AZ-900 Practice Test 2 — 10 Questions

Question 1

A global company creates a new Azure subscription for each major project. To ensure compliance and consistency, the governance team needs a single, versioned, auditable package that, when assigned to a subscription, automatically deploys a standard set of Azure Policy assignments, role assignments, a resource group structure, and a pre-configured virtual network. The solution must allow these packages to be updated centrally and have changes tracked for auditing. Which Azure service should the governance team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it provides a single, versioned, auditable package that can be assigned to a subscription to orchestrate the deployment of Azure Policy assignments, role assignments, resource groups, and resource templates (like a virtual network). Blueprints support versioning and central update management, with changes tracked in the blueprint definition history for auditing. This aligns exactly with the requirement for a governance team to enforce compliance and consistency across subscriptions.

Answer

Azure Policy

Answer

Azure Resource Manager templates

Answer

Management groups

Question 2

A company wants to enforce a naming convention for all Azure resources. For example, all resources must start with 'Contoso-'. They want to automatically audit and deny creation of resources that do not follow the naming convention. Which Azure Policy effect should they use?

Accepted Answer

Deny. The Deny effect is correct because it actively prevents the creation of Azure resources that do not match the defined naming convention rule, such as requiring all resources to start with 'Contoso-'. This effect evaluates the resource against the policy rule during deployment and rejects the request with a 403 Forbidden status if the condition is not met, ensuring compliance before the resource is created.

Answer

Audit

Answer

Modify

Answer

Append

Question 3

A company wants to ensure that its cloud resources are available even if a major disaster occurs in one region. They plan to deploy resources in two different geographic locations. Which cloud computing characteristic does this scenario primarily address?

Accepted Answer

D) Disaster recovery. Option D (Disaster recovery) is correct because the scenario explicitly describes deploying resources in two different geographic locations to ensure availability despite a major regional disaster. Disaster recovery (DR) focuses on restoring services and data after a catastrophic failure, often using paired regions (e.g., Azure paired regions) to provide geo-redundancy and failover capabilities. This goes beyond simple uptime guarantees to address full recovery from region-level outages.

Answer

A) Scalability

Answer

B) Elasticity

Answer

C) High availability

Question 4

A company wants to segregate their Azure resources into logical groups based on department and environment. They also want to apply access control and management at these group levels. Which Azure construct should they use?

Accepted Answer

Resource groups. Resource groups are logical containers in Azure that allow you to group related resources (e.g., VMs, databases, storage) by department and environment. They enable you to apply access control via Azure RBAC and management policies (e.g., tags, locks) at the group level, ensuring consistent governance across all resources within the group.

Answer

Availability sets

Answer

Virtual networks

Answer

Subscriptions

Question 5

A financial services company runs a critical trading application in its on-premises data center. The company is migrating some workloads to Azure and requires a dedicated, private network connection between its on-premises network and Azure. The connection must not use the public internet, must provide consistent latency and higher bandwidth than a typical internet-based VPN, and must be backed by a service-level agreement (SLA) for availability. Which Azure service should the company use to meet these requirements?

Accepted Answer

ExpressRoute. ExpressRoute is the correct choice because it provides a dedicated, private connection between on-premises networks and Azure that bypasses the public internet entirely. This ensures consistent latency, higher bandwidth options (up to 100 Gbps), and a financially backed SLA of at least 99.95% availability, meeting all the stated requirements for a critical trading application.

Answer

Azure VPN Gateway

Answer

Azure Firewall

Answer

Azure Front Door

Question 6

A company wants to query all Azure resources across multiple subscriptions to find all storage accounts without encryption enabled. They need to use a powerful query language to filter and join data. Which Azure tool should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph (ARG) is the correct tool because it provides a powerful, Kusto Query Language (KQL)-based query engine that can explore Azure resources across multiple subscriptions, resource groups, and management groups. It allows you to filter, project, and join resource data (e.g., find all storage accounts where encryption is disabled) using a single query, making it ideal for cross-subscription resource discovery and compliance checks.

Answer

Azure Monitor Logs

Answer

Azure Advisor

Answer

Azure Policy

Question 7

A company wants to ensure that their cloud provider's physical data centers are located in specific geographic areas to comply with data residency requirements. Which cloud concept is this related to?

Accepted Answer

Data sovereignty. Data sovereignty is the concept that data is subject to the laws and regulations of the country or region where it is physically stored. By ensuring their cloud provider's data centers are located in specific geographic areas, the company is directly addressing data sovereignty requirements to comply with local data residency laws, such as GDPR in Europe or the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada.

Answer

Availability

Answer

Disaster recovery

Answer

Hybrid cloud

Question 8

A financial services firm uses a hybrid cloud strategy. They run customer-facing applications in a public cloud and store sensitive customer data in an on-premises data center to meet regulatory compliance. The firm wants to allow its applications in the public cloud to securely access the on-premises data when needed. Which cloud deployment model best describes this setup?

Accepted Answer

Hybrid cloud. Option C is correct because the scenario describes a hybrid cloud deployment model, which combines a public cloud (for customer-facing applications) with an on-premises private cloud (for sensitive data storage) and enables secure connectivity between them, typically through VPN or dedicated circuits like Azure ExpressRoute. This allows the firm to meet regulatory compliance by keeping sensitive data on-premises while leveraging public cloud scalability for applications.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 9

A development team lead needs to quickly provision a new Azure virtual machine for a short-term testing project. Instead of submitting a ticket to the IT procurement team and waiting several days for hardware approval and setup, the lead directly signs into the Azure portal, configures the VM settings, and has it running within 15 minutes. The entire process required no human interaction from the cloud provider's staff. Which cloud computing characteristic does this scenario primarily demonstrate?

Accepted Answer

On-demand self-service. The scenario demonstrates on-demand self-service because the development team lead was able to provision and configure an Azure virtual machine directly through the Azure portal without any human interaction from Microsoft's staff. This characteristic allows users to automatically obtain computing resources, such as VM time and storage, as needed without requiring manual approval or provisioning from the cloud provider's IT team.

Answer

Broad network access

Answer

Measured service

Answer

Resource pooling

Question 10

A company wants to ensure that all new Azure storage accounts have a specific encryption setting enabled. They also want to automatically remediate any existing non-compliant storage accounts without manual effort. Which Azure Policy effect should they use?

Accepted Answer

DeployIfNotExists. DeployIfNotExists is the correct effect because it not only evaluates the compliance of storage accounts against the encryption policy but also automatically deploys a remediation task (e.g., enabling encryption via a linked ARM template or Azure function) to bring non-compliant resources into compliance without manual intervention. This effect is specifically designed for scenarios where the resource itself needs to be modified or configured to meet the policy requirement.

Answer

Append

Answer

AuditIfNotExists

Answer

Deny