requests. This ensures we can handle peak loads without manually adjusting resources.' Considering this scenario, what does Alex primarily mean when he refers to 'automatic scaling' in relation to the Azure App Service?
Alex is referring to Azure's auto-scaling feature, which automatically adjusts the number of instances running the App Service based on real-time demand. This contrasts with options A (restart after failure), C (maintenance windows), and D (load balancing) – those are distinct Azure capabilities. Option B accurately describes the core function of automatic scaling: dynamically increasing capacity to meet fluctuating workloads.
Frequently Asked Questions
What will I practice in "Azure Certification Vocabulary — AZ-900 & AZ-104 Exam Terms"?
This is a Certification Prep exercise set. It walks through 25 scenario-based multiple-choice questions built around real usage of Certification Prep terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 25 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the Certification Prep vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Certification Prep exercises?
See the Certification Prep exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — Certification Prep vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.