AZ-900 Practice Test 28 — 15 Questions

Question 1

A finance company is migrating a mission-critical trading application to Azure. The application must be resilient to a complete datacenter failure within the same Azure region. The solution should provide low-latency replication between separate physical locations with independent power, cooling, and networking. Which Azure feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Availability Zones. Availability Zones (B) are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. They provide low-latency replication and protect against a complete datacenter failure by allowing the application to run in multiple zones simultaneously, ensuring high availability and resilience within a single region.

Answer

Availability Sets

Answer

Azure Site Recovery

Answer

Region Pairs

Question 2

A company is subject to strict data residency regulations that require all personally identifiable information (PII) to remain on their own physical servers. However, they want to use Azure for compute-intensive analytics that do not process PII. They also need a consistent set of management tools to manage resources across both environments. Which cloud deployment model should the company adopt?

Accepted Answer

Hybrid cloud. The hybrid cloud model is correct because it allows the company to keep PII on-premises (private cloud) to satisfy data residency regulations while running compute-intensive analytics in Azure (public cloud). Azure Arc provides a consistent set of management tools to govern resources across both environments, enabling unified policy, compliance, and monitoring.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 3

A company has an Azure Policy assignment that denies the creation of any virtual machine (VM) that does not have a mandatory 'CostCenter' tag. A development team needs to deploy a temporary test VM without the required tag for a short-term experiment. The governance team wants to allow this specific exception while recording the reason for the exception, ensuring the policy is still enforced for all other resources. The exception must also automatically expire after 30 days. Which Azure Policy feature should the governance team use?

Accepted Answer

Exemption. Azure Policy Exemption allows the governance team to create a specific exception for the test VM while recording the reason and setting an automatic expiration date (30 days). Unlike exclusion scopes, exemptions are explicitly designed to handle scenarios where a resource should be excluded from policy evaluation with a defined justification and expiry, ensuring the policy remains enforced for all other resources.

Answer

Exclusion scope

Answer

Audit effect

Answer

Override effect

Question 4

A company runs a legacy database on a single Azure virtual machine. The database is experiencing performance issues as the dataset grows. The IT team decides to increase the virtual machine size from Standard_D2s_v3 (2 vCPUs, 8 GB RAM) to Standard_D8s_v3 (8 vCPUs, 32 GB RAM) to improve performance. This process is an example of which cloud computing concept?

Accepted Answer

Vertical scaling. Vertical scaling (also known as scaling up) involves increasing the capacity of a single resource, such as adding more vCPUs and RAM to an existing virtual machine. In this scenario, the IT team is resizing the Azure VM from Standard_D2s_v3 to Standard_D8s_v3, which increases the compute and memory resources of the same instance. This directly matches the definition of vertical scaling, where performance is improved by upgrading the existing machine rather than adding more machines.

Answer

Horizontal scaling

Answer

Elasticity

Answer

High availability

Question 5

A company uses Azure Blob Storage to store compliance documents that are required to be kept for 10 years. The documents are very rarely accessed; on average, only 2-3 requests per year are made, usually for audits. The company needs the lowest possible storage cost. When a document is requested, the company can tolerate a retrieval time of up to 15 hours. Which Azure Blob Storage access tier should the company use?

Accepted Answer

Archive access tier. The Archive access tier is designed for data that is rarely accessed and has a flexible retrieval time, offering the lowest storage cost among Azure Blob Storage tiers. With only 2-3 requests per year and a tolerance for up to 15-hour retrieval latency, the Archive tier (which typically takes up to 15 hours to rehydrate) perfectly matches the requirements while minimizing storage expenses.

Answer

Hot access tier

Answer

Cool access tier

Answer

Premium access tier

Question 6

A company has an Azure subscription that contains production resources. The IT manager is concerned that a user who has the Contributor role might accidentally delete the entire subscription. The company wants a solution that prevents anyone from deleting the subscription, even users with the Owner role, while still allowing modifications to the resources inside the subscription. What should the administrator configure?

