AZ-900 Practice Test 31 — 15 Questions

Question 1

A company runs a customer-facing e-commerce platform on multiple Azure virtual machines behind a load balancer. The platform experiences unpredictable traffic spikes during promotions. The operations team needs a solution that automatically adds new virtual machines when CPU utilization exceeds 80% and removes virtual machines when utilization drops below 30%. The solution must also ensure that if a virtual machine fails, the load balancer immediately stops routing traffic to it. Which Azure compute service should the team use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Virtual Machine Scale Sets. Virtual Machine Scale Sets (VMSS) provide automatic scaling based on metrics like CPU utilization, enabling the platform to add VMs when CPU exceeds 80% and remove VMs when it drops below 30%. Additionally, VMSS integrates with Azure Load Balancer to automatically detect VM failures via health probes and immediately stop routing traffic to unhealthy instances, meeting all stated requirements.

Answer

Azure App Service

Answer

Availability Sets

Answer

Azure Batch

Question 2

What is 'zero trust' security model, and how does Azure support it?

Accepted Answer

A model that verifies every access request regardless of network location. The zero trust security model operates on the principle of 'never trust, always verify,' meaning every access request is authenticated, authorized, and encrypted regardless of the user's location or network. Azure supports zero trust through services like Azure Active Directory (now Microsoft Entra ID) for conditional access policies, Azure Policy for enforcing compliance, and Azure Security Center for continuous monitoring and threat detection.

Answer

A model that trusts all traffic within the corporate network boundary

Answer

A model that uses no security controls to maximize productivity

Answer

A model that allows only Microsoft-approved applications on Azure

Question 3

A company deploys a line-of-business application on an Azure virtual machine. The IT team wants to ensure the application remains secure. According to the shared responsibility model, which of the following security tasks is the sole responsibility of the customer (the company)?

Accepted Answer

Configuring the network security group (NSG) rules to restrict inbound traffic to the virtual machine.. Configuring Network Security Group (NSG) rules to restrict inbound traffic is a customer responsibility under the shared responsibility model. The customer controls the virtual network and VM-level access, including defining allow/deny rules for protocols like TCP/UDP on specific ports. Azure manages the underlying infrastructure, but the customer must secure their own application traffic.

Answer

Protecting the physical servers in the Azure datacenter with video surveillance and access controls.

Answer

Ensuring the hypervisor that isolates virtual machines is free from vulnerabilities.

Answer

Maintaining the security of the Azure Fabric Controller that manages the host servers.

Question 4

A startup wants to migrate its application to Azure. The development team needs to be able to provision virtual machines and storage on demand without waiting for manual approval from a central IT team. Which characteristic of cloud computing directly fulfills this requirement?

Accepted Answer

On-demand self-service. B is correct because on-demand self-service allows users to provision cloud resources like virtual machines and storage automatically, without requiring human interaction or manual approval from a central IT team. This characteristic is defined by NIST SP 800-145 as the ability for a consumer to unilaterally provision computing capabilities as needed, which directly matches the startup's requirement for no-wait provisioning.

Answer

Measured service

Answer

Rapid elasticity

Answer

Resource pooling

Question 5

Which Azure service enables you to build, train, and deploy machine learning models using automated ML capabilities?

Accepted Answer

Azure Machine Learning. Azure Machine Learning is the correct service because it provides a comprehensive platform for building, training, and deploying machine learning models, including automated ML (AutoML) capabilities that automatically iterate over algorithms and hyperparameters to find the best model for your data. This directly matches the question's requirement for automated ML features.

Answer

Azure Cognitive Services

Answer

Azure Bot Service

Answer

Azure Databricks

Question 6

A startup wants to run a web application without managing the underlying servers. They only want to upload their code and let the cloud provider handle the runtime, scaling, and maintenance. Which cloud service model is this?

Accepted Answer

Platform as a Service (PaaS). Platform as a Service (PaaS) is the correct model because it provides a managed hosting environment where the startup can deploy their web application code without managing the underlying servers, operating systems, or runtime infrastructure. Azure App Service is a prime example of PaaS, handling automatic scaling, patching, and load balancing while the customer only focuses on code and data.

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Question 7

A company runs a web application on two Azure virtual machines in the same region. The application must be accessible from the internet, and incoming traffic should be distributed evenly across both VMs. Additionally, the company needs to offload Transport Layer Security (TLS) termination to a single service and route requests based on the URL path (e.g., /images to one set of VMs, /api to another). Which Azure service should the company use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 (HTTP/HTTPS) load balancer that supports TLS termination, URL path-based routing, and cookie-based session affinity. This allows the company to offload TLS decryption to a single service and route requests like /images or /api to different backend pools, meeting all stated requirements.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 8

A company uses Azure Policy to enforce governance rules across its subscriptions. The governance team wants to ensure that every resource in the 'Production' subscription has a tag named 'Environment' with the value 'Production'. If a resource is created without this tag, or with a different value, the tag must be automatically corrected to 'Production' without blocking the creation of the resource. Which Azure Policy effect should the team configure?

Accepted Answer

Modify. The Modify effect is correct because it automatically applies the required tag value to resources during creation or update without blocking the operation. Unlike Append, which only adds tags to new resources but cannot change existing values, Modify can alter both new and existing resources to enforce the desired tag value. This ensures that any resource created without the 'Environment' tag or with a different value is automatically corrected to 'Production'.

