AZ-900 Practice Test 17 — 15 Questions

Question 1

A company is migrating a legacy on-premises application to Azure. The application runs on multiple Windows Server virtual machines and requires a shared file system that multiple servers can mount simultaneously using the SMB protocol. The data must also be accessible from on-premises servers in a hybrid configuration. The IT team wants to minimize management overhead and avoid provisioning additional servers solely for file sharing. Which Azure service should they use?

Accepted Answer

Azure Files. Azure Files provides fully managed SMB file shares that can be mounted simultaneously by multiple Windows Server VMs, both in Azure and on-premises, without needing to provision or manage a dedicated file server. It supports the SMB 3.0 protocol required for hybrid access and offers low management overhead through a serverless, PaaS-based file share service.

Answer

Azure Blob Storage

Answer

Azure Disk Storage

Answer

Azure NetApp Files

Question 2

A company needs to store log files from multiple applications. The logs are accessed infrequently for compliance audits but must be retained for 10 years. Storage cost must be minimized. Which Azure Storage access tier should they use for the blob storage?

Accepted Answer

Archive tier. The Archive tier is the correct choice because it is designed for data that is rarely accessed and has a flexible retrieval latency of up to 15 hours, making it ideal for compliance logs that are accessed infrequently but must be retained for 10 years. It offers the lowest storage cost among all Azure Blob Storage access tiers, which directly minimizes storage costs for long-term retention. The Hot, Cool, and Cold tiers are progressively more expensive and are optimized for more frequent access patterns, not for archival scenarios.

Answer

Hot tier

Answer

Cool tier

Answer

Cold tier

Question 3

A company is migrating a customer-facing web application to Azure. The application requires a relational database with built-in high availability, automatic backups, and automatic patching of the database engine. The development team is familiar with SQL Server and wants to minimize administrative overhead. They do not want to manage virtual machines or operating systems. Which Azure database service should the team choose?

Accepted Answer

Azure SQL Database (PaaS). Azure SQL Database is a fully managed Platform-as-a-Service (PaaS) offering that provides built-in high availability (99.99% SLA), automatic backups with point-in-time restore, and automatic patching of the database engine. It allows the development team to use their existing SQL Server skills without managing any virtual machines or operating systems, directly meeting the requirement to minimize administrative overhead.

Answer

Azure Cosmos DB

Answer

SQL Server on Azure Virtual Machines (IaaS)

Answer

Azure Database for PostgreSQL

Question 4

A company is migrating its on-premises infrastructure to Azure. Previously, the company purchased physical servers, networking equipment, and data center space every three years, paying a large sum upfront. After migration, the company expects to pay a monthly invoice based only on the virtual machines and storage it actually uses, with the ability to increase or decrease resources as needed without additional upfront costs. This change in cost structure is best described by which pair of cloud computing concepts?

Accepted Answer

Capital expenditure (CapEx) to operational expenditure (OpEx). This scenario describes a shift from paying large upfront sums for hardware and data center space (CapEx) to paying a monthly invoice based on actual consumption of virtual machines and storage (OpEx). Azure's pay-as-you-go model allows resources to be scaled up or down without upfront costs, directly aligning with the CapEx-to-OpEx transition. This is a fundamental cloud concept that changes how organizations budget and manage IT expenses.

Answer

Measured service and resource pooling

Answer

Economies of scale and geographic distribution

Answer

Agility and high availability

Question 5

A company needs to share a set of files between multiple Azure VMs using the SMB protocol. They require a managed file share that can be mounted simultaneously by multiple VMs with permissions managed via Active Directory. Which Azure storage service should they use?

Accepted Answer

Azure Files. Azure Files provides fully managed SMB file shares in the cloud that can be mounted concurrently by multiple Azure VMs. It supports Active Directory (AD) authentication and access control lists (ACLs), making it the correct choice for sharing files via SMB with AD-managed permissions.

Answer

Azure Blob Storage

Answer

Azure Disk Storage

Answer

Azure NetApp Files

Question 6

A company runs a web application in two Azure regions: East US and West US. The company wants to route users automatically to the region that provides the lowest network latency. If one region becomes unavailable, all traffic should be rerouted to the healthy region. The company does not need to offload Transport Layer Security (TLS) or perform URL-based routing. Which Azure service should the company use to distribute traffic at the DNS level?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager operates at the DNS level, using DNS responses to direct user traffic to the region with the lowest network latency based on the Performance traffic-routing method. It also supports automatic failover: if a region becomes unavailable, Traffic Manager detects the endpoint health probe failure and reroutes all traffic to the healthy region. This matches the requirement exactly, as the company needs DNS-level distribution without TLS offloading or URL-based routing.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 7

A company needs to store archival data for 10 years with the lowest possible storage cost. Data may be accessed once a year for compliance audits. Which Azure Storage access tier should they choose?

Accepted Answer

Archive. The Archive access tier is designed for data that is rarely accessed and has a flexible latency requirement, making it the most cost-effective option for long-term archival storage. With a 10-year retention period and only annual access for compliance audits, Archive provides the lowest storage cost per gigabyte compared to Cool or Hot tiers, though it incurs higher retrieval costs and latency (typically hours to rehydrate data).

Answer

Cool

Answer

Hot

Answer

Premium

Question 8

A company's security policy requires that all Azure Storage accounts must enforce a minimum TLS version of 1.2. The governance team needs to continuously audit all existing storage accounts for compliance with this requirement, and also ensure that any new storage account that does not meet the TLS version requirement is automatically flagged as non-compliant in the Azure portal compliance dashboard. The team does not want to block the creation of non-compliant resources; they only need to report them. Which Azure feature should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct choice because it can continuously audit existing Azure resources and evaluate new resources against a defined policy rule—in this case, requiring a minimum TLS version of 1.2 on all storage accounts. It can be configured in audit-only mode, which flags non-compliant resources in the Azure portal compliance dashboard without blocking their creation, exactly matching the team's requirement to report rather than deny.

