AZ-900 Practice Test 2 — 25 Questions

Question 1

A healthcare organization needs to enforce a set of compliance requirements (e.g., enable encryption on all storage accounts, restrict public network access to SQL databases, and enforce a specific TLS version) across all Azure subscriptions. The organization has defined these requirements as individual Azure Policy definitions. The governance team wants to assign all these policies together as a single unit to a management group, ensuring that any new subscription created under that group automatically receives all the policies. Which Azure object should the governance team create first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Policy initiative. An Azure Policy initiative is a collection of individual policy definitions designed to group related policies together for assignment as a single unit. By creating an initiative that contains the required compliance policies (encryption, network restrictions, TLS version) and assigning it to a management group, any new subscription under that group automatically inherits the initiative, ensuring consistent enforcement.

Answer

Azure Blueprint

Answer

Azure Management Group

Answer

Azure Resource Manager template

Question 2

Which Azure networking service provides a distributed, highly available, and scalable DNS service for routing users to the best-performing endpoint?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that distributes traffic to the best-performing endpoint across global Azure regions. It uses DNS responses to direct users to the endpoint with the lowest latency or highest priority, providing high availability and scalability without proxying traffic.

Answer

Azure Front Door

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Question 3

A company is designing a disaster recovery solution for a multi-tier application hosted in Azure. They need to ensure that if an entire Azure region becomes unavailable, the application can fail over to another region. The application uses Azure SQL Database. Which Azure feature should they use to replicate the database across regions?

Accepted Answer

B) Azure SQL Database automatic failover groups. Azure SQL Database automatic failover groups (Option B) are the correct choice because they provide automated, orchestrated failover of a group of databases across regions, ensuring the entire multi-tier application can fail over when an Azure region becomes unavailable. Unlike geo-replication, which only replicates data, failover groups manage the entire logical server and its databases, including updating the connection string endpoint to the secondary region, which is essential for application continuity.

Answer

A) Azure SQL Database geo-replication

Answer

C) Azure Traffic Manager

Answer

D) Azure Site Recovery

Question 4

A company's CTO asks why Azure can offer services at lower costs than building an equivalent on-premises solution. Which cloud principle BEST explains this?

Accepted Answer

Economies of scale. Economies of scale is the correct answer because cloud providers like Azure operate massive, standardized data centers that serve millions of customers simultaneously. This allows them to negotiate bulk discounts on hardware, power, and cooling, and to spread fixed operational costs across a vast customer base, resulting in per-unit costs far lower than what a single company would pay for an equivalent on-premises deployment.

Answer

Elasticity

Answer

High availability

Answer

Geo-distribution

Question 5

A manufacturing company runs its proprietary production scheduling software on on-premises servers. The IT team also manages on-premises file servers. The company decides to move its email system to Microsoft 365 but keeps all other systems on-premises. Which cloud deployment model does this scenario best describe?

Accepted Answer

Hybrid cloud. This scenario describes a hybrid cloud because the company uses a mix of on-premises infrastructure (production scheduling servers and file servers) and a public cloud service (Microsoft 365 for email). In a hybrid cloud model, organizations integrate on-premises resources with public cloud services, allowing data and applications to be shared between them. Here, the email system runs in Microsoft's public cloud while all other systems remain on-premises, creating a hybrid deployment.

Answer

Private cloud

Answer

Public cloud

Answer

Community cloud

Question 6

Match each Azure database service to its type.

Accepted Answer

Azure SQL Database: Relational. In this matching exercise, the correct pairs are: Azure SQL Database (Relational), Azure Cosmos DB (NoSQL), Azure Database for MySQL (Relational), Azure Database for PostgreSQL (Relational). The distractors swap the types, incorrectly labeling Cosmos DB as relational and SQL Database as NoSQL.

Answer

Azure Cosmos DB: Relational

Answer

Azure SQL Database: NoSQL

Question 7

A US-based financial services company must ensure that all customer data remains within the United States at all times to comply with regulatory requirements. The company plans to replicate its Azure SQL database between two Azure regions for disaster recovery. The solution must guarantee that if a region experiences a major outage, the paired region is prioritized for recovery. Additionally, the solution should ensure that during planned maintenance, only one region in the pair is updated at a time. Which Azure architecture feature should the company use?

Accepted Answer

Region Pairs. Region Pairs are the correct choice because Azure guarantees that each region is paired with another region within the same geography (e.g., East US with West US) to provide physical isolation, prioritized disaster recovery, and sequential planned maintenance updates. This ensures that during an outage, recovery is directed to the paired region, and during maintenance, only one region in the pair is updated at a time, meeting the company's regulatory and availability requirements.

Answer

Availability Zones

Answer

Resource Groups

Answer

Azure Policy

Question 8

Which Azure service provides a managed, serverless SQL database that scales automatically and pauses when not in use?

