AZ-900 Practice Test 3 — 25 Questions

Question 1

A multinational company runs a web application that must serve users from around the world with low latency. The application is deployed in multiple Azure regions. The company also requires built-in protection against distributed denial-of-service (DDoS) attacks at the network layer. The solution must automatically route users to the closest healthy endpoint based on geographic location. Which Azure service should the company use?

Accepted Answer

Azure Front Door. Azure Front Door is correct because it provides global load balancing with automatic routing to the closest healthy endpoint based on geographic location (latency-based routing), and it includes built-in DDoS protection at the network layer (L3/L4) as part of the Azure infrastructure. This combination of global routing and integrated DDoS mitigation directly matches the requirements for a multinational application serving users worldwide.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Question 2

A financial services company must deploy a standardized environment for a new customer-facing application. The environment must include a specific set of Azure resources (such as virtual networks, databases, and App Service plans), pre-configured role assignments for the compliance team, and a collection of Azure Policy definitions that enforce encryption and tagging rules. The company needs to package all these components into a single, versioned artifact that can be consistently deployed across multiple subscriptions and regions, with the ability to track changes and updates. Which Azure service should the company use to achieve this?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it is designed to package a standardized environment—including resource templates, role assignments, and policy definitions—into a single, versioned artifact that can be deployed consistently across multiple subscriptions and regions. Unlike ARM templates, Blueprints natively supports versioning, tracking changes, and updating deployments, which meets the company's requirement for a versioned artifact with change tracking.

Answer

Azure Policy

Answer

Azure Resource Manager (ARM) templates

Answer

Azure Management Groups

Question 3

A company runs a web application on two Azure virtual machines (VMs) in different availability zones within the same region. The application maintains user session state in memory on the VMs. The company needs a load balancing solution that distributes incoming HTTP requests across both VMs, ensures all requests from a specific user session are routed to the same VM (session persistence), and terminates SSL/TLS to offload encryption from the VMs. Which Azure service should the company use?

Accepted Answer

Azure Application Gateway v2. Azure Application Gateway v2 is a layer-7 load balancer that supports HTTP/HTTPS traffic, SSL/TLS termination, and session persistence (sticky sessions) via cookie-based affinity. This makes it the correct choice for distributing HTTP requests across VMs in different availability zones while maintaining user session state and offloading encryption.

Answer

Azure Load Balancer (Standard)

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 4

A company wants to understand who is responsible for securing the operating system on an Azure virtual machine. According to the shared responsibility model, who is responsible?

Accepted Answer

Microsoft is responsible for the physical host and network, while the customer is responsible for the guest OS and applications.. Under the shared responsibility model for IaaS like Azure VMs, Microsoft secures the physical datacenter, host OS, and network infrastructure, while the customer is responsible for securing the guest OS (e.g., applying patches, configuring firewalls) and any applications running on the VM. This division is explicit in Azure's documentation, where the customer retains control over the OS and software stack.

Answer

Microsoft is responsible for all security.

Answer

The customer is responsible for all security.

Answer

Responsibility is split 50/50.

Question 5

A company runs a mission-critical application on Azure virtual machines. The application is hosted in the East US Azure region. To protect against a regional disaster, the company configures Azure Site Recovery to replicate the VMs to a secondary region (West US). If a disaster occurs in East US, the company can initiate a failover to West US and bring the application back online within minutes using the replicated data. Which cloud computing benefit does this scenario best demonstrate?

Accepted Answer

Disaster recovery and business continuity. Option C is correct because Azure Site Recovery provides disaster recovery and business continuity by replicating Azure VMs from the primary region (East US) to a secondary region (West US). In the event of a regional disaster, failover can be initiated to bring the application online within minutes using the replicated data, ensuring minimal downtime and data loss. This directly aligns with the cloud benefit of disaster recovery and business continuity, which focuses on maintaining operations during catastrophic failures.

Answer

Elasticity

Answer

Pay-as-you-go pricing

Answer

Geo-redundancy

Question 6

A company has multiple Azure subscriptions for different projects. They want to apply the same set of Azure policies and role assignments to all subscriptions under a specific department, and they plan to add more subscriptions in the future. Which Azure construct should they use?

Accepted Answer

Management group. A management group is the correct construct because it allows you to manage governance, policy, and role assignments across multiple Azure subscriptions hierarchically. By placing all subscriptions for a department under a single management group, you can apply the same Azure Policy and role-based access control (RBAC) assignments once, and any new subscriptions added to that group will automatically inherit those settings.

Answer

Resource group

Answer

Azure Policy initiative

Answer

Azure Blueprint

Question 7

A company needs to store large amounts of unstructured data, such as images and videos, which will be accessed by multiple applications over the internet. The data must be highly durable and available. Which Azure storage service should they use?

Accepted Answer

Azure Blob Storage. Azure Blob Storage is designed for storing massive amounts of unstructured data, such as images and videos, and provides high durability (99.9999999999% with LRS) and availability through geo-replication options. It supports access via HTTP/HTTPS from any internet-connected application, making it ideal for this scenario.

Answer

Azure Files

Answer

Azure Queue Storage

Answer

Azure Disk Storage

Question 8

A financial services company is evaluating a public cloud provider. They are concerned about the shared responsibility model for security. The company must ensure that their customer data is encrypted at rest and in transit. Under the shared responsibility model, which security control is the cloud provider typically responsible for?

Accepted Answer

Physical network security. Under the shared responsibility model, the cloud provider is responsible for the security OF the cloud, which includes physical network security such as protecting the data center perimeter, network infrastructure, and hardware. This is correct because physical security controls (e.g., access badges, surveillance, and network firewalls at the provider's edge) are entirely the provider's domain and cannot be delegated to the customer.

Answer

Encrypting customer data at rest

Answer

Patching virtual machines

Answer

Managing customer access policies

Question 9

A rapidly growing e-commerce company currently hosts its website on a single server in a US data center. Customers in Europe and Asia report slow load times and timeouts. The company wants to improve performance for global users without building and managing data centers worldwide. They plan to deploy the website on Azure virtual machines in multiple Azure regions (e.g., West Europe, Southeast Asia) and use Azure Traffic Manager to route users to the closest region. Which benefit of cloud computing does this approach primarily demonstrate?

Accepted Answer

Global reach. This approach primarily demonstrates global reach, which is the ability to deploy applications and services across multiple geographic regions to provide low-latency access to users worldwide. By hosting the website on Azure VMs in West Europe and Southeast Asia, and using Azure Traffic Manager to route users to the closest region based on DNS-based traffic routing (e.g., performance or geographic routing methods), the company leverages Azure's distributed infrastructure without building or managing its own data centers. This directly addresses the performance issues for European and Asian customers by reducing network latency and avoiding timeouts.

Answer

Scalability

Answer

Elasticity

Answer

High availability

Question 10

A startup wants to run a web application without purchasing or managing any servers. They only want to upload their code and let the cloud provider handle everything from the runtime to scaling. Which cloud service model best fits this requirement?

Accepted Answer

Platform as a Service (PaaS). Platform as a Service (PaaS) is the correct model because it provides a fully managed hosting environment where the startup can deploy their web application code without needing to provision or manage underlying servers, operating systems, or runtime infrastructure. Azure App Service is a prime example of PaaS that handles automatic scaling, load balancing, and patching, allowing developers to focus solely on code.

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Question 11

A company wants to organize their Azure subscriptions into a hierarchy to manage access policies and cost across different departments. They have three departments: Sales, Marketing, IT. What should they create first?

Accepted Answer

Management groups. Management groups are the correct first step because they allow you to organize Azure subscriptions into a hierarchy for centralized management of access policies and cost across departments. By creating a management group hierarchy (e.g., Root → Departments → Sales, Marketing, IT), you can apply Azure Policy and role-based access control (RBAC) at the management group level, which then cascades down to all subscriptions and resources within that branch. This enables consistent governance and cost tracking across the entire department without needing to configure each subscription individually.

Answer

Resource groups

Answer

Azure Policy

Answer

Tagging

Question 12

A global e-commerce company runs its website on Azure virtual machines in two different Azure regions: West US and East US. The company wants to distribute incoming web traffic to the region that provides the lowest latency for each user. Additionally, if one region becomes unavailable, all traffic should automatically fail over to the healthy region. The solution must not require any changes to the web application code. Which Azure service should the company use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that directs incoming web traffic to the region with the lowest latency based on the user's DNS resolver location. It supports automatic failover by routing traffic to the next healthy endpoint if a region becomes unavailable, and it requires no changes to the web application code because it operates at the DNS level.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 13

A company stores critical configuration data in an Azure Storage account. The IT administrator wants to prevent accidental deletion of this storage account. However, the administrator must still be able to read and update the data within the storage account. The company uses Azure Role-Based Access Control (RBAC) to manage permissions. Which Azure governance feature should the administrator implement to achieve this goal?

Accepted Answer

A Delete lock on the storage account. Option D is correct because a Delete lock on the storage account prevents deletion of the resource while still allowing read and update operations on the data within it. Azure resource locks operate at the resource level, overriding any RBAC permissions that would otherwise allow deletion, but they do not restrict data plane operations like reading or writing blobs or tables. This directly meets the administrator's requirement to protect against accidental deletion while maintaining full read/update access.

