Question 1

What is the Microsoft Cloud Adoption Framework (CAF) Azure resource naming convention?

Accepted Answer

The Microsoft Cloud Adoption Framework (CAF) naming convention is an industry standard for organizing Azure resources. It combines standardized component abbreviations (Resource Type, Workload, Environment, Region, and Instance number) to ensure consistency, prevent character limit violations, and simplify cloud resource management.

Question 2

How do Microsoft Entra ID Conditional Access policy templates protect Azure workloads?

Accepted Answer

Conditional Access policies enforce Zero Trust security principles by evaluating user identity, device health, location, and client app before granting access. Standardized naming and baseline templates ensure comprehensive coverage (e.g. requiring MFA, blocking legacy authentication, and protecting admin roles) while safely excluding emergency break-glass accounts.

Question 3

What is an Azure Management Group topology and how does it support Landing Zones?

Accepted Answer

Azure Management Groups provide hierarchical governance above subscriptions. A properly architected topology—such as Azure Enterprise-Scale Landing Zones (ESLZ)—allows organizations to centrally assign Azure Policies, RBAC permissions, and compliance guardrails across Landing Zones, Platform, and Sandbox subscriptions.

Question 4

Why is an Azure Tagging Strategy critical for cloud governance and FinOps?

Accepted Answer

A robust Azure tagging strategy attaches vital metadata (Environment, Cost Center, Owner, Workload, Disaster Recovery tier) to resources. This powers automated cost allocation, chargeback reporting, resource lifecycle automation, and compliance auditing enforced via Azure Policy.

Question 5

How do you create Azure Custom RBAC Role definitions with least-privilege permissions?

Accepted Answer

Custom RBAC roles in Azure define granular permissions by combining specific resource provider Actions, NotActions, DataActions, and AssignableScopes. Building roles with least-privilege access minimizes security blast radius while enabling DevOps teams to operate effectively.