AZ-900 Practice Test 38 — 15 Questions

Question 1

Which Azure service provides a way to implement role-based access control for Kubernetes cluster resources?

Accepted Answer

AKS with Azure AD integration and Kubernetes RBAC. B is correct because Azure Kubernetes Service (AKS) integrates with Azure Active Directory (Azure AD) to provide identity and authentication, and then uses Kubernetes RBAC (Role-Based Access Control) to authorize actions on cluster resources. This combination allows you to define fine-grained permissions for users, groups, or service principals against Kubernetes objects like pods, namespaces, and deployments, using standard Kubernetes Role and ClusterRole objects.

Answer

Azure RBAC at the subscription level

Answer

Azure Policy for Kubernetes

Answer

Network Security Groups on AKS node pools

Question 2

Which Azure AI service can analyze images and return information about people, objects, brands, and text within those images?

Accepted Answer

Azure Computer Vision. Azure Computer Vision is the correct service because it is specifically designed to extract rich information from images, including the detection of people, objects, brands, and embedded text (via OCR). It provides a comprehensive set of pre-built image analysis capabilities without requiring custom training, making it the appropriate choice for this general-purpose scenario.

Answer

Azure Face API

Answer

Azure Custom Vision

Answer

Azure Form Recognizer

Question 3

Which Azure feature allows an organization to provide temporary, time-limited access to Azure resources without permanent role assignment?

Accepted Answer

Azure Privileged Identity Management. Azure Privileged Identity Management (PIM) is the correct answer because it provides just-in-time (JIT) privileged access to Azure resources, allowing organizations to grant time-bound, temporary permissions that automatically expire. Unlike permanent role assignments, PIM requires activation with approval, duration, and justification, ensuring least-privilege security without persistent access.

Answer

Azure Conditional Access

Answer

Azure RBAC role assignment

Answer

Azure Policy

Question 4

A company is deploying a mission-critical application that must remain available even if a physical Azure datacenter within a region fails. The application will run on multiple virtual machines. Which Azure feature should they use to protect against this specific failure scenario?

Accepted Answer

Availability Zones. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By deploying VMs across multiple zones, the application remains available even if one entire datacenter fails. This directly addresses the requirement for protection against a physical datacenter failure within a region.

Answer

Availability Sets

Answer

Virtual Machine Scale Sets

Answer

Azure Load Balancer

Question 5

A company needs to protect their Azure VMs from DDoS attacks at the network layer. Which Azure service provides this protection?

Accepted Answer

Azure DDoS Protection Standard. Azure DDoS Protection Standard is the correct service because it provides dedicated mitigation against Distributed Denial of Service (DDoS) attacks targeting Azure virtual machines at the network layer (Layer 3/4). It uses adaptive tuning, traffic monitoring, and automatic attack mitigation to protect public IP addresses associated with Azure resources, including VMs, without requiring any application-level changes.

Answer

Azure Firewall

Answer

Network Security Groups

Answer

Azure WAF

Question 6

A company needs to run a batch job that processes large amounts of data nightly. The job requires hundreds of VMs for a few hours and then terminates. Which Azure service is BEST suited for this workload?

Accepted Answer

Azure Batch. Azure Batch is designed specifically for large-scale parallel and high-performance computing (HPC) workloads that require hundreds of VMs for a short duration. It automatically provisions, manages, and deallocates the VMs, scaling to the required number of nodes, running the batch job, and then terminating them—matching the nightly processing requirement exactly.

Answer

Azure Virtual Machine Scale Sets

Answer

Azure Functions

Answer

Azure Container Instances

Question 7

A company uses Azure and wants to organize all their virtual machines, databases, and storage accounts into logical containers for management and billing purposes. Which Azure component should they use to group these resources?

Accepted Answer

Resource Group. Resource Groups are logical containers in Azure that allow you to group related resources such as virtual machines, databases, and storage accounts for unified management, monitoring, and billing. By placing resources in the same resource group, you can apply lifecycle operations (e.g., delete, tag) and cost tracking across all members. This directly matches the requirement to organize resources for management and billing purposes.

Answer

Azure Policy

Answer

Management Group

Answer

Azure Subscription

Question 8

Which Azure service enables you to connect to an Azure virtual machine using a web browser without exposing RDP/SSH ports to the internet?

