AZ-900 Practice Test 12 — 15 Questions

Question 1

A company has a policy that all Azure Storage accounts must have diagnostic settings enabled to send logs and metrics to a specific Log Analytics workspace. The governance team wants to automatically configure these diagnostic settings when a new storage account is created, without blocking the initial creation. The solution must not require manual intervention. Which Azure Policy effect should the team use in their policy definition?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it automatically deploys a remediation task to configure diagnostic settings on storage accounts that lack them, without blocking the initial creation of the resource. This effect evaluates resources after creation and triggers a deployment to bring non-compliant resources into compliance, which aligns with the requirement for automatic configuration without manual intervention.

Answer

Audit

Answer

Deny

Answer

Append

Question 2

A company has a governance requirement that every Azure virtual machine must have a tag named 'CostCenter' with the value 'Unassigned'. If a user creates a VM without the tag, or with a different value for that tag, the tag should be automatically corrected to 'Unassigned' immediately upon resource creation. The IT team is writing an Azure Policy definition to enforce this. Which Policy effect should they use?

Accepted Answer

Modify. The Modify effect is correct because it automatically corrects non-compliant tags (missing or wrong value) to the specified value ('Unassigned') during resource creation or update, without blocking the deployment. This satisfies the requirement for immediate, automatic remediation without denying the VM creation entirely.

Answer

Deny

Answer

Audit

Answer

DeployIfNotExists

Question 3

A company has created an Azure Blueprint to define a standard environment with role assignments and policies. They have published multiple versions. They want all existing subscriptions that were created from an older version to automatically receive the updates from the latest version. What should they do?

Accepted Answer

Upgrade the blueprint assignment on the existing subscriptions. Option B is correct because Azure Blueprints allow you to update assignments on existing subscriptions to the latest published version. When you upgrade the blueprint assignment, it applies any new role assignments, policies, or artifacts defined in the newer version to the target subscriptions, ensuring they remain compliant with the updated standard environment.

Answer

Create a new subscription from the latest blueprint version

Answer

Reassign the blueprint to the subscriptions

Answer

Nothing, updates apply automatically

Question 4

A company has an Azure Policy assignment that denies the creation of any virtual machine (VM) that does not have a mandatory 'CostCenter' tag. A development team needs to deploy a temporary test VM without the required tag for a short-term experiment. The governance team wants to allow this specific exception while recording the reason for the exception, ensuring the policy is still enforced for all other resources. The exception must also automatically expire after 30 days. Which Azure Policy feature should the governance team use?

Accepted Answer

Exemption. Azure Policy Exemption allows the governance team to create a specific exception for the test VM while recording the reason and setting an automatic expiration date (30 days). Unlike exclusion scopes, exemptions are explicitly designed to handle scenarios where a resource should be excluded from policy evaluation with a defined justification and expiry, ensuring the policy remains enforced for all other resources.

Answer

Exclusion scope

Answer

Audit effect

Answer

Override effect

Question 5

A bank needs to keep some sensitive customer data on-premises due to regulatory requirements, but wants to use cloud services for less sensitive workloads. Which cloud deployment model should they adopt?

Accepted Answer

Hybrid cloud. A hybrid cloud model combines on-premises infrastructure (private cloud) with public cloud services, allowing the bank to keep sensitive customer data on-premises to meet regulatory requirements while using the public cloud for less sensitive workloads. This approach provides a unified management plane and secure connectivity (e.g., VPN or Azure ExpressRoute) between the two environments, ensuring compliance and flexibility.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 6

A company has multiple Azure subscriptions. The finance team needs to analyze spending trends and create budgets to prevent cost overruns. Which Azure tool should they use to visualize historical spending and set budget alerts?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing is the correct tool because it provides native capabilities for analyzing historical spending trends, creating budgets, and setting cost-based alerts. It integrates directly with Azure's billing data to visualize costs across subscriptions and resource groups, and its budget alerts can trigger actions (e.g., email notifications or automation runbooks) when spending exceeds defined thresholds.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Monitor

Question 7

A company has a resource group named 'RG-Prod' that contains critical virtual machines (VMs), virtual networks, and a SQL database. The infrastructure team needs to grant a group of developers the ability to start, stop, and restart only the VMs in RG-Prod. The developers must not be able to create new VMs, delete existing VMs, modify the virtual networks, or access the database. The company wants to follow the principle of least privilege. Which Azure role-based access control (RBAC) approach should the company use?

Accepted Answer

Create a custom RBAC role that includes only the specific actions required (e.g., Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action) and assign it to the developers.. Option B is correct because the principle of least privilege requires granting only the exact permissions needed. The built-in Virtual Machine Contributor role includes permissions beyond start/stop/restart (e.g., it allows creating and deleting VMs), which violates the requirement. A custom RBAC role scoped to RG-Prod with only the specific actions (Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/restart/action) meets the need precisely.

Answer

Assign the Virtual Machine Contributor built-in role to the developers.

Answer

Assign the Contributor built-in role and then create an Azure Policy to deny any VM creation or deletion and VNet modifications in RG-Prod.

Answer

Assign the Reader role to the developers and use Azure Policy to automatically start, stop, and restart VMs on their behalf.

Question 8

A company has an on-premises data center with a site-to-site VPN connection to Azure. The company wants to ensure that the connection remains secure by encrypting all traffic between the on-premises network and Azure virtual network. The connection must be established over the public internet. Which Azure service should the company use to create this encrypted tunnel?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct service because it creates an encrypted site-to-site VPN tunnel over the public internet using IPsec/IKE protocols. This meets the requirement for a secure connection between the on-premises data center and Azure virtual network over the public internet.

