AZ-900 Practice Test 1 — 30 Questions

Question 1

A company uses Azure and wants to organize all their virtual machines, databases, and storage accounts into logical containers for management and billing purposes. Which Azure component should they use to group these resources?

Accepted Answer

Resource Group. Resource Groups are logical containers in Azure that allow you to group related resources such as virtual machines, databases, and storage accounts for unified management, monitoring, and billing. By placing resources in the same resource group, you can apply lifecycle operations (e.g., delete, tag) and cost tracking across all members. This directly matches the requirement to organize resources for management and billing purposes.

Answer

Azure Policy

Answer

Management Group

Answer

Azure Subscription

Question 2

A company uses multiple Azure subscriptions for different departments. The finance team wants to monitor spending across all subscriptions and receive automated email alerts when a subscription's actual spending reaches 80% of its monthly budget. The team does not want to write custom scripts or use external tools. Which Azure feature should they use?

Accepted Answer

Azure Cost Management + Budgets. Azure Cost Management + Budgets is the correct feature because it allows you to create budgets at the subscription or resource group level, set alert thresholds (e.g., 80% of actual spend), and configure automated email notifications when the threshold is met—all without custom scripts or external tools. This directly addresses the finance team's requirement to monitor spending across multiple subscriptions and receive alerts.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Resource Locks

Question 3

A company wants to ensure that all Azure resources are tagged with a 'CostCenter' tag at creation time. If a resource is created without the tag, it should be automatically denied. Which Azure Policy effect should they use?

Accepted Answer

A) deny. The 'deny' effect is correct because it actively blocks any resource creation request that does not include the required 'CostCenter' tag. Azure Policy with the 'deny' effect evaluates the resource against the policy rule at creation or update time and rejects the request if the condition is not met, ensuring compliance before the resource is provisioned.

Answer

B) audit

Answer

C) append

Answer

D) deployIfNotExists

Question 4

A company uses Azure Blueprints to define a repeatable set of Azure resources and policies for new subscriptions. They want to ensure that when a new subscription is created, a specific role assignment is automatically applied. What should they include in the blueprint definition?

Accepted Answer

A role assignment artifact. Azure Blueprints allow you to define artifacts that are applied to new subscriptions. A role assignment artifact is the correct choice because it directly assigns a specific Azure RBAC role to a user, group, or service principal at the subscription scope, ensuring the role is automatically applied when the blueprint is assigned to a new subscription.

Answer

An Azure Policy assignment

Answer

An Azure Resource Manager template

Answer

A resource group

Question 5

A company uses Azure Policy to enforce governance. They want to prevent users from creating virtual machines of the Standard_DS3_v2 SKU in their subscription, and they also want to log any attempt to create such a VM (whether successful or not) for audit purposes. What is the minimum number of Azure Policy assignments required to meet both requirements?

Accepted Answer

Two – assign one policy definition with the Deny effect and another with the Audit effect.. Option C is correct because Azure Policy can only enforce a single effect per policy definition. To both deny the creation of Standard_DS3_v2 VMs and log all attempts (successful or denied) for audit, you need two separate policy assignments: one with the Deny effect to block the action, and another with the Audit effect to log the attempt. A single policy cannot combine both effects, as each definition is limited to one effect type.

Answer

One – assign a policy definition with the Deny effect.

Answer

One – assign a policy definition with the Audit effect.

Answer

Two – assign one policy definition with the Deny effect and another with the Append effect.

Question 6

A company wants to ensure that all Azure resources are tagged with metadata such as 'Environment' and 'Department'. They have created an Azure Policy that appends the required tags and their values when a resource is created. However, they notice that some resources created before the policy assignment are missing tags. They want to automatically add those tags without manual effort. What should they do?

Accepted Answer

Create a new policy with DeployIfNotExists effect. Option B is correct because the DeployIfNotExists (DINE) policy effect can automatically remediate non-compliant resources, including those created before the policy assignment. When combined with a managed identity, DINE triggers a deployment task that adds the required tags without manual intervention, addressing the gap left by the 'append' effect which only acts on new resources.

Answer

Create a remediation task for the policy

Answer

Use Azure Resource Graph to query and update

Answer

Create an Azure Automation runbook

Question 7

A company uses Azure SQL Database for a web application. They need to ensure that the database can automatically scale to handle sudden spikes in traffic without downtime. Which feature should they enable?

