AZ-900 Practice Test 17 — 15 Questions

Question 1

Which Azure service replicates on-premises virtual machines and physical servers to Azure for disaster recovery?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) is the correct service because it is specifically designed for disaster recovery (DR) by orchestrating replication, failover, and failback of on-premises virtual machines and physical servers to Azure. It uses continuous replication to maintain data consistency and supports planned/unplanned failover, ensuring business continuity during outages.

Answer

Azure Backup

Answer

Azure Migrate

Answer

Azure Archive Storage

Question 2

What is Azure DDoS Protection Standard?

Accepted Answer

Enhanced protection against distributed denial of service attacks for Azure VNet resources. Azure DDoS Protection Standard provides enhanced mitigation capabilities specifically for Azure Virtual Network (VNet) resources, defending against volumetric, protocol, and application-layer DDoS attacks. It integrates with Azure's global network to automatically detect and scrub malicious traffic, offering adaptive tuning and attack analytics. This is distinct from basic DDoS protection, which is included by default but lacks the dedicated mitigation capacity and reporting features of the Standard tier.

Answer

A firewall service that filters HTTP/HTTPS traffic based on rules

Answer

A service that encrypts data in transit between Azure regions

Answer

An intrusion detection system for monitoring network traffic

Question 3

A company wants to enforce a set of security policies across all their Azure subscriptions. They have created several individual policy definitions. Which Azure construct should they use to group these policies together and assign them as a single package?

Accepted Answer

Policy Initiative. A Policy Initiative (also known as a policy set) in Azure allows you to group multiple individual policy definitions into a single package. This enables you to assign the entire set of security policies together across subscriptions, ensuring consistent enforcement. It simplifies management by applying a collection of related policies as one unit.

Answer

Azure Blueprint

Answer

Management Group

Answer

Resource Group

Question 4

Which Azure service enables accessing on-premises applications securely from anywhere without requiring VPN or changes to the network perimeter?

Accepted Answer

Azure AD Application Proxy. Microsoft Entra application proxy enables secure remote access to on-premises web applications by publishing them through an external endpoint in Azure, without requiring a VPN or changes to the network perimeter. It works by establishing outbound connections from the on-premises Application Proxy connector to Microsoft Entra ID, which then proxies user requests to the internal application, leveraging Microsoft Entra ID for authentication and conditional access.

Answer

Azure VPN Gateway

Answer

Azure Bastion

Answer

Azure Front Door

Question 5

A company runs a web application on Azure VMs. They want to distribute incoming traffic evenly across multiple VMs to ensure no single VM is overwhelmed. Which Azure load balancing solution should they use?

Accepted Answer

Azure Load Balancer. Azure Load Balancer (Option D) operates at Layer 4 (TCP/UDP) and distributes incoming traffic across a set of backend VMs based on a hash of the source IP and port, ensuring even distribution and high availability. It is the correct choice for balancing traffic within a single Azure region across multiple VMs to prevent any single VM from being overwhelmed.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure Traffic Manager

Question 6

Which Azure service allows you to create a private network connection between your Azure VNet and your on-premises network using a dedicated circuit, not over the public internet?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute is the correct answer because it provides a dedicated, private connection from your on-premises network to Azure, bypassing the public internet entirely. This is achieved through a direct, private circuit provided by a connectivity partner, offering higher reliability, lower latency, and higher bandwidth than internet-based connections.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Bastion

Question 7

A cloud provider purchases hardware in bulk and shares physical infrastructure among many customers, which allows them to offer lower prices per customer. This benefit is known as:

Accepted Answer

Economies of scale. Economies of scale refer to the cost advantage that cloud providers achieve by purchasing hardware in bulk and sharing physical infrastructure across many customers. This reduces the per-unit cost of compute, storage, and networking resources, enabling providers to offer lower prices per customer. The scenario directly describes the cost benefits of large-scale operations, which is the defining characteristic of economies of scale.

Answer

Elasticity

Answer

Resource pooling

Answer

High availability

Question 8

A company has multiple Azure subscriptions for different projects. They want to apply a common set of policies and role assignments to all subscriptions under the 'Research' department. They also plan to add more subscriptions for Research in the future. What should they use?

Accepted Answer

Azure management group. Azure management groups allow you to efficiently manage access, policies, and compliance across multiple Azure subscriptions. By placing all 'Research' subscriptions under a single management group, you can apply a common set of Azure Policy assignments and Azure role-based access control (RBAC) assignments at the management group scope, which automatically cascades to all current and future subscriptions within that group. This hierarchical structure is specifically designed for enterprise-scale governance across departments.

