AZ-900 Practice Test 32 — 15 Questions

Question 1

A company migrates its on-premises servers to Azure virtual machines (IaaS model). The security team is planning the patching strategy and asks who is responsible for installing security updates on the guest operating system of the Azure VMs. According to the shared responsibility model, which statement is correct?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The customer is responsible for maintaining and patching the guest operating system on Azure virtual machines.. In the shared responsibility model for IaaS, the customer retains control over the guest operating system, applications, and data. Microsoft manages the physical host, hypervisor, and underlying Azure infrastructure, but the customer must install and maintain security updates on the guest OS of their Azure VMs. This is because the customer has full administrative access to the VM and is responsible for its configuration and patch management.

Answer

Microsoft is responsible for maintaining and patching the guest operating system on Azure virtual machines.

Answer

Microsoft is responsible for patching any application software that runs on Azure virtual machines.

Answer

The customer is responsible for the physical security of the Azure datacenter where the virtual machines are hosted.

Question 2

A company manages a production Azure subscription that contains critical resources. The security team wants to prevent any user, including users with the Owner role, from accidentally deleting the entire subscription or any resource within it. The team still wants authorized users to be able to modify settings and create new resources. Which Azure feature should the team use?

Accepted Answer

Apply a global 'CanNotDelete' resource lock at the subscription scope.. A 'CanNotDelete' resource lock at the subscription scope prevents any user, including those with the Owner role, from deleting the subscription or any resource within it. This lock overrides all RBAC permissions for delete operations, while still allowing authorized users to modify settings and create new resources, meeting the security team's requirement.

Answer

Create a custom RBAC role that denies the 'Microsoft.Resources/subscriptions/delete' action and assign it to the subscription.

Answer

Configure an Azure Policy that audits delete operations and sends an alert to the security team.

Answer

Create a management group, move the subscription into it, and assign an Azure Policy definition with the 'Deny' effect targeting delete operations.

Question 3

A company runs a web application on a set of Azure virtual machines. The application experiences unpredictable spikes in user traffic. The company configures an Azure Virtual Machine Scale Set with an autoscale rule that adds virtual machines when CPU usage exceeds 75% and removes virtual machines when CPU usage drops below 30%. This ability to automatically adjust compute resources to match demand best represents which characteristic of cloud computing?

Accepted Answer

Elasticity. Elasticity is the ability of a cloud system to automatically scale resources up or down to match demand. In this scenario, the Azure Virtual Machine Scale Set dynamically adds VMs when CPU exceeds 75% and removes them when CPU drops below 30%, directly demonstrating elasticity. This ensures the application has sufficient compute capacity during traffic spikes and avoids over-provisioning during low usage.

Answer

High availability

Answer

Fault tolerance

Answer

Disaster recovery

Question 4

An international e-commerce company has deployed its web application in two Azure regions to serve customers globally. The solution must automatically route users to the region with the lowest latency, provide high availability with automatic failover if one region becomes unavailable, and protect the application from common web exploits such as SQL injection and cross-site scripting at the edge. Which Azure service should the company use?

Accepted Answer

Azure Front Door. Azure Front Door is a global, scalable entry point that provides HTTP(S) load balancing with latency-based routing, automatic failover across regions, and built-in web application firewall (WAF) protection against common exploits like SQL injection and cross-site scripting. It operates at Layer 7 (application layer) and integrates with Azure WAF policies at the edge, making it the correct choice for this scenario.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Question 5

A company has multiple Azure subscriptions used by different departments. The governance team has created several Azure Policy definitions to enforce tagging rules, restrict allowed VM SKUs, and require HTTPS for storage accounts. The team wants to assign these policies as a single, manageable unit to a management group so that they can track overall compliance across all subscriptions in that group from one dashboard. The compliance summary should show how many resources are compliant against all the combined policies. Which Azure feature should the team use?

