AZ-900 Practice Questions 2 — 50 Questions

Question 1

A development team needs to quickly provision a new virtual machine for a short-term testing environment. The team uses the Azure portal to create the VM without submitting a request to the IT operations team or waiting for any manual approval. The VM is provisioned and available within minutes. Which cloud computing characteristic does this scenario best represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

On-demand self-service. The scenario describes the development team provisioning a virtual machine directly through the Azure portal without any manual approval or intervention from IT operations. This is the essence of on-demand self-service, a core cloud computing characteristic defined by NIST SP 800-145, where a consumer can unilaterally provision computing capabilities as needed automatically without requiring human interaction with each service provider.

Answer

Rapid elasticity

Answer

Measured service

Answer

Resource pooling

Question 2

What is Microsoft's definition of 'cloud computing' as used in the context of Azure?

Accepted Answer

Delivery of computing services over the internet with flexible, pay-as-you-go pricing. Microsoft defines cloud computing as the delivery of computing services—including servers, storage, databases, networking, software, analytics, and intelligence—over the internet (the cloud) with flexible, pay-as-you-go pricing. This definition is foundational to Azure, enabling customers to scale resources up or down as needed and only pay for what they use, rather than investing in and maintaining physical infrastructure.

Answer

Storing all data on physical servers in the customer's own building

Answer

Using only virtual machines in a third-party data center

Answer

A type of software that runs in web browsers without installation

Question 3

What does 'disaster recovery' mean in cloud computing, and how does Azure support it?

Accepted Answer

The ability to restore systems and data after a major outage, supported by services like Azure Site Recovery. Disaster recovery (DR) in cloud computing refers to the strategies and processes used to restore IT systems and data after a catastrophic failure, such as a natural disaster or large-scale outage. Azure supports DR primarily through Azure Site Recovery (ASR), which orchestrates replication, failover, and failback of virtual machines and workloads between Azure regions or from on-premises to Azure, ensuring business continuity with defined recovery point objectives (RPO) and recovery time objectives (RTO).

Answer

Disaster recovery means the cloud never experiences any failures

Answer

Disaster recovery is only relevant for on-premises systems

Answer

Azure automatically protects all data with no configuration required

Question 4

A company is migrating its on-premises infrastructure to Azure. In the past, to provision a new server, the IT team had to submit a formal request to the data center operations team. The operations team would then procure hardware, install the operating system, configure networking, and make the server available. This process often took several weeks. After migrating to Azure, a developer can log into the Azure portal, select a virtual machine configuration, and have it provisioned and running within minutes, without any need to interact with Azure support or operations staff. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

On-demand self-service. The scenario describes a developer provisioning a virtual machine directly through the Azure portal without any human intervention from IT or operations staff. This aligns with the cloud characteristic of on-demand self-service, where users can provision and manage computing resources as needed automatically, without requiring manual approval or interaction with service providers.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

Measured service

Question 5

Which Azure compute service lets you run containers without managing any virtual machine infrastructure, paying only for CPU and memory used while the container runs?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is a serverless container service that allows you to run containers directly on Azure without provisioning or managing any underlying virtual machines. You are billed per second based on the CPU and memory resources consumed while the container is running, making it ideal for burst or short-lived workloads.

Answer

Azure Kubernetes Service

Answer

Azure App Service

Answer

Azure Batch

Question 6

Which Azure service provides managed hosting for Hadoop ecosystems including HDFS, Hive, HBase, and Spark?

Accepted Answer

Azure HDInsight. Azure HDInsight is the correct answer because it is a fully managed, open-source analytics service specifically designed for running popular Hadoop ecosystems such as HDFS, Hive, HBase, and Spark on Azure. It provides pre-configured clusters with these components, allowing you to process large-scale data workloads without manual infrastructure management.

Answer

Azure Databricks

Answer

Azure Synapse Analytics

Answer

Azure Data Factory

Question 7

A company has multiple Azure subscriptions for different departments. The IT team wants to ensure that all resources in a specific subscription are only deployed in the 'West Europe' region. Which Azure feature should they use to enforce this restriction?

Accepted Answer

Azure Policy. Azure Policy is correct because it allows you to create, assign, and manage policies that enforce specific rules or effects on your resources. By defining a policy that restricts allowed locations to 'West Europe' and assigning it to the subscription scope, Azure Policy will deny or audit any resource deployment that does not comply with this geographic restriction.

