AZ-900 Practice Test 29 — 15 Questions

Question 1

A retail company is planning to migrate its e-commerce application to Azure. The application will run on an Azure virtual machine that the company will manage. The IT manager wants to ensure that security patches are applied promptly. According to the shared responsibility model, who is responsible for applying security updates to the guest operating system of the Azure virtual machine?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The customer, because the guest operating system is under the customer's control.. In the shared responsibility model, the customer is responsible for securing and patching the guest operating system (OS) of an Azure virtual machine because the customer retains control over the OS, applications, and data. Microsoft manages the underlying hypervisor and physical infrastructure but does not have access to the guest OS. Therefore, the customer must apply security updates to the guest OS.

Answer

Microsoft, because they manage the hypervisor under the virtual machine.

Answer

Both Microsoft and the customer share responsibility equally for patching the guest operating system.

Answer

The customer, but only if they have configured Azure Policy to enforce patch compliance.

Question 2

A company deploys web servers across Azure regions East US and West Europe. The application must automatically direct each user to the region that provides the lowest network latency, and if an entire region becomes unavailable, traffic must be seamlessly redirected to the remaining healthy region. Which Azure service should the company use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that directs user requests to the nearest available endpoint based on the lowest network latency. It also supports automatic failover: if a region becomes unavailable, Traffic Manager detects the endpoint health failure via health probes and redirects traffic to the remaining healthy region, providing seamless global load balancing and disaster recovery.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 3

A company uses Azure Policy to enforce governance. They want to prevent users from creating virtual machines of the Standard_DS3_v2 SKU in their subscription, and they also want to log any attempt to create such a VM (whether successful or not) for audit purposes. What is the minimum number of Azure Policy assignments required to meet both requirements?

Accepted Answer

Two – assign one policy definition with the Deny effect and another with the Audit effect.. Azure Policy can only enforce a single effect per policy definition. To both deny the creation of Standard_DS3_v2 VMs and log all attempts (successful or denied) for audit, you need two separate policy assignments: one with the Deny effect to block the action, and another with the Audit effect to log the attempt. A single policy cannot combine both effects, as each definition is limited to one effect type.

Answer

One – assign a policy definition with the Deny effect.

Answer

One – assign a policy definition with the Audit effect.

Answer

Two – assign one policy definition with the Deny effect and another with the Append effect.

Question 4

A company runs a legacy application on-premises that must store data within the country due to regulatory requirements. To handle occasional peak workloads, the company connects its local network to an Azure virtual network via a site-to-site VPN. During these peaks, the application scales out to Azure virtual machines that process compute tasks but never store regulated data outside the on-premises datacenter. Which cloud deployment model does this scenario best describe?

Accepted Answer

Hybrid cloud. The scenario combines an on-premises private infrastructure (the legacy application and regulated data) with Azure public cloud resources (virtual machines for compute scaling) connected via a site-to-site VPN. This integration of private and public resources to handle variable workloads while maintaining data sovereignty defines a hybrid cloud deployment model.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 5

A financial institution must keep sensitive customer financial data on-premises to comply with regulatory requirements. However, they also want to use Azure to run compute-intensive analytics on anonymized datasets, taking advantage of scalable resources without managing physical servers. Which cloud deployment model should they adopt?

Accepted Answer

Hybrid cloud. The hybrid cloud model is correct because it allows the financial institution to keep sensitive customer data on-premises for regulatory compliance while leveraging Azure's public cloud for compute-intensive analytics on anonymized datasets. This approach combines the security and control of a private cloud (on-premises) with the scalability and managed services of a public cloud, without requiring the organization to manage physical servers for the analytics workload.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 6

A company deploys a critical application on Azure virtual machines across three different availability zones in the East US region. The application is designed to handle the failure of one zone by automatically failing over to the remaining healthy zones. Which type of failure does this architecture primarily protect against?

Accepted Answer

A failure of an entire Azure data center. Deploying a critical application across multiple availability zones protects against the failure of an entire Azure data center. Each availability zone is a physically separate data center within an Azure region, with independent power, cooling, and networking. If one zone fails, the application automatically fails over to the remaining healthy zones, ensuring high availability at the data center level.

Answer

A regional disaster that affects the entire East US region

Answer

A failure of a single physical server

Answer

A failure of the Azure network backbone

Question 7

A company is migrating its customer relationship management (CRM) system to a Software as a Service (SaaS) provider. The provider manages the application, runtime, middleware, and infrastructure. The company's IT security team is concerned about who is responsible for protecting the company's data and managing user access. Based on the shared responsibility model for cloud computing, which statement is correct?

Accepted Answer

The company is responsible for managing user access and protecting their own data within the SaaS application.. In the shared responsibility model for SaaS, the provider manages the application, runtime, middleware, and infrastructure, but the customer retains responsibility for securing their own data and managing user access. This includes tasks such as data classification, identity and access management (IAM), and ensuring compliance with internal policies. Option C correctly identifies that the company must handle user access and data protection within the SaaS application.

Answer

The SaaS provider is responsible for everything, including data classification and user access control.

Answer

The company is responsible for the security of the application itself, including patching vulnerabilities in the CRM software.

Answer

The SaaS provider is responsible for physical security of data centers, and the company is responsible for patching the operating system of the servers hosting the CRM.

Question 8

A retail company runs an e-commerce application on Azure virtual machines. Traffic follows a predictable daily pattern: peak load occurs from 9 AM to 5 PM on weekdays. To handle this, the company configures an Azure autoscale rule that adds virtual machines at 8:30 AM and removes them at 5:30 PM each weekday. This scenario best demonstrates which cloud computing characteristic?