Accepted Answer

Azure SQL Database Serverless. Azure SQL Database Serverless is the correct answer because it is a compute tier for single databases that automatically scales compute resources based on workload demand and pauses the database during periods of inactivity, charging only for storage when paused. This aligns directly with the question's requirement for a managed, serverless SQL database that scales automatically and pauses when not in use.

Answer

Azure SQL Database General Purpose tier

Answer

Azure Cosmos DB Serverless

Answer

Azure SQL Managed Instance

Question 9

A company uses Azure for multiple projects. The IT governance team wants to ensure that every new Azure resource within a subscription is automatically assigned a 'CostCenter' tag based on the resource group it is created in. The team does not want to rely on users manually applying the tag. They need a built-in Azure solution that enforces this rule without custom scripts. Which Azure feature should they use?

Accepted Answer

Azure Policy with the 'Inherit a tag from the resource group if missing' effect. Azure Policy with the 'Inherit a tag from the resource group if missing' effect is correct because it automatically applies the 'CostCenter' tag from the resource group to any new resource created within that resource group, without requiring manual intervention or custom scripts. This built-in policy effect enforces governance rules at scale, ensuring compliance across the subscription.

Answer

Azure Resource Graph

Answer

Azure Management Groups

Answer

Azure Tags (manual tagging feature)

Question 10

A company runs a multi-tier application on Azure virtual machines in a virtual network. The web tier VMs are in a front-end subnet, and the database tier VMs are in a back-end subnet. Currently, outbound internet traffic from the VMs goes directly to the internet without any inspection or logging. The security team needs a centralized service to inspect all outbound traffic from the virtual network, log the destinations, and reject traffic to malicious domains based on threat intelligence feeds. The solution must also allow rules based on fully qualified domain names (FQDNs) instead of only IP addresses. Which Azure service should the security team deploy?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-based network security service that provides centralized outbound traffic inspection, logging, and threat intelligence-based filtering. It supports application rules based on fully qualified domain names (FQDNs), allowing the security team to reject traffic to malicious domains without relying solely on IP addresses. This makes it the correct choice for inspecting and controlling outbound traffic from the virtual network.

Answer

Azure Bastion

Answer

Network Security Group (NSG)

Answer

Application Gateway

Question 11

A company plans to migrate a line-of-business application to Azure virtual machines (IaaS). The company's security team is reviewing the shared responsibility model to determine which security tasks are handled by Microsoft. Which of the following security responsibilities belongs to Microsoft?

Accepted Answer

Maintaining physical security of the datacenter where the servers are hosted. Under the shared responsibility model for IaaS, Microsoft is responsible for the physical security of its datacenters, including access controls, surveillance, and environmental safeguards. This is a foundational layer that customers cannot manage, making option C correct.

Answer

Configuring operating system firewalls on the virtual machines

Answer

Patching the guest operating system of the virtual machines

Answer

Managing application-level user authentication and authorization

Question 12

Which Azure service provides automatic threat detection and response for Azure SQL Database, detecting anomalous activities like SQL injection?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL is the correct answer because it is a cloud-native security solution specifically designed to detect and respond to threats against Azure SQL Database, including SQL injection attacks. It provides advanced threat protection by continuously monitoring database activities and generating security alerts for anomalous behaviors, such as unusual access patterns or injection attempts, without requiring manual intervention.

Answer

Azure SQL Database auditing

Answer

Azure Policy

Answer

Azure Firewall

Question 13

A company runs a web application on Azure. At the end of each month, the finance team reviews an invoice that itemizes charges by resource type, such as virtual machine compute hours, storage capacity used, and data transfer volume. The total cost directly corresponds to the exact quantity of resources consumed during the billing period. This capability is an example of which fundamental characteristic of cloud computing?

Accepted Answer

Measured service. Measured service is the correct answer because it refers to the cloud provider's ability to meter and bill customers based on actual resource consumption. In this scenario, the invoice itemizes charges by resource type (compute hours, storage, data transfer) and the total cost directly corresponds to the exact quantity consumed, which is the defining characteristic of measured service. This capability relies on metering telemetry (e.g., Azure Monitor metrics, usage logs) to track usage and generate a pay-per-use billing model.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

On-demand self-service

Question 14

A company has 30 Azure subscriptions organized under a single management group. The governance team wants to enforce that all resource groups must have a specific tag 'CostCenter' with a valid value. They create an Azure Policy definition with the 'Deny' effect and assign it to the root management group. However, the development team complains that they have a sandbox subscription where they need to create resource groups without the 'CostCenter' tag for testing. The governance team still wants the policy to apply to all other subscriptions but exempt the sandbox subscription. Which solution should the governance team use?