Accepted Answer

Apply a resource lock of type 'Delete' at the subscription level.. A resource lock of type 'Delete' at the subscription level prevents any user, including those with the Owner role, from deleting the subscription. This lock overrides all RBAC permissions, ensuring that while modifications to resources inside the subscription are still allowed, the subscription itself cannot be removed. This directly addresses the IT manager's concern about accidental deletion.

Answer

Assign a custom role-based access control (RBAC) role that denies the delete action for all users.

Answer

Configure an Azure Policy with the 'Deny' effect to block deletion of the subscription.

Answer

Apply a resource lock of type 'ReadOnly' at the subscription level.

Question 7

A company runs a web application in two Azure regions: East US and West US. The company wants to route users automatically to the region that provides the lowest network latency. If one region becomes unavailable, all traffic should be rerouted to the healthy region. The company does not need to offload Transport Layer Security (TLS) or perform URL-based routing. Which Azure service should the company use to distribute traffic at the DNS level?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager operates at the DNS level, using DNS responses to direct user traffic to the region with the lowest network latency based on the Performance traffic-routing method. It also supports automatic failover: if a region becomes unavailable, Traffic Manager detects the endpoint health probe failure and reroutes all traffic to the healthy region. This matches the requirement exactly, as the company needs DNS-level distribution without TLS offloading or URL-based routing.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 8

A company's field employees use a custom mobile app to upload sales data from their smartphones while at client sites. The app connects to an Azure-hosted backend API. The company's IT team notes that the mobile app can connect to the Azure service using standard HTTPS from any location with internet connectivity, without requiring a VPN. This ability to access cloud resources over the internet from various devices and locations is an example of which key characteristic of cloud computing?

Accepted Answer

Broad network access. Broad network access means cloud resources can be accessed over standard network protocols (like HTTPS) from a wide range of devices (smartphones, laptops, tablets) and locations without requiring a private connection such as a VPN. In this scenario, the mobile app uses HTTPS to reach the Azure backend API from any internet-connected location, which directly matches the NIST definition of broad network access.

Answer

Rapid elasticity

Answer

Measured service

Answer

Resource pooling

Question 9

A company has deployed several virtual machines in an Azure virtual network. The IT administrators need to connect to these VMs using RDP and SSH from the internet. However, the company's security policy prohibits assigning any public IP addresses to the VMs and also prohibits exposing the VMs directly to the internet. The solution must be fully managed by Azure and require no additional infrastructure in the virtual network. Which Azure service should the company use?

Accepted Answer

Azure Bastion. Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to virtual machines directly in the Azure portal over TLS. It eliminates the need for public IP addresses on the VMs and does not require any additional infrastructure in the virtual network, as it is deployed inside the virtual network and uses a private IP to connect to the VMs.

Answer

Azure Virtual Network Peering

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Question 10

A company runs a web application on Azure App Service. The application experiences variable traffic patterns with occasional sudden spikes. The company wants to automatically increase the number of instances during high demand and decrease them during low demand to optimize cost and performance. The solution must require no manual intervention after initial configuration. Which Azure App Service feature should the company enable?

Accepted Answer

Autoscale. Autoscale is the correct feature because it automatically adjusts the number of App Service instances based on predefined rules (e.g., CPU > 70% or memory pressure) or schedules, matching the variable traffic patterns and sudden spikes described. This ensures cost optimization by scaling down during low demand and performance during high demand, all without manual intervention after initial configuration.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Availability Zones

Question 11

A company runs a web application in Azure that experiences variable traffic throughout the day. During peak hours, the application becomes slow because the existing virtual machine (VM) cannot handle the increased load. The solution architect proposes adding more VMs of the same size and distributing incoming requests across all of them to balance the load. Which scaling concept does this approach represent?

Accepted Answer

Horizontal scaling. Horizontal scaling (also known as scaling out) involves adding more virtual machines of the same size to distribute incoming traffic across them. In this scenario, adding more VMs of the same size and using a load balancer to distribute requests directly matches the definition of horizontal scaling, which increases system capacity by adding more instances rather than increasing the power of a single instance.

