AZ-900 Practice Test 2 — 25 Questions

Question 1

A development team is building a proof-of-concept microservice that is packaged as a Docker container. They want to deploy it to Azure with the fastest provisioning time and the least operational overhead. The team does not need to manage virtual machines, orchestrate multiple containers, or configure scaling rules. Which Azure compute service should they use?

Accepted Answer

Azure Container Instances (ACI). Azure Container Instances (ACI) is the correct choice because it allows you to deploy a single Docker container directly to Azure without managing any underlying virtual machines or orchestration. It offers the fastest provisioning time (typically seconds) and the least operational overhead, as it is a serverless platform that automatically handles container startup, networking, and resource allocation. The team's requirement to avoid managing VMs, orchestrating multiple containers, or configuring scaling rules aligns perfectly with ACI's design for simple, isolated container workloads.

Answer

Azure Kubernetes Service (AKS)

Answer

Azure Virtual Machines

Answer

Azure Batch

Question 2

A healthcare organization migrates its patient data management application to Azure. The organization's compliance team learns that Azure's underlying physical infrastructure, including servers and storage, is shared by many customers globally. The team is concerned about data leakage and wants to understand which fundamental cloud computing characteristic allows the provider to share physical hardware among multiple tenants while ensuring that each tenant's data and compute resources remain logically isolated and secure from one another.

Accepted Answer

Resource pooling. Resource pooling is the correct answer because it is the fundamental cloud computing characteristic that enables a provider to serve multiple customers (tenants) from the same physical hardware while maintaining logical isolation. In Azure, this is achieved through hypervisor-level virtualization (e.g., Hyper-V) where each tenant's virtual machines and data are isolated at the kernel and memory level, preventing cross-tenant data leakage even though the underlying servers and storage are shared.

Answer

Rapid elasticity

Answer

Measured service

Answer

Broad network access

Question 3

A multinational company uses Azure management groups to organize its subscriptions. The company has a root management group (tenant root group) containing three child management groups: 'Finance', 'HR', and 'IT'. Each child management group contains multiple subscriptions. The global governance team needs to enforce an Azure Policy that restricts all resource deployments across every subscription in the organization to only the 'West US' and 'East US' regions. The policy must automatically apply to any new subscriptions that are created under any management group in the future. The team wants to assign the policy once and have it affect all current and future subscriptions with minimal administrative overhead. At which Azure scope should the team assign the policy?

Accepted Answer

The root management group. Assigning the policy to the root management group ensures it is inherited by all child management groups (Finance, HR, IT) and their subscriptions, including any new subscriptions created in the future. This approach enforces the allowed regions policy across the entire tenant with a single assignment, minimizing administrative overhead. Azure Policy inheritance flows from the root management group down through all levels of the hierarchy.

Answer

Each subscription individually

Answer

Each child management group (Finance, HR, IT) individually

Answer

A single resource group

Question 4

A company wants to run a containerized application that responds to HTTP requests. They want to deploy it without managing any virtual machines or orchestration. Which Azure service is the simplest option?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the simplest option because it allows you to run a containerized application directly in Azure without managing any underlying virtual machines or orchestration. ACI automatically starts the container, assigns a public IP address, and handles HTTP requests on port 80/443, making it ideal for event-driven or stateless workloads that need rapid deployment.

Answer

Azure Kubernetes Service

Answer

Azure Virtual Machines

Answer

Azure App Service

Question 5

A financial institution must keep sensitive customer financial data on-premises to comply with regulatory requirements. However, they also want to use Azure to run compute-intensive analytics on anonymized datasets, taking advantage of scalable resources without managing physical servers. Which cloud deployment model should they adopt?

Accepted Answer

Hybrid cloud. The hybrid cloud model is correct because it allows the financial institution to keep sensitive customer data on-premises for regulatory compliance while leveraging Azure's public cloud for compute-intensive analytics on anonymized datasets. This approach combines the security and control of a private cloud (on-premises) with the scalability and managed services of a public cloud, without requiring the organization to manage physical servers for the analytics workload.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 6

A global company wants to organize its Azure resources by department and project. They need to enforce cost allocation and apply governance policies consistently across all subscriptions. Which two Azure features should they use together? (Select two.)

Accepted Answer

Management groups. Management groups (B) are correct because they provide a hierarchical structure above subscriptions, enabling consistent governance and policy assignment across multiple subscriptions. Tags (C) are correct because they allow you to attach metadata (e.g., department and project) to resources for cost allocation and organization. Together, management groups enforce policies at scale, while tags enable granular cost tracking and reporting.

