AZ-900 Practice Test 44 — 15 Questions

Question 1

Which Azure service provides network filtering to protect web applications from common exploits like SQL injection and cross-site scripting?

Accepted Answer

Azure Web Application Firewall (WAF). Azure Web Application Firewall (WAF) is specifically designed to inspect and filter HTTP/HTTPS traffic at the application layer (Layer 7). It uses rule sets like the OWASP Core Rule Set to detect and block common web exploits such as SQL injection and cross-site scripting (XSS), making it the correct choice for protecting web applications.

Answer

Azure Firewall

Answer

Azure DDoS Protection

Answer

Network Security Groups (NSG)

Question 2

What is the primary difference between a public cloud and a private cloud?

Accepted Answer

Public cloud infrastructure is shared among multiple customers; private is dedicated to one organization. The primary difference is that a public cloud uses a multi-tenant architecture where infrastructure resources like compute, storage, and networking are shared across multiple unrelated customers, while a private cloud provisions dedicated infrastructure for a single organization, either on-premises or hosted by a third party. This distinction is fundamental to cloud deployment models as defined by NIST SP 800-145, which emphasizes resource pooling in public clouds versus single-tenant isolation in private clouds.

Answer

Public cloud is more secure than private cloud

Answer

Private cloud is always hosted by a third-party provider

Answer

Public cloud can only be accessed from within the organization's network

Question 3

Which Azure feature automatically identifies cost savings opportunities like orphaned resources and idle VMs?

Accepted Answer

Azure Advisor cost recommendations. Azure Advisor is a built-in, personalized cloud consultant that continuously analyzes your Azure resource usage and configuration. It provides proactive cost recommendations by identifying specific optimization opportunities, such as orphaned disks, idle virtual machines (VMs), and underutilized ExpressRoute circuits, helping you reduce spending without manual auditing.

Answer

Azure Cost Management budgets

Answer

Azure Pricing Calculator

Answer

Azure Policy cost controls

Question 4

Which Azure service translates domain names to IP addresses for routing internet traffic?

Accepted Answer

Azure DNS. Azure DNS is the correct service because it provides domain name resolution, translating human-readable domain names (e.g., www.example.com) into IP addresses using the DNS protocol. This is the fundamental function of a DNS service, enabling internet traffic to be routed to the correct destination based on the resolved IP address.

Answer

Azure Traffic Manager

Answer

Azure Private DNS

Answer

Azure Application Gateway

Question 5

Which Azure service enables organizations to identify and classify sensitive data (like credit card numbers and passport numbers) stored in Azure?

Accepted Answer

Microsoft Purview. Microsoft Purview (formerly Azure Purview) is the correct service because it provides unified data governance, including automated data classification and sensitivity labeling across Azure, on-premises, and multi-cloud environments. It uses built-in classifiers to detect sensitive data types such as credit card numbers (based on Luhn algorithm validation) and passport numbers, and can apply Microsoft Information Protection (MIP) sensitivity labels to the classified data.

Answer

Azure Key Vault

Answer

Azure Information Protection

Answer

Azure Security Center

Question 6

A company has deployed several Windows and Linux virtual machines in an Azure virtual network. For security reasons, the virtual machines have no public IP addresses assigned. The IT administrators need to securely connect to these VMs using Remote Desktop Protocol (RDP) for Windows and Secure Shell (SSH) for Linux without deploying any additional agents on the VMs. The connection must be established directly from the Azure portal, and the service must provide protection against port scanning and brute-force attacks. Which Azure service should the company use?

Accepted Answer

Azure Bastion. Azure Bastion is the correct choice because it provides secure, seamless RDP and SSH connectivity to virtual machines directly from the Azure portal over TLS, without requiring any public IP addresses on the VMs or additional agent installations. It uses a hardened bastion host inside the virtual network, and by default it protects against port scanning and brute-force attacks by not exposing the VMs' RDP/SSH ports to the internet.

Answer

Just-in-time (JIT) VM access (Microsoft Defender for Cloud)

Answer

Azure Firewall

Answer

Azure VPN Gateway

Question 7

Which cloud deployment model combines on-premises infrastructure with public cloud resources, allowing data and applications to be shared between them?

Accepted Answer

Hybrid cloud. A hybrid cloud deployment model explicitly combines on-premises infrastructure (private cloud or local datacenter) with public cloud resources, enabling data and application portability through technologies like VPNs, dedicated interconnects, or orchestration tools. This model allows workloads to burst to the public cloud during peak demand while keeping sensitive data on-premises, fulfilling the scenario described in the question.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 8

Which type of expenditure does cloud computing convert infrastructure costs into?

Accepted Answer

Operational expenditure (OpEx). Cloud computing converts infrastructure costs from capital expenditure (CapEx) to operational expenditure (OpEx) because you pay for compute, storage, and networking resources on a consumption-based model (pay-as-you-go) rather than purchasing physical hardware upfront. This shift allows organizations to avoid large upfront investments and instead pay for only what they use, aligning costs with actual usage and reducing financial risk.

Answer

Capital expenditure (CapEx)

Answer

Research and development expenditure (R&D)

Answer

Capital and operational expenditure equally

Question 9

Which Azure service provides a dedicated hardware security module (HSM) for generating and storing cryptographic keys?

Accepted Answer

Azure Dedicated HSM. Azure Dedicated HSM provides a single-tenant, FIPS 140-2 Level 3 validated hardware security module that is fully under your control, allowing you to generate and store cryptographic keys in a dedicated appliance. Unlike Key Vault, which is a multi-tenant software-based service, Dedicated HSM gives you exclusive access to the HSM hardware for compliance and high-security workloads.

Answer

Azