AZ-900 Practice Test 13 — 15 Questions

Question 1

A company wants to run a containerized application quickly without managing any virtual machines or orchestration infrastructure. They just need to start a container and have it run. Which Azure service is best suited for this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it provides a serverless container platform that allows you to run a container directly without managing any underlying virtual machines or orchestration infrastructure. You simply specify the container image and resource requirements, and ACI launches the container in seconds, making it ideal for quick, isolated container workloads.

Answer

Azure Kubernetes Service

Answer

Azure App Service

Answer

Azure Functions

Question 2

What is the purpose of the Azure portal?

Accepted Answer

A web-based graphical interface for managing all Azure services and resources. The Azure portal is a web-based, unified console that provides a graphical user interface (GUI) for provisioning, configuring, monitoring, and managing all Azure services and resources. It is built on HTML5 and JavaScript, allowing users to perform administrative tasks without needing to write code or use command-line tools.

Answer

A command-line tool for automating Azure resource management

Answer

A development environment for writing and testing Azure code

Answer

A marketplace for purchasing third-party software

Question 3

A company needs a globally distributed, multi-master database that guarantees less than 10 milliseconds latency for reads and writes regardless of geographic location. Which Azure service should they use?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it is a globally distributed, multi-master database service that offers turnkey global distribution, single-digit millisecond latency (less than 10 ms) for both reads and writes at any scale, and supports multiple consistency models. Its multi-master capability allows any region to accept writes, which is essential for the stated requirement of low-latency writes regardless of geographic location.

Answer

Azure SQL Database with geo-replication

Answer

Azure Cache for Redis

Answer

Azure Database for PostgreSQL with read replicas

Question 4

A company has a management group hierarchy: Root (tenant root group) > Contoso > Sales, Marketing. They want to assign an Azure policy that applies to all subscriptions under the Sales and Marketing management groups only. The policy must not affect any other subscriptions in the hierarchy. Where should they assign the policy?

Accepted Answer

Assign the policy separately at both the Sales and Marketing management groups.. Azure Policy assignments are inherited by all child resources within the scope where the policy is assigned. To restrict the policy to only the Sales and Marketing management groups without affecting other subscriptions under Contoso, you must assign the policy separately to each of those two management groups. Assigning at a higher scope (e.g., Contoso or Root) would cause the policy to apply to all subscriptions under that scope, including any other child management groups or subscriptions.

Answer

At the Root management group.

Answer

At the Contoso management group.

Answer

At the Sales management group only.

Question 5

A company wants to query all Azure resources across multiple subscriptions to find all storage accounts without encryption enabled. They need to use a powerful query language to filter and join data. Which Azure tool should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph (ARG) is the correct tool because it provides a powerful, Kusto Query Language (KQL)-based query engine that can explore Azure resources across multiple subscriptions, resource groups, and management groups. It allows you to filter, project, and join resource data (e.g., find all storage accounts where encryption is disabled) using a single query, making it ideal for cross-subscription resource discovery and compliance checks.

Answer

Azure Monitor Logs

Answer

Azure Advisor

Answer

Azure Policy

Question 6

Which Azure network security service filters network traffic to and from Azure resources using rules based on source, destination, port, and protocol?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) are the correct answer because they filter network traffic to and from Azure resources at the subnet or network interface level using rules that specify source, destination, port, and protocol. NSGs operate as a distributed, stateful firewall that evaluates each packet against a set of allow or deny rules, making them the primary tool for granular network traffic control within a virtual network.

Answer

Azure Firewall

Answer

Azure DDoS Protection

Answer

Azure WAF

Question 7

Which Azure feature allows you to save money on Azure SQL Database and Azure SQL Managed Instance using existing on-premises SQL Server licenses?

Accepted Answer

Azure Hybrid Benefit. Azure Hybrid Benefit allows you to use your existing on-premises SQL Server licenses with Software Assurance to reduce the cost of Azure SQL Database and Azure SQL Managed Instance. By applying this benefit, you pay only for the underlying compute infrastructure at the base compute rate, effectively saving up to 55% on SQL licensing costs. This is specifically designed to maximize value from existing license investments when migrating to Azure.

Answer

Azure Reserved Instances

Answer

Azure Spot VMs

Answer

Azure Dev/Test pricing

Question 8

Which Azure service provides compliance documentation, audit reports, and regulatory certifications to help organizations meet their own compliance obligations?

Accepted Answer

Microsoft Service Trust Portal. The Microsoft Service Trust Portal (STP) is the dedicated Azure service that provides access to compliance documentation, audit reports, and regulatory certifications. It aggregates detailed information about Microsoft's security and compliance practices, including ISO 27001, SOC 2, and FedRAMP reports, enabling organizations to verify Azure's adherence to standards and fulfill their own compliance obligations.

