AZ-900 Practice Test 4 — 25 Questions

Question 1

A company has a policy that all Azure resources must have a tag named 'CostCenter'. The governance team wants to automatically add the tag with a default value 'IT' to any new resource that is created without it. The team wants the tag to be applied during resource creation, not just report non-compliance. The solution must also support remediation for existing non-compliant resources if needed later. Which Azure Policy effect should the team use in their policy definition?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify. The Modify effect is correct because it can automatically add or change tags on resources during creation or update, enforcing compliance in real-time. Unlike Append, Modify supports both creation and remediation of existing resources, and unlike DeployIfNotExists, it directly alters the resource properties without deploying a separate remediation task.

Answer

Append

Answer

DeployIfNotExists

Answer

Audit

Question 2

A company migrates its web application to Azure App Service (Platform as a Service). The application processes sensitive customer data and must ensure that all data in memory is encrypted while the application is running. According to the shared responsibility model, which party is responsible for implementing encryption of data in memory for this application?

Accepted Answer

The company, because it is responsible for securing its own application data and code.. In the shared responsibility model for PaaS like Azure App Service, Microsoft secures the physical host, OS, and platform runtime, but the customer retains responsibility for securing application-level data, including data in memory. Encrypting data in memory requires application code changes (e.g., using .NET's `ProtectedMemory` or Windows DPAPI), which is solely the customer's responsibility because Microsoft cannot access or manage the application's runtime memory contents.

Answer

Microsoft Azure, because it provides the hosting infrastructure and manages the runtime environment.

Answer

Both Microsoft and the company share this responsibility equally.

Answer

A third-party encryption service that is automatically enabled for all Azure App Service deployments.

Question 3

A small business runs its IT infrastructure in a small on-premises server room. The business owner is considering moving to Azure and asks the IT manager: 'How can a large cloud provider like Microsoft offer compute and storage at a lower per-unit cost than I can get by purchasing my own servers, even though I only need a few virtual machines?' Which cloud computing benefit best answers this question?

Accepted Answer

Economies of scale. Economies of scale allow Microsoft to spread massive capital and operational costs (data center construction, power, cooling, hardware procurement) across millions of customers. This per-unit cost reduction means even a small business consuming only a few virtual machines benefits from the same low-cost infrastructure that a large enterprise would, making Azure's compute and storage cheaper than purchasing and maintaining dedicated on-premises servers.

Answer

High availability

Answer

Elasticity

Answer

Fault tolerance

Question 4

A company migrates its web application to Azure. The CFO wants to view detailed reports of CPU usage, storage consumption, and network bandwidth for each team's resources to accurately allocate costs. The company uses Azure Cost Management and Billing to generate these reports. Which characteristic of cloud computing does this capability best illustrate?

Accepted Answer

Measured service. Measured service is the cloud characteristic that enables providers to track and report resource usage (CPU, storage, bandwidth) for billing and cost allocation. Azure Cost Management and Billing leverages this capability by aggregating consumption metrics from Azure Monitor and resource providers, then generating detailed reports that allow the CFO to allocate costs per team. Without measured service, granular usage-based billing and cost attribution would not be possible.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

On-demand self-service

Question 5

A development team frequently needs to create and tear down test environments. In their on-premises datacenter, they must submit a ticket to the IT operations team, which often takes several days to provision the required servers. After migrating to Azure, developers can now create virtual machines, databases, and other resources directly through the Azure portal or using PowerShell scripts, without any interaction from the IT operations team. This ability to provision cloud resources directly is a direct example of which fundamental characteristic of cloud computing?

Accepted Answer

On-demand self-service. The scenario describes developers provisioning virtual machines, databases, and other resources directly through the Azure portal or PowerShell scripts without needing to interact with the IT operations team. This is the definition of on-demand self-service, a core characteristic of cloud computing defined by NIST (SP 800-145) as a consumer being able to unilaterally provision computing capabilities without requiring human interaction with each service provider.

