AZ-900 Practice Test 21 — 15 Questions

Question 1

A company manages 50 Azure SQL Databases, each used by a different department. Each database experiences low average usage (less than 5 DTU on average) but unpredictable hourly peaks that can reach up to 50 DTU for short bursts. The company wants to minimize total cost while ensuring every database can handle its peak load without performance degradation. Which Azure SQL Database deployment option should the company choose?

Accepted Answer

Azure SQL Database elastic pool. Azure SQL Database elastic pool is the correct choice because it allows multiple databases to share a fixed pool of DTU resources, enabling the aggregated peak loads to be handled efficiently without over-provisioning each database individually. With low average usage (less than 5 DTU) but unpredictable bursts up to 50 DTU, an elastic pool provides the necessary headroom for spikes while minimizing total cost by only paying for the pooled eDTUs, not per-database maximums.

Answer

Azure SQL Database single database with 50 DTU

Answer

Azure SQL Managed Instance

Answer

SQL Server on an Azure virtual machine

Question 2

A company subscribes to a SaaS-based customer relationship management (CRM) application hosted in the cloud. The CRM provider manages the application, runtime, and infrastructure. The company's employees access the CRM via a web browser. According to the shared responsibility model, which security responsibility belongs solely to the company?

Accepted Answer

Safeguarding the company's customer data and user identities.. In a SaaS model, the provider manages the application, runtime, and infrastructure, including patching the OS and physical security. The customer retains responsibility for what they bring into the cloud: their data and user identities. Option C is correct because safeguarding customer data and managing user identities (e.g., via Azure AD) is solely the company's responsibility under the shared responsibility model.

Answer

Patching the underlying operating system of the CRM servers.

Answer

Managing network access controls to the CRM application.

Answer

Ensuring physical security of the data centers hosting the CRM.

Question 3

A company migrates its on-premises SQL Server database to Azure SQL Database. The company's security team is concerned about who is responsible for applying security updates to the operating system that hosts the database engine. According to the shared responsibility model for cloud computing, who is responsible for patching the operating system of the underlying host?

Accepted Answer

Microsoft (Azure). In the shared responsibility model for Azure SQL Database, Microsoft is responsible for the underlying infrastructure, including the operating system that hosts the database engine. Azure SQL Database is a Platform as a Service (PaaS) offering, where Microsoft manages the host OS, applies security patches, and ensures the physical and virtual environment is secure. The customer is only responsible for data, access management, and database-level configurations.

Answer

The company (customer)

Answer

Both the company and Microsoft share this responsibility

Answer

A third-party managed service provider

Question 4

A company stores critical financial records in an Azure Storage account. The operations team needs to ensure that the storage account cannot be deleted by any user, including administrators with Contributor permissions. However, authorized users must still be able to add and modify blobs. The solution should not affect the ability to update the account's configuration. Which Azure feature should the company implement?

Accepted Answer

Apply a CanNotDelete resource lock on the storage account.. A CanNotDelete resource lock on the storage account prevents any user, including those with Contributor permissions, from deleting the resource. This satisfies the requirement that even administrators cannot delete the account, while still allowing authorized users to add and modify blobs (since blob operations are controlled by Azure RBAC roles, not the lock) and update the account's configuration (the lock only blocks delete operations).

Answer

Assign the Storage Blob Data Owner role to the operations team.

Answer

Create an Azure Policy that denies delete operations on storage accounts.

Answer

Move the storage account to a new resource group.

Question 5

A company is planning to migrate its on-premises applications to Azure. They have a mix of monolithic and microservices-based applications. Which Azure compute service should they choose for a microservices architecture that requires independent scaling and deployment of components?

Accepted Answer

Azure Kubernetes Service (AKS). Azure Kubernetes Service (AKS) is the correct choice because it provides a managed Kubernetes orchestration platform designed specifically for microservices architectures. AKS enables independent scaling, deployment, and management of containerized components, which aligns with the requirement for decoupled services that can be updated or scaled individually without affecting the entire application.

