AZ-900 Practice Test 17 — 15 Questions

Question 1

A company deploys a critical application on Azure virtual machines. They want to ensure that the VMs are distributed across physically separate datacenters within a single Azure region to protect against a single datacenter failure. Which Azure feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Availability zones. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By deploying VMs across multiple zones, the application is protected from a single datacenter failure, as Azure ensures at least one zone remains operational during an outage.

Answer

Availability sets

Answer

Resource groups

Answer

Azure Site Recovery

Question 2

A company wants to increase the number of virtual machines it uses during peak hours and decrease them during off-peak hours without manual intervention. Which characteristic of cloud computing does this represent?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that allows resources to automatically scale out (increase) during peak demand and scale in (decrease) during off-peak hours without manual intervention. This matches the company's requirement for dynamic, automatic adjustment of virtual machine counts based on workload changes.

Answer

High Availability

Answer

Scalability

Answer

Load Balancing

Question 3

Which Azure service provides a managed Kubernetes environment that reduces the complexity and operational overhead of running Kubernetes?

Accepted Answer

Azure Kubernetes Service. Azure Kubernetes Service (AKS) is the correct answer because it is a managed Kubernetes service that handles critical operational tasks such as health monitoring, patching, and upgrades of the control plane, thereby reducing the complexity and overhead of running Kubernetes. Unlike unmanaged Kubernetes, AKS abstracts the master node management, allowing you to focus on deploying and managing your containerized applications.

Answer

Azure Container Instances

Answer

Azure Container Apps

Answer

Azure App Service

Question 4

A company hosts a web application on Azure App Service. The application must be accessible from any internet-connected device, including smartphones and laptops. Employees also use the Azure portal and Azure CLI from various locations to manage the application and other Azure resources. This scenario best illustrates which characteristic of cloud computing?

Accepted Answer

Broad network access. Broad network access is the correct characteristic because the scenario explicitly describes the web application being accessible from any internet-connected device (smartphones, laptops) and employees managing resources via the Azure portal and CLI from various locations. This aligns with the NIST definition of broad network access, where resources are available over the network and accessed through standard protocols (e.g., HTTPS, SSH) by heterogeneous thin or thick client platforms.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Measured service

Question 5

A company wants to track resource usage across departments and projects. They have multiple Azure subscriptions. They need to assign costs to specific departments based on resource usage. Which Azure feature enables them to view and analyze costs by resource tags?

Accepted Answer

A) Azure Cost Management + Billing. Azure Cost Management + Billing provides the tools to view, analyze, and allocate costs across subscriptions and resources. By enabling tag inheritance and using cost analysis filters, you can group costs by resource tags (e.g., Department or Project) to assign spending to specific departments. This is the correct feature because it directly supports cost tracking and allocation by tags.

Answer

B) Azure Policy

Answer

C) Azure Tags

Answer

D) Azure Resource Groups

Question 6

Which Azure service acts as a central networking hub connecting multiple virtual networks and on-premises networks together?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is a networking service that provides a centralized hub-and-spoke architecture, enabling connectivity between multiple virtual networks (VNets) and on-premises networks through a single managed hub. It aggregates VPN, ExpressRoute, and VNet-to-VNet connections, simplifying routing and policy management across hybrid and multi-site environments.

Answer

Azure VNet Peering

Answer

Azure ExpressRoute

Answer

Azure Private Link

Question 7

An IT administrator needs to query all Azure resources across multiple subscriptions to find all virtual machines that were created in the last 30 days. They want to use a powerful query language. Which Azure service should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct service because it provides a powerful, Kusto Query Language (KQL)-based query engine that can efficiently explore and query Azure resources across multiple subscriptions, resource groups, and locations. It is specifically designed for resource discovery and inventory scenarios, such as finding all virtual machines created in the last 30 days, by filtering on properties like `createdTime`.

Answer

Azure Monitor

Answer

Azure Resource Manager

Answer

Azure CLI

Question 8

What is the Microsoft Trust Center?

