AZ-900 Practice Test 37 — 15 Questions

Question 1

Which Azure feature allows an organization to provide temporary, time-limited access to Azure resources without permanent role assignment?

Accepted Answer

Azure Privileged Identity Management. Azure Privileged Identity Management (PIM) is the correct answer because it provides just-in-time (JIT) privileged access to Azure resources, allowing organizations to grant time-bound, temporary permissions that automatically expire. Unlike permanent role assignments, PIM requires activation with approval, duration, and justification, ensuring least-privilege security without persistent access.

Answer

Azure Conditional Access

Answer

Azure RBAC role assignment

Answer

Azure Policy

Question 2

A company is deploying a mission-critical application that must remain available even if a physical Azure datacenter within a region fails. The application will run on multiple virtual machines. Which Azure feature should they use to protect against this specific failure scenario?

Accepted Answer

Availability Zones. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By deploying VMs across multiple zones, the application remains available even if one entire datacenter fails. This directly addresses the requirement for protection against a physical datacenter failure within a region.

Answer

Availability Sets

Answer

Virtual Machine Scale Sets

Answer

Azure Load Balancer

Question 3

A company needs to protect their Azure VMs from DDoS attacks at the network layer. Which Azure service provides this protection?

Accepted Answer

Azure DDoS Protection Standard. Azure DDoS Protection Standard is the correct service because it provides dedicated mitigation against Distributed Denial of Service (DDoS) attacks targeting Azure virtual machines at the network layer (Layer 3/4). It uses adaptive tuning, traffic monitoring, and automatic attack mitigation to protect public IP addresses associated with Azure resources, including VMs, without requiring any application-level changes.

Answer

Azure Firewall

Answer

Network Security Groups

Answer

Azure WAF

Question 4

A company needs to run a batch job that processes large amounts of data nightly. The job requires hundreds of VMs for a few hours and then terminates. Which Azure service is BEST suited for this workload?

Accepted Answer

Azure Batch. Azure Batch is designed specifically for large-scale parallel and high-performance computing (HPC) workloads that require hundreds of VMs for a short duration. It automatically provisions, manages, and deallocates the VMs, scaling to the required number of nodes, running the batch job, and then terminating them—matching the nightly processing requirement exactly.

Answer

Azure Virtual Machine Scale Sets

Answer

Azure Functions

Answer

Azure Container Instances

Question 5

A company uses Azure and wants to organize all their virtual machines, databases, and storage accounts into logical containers for management and billing purposes. Which Azure component should they use to group these resources?

Accepted Answer

Resource Group. Resource Groups are logical containers in Azure that allow you to group related resources such as virtual machines, databases, and storage accounts for unified management, monitoring, and billing. By placing resources in the same resource group, you can apply lifecycle operations (e.g., delete, tag) and cost tracking across all members. This directly matches the requirement to organize resources for management and billing purposes.

Answer

Azure Policy

Answer

Management Group

Answer

Azure Subscription

Question 6

Which Azure service enables you to connect to an Azure virtual machine using a web browser without exposing RDP/SSH ports to the internet?

Accepted Answer

Azure Bastion. Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to Azure virtual machines directly from the Azure portal using a web browser. It eliminates the need for public IP addresses on VMs and does not expose RDP/SSH ports to the internet, as all traffic is tunneled through the Azure backbone network over TLS.

Answer

Azure VPN Gateway Point-to-Site

Answer

Azure AD Application Proxy

Answer

Azure Firewall Just-In-Time access

Question 7

An organization wants to track which team or project each Azure resource belongs to for cost allocation purposes. Which Azure feature is BEST for this?

Accepted Answer

Azure tags. Azure tags are metadata key-value pairs that can be applied to resources, resource groups, and subscriptions to logically organize them. They are the best choice for tracking cost allocation by team or project because Azure Cost Management can filter and group costs by tag values, enabling chargeback and showback scenarios.

Answer

Azure resource groups

Answer

Management groups

Answer

Azure Subscriptions

Question 8

A company has multiple Azure subscriptions for different departments. The IT team wants to apply a common set of policies (e.g., allowed VM sizes) and assign the same role-based access control (RBAC) permissions across all subscriptions automatically. Which Azure feature should they use?