Answer

Azure Functions

Answer

Azure App Service

Answer

Azure Virtual Machines

Question 6

A company traditionally purchased physical servers and networking equipment every three years, paying the full cost upfront. They are now migrating their workloads to Azure virtual machines. The finance team wants to understand the primary financial benefit of the new cloud model. Which statement best describes this benefit?

Accepted Answer

The company can replace large upfront capital expenditures with variable monthly payments based on actual usage.. Option B is correct because migrating from on-premises physical servers to Azure virtual machines shifts the cost model from Capital Expenditure (CapEx) — paying the full hardware cost upfront every three years — to Operational Expenditure (OpEx), where you pay only for the compute, storage, and network resources you actually consume on a monthly basis. This aligns costs directly with usage, avoiding large upfront investments and enabling better cash flow management.

Answer

The company can stop paying for electricity and cooling because Azure includes those costs in the monthly bill.

Answer

The company will pay a fixed monthly fee for each virtual machine, regardless of whether it is running or stopped.

Answer

The company can reduce its overall IT spending by 50% or more when moving to the cloud.

Question 7

A company uses Azure for its production workloads. The security team wants to receive proactive, personalized recommendations to improve the security of their Azure resources, such as enabling Microsoft Defender for Cloud on subscriptions that do not have it enabled. Which Azure service provides these security recommendations?

Accepted Answer

Azure Advisor. Azure Advisor provides personalized, proactive recommendations to optimize Azure resources for security, reliability, performance, and cost. The question specifically asks for security recommendations, and Azure Advisor includes a dedicated 'Security' category that surfaces actions such as enabling Microsoft Defender for Cloud on subscriptions that lack it. This matches the scenario exactly.

Answer

Azure Policy

Answer

Azure Service Health

Answer

Azure Monitor

Question 8

A company uses a hybrid cloud model where some workloads run on-premises and some in Azure. They need a consistent identity management system across both environments, allowing single sign-on for users accessing resources in either location. What should they implement?

Accepted Answer

Azure AD Connect. Azure AD Connect is the correct solution because it synchronizes on-premises Active Directory identities with Azure Active Directory, enabling a unified identity management system. This allows users to use the same credentials (single sign-on) to access both on-premises resources and Azure cloud services, fulfilling the hybrid cloud requirement.

Answer

Azure Site Recovery

Answer

Azure VPN Gateway

Answer

Azure Traffic Manager

Question 9

A company manages its production workloads in a dedicated Azure subscription under the root management group. The infrastructure team recently created a critical resource group named 'rg-prod-core' that contains networking resources. To prevent accidental deletion of this entire resource group, the team needs a mechanism that blocks delete operations on 'rg-prod-core' while still allowing changes to resources within it. The solution must not affect any other resource groups in the subscription. Which Azure feature should the team apply to 'rg-prod-core'?

Accepted Answer

Apply a resource lock with the 'CanNotDelete' setting to the resource group.. Option B is correct because a resource lock with the 'CanNotDelete' setting prevents deletion of the resource group while still allowing read and update operations on resources within it. This lock applies only to the specific resource group scope, so it does not affect any other resource groups in the subscription. This directly meets the requirement to block deletion of 'rg-prod-core' without impacting other groups.

Answer

Assign an Azure Policy with the 'deny' effect at the management group scope to block deletions of any resource group.

Answer

Create a custom RBAC role that explicitly denies the delete action, and assign it to the infrastructure team at the resource group scope.

Answer

Deploy an Azure Blueprint that includes a policy to audit deletions of the resource group.

Question 10

A company uses Azure Blob Storage to store archival backups of financial records. The company requires that the data is protected against a complete regional outage by replicating it to another Azure region. However, they do not need to access the replicated copy unless the primary region fails. The company wants to minimize storage costs while meeting this requirement. Which type of storage replication should the company configure?