Answer

Resource groups

Answer

Azure Policies

Question 7

A multinational e-commerce company runs its customer-facing web application on Azure virtual machines deployed in two Azure regions: East US and West Europe. The company wants to automatically route user traffic to the nearest regional deployment based on the user's geographic location. Additionally, if one region becomes unavailable, all traffic should automatically be redirected to the remaining healthy region. The company wants a solution that works at the DNS level and does not require terminating HTTPS traffic at the routing layer. Which Azure service should they use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming DNS requests to the nearest available endpoint based on geographic location (using the Performance traffic-routing method) and automatically fails over to the next healthy region when a region becomes unavailable. It operates at the DNS level, so it does not terminate HTTPS traffic, meeting the requirement to avoid SSL/TLS termination at the routing layer.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 8

Which Azure service provides a way to deploy and manage Azure services at the edge, close to IoT devices and end users?

Accepted Answer

Azure IoT Edge. Azure IoT Edge is correct because it extends cloud intelligence to edge devices, allowing you to deploy and manage Azure services (like Azure Functions, Stream Analytics, and custom modules) directly on IoT devices or gateways. This enables local data processing and decision-making close to IoT sensors and end users, reducing latency and bandwidth usage.

Answer

Azure IoT Hub

Answer

Azure Stack Edge

Answer

Azure Arc for IoT

Question 9

A hospital is subject to strict data residency laws that require patient data to remain within the country's borders. They are considering using a public cloud provider. Which cloud deployment model would best meet this compliance requirement?

Accepted Answer

Private cloud. A private cloud is dedicated to a single organization, allowing the hospital to deploy and manage infrastructure within its own data center or a colocation facility located within the country's borders. This ensures full control over data storage and processing, directly satisfying data residency laws that prohibit patient data from leaving the country. In contrast, public cloud providers may have data centers in multiple regions, making it harder to guarantee data never crosses borders.

Answer

Public cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 10

A multinational company has 10 Azure subscriptions, each managed by a different department. The central governance team wants to deploy a standardized environment that includes a specific network topology (virtual network, subnets, and network security groups), a set of Azure Policy definitions to enforce tagging and encryption, and a role assignment granting the 'Reader' role to a central security team in every subscription. The team must be able to update this standard definition in one place, and any changes should automatically apply to all existing deployments that were created from the definition. Which Azure service should they use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it enables the central governance team to define a repeatable, versioned environment that includes network topology, Azure Policy definitions, and role assignments. Blueprints support versioning and automatic updates: when a blueprint is updated and published, existing blueprint assignments can be upgraded to apply the new definitions to all deployed resources, ensuring consistency across all 10 subscriptions.

Answer

Azure Policy

Answer

Azure Resource Manager (ARM) templates

Answer

Azure Management Groups

Question 11

A retail company has 50 on-premises servers in multiple branch offices that run legacy applications that cannot be migrated to Azure. The company wants to govern these servers using the same Azure Policy and tagging standards that they use for their Azure virtual machines. They also want to view these servers alongside Azure resources in the Azure portal. Which Azure service should they deploy to extend Azure management capabilities to these on-premises servers?

Accepted Answer

Azure Arc. Azure Arc is the correct service because it extends Azure Resource Manager (ARM) control plane to on-premises servers, allowing them to be projected as Azure resources. This enables you to apply Azure Policy and tagging standards to these servers and view them alongside Azure VMs in the Azure portal, even though the legacy applications cannot be migrated.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Manager

Question 12

A multinational company has multiple Azure subscriptions managed by different teams. The compliance team requires that all new virtual machines deployed in any subscription must have a specific tag (e.g., 'CostCenter') and must be deployed in approved regions only. They also want to automatically enforce these requirements without manual intervention. Which Azure service should the compliance team use to achieve this?

Accepted Answer

Azure Policy. Azure Policy is correct because it enables the compliance team to create, assign, and manage policies that enforce rules (like requiring a 'CostCenter' tag and restricting VM deployment to approved regions) across all subscriptions. Policies are evaluated during resource creation and can automatically deny or audit non-compliant resources, ensuring enforcement without manual intervention.

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Blueprints

Answer

Azure Management Groups

Question 13

A company wants to increase the number of virtual machines it uses during peak hours and decrease them during off-peak hours without manual intervention. Which characteristic of cloud computing does this represent?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that allows resources to automatically scale out (increase) during peak demand and scale in (decrease) during off-peak hours without manual intervention. This matches the company's requirement for dynamic, automatic adjustment of virtual machine counts based on workload changes.

Answer

High Availability

Answer

Scalability

Answer

Load Balancing

Question 14

A retail company is planning to migrate its e-commerce application to Azure. The application will run on an Azure virtual machine that the company will manage. The IT manager wants to ensure that security patches are applied promptly. According to the shared responsibility model, who is responsible for applying security updates to the guest operating system of the Azure virtual machine?

Accepted Answer

The customer, because the guest operating system is under the customer's control.. In the shared responsibility model, the customer is responsible for securing and patching the guest operating system (OS) of an Azure virtual machine because the customer retains control over the OS, applications, and data. Microsoft manages the underlying hypervisor and physical infrastructure but does not have access to the guest OS. Therefore, the customer must apply security updates to the guest OS.

