AZ-900 Practice Test 33 — 15 Questions

Question 1

A company deploys a multi-tier web application on Azure. The web tier and database tier must be in the same region for low latency, but the database tier must be in a different subnet and have restricted network access from the web tier only. Which Azure network solution should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Virtual Network with subnets and Network Security Groups. Azure Virtual Network (VNet) with subnets and Network Security Groups (NSGs) is the correct solution because it allows you to create isolated subnets for the web and database tiers within the same region, ensuring low latency. NSGs can then be applied to the database subnet to restrict inbound traffic exclusively from the web tier's subnet using source IP or service tag rules, providing the required network segmentation and access control.

Answer

Azure Application Gateway

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 2

A company wants to proactively monitor and control its Azure spending. The finance team has set a monthly budget of $10,000 for the 'Marketing' subscription. They want to receive an email notification when the actual spending reaches 80% of the budget and another notification when it reaches 100%. Additionally, if the spending ever exceeds $12,000 in a month, they want to automatically trigger a runbook that scales down non-critical resources. Which Azure feature should the finance team use to achieve all these requirements?

Accepted Answer

Azure Budgets in Microsoft Cost Management with action groups. Azure Budgets in Microsoft Cost Management allows you to set spending thresholds and configure alerts based on actual or forecasted costs. By linking an action group to the budget, you can trigger email notifications at 80% and 100% of the $10,000 budget, and also invoke an Azure Automation runbook when spending exceeds $12,000, meeting all requirements.

Answer

Azure Advisor cost recommendations

Answer

Azure Policy with the 'append' effect

Answer

Azure Cost Management invoices

Question 3

A company needs to run a custom-built Windows application that requires full administrative access to the operating system, including the ability to install custom software and configure firewall rules. They also need to ensure the application is highly available by running multiple instances. Which Azure compute service should they use?

Accepted Answer

Azure Virtual Machines. Azure Virtual Machines (VMs) provide full administrative access to the operating system, allowing you to install custom software, configure firewall rules, and manage the OS as needed. By deploying multiple VMs in an availability set or across availability zones, you can achieve high availability for the application. This makes VMs the correct choice for a custom Windows application requiring full OS control and multi-instance high availability.

Answer

Azure App Service

Answer

Azure Functions

Answer

Azure Container Instances

Question 4

A hospital stores sensitive patient data in the cloud. They want to ensure that data remains secure and that the cloud provider has implemented strict physical security controls, such as biometric access and 24/7 surveillance at datacenters. Which aspect of the shared responsibility model does this describe?

Accepted Answer

Responsibility of the cloud provider for physical security. The shared responsibility model delineates that the cloud provider is responsible for the security 'of' the cloud, which includes physical infrastructure controls like biometric access and 24/7 surveillance at datacenters. This question specifically asks about physical security controls, which fall under the provider's domain regardless of the deployment model (IaaS, PaaS, or SaaS). Therefore, option B is correct because the provider must secure the physical premises housing the servers and storage.

Answer

Responsibility of the customer for network security

Answer

Responsibility of the customer for data classification

Answer

Responsibility of the customer for identity and access management

Question 5

A company has an Azure subscription used by several development teams. The governance team wants to identify any virtual machines that are not tagged with a mandatory 'CostCenter' tag. The team does not want to block the creation of untagged VMs; they only want to report on non-compliant resources in Azure Policy's compliance dashboard. Which Azure Policy effect should they use in their policy definition?

Accepted Answer

Audit. The Audit effect is correct because it enables Azure Policy to evaluate resources against the policy rule and report non-compliant resources in the compliance dashboard without blocking resource creation or modification. Since the governance team only wants visibility into untagged VMs, Audit logs the non-compliance as a warning in the activity log and marks the resource as non-compliant, but does not prevent the VM from being deployed.

Answer

Deny

Answer

Append

Answer

Disabled

Question 6

Which Azure networking service enables you to create a hub-and-spoke network topology where multiple VNets are connected and can communicate through a central hub VNet?

Accepted Answer

Azure VNet Peering. Azure VNet Peering is the correct service because it directly connects two or more Azure Virtual Networks (VNets) using the Microsoft backbone infrastructure, enabling a hub-and-spoke topology where multiple spoke VNets communicate through a central hub VNet. Unlike VPN-based solutions, VNet Peering provides low-latency, private connectivity without traversing the public internet, and it supports transitive routing only when explicitly configured via a network virtual appliance (NVA) or Azure Route Server in the hub.

Answer

Azure VPN Gateway

Answer

Azure Load Balancer

Answer

Azure Front Door

Question 7

A company wants to ensure that all Azure resources are tagged with metadata such as 'Environment' and 'Department'. They have created an Azure Policy that appends the required tags and their values when a resource is created. However, they notice that some resources created before the policy assignment are missing tags. They want to automatically add those tags without manual effort. What should they do?

Accepted Answer

Create a new policy with DeployIfNotExists effect. The DeployIfNotExists (DINE) policy effect can automatically remediate non-compliant resources, including those created before the policy assignment. When combined with a managed identity, DINE triggers a deployment task that adds the required tags without manual intervention, addressing the gap left by the 'append' effect which only acts on new resources.