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Blueprints

Answer

Azure Locks

Question 9

A company is migrating its on-premises SQL Server databases to Azure SQL Database, which is a Platform as a Service (PaaS) offering. The on-premises IT team is accustomed to manually applying monthly security patches to the SQL Server software. After the migration, the team wants to understand their responsibilities for securing the database. According to the shared responsibility model, which party is responsible for applying security patches to the SQL Server database engine in Azure SQL Database?

Accepted Answer

Microsoft, because Azure SQL Database is a PaaS service where Microsoft manages the database engine.. Azure SQL Database is a Platform as a Service (PaaS) offering where Microsoft manages the underlying infrastructure, including the operating system and the SQL Server database engine. Under the shared responsibility model, Microsoft is responsible for applying security patches to the database engine, while the customer is responsible for securing their data, access controls, and database-level configurations. This frees the customer from manual patching tasks they performed on-premises.

Answer

The customer, because the database engine is a customer-managed application.

Answer

Both the customer and Microsoft share equal responsibility for patching the database engine.

Answer

The customer, but only if the Azure SQL Database is configured with the serverless compute tier.

Question 10

A company migrates its on-premises infrastructure to Azure. The IT manager notes that Azure dynamically allocates and reallocates compute and storage resources across multiple customers based on demand, while ensuring each customer's data and workloads remain isolated from others. Which cloud computing characteristic does this describe?

Accepted Answer

Resource pooling. Resource pooling is the cloud computing characteristic where the provider's computing resources are pooled to serve multiple customers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to demand. This ensures each customer's data and workloads remain isolated while the provider can efficiently allocate compute and storage across tenants. The scenario directly describes this multi-tenant isolation and dynamic allocation, which is the essence of resource pooling.

Answer

Rapid elasticity

Answer

Measured service

Answer

On-demand self-service

Question 11

A company runs an e-commerce website on a set of on-premises servers that are fully owned and depreciated. The website experiences predictable traffic surges during seasonal sales. The company plans to migrate to Azure and wants to pay only for the compute and storage resources consumed, with the ability to automatically add virtual machines during sales and remove them afterward. Which characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Elasticity. Elasticity is the cloud computing characteristic that allows resources to automatically scale out (add virtual machines) during demand spikes like seasonal sales and scale in (remove VMs) when demand drops, aligning with the pay-per-use model. This scenario directly matches elasticity because the company wants to dynamically adjust compute and storage resources in response to predictable traffic surges, paying only for what is consumed.

Answer

High availability

Answer

Fault tolerance

Answer

Disaster recovery

Question 12

A company is migrating a custom line-of-business application to Azure. The application handles sensitive customer data. The IT team is evaluating whether to deploy the application on Azure Virtual Machines (IaaS) or Azure App Service (PaaS). They want to understand the division of security responsibilities between Microsoft and the customer under the shared responsibility model. Which responsibility remains the customer's obligation regardless of whether they choose IaaS, PaaS, or SaaS?

Accepted Answer

Managing user access to the application data and ensuring data classification policies are enforced. Under the shared responsibility model, the customer is always responsible for managing access to data and enforcing data classification policies, regardless of whether the workload runs on IaaS, PaaS, or SaaS. This is because data ownership and the associated governance obligations (such as who can read, write, or modify sensitive customer data) remain with the customer. Microsoft secures the underlying infrastructure, but the customer must control who accesses the application data and how it is classified.

Answer

Applying operating system security patches and updates to virtual machines

Answer

Managing the physical server hardware, network switches, and datacenter cooling

Answer

Configuring and maintaining the application-level network load balancer for high availability

Question 13

A company needs to connect their on-premises network to Azure with a dedicated, private, and high-bandwidth connection that does not traverse the public internet. They require an SLA for availability and performance. Which Azure service should they use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute is the correct choice because it provides a dedicated, private connection from on-premises networks to Azure that does not traverse the public internet. It offers a Service-Level Agreement (SLA) for availability (e.g., 99.95% for a single connection with redundancy) and performance, which is not guaranteed over internet-based VPNs. This meets the requirement for high bandwidth, privacy, and a guaranteed SLA.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Peering Service

Question 14

A company wants to connect their on-premises data center to Azure with a dedicated, private connection that does not traverse the internet. They also need to ensure high availability by having two active connections. Which Azure service and configuration should they use?

Accepted Answer

Azure ExpressRoute with two circuits.. Azure ExpressRoute provides a dedicated, private connection from on-premises to Azure that does not traverse the public internet. To achieve high availability with two active connections, you must configure two ExpressRoute circuits, each connecting to different Microsoft Enterprise Edge (MSEE) devices, ensuring redundancy at the physical and network layer.

Answer

Azure VPN Gateway with active-active mode.

Answer

Azure Virtual WAN with a single connection.

Answer

Azure Point-to-Site VPN.

Question 15

A company plans to deploy a critical web application on Azure virtual machines in the West US region. The application must remain available if a single datacenter within that region experiences a complete outage. The company also requires the virtual machines to be connected to each other with low-latency network connectivity. Which Azure feature should the company use to deploy the virtual machines?

Accepted Answer

Availability Zone. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across two or more zones ensures that if one datacenter fails, the application remains available in another zone, while the VMs within the same region can still be connected via a low-latency virtual network.

Answer

Availability Set

Answer

Region Pair

Answer

Virtual Machine Scale Set