Accepted Answer

Serverless compute. Serverless compute for Azure SQL Database automatically scales compute resources based on workload demand and pauses the database during idle periods, charging only for consumed resources. This enables handling sudden traffic spikes without downtime because the service dynamically adjusts the vCore count and memory within a configurable range, ensuring continuous availability during bursts.

Answer

Geo-replication

Answer

Active geo-replication

Answer

Elastic pool

Question 8

A company uses Azure to host multiple virtual machines and virtual networks. The network team is responsible for configuring and maintaining virtual networks, subnets, and network security groups. The company wants to ensure that the network team can manage these network resources but cannot modify or delete virtual machines. Which Azure built-in role should the company assign to the network team?

Accepted Answer

Network Contributor. The Network Contributor role grants full management permissions for network resources, including virtual networks, subnets, and network security groups, but does not allow modification or deletion of virtual machines. This aligns exactly with the requirement to restrict the network team to network resources only.

Answer

Owner

Answer

Contributor

Answer

Virtual Machine Contributor

Question 9

A company wants to ensure their application remains available even if an entire Azure region experiences an outage. Which Azure feature should they implement?

Accepted Answer

Region pairs. Region pairs are designed to provide resilience against a complete Azure region outage by pairing each region with another region in the same geography (e.g., East US paired with West US). If one region fails, Azure can fail over services like storage (GRS) and SQL Database (Geo-Replication) to the paired region, ensuring application availability. This is the only option that protects against an entire region failure, as it leverages physically separate datacenters with independent power, cooling, and networking.

Answer

Availability sets

Answer

Availability zones

Answer

Load balancer

Question 10

A company wants to view a consolidated list of all Azure resources across multiple subscriptions and query them using Kusto Query Language (KQL). Which Azure tool should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct tool because it provides a powerful, queryable view of all Azure resources across multiple subscriptions using Kusto Query Language (KQL). It allows you to explore, discover, and analyze resource properties and relationships at scale, making it ideal for consolidated inventory and governance queries.

Answer

Azure Resource Manager

Answer

Azure Monitor

Answer

Azure Policy

Question 11

A global company creates a new Azure subscription for each major project. To ensure compliance and consistency, the governance team needs a single, versioned, auditable package that, when assigned to a subscription, automatically deploys a standard set of Azure Policy assignments, role assignments, a resource group structure, and a pre-configured virtual network. The solution must allow these packages to be updated centrally and have changes tracked for auditing. Which Azure service should the governance team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it provides a single, versioned, auditable package that can be assigned to a subscription to orchestrate the deployment of Azure Policy assignments, role assignments, resource groups, and resource templates (like a virtual network). Blueprints support versioning and central update management, with changes tracked in the blueprint definition history for auditing. This aligns exactly with the requirement for a governance team to enforce compliance and consistency across subscriptions.

Answer

Azure Policy

Answer

Azure Resource Manager templates

Answer

Management groups

Question 12

A company wants to enforce a naming convention for all Azure resources. For example, all resources must start with 'Contoso-'. They want to automatically audit and deny creation of resources that do not follow the naming convention. Which Azure Policy effect should they use?

Accepted Answer

Deny. The Deny effect is correct because it actively prevents the creation of Azure resources that do not match the defined naming convention rule, such as requiring all resources to start with 'Contoso-'. This effect evaluates the resource against the policy rule during deployment and rejects the request with a 403 Forbidden status if the condition is not met, ensuring compliance before the resource is created.

Answer

Audit

Answer

Modify

Answer

Append

Question 13

A company wants to ensure that its cloud resources are available even if a major disaster occurs in one region. They plan to deploy resources in two different geographic locations. Which cloud computing characteristic does this scenario primarily address?

Accepted Answer

D) Disaster recovery. Option D (Disaster recovery) is correct because the scenario explicitly describes deploying resources in two different geographic locations to ensure availability despite a major regional disaster. Disaster recovery (DR) focuses on restoring services and data after a catastrophic failure, often using paired regions (e.g., Azure paired regions) to provide geo-redundancy and failover capabilities. This goes beyond simple uptime guarantees to address full recovery from region-level outages.

Answer

A) Scalability

Answer

B) Elasticity

Answer

C) High availability

Question 14

A company wants to segregate their Azure resources into logical groups based on department and environment. They also want to apply access control and management at these group levels. Which Azure construct should they use?

