AZ-900 Practice Test 4 — 10 Questions

Question 1

Match each Azure database service to its type.

Accepted Answer

Azure SQL Database: Relational. In this matching exercise, the correct pairs are: Azure SQL Database (Relational), Azure Cosmos DB (NoSQL), Azure Database for MySQL (Relational), Azure Database for PostgreSQL (Relational). The distractors swap the types, incorrectly labeling Cosmos DB as relational and SQL Database as NoSQL.

Answer

Azure Cosmos DB: Relational

Answer

Azure SQL Database: NoSQL

Question 2

A US-based financial services company must ensure that all customer data remains within the United States at all times to comply with regulatory requirements. The company plans to replicate its Azure SQL database between two Azure regions for disaster recovery. The solution must guarantee that if a region experiences a major outage, the paired region is prioritized for recovery. Additionally, the solution should ensure that during planned maintenance, only one region in the pair is updated at a time. Which Azure architecture feature should the company use?

Accepted Answer

Region Pairs. Region Pairs are the correct choice because Azure guarantees that each region is paired with another region within the same geography (e.g., East US with West US) to provide physical isolation, prioritized disaster recovery, and sequential planned maintenance updates. This ensures that during an outage, recovery is directed to the paired region, and during maintenance, only one region in the pair is updated at a time, meeting the company's regulatory and availability requirements.

Answer

Availability Zones

Answer

Resource Groups

Answer

Azure Policy

Question 3

Which Azure service provides a managed, serverless SQL database that scales automatically and pauses when not in use?

Accepted Answer

Azure SQL Database Serverless. Azure SQL Database Serverless is the correct answer because it is a compute tier for single databases that automatically scales compute resources based on workload demand and pauses the database during periods of inactivity, charging only for storage when paused. This aligns directly with the question's requirement for a managed, serverless SQL database that scales automatically and pauses when not in use.

Answer

Azure SQL Database General Purpose tier

Answer

Azure Cosmos DB Serverless

Answer

Azure SQL Managed Instance

Question 4

A company uses Azure for multiple projects. The IT governance team wants to ensure that every new Azure resource within a subscription is automatically assigned a 'CostCenter' tag based on the resource group it is created in. The team does not want to rely on users manually applying the tag. They need a built-in Azure solution that enforces this rule without custom scripts. Which Azure feature should they use?

Accepted Answer

Azure Policy with the 'Inherit a tag from the resource group if missing' effect. Azure Policy with the 'Inherit a tag from the resource group if missing' effect is correct because it automatically applies the 'CostCenter' tag from the resource group to any new resource created within that resource group, without requiring manual intervention or custom scripts. This built-in policy effect enforces governance rules at scale, ensuring compliance across the subscription.

Answer

Azure Resource Graph

Answer

Azure Management Groups

Answer

Azure Tags (manual tagging feature)

Question 5

A company runs a multi-tier application on Azure virtual machines in a virtual network. The web tier VMs are in a front-end subnet, and the database tier VMs are in a back-end subnet. Currently, outbound internet traffic from the VMs goes directly to the internet without any inspection or logging. The security team needs a centralized service to inspect all outbound traffic from the virtual network, log the destinations, and reject traffic to malicious domains based on threat intelligence feeds. The solution must also allow rules based on fully qualified domain names (FQDNs) instead of only IP addresses. Which Azure service should the security team deploy?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-based network security service that provides centralized outbound traffic inspection, logging, and threat intelligence-based filtering. It supports application rules based on fully qualified domain names (FQDNs), allowing the security team to reject traffic to malicious domains without relying solely on IP addresses. This makes it the correct choice for inspecting and controlling outbound traffic from the virtual network.

Answer

Azure Bastion

Answer

Network Security Group (NSG)

Answer

Application Gateway

Question 6

A company plans to migrate a line-of-business application to Azure virtual machines (IaaS). The company's security team is reviewing the shared responsibility model to determine which security tasks are handled by Microsoft. Which of the following security responsibilities belongs to Microsoft?

Accepted Answer

Maintaining physical security of the datacenter where the servers are hosted. Under the shared responsibility model for IaaS, Microsoft is responsible for the physical security of its datacenters, including access controls, surveillance, and environmental safeguards. This is a foundational layer that customers cannot manage, making option C correct.

Answer

Configuring operating system firewalls on the virtual machines

Answer

Patching the guest operating system of the virtual machines

Answer

Managing application-level user authentication and authorization

Question 7

Which Azure service provides automatic threat detection and response for Azure SQL Database, detecting anomalous activities like SQL injection?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL is the correct answer because it is a cloud-native security solution specifically designed to detect and respond to threats against Azure SQL Database, including SQL injection attacks. It provides advanced threat protection by continuously monitoring database activities and generating security alerts for anomalous behaviors, such as unusual access patterns or injection attempts, without requiring manual intervention.

Answer

Azure SQL Database auditing

Answer

Azure Policy

Answer

Azure Firewall

Question 8

A company runs a web application on Azure. At the end of each month, the finance team reviews an invoice that itemizes charges by resource type, such as virtual machine compute hours, storage capacity used, and data transfer volume. The total cost directly corresponds to the exact quantity of resources consumed during the billing period. This capability is an example of which fundamental characteristic of cloud computing?

Accepted Answer

Measured service. Measured service is the correct answer because it refers to the cloud provider's ability to meter and bill customers based on actual resource consumption. In this scenario, the invoice itemizes charges by resource type (compute hours, storage, data transfer) and the total cost directly corresponds to the exact quantity consumed, which is the defining characteristic of measured service. This capability relies on metering telemetry (e.g., Azure Monitor metrics, usage logs) to track usage and generate a pay-per-use billing model.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

On-demand self-service

Question 9

A company has 30 Azure subscriptions organized under a single management group. The governance team wants to enforce that all resource groups must have a specific tag 'CostCenter' with a valid value. They create an Azure Policy definition with the 'Deny' effect and assign it to the root management group. However, the development team complains that they have a sandbox subscription where they need to create resource groups without the 'CostCenter' tag for testing. The governance team still wants the policy to apply to all other subscriptions but exempt the sandbox subscription. Which solution should the governance team use?

Accepted Answer

Use a policy exemption on the sandbox subscription with category 'Waiver'.. Azure Policy exemptions allow specific scopes (like the sandbox subscription) to be excluded from a policy's enforcement while keeping the policy assigned to the parent management group. A 'Waiver' exemption category is used when the intent is to temporarily or permanently exempt a resource from policy evaluation, which fits the governance team's requirement to exempt only the sandbox subscription without altering the policy assignment structure.

Answer

Create a second policy assignment at the sandbox subscription with the 'Disabled' effect.

Answer

Remove the policy assignment from the management group and assign it individually to all subscriptions except the sandbox.

Answer

Configure an Azure Blueprint for the management group and exclude the sandbox subscription.

Question 10

A large enterprise manages hundreds of Azure subscriptions. The compliance team needs to run an on-demand report that shows all virtual machines with their current power state (running or deallocated), operating system, and VM size, filtering by specific resource groups or subscriptions. The team wants to use a native Azure tool that allows querying Azure resources at scale using a Kusto Query Language (KQL) syntax. Which Azure service should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct choice because it is a native Azure service designed for querying Azure resources at scale using Kusto Query Language (KQL). It allows you to run on-demand, complex queries across multiple subscriptions, resource groups, and resource types, and can return properties such as power state, operating system, and VM size. This directly matches the compliance team's requirement for a scalable, KQL-based query tool that works across hundreds of subscriptions.

Answer

Azure Monitor Logs

Answer

Azure Resource Explorer

Answer

Azure Advisor