AZ-900 Practice Exam 4 — 20 Questions

Question 1

A company wants to organize their Azure subscriptions into a hierarchy to manage access policies and cost across different departments. They have three departments: Sales, Marketing, IT. What should they create first?

Accepted Answer

Management groups. Management groups are the correct first step because they allow you to organize Azure subscriptions into a hierarchy for centralized management of access policies and cost across departments. By creating a management group hierarchy (e.g., Root → Departments → Sales, Marketing, IT), you can apply Azure Policy and role-based access control (RBAC) at the management group level, which then cascades down to all subscriptions and resources within that branch. This enables consistent governance and cost tracking across the entire department without needing to configure each subscription individually.

Answer

Resource groups

Answer

Azure Policy

Answer

Tagging

Question 2

A global e-commerce company runs its website on Azure virtual machines in two different Azure regions: West US and East US. The company wants to distribute incoming web traffic to the region that provides the lowest latency for each user. Additionally, if one region becomes unavailable, all traffic should automatically fail over to the healthy region. The solution must not require any changes to the web application code. Which Azure service should the company use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that directs incoming web traffic to the region with the lowest latency based on the user's DNS resolver location. It supports automatic failover by routing traffic to the next healthy endpoint if a region becomes unavailable, and it requires no changes to the web application code because it operates at the DNS level.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 3

A company stores critical configuration data in an Azure Storage account. The IT administrator wants to prevent accidental deletion of this storage account. However, the administrator must still be able to read and update the data within the storage account. The company uses Azure Role-Based Access Control (RBAC) to manage permissions. Which Azure governance feature should the administrator implement to achieve this goal?

Accepted Answer

A Delete lock on the storage account. Option D is correct because a Delete lock on the storage account prevents deletion of the resource while still allowing read and update operations on the data within it. Azure resource locks operate at the resource level, overriding any RBAC permissions that would otherwise allow deletion, but they do not restrict data plane operations like reading or writing blobs or tables. This directly meets the administrator's requirement to protect against accidental deletion while maintaining full read/update access.

Answer

Azure Policy with the deny effect to block deletion of the storage account

Answer

An Azure Blueprint that includes the storage account with a policy to prevent deletion

Answer

A Read-only lock on the storage account

Question 4

A small business wants to migrate its IT infrastructure to Azure. The owner wants the ability to provision new virtual machines, storage accounts, and databases entirely through a web-based portal, without needing to submit a formal request or wait for an administrator to manually allocate resources. The owner expects resources to be available immediately after configuration. Which characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

On-demand self-service. This scenario best illustrates on-demand self-service because the owner can provision virtual machines, storage accounts, and databases through a web-based portal (such as the Azure portal) without requiring human interaction with the cloud provider's administrators. The key characteristic is that resources are available immediately after configuration, eliminating the need for formal requests or manual allocation, which is the essence of on-demand self-service as defined by NIST SP 800-145.

Answer

Broad network access

Answer

Resource pooling

Answer

Rapid elasticity

Question 5

A global retail company hosts its e-commerce web application on Azure virtual machines in three Azure regions: West Europe, East US, and Southeast Asia. The application must provide a single HTTPS entry point for customers worldwide. The company requires the solution to: route each user to the region that provides the best performance (lowest latency), automatically redirect traffic to a healthy region if one becomes unavailable, and protect the application from common web vulnerabilities such as SQL injection and cross-site scripting (XSS) by inspecting all incoming HTTP/HTTPS traffic at the edge. Which Azure service should the company use?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it provides global HTTP(S) load balancing with latency-based routing to the nearest region, automatic failover across regions, and built-in Web Application Firewall (WAF) at the edge to inspect all incoming traffic for SQL injection and XSS. This single service meets all three requirements—performance routing, regional failover, and edge-level web vulnerability protection—without needing additional components.

Answer

Azure Traffic Manager with a Web Application Firewall (WAF) policy applied to each backend virtual machine

Answer

Azure Application Gateway

Answer

Azure Load Balancer

Question 6

A small business wants to move its accounting software to the cloud to avoid purchasing and maintaining physical servers. Which cloud service model would provide the accounting application as a ready-to-use service over the internet?

Accepted Answer

Software as a Service (SaaS). Option C (SaaS) is correct because the business needs a ready-to-use accounting application delivered over the internet without managing underlying infrastructure. SaaS provides fully functional software accessed via a web browser, where the provider handles all maintenance, updates, and server management, aligning perfectly with the goal of avoiding physical server ownership.

