AZ-900 Practice Test 36 — 15 Questions

Question 1

Which Azure governance concept ensures that access to resources is granted only to users who need it for their job function?

Accepted Answer

Principle of least privilege. The principle of least privilege is an Azure governance concept that ensures users are granted only the minimum permissions necessary to perform their job functions. In Azure, this is implemented through Azure RBAC (Role-Based Access Control), where custom or built-in roles define specific actions allowed on resources, preventing over-permissioning.

Answer

Defense in depth

Answer

Role inheritance

Answer

Separation of duties

Question 2

What is the purpose of Azure Private DNS zones?

Accepted Answer

To provide DNS name resolution for resources within Azure virtual networks privately. Azure Private DNS zones provide DNS name resolution within a virtual network without requiring a custom DNS solution. They allow you to use your own domain names (e.g., contoso.internal) and automatically resolve them for resources inside the VNet, ensuring that DNS queries never leave the Azure network boundary. This is correct because the primary purpose is private, internal resolution, not public hosting or security filtering.

Answer

To host public-facing domain names and DNS records

Answer

To filter DNS requests for potentially malicious domains

Answer

To translate domain names for cross-region traffic routing

Question 3

A company is migrating a custom-built inventory management application to the cloud. The application runs on a specific version of Windows Server and requires custom registry settings that are not supported in a platform as a service (PaaS) offering. The company wants to avoid the overhead of managing physical servers but still needs full control over the operating system and application dependencies. Which cloud service model should the company use?

Accepted Answer

Infrastructure as a Service (IaaS). The company needs full control over the operating system and custom registry settings, which are not supported in PaaS. Infrastructure as a Service (IaaS) provides virtualized computing resources (e.g., virtual machines) where the customer manages the OS, applications, and dependencies, while the cloud provider handles the physical hardware. This model allows the company to run a specific version of Windows Server with custom registry configurations without managing physical servers.

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Question 4

A financial services company is evaluating a public cloud provider. They are concerned about the shared responsibility model for security. The company must ensure that their customer data is encrypted at rest and in transit. Under the shared responsibility model, which security control is the cloud provider typically responsible for?

Accepted Answer

Physical network security. Under the shared responsibility model, the cloud provider is responsible for the security OF the cloud, which includes physical network security such as protecting the data center perimeter, network infrastructure, and hardware. This is correct because physical security controls (e.g., access badges, surveillance, and network firewalls at the provider's edge) are entirely the provider's domain and cannot be delegated to the customer.

Answer

Encrypting customer data at rest

Answer

Patching virtual machines

Answer

Managing customer access policies

Question 5

A company needs to find all virtual machines that have the tag 'Environment:Production' and were created more than 6 months ago. They want to run a complex query across all subscriptions in their tenant. Which Azure tool should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct tool because it is designed to efficiently query across multiple subscriptions, resource groups, and resource types using the Kusto Query Language (KQL). It can filter virtual machines by the tag 'Environment:Production' and compare the 'createdTime' property to a date six months ago, all in a single, complex query that spans the entire tenant.

Answer

Azure CLI

Answer

Azure PowerShell

Answer

Azure Cost Management

Question 6

A hospital stores patient data in the cloud. They are concerned about physical security at the datacenter. Which aspect of the shared responsibility model describes the cloud provider's obligation to secure the physical infrastructure?

Accepted Answer

Security of physical hardware. In the shared responsibility model, the cloud provider is always responsible for the physical security of the datacenter, including the physical hardware, environmental controls (power, cooling), and physical access controls. This is a foundational principle of the model: the provider secures the physical layer, while the customer secures what they deploy on top of it.

Answer

Security of the network infrastructure

Answer

Security of customer data

Answer

Security of operating systems

Question 7

A company plans to deploy a critical application across multiple physical locations within a single Azure region to ensure that if one datacenter fails, the application remains available. Which Azure feature should they use to distribute virtual machines across these locations?

Accepted Answer

Availability Zone. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By deploying VMs across multiple zones, the application remains available even if one entire datacenter fails, meeting the requirement for fault isolation within a single region.

Answer

Availability Set

Answer

Region Pair

Answer

Resource Group

Question 8

A developer is building a serverless application that requires integration with an on-premises SQL Server database for real-time data processing. The on-premises network is connected to Azure via a site-to-site VPN. Which Azure service would allow the function to securely access the on-premises database without exposing it to the public internet?

