AZ-900 Practice Test 2 — 10 Questions

Question 1

A company migrates its web application to Azure App Service (Platform as a Service). The application processes sensitive customer data and must ensure that all data in memory is encrypted while the application is running. According to the shared responsibility model, which party is responsible for implementing encryption of data in memory for this application?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The company, because it is responsible for securing its own application data and code.. In the shared responsibility model for PaaS like Azure App Service, Microsoft secures the physical host, OS, and platform runtime, but the customer retains responsibility for securing application-level data, including data in memory. Encrypting data in memory requires application code changes (e.g., using .NET's `ProtectedMemory` or Windows DPAPI), which is solely the customer's responsibility because Microsoft cannot access or manage the application's runtime memory contents.

Answer

Microsoft Azure, because it provides the hosting infrastructure and manages the runtime environment.

Answer

Both Microsoft and the company share this responsibility equally.

Answer

A third-party encryption service that is automatically enabled for all Azure App Service deployments.

Question 2

A company has two Azure virtual networks: VNet-A in the East US region and VNet-B in the West US region. Both virtual networks use non-overlapping IP address spaces and are deployed in different resource groups. The company needs to enable communication between resources in VNet-A and VNet-B using private IP addresses only, with low latency and without any traffic traversing the public internet. The solution must not require deploying a virtual network gateway or any additional network appliance. Which Azure service should the company use?

Accepted Answer

Azure Virtual Network Peering. Azure Virtual Network Peering connects VNet-A and VNet-B directly over the Microsoft backbone network, enabling private IP communication with low latency and no public internet traversal. It requires no virtual network gateway or additional appliances, and works across regions (global peering) as long as IP address spaces are non-overlapping.

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Answer

Azure Load Balancer

Question 3

A company has a management group hierarchy: Root > Europe > Production. They assign a policy at the Root level that denies creation of resources without a tag. Later, they assign a different policy at the Europe level. What is the effective effect on the Production subscription?

Accepted Answer

Both policies apply. Azure Policy is inherited by default from higher-level management groups down to subscriptions. When a policy is assigned at the Root management group, it applies to all child management groups and subscriptions, including the Production subscription. Assigning an additional policy at the Europe management group does not remove or override the Root-level policy; instead, both policies are evaluated and enforced, with the most restrictive effect taking precedence. Therefore, the Production subscription is subject to both policies.

Answer

Only the policy at the Europe level applies

Answer

Only the policy at the Root level applies

Answer

The policy at the lower level overrides the Root policy

Question 4

A company uses Azure for its production workloads. The security team wants to receive proactive, personalized recommendations to improve the security of their Azure resources, such as enabling Microsoft Defender for Cloud on subscriptions that do not have it enabled. Which Azure service provides these security recommendations?

Accepted Answer

Azure Advisor. Azure Advisor provides personalized, proactive recommendations to optimize Azure resources for security, reliability, performance, and cost. The question specifically asks for security recommendations, and Azure Advisor includes a dedicated 'Security' category that surfaces actions such as enabling Microsoft Defender for Cloud on subscriptions that lack it. This matches the scenario exactly.

Answer

Azure Policy

Answer

Azure Service Health

Answer

Azure Monitor

Question 5

An organization wants to combine on-premises data center resources with Azure public cloud services to extend capacity during peak demand. Which cloud deployment model describes this approach?

Accepted Answer

Hybrid. The hybrid cloud model combines on-premises infrastructure (private cloud) with public cloud services, enabling workload bursting during peak demand. This approach uses technologies like Azure ExpressRoute or VPN gateways to create a seamless network, allowing organizations to scale capacity on-demand without permanently migrating all resources.

Answer

Public

Answer

Private

Answer

Multi-cloud

Question 6

A company runs a critical line-of-business application on Azure virtual machines. The operations team needs to receive proactive notifications about any upcoming planned maintenance events that could affect their virtual machines, as well as real-time alerts when a service incident occurs in the Azure region where the application is deployed. The team wants a native Azure solution that provides a personalized view of all service health events relevant to their subscriptions, including historical incident reports. Which Azure service should the operations team use?

Accepted Answer

Azure Service Health. Azure Service Health provides a personalized dashboard of service health events, including planned maintenance notifications, real-time service incident alerts, and historical reports, all scoped to the user's subscriptions. This makes it the correct native Azure solution for the operations team's requirements.

Answer

Azure Monitor

Answer

Azure Advisor

Answer

Azure Status Page (status.azure.com)

Question 7

Which Azure networking service acts as a software-defined WAN that connects branch offices, datacenters, and remote users through an optimized global network?

Accepted Answer

Azure Virtual WAN. Azure Virtual WAN is a software-defined WAN (SD-WAN) service that provides a unified, optimized global network connecting branch offices, datacenters, and remote users. It leverages Microsoft's global backbone to route traffic efficiently, automatically selecting the best path and reducing latency, while integrating with VPN, ExpressRoute, and SD-WAN partners for seamless connectivity.

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Answer

Azure Load Balancer

Question 8

What is the purpose of Azure Service Level Agreements (SLAs)?

Accepted Answer

To define Microsoft's commitments for uptime and the remedies if not met. Azure SLAs define Microsoft's formal commitments regarding service availability (uptime) and connectivity. They specify the guaranteed uptime percentage (e.g., 99.9% for most virtual machines) and outline the service credits (remedies) customers receive if Microsoft fails to meet those commitments. This is not a guarantee of zero downtime but a contractual promise with financial recourse.

Answer

To guarantee Microsoft will never have any downtime

Answer

To prevent customers from migrating to other cloud providers

Answer

To specify how Azure handles customer data

Question 9

A manufacturing company deploys a batch processing application on Azure. The processing workload is highly unpredictable; sometimes the application requires hundreds of virtual machines for a few hours to process a large queue of jobs, and at other times it requires only a handful of virtual machines. The company configures the application to automatically add and remove virtual machines based on the size of the processing queue, ensuring that they never pay for idle capacity. Which cloud characteristic does this scenario primarily demonstrate?

Accepted Answer

Elasticity. The scenario describes automatically scaling the number of virtual machines up and down based on the queue size, which directly aligns with the cloud characteristic of elasticity. Elasticity allows resources to be dynamically provisioned and de-provisioned to match workload demand, ensuring the company never pays for idle capacity. This is distinct from high availability, fault tolerance, or disaster recovery, which focus on uptime, redundancy, and data protection rather than dynamic scaling.

Answer

High availability

Answer

Fault tolerance

Answer

Disaster recovery

Question 10

A company is adopting Azure and needs to deploy a standardized environment that includes a resource group, a virtual network with specific IP address ranges, and a set of Azure Policy definitions to restrict allowed deployment locations. The environment will be deployed to multiple subscriptions used by different departments. The company requires a repeatable, versioned package that defines the resources, policies, and role assignments as a single item. The solution must allow updates to be managed and enforced over time. Which Azure feature should the company use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it enables the orchestrated deployment of a standardized environment—including resource groups, virtual networks, Azure Policy definitions, and role assignments—as a single, versioned, and updatable package. Unlike ARM templates, Blueprints natively supports versioning, policy assignment, and role assignment as first-class artifacts, and it allows the blueprint to be assigned to multiple subscriptions while maintaining a central source of truth for updates and enforcement.

Answer

Azure Policy

Answer

ARM templates

Answer

Management groups