AZ-900 Practice Test 22 — 15 Questions

Question 1

A company uses Azure Blob Storage to store backup files that must survive a complete regional outage. The company needs the data to be automatically accessible from a secondary region if the primary region becomes unavailable, without any manual failover. Which storage redundancy option should the company use?

Accepted Answer

Read-Access Geo-Redundant Storage (RA-GRS). Read-Access Geo-Redundant Storage (RA-GRS) is the correct choice because it provides geo-redundancy (data replicated to a secondary region for disaster recovery) and, crucially, enables read access to the secondary region without requiring a manual failover. This ensures that if the primary region becomes unavailable, the data is automatically accessible from the secondary region for read operations, meeting the requirement of no manual intervention.

Answer

Locally Redundant Storage (LRS)

Answer

Zone-Redundant Storage (ZRS)

Answer

Geo-Redundant Storage (GRS)

Question 2

A company uses Azure Policy to require that all storage accounts must have blob soft delete enabled. They also want to automatically create a remediation task that fixes any existing non-compliant storage accounts. Which policy effect should they include in the policy definition to achieve automatic remediation?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is designed to automatically remediate non-compliant resources by deploying a defined template (e.g., enabling blob soft delete) when the resource is evaluated as non-compliant. This effect triggers a remediation task that can be run on existing resources, ensuring all storage accounts meet the policy requirement without manual intervention.

Answer

Deny

Answer

Audit

Answer

Append

Question 3

A company uses Azure Resource Manager templates to deploy infrastructure. They need to manage secrets such as database connection strings and passwords securely. Which Azure service should they use to store and retrieve these secrets during deployment?

Accepted Answer

A) Azure Key Vault. Azure Key Vault is the correct service because it is designed specifically to securely store and manage secrets such as database connection strings, passwords, and certificates. During Azure Resource Manager (ARM) template deployments, you can reference Key Vault secrets directly in the template using a linked template or a parameter file, allowing the secrets to be retrieved at deployment time without exposing them in plaintext. This integration ensures that sensitive values are never hardcoded or stored in source control.

Answer

B) Azure Policy

Answer

C) Azure Managed Identity

Answer

D) Azure Service Principal

Question 4

A company wants to ensure its Azure resources are deployed in a geographic location that is paired with another region for disaster recovery. If a regional outage occurs, they plan to failover to the paired region. Which concept does this describe?

Accepted Answer

Azure region pairs. Azure region pairs are designed to support disaster recovery by ensuring that each Azure region is paired with another region in the same geography (e.g., East US paired with West US). During a regional outage, services can failover to the paired region, and Microsoft prioritizes recovery of paired regions to minimize downtime. This concept directly matches the scenario described, where the company plans to use a paired region for failover.

Answer

Availability zones

Answer

Azure geographies

Answer

Sovereign regions

Question 5

A company wants to enforce that all storage accounts use the 'Standard' performance tier and block creation of any 'Premium' storage accounts. Which Azure Policy effect could achieve this?

Accepted Answer

Deny. The Deny effect is the correct choice because it actively prevents the creation of Azure resources that do not comply with the policy definition. In this scenario, by assigning a policy with the Deny effect that targets storage accounts with the 'Premium' performance tier, Azure Resource Manager will block any request to create a Premium storage account, ensuring only 'Standard' tier accounts are provisioned.

Answer

Append

Answer

Audit

Answer

Disabled

Question 6

A company uses Azure Blueprints to enforce a standard landing zone for all development subscriptions. The blueprint includes a virtual network, subnets, and network security groups. After the blueprint is assigned to a subscription, a development team manually adds a new subnet to the virtual network. The company plans to update the blueprint to add a new network security group rule. When the updated blueprint is published and the assignment is updated, what will happen to the manually added subnet?

Accepted Answer

The manually added subnet will be preserved because blueprints do not manage resources after creation.. Azure Blueprints deploy resources using Azure Resource Manager templates in incremental mode by default. When a blueprint assignment is updated, only the resources defined in the blueprint are affected. Resources that were manually created and are not part of the blueprint definition—such as the manually added subnet—are preserved and not removed or overwritten. To prevent manual modifications, a resource lock can be applied via the blueprint assignment, but that is not the case in this scenario.

Answer

The manually added subnet will be removed because the blueprint definition now takes precedence.

Answer

The manually added subnet will be overwritten by the updated blueprint definition.

Answer

The blueprint update will fail because the subnet already exists.

Question 7

A healthcare organization stores patient records in Azure Blob Storage. They require that data remains available even if an entire Azure datacenter fails, and they also need to ensure data is replicated within the same region for low latency. Which storage redundancy option should they choose?

Accepted Answer

Zone-Redundant Storage (ZRS). Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region, ensuring data remains available even if an entire datacenter (one zone) fails. This meets both the availability requirement and the low-latency requirement because replication stays within the region, avoiding cross-region latency.

Answer

Locally Redundant Storage (LRS)

Answer

Geo-Redundant Storage (GRS)

Answer

Read-Access Geo-Redundant Storage (RA-GRS)

Question 8

A company wants to ensure that all Azure resources they deploy are created in the Europe West region to comply with data sovereignty requirements. They want to block creation of resources in any other region. Which Azure service should they use?