Answer

Azure Policy compliance dashboard

Answer

Microsoft Defender for Cloud

Answer

Azure Security Center

Question 9

Which Azure storage tier should be used for data that is rarely accessed, can tolerate several hours of retrieval latency, and needs to be stored at the lowest cost?

Accepted Answer

Archive tier. The Archive tier is designed for data that is rarely accessed and can tolerate several hours of retrieval latency, offering the lowest storage cost among Azure Blob Storage tiers. It requires rehydration to a Hot or Cool tier before reading, which typically takes up to 15 hours, making it ideal for long-term backup, archival, and compliance data.

Answer

Hot tier

Answer

Cool tier

Answer

Premium tier

Question 10

Which Azure database service is specifically optimized for running open-source MariaDB workloads as a fully managed service?

Accepted Answer

Azure Database for MariaDB. Azure Database for MariaDB is the correct answer because it is a fully managed relational database service specifically built for the MariaDB community edition, offering high availability, automated backups, and scaling. It uses the same wire protocol as MySQL but is tailored to MariaDB's specific engine features and versioning, such as support for the Aria storage engine and Galera cluster replication.

Answer

Azure Database for MySQL

Answer

Azure SQL Database

Answer

Azure Cosmos DB

Question 11

A company is evaluating moving its on-premises applications to the cloud. The IT manager wants to avoid upfront hardware costs and instead pay for resources on a monthly basis based on usage. Which cloud characteristic enables this financial model?

Accepted Answer

Consumption-based pricing. Consumption-based pricing is the cloud characteristic that allows organizations to pay only for the resources they actually use, such as compute hours, storage GBs, or data transfer, without any upfront hardware costs. This model shifts IT spending from a capital expenditure (CapEx) to an operational expenditure (OpEx), aligning costs directly with usage. The IT manager's requirement to avoid upfront costs and pay monthly based on usage is the exact definition of consumption-based pricing.

Answer

Measured service

Answer

Rapid elasticity

Answer

Resource pooling

Question 12

A company wants to run a containerized application in Azure without managing the underlying virtual machines. Which Azure service should they use?

Accepted Answer

B) Azure Kubernetes Service (AKS). Azure Kubernetes Service (AKS) is a managed container orchestration service that abstracts the underlying virtual machines, allowing you to deploy, scale, and manage containerized applications without having to manage the host infrastructure. AKS handles provisioning, upgrading, and patching of the cluster nodes, so you only interact with the control plane and your workloads.

Answer

A) Azure Virtual Machines

Answer

C) Azure App Service

Answer

D) Azure Functions

Question 13

Which Azure pricing model allows customers to pay less per hour by committing to a 1-year or 3-year term for Azure services like VMs and SQL Database?

Accepted Answer

Azure Reservations. Azure Reservations (also known as Reserved Instances) allow customers to commit to a 1-year or 3-year term for specific Azure services, such as VMs and SQL Database, in exchange for a significant discount (up to 72%) on the pay-as-you-go hourly rate. This pricing model is ideal for workloads with predictable usage, as the upfront commitment lowers the per-hour cost compared to on-demand pricing.

Answer

Pay-as-you-go

Answer

Azure Spot pricing

Answer

Azure Dev/Test pricing

Question 14

Which Azure service allows customers to extend Azure management and governance to non-Azure resources, including on-premises servers and other cloud providers?

Accepted Answer

Azure Arc. Azure Arc is the correct answer because it is specifically designed to extend Azure's management plane and governance policies (such as Azure Policy and Azure RBAC) to resources outside of Azure, including on-premises servers, Kubernetes clusters, and other cloud providers like AWS or GCP. It does this by installing the Azure Connected Machine agent on non-Azure machines, which registers them as Azure resources and enables consistent management through the Azure portal, CLI, and APIs.

Answer

Azure Stack Hub

Answer

Azure ExpressRoute

Answer

Azure VPN Gateway

Question 15

An administrator needs to grant a user the ability to manage virtual machines in a specific resource group but NOT allow them to modify networking or storage. Which approach is BEST?

Accepted Answer

Assign Virtual Machine Contributor role scoped to the resource group. The Virtual Machine Contributor role provides exactly the permissions needed to manage virtual machines, including starting, stopping, and restarting them, but explicitly excludes access to the virtual network and storage account resources. By scoping this role to the specific resource group, the administrator ensures the user cannot modify networking or storage resources outside of the VM's operational scope. This is the most precise and secure approach because it follows the principle of least privilege.

Answer

Assign Owner role at the subscription level

Answer

Assign Contributor role at the resource group level

Answer

Use Azure Policy to restrict the user's actions