Accepted Answer

Azure Policy Initiative. Azure Policy Initiative is the correct choice because it allows the governance team to group multiple Azure Policy definitions (tagging rules, VM SKU restrictions, HTTPS requirement) into a single, manageable unit. Assigning this initiative to a management group enables aggregated compliance tracking across all subscriptions within that group, showing a unified compliance summary for all combined policies.

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Management Groups

Answer

Azure Resource Graph

Question 6

A company currently budgets for maximum capacity to handle peak loads, resulting in underutilized resources during off-peak times. They want a model where they can quickly adjust resources up or down based on demand. Which cloud characteristic directly addresses this concern?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that enables automatic scaling of resources up or down in response to real-time demand. This directly addresses the company's need to avoid over-provisioning for peak loads while still being able to handle spikes without manual intervention, typically implemented through auto-scaling policies in services like Azure Virtual Machine Scale Sets or Azure App Service autoscale.

Answer

High availability

Answer

Geo-redundancy

Answer

Fault tolerance

Question 7

A company wants to enforce a governance policy that only allows virtual machines of the SKU 'Standard_DS2_v2' to be deployed in their Azure subscription. If a user attempts to create a virtual machine with a different SKU (e.g., 'Standard_D2s_v3'), the deployment must be immediately rejected with an error, and the resource must not be created. Which Azure Policy effect should the team use to implement this requirement?

Accepted Answer

Deny. The Deny effect is the correct choice because it actively prevents the creation or deployment of resources that do not comply with the policy rule. In this scenario, when a user attempts to deploy a virtual machine with a SKU other than 'Standard_DS2_v2', the Deny effect immediately rejects the request and blocks the resource from being created, ensuring the governance policy is enforced without exception.

Answer

Append

Answer

Audit

Answer

DeployIfNotExists

Question 8

A company deploys two Azure virtual machines in an availability set. The application requires that at least one VM remains running during Azure platform-initiated maintenance, such as operating system updates to the underlying host. Which component of the availability set directly ensures that the VMs are not updated at the same time?

Accepted Answer

Update domains. Update domains (B) are the correct component because they logically group VMs that are updated together during Azure platform-initiated maintenance. By placing VMs in different update domains, Azure ensures that only one update domain is taken offline at a time, guaranteeing that at least one VM remains running during host OS updates.

Answer

Fault domains

Answer

Proximity placement groups

Answer

Availability zones

Question 9

A company plans to deploy a mission-critical application on Azure virtual machines. The application must remain available if a single Azure datacenter fails. The company chooses to deploy the VMs in the East US Azure region. The solution should provide the highest availability within that single region. What should the company configure?

Accepted Answer

Deploy the VMs in different availability zones within East US.. Deploying VMs across availability zones within a single region provides the highest availability within that region. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. This configuration protects against a single datacenter failure while keeping all resources in the same region, meeting the requirement for high availability without cross-region complexity.

Answer

Deploy the VMs in an availability set.

Answer

Deploy the VMs in different Azure regions connected with Azure Traffic Manager.

Answer

Deploy all VMs in the same availability set but in different fault domains.

Question 10

A company stores historical sales data in Azure Blob Storage. The data is accessed frequently during the first 30 days after upload, but after that, it is rarely accessed. The company wants to automatically move blobs to a lower-cost storage tier after 30 days without any manual scripting or custom code. Which Azure feature should they use?

Accepted Answer

Azure Blob Storage lifecycle management policies. Azure Blob Storage lifecycle management policies allow you to define rules that automatically transition blobs to a lower-cost storage tier (e.g., from Hot to Cool or Archive) based on the age of the data. This feature operates natively within Azure Storage, requires no custom code or scripting, and can be configured directly in the Azure portal or via ARM templates. The scenario's requirement for automatic, rule-based tiering after 30 days is exactly what lifecycle management policies are designed to do.

Answer

Azure Automation runbooks with a schedule

Answer

Azure Logic Apps with a recurrence trigger

Answer

Azure Policy to enforce storage tier at creation

Question 11

A company has a team of support engineers who need to be able to restart Azure virtual machines when they become unresponsive. The support engineers must not be able to modify the VM configuration, delete the VMs, or access VM data. The company wants to use the principle of least privilege. No built-in Azure role meets these exact requirements. What should the company do?