Accepted Answer

Azure Policy with allowed locations. Azure Policy with the 'allowed locations' built-in policy definition can enforce that all resources are deployed only in the Europe West region. When assigned to a subscription or resource group scope, this policy denies any resource creation outside the specified regions, directly meeting the data sovereignty requirement.

Answer

Resource groups

Answer

Management groups

Answer

Azure Blueprints

Question 9

A company uses Azure Policy to govern its Azure environment. The governance team wants to enforce that all virtual machines (VMs) deployed in the production subscription use only approved operating system images from a specific Azure Compute Gallery. However, during a transition period, the team does not want to block the creation of VMs that use non-approved images; instead, they need to identify and report on any non-compliant VMs. They also want to track compliance over time. Which Azure Policy effect should the governance team use in the policy definition to meet these requirements?

Accepted Answer

Audit. The Audit effect is correct because it enables the governance team to identify and report non-compliant VMs without blocking their creation. Azure Policy's Audit effect logs a warning in the activity log for resources that violate the policy, allowing the team to track compliance over time via Azure Policy compliance reports and Azure Monitor, while the transition period remains unblocked.

Answer

Deny

Answer

Append

Answer

Modify

Question 10

A company wants to enforce a policy that all Azure resources must have a 'CostCenter' tag. They want to automatically apply the tag to new resources, and also to existing resources that are missing it. Which Azure service should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it can enforce tagging rules by evaluating resources against a policy definition and automatically applying the 'CostCenter' tag to new resources via the 'deployIfNotExists' effect. It can also remediate existing non-compliant resources by triggering a remediation task that applies the missing tag. This makes Azure Policy the ideal tool for governance and compliance at scale.

Answer

Azure Blueprints

Answer

Azure Resource Manager

Answer

Azure Cost Management

Question 11

A healthcare organization needs to enforce a set of compliance requirements (e.g., enable encryption on all storage accounts, restrict public network access to SQL databases, and enforce a specific TLS version) across all Azure subscriptions. The organization has defined these requirements as individual Azure Policy definitions. The governance team wants to assign all these policies together as a single unit to a management group, ensuring that any new subscription created under that group automatically receives all the policies. Which Azure object should the governance team create first?

Accepted Answer

Azure Policy initiative. An Azure Policy initiative is a collection of individual policy definitions designed to group related policies together for assignment as a single unit. By creating an initiative that contains the required compliance policies (encryption, network restrictions, TLS version) and assigning it to a management group, any new subscription under that group automatically inherits the initiative, ensuring consistent enforcement.

Answer

Azure Blueprint

Answer

Azure Management Group

Answer

Azure Resource Manager template

Question 12

A company wants to deploy a virtual machine in Azure and needs to ensure that the VM is placed in a location that provides the lowest network latency to its users in Europe. Which Azure construct should they consider to meet this requirement?

Accepted Answer

Azure region. Azure regions are geographically discrete data center groupings that provide low-latency connectivity to users within that region. By deploying the VM in a Europe-based region (e.g., West Europe or North Europe), the company ensures the shortest physical distance and network path to its European users, minimizing latency. Availability zones, resource groups, and management groups do not influence geographic placement or network latency.

Answer

Azure availability zone

Answer

Azure resource group

Answer

Azure management group

Question 13

A company wants to migrate a set of on-premises databases to Azure. They require high compatibility with SQL Server features, including cross-database queries and SQL Agent jobs. They want a PaaS solution. Which Azure service is most appropriate?

Accepted Answer

Azure SQL Managed Instance. Azure SQL Managed Instance is the correct choice because it provides near 100% compatibility with SQL Server on-premises, including support for cross-database queries and SQL Agent jobs, while being a fully managed Platform-as-a-Service (PaaS) offering. This allows the company to lift-and-shift their databases without redesigning applications, meeting both the feature and PaaS requirements.

Answer

Azure SQL Database

Answer

SQL Server on Azure Virtual Machines

Answer

Azure Database for PostgreSQL

Question 14

A company uses Azure Policy to require encryption on storage accounts. They want to automatically deploy an encryption extension to any new storage account that does not have it enabled, without manual intervention. Which policy effect should they use?

Accepted Answer

DeployIfNotExists. DeployIfNotExists is the correct effect because it evaluates resources after creation and automatically deploys a required configuration (like an encryption extension) if it is missing, without requiring manual intervention. This effect is specifically designed for scenarios where you need to remediate non-compliant resources by deploying a template or extension, ensuring encryption is enabled on all storage accounts.

Answer

Modify

Answer

Append

Answer

AuditIfNotExists

Question 15

A company wants to encrypt data at rest in Azure SQL Database using customer-managed keys stored in Azure Key Vault. They also need to be able to rotate the keys without downtime. Which feature should they use?

Accepted Answer

Transparent Data Encryption with customer-managed keys. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault allows you to encrypt the database at rest using your own keys, which you can rotate without downtime because Azure SQL Database handles the re-encryption of the database encryption key (DEK) transparently in the background, without requiring database offline or performance impact.

Answer

Always Encrypted

Answer

Dynamic Data Masking

Answer

Row-level security