Answer

Infrastructure as a Service (IaaS)

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Question 7

A startup wants to deploy a web application that experiences unpredictable traffic spikes. They need to scale resources automatically without manual intervention. Which benefit of cloud computing directly addresses this requirement?

Accepted Answer

Elasticity. Elasticity is the cloud computing benefit that enables resources to automatically scale out (add instances) during traffic spikes and scale in (remove instances) when demand drops, without manual intervention. This directly matches the startup's need to handle unpredictable traffic patterns by dynamically adjusting compute capacity, typically using services like Azure Virtual Machine Scale Sets or Azure App Service auto-scale rules.

Answer

High availability

Answer

Disaster recovery

Answer

Fault tolerance

Question 8

A finance company is migrating a mission-critical trading application to Azure. The application must be resilient to a complete datacenter failure within the same Azure region. The solution should provide low-latency replication between separate physical locations with independent power, cooling, and networking. Which Azure feature should they use?

Accepted Answer

Availability Zones. Availability Zones (B) are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. They provide low-latency replication and protect against a complete datacenter failure by allowing the application to run in multiple zones simultaneously, ensuring high availability and resilience within a single region.

Answer

Availability Sets

Answer

Azure Site Recovery

Answer

Region Pairs

Question 9

A startup frequently deploys identical environments for development, testing, and production. They want to ensure all deployments are consistent and follow best practices without manual configuration. They need a declarative JSON-based method to define the entire infrastructure (virtual machines, databases, networking) so that the same template can be reused across environments. Which Azure service should the startup use?

Accepted Answer

Azure Resource Manager templates. Azure Resource Manager (ARM) templates are the correct choice because they provide a declarative JSON-based syntax to define and deploy entire Azure infrastructures consistently. This allows the startup to reuse the same template across development, testing, and production environments, ensuring identical configurations without manual intervention. ARM templates also enforce idempotent deployments, meaning the same template can be applied repeatedly to achieve the same state.

Answer

Azure PowerShell scripts

Answer

Azure CLI commands

Answer

Azure Blueprints

Question 10

A team uses Docker containers to run microservices. They need a service that automatically manages the cluster, scales containers based on demand, and provides load balancing without requiring them to manage the underlying VMs. Which Azure compute service should they choose?

Accepted Answer

Azure Kubernetes Service. Azure Kubernetes Service (AKS) is the correct choice because it provides a managed Kubernetes cluster that automates container orchestration, scaling, and load balancing. AKS abstracts the underlying VMs, handling master node management, updates, and scaling based on demand, which aligns with the team's requirement to avoid VM management.

Answer

Azure Container Instances

Answer

Azure Batch

Answer

Azure Virtual Machine Scale Sets

Question 11

A company wants to track and manage costs across multiple Azure subscriptions. They have created a hierarchy of management groups: Root -> Department A -> Project 1, Project 2. They want to see the total cost for Department A across all its projects. Which Azure tool should they use?

Accepted Answer

Cost Management + Billing. Cost Management + Billing is the correct tool because it provides consolidated cost tracking and analysis across multiple subscriptions and management groups. By organizing subscriptions under the Department A management group, Cost Management can aggregate costs from Project 1 and Project 2, allowing the company to view the total cost for Department A in a single dashboard or report.

Answer

Azure Policy

Answer

Azure Advisor

Answer

Azure Monitor

Question 12

A hospital stores patient data in the cloud. The hospital is responsible for encrypting the data before uploading, managing user access, and complying with healthcare regulations. The cloud provider is responsible for securing the physical datacenter, network infrastructure, and hypervisor. This model describes which concept?

Accepted Answer

Shared responsibility model. The scenario explicitly divides security responsibilities between the hospital (data encryption, access management, regulatory compliance) and the cloud provider (physical datacenter, network, hypervisor). This division of security obligations is the core definition of the shared responsibility model, which applies across all cloud service models (IaaS, PaaS, SaaS) but is most clearly illustrated here where the customer retains control over data and identity layers.

Answer

Infrastructure as a Service (IaaS)

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Question 13

A small business runs its IT infrastructure in a small on-premises server room. The business owner is considering moving to Azure and asks the IT manager: 'How can a large cloud provider like Microsoft offer compute and storage at a lower per-unit cost than I can get by purchasing my own servers, even though I only need a few virtual machines?' Which cloud computing benefit best answers this question?

Accepted Answer

Economies of scale. Option C is correct because economies of scale allow Microsoft to spread massive capital and operational costs (data center construction, power, cooling, hardware procurement) across millions of customers. This per-unit cost reduction means even a small business consuming only a few virtual machines benefits from the same low-cost infrastructure that a large enterprise would, making Azure's compute and storage cheaper than purchasing and maintaining dedicated on-premises servers.

Answer

High availability

Answer

Elasticity

Answer

Fault tolerance

Question 14

A startup application experiences unpredictable traffic spikes. The application runs on Azure Virtual Machines. They want the VMs to automatically increase in number during peak times and decrease during low usage, without manual intervention. Which cloud characteristic does this requirement describe?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that enables resources to automatically scale out (increase) during high demand and scale in (decrease) during low demand, matching capacity to workload in real time. In this scenario, Azure Virtual Machines can be configured with autoscale rules (e.g., based on CPU > 75% for 5 minutes) to add or remove VM instances without manual intervention. This directly addresses the startup's need to handle unpredictable traffic spikes while optimizing cost.

Answer

High availability

Answer

Disaster recovery

Answer

Geo-redundancy

Question 15

A global software company hosts its SaaS product on Azure. Thousands of different customers' virtual machines and databases run on the same physical servers in Microsoft's data centers, yet each customer can only access their own resources and cannot see or interact with other customers' data. Which cloud computing characteristic does this scenario primarily describe?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because the scenario describes a multi-tenant architecture where Microsoft's Azure data centers use a shared physical infrastructure (servers, storage, network) to serve multiple customers. Each customer's VMs and databases are isolated via hypervisor-level virtualization and network segmentation, ensuring they cannot access each other's data. This pooling of resources to serve many customers, with dynamic assignment and reassignment of physical and virtual resources, is the defining characteristic of resource pooling as per the NIST definition of cloud computing.

Answer

Rapid elasticity

Answer

Measured service

Answer

On-demand self-service

Question 16

A company wants to run a containerized application in Azure without managing the underlying virtual machines. Which Azure service should they use?

Accepted Answer

B) Azure Kubernetes Service (AKS). Azure Kubernetes Service (AKS) is a managed container orchestration service that abstracts the underlying virtual machines, allowing you to deploy, scale, and manage containerized applications without having to manage the host infrastructure. AKS handles provisioning, upgrading, and patching of the cluster nodes, so you only interact with the control plane and your workloads.

Answer

A) Azure Virtual Machines

Answer

C) Azure App Service

Answer

D) Azure Functions

Question 17

Company A deploys several Linux virtual machines (VMs) across multiple Azure availability zones in the West US region. The VMs run a cluster application that needs to read and write data concurrently to a shared file system. The solution must support the Server Message Block (SMB) protocol and must be accessible from all zones with low latency. Which Azure storage service should the company use?

Accepted Answer

Azure Files. Azure Files provides fully managed file shares in the cloud that support the SMB protocol, making it the correct choice for a shared file system accessible from multiple Azure availability zones with low latency. It allows concurrent read/write access from Linux VMs across zones, meeting the cluster application's requirements.

Answer

Azure Blob Storage

Answer

Azure Managed Disks

Answer

Azure Queue Storage

Question 18

A company wants to move their on-premises data center to Azure to take advantage of the ability to quickly provision new environments for development and testing on demand, reducing time-to-market. Which cloud benefit is this an example of?

Accepted Answer

Agility. Agility refers to the ability to rapidly provision and de-provision resources as needed, which directly aligns with the scenario of quickly creating new development and test environments on demand. In Azure, this is enabled by Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) offerings, allowing teams to spin up virtual machines, databases, and networks in minutes using Azure Resource Manager (ARM) templates or the Azure portal. This reduces time-to-market by eliminating the procurement and setup delays typical of on-premises data centers.

Answer

Scalability

Answer

Reliability

Answer

Security

Question 19

A startup wants to avoid managing physical servers and instead focus on developing their application. Which cloud service model provides them with the most control over the operating system and applications while still not managing hardware?

Accepted Answer

Infrastructure as a Service (IaaS). Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet, giving the startup full control over the operating system, storage, and deployed applications without managing the underlying physical hardware. This model is ideal for a startup that wants to avoid hardware maintenance while retaining the flexibility to configure and manage their own OS and application stack.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

Functions as a Service (FaaS)

Question 20

An application deployed on Azure Virtual Machines needs to be resilient to failures within a single Azure region. The VMs are placed across multiple physically separate locations within the region, each with independent power, cooling, and networking. What is this feature called?

Accepted Answer

Availability zone. Availability zones are physically separate locations within an Azure region, each with independent power, cooling, and networking. By placing VMs across different zones, you protect your application from a single point of failure within the region, such as a datacenter outage. This is the correct feature for achieving intra-region resilience.

Answer

Availability set

Answer

Region pair

Answer

Resource group