Azure Cert Prep Coach prompts

Act as a senior Azure Solutions Architect explaining concepts to a junior engineer studying for the <CERT_CODE_E_G_AZ_104> exam.

Topic: <AZURE_SERVICE_OR_CONCEPT>
My current level: <BEGINNER | INTERMEDIATE | RUSTY>
My use case: <WHAT_I_AM_TRYING_TO_BUILD_OR_LEARN_IT_FOR>

Explain it in 4 layers:
1. The 1-sentence elevator pitch — what problem it solves.
2. The 3-bullet mental model — how it actually works under the hood (control plane vs data plane, where it lives in the Azure hierarchy — Tenant / Management Group / Subscription / Resource Group / Resource).
3. A concrete worked example with numbers, a tiny ASCII diagram, AND the equivalent `az` CLI command to provision it.
4. The 2-3 most common exam traps for this concept (e.g. RBAC role vs Entra ID role, regional vs zonal vs zone-redundant, ‘System-assigned’ vs ‘User-assigned’ managed identity, classic vs ARM resources, similar-sounding sibling services like Logic Apps vs Functions vs Durable Functions).

Keep it under 350 words. No fluff. If something is commonly misunderstood — especially anything renamed in the last 24 months — call it out as ⚠️ TRAP.

Generate 10 multiple-choice questions in the style of the Microsoft <CERT_CODE_E_G_AZ_104> exam, all on the topic of <DOMAIN_OR_SERVICE>.

Rules:
- Each question has exactly 4 options labeled A/B/C/D.
- 8 must be scenario-based (a Contoso/Fabrikam/Tailwind situation with constraints), not definition recall.
- Include 2 questions where multiple options look correct but only one matches Microsoft's stated best practice (cite the Well-Architected Framework pillar in the explanation).
- Include 1 question with a deprecated answer (classic deployment, old SKU, pre-rename service name) so I learn to spot stale content.
- Use current 2026 service names — Entra ID (not Azure AD), Entra External ID (not Azure AD B2C), Microsoft Sentinel (not Azure Sentinel), Microsoft Defender for Cloud (not Azure Security Center).
- After ALL 10 questions, give me an answer key in a separate code block (so I can hide it while drilling) with 1-2 sentence explanations and the Microsoft Learn URL pattern (`learn.microsoft.com/azure/<service>/<page>` — you don't need an exact URL, the pattern is fine).

I just got this Azure practice question wrong. Diagnose what I'm missing.

Question: <PASTE_QUESTION>

Options:
A) <OPT_A>
B) <OPT_B>
C) <OPT_C>
D) <OPT_D>

My answer: <MY_ANSWER>
Correct answer: <CORRECT_ANSWER>

Do this:
1. In 2 sentences, explain why my answer was wrong — but specifically name which Azure concept I'm confusing (e.g. ‘you're confusing RBAC roles with Entra ID directory roles’, ‘you're confusing Standard_LRS with Standard_ZRS’), not just ‘because X is correct’.
2. In 2 sentences, explain why the correct answer is right and which Well-Architected pillar it leans on (Reliability / Security / Cost / Performance / Operational Excellence).
3. Give me the 1 sentence I should memorize about this concept to never miss it again.
4. List the 2 sibling services / SKUs / features that are commonly confused with this one, with a 1-line differentiator each. Include at least one renamed-service trap if relevant (e.g. AAD → Entra ID).

No recap of the question. No fluff. Diagnostic mode.

I'm evaluating which Azure service fits this scenario. Help me decide.

