AZ-900 Practice Test 13 — 15 Questions

Question 1

A company has three Azure subscriptions: one for the engineering department, one for marketing, and one for finance. The central IT team needs to apply a common set of Azure Policy definitions (e.g., allowed locations for resources) that must be enforced across all three subscriptions. Additionally, each department manager must be able to apply custom policies that only affect their own subscription. The IT team wants to organize the subscriptions into a hierarchy where they can assign the common policy at the top level and delegate custom policy assignment at the subscription level. Which Azure feature should the IT team use to create this hierarchical structure?

Accepted Answer

Management groups. Management groups allow you to create a hierarchical structure of Azure subscriptions, enabling you to assign common Azure Policy definitions (like allowed locations) at a top-level management group that applies to all child subscriptions. Each department subscription can then have its own custom policy assignments, as management groups support inheritance and delegation of policy assignments across the hierarchy.

Answer

Resource groups

Answer

Azure Policy

Answer

Azure role-based access control (RBAC)

Question 2

A company has multiple Azure subscriptions for different development teams. They need to define a repeatable environment that includes a set of Azure policies, role assignments, and resource templates that must be applied to any new subscription created for a project. Which Azure service should they use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it enables the orchestrated deployment of a repeatable environment that includes Azure Policy assignments, role-based access control (RBAC) assignments, and Azure Resource Manager (ARM) template deployments as a single composable artifact. Unlike individual services, Blueprints packages these components together and supports versioning, allowing teams to consistently apply the same governance and resource definitions to any new subscription created for a project.

Answer

Azure Policy

Answer

Azure Resource Manager

Answer

Azure Management Groups

Question 3

A company has two on-premises data centers connected to each other via a high-speed MPLS link. They plan to migrate several critical workloads to Azure. The network team requires a dedicated, private connection from each on-premises site to Azure that does not traverse the public internet. The connection must provide high bandwidth, low latency, and a Service Level Agreement (SLA) for availability. Which Azure service should the network team provision to meet these requirements?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated, private connection from on-premises data centers to Azure that does not traverse the public internet. It offers high bandwidth, low latency, and a financially backed SLA of 99.95% availability, meeting all the stated requirements for critical workloads.

Answer

Azure VPN Gateway (Site-to-Site)

Answer

Azure Virtual WAN

Answer

Azure Application Gateway

Question 4

A company has a management group hierarchy with a root management group that contains all subscriptions. The governance team assigns a built-in Azure Policy initiative 'Allowed Locations' to the root management group with the 'Deny' effect, restricting resource deployment to East US and West US only. After six months, a new regulatory requirement forces the marketing department's subscription (placed under the root) to deploy resources in North Europe for a specific pilot project. The governance team must allow this exception without changing the original policy assignment and without allowing any other subscription to deploy to North Europe. What should the governance team do?

Accepted Answer

Create an Azure Policy exemption for the marketing subscription with 'Exempt' category and specify the policy definition and effect to be excluded.. Option C is correct because Azure Policy exemptions allow you to exclude a specific scope from the effect of a policy assignment without modifying the original assignment. By creating an exemption with the 'Exempt' category on the marketing subscription, the governance team can allow resource deployment to North Europe for that subscription only, while the 'Deny' effect remains enforced for all other subscriptions under the root management group.

Answer

Create a new Azure Policy assignment at the marketing subscription scope with the 'Allowed Locations' initiative set to 'Audit' instead of 'Deny' and include North Europe in the allowed list.

Answer

Create an Azure Blueprint that includes the 'Allowed Locations' policy and assign it to the marketing subscription.

Answer

Assign a custom RBAC role to the marketing subscription that bypasses the policy.

Question 5

A company has 30 Azure subscriptions organized under a single management group. The governance team wants to enforce that all resource groups must have a specific tag 'CostCenter' with a valid value. They create an Azure Policy definition with the 'Deny' effect and assign it to the root management group. However, the development team complains that they have a sandbox subscription where they need to create resource groups without the 'CostCenter' tag for testing. The governance team still wants the policy to apply to all other subscriptions but exempt the sandbox subscription. Which solution should the governance team use?

Accepted Answer

Use a policy exemption on the sandbox subscription with category 'Waiver'.. Option C is correct because Azure Policy exemptions allow specific scopes (like the sandbox subscription) to be excluded from a policy's enforcement while keeping the policy assigned to the parent management group. A 'Waiver' exemption category is used when the intent is to temporarily or permanently exempt a resource from policy evaluation, which fits the governance team's requirement to exempt only the sandbox subscription without altering the policy assignment structure.

Answer

Create a second policy assignment at the sandbox subscription with the 'Disabled' effect.

Answer

Remove the policy assignment from the management group and assign it individually to all subscriptions except the sandbox.

Answer

Configure an Azure Blueprint for the management group and exclude the sandbox subscription.

Question 6

A company has deployed multiple Azure virtual machines for a production workload. The IT administrator wants a centralized list of prioritized recommendations to improve the security, high availability, and cost efficiency of the virtual machines. The administrator also wants to be able to view the potential impact of implementing each recommendation. Which Azure service should the administrator use?

Accepted Answer

Azure Advisor. Azure Advisor is the correct service because it provides a centralized, personalized list of best practice recommendations across five categories: Reliability, Security, Performance, Cost, and Operational Excellence. It specifically offers prioritized recommendations for Azure VMs with an 'Impact' column (High, Medium, Low) that indicates the potential effect of implementing each suggestion, directly matching the administrator's requirement for security, high availability, and cost efficiency improvements with impact visibility.

Answer

Azure Security Center

Answer

Azure Monitor

Answer

Azure Policy

Question 7

A company has multiple on-premises sites that need to connect to Azure over high-throughput, low-latency private connections. They want a dedicated private connection that does not traverse the internet. Which Azure service should they use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated private connection from on-premises sites to Azure that does not traverse the public internet, ensuring high throughput and low latency. It uses a Layer 3 VPN or direct peering via a connectivity provider, bypassing internet-based routing entirely. This makes it ideal for scenarios requiring consistent performance and security for hybrid connectivity.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Peering Service

Question 8

A company has 10 Azure subscriptions organized under two management groups: Production and Non-Production. The governance team needs to enforce a policy that all Azure resources must be deployed only in the East US or West US Azure regions. The policy must apply to every subscription under both management groups, including any new subscriptions added in the future, without requiring separate assignments per subscription. Which Azure feature should the team use to achieve this with the least administrative effort?

Accepted Answer

Assign the 'Allowed Locations' Azure Policy definition to the root management group.. Assigning the 'Allowed Locations' Azure Policy definition to the root management group ensures the policy is inherited by all child management groups (Production and Non-Production) and all subscriptions under them, including any new subscriptions added in the future. This approach requires only a single assignment and minimizes administrative effort compared to per-subscription assignments.

Answer

Assign the 'Allowed Locations' Azure Policy definition to each individual subscription.

Answer

Create a custom Azure RBAC role that restricts the region property and assign it to all users.

Answer

Apply an Azure Resource Manager read-only lock to each subscription.

Question 9

A company has deployed several Azure virtual machines in a virtual network. The security policy requires that administrators must be able to connect to these VMs using Remote Desktop Protocol (RDP) from the Azure portal, but the VMs must not have any public IP addresses assigned. The company wants to minimize management overhead and avoid deploying additional jump-box virtual machines. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure and seamless RDP/SSH connectivity to virtual machines directly from the Azure portal over TLS, without requiring public IP addresses on the VMs. It is a fully managed PaaS service that is deployed inside the virtual network, eliminating the need for a jump-box or additional management overhead. This meets the security policy by ensuring VMs remain isolated from the internet while administrators can still connect via the portal.

Answer

Azure Front Door

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Question 10

A company has traditionally managed on-premises servers for their internal business applications. Setting up a new test environment involves ordering hardware, waiting for delivery, racking, and configuring the OS and applications, which typically takes two to three weeks. The company is migrating their development and testing workloads to Azure. Now, developers can deploy a complete, pre-configured test environment using Azure Resource Manager templates in under two hours. This ability to rapidly provision resources and adapt to changing requirements best illustrates which benefit of cloud computing?

Accepted Answer

Agility. The scenario describes how the company can provision a complete test environment in under two hours using Azure Resource Manager templates, compared to the two-to-three-week on-premises process. This rapid provisioning and ability to quickly adapt to changing requirements is the definition of agility in cloud computing, which focuses on speed, flexibility, and reduced time-to-market for IT resources.

Answer

Scalability

Answer

High availability

Answer

Geographic distribution

Question 11

A company has a management group hierarchy: Root > Europe > Production. They assign a policy at the Root level that denies creation of resources without a tag. Later, they assign a different policy at the Europe level. What is the effective effect on the Production subscription?

Accepted Answer

Both policies apply. Azure Policy is inherited by default from higher-level management groups down to subscriptions. When a policy is assigned at the Root management group, it applies to all child management groups and subscriptions, including the Production subscription. Assigning an additional policy at the Europe management group does not remove or override the Root-level policy; instead, both policies are evaluated and enforced, with the most restrictive effect taking precedence. Therefore, the Production subscription is subject to both policies.

Answer

Only the policy at the Europe level applies

Answer

Only the policy at the Root level applies

Answer

The policy at the lower level overrides the Root policy

Question 12

A company can provision virtual machines in Azure without submitting a request or waiting for hardware procurement. Which cloud characteristic does this describe?

Accepted Answer

On-demand self-service. Option C is correct because on-demand self-service allows users to provision virtual machines and other cloud resources automatically without requiring human interaction with the service provider. This eliminates the need for submitting a formal request or waiting for hardware procurement, as the provisioning is handled through a web portal, API, or CLI.

Answer

Rapid elasticity

Answer

Measured service

Answer

Resource pooling

Question 13

A company has multiple Azure subscriptions, each managed by different development teams. The central governance team wants to ensure that every subscription adheres to the same security baselines, including specific Azure Policy definitions, RBAC role assignments, and a standard resource group structure. The team needs a single, versioned package that brings these components together and can be consistently deployed across all subscriptions. Which Azure service should the governance team use to meet these requirements?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it is designed to orchestrate the deployment of a repeatable set of Azure resources and policies that adhere to organizational standards. It packages artifacts like Azure Policy definitions, RBAC role assignments, and resource group templates into a single, versioned blueprint that can be assigned to multiple subscriptions, ensuring consistent governance across all environments.

Answer

Azure Resource Manager templates

Answer

Azure Policy

Answer

Azure Management Groups

Question 14

A company has an Azure subscription with 200 virtual machines. The compliance team requires that all virtual machines have diagnostic settings enabled to send metrics and logs to a central Log Analytics workspace. The team wants Azure to automatically configure these diagnostic settings on any VM that currently lacks them, without manual intervention. Which Azure Policy effect should the team use in the policy definition?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it automatically deploys a diagnostic settings configuration to any VM that lacks it, ensuring compliance without manual intervention. This effect evaluates resources and, if they do not meet the condition (missing diagnostic settings), triggers a deployment to remediate them. Audit only logs non-compliance without fixing it, and Deny blocks non-compliant creation but does not remediate existing VMs.

Answer

Audit

Answer

Deny

Answer

Modify

Question 15

A company has a virtual machine running a legacy application that needs high-performance, low-latency storage for transactional data. They need to attach a storage solution that provides the highest IOPS and throughput. Which Azure managed disk type should they choose?

Accepted Answer

D) Ultra Disk. Ultra Disk is the correct choice because it offers the highest IOPS and throughput of any Azure managed disk, with sub-millisecond latency, making it ideal for high-performance, low-latency transactional workloads. It supports up to 160,000 IOPS and 2,000 MB/s throughput per disk, and allows independent scaling of IOPS and throughput without requiring a disk swap.

Answer

A) Standard HDD

Answer

B) Standard SSD

Answer

C) Premium SSD