Answer

Vertical scaling

Answer

Elastic scaling

Answer

Disaster recovery

Question 12

A global company creates a new Azure subscription for each major project. To ensure compliance and consistency, the governance team needs a single, versioned, auditable package that, when assigned to a subscription, automatically deploys a standard set of Azure Policy assignments, role assignments, a resource group structure, and a pre-configured virtual network. The solution must allow these packages to be updated centrally and have changes tracked for auditing. Which Azure service should the governance team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it provides a single, versioned, auditable package that can be assigned to a subscription to orchestrate the deployment of Azure Policy assignments, role assignments, resource groups, and resource templates (like a virtual network). Blueprints support versioning and central update management, with changes tracked in the blueprint definition history for auditing. This aligns exactly with the requirement for a governance team to enforce compliance and consistency across subscriptions.

Answer

Azure Policy

Answer

Azure Resource Manager templates

Answer

Management groups

Question 13

A company runs an Azure SQL Database that stores sensitive customer data. The security team mandates that all traffic to the database must remain entirely within the Microsoft Azure backbone network and never traverse the public internet. The database can only be accessed by a specific application running on virtual machines in a specific Azure virtual network. Which Azure feature should they configure to meet this requirement?

Accepted Answer

Azure Private Endpoint. Azure Private Endpoint assigns a private IP address from your virtual network to the Azure SQL Database, allowing traffic to reach the database over the Microsoft backbone network without ever leaving the Azure network or traversing the public internet. This ensures that all communication between the application VMs and the database remains private and secure, meeting the mandate that traffic must never traverse the public internet.

Answer

Azure Service Endpoint

Answer

VNet Peering

Answer

Azure Firewall

Question 14

A company has three departments: Sales, Marketing, and IT. Each department has its own Azure subscription. The IT department manages all networking and security policies across all subscriptions. The Sales and Marketing departments should be able to create and manage their own resources but cannot modify networking or security policies. The IT department wants to apply a consistent set of policies (e.g., enforce tagging, restrict VM SKUs) across all subscriptions without needing to assign policies to each subscription individually. Additionally, the IT department wants to delegate administration of a specific custom role to a junior administrator who can assign that role to users within the Sales subscription only. Which combination of Azure governance features should the IT department use?

Accepted Answer

Create a management group containing all three subscriptions, assign Azure Policy initiatives at the management group, and use Azure RBAC with a custom role scoped to the Sales subscription.. Azure management groups allow hierarchical policy inheritance: assigning an Azure Policy initiative at the management group level automatically applies it to all child subscriptions (Sales, Marketing, IT). This satisfies the requirement for consistent policies without individual assignment. Additionally, Azure RBAC with a custom role scoped to the Sales subscription enables the IT department to delegate administration of that role to a junior administrator, who can then assign it only within the Sales subscription, meeting the delegation requirement precisely.

Answer

Create a management group for each department, assign Azure Policy initiatives at each management group, and use Azure Blueprints to manage role assignments.

Answer

Use Azure Resource Manager templates to deploy policies and role assignments to each subscription, and use Azure Active Directory administrative units to manage delegation.

Answer

Assign Azure Policy initiatives to each subscription individually, and create a custom role that is scoped to the management group.

Question 15

A company is developing a custom web application that will be deployed to Azure. The development team wants to minimize operational overhead and avoid any responsibility for managing the underlying operating system, runtime, or middleware. They want to focus solely on writing application code and managing data. Which cloud service model should the company use for this application?

Accepted Answer

Platform as a Service (PaaS). Platform as a Service (PaaS) is the correct model because it abstracts the underlying OS, runtime, and middleware, allowing developers to focus solely on writing application code and managing data. Azure App Service is a PaaS offering that provides automatic patching, load balancing, and scaling without any responsibility for the host OS or runtime environment. This directly matches the requirement to minimize operational overhead and avoid managing infrastructure layers.

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Answer

Functions as a Service (FaaS)