Accepted Answer

Use a policy exemption on the sandbox subscription with category 'Waiver'.. Azure Policy exemptions allow specific scopes (like the sandbox subscription) to be excluded from a policy's enforcement while keeping the policy assigned to the parent management group. A 'Waiver' exemption category is used when the intent is to temporarily or permanently exempt a resource from policy evaluation, which fits the governance team's requirement to exempt only the sandbox subscription without altering the policy assignment structure.

Answer

Create a second policy assignment at the sandbox subscription with the 'Disabled' effect.

Answer

Remove the policy assignment from the management group and assign it individually to all subscriptions except the sandbox.

Answer

Configure an Azure Blueprint for the management group and exclude the sandbox subscription.

Question 15

A large enterprise manages hundreds of Azure subscriptions. The compliance team needs to run an on-demand report that shows all virtual machines with their current power state (running or deallocated), operating system, and VM size, filtering by specific resource groups or subscriptions. The team wants to use a native Azure tool that allows querying Azure resources at scale using a Kusto Query Language (KQL) syntax. Which Azure service should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct choice because it is a native Azure service designed for querying Azure resources at scale using Kusto Query Language (KQL). It allows you to run on-demand, complex queries across multiple subscriptions, resource groups, and resource types, and can return properties such as power state, operating system, and VM size. This directly matches the compliance team's requirement for a scalable, KQL-based query tool that works across hundreds of subscriptions.

Answer

Azure Monitor Logs

Answer

Azure Resource Explorer

Answer

Azure Advisor

Question 16

A company uses Azure for its infrastructure. A developer needs a new virtual machine to test a feature. The developer goes to the Azure portal, selects an image, and provisions the VM within minutes without any interaction with the IT procurement department. This capability directly demonstrates which essential characteristic of cloud computing as defined by NIST?

Accepted Answer

On-demand self-service. The scenario describes a developer provisioning a virtual machine directly through the Azure portal without needing to submit a request or obtain approval from IT procurement. This aligns with the NIST definition of on-demand self-service, which states that a consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider. The key enabler here is the self-service portal (Azure portal) that allows the developer to select an image and deploy the VM instantly, bypassing any manual approval workflow.

Answer

Rapid elasticity

Answer

Measured service

Answer

Resource pooling

Question 17

A cloud provider uses virtualization technology to host multiple customers on the same physical server. Each customer's data, applications, and operating systems are logically isolated and secured from one another. Which characteristic of cloud computing does this scenario best describe?

Accepted Answer

Resource pooling. This scenario describes resource pooling, where the provider's computing resources (such as storage, memory, and network bandwidth) are pooled to serve multiple customers using a multi-tenant model. Virtualization technology creates isolated virtual machines for each tenant, ensuring logical separation of data and applications while sharing the same physical hardware. This is a core characteristic of cloud computing as defined by NIST SP 800-145.

Answer

Rapid elasticity

Answer

Measured service

Answer

On-demand self-service

Question 18

A company wants to track and manage costs across multiple Azure subscriptions. They have created a hierarchy of management groups: Root -> Department A -> Project 1, Project 2. They want to see the total cost for Department A across all its projects. Which Azure tool should they use?

Accepted Answer

Cost Management + Billing. Cost Management + Billing is the correct tool because it provides consolidated cost tracking and analysis across multiple subscriptions and management groups. By organizing subscriptions under the Department A management group, Cost Management can aggregate costs from Project 1 and Project 2, allowing the company to view the total cost for Department A in a single dashboard or report.

Answer

Azure Policy

Answer

Azure Advisor

Answer

Azure Monitor

Question 19

Which cloud benefit helps organizations meet workload demands during unexpected events like viral marketing campaigns without service degradation?

Accepted Answer

Elasticity. Elasticity is the correct answer because it refers to the ability of a cloud system to automatically provision and de-provision resources (such as compute instances, storage, or bandwidth) in real time to match fluctuating demand. During a viral marketing campaign, traffic spikes can be handled by scaling out resources dynamically, ensuring consistent performance without manual intervention or service degradation.

Answer

High availability

Answer

Security

Answer

Predictability

Question 20

A company runs an e-commerce web application on a set of Azure virtual machines behind a load balancer. The application experiences unpredictable traffic surges during flash sales. The company configures an autoscale setting that automatically adds virtual machines when the average CPU usage across the existing VMs exceeds 75% for five minutes, and removes virtual machines when CPU usage drops below 30% for ten minutes. Which essential characteristic of cloud computing does this configuration primarily demonstrate?

Accepted Answer

Rapid elasticity. B is correct because the autoscale configuration dynamically adds and removes virtual machines in response to real-time CPU usage thresholds, which is the defining characteristic of rapid elasticity. This allows the e-commerce application to scale computing resources up and down automatically and seamlessly to match unpredictable traffic surges, ensuring performance during flash sales without manual intervention.

Answer

Measured service

Answer

Resource pooling

Answer

Broad network access