Answer

Azure resource group

Answer

Azure Blueprint

Answer

Azure Policy initiative

Question 9

Which feature allows Azure administrators to require users to complete an additional verification step (beyond password) before accessing Azure resources?

Accepted Answer

Azure Active Directory Multi-Factor Authentication. Microsoft Entra ID Multi-Factor Authentication (MFA) is the correct feature because it specifically requires users to provide an additional form of verification (e.g., a phone call, text message, or app notification) beyond just a password before accessing Azure resources. This directly addresses the need for an extra security step, which is the core of MFA. Azure RBAC, Policy, and PIM do not enforce additional authentication factors.

Answer

Azure RBAC

Answer

Azure Policy

Answer

Azure Privileged Identity Management

Question 10

A company has a management group hierarchy: Root → UK → Production. They assign a policy at the Root level that allows only certain VM sizes. Later, they assign another policy at the UK level that denies all resources. What is the effective effect on the Production subscription?

Accepted Answer

Both policies apply, and the most restrictive (Deny) takes precedence.. D is correct because Azure Policy is inherited and cumulative down the management group hierarchy. The Root-level policy (allow only certain VM sizes) and the UK-level policy (deny all resources) both apply to the Production subscription. When a deny policy conflicts with an allow policy, the deny effect always takes precedence, making the most restrictive policy effective.

Answer

Only the Root policy applies because it is at the highest level.

Answer

Only the UK policy applies because it is more specific.

Answer

Both policies apply, and the order of evaluation could cause a conflict.

Question 11

What does the Azure 'Reliability' pillar of the Well-Architected Framework focus on?

Accepted Answer

Ensuring workloads recover from failures and meet availability requirements. The Azure Well-Architected Framework's Reliability pillar is specifically designed to ensure that workloads can recover from failures and meet defined availability and resiliency targets. This involves designing for fault tolerance, implementing redundancy across regions or availability zones, and using features like Azure Site Recovery and Azure Load Balancer to maintain service continuity. The core goal is to minimize downtime and data loss, which directly aligns with option B.

Answer

Reducing unnecessary resource provisioning to minimize costs

Answer

Encrypting all data and managing access identities

Answer

Monitoring resource performance and responding to performance alerts

Question 12

Which Azure service provides enterprise-grade, distributed message queuing with features like guaranteed delivery and FIFO ordering?

Accepted Answer

Azure Service Bus queues. Azure Service Bus queues are the correct choice because they are designed for enterprise-grade messaging with support for guaranteed delivery (at-least-once or exactly-once semantics) and strict FIFO ordering through sessions. Unlike simpler queue services, Service Bus provides advanced features like dead-lettering, message deferral, and transactional support, making it suitable for mission-critical application integration.

Answer

Azure Queue Storage

Answer

Azure Event Hubs

Answer

Azure Event Grid

Question 13

Which feature of Azure subscriptions allows an organization to separate billing and access management for different departments?

Accepted Answer

Multiple subscriptions. Multiple subscriptions allow an organization to create separate billing invoices and independent access management boundaries for different departments. Each subscription has its own billing relationship and can be assigned distinct Microsoft Entra ID tenants or RBAC configurations, enabling cost tracking and administrative isolation per department.

Answer

Resource groups

Answer

Azure tags

Answer

Azure RBAC

Question 14

A company needs to host a website that must automatically scale to handle millions of concurrent users during peak events. Which Azure architecture BEST supports this?

Accepted Answer

Azure App Service with autoscaling and Azure Front Door. Azure App Service with autoscaling and Azure Front Door is the best choice because it provides a fully managed platform for web applications that can automatically scale out (add instances) based on demand, while Azure Front Door offers global load balancing and acceleration at Layer 7 (HTTP/HTTPS) to distribute traffic across multiple regions. This combination ensures the website can handle millions of concurrent users during peak events without manual intervention.

Answer

Single Azure VM with manual scaling

Answer

Azure Blob Storage static website

Answer

Azure VMs without load balancing

Question 15

A company needs to store backup data that must be retained for 7 years. They want to store the data as cheaply as possible, and access may be rare. Which Azure Storage access tier is most cost-effective?

Accepted Answer

Archive tier. The Archive tier is the most cost-effective option for data that must be retained for 7 years with rare access. It offers the lowest storage cost among Azure Blob Storage access tiers, specifically designed for long-term retention where retrieval latency of up to 15 hours is acceptable. This aligns perfectly with the requirement to minimize cost while meeting the 7-year retention period.

Answer

Hot tier

Answer

Cool tier

Answer

Premium tier