Answer

Resource pooling

Answer

Measured service

Answer

Rapid elasticity

Question 6

A company has multiple Azure subscriptions for different development teams. They need to define a repeatable environment that includes a set of Azure policies, role assignments, and resource templates that must be applied to any new subscription created for a project. Which Azure service should they use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it enables the orchestrated deployment of a repeatable environment that includes Azure Policy assignments, role-based access control (RBAC) assignments, and Azure Resource Manager (ARM) template deployments as a single composable artifact. Unlike individual services, Blueprints packages these components together and supports versioning, allowing teams to consistently apply the same governance and resource definitions to any new subscription created for a project.

Answer

Azure Policy

Answer

Azure Resource Manager

Answer

Azure Management Groups

Question 7

A financial services company must deploy a standardized environment for a new customer-facing application. The environment must include a specific set of Azure resources (such as virtual networks, databases, and App Service plans), pre-configured role assignments for the compliance team, and a collection of Azure Policy definitions that enforce encryption and tagging rules. The company needs to package all these components into a single, versioned artifact that can be consistently deployed across multiple subscriptions and regions, with the ability to track changes and updates. Which Azure service should the company use to achieve this?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it is designed to package a standardized environment—including resource templates, role assignments, and policy definitions—into a single, versioned artifact that can be deployed consistently across multiple subscriptions and regions. Unlike ARM templates, Blueprints natively supports versioning, tracking changes, and updating deployments, which meets the company's requirement for a versioned artifact with change tracking.

Answer

Azure Policy

Answer

Azure Resource Manager (ARM) templates

Answer

Azure Management Groups

Question 8

A company deploys three Azure virtual machines (VMs) that host a critical line-of-business application. All three VMs are located in the same Azure region. The company notices that during planned maintenance events triggered by the Azure platform, such as host OS updates, all three VMs are updated simultaneously, causing the application to become unavailable. The company requires that during such maintenance, at least two VMs remain running to preserve application uptime. Which Azure feature should the company implement to logically group the VMs and ensure they are updated in separate batches?

Accepted Answer

Azure Availability Set. An Azure Availability Set logically groups VMs to protect against platform updates and faults. By placing VMs into an availability set, Azure assigns them to different update domains (default 5) and fault domains (default 2). During planned maintenance, only one update domain is rebooted at a time, ensuring that at most one of the three VMs is updated simultaneously, thus keeping at least two VMs running.

Answer

Azure Availability Zone

Answer

Azure Virtual Machine Scale Set

Answer

Azure Site Recovery

Question 9

A company is migrating its on-premises infrastructure to Azure. Previously, the company purchased physical servers, networking equipment, and data center space every three years, paying a large sum upfront. After migration, the company expects to pay a monthly invoice based only on the virtual machines and storage it actually uses, with the ability to increase or decrease resources as needed without additional upfront costs. This change in cost structure is best described by which pair of cloud computing concepts?

Accepted Answer

Capital expenditure (CapEx) to operational expenditure (OpEx). This scenario describes a shift from paying large upfront sums for hardware and data center space (CapEx) to paying a monthly invoice based on actual consumption of virtual machines and storage (OpEx). Azure's pay-as-you-go model allows resources to be scaled up or down without upfront costs, directly aligning with the CapEx-to-OpEx transition. This is a fundamental cloud concept that changes how organizations budget and manage IT expenses.

Answer

Measured service and resource pooling

Answer

Economies of scale and geographic distribution

Answer

Agility and high availability

Question 10

A company has a production Azure subscription used by multiple teams. The governance team wants to enforce a rule that only virtual machines (VMs) of specific SKU sizes (e.g., Standard_D2s_v3 and Standard_D4s_v3) can be deployed. If a team attempts to deploy a VM of a different SKU size, the deployment must be blocked immediately and the user must see an error message explaining the restriction. Which Azure feature should the governance team use?

Accepted Answer

Azure Policy with the 'Deny' effect. Azure Policy with the 'Deny' effect is the correct choice because it allows the governance team to define and enforce rules that prevent the deployment of non-compliant resources, such as VMs with disallowed SKU sizes. When a policy with the 'Deny' effect is assigned, any attempt to create or update a resource that violates the policy is blocked immediately, and the user receives a clear error message explaining the restriction. This is the only Azure feature that provides proactive, resource-level enforcement with a built-in denial mechanism.