Accepted Answer

Azure Management Groups. Azure Management Groups allow you to organize Azure subscriptions hierarchically and apply governance conditions, such as RBAC assignments and Azure Policy definitions, at the management group level. These conditions are inherited by all subscriptions within the group, enabling automatic and consistent application of policies and permissions across multiple subscriptions without manual per-subscription configuration.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Resource Manager (ARM) templates

Question 9

Which Azure feature allows an organization to identify resources that do not comply with defined policies and automatically trigger remediation?

Accepted Answer

Azure Policy remediation tasks. Azure Policy remediation tasks are the correct answer because they are specifically designed to identify non-compliant resources based on policy definitions and automatically trigger remediation actions, such as deploying a required configuration or modifying resource settings. This feature works by using managed identities to execute the 'deployIfNotExists' or 'modify' policy effects, ensuring resources are brought into compliance without manual intervention.

Answer

Azure Automation runbooks

Answer

Azure Blueprints re-assignment

Answer

Azure Logic Apps compliance workflows

Question 10

A developer wants to host a static website with HTML, CSS, and JavaScript files. Which Azure service is the MOST cost-effective option?

Accepted Answer

Azure Blob Storage static website hosting. Azure Blob Storage static website hosting is the most cost-effective option because it allows you to serve static content (HTML, CSS, JavaScript) directly from a storage container at a fraction of the cost of compute-based services. There is no need to provision or pay for virtual machines, app service plans, or orchestration layers, as the content is served via HTTP from Azure's highly durable and low-cost blob storage infrastructure.

Answer

Azure App Service

Answer

Azure Virtual Machines

Answer

Azure Kubernetes Service

Question 11

Which Azure feature provides a unified compliance score and consolidated view of your organization's compliance posture across different regulatory standards?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) provides a unified compliance score and a consolidated view of your organization's compliance posture across multiple regulatory standards (e.g., SOC 2, ISO 27001, PCI DSS). It continuously assesses your Azure and hybrid workloads against these standards, calculates a compliance score based on the percentage of compliant controls, and offers actionable recommendations to improve your overall security and compliance posture.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Active Directory

Question 12

Which Azure service provides a secure, scalable API gateway that manages access to backend services?

Accepted Answer

Azure API Management. Azure API Management is the correct service because it provides a secure, scalable API gateway that manages access to backend services. It handles API publishing, versioning, rate limiting, authentication (e.g., OAuth 2.0, JWT validation), and request/response transformation, acting as a centralized facade between clients and backend APIs.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure Service Bus

Question 13

What is 'serverless computing'?

Accepted Answer

A model where developers deploy code without managing server infrastructure, paying only for execution. Serverless computing is a cloud execution model where the cloud provider dynamically manages the allocation and provisioning of servers. Developers write and deploy code in the form of functions (e.g., AWS Lambda, Azure Functions) without provisioning or managing any underlying server infrastructure, and they are billed only for the actual compute time consumed during execution, not for idle capacity.

Answer

Computing that uses no physical servers anywhere in the world

Answer

Running applications without an operating system

Answer

Hosting applications on shared physical hardware

Question 14

Which Azure service provides a fully managed time-series database optimized for IoT and operational data?

Accepted Answer

Azure Data Explorer. Azure Data Explorer (ADX) is a fully managed, high-performance big data analytics service optimized for time-series and log data, making it ideal for IoT and operational scenarios. It uses a columnar storage engine and Kusto Query Language (KQL) to ingest and query massive volumes of time-stamped data with sub-second latency. This directly matches the requirement for a fully managed time-series database for IoT and operational data.

Answer

Azure Cosmos DB

Answer

Azure SQL Database

Answer

Azure Table Storage

Question 15

Which Azure compute option allows you to run code in response to events without provisioning or managing servers, and supports triggers from HTTP, timers, and Azure service events?

Accepted Answer

Azure Functions. Azure Functions is the correct answer because it is a serverless compute service that executes code in response to events, such as HTTP requests, timer-based schedules, or Azure service events (e.g., Blob Storage or Queue triggers). It abstracts server management entirely, allowing you to focus solely on the code logic, and automatically scales based on demand.

Answer

Azure Logic Apps

Answer

Azure Container Instances

Answer

Azure App Service WebJobs