Accepted Answer

A website providing information about Microsoft's security, privacy, and compliance practices. The Microsoft Trust Center is a dedicated website that provides detailed information about Microsoft's security, privacy, and compliance practices. It serves as a central resource for customers to understand how Microsoft protects their data, including certifications, audit reports, and regulatory compliance documentation. This aligns with the need for transparency in cloud services, making option B correct.

Answer

A tool for managing Azure resource permissions

Answer

A monitoring service for Azure infrastructure health

Answer

An Azure portal feature for security recommendations

Question 9

Which Azure service enables you to create, train, and deploy machine learning models using a visual drag-and-drop interface?

Accepted Answer

Azure Machine Learning. Azure Machine Learning provides a visual drag-and-drop interface called the designer, which allows users to create, train, and deploy machine learning models without writing code. This distinguishes it from other Azure services that focus on pre-built APIs, big data processing, or analytics pipelines.

Answer

Azure Cognitive Services

Answer

Azure Databricks

Answer

Azure Synapse Analytics

Question 10

Which Azure service replicates on-premises virtual machines and physical servers to Azure for disaster recovery?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) is the correct service because it is specifically designed for disaster recovery (DR) by orchestrating replication, failover, and failback of on-premises virtual machines and physical servers to Azure. It uses continuous replication to maintain data consistency and supports planned/unplanned failover, ensuring business continuity during outages.

Answer

Azure Backup

Answer

Azure Migrate

Answer

Azure Archive Storage

Question 11

What is Azure DDoS Protection Standard?

Accepted Answer

Enhanced protection against distributed denial of service attacks for Azure VNet resources. Azure DDoS Protection Standard provides enhanced mitigation capabilities specifically for Azure Virtual Network (VNet) resources, defending against volumetric, protocol, and application-layer DDoS attacks. It integrates with Azure's global network to automatically detect and scrub malicious traffic, offering adaptive tuning and attack analytics. This is distinct from basic DDoS protection, which is included by default but lacks the dedicated mitigation capacity and reporting features of the Standard tier.

Answer

A firewall service that filters HTTP/HTTPS traffic based on rules

Answer

A service that encrypts data in transit between Azure regions

Answer

An intrusion detection system for monitoring network traffic

Question 12

A company wants to enforce a set of security policies across all their Azure subscriptions. They have created several individual policy definitions. Which Azure construct should they use to group these policies together and assign them as a single package?

Accepted Answer

Policy Initiative. A Policy Initiative (also known as a policy set) in Azure allows you to group multiple individual policy definitions into a single package. This enables you to assign the entire set of security policies together across subscriptions, ensuring consistent enforcement. It simplifies management by applying a collection of related policies as one unit.

Answer

Azure Blueprint

Answer

Management Group

Answer

Resource Group

Question 13

Which Azure service enables accessing on-premises applications securely from anywhere without requiring VPN or changes to the network perimeter?

Accepted Answer

Azure AD Application Proxy. Azure AD Application Proxy enables secure remote access to on-premises web applications by publishing them through an external endpoint in Azure, without requiring a VPN or changes to the network perimeter. It works by establishing outbound connections from the on-premises Application Proxy connector to Azure AD, which then proxies user requests to the internal application, leveraging Azure AD for authentication and conditional access.

Answer

Azure VPN Gateway

Answer

Azure Bastion

Answer

Azure Front Door

Question 14

A company runs a web application on Azure VMs. They want to distribute incoming traffic evenly across multiple VMs to ensure no single VM is overwhelmed. Which Azure load balancing solution should they use?

Accepted Answer

Azure Load Balancer. Azure Load Balancer (Option D) operates at Layer 4 (TCP/UDP) and distributes incoming traffic across a set of backend VMs based on a hash of the source IP and port, ensuring even distribution and high availability. It is the correct choice for balancing traffic within a single Azure region across multiple VMs to prevent any single VM from being overwhelmed.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure Traffic Manager

Question 15

Which Azure service allows you to create a private network connection between your Azure VNet and your on-premises network using a dedicated circuit, not over the public internet?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute is the correct answer because it provides a dedicated, private connection from your on-premises network to Azure, bypassing the public internet entirely. This is achieved through a direct, private circuit provided by a connectivity partner, offering higher reliability, lower latency, and higher bandwidth than internet-based connections.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Bastion