Answer

Azure Role-Based Access Control (RBAC) with a custom role that denies the 'Microsoft.Compute/virtualMachines/write' action

Answer

Azure Blueprints with a resource lock

Answer

Azure resource locks at the resource group level

Question 11

A company migrates its web application to Azure App Service (PaaS) and its data to Azure SQL Database (PaaS). The company wants to understand which security responsibilities it retains after the migration. According to the shared responsibility model, which of the following responsibilities remains the responsibility of the company (customer) when using these PaaS services?

Accepted Answer

Managing user access to the application and database. In the shared responsibility model for PaaS, the cloud provider manages the underlying infrastructure, including the OS and network security groups, while the customer retains responsibility for managing access to their application and data. For Azure App Service and Azure SQL Database, this means the customer must configure authentication, authorization, and user permissions (e.g., using Azure Active Directory or SQL logins) to control who can access the application and database.

Answer

Patching the operating system of the web server

Answer

Managing network security groups for the virtual network

Answer

Physical security of the Azure data center

Question 12

A company has deployed a production Azure SQL Database that is used by a critical line-of-business application. The database administrators need to be able to change the database schema and scaling settings. However, the operations team must ensure that no one can accidentally delete the database or its server. The company does not want to implement a complex backup strategy for this prevention; they want a simple control that can be applied at the resource level without affecting other management operations. What should the operations team configure to meet these requirements?

Accepted Answer

A 'CanNotDelete' resource lock on the database and the server. A 'CanNotDelete' resource lock on the database and the server prevents accidental deletion while still allowing all other management operations, including schema changes and scaling. This meets the requirement for a simple, resource-level control that does not affect read or update permissions.

Answer

An Azure Policy definition with the 'Deny' effect assigned to the resource group containing the database

Answer

A custom Azure Role-Based Access Control (RBAC) role that excludes the delete action

Answer

An Azure Blueprint that includes a policy enforcing a read-only state

Question 13

A company plans to deploy a web application on Azure Virtual Machines. The solution must remain available even if a physical datacenter in the region experiences a complete outage. The company wants to use the simplest and most cost-effective architecture that meets this requirement within a single Azure region. What should the company configure?

Accepted Answer

Deploy VMs in an Availability Zone across multiple zones.. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across multiple zones protects against a single datacenter outage while remaining in one region, making it the simplest and most cost-effective solution for this requirement.

Answer

Deploy VMs in an Availability Set across multiple fault domains.

Answer

Deploy VMs in a single scale set with autoscale.

Answer

Deploy VMs in a virtual network with a VPN gateway to a secondary region.

Question 14

A startup company plans to move its e-commerce application to Azure. The startup has limited upfront capital and expects demand to be unpredictable initially. The key requirement is that the company should only be charged for the compute and storage resources it actually uses, with the ability to pay per hour or per minute. This requirement directly maps to which fundamental benefit of cloud computing?

Accepted Answer

Consumption-based pricing – customers pay only for the resources they consume, with no upfront costs.. The startup's requirement to pay only for the compute and storage resources it actually uses, with per-hour or per-minute billing and no upfront capital, directly maps to consumption-based pricing. This cloud benefit eliminates the need for large initial investments and aligns costs with actual usage, which is ideal for unpredictable demand scenarios.

Answer

High availability – redundant infrastructure ensures the application stays online.

Answer

Elasticity – resources can automatically scale out and in based on demand.

Answer

Disaster recovery – data and applications are backed up to another region.

Question 15

A large enterprise has multiple Azure subscriptions for different departments. The central IT team wants to enforce a policy that restricts the Azure regions where resources can be deployed. The policy must automatically apply to all existing subscriptions and to any new subscriptions created in the future, without requiring manual assignment to each subscription individually. Which Azure feature should the central IT team use to achieve this hierarchical governance?

Accepted Answer

Azure Management Groups. Azure Management Groups provide a hierarchical structure above subscriptions, allowing policies (like region restrictions) to be assigned at the management group level. This inheritance ensures the policy automatically applies to all existing subscriptions within the group and to any new subscriptions added later, without manual per-subscription assignment.