Scenario: <DESCRIBE_USE_CASE_INCLUDING_CONSTRAINTS_LIKE_LATENCY_COMPLIANCE_BUDGET_TEAM_SIZE_EXISTING_STACK>
Region / compliance constraints: <E_G_FRANCE_CENTRAL_GDPR_DATA_RESIDENCY_OR_NONE>
Candidates I'm choosing between: <SERVICE_1>, <SERVICE_2>, <SERVICE_3>, <SERVICE_4>

For each candidate, give me:
- One-line fit-score: 🟢 ideal / 🟡 workable / 🔴 wrong tool
- The single feature that makes it fit or not
- The hidden cost or constraint people forget (egress, idle compute, premium-tier minimum, ‘only billed when warm’ misconceptions, regional availability gaps)

Then give me your final pick + the Azure Well-Architected pillar that supports it (Reliability / Security / Cost / Performance / Operational Excellence).

If two candidates are tied, name a concrete sub-scenario where each one wins. If one is a renamed/deprecated path I should never pick on a 2026 exam (e.g. classic VMs, ASE v2, Azure DevOps for new greenfield IaC vs GitHub Actions), say so explicitly.

Build me an exam-grade SKU / tier comparison table for Azure <SERVICE_NAME>, in the context of the <CERT_CODE_E_G_AZ_104> exam.

Format (markdown table, one row per SKU/tier, no paragraphs):

| SKU / tier | Use it when | Don't use it when | Cost shape | Exam trap |

Rules:
- Cover every SKU / tier that's still on a 2026 exam blueprint. Mark any deprecated or classic-only SKU with ⚠️ and a 1-line ‘never pick on the exam’ note.
- ‘Cost shape’ is one line — what dimension drives the bill (per-vCore-hour, per-GB-stored, per-execution, per-DTU, ingress free / egress charged, idle-billed vs request-billed).
- ‘Exam trap’ is the single misconception this SKU triggers (e.g. ‘LRS is in ONE datacenter — losing the datacenter loses your data’, ‘B-series VMs accrue CPU credits — fine for dev, wrong answer for a steady production workload’, ‘Premium SSD v2 has no host-cache, P-series classic does’).

After the table, give me:
1. The default I should pick when the scenario gives no constraints.
2. The 2 scenario keywords that flip the answer (‘zone-redundant’ → ZRS, ‘steady CPU’ → not B-series, ‘global low-latency reads’ → RA-GRS / Cosmos).
3. The single sentence I should memorize for this service.

Translate this Azure provisioning task across all 4 surfaces so I can recognize it in any exam question format.

Task in plain English: <DESCRIBE_TASK_EXACTLY_E_G_CREATE_A_STORAGE_ACCOUNT_NAMED_X_IN_FRANCE_CENTRAL_WITH_GRS_AND_BLOB_PUBLIC_ACCESS_DISABLED>
Target exam: <CERT_CODE_E_G_AZ_104>

Give me, in this order:

1. **Portal clickpath** — the exact navigation: ‘Portal → search <X> → + Create → tab <Y> → field <Z> = <VALUE>’. Name the tabs and the fields, not screenshots.
2. **Azure CLI one-liner** — the smallest `az <group> <subcommand>` that produces the same result. No `az login`, no resource-group create unless it's part of the task. Include the flags the Portal sets by default (--sku, --kind, --allow-blob-public-access false, etc.) so the result really matches.
3. **Bicep module** — a self-contained `.bicep` file with `param location string = resourceGroup().location`, the resource block, and any outputs the exam typically asks for (`output id string = …`). Use the latest stable apiVersion for 2026.
4. **Terraform (azurerm provider)** — the equivalent `resource` block. Match the Bicep one-for-one in arguments.
5. **The 3 implicit defaults** the Portal sets but the CLI / Bicep / Terraform forms make you think about (e.g. ‘Portal defaults TLS 1.2, az defaults TLS 1.0 until you pin --min-tls-version’, ‘Portal disables blob public access by default since 2023, az still defaults to allowed unless you pass --allow-blob-public-access false’). These are the highest-frequency exam traps.
6. **The verify command** — one `az` command that proves the resource was created with the right config (so you can spot a wrong-default exam question).

No lectures on what the service does. Treat me like I've passed the practice quizzes and I'm drilling cross-format fluency.