Accepted Answer

Elasticity. Elasticity is the ability to dynamically scale resources up or down to match demand. In this scenario, the autoscale rule adds VMs at 8:30 AM to handle the predictable peak load and removes them at 5:30 PM, demonstrating automatic resource provisioning and de-provisioning based on a schedule. This is a textbook example of elasticity in cloud computing.

Answer

High availability

Answer

Agility

Answer

Fault tolerance

Question 9

A company has an Azure tenant with a management group hierarchy. The 'Production' management group contains five subscriptions used by the operations team. The IT security team wants to grant the 'Network Contributor' role to a group of network administrators for all subscriptions under the 'Production' management group. The role assignment must automatically apply to any new subscription added under the 'Production' management group in the future. The network administrators already exist as a security group in Azure AD. What is the most efficient way to achieve this?

Accepted Answer

Assign the 'Network Contributor' role to the security group at the 'Production' management group scope.. Assigning the 'Network Contributor' role at the 'Production' management group scope is the most efficient method because management groups provide a hierarchical scope that automatically inherits role assignments to all child subscriptions, including any new subscriptions added in the future. This eliminates the need for manual assignments per subscription and ensures consistent access control across the entire management group hierarchy.

Answer

Assign the 'Network Contributor' role at the scope of each existing subscription individually, and remember to assign it to new subscriptions manually.

Answer

Create an Azure Policy that assigns the 'Network Contributor' role to the security group for all subscriptions under 'Production'.

Answer

Assign the 'Network Contributor' role to the security group at the root management group scope.

Question 10

A startup runs a web application on Azure virtual machines. The application experiences sudden, short-lived spikes in traffic multiple times a day. The startup configures an autoscale rule that adds two additional VM instances when CPU usage exceeds 75% and removes them when CPU drops below 30%. This approach is designed to match resource consumption closely to demand. Which cloud computing characteristic does this scenario primarily demonstrate?

Accepted Answer

Elasticity. Elasticity is the ability of a cloud system to automatically scale resources up or down based on real-time demand. In this scenario, the autoscale rule dynamically adds two VM instances when CPU exceeds 75% and removes them when CPU drops below 30%, closely matching resource consumption to traffic spikes. This on-demand provisioning and de-provisioning of compute capacity is the defining characteristic of elasticity.

Answer

High Availability

Answer

Fault Tolerance

Answer

Durability

Question 11

A company runs a legacy application on-premises that cannot be migrated to the cloud due to strict data sovereignty laws requiring customer data to remain within the country's physical borders. The company wants to use Azure's advanced analytics services to gain insights from the data. They plan to keep the data on-premises but run the analytics workloads in Azure. Which cloud deployment model should they use?

Accepted Answer

Hybrid cloud. The hybrid cloud model is correct because it combines on-premises infrastructure (for data sovereignty compliance) with Azure's public cloud services (for advanced analytics). This allows the company to keep customer data within the country's physical borders while leveraging Azure's analytics workloads, such as Azure Synapse Analytics or Azure Machine Learning, without migrating the data to the cloud.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 12

A company runs a critical transaction processing application on two Azure virtual machines. The infrastructure is designed so that if one virtual machine encounters a hardware failure and stops functioning, the other virtual machine continues to serve traffic without any interruption or loss of service. Which cloud computing characteristic does this design primarily address?

Accepted Answer

Fault tolerance. The design ensures that if one virtual machine fails due to a hardware failure, the other continues serving traffic without any interruption or loss of service. This is the definition of fault tolerance, which eliminates any single point of failure and maintains continuous operation even when a component fails. High availability reduces downtime but may allow brief interruptions during failover, whereas fault tolerance guarantees zero interruption.

Answer

High availability

Answer

Disaster recovery

Answer

Scalability

Question 13

Which Azure networking service allows you to privately access Azure PaaS services from your virtual network using a private IP address?

Accepted Answer

Azure Private Endpoint. Azure Private Endpoint is correct because it assigns a private IP address from your virtual network to an Azure PaaS service (e.g., Azure SQL Database, Storage), enabling secure, private connectivity without traversing the public internet. This uses Azure Private Link to bring the service into your VNet, ensuring traffic stays within the Microsoft backbone network.

Answer

Azure Service Endpoint

Answer

Azure NAT Gateway

Answer

Azure VPN Gateway

Question 14

Which Azure feature automatically moves blob data between access tiers based on defined rules to optimize storage costs?

Accepted Answer

Azure Blob Storage lifecycle management policies. Azure Blob Storage lifecycle management policies allow you to define rules that automatically move blob data between access tiers (hot, cool, cold, archive) or delete data based on age or last modification time. This reduces storage costs by ensuring data is stored in the most cost-effective tier without manual intervention.

Answer

Azure Storage Explorer

Answer

Azure Intelligent-Tiering

Answer

Azure Cost Management auto-optimization

Question 15

A company is moving its IT infrastructure to the cloud to avoid large upfront hardware purchases and instead pay a predictable monthly fee. Which cloud benefit does this represent?

Accepted Answer

Consumption-based pricing. Consumption-based pricing is a cloud benefit where customers pay only for the resources they use (e.g., compute hours, storage GBs) rather than making large upfront capital expenditures. This model shifts costs from CapEx to OpEx, enabling predictable monthly billing based on actual consumption. The scenario explicitly describes avoiding upfront hardware purchases and paying a predictable monthly fee, which directly aligns with this pay-as-you-go model.

Answer

High availability

Answer

Elasticity

Answer

Scalability