Answer

Azure RBAC

Answer

Azure Blueprints

Answer

Azure Resource Graph

Question 8

A company hosts a public-facing e-commerce website on Azure virtual machines deployed in two Azure regions (East US and West Europe). The company wants to automatically route users to the region that provides the lowest network latency based on their geographic location. The solution must use DNS-based traffic routing and does not require terminating HTTP traffic at the load balancer. Which Azure service should the company use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming DNS requests to the most appropriate endpoint based on the traffic-routing method selected. The 'Performance' routing method directs users to the region with the lowest network latency, and because it operates at the DNS level, it does not terminate HTTP traffic, meeting all stated requirements.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure Load Balancer

Question 9

A company has a critical Azure resource group that contains all production virtual machines and databases. The IT security administrator wants to ensure that no user, including members of the 'Owner' role, can accidentally or intentionally delete this resource group. The solution must not prevent modification of resources inside the resource group. The administrator needs to apply a governance control at the resource group level. What should the administrator do?

Accepted Answer

Apply a 'CanNotDelete' lock on the resource group.. Applying a 'CanNotDelete' lock at the resource group level prevents any user, including those with the Owner role, from deleting the resource group while still allowing modifications (e.g., adding or updating resources) inside it. This lock overrides all RBAC permissions for delete operations, making it the appropriate governance control for this requirement.

Answer

Apply a 'ReadOnly' lock on the resource group.

Answer

Assign a custom RBAC role that denies delete actions at the resource group scope.

Answer

Move the resource group to a separate subscription with billing separation.

Question 10

A company has a single Azure subscription that contains resource groups for several business units. The company's compliance team wants to enforce a rule: no virtual network (VNet) can be deployed in any resource group unless the VNet is in a specific allowed region (West Europe). The rule must also block the creation of VNets in disallowed regions, but the team must be able to selectively exempt certain resource groups (e.g., for disaster recovery testing) without altering the underlying rule definition. Which Azure feature should the compliance team implement?

Accepted Answer

Azure Policy with the 'Deny' effect assigned to the subscription, and create policy exemptions for the resource groups that need to deploy VNets in other regions.. Azure Policy with the 'Deny' effect can enforce a rule at the subscription scope that blocks VNet creation in disallowed regions. Policy exemptions allow specific resource groups to be excluded from the policy without modifying the original rule definition, meeting the compliance team's requirement for selective exemption.

Answer

Azure role-based access control (RBAC) by creating a custom role that restricts the 'Microsoft.Network/virtualNetworks/write' action to only the West Europe region, and assign that role to all users.

Answer

A resource lock on each resource group that prevents the creation of any resource in disallowed regions.

Answer

Azure Blueprints by defining a blueprint that only includes VNets in West Europe and assigning it to all resource groups.

Question 11

A company has a root management group that contains all Azure subscriptions. A centralized governance team needs to create and assign Azure Policy definitions and set initiatives that apply to all subscriptions. Which built-in role should be assigned to the governance team at the root management group scope to grant the minimum required permissions?

Accepted Answer

Policy Contributor. The Policy Contributor built-in role grants the minimum required permissions to create and assign Azure Policy definitions and initiatives, including the ability to read policy assignments and manage policy resources, without granting full write access to all resources. Assigning this role at the root management group scope ensures the governance team can apply policies across all subscriptions while adhering to the principle of least privilege.

Answer

Owner

Answer

Contributor

Answer

Security Admin

Question 12

A multinational company has a strict data residency requirement: all Azure virtual machines must be deployed only in the East US or West Europe Azure regions. The IT governance team wants to enforce this rule automatically so that any attempt to create a virtual machine in any other region is blocked immediately at the time of deployment. Users must receive a clear error message if they try to create a VM in a disallowed region. Which Azure feature should the governance team configure to meet this requirement?

Accepted Answer

Configure an Azure Policy with the Deny effect assigned to the subscription scope.. Azure Policy with the Deny effect is the correct choice because it enforces organizational rules by evaluating resource properties during deployment and blocking any non-compliant request. In this scenario, a policy can be defined to deny virtual machine creation in any region other than East US or West Europe, and the Deny effect ensures the deployment fails with a clear error message, meeting the real-time enforcement requirement.

Answer

Create a resource lock on the subscription to prevent all resource creation.

Answer

Assign an Azure RBAC role that denies create permissions for VMs in disallowed regions.

Answer

Set up a budget alert in Cost Management to notify when a VM is created in a disallowed region.

Question 13

A company operates a hybrid IT environment with virtual machines running on-premises and in Amazon Web Services (AWS). The company also has a growing number of resources in Microsoft Azure. To simplify management, the company wants to use a single Azure service to apply Azure Policy definitions and enable unified inventory and tagging across all virtual machines, regardless of their location. Which Azure service should the company use?

Accepted Answer

Azure Arc. Azure Arc extends Azure Resource Manager (ARM) and Azure Policy to non-Azure environments, including on-premises and AWS virtual machines. By installing the Azure Connected Machine agent on each VM, the company can apply Azure Policy definitions and use unified inventory and tagging across all VMs from a single Azure control plane.