Answer

Microsoft, because they manage the hypervisor under the virtual machine.

Answer

Both Microsoft and the customer share responsibility equally for patching the guest operating system.

Answer

The customer, but only if they have configured Azure Policy to enforce patch compliance.

Question 15

A multinational company is expanding its online retail business to new countries. The company needs to deploy its web application in Azure regions that are geographically close to customers in Europe, Asia, and North America to minimize latency. The IT team can deploy identical application instances in multiple regions within minutes using Azure Resource Manager templates. Which benefit of cloud computing does this scenario best illustrate?

Accepted Answer

Global reach. Option C is correct because the scenario emphasizes deploying identical application instances in multiple Azure regions across Europe, Asia, and North America to serve customers geographically close to each region, which directly illustrates the global reach benefit of cloud computing. Azure Resource Manager (ARM) templates enable rapid, consistent deployment to any region, allowing the company to expand its global footprint and reduce latency by leveraging Azure's distributed infrastructure.

Answer

High availability

Answer

Elasticity

Answer

Disaster recovery

Question 16

A manufacturing company traditionally relied on an internal IT team to procure, configure, and install physical servers for each new project. The provisioning process typically took three to four weeks. After migrating to Azure, developers can now provision virtual machines and other resources directly from the Azure portal within minutes without any interaction with the IT team. This capability best represents which characteristic of cloud computing?

Accepted Answer

On-demand self-service. The scenario describes users provisioning virtual machines directly from the Azure portal without IT intervention. This aligns with on-demand self-service, a core cloud characteristic defined by NIST SP 800-145, where a consumer can unilaterally provision computing capabilities as needed automatically without requiring human interaction with each service provider.

Answer

Rapid elasticity

Answer

Measured service

Answer

Resource pooling

Question 17

A hospital stores patient data in the cloud. They are concerned about physical security at the datacenter. Which aspect of the shared responsibility model describes the cloud provider's obligation to secure the physical infrastructure?

Accepted Answer

Security of physical hardware. In the shared responsibility model, the cloud provider is always responsible for the physical security of the datacenter, including the physical hardware, environmental controls (power, cooling), and physical access controls. This is a foundational principle of the model: the provider secures the physical layer, while the customer secures what they deploy on top of it.

Answer

Security of the network infrastructure

Answer

Security of customer data

Answer

Security of operating systems

Question 18

A company wants to receive notifications when Azure services in their region experience an outage or planned maintenance that might affect their resources. Which Azure service should they set up alerts for?

Accepted Answer

Azure Service Health. Azure Service Health is the correct service because it provides personalized alerts and notifications specifically for Azure service issues—such as outages and planned maintenance—that affect your subscriptions and resources in a given region. It combines global service health information with region-specific and resource-specific impacts, allowing you to configure alerts via Azure Service Health alerts (formerly known as Service Health Alerts).

Answer

Azure Monitor

Answer

Azure Advisor

Answer

Azure Resource Health

Question 19

A manufacturing company deploys a batch processing application on Azure. The processing workload is highly unpredictable; sometimes the application requires hundreds of virtual machines for a few hours to process a large queue of jobs, and at other times it requires only a handful of virtual machines. The company configures the application to automatically add and remove virtual machines based on the size of the processing queue, ensuring that they never pay for idle capacity. Which cloud characteristic does this scenario primarily demonstrate?

Accepted Answer

Elasticity. The scenario describes automatically scaling the number of virtual machines up and down based on the queue size, which directly aligns with the cloud characteristic of elasticity. Elasticity allows resources to be dynamically provisioned and de-provisioned to match workload demand, ensuring the company never pays for idle capacity. This is distinct from high availability, fault tolerance, or disaster recovery, which focus on uptime, redundancy, and data protection rather than dynamic scaling.

Answer

High availability

Answer

Fault tolerance

Answer

Disaster recovery

Question 20

A company wants to run a containerized microservices application on Azure. They need automatic scaling based on demand, service discovery, and rolling updates without manual intervention. They want to avoid managing the underlying virtual machines. Which Azure compute service should they choose?

Accepted Answer

Azure Kubernetes Service (AKS). Azure Kubernetes Service (AKS) is the correct choice because it provides a managed Kubernetes orchestration platform that supports automatic scaling (Horizontal Pod Autoscaler), service discovery (via DNS and Kubernetes Services), and rolling updates (via Deployment strategies) without requiring you to manage the underlying VMs. AKS abstracts the control plane and node management, aligning perfectly with the requirement to avoid VM management while offering full container orchestration capabilities.

Answer

Azure Container Instances (ACI)

Answer

Azure App Service

Answer

Azure Functions