Accepted Answer

Geo-redundant storage (GRS). Geo-redundant storage (GRS) replicates your data synchronously three times within the primary region using LRS, then asynchronously to a secondary region hundreds of miles away. This meets the requirement of protecting against a complete regional outage while minimizing costs, because the secondary copy is not accessible for reads unless Microsoft initiates a failover, and GRS is less expensive than RA-GRS which includes read-access to the secondary region.

Answer

Locally redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 11

A company uses Azure Blueprints to define a standard environment for all new development subscriptions. The blueprint includes a set of Azure policies, role assignments, and resource templates. However, after applying the blueprint, some resources are created that do not comply with the policies. The company wants to be notified of these non-compliant resources without blocking their creation. Which Azure Policy effect should be used in the blueprint?

Accepted Answer

Audit. The Audit effect is correct because it enables Azure Policy to evaluate resources against the defined policies and log compliance warnings in the activity log without blocking resource creation. This meets the requirement to be notified of non-compliant resources while allowing them to be created.

Answer

Deny

Answer

Append

Answer

DeployIfNotExists

Question 12

A company uses Azure Policy to enforce encryption on storage accounts. They discover some existing storage accounts are non-compliant. They want to automatically enable encryption on these accounts without manual intervention. Which combination of policy effects should they use?

Accepted Answer

Audit and DeployIfNotExists. The correct combination is Audit and DeployIfNotExists. Audit logs non-compliant storage accounts without blocking them, while DeployIfNotExists automatically enables encryption on those accounts by deploying a remediation task. This ensures existing non-compliant resources are brought into compliance without manual intervention.

Answer

Deny and Audit

Answer

Append and Modify

Answer

Audit and Disabled

Question 13

A company needs to store large amounts of unstructured data, such as images and videos, for a web application. They need to access data from anywhere via HTTP/HTTPS. Which Azure storage service should they use?

Accepted Answer

A) Azure Blob Storage. Azure Blob Storage is designed for storing large amounts of unstructured data, such as images and videos, and provides REST-based access over HTTP/HTTPS from anywhere. It supports scalable object storage with global accessibility, making it ideal for web application content delivery.

Answer

B) Azure File Storage

Answer

C) Azure Queue Storage

Answer

D) Azure Table Storage

Question 14

A company stores sensitive customer transaction records in Azure Blob Storage. The records must be available for read access at all times, even if the primary Azure region becomes unavailable. The company initially configured geo-redundant storage (GRS). During a disaster recovery test, the operations team discovers that although data is replicated to a secondary region, they cannot read the data from the secondary region until a Microsoft-initiated failover occurs. The team needs a solution that provides immediate, continuous read access to the replicated data in the secondary region without waiting for a failover. Which Azure Storage replication option should the company use?

Accepted Answer

Read-access geo-redundant storage (RA-GRS). RA-GRS extends GRS by enabling read access to the data in the secondary region at all times, without requiring a Microsoft-initiated failover. This ensures that the customer transaction records remain continuously readable from the secondary region, meeting the requirement for immediate read access during a primary region outage.

Answer

Locally-redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Question 15

A company uses Azure Blob Storage to store compliance documents that are required to be kept for 10 years. The documents are very rarely accessed; on average, only 2-3 requests per year are made, usually for audits. The company needs the lowest possible storage cost. When a document is requested, the company can tolerate a retrieval time of up to 15 hours. Which Azure Blob Storage access tier should the company use?

Accepted Answer

Archive access tier. The Archive access tier is designed for data that is rarely accessed and has a flexible retrieval time, offering the lowest storage cost among Azure Blob Storage tiers. With only 2-3 requests per year and a tolerance for up to 15-hour retrieval latency, the Archive tier (which typically takes up to 15 hours to rehydrate) perfectly matches the requirements while minimizing storage expenses.

Answer

Hot access tier

Answer

Cool access tier

Answer

Premium access tier