Accepted Answer

Resource groups. Resource groups are logical containers in Azure that allow you to group related resources (e.g., VMs, databases, storage) by department and environment. They enable you to apply access control via Azure RBAC and management policies (e.g., tags, locks) at the group level, ensuring consistent governance across all resources within the group.

Answer

Availability sets

Answer

Virtual networks

Answer

Subscriptions

Question 15

A financial services company runs a critical trading application in its on-premises data center. The company is migrating some workloads to Azure and requires a dedicated, private network connection between its on-premises network and Azure. The connection must not use the public internet, must provide consistent latency and higher bandwidth than a typical internet-based VPN, and must be backed by a service-level agreement (SLA) for availability. Which Azure service should the company use to meet these requirements?

Accepted Answer

ExpressRoute. ExpressRoute is the correct choice because it provides a dedicated, private connection between on-premises networks and Azure that bypasses the public internet entirely. This ensures consistent latency, higher bandwidth options (up to 100 Gbps), and a financially backed SLA of at least 99.95% availability, meeting all the stated requirements for a critical trading application.

Answer

Azure VPN Gateway

Answer

Azure Firewall

Answer

Azure Front Door

Question 16

A company wants to query all Azure resources across multiple subscriptions to find all storage accounts without encryption enabled. They need to use a powerful query language to filter and join data. Which Azure tool should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph (ARG) is the correct tool because it provides a powerful, Kusto Query Language (KQL)-based query engine that can explore Azure resources across multiple subscriptions, resource groups, and management groups. It allows you to filter, project, and join resource data (e.g., find all storage accounts where encryption is disabled) using a single query, making it ideal for cross-subscription resource discovery and compliance checks.

Answer

Azure Monitor Logs

Answer

Azure Advisor

Answer

Azure Policy

Question 17

A company wants to ensure that their cloud provider's physical data centers are located in specific geographic areas to comply with data residency requirements. Which cloud concept is this related to?

Accepted Answer

Data sovereignty. Data sovereignty is the concept that data is subject to the laws and regulations of the country or region where it is physically stored. By ensuring their cloud provider's data centers are located in specific geographic areas, the company is directly addressing data sovereignty requirements to comply with local data residency laws, such as GDPR in Europe or the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada.

Answer

Availability

Answer

Disaster recovery

Answer

Hybrid cloud

Question 18

A financial services firm uses a hybrid cloud strategy. They run customer-facing applications in a public cloud and store sensitive customer data in an on-premises data center to meet regulatory compliance. The firm wants to allow its applications in the public cloud to securely access the on-premises data when needed. Which cloud deployment model best describes this setup?

Accepted Answer

Hybrid cloud. Option C is correct because the scenario describes a hybrid cloud deployment model, which combines a public cloud (for customer-facing applications) with an on-premises private cloud (for sensitive data storage) and enables secure connectivity between them, typically through VPN or dedicated circuits like Azure ExpressRoute. This allows the firm to meet regulatory compliance by keeping sensitive data on-premises while leveraging public cloud scalability for applications.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 19

A development team lead needs to quickly provision a new Azure virtual machine for a short-term testing project. Instead of submitting a ticket to the IT procurement team and waiting several days for hardware approval and setup, the lead directly signs into the Azure portal, configures the VM settings, and has it running within 15 minutes. The entire process required no human interaction from the cloud provider's staff. Which cloud computing characteristic does this scenario primarily demonstrate?

Accepted Answer

On-demand self-service. The scenario demonstrates on-demand self-service because the development team lead was able to provision and configure an Azure virtual machine directly through the Azure portal without any human interaction from Microsoft's staff. This characteristic allows users to automatically obtain computing resources, such as VM time and storage, as needed without requiring manual approval or provisioning from the cloud provider's IT team.

Answer

Broad network access

Answer

Measured service

Answer

Resource pooling

Question 20

A company wants to ensure that all new Azure storage accounts have a specific encryption setting enabled. They also want to automatically remediate any existing non-compliant storage accounts without manual effort. Which Azure Policy effect should they use?

Accepted Answer

DeployIfNotExists. DeployIfNotExists is the correct effect because it not only evaluates the compliance of storage accounts against the encryption policy but also automatically deploys a remediation task (e.g., enabling encryption via a linked ARM template or Azure function) to bring non-compliant resources into compliance without manual intervention. This effect is specifically designed for scenarios where the resource itself needs to be modified or configured to meet the policy requirement.

Answer

Append

Answer

AuditIfNotExists

Answer

Deny