Answer

Azure Policy with the deny effect to block deletion of the storage account

Answer

An Azure Blueprint that includes the storage account with a policy to prevent deletion

Answer

A Read-only lock on the storage account

Question 14

A small business wants to migrate its IT infrastructure to Azure. The owner wants the ability to provision new virtual machines, storage accounts, and databases entirely through a web-based portal, without needing to submit a formal request or wait for an administrator to manually allocate resources. The owner expects resources to be available immediately after configuration. Which characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

On-demand self-service. This scenario best illustrates on-demand self-service because the owner can provision virtual machines, storage accounts, and databases through a web-based portal (such as the Azure portal) without requiring human interaction with the cloud provider's administrators. The key characteristic is that resources are available immediately after configuration, eliminating the need for formal requests or manual allocation, which is the essence of on-demand self-service as defined by NIST SP 800-145.

Answer

Broad network access

Answer

Resource pooling

Answer

Rapid elasticity

Question 15

A global retail company hosts its e-commerce web application on Azure virtual machines in three Azure regions: West Europe, East US, and Southeast Asia. The application must provide a single HTTPS entry point for customers worldwide. The company requires the solution to: route each user to the region that provides the best performance (lowest latency), automatically redirect traffic to a healthy region if one becomes unavailable, and protect the application from common web vulnerabilities such as SQL injection and cross-site scripting (XSS) by inspecting all incoming HTTP/HTTPS traffic at the edge. Which Azure service should the company use?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it provides global HTTP(S) load balancing with latency-based routing to the nearest region, automatic failover across regions, and built-in Web Application Firewall (WAF) at the edge to inspect all incoming traffic for SQL injection and XSS. This single service meets all three requirements—performance routing, regional failover, and edge-level web vulnerability protection—without needing additional components.

Answer

Azure Traffic Manager with a Web Application Firewall (WAF) policy applied to each backend virtual machine

Answer

Azure Application Gateway

Answer

Azure Load Balancer

Question 16

A small business wants to move its accounting software to the cloud to avoid purchasing and maintaining physical servers. Which cloud service model would provide the accounting application as a ready-to-use service over the internet?

Accepted Answer

Software as a Service (SaaS). Option C (SaaS) is correct because the business needs a ready-to-use accounting application delivered over the internet without managing underlying infrastructure. SaaS provides fully functional software accessed via a web browser, where the provider handles all maintenance, updates, and server management, aligning perfectly with the goal of avoiding physical server ownership.

Answer

Infrastructure as a Service (IaaS)

Answer

Platform as a Service (PaaS)

Answer

Function as a Service (FaaS)

Question 17

A startup wants to deploy a web application that experiences unpredictable traffic spikes. They need to scale resources automatically without manual intervention. Which benefit of cloud computing directly addresses this requirement?

Accepted Answer

Elasticity. Elasticity is the cloud computing benefit that enables resources to automatically scale out (add instances) during traffic spikes and scale in (remove instances) when demand drops, without manual intervention. This directly matches the startup's need to handle unpredictable traffic patterns by dynamically adjusting compute capacity, typically using services like Azure Virtual Machine Scale Sets or Azure App Service auto-scale rules.

Answer

High availability

Answer

Disaster recovery

Answer

Fault tolerance

Question 18

A finance company is migrating a mission-critical trading application to Azure. The application must be resilient to a complete datacenter failure within the same Azure region. The solution should provide low-latency replication between separate physical locations with independent power, cooling, and networking. Which Azure feature should they use?

Accepted Answer

Availability Zones. Availability Zones (B) are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. They provide low-latency replication and protect against a complete datacenter failure by allowing the application to run in multiple zones simultaneously, ensuring high availability and resilience within a single region.

Answer

Availability Sets

Answer

Azure Site Recovery

Answer

Region Pairs

Question 19

A startup frequently deploys identical environments for development, testing, and production. They want to ensure all deployments are consistent and follow best practices without manual configuration. They need a declarative JSON-based method to define the entire infrastructure (virtual machines, databases, networking) so that the same template can be reused across environments. Which Azure service should the startup use?

Accepted Answer

Azure Resource Manager templates. Azure Resource Manager (ARM) templates are the correct choice because they provide a declarative JSON-based syntax to define and deploy entire Azure infrastructures consistently. This allows the startup to reuse the same template across development, testing, and production environments, ensuring identical configurations without manual intervention. ARM templates also enforce idempotent deployments, meaning the same template can be applied repeatedly to achieve the same state.

Answer

Azure PowerShell scripts

Answer

Azure CLI commands

Answer

Azure Blueprints

Question 20

A team uses Docker containers to run microservices. They need a service that automatically manages the cluster, scales containers based on demand, and provides load balancing without requiring them to manage the underlying VMs. Which Azure compute service should they choose?

Accepted Answer

Azure Kubernetes Service. Azure Kubernetes Service (AKS) is the correct choice because it provides a managed Kubernetes cluster that automates container orchestration, scaling, and load balancing. AKS abstracts the underlying VMs, handling master node management, updates, and scaling based on demand, which aligns with the team's requirement to avoid VM management.

Answer

Azure Container Instances

Answer

Azure Batch

Answer

Azure Virtual Machine Scale Sets