Accepted Answer

Azure Functions in Premium plan with VNet integration. Azure Functions in the Premium plan supports VNet integration, allowing the function to securely access resources in a connected on-premises network via a site-to-site VPN without exposing the database to the public internet. The Consumption plan lacks VNet integration, and Azure SQL Database is a PaaS service, not a compute service for running serverless code.

Answer

Azure Functions in Consumption plan

Answer

Azure SQL Database

Answer

Hybrid Connections

Question 9

An Azure administrator needs to review all changes made to Azure resources over the past 90 days, including who made each change and when. Which Azure service provides this information?

Accepted Answer

Azure Activity Log. The Azure Activity Log is a platform log in Azure that provides insight into subscription-level events. It records all control-plane operations (e.g., creating, modifying, or deleting resources) and includes details such as who initiated the operation, what the operation was, and when it occurred. The log retains this data for 90 days by default, making it the correct service for reviewing changes over that period.

Answer

Azure Monitor Metrics

Answer

Azure Resource Health

Answer

Azure Policy compliance reports

Question 10

A company operates on-premises servers that they own. They are considering moving to Azure. Which cloud benefit would MOST directly reduce their total cost of ownership?

Accepted Answer

Eliminating hardware purchase and maintenance costs. Moving to Azure eliminates the need to purchase, maintain, and eventually replace physical servers, which directly reduces capital expenditure (CapEx) and operational costs related to hardware lifecycle management. This is the most direct way to lower total cost of ownership (TCO) when transitioning from on-premises infrastructure to a public cloud model.

Answer

Automatic compliance with all regulations

Answer

Guaranteed zero downtime for all services

Answer

Free support for all Azure services

Question 11

Which Azure service provides a visual designer for building data transformation and movement pipelines between data stores?

Accepted Answer

Azure Data Factory. Azure Data Factory (ADF) is the correct answer because it is a cloud-based ETL and data integration service that provides a visual designer (the ADF authoring canvas) for building data transformation and movement pipelines. These pipelines can copy data between over 90 supported on-premises and cloud data stores, and they can include transformations using mapping data flows or external compute services like Azure HDInsight and Azure Databricks.

Answer

Azure Synapse Analytics Studio

Answer

Azure Databricks

Answer

Azure Stream Analytics

Question 12

A financial services company processes sensitive customer data and must strictly control the physical location of the servers. They want to use cloud computing but with dedicated hardware that is not shared with other customers. Which cloud deployment model should they choose?

Accepted Answer

Private cloud. A private cloud is the correct deployment model because it provides dedicated, single-tenant infrastructure that is not shared with other customers. This ensures that the financial services company can maintain strict physical control over server locations and meet compliance requirements for sensitive customer data, as the hardware is exclusively used by one organization.

Answer

Public cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 13

A company is designing a multi-cloud strategy to avoid dependency on a single provider. They need the ability to move workloads between different cloud providers or back to an on-premises environment with minimal rework. Which cloud characteristic is most essential for this goal?

Accepted Answer

Portability. Portability is the cloud characteristic that enables workloads, data, and applications to be moved across different cloud providers or between cloud and on-premises environments with minimal rework. This is achieved through the use of standardized formats, APIs, and containerization technologies such as Docker and Kubernetes, which abstract underlying infrastructure dependencies. For a multi-cloud strategy aimed at avoiding vendor lock-in, portability is the essential enabler.

Answer

Elasticity

Answer

Scalability

Answer

Fault tolerance

Question 14

A global organization wants to apply a consistent set of Azure policies and RBAC roles across all new subscriptions automatically as they are created. Which Azure capability enables this?

Accepted Answer

Policy inheritance via Management Groups. Management Groups allow you to apply Azure Policy and RBAC role assignments at the management group level, which are inherited by all subscriptions within that group. When a new subscription is created under the management group, it automatically receives those policies and roles, ensuring consistent governance without manual intervention.

Answer

Azure Blueprints deployment

Answer

Azure Policy initiatives

Answer

Subscription tags

Question 15

A company is evaluating cloud service models. They need to migrate an existing application that requires full control over the operating system and custom software installations. They do not want to manage the underlying physical hardware. Which cloud service model best fits this requirement?

Accepted Answer

Infrastructure as a Service (IaaS). Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet, including virtual machines with full control over the guest operating system. This allows the company to install custom software and manage the OS while the cloud provider handles the underlying physical hardware, such as servers, storage, and networking. The requirement for full OS control and custom software installations excludes PaaS and SaaS, which abstract away the OS layer.

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Answer

On-premises deployment