Accepted Answer

Create a custom role in Azure RBAC that includes only the 'Microsoft.Compute/virtualMachines/restart/action' permission and assign it to the support engineers.. It adheres to the principle of least privilege by creating a custom role that grants only the specific 'Microsoft.Compute/virtualMachines/restart/action' permission. This ensures support engineers can restart VMs without being able to modify configurations, delete VMs, or access data, which no built-in role provides.

Answer

Assign the support engineers the Virtual Machine Contributor built-in role.

Answer

Assign the support engineers the Owner built-in role on the resource group containing the VMs.

Answer

Configure an Azure Policy definition that allows only the restart operation on virtual machines.

Question 12

Company A deploys several Linux virtual machines (VMs) across multiple Azure availability zones in the West US region. The VMs run a cluster application that needs to read and write data concurrently to a shared file system. The solution must support the Server Message Block (SMB) protocol and must be accessible from all zones with low latency. Which Azure storage service should the company use?

Accepted Answer

Azure Files. Azure Files provides fully managed file shares in the cloud that support the SMB protocol, making it the correct choice for a shared file system accessible from multiple Azure availability zones with low latency. It allows concurrent read/write access from Linux VMs across zones, meeting the cluster application's requirements.

Answer

Azure Blob Storage

Answer

Azure Managed Disks

Answer

Azure Queue Storage

Question 13

A company currently runs its application on-premises in a data center. The IT manager calculates that the cost per server per month is approximately $200 when considering hardware depreciation, electricity, cooling, and staff. The company is considering moving to Azure and discovers that Azure can provision the same server capacity for $150 per month, but only if the company commits to a three-year reservation. Which cloud concept best explains why Azure can offer a lower price even with the reservation commitment?

Accepted Answer

Economies of scale. Azure can offer a lower price for a three-year reserved instance because of economies of scale. Microsoft operates massive, globally distributed data centers that purchase hardware, power, and cooling in bulk, significantly reducing per-unit costs. This cost advantage is passed to customers who commit to longer-term reservations, as the provider can better predict and optimize resource utilization.

Answer

Rapid elasticity

Answer

High availability

Answer

Measured service

Question 14

A company stores critical customer data in Azure Blob Storage. The compliance team requires that the data remains available for read operations even if the primary Azure region experiences a complete outage. They plan to use an Azure storage redundancy option that automatically replicates data to a secondary region and allows read access from that secondary region during an outage, without requiring any manual failover action. Which storage redundancy option should they configure on the storage account?

Accepted Answer

Read-access geo-redundant storage (RA-GRS). RA-GRS (Read-access geo-redundant storage) is correct because it replicates data to a secondary region (geo-redundancy) and, crucially, enables read access to that secondary replica during a primary region outage without requiring any manual failover. This meets the compliance requirement for automatic read availability during a complete primary region failure.

Answer

Locally-redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Question 15

An IT team manages a customer relationship management (CRM) application hosted on a single Azure virtual machine. As the number of users grows, the CPU and memory usage on the VM consistently exceed 90%. The team decides to increase the VM size from Standard_D2s_v3 (2 vCPUs, 8 GB RAM) to Standard_D8s_v3 (8 vCPUs, 32 GB RAM) to handle the increased load. The application is not designed to run on multiple servers simultaneously. This approach represents which type of scaling in the cloud?

Accepted Answer

Vertical scaling. Increasing the VM size from Standard_D2s_v3 to Standard_D8s_v3 adds more vCPUs and RAM to the same virtual machine, which is the definition of vertical scaling (scaling up). This approach is appropriate because the application cannot run on multiple servers simultaneously, so adding resources to the existing single VM is the only viable option to handle the increased load.

Answer

Horizontal scaling

Answer

Diagonal scaling

Answer

Auto-scaling