Accepted Answer

Azure Bastion. Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to Azure virtual machines directly from the Azure portal using a web browser. It eliminates the need for public IP addresses on VMs and does not expose RDP/SSH ports to the internet, as all traffic is tunneled through the Azure backbone network over TLS.

Answer

Azure VPN Gateway Point-to-Site

Answer

Azure AD Application Proxy

Answer

Azure Firewall Just-In-Time access

Question 9

An organization wants to track which team or project each Azure resource belongs to for cost allocation purposes. Which Azure feature is BEST for this?

Accepted Answer

Azure tags. Azure tags are metadata key-value pairs that can be applied to resources, resource groups, and subscriptions to logically organize them. They are the best choice for tracking cost allocation by team or project because Azure Cost Management can filter and group costs by tag values, enabling chargeback and showback scenarios.

Answer

Azure resource groups

Answer

Management groups

Answer

Azure Subscriptions

Question 10

A company has multiple Azure subscriptions for different departments. The IT team wants to apply a common set of policies (e.g., allowed VM sizes) and assign the same role-based access control (RBAC) permissions across all subscriptions automatically. Which Azure feature should they use?

Accepted Answer

Azure Management Groups. Azure Management Groups allow you to organize Azure subscriptions hierarchically and apply governance conditions, such as RBAC assignments and Azure Policy definitions, at the management group level. These conditions are inherited by all subscriptions within the group, enabling automatic and consistent application of policies and permissions across multiple subscriptions without manual per-subscription configuration.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Resource Manager (ARM) templates

Question 11

Which Azure feature allows an organization to identify resources that do not comply with defined policies and automatically trigger remediation?

Accepted Answer

Azure Policy remediation tasks. Azure Policy remediation tasks are the correct answer because they are specifically designed to identify non-compliant resources based on policy definitions and automatically trigger remediation actions, such as deploying a required configuration or modifying resource settings. This feature works by using managed identities to execute the 'deployIfNotExists' or 'modify' policy effects, ensuring resources are brought into compliance without manual intervention.

Answer

Azure Automation runbooks

Answer

Azure Blueprints re-assignment

Answer

Azure Logic Apps compliance workflows

Question 12

A developer wants to host a static website with HTML, CSS, and JavaScript files. Which Azure service is the MOST cost-effective option?

Accepted Answer

Azure Blob Storage static website hosting. Azure Blob Storage static website hosting is the most cost-effective option because it allows you to serve static content (HTML, CSS, JavaScript) directly from a storage container at a fraction of the cost of compute-based services. There is no need to provision or pay for virtual machines, app service plans, or orchestration layers, as the content is served via HTTP from Azure's highly durable and low-cost blob storage infrastructure.

Answer

Azure App Service

Answer

Azure Virtual Machines

Answer

Azure Kubernetes Service

Question 13

Which Azure feature provides a unified compliance score and consolidated view of your organization's compliance posture across different regulatory standards?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) provides a unified compliance score and a consolidated view of your organization's compliance posture across multiple regulatory standards (e.g., SOC 2, ISO 27001, PCI DSS). It continuously assesses your Azure and hybrid workloads against these standards, calculates a compliance score based on the percentage of compliant controls, and offers actionable recommendations to improve your overall security and compliance posture.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Active Directory

Question 14

Which Azure service provides a secure, scalable API gateway that manages access to backend services?

Accepted Answer

Azure API Management. Azure API Management is the correct service because it provides a secure, scalable API gateway that manages access to backend services. It handles API publishing, versioning, rate limiting, authentication (e.g., OAuth 2.0, JWT validation), and request/response transformation, acting as a centralized facade between clients and backend APIs.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure Service Bus

Question 15

What is 'serverless computing'?

Accepted Answer

A model where developers deploy code without managing server infrastructure, paying only for execution. Serverless computing is a cloud execution model where the cloud provider dynamically manages the allocation and provisioning of servers. Developers write and deploy code in the form of functions (e.g., AWS Lambda, Azure Functions) without provisioning or managing any underlying server infrastructure, and they are billed only for the actual compute time consumed during execution, not for idle capacity.

Answer

Computing that uses no physical servers anywhere in the world

Answer

Running applications without an operating system

Answer

Hosting applications on shared physical hardware