AZ-900 Practice Test 14 — 15 Questions

Question 1

A company historically purchased physical servers and networking equipment for its data center, paying the full cost upfront before using the hardware. The company is now migrating its workloads to Azure and will only pay for the compute and storage resources it consumes each month, with no long-term commitments or upfront hardware purchases. This financial model change best represents which cloud computing benefit?

Accepted Answer

Consumption-based pricing. The scenario describes a shift from upfront capital expenditure (CapEx) for physical hardware to a model where the company pays only for the resources it consumes each month, without long-term commitments. This directly aligns with consumption-based pricing, a core Azure benefit where costs are incurred based on actual usage of compute, storage, and other services, eliminating the need for upfront hardware purchases.

Answer

High availability

Answer

Elasticity

Answer

Disaster recovery

Question 2

A company has multiple Azure subscriptions. The IT team wants to apply common policies and role assignments across all subscriptions automatically when a new subscription is created. Which Azure service should they use?

Accepted Answer

B) Azure Blueprints. Azure Blueprints is the correct service because it enables the orchestrated deployment of resource templates, policies, and role assignments as a single composable artifact. When a new subscription is created, a blueprint assignment can automatically apply the defined governance artifacts, ensuring consistent compliance and access control across all subscriptions.

Answer

A) Azure Policy

Answer

C) Azure Resource Manager

Answer

D) Azure Management Groups

Question 3

A company has a critical Azure resource group that contains production resources. They want to ensure that no one can accidentally delete or modify the resources in this group, even if they have Contributor permissions. Which Azure feature should they use?

Accepted Answer

Resource Locks. Resource Locks are the correct choice because they provide a way to prevent accidental deletion or modification of critical Azure resources by applying a lock at the resource, resource group, or subscription level. Even users with Contributor or Owner permissions are blocked from performing delete or modify operations when a lock is set to 'CanNotDelete' or 'ReadOnly'. This ensures that production resources are protected beyond the permissions granted by RBAC.

Answer

Azure Policy

Answer

Role-Based Access Control (RBAC)

Answer

Management Groups

Question 4

A company deploys a web application on Azure App Service. During a marketing campaign, they expect traffic to double. The app uses a Standard tier App Service plan. They want to ensure that the additional load is handled without performance degradation while keeping costs minimal. Which action should they take?

Accepted Answer

Scale out the App Service plan by increasing the instance count.. Scaling out (increasing instance count) for the Standard tier App Service plan allows the application to handle the doubled traffic by distributing requests across multiple instances, ensuring no performance degradation. This approach is cost-minimal because the Standard tier supports manual scale-out without requiring a tier upgrade, and you only pay for the additional instances while they are needed.

Answer

Scale up the App Service plan to a Premium tier for more resources.

Answer

Enable autoscale on the existing plan to let Azure handle scaling automatically.

Answer

Deploy Azure CDN to cache static content.

Question 5

A company has multiple Azure subscriptions for different departments. The IT team wants to apply a common set of policies (e.g., allowed VM sizes) and assign the same role-based access control (RBAC) permissions across all subscriptions automatically. Which Azure feature should they use?

Accepted Answer

Azure Management Groups. Azure Management Groups allow you to organize Azure subscriptions hierarchically and apply governance conditions, such as RBAC assignments and Azure Policy definitions, at the management group level. These conditions are inherited by all subscriptions within the group, enabling automatic and consistent application of policies and permissions across multiple subscriptions without manual per-subscription configuration.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Resource Manager (ARM) templates

Question 6

A company has multiple Azure subscriptions organized under a management group hierarchy. They need to assign the 'Contributor' role to a security team for all subscriptions under the 'Production' management group. They also want new subscriptions added later to automatically inherit this role assignment. What should they do?

Accepted Answer

Assign the role at the management group level. Assigning the 'Contributor' role at the management group level ensures that all subscriptions under that management group inherit the role assignment. When new subscriptions are added to the 'Production' management group, they automatically inherit the role assignment because Azure RBAC supports inheritance down the management group hierarchy. This meets both requirements: immediate coverage and automatic inheritance for future subscriptions.

Answer

Assign the role at the tenant root management group level

Answer

Assign the role at each subscription individually

Answer

Use an Azure Blueprint to assign the role

Question 7

A company has an Azure subscription that contains hundreds of virtual machines (VMs) across multiple resource groups. The security team needs to enforce two governance rules: 1) All VMs must use managed disks. 2) All VMs must be deployed only in the East US region. The team wants to assign a single governance artifact that combines both rules so that the compliance state is evaluated as a group. The solution must not require assigning each rule individually. Which Azure feature should the team use to define and assign this combined set of rules?

Accepted Answer

Azure Policy initiative (policy set) definition. Azure Policy initiative (policy set) definitions allow you to group multiple individual policy definitions into a single, combined set of rules. By assigning the initiative, both the managed disks requirement and the East US region restriction are evaluated together as a single compliance artifact, meeting the requirement to avoid assigning each rule individually.

Answer

Azure Policy group definition

Answer

Azure Blueprints artifact

Answer

Azure compliance bundle

Question 8

A company has a simple containerized web application that runs in a single container. The application processes a workload for a few minutes every hour and remains idle the rest of the time. The company wants to deploy the container in Azure without managing any virtual machines or container orchestrators. They also want to pay only for the time the container is actually running, with no cost when idle. Which Azure compute service should the company use?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it allows you to run a containerized application without managing any underlying virtual machines or container orchestrators like Kubernetes. ACI supports a per-second billing model, meaning you only pay for the compute resources consumed while the container is actively running, and incur no cost when the container is stopped or idle. This aligns perfectly with the company's requirement of a simple, single-container workload that runs intermittently.

Answer

Azure App Service

Answer

Azure Virtual Machine Scale Sets

Answer

Azure Kubernetes Service

Question 9

A company has deployed several virtual machines in an Azure virtual network. The IT administrators need to connect to these VMs using RDP and SSH from the internet. However, the company's security policy prohibits assigning any public IP addresses to the VMs and also prohibits exposing the VMs directly to the internet. The solution must be fully managed by Azure and require no additional infrastructure in the virtual network. Which Azure service should the company use?

Accepted Answer

Azure Bastion. Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to virtual machines directly in the Azure portal over TLS. It eliminates the need for public IP addresses on the VMs and does not require any additional infrastructure in the virtual network, as it is deployed inside the virtual network and uses a private IP to connect to the VMs.

Answer

Azure Virtual Network Peering

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Question 10

A company hosts a web application on a single Azure virtual machine. Over the past month, the application's CPU utilization has consistently remained above 90%, causing slow response times. The administrator plans to modify the virtual machine's size from Standard_D2s_v3 (2 vCPUs) to Standard_D8s_v3 (8 vCPUs) to improve performance. Which scaling method does this change represent?

Accepted Answer

Vertical scaling (scaling up). Vertical scaling (scaling up) increases the power of an existing resource by upgrading its size or capacity. In this scenario, changing the virtual machine from Standard_D2s_v3 (2 vCPUs) to Standard_D8s_v3 (8 vCPUs) adds more CPU cores to the same VM, which is a classic example of scaling up. This approach improves performance without adding additional VM instances.

Answer

Horizontal scaling (scaling out)

Answer

Elastic scaling

Answer

Auto-scaling

Question 11

A company deploys virtual machines in Azure. They want to ensure that the VMs are distributed across multiple fault domains and update domains within an Azure datacenter to protect against hardware failures and maintenance. Which Azure construct should they use?

Accepted Answer

A) Availability Set. An Availability Set is the correct Azure construct because it logically groups VMs to protect against both hardware failures (via fault domains) and planned maintenance (via update domains) within a single Azure datacenter. Fault domains distribute VMs across separate racks with independent power, cooling, and network, while update domains ensure VMs in different groups are not rebooted simultaneously during Azure host updates. This directly matches the requirement to isolate VMs across multiple fault and update domains within a datacenter.

Answer

B) Availability Zone

Answer

C) Region Pair

Answer

D) Resource Group

Question 12

A company has a policy that requires all storage accounts to have secure transfer enabled. They want to automatically audit all existing storage accounts and enforce the setting on new ones. They also want to automatically fix non-compliant new storage accounts. Which Azure Policy effect combination should they use?

Accepted Answer

B) audit and deployIfNotExists. The correct combination is 'audit' and 'deployIfNotExists'. The 'audit' effect logs non-compliant existing storage accounts without changing them, satisfying the audit requirement. The 'deployIfNotExists' effect automatically remediates new non-compliant storage accounts by enabling secure transfer (HTTPS) during deployment, enforcing the policy on new resources without blocking creation.

Answer

A) audit and deny

Answer

C) append and deny

Answer

D) modify and audit

Question 13

A company is deploying a mission-critical application on Azure virtual machines. The solution must remain operational even if a single Azure datacenter within a region experiences a complete outage. Which Azure feature should the company use to protect against this specific failure scenario?

Accepted Answer

Availability Zones. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By deploying the application across multiple zones, the solution remains operational if one entire datacenter fails, as the other zones continue to serve traffic. This directly addresses the requirement to survive a single datacenter outage within a region.

Answer

Region Pairs

Answer

Fault Domains

Answer

Resource Groups

Question 14

Which Azure service provides pre-built AI capabilities like language understanding, vision, and speech without requiring custom model training?

Accepted Answer

Azure Cognitive Services. Azure Cognitive Services is the correct answer because it provides a suite of pre-built, pre-trained AI models accessible via REST APIs and SDKs for tasks such as language understanding (e.g., LUIS), computer vision (e.g., Computer Vision API), and speech recognition (e.g., Speech-to-Text). These services require no custom model training or machine learning expertise, allowing developers to integrate AI capabilities directly into applications.

Answer

Azure Machine Learning

Answer

Azure Databricks

Answer

Azure Bot Service

Question 15

A company has an Azure subscription used by multiple development teams. The security team wants to ensure that every virtual network (VNet) created in the subscription automatically has a specific network security group (NSG) associated with its default subnet. The NSG rules are defined by the security team, and developers should not have to perform any extra steps after creating a VNet. Which Azure Policy effect should the security team use in the policy definition?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it automatically deploys a specific NSG to the default subnet of any VNet that does not already have it, ensuring compliance without requiring developer intervention. This effect evaluates the resource after creation and triggers a deployment to remediate non-compliant states, aligning with the requirement for zero extra steps.

Answer

Deny

Answer

Audit

Answer

Append