Answer

Deny

Answer

Audit

Answer

Append

Question 9

A multinational company has multiple Azure subscriptions managed by different teams. The compliance team requires that all new virtual machines deployed in any subscription must have a specific tag (e.g., 'CostCenter') and must be deployed in approved regions only. They also want to automatically enforce these requirements without manual intervention. Which Azure service should the compliance team use to achieve this?

Accepted Answer

Azure Policy. Azure Policy is correct because it enables the compliance team to create, assign, and manage policies that enforce rules (like requiring a 'CostCenter' tag and restricting VM deployment to approved regions) across all subscriptions. Policies are evaluated during resource creation and can automatically deny or audit non-compliant resources, ensuring enforcement without manual intervention.

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Blueprints

Answer

Azure Management Groups

Question 10

A multinational bank operates a critical financial application that must remain available even if an entire Azure region experiences a prolonged outage. The bank's compliance team mandates that the disaster recovery data must reside in a separate geographic location that is at least 300 miles away from the primary region to reduce the risk of correlated failures. The solution must use Azure's built-in data replication feature without requiring manual pairing of regions. Which Azure feature meets these requirements?

Accepted Answer

Azure Region Pair. Azure Region Pairs are designed to provide built-in disaster recovery by replicating data (e.g., geo-redundant storage) to a paired region that is at least 300 miles away, ensuring geographic separation without manual pairing. This meets the bank's compliance requirement for a separate location and automatic failover capability during a prolonged regional outage.

Answer

Azure Availability Zones

Answer

Azure Resource Manager

Answer

Azure Policy

Question 11

A company runs a development and testing environment on Azure virtual machines. The environment is only needed during standard business hours (9:00 AM to 5:00 PM), Monday through Friday. The IT team configures an automated schedule that deallocates all VMs at 5:00 PM each weekday and starts them again at 8:00 AM the next morning. The team reports a significant reduction in their monthly Azure bill after implementing this schedule. Which essential characteristic of cloud computing does this scenario primarily demonstrate?

Accepted Answer

Measured service and consumption-based pricing. The scenario demonstrates measured service and consumption-based pricing because Azure charges for VM compute costs only when the VM is in the 'Running' state. Deallocating the VM releases the reserved compute resources, stopping billing for the VM's vCPU and RAM while retaining the disk and other resources. By scheduling deallocation outside business hours, the company pays only for the hours the VMs are actually running, directly reducing costs based on usage.

Answer

Rapid elasticity and scaling

Answer

High availability

Answer

Geographic distribution

Question 12

A hospital maintains its patient records on physical servers located within its own on-premises data center due to strict data residency regulations that prohibit patient data from leaving the country. For analytical workloads that process only anonymized data, the hospital uses Azure virtual machines and Azure Synapse Analytics. This combination of on-premises and cloud resources best describes which cloud deployment model?

Accepted Answer

Hybrid cloud. The hospital uses a combination of on-premises physical servers (for patient records due to data residency regulations) and Azure cloud resources (VMs and Synapse Analytics for anonymized data analytics). This integration of on-premises and public cloud services is the defining characteristic of a hybrid cloud deployment model, as it allows workloads to span both environments while maintaining compliance.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 13

A company has a policy that every Azure virtual machine must have the Azure Monitor Agent installed and configured to send metrics to a central Log Analytics workspace. To enforce this requirement without relying on manual user action, the governance team wants to automatically deploy the agent to any existing or new VM that is missing it. They also need to generate a compliance report showing any VMs where the installation failed. Which Azure Policy effect should the team use to meet these requirements?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it automatically deploys the Azure Monitor Agent to any VM that does not have it, and it can trigger remediation tasks to enforce compliance. This effect also supports generating compliance reports by evaluating the deployment status and flagging VMs where the installation failed, meeting both the automatic deployment and reporting requirements without manual intervention.

Answer

AuditIfNotExists

Answer

Deny

Answer

Modify

Question 14

A company runs a critical application on-premises and plans to extend its data center to Azure. The company needs a dedicated, private network connection between the on-premises network and Azure that bypasses the public internet. The connection must provide higher bandwidth and more reliable, lower-latency connectivity than a site-to-site VPN. The company also requires a Service Level Agreement (SLA) for the connection's availability. Which Azure service should the company use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute is the correct choice because it provides a dedicated, private network connection from on-premises to Azure that bypasses the public internet entirely. It offers higher bandwidth, lower latency, and more reliable connectivity than a site-to-site VPN, and it includes a financially backed SLA for availability (typically 99.95% or higher). This makes it ideal for critical applications requiring consistent, private, and high-performance connectivity.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Application Gateway

Question 15

A company has two Azure virtual networks: VNet-A in the East US region and VNet-B in the West US region. Each VNet hosts a set of virtual machines that run a distributed application. The application requires private, low-latency communication between the VMs in VNet-A and VNet-B. The company wants to minimize operational complexity and avoid any additional billing for data transfer between the two VNets beyond the standard Azure data transfer charges. Which Azure service should the company use to connect the two virtual networks?

Accepted Answer

Azure Virtual Network Peering. Azure Virtual Network Peering is the correct choice because it connects two virtual networks directly over the Microsoft backbone network, providing private, low-latency communication between VMs in different regions. It incurs only standard Azure data transfer charges (no additional gateway or circuit costs) and requires minimal operational overhead, as it is a simple configuration with no extra devices or bandwidth provisioning.

Answer

Azure VPN Gateway (Site-to-Site)

Answer

Azure ExpressRoute

Answer

Azure Front Door