Answer

Create a remediation task for the policy

Answer

Use Azure Resource Graph to query and update

Answer

Create an Azure Automation runbook

Question 8

Which Azure service provides distributed, low-latency access to large files (like game assets or software packages) for global users?

Accepted Answer

Azure CDN with Blob Storage origin. Azure CDN (Content Delivery Network) with a Blob Storage origin is the correct choice because it caches large files like game assets or software packages at edge nodes distributed globally, providing low-latency access to users. Blob Storage alone offers scalable storage but lacks the distributed caching and geographic proximity that CDN provides, which is essential for reducing latency for global users.

Answer

Azure Blob Storage alone

Answer

Azure Front Door

Answer

Azure Files

Question 9

A company has a critical Azure resource group that contains production resources. They want to ensure that no one can accidentally delete or modify the resources in this group, even if they have Contributor permissions. Which Azure feature should they use?

Accepted Answer

Resource Locks. Resource Locks are the correct choice because they provide a way to prevent accidental deletion or modification of critical Azure resources by applying a lock at the resource, resource group, or subscription level. Even users with Contributor or Owner permissions are blocked from performing delete or modify operations when a lock is set to 'CanNotDelete' or 'ReadOnly'. This ensures that production resources are protected beyond the permissions granted by RBAC.

Answer

Azure Policy

Answer

Role-Based Access Control (RBAC)

Answer

Management Groups

Question 10

A company wants to run a containerized microservices application on Azure. They need automatic scaling based on demand, service discovery, and rolling updates without manual intervention. They want to avoid managing the underlying virtual machines. Which Azure compute service should they choose?

Accepted Answer

Azure Kubernetes Service (AKS). Azure Kubernetes Service (AKS) is the correct choice because it provides a managed Kubernetes orchestration platform that supports automatic scaling (Horizontal Pod Autoscaler), service discovery (via DNS and Kubernetes Services), and rolling updates (via Deployment strategies) without requiring you to manage the underlying VMs. AKS abstracts the control plane and node management, aligning perfectly with the requirement to avoid VM management while offering full container orchestration capabilities.

Answer

Azure Container Instances (ACI)

Answer

Azure App Service

Answer

Azure Functions

Question 11

A hospital stores patient data in the cloud. The hospital is responsible for encrypting the data before uploading, managing user access, and complying with healthcare regulations. The cloud provider is responsible for securing the physical datacenter, network infrastructure, and hypervisor. This model describes which concept?

Accepted Answer

Shared responsibility model. The scenario explicitly divides security responsibilities between the hospital (data encryption, access management, regulatory compliance) and the cloud provider (physical datacenter, network, hypervisor). This division of security obligations is the core definition of the shared responsibility model, which applies across all cloud service models (IaaS, PaaS, SaaS) but is most clearly illustrated here where the customer retains control over data and identity layers.

Answer

Infrastructure as a Service (IaaS)

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Question 12

A company manages 50 Azure subscriptions that contain thousands of resources. The DevOps team needs to identify all virtual machines that are tagged with 'Environment: Production' across all subscriptions. They need a single query that returns the VM name, resource group, and location for every such VM. The team does not want to write PowerShell commands or loop through each subscription manually. Which Azure service should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph (ARG) is the correct service because it enables efficient, cross-subscription querying of Azure resources using the Kusto Query Language (KQL). With a single ARG query, the DevOps team can filter all virtual machines tagged with 'Environment: Production' across all 50 subscriptions and project only the VM name, resource group, and location, without needing to loop through subscriptions or write PowerShell scripts.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Resource Manager

Question 13

Which Azure region feature provides fault tolerance by isolating failures within a single region? It consists of physically separate datacenters with independent power, cooling, and networking.

Accepted Answer

Availability Zones. B is correct because Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. This isolation ensures that if one zone fails, the others remain operational, providing fault tolerance within the same region. Availability Zones protect applications from datacenter-level failures, not just server or rack failures.

Answer

Availability Sets

Answer

Region Pairs

Answer

Fault Domains

Question 14

A company wants to enforce a naming convention on all Azure resources by automatically adding a tag with the environment name (e.g., 'Env-Prod' or 'Env-Dev') when a resource is created. They do not want to block resource creation if the tag is missing. Which Azure Policy effect should they use?

Accepted Answer

Append. The Append effect adds a specified tag (e.g., 'Env-Prod' or 'Env-Dev') to a resource during creation or update without blocking the operation. This matches the requirement to enforce a naming convention via tags automatically while allowing resource creation to proceed even if the tag is missing.

Answer

Deny

Answer

Audit

Answer

DeployIfNotExists

Question 15

A small business wants to run its accounting application without managing the underlying operating systems or hardware. The application is accessed through a web browser. Which cloud service model is being used?

Accepted Answer

Software as a Service (SaaS). (SaaS) because the business uses a web browser to access the accounting application without managing the underlying OS or hardware. SaaS delivers fully functional software over the internet, where the provider handles all infrastructure, platform, and application management, matching the scenario's requirement of zero administrative overhead.

Answer

Infrastructure as a Service (IaaS)

Answer

Platform as a Service (PaaS)

Answer

Functions as a Service (FaaS)