Answer

Azure Resource Manager

Answer

Azure Blueprints

Answer

Azure Management Groups

Question 14

A hospital is migrating patient data to the cloud. The hospital is responsible for managing who can access the data and for encrypting the data before upload. The cloud provider is responsible for securing the physical datacenters, network infrastructure, and hypervisor. This division of security responsibilities is described by which model?

Accepted Answer

Shared responsibility model. The shared responsibility model defines the division of security obligations between the cloud provider and the customer. In this scenario, the hospital (customer) is responsible for identity and access management (IAM) and data encryption at rest and in transit, while the cloud provider secures the physical datacenter, network infrastructure, and hypervisor. This clear separation of duties is the core of the shared responsibility model, which varies by service model (IaaS, PaaS, SaaS).

Answer

Defense in depth

Answer

Principle of least privilege

Answer

Zero trust model

Question 15

A company deploys a critical application across two Azure regions for disaster recovery. They want to automatically failover traffic to the secondary region if the primary becomes unavailable. They also want to improve performance by routing users to the closest region. Which Azure service should they use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic optimally to services across global Azure regions. It supports the 'Priority' routing method for automatic failover to a secondary region when the primary is unavailable, and the 'Performance' routing method to direct users to the closest region for improved latency. This combination directly meets the stated requirements for disaster recovery failover and performance-based routing.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure VPN Gateway

Question 16

A company has 15 Azure subscriptions organized under multiple management groups. The security team has defined a standard set of 8 Azure Policy definitions that must be applied to every subscription. These definitions enforce required tags, deny creation of public IPs, require encryption for storage accounts, and restrict VM SKUs. The team wants to assign these policies as a single entity to simplify management and ensure consistent compliance. What should the team create and assign?

Accepted Answer

An Azure Policy initiative (policy set definition) containing the policy definitions. An Azure Policy initiative (policy set definition) allows grouping multiple individual policy definitions into a single set, which can then be assigned as one entity. This simplifies management and ensures consistent compliance across all subscriptions, as the security team requires. Assigning the initiative at the root management group applies it to all 15 subscriptions under the management groups.

Answer

An Azure Blueprint containing the policy definitions

Answer

An Azure Policy assignment for each individual definition at the root management group

Answer

An Azure Resource Manager template that deploys the policy definitions

Question 17

What is the shared responsibility model in cloud computing?

Accepted Answer

A framework dividing security responsibilities between the cloud provider and the customer. The shared responsibility model defines the division of security and compliance obligations between the cloud provider and the customer. The provider is responsible for the security 'of' the cloud (physical hosts, network, hypervisor), while the customer is responsible for security 'in' the cloud (data, access management, OS configuration). This division varies by service model (IaaS, PaaS, SaaS), but the core principle is that security is a shared, not transferred, responsibility.

Answer

The provider and customer each pay half the cost of cloud services

Answer

An agreement where customers share their infrastructure with other cloud users

Answer

A service where two cloud providers share management of customer workloads

Question 18

A company's IT manager is evaluating a public cloud provider. The provider's data center contains powerful physical servers that host virtual machines from thousands of different organizations. The manager is concerned about security, but the provider assures that each organization's VMs are logically isolated and cannot access each other's data, even though they share the same hardware. Which essential characteristic of cloud computing does this scenario best describe?

Accepted Answer

Resource pooling. The scenario describes resource pooling because the provider's physical servers host VMs from multiple organizations, and logical isolation ensures each tenant's data remains separate. Resource pooling is the cloud characteristic where computing resources (e.g., storage, processing, memory) are aggregated to serve multiple customers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to demand. The provider's assurance of logical isolation (e.g., via hypervisor-level segmentation or VLANs) is a direct implementation of resource pooling's security boundary.

Answer

Rapid elasticity

Answer

Measured service

Answer

Broad network access

Question 19

A company wants to deploy a virtual machine in Azure and needs to ensure that the VM is placed in a location that provides the lowest network latency to its users in Europe. Which Azure construct should they consider to meet this requirement?

Accepted Answer

Azure region. Azure regions are geographically discrete data center groupings that provide low-latency connectivity to users within that region. By deploying the VM in a Europe-based region (e.g., West Europe or North Europe), the company ensures the shortest physical distance and network path to its European users, minimizing latency. Availability zones, resource groups, and management groups do not influence geographic placement or network latency.

Answer

Azure availability zone

Answer

Azure resource group

Answer

Azure management group

Question 20

Which Azure storage redundancy option replicates data synchronously across three availability zones within a single region?

Accepted Answer

Zone-Redundant Storage (ZRS). Zone-Redundant Storage (ZRS) is the correct answer because it synchronously replicates data across three Azure availability zones within a single region, ensuring high durability and availability even if an entire zone fails. This meets the exact requirement of the question: synchronous replication across multiple zones in one region.

Answer

Locally Redundant Storage (LRS)

Answer

Geo-Redundant Storage (GRS)

Answer

Geo-Zone-Redundant Storage (GZRS)