Answer

Azure ExpressRoute

Answer

Azure Virtual WAN

Answer

Azure Bastion

Question 9

A company deploys two Azure virtual machines (VMs) into the same availability set. The first VM runs a web server and the second runs a database server. The company's primary concern is that during Azure platform maintenance events (e.g., OS updates to the underlying host) or in the event of a hardware failure in the datacenter, both VMs should not be impacted at the same time. Which benefit does placing the VMs in the same availability set provide?

Accepted Answer

The VMs will be distributed across different fault domains and update domains within the datacenter.. An availability set ensures that VMs are distributed across different fault domains (separate power, cooling, and network racks) and update domains (groups that are updated sequentially during planned maintenance). This isolation guarantees that a hardware failure or a platform maintenance event will not affect both VMs simultaneously, meeting the company's primary concern.

Answer

Both VMs will be placed on the same physical server for performance consistency.

Answer

The VMs will be automatically load-balanced and scaled based on CPU usage.

Answer

The VMs will be replicated to a second Azure region for disaster recovery.

Question 10

A company has deployed several Windows and Linux virtual machines in an Azure virtual network. For security reasons, the virtual machines have no public IP addresses assigned. The IT administrators need to securely connect to these VMs using Remote Desktop Protocol (RDP) for Windows and Secure Shell (SSH) for Linux without deploying any additional agents on the VMs. The connection must be established directly from the Azure portal, and the service must provide protection against port scanning and brute-force attacks. Which Azure service should the company use?

Accepted Answer

Azure Bastion. Azure Bastion is the correct choice because it provides secure, seamless RDP and SSH connectivity to virtual machines directly from the Azure portal over TLS, without requiring any public IP addresses on the VMs or additional agent installations. It uses a hardened bastion host inside the virtual network, and by default it protects against port scanning and brute-force attacks by not exposing the VMs' RDP/SSH ports to the internet.

Answer

Just-in-time (JIT) VM access (Microsoft Defender for Cloud)

Answer

Azure Firewall

Answer

Azure VPN Gateway

Question 11

A company has an Azure Policy assigned to all subscriptions that denies creation of any resource without a 'CostCenter' tag. During an emergency, a team needs to create a resource without the tag. They want a temporary exception without changing the policy. What should they create?

Accepted Answer

Policy exemption. A Policy exemption allows you to create an exception for a specific resource or subscription without modifying the underlying policy definition. In this scenario, the team can request an exemption (e.g., 'Emergency' or 'Waiver' category) to bypass the 'CostCenter' tag requirement temporarily, while the policy remains enforced for all other resources.

Answer

Policy initiative

Answer

Role assignment

Answer

Blueprint

Question 12

A company has an Azure policy requirement that all new resources in a specific resource group must have a 'Department' tag. If a resource is created without this tag, the tag should be automatically added with a default value of 'Finance'. Which Azure Policy effect should be used?

Accepted Answer

Append. The Append effect is correct because it allows Azure Policy to automatically add a 'Department' tag with a default value of 'Finance' to any resource created without it in the specified resource group. This effect modifies the resource during creation or update to enforce compliance without blocking the operation.

Answer

Deny

Answer

Audit

Answer

Modify

Question 13

A company has multiple Azure subscriptions, each belonging to a different department. The finance department wants to set spending limits per subscription and receive automated email notifications whenever actual spending reaches 80% of the allocated budget. Which Azure feature should they configure?

Accepted Answer

Azure Budgets. Azure Budgets is the correct feature because it allows you to set spending limits (budgets) on Azure subscriptions or resource groups and configure alerts that trigger automated email notifications when actual spending reaches a specified threshold, such as 80% of the allocated budget. This directly meets the finance department's requirement for per-subscription spending limits and proactive notifications.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Resource Graph

Question 14

A company has an on-premises datacenter with critical line-of-business applications. They plan to migrate some workloads to Azure but need a reliable, high-bandwidth, and low-latency connection that does not traverse the public internet. The connection must be dedicated and guaranteed for a consistent network experience. Which Azure service should the company use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated, private connection from on-premises to Azure that does not traverse the public internet, offering higher reliability, lower latency, and higher bandwidth than internet-based connections. This meets the requirement for a guaranteed, consistent network experience for critical line-of-business applications.

Answer

Azure VPN Gateway (site-to-site)

Answer

Azure Virtual WAN

Answer

Azure Bastion

Question 15

A company currently runs its IT operations entirely on-premises. The finance team is evaluating moving to Azure and wants to understand the financial impact. They currently purchase new servers every five years as a large upfront capital expenditure (CapEx). In Azure, they would pay a fixed monthly subscription for virtual machines instead. This shift from a large upfront payment to a smaller monthly operational expense (OpEx) is a direct illustration of which cloud computing benefit?

Accepted Answer

Consumption-based pricing (OpEx model). Option D is correct because the shift from a large upfront capital expenditure (CapEx) for on-premises servers to a fixed monthly operational expense (OpEx) for Azure virtual machines directly illustrates the consumption-based pricing model. This model allows organizations to pay only for the resources they use, converting large, infrequent costs into predictable, smaller monthly payments. It is a fundamental cloud benefit that aligns with the OpEx financial model, enabling better cash flow management and budget forecasting.

Answer

Elasticity

Answer

High availability

Answer

Predictable performance