Answer

Azure Blueprints

Answer

Azure Resource Groups

Answer

Azure Policy alone assigned to each subscription

Question 16

A global consulting firm has offices in New York, London, and Tokyo. They deployed a document management system on Azure App Service. Consultants need to access the system from any location worldwide using laptops or smartphones over public Wi-Fi or cellular networks, without needing a VPN connection. After deployment, all consultants can successfully log in and use the application from any internet-connected device. Which characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Broad network access. This scenario best illustrates broad network access because the document management system is accessible over the internet from any location using laptops or smartphones without requiring a VPN. Broad network access means resources can be accessed via standard network protocols (e.g., HTTPS) from a wide range of devices, including mobile phones and laptops, over public networks like Wi-Fi or cellular. The consultants' ability to log in and use the application from any internet-connected device directly demonstrates this characteristic.

Answer

High availability

Answer

Resource pooling

Answer

Rapid elasticity

Question 17

A company has a regulatory requirement that all Azure resources must be deployed only in the West Europe region. The governance team needs to automatically prevent any user or application from creating resources in any other region. The team must also ensure that this restriction is applied to all existing and future subscriptions within the tenant. Which Azure service should the governance team use?

Accepted Answer

Azure Policy. Azure Policy is correct because it enforces organizational standards by evaluating resources for compliance with defined rules, such as restricting allowed regions. By creating a policy definition that denies resource creation outside West Europe and assigning it at the management group scope, the restriction applies to all existing and future subscriptions within the tenant automatically.

Answer

Azure Blueprints

Answer

Management Groups

Answer

Azure Role-Based Access Control (RBAC)

Question 18

A company's CFO is evaluating the financial impact of moving the company's on-premises data center to Azure. The on-premises data center requires significant upfront investment for servers, storage, and networking equipment, which is depreciated over several years. In contrast, Azure offers a pay-as-you-go pricing model where the company pays only for the resources it consumes, with no upfront costs. The CFO wants to understand how this shift changes the company's financial reporting. Which statement accurately describes the financial difference between on-premises and cloud spending?

Accepted Answer

On-premises is a capital expenditure (CapEx), while Azure is an operational expenditure (OpEx).. On-premises data centers require significant upfront capital investment for hardware, which is capitalized as a capital expenditure (CapEx) and depreciated over time. Azure's pay-as-you-go model shifts costs to operational expenditure (OpEx), where you pay only for consumed resources with no upfront costs, directly impacting financial reporting by converting fixed costs to variable costs.

Answer

On-premises is an operational expenditure (OpEx), while Azure is a capital expenditure (CapEx).

Answer

Both on-premises and Azure are classified as capital expenditures (CapEx).

Answer

Both on-premises and Azure are classified as operational expenditures (OpEx).

Question 19

A company is designing a highly available application deployment in Azure. The solution must ensure that virtual machines are placed in physically separate data centers within the same Azure region to protect against a single data center failure. Which Azure feature should the company use?

Accepted Answer

Availability Zone. Availability Zones are physically separate data centers within an Azure region, each with independent power, cooling, and networking. By deploying VMs across multiple zones, the application remains available even if a single data center fails, meeting the requirement for physical separation within the same region.

Answer

Availability Set

Answer

Virtual Machine Scale Set

Answer

Azure Resource Manager

Question 20

A company has an Azure subscription with hundreds of existing virtual machines. The governance team wants to enforce a policy that every virtual machine must have a tag named 'CostCenter' with a valid value. The team wants to automatically add the 'CostCenter' tag with a default value of 'Undefined' to any existing or new virtual machine that is missing the tag. They do not want to block the creation of virtual machines that are missing the tag, but they do want the tag to be added automatically within a few minutes of detection. Which Azure Policy effect should the team use?

Accepted Answer

Modify. The Modify effect is correct because it can automatically add or change tags on existing and new resources without blocking creation. Unlike Append, which only works during resource creation and cannot modify existing resources, Modify uses a 'remediation' task to fix non-compliant resources after they are created, aligning with the requirement to add the tag within minutes of detection.

Answer

Audit

Answer

Deny

Answer

Append