AZ-900 Practice Test 2 — 25 Questions

Question 1

A company runs a critical web application on Azure virtual machines. To ensure the application remains accessible even if an entire Azure datacenter becomes unavailable due to a power outage, the company deploys virtual machines in two different Azure regions and uses Azure Traffic Manager to automatically route traffic to the healthy region. Which benefit of cloud computing does this configuration primarily demonstrate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

High availability. This configuration demonstrates high availability because it uses Azure Traffic Manager to route traffic across two Azure regions, ensuring the application remains accessible even if an entire datacenter fails. High availability focuses on minimizing downtime by eliminating single points of failure, which is exactly what deploying VMs in multiple regions with traffic routing achieves.

Answer

Elasticity

Answer

Cost reduction

Answer

Security

Question 2

A startup application experiences unpredictable traffic spikes. The application runs on Azure Virtual Machines. They want the VMs to automatically increase in number during peak times and decrease during low usage, without manual intervention. Which cloud characteristic does this requirement describe?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that enables resources to automatically scale out (increase) during high demand and scale in (decrease) during low demand, matching capacity to workload in real time. In this scenario, Azure Virtual Machines can be configured with autoscale rules (e.g., based on CPU > 75% for 5 minutes) to add or remove VM instances without manual intervention. This directly addresses the startup's need to handle unpredictable traffic spikes while optimizing cost.

Answer

High availability

Answer

Disaster recovery

Answer

Geo-redundancy

Question 3

A software company develops a microservices application using Docker containers. The application consists of multiple services that need to be deployed, scaled, and managed together. The company wants to use Azure to orchestrate and manage these containers without provisioning or managing the underlying virtual machines. Which Azure service should they use?

Accepted Answer

Azure Kubernetes Service (AKS). Azure Kubernetes Service (AKS) is the correct choice because it provides a fully managed Kubernetes orchestration platform that automates the deployment, scaling, and management of containerized microservices. AKS abstracts the underlying virtual machines, allowing the company to focus on application logic without provisioning or managing the VM infrastructure, which directly matches the requirement for orchestration without VM management.

Answer

Azure Container Instances

Answer

Azure App Service

Answer

Azure Batch

Question 4

A healthcare organization needs to enforce a set of compliance requirements (e.g., enable encryption on all storage accounts, restrict public network access to SQL databases, and enforce a specific TLS version) across all Azure subscriptions. The organization has defined these requirements as individual Azure Policy definitions. The governance team wants to assign all these policies together as a single unit to a management group, ensuring that any new subscription created under that group automatically receives all the policies. Which Azure object should the governance team create first?

Accepted Answer

Azure Policy initiative. An Azure Policy initiative is a collection of individual policy definitions designed to group related policies together for assignment as a single unit. By creating an initiative that contains the required compliance policies (encryption, network restrictions, TLS version) and assigning it to a management group, any new subscription under that group automatically inherits the initiative, ensuring consistent enforcement.

Answer

Azure Blueprint

Answer

Azure Management Group

Answer

Azure Resource Manager template

Question 5

A company is evaluating whether to move to cloud. Their IT manager says they are concerned about losing control over their data. Which Azure feature MOST directly addresses this concern?

Accepted Answer

Azure guarantees data never leaves the specified region unless configured to do so. Azure data residency controls, combined with Azure regions and data sovereignty guarantees, ensure that customer data stays within specified geographic boundaries. Microsoft's contractual commitments in the Microsoft Products and Services Data Protection Addendum (DPA) address data sovereignty concerns.

Answer

Microsoft employees have unrestricted access to all customer data

Answer

Data is automatically shared with government agencies

Answer

All Azure data is stored in the United States

Question 6

Which Azure networking service provides a distributed, highly available, and scalable DNS service for routing users to the best-performing endpoint?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that distributes traffic to the best-performing endpoint across global Azure regions. It uses DNS responses to direct users to the endpoint with the lowest latency or highest priority, providing high availability and scalability without proxying traffic.

Answer

Azure Front Door

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Question 7

A company is designing a disaster recovery solution for a multi-tier application hosted in Azure. They need to ensure that if an entire Azure region becomes unavailable, the application can fail over to another region. The application uses Azure SQL Database. Which Azure feature should they use to replicate the database across regions?

Accepted Answer

B) Azure SQL Database automatic failover groups. Azure SQL Database automatic failover groups (Option B) are the correct choice because they provide automated, orchestrated failover of a group of databases across regions, ensuring the entire multi-tier application can fail over when an Azure region becomes unavailable. Unlike geo-replication, which only replicates data, failover groups manage the entire logical server and its databases, including updating the connection string endpoint to the secondary region, which is essential for application continuity.

Answer

A) Azure SQL Database geo-replication

Answer

C) Azure Traffic Manager

Answer

D) Azure Site Recovery

Question 8

Which of the following is an example of a SaaS (Software as a Service) offering from Microsoft?

Accepted Answer

Microsoft 365. Microsoft 365 is a SaaS offering because it provides ready-to-use productivity applications (e.g., Word, Excel, Teams) accessed via a web browser or client, with Microsoft managing the underlying infrastructure, operating system, and application updates. The customer simply consumes the software without needing to install or maintain servers or runtime environments.

Answer

Azure Virtual Machines

Answer

Azure App Service

Answer

Azure SQL Database

Question 9

A company's CTO asks why Azure can offer services at lower costs than building an equivalent on-premises solution. Which cloud principle BEST explains this?

Accepted Answer

Economies of scale. Economies of scale is the correct answer because cloud providers like Azure operate massive, standardized data centers that serve millions of customers simultaneously. This allows them to negotiate bulk discounts on hardware, power, and cooling, and to spread fixed operational costs across a vast customer base, resulting in per-unit costs far lower than what a single company would pay for an equivalent on-premises deployment.

Answer

Elasticity

Answer

High availability

Answer

Geo-distribution

Question 10

A manufacturing company runs its proprietary production scheduling software on on-premises servers. The IT team also manages on-premises file servers. The company decides to move its email system to Microsoft 365 but keeps all other systems on-premises. Which cloud deployment model does this scenario best describe?

Accepted Answer

Hybrid cloud. This scenario describes a hybrid cloud because the company uses a mix of on-premises infrastructure (production scheduling servers and file servers) and a public cloud service (Microsoft 365 for email). In a hybrid cloud model, organizations integrate on-premises resources with public cloud services, allowing data and applications to be shared between them. Here, the email system runs in Microsoft's public cloud while all other systems remain on-premises, creating a hybrid deployment.

Answer

Private cloud

Answer

Public cloud

Answer

Community cloud

Question 11

Match each Azure database service to its type.

Accepted Answer

Azure SQL Database: Relational. In this matching exercise, the correct pairs are: Azure SQL Database (Relational), Azure Cosmos DB (NoSQL), Azure Database for MySQL (Relational), Azure Database for PostgreSQL (Relational). The distractors swap the types, incorrectly labeling Cosmos DB as relational and SQL Database as NoSQL.

Answer

Azure Cosmos DB: Relational

Answer

Azure SQL Database: NoSQL

Question 12

Which Azure feature provides a way to audit and track access to sensitive resources using detailed logs?

Accepted Answer

Azure Activity Log and Diagnostic Logs. Azure Activity Log and Diagnostic Logs together provide a comprehensive auditing and tracking mechanism for sensitive resources. The Activity Log records control-plane events (e.g., who created or deleted a resource), while Diagnostic Logs capture data-plane events (e.g., read/write operations on a storage account or key vault). This combination allows administrators to trace every access attempt, including successful and failed operations, with detailed timestamps, caller identities, and request payloads.

Answer

Azure AD Sign-in logs

Answer

Azure Network Security Group flow logs

Answer

Azure Advisor audit recommendations

Question 13

A US-based financial services company must ensure that all customer data remains within the United States at all times to comply with regulatory requirements. The company plans to replicate its Azure SQL database between two Azure regions for disaster recovery. The solution must guarantee that if a region experiences a major outage, the paired region is prioritized for recovery. Additionally, the solution should ensure that during planned maintenance, only one region in the pair is updated at a time. Which Azure architecture feature should the company use?

Accepted Answer

Region Pairs. Region Pairs are the correct choice because Azure guarantees that each region is paired with another region within the same geography (e.g., East US with West US) to provide physical isolation, prioritized disaster recovery, and sequential planned maintenance updates. This ensures that during an outage, recovery is directed to the paired region, and during maintenance, only one region in the pair is updated at a time, meeting the company's regulatory and availability requirements.

Answer

Availability Zones

Answer

Resource Groups

Answer

Azure Policy

Question 14

Which Azure service provides a managed, serverless SQL database that scales automatically and pauses when not in use?

Accepted Answer

Azure SQL Database Serverless. Azure SQL Database Serverless is the correct answer because it is a compute tier for single databases that automatically scales compute resources based on workload demand and pauses the database during periods of inactivity, charging only for storage when paused. This aligns directly with the question's requirement for a managed, serverless SQL database that scales automatically and pauses when not in use.

Answer

Azure SQL Database General Purpose tier

Answer

Azure Cosmos DB Serverless

Answer

Azure SQL Managed Instance

Question 15

A company uses Azure for multiple projects. The IT governance team wants to ensure that every new Azure resource within a subscription is automatically assigned a 'CostCenter' tag based on the resource group it is created in. The team does not want to rely on users manually applying the tag. They need a built-in Azure solution that enforces this rule without custom scripts. Which Azure feature should they use?

Accepted Answer

Azure Policy with the 'Inherit a tag from the resource group if missing' effect. Azure Policy with the 'Inherit a tag from the resource group if missing' effect is correct because it automatically applies the 'CostCenter' tag from the resource group to any new resource created within that resource group, without requiring manual intervention or custom scripts. This built-in policy effect enforces governance rules at scale, ensuring compliance across the subscription.

Answer

Azure Resource Graph

Answer

Azure Management Groups

Answer

Azure Tags (manual tagging feature)

Question 16

A company runs a multi-tier application on Azure virtual machines in a virtual network. The web tier VMs are in a front-end subnet, and the database tier VMs are in a back-end subnet. Currently, outbound internet traffic from the VMs goes directly to the internet without any inspection or logging. The security team needs a centralized service to inspect all outbound traffic from the virtual network, log the destinations, and reject traffic to malicious domains based on threat intelligence feeds. The solution must also allow rules based on fully qualified domain names (FQDNs) instead of only IP addresses. Which Azure service should the security team deploy?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-based network security service that provides centralized outbound traffic inspection, logging, and threat intelligence-based filtering. It supports application rules based on fully qualified domain names (FQDNs), allowing the security team to reject traffic to malicious domains without relying solely on IP addresses. This makes it the correct choice for inspecting and controlling outbound traffic from the virtual network.

Answer

Azure Bastion

Answer

Network Security Group (NSG)

Answer

Application Gateway

Question 17

A company plans to migrate a line-of-business application to Azure virtual machines (IaaS). The company's security team is reviewing the shared responsibility model to determine which security tasks are handled by Microsoft. Which of the following security responsibilities belongs to Microsoft?

Accepted Answer

Maintaining physical security of the datacenter where the servers are hosted. Under the shared responsibility model for IaaS, Microsoft is responsible for the physical security of its datacenters, including access controls, surveillance, and environmental safeguards. This is a foundational layer that customers cannot manage, making option C correct.

Answer

Configuring operating system firewalls on the virtual machines

Answer

Patching the guest operating system of the virtual machines

Answer

Managing application-level user authentication and authorization

Question 18

Which Azure service provides automatic threat detection and response for Azure SQL Database, detecting anomalous activities like SQL injection?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL is the correct answer because it is a cloud-native security solution specifically designed to detect and respond to threats against Azure SQL Database, including SQL injection attacks. It provides advanced threat protection by continuously monitoring database activities and generating security alerts for anomalous behaviors, such as unusual access patterns or injection attempts, without requiring manual intervention.

Answer

Azure SQL Database auditing

Answer

Azure Policy

Answer

Azure Firewall

Question 19

A company runs a web application on Azure. At the end of each month, the finance team reviews an invoice that itemizes charges by resource type, such as virtual machine compute hours, storage capacity used, and data transfer volume. The total cost directly corresponds to the exact quantity of resources consumed during the billing period. This capability is an example of which fundamental characteristic of cloud computing?

Accepted Answer

Measured service. Measured service is the correct answer because it refers to the cloud provider's ability to meter and bill customers based on actual resource consumption. In this scenario, the invoice itemizes charges by resource type (compute hours, storage, data transfer) and the total cost directly corresponds to the exact quantity consumed, which is the defining characteristic of measured service. This capability relies on metering telemetry (e.g., Azure Monitor metrics, usage logs) to track usage and generate a pay-per-use billing model.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

On-demand self-service

Question 20

A company has 30 Azure subscriptions organized under a single management group. The governance team wants to enforce that all resource groups must have a specific tag 'CostCenter' with a valid value. They create an Azure Policy definition with the 'Deny' effect and assign it to the root management group. However, the development team complains that they have a sandbox subscription where they need to create resource groups without the 'CostCenter' tag for testing. The governance team still wants the policy to apply to all other subscriptions but exempt the sandbox subscription. Which solution should the governance team use?

Accepted Answer

Use a policy exemption on the sandbox subscription with category 'Waiver'.. Azure Policy exemptions allow specific scopes (like the sandbox subscription) to be excluded from a policy's enforcement while keeping the policy assigned to the parent management group. A 'Waiver' exemption category is used when the intent is to temporarily or permanently exempt a resource from policy evaluation, which fits the governance team's requirement to exempt only the sandbox subscription without altering the policy assignment structure.

Answer

Create a second policy assignment at the sandbox subscription with the 'Disabled' effect.

Answer

Remove the policy assignment from the management group and assign it individually to all subscriptions except the sandbox.

Answer

Configure an Azure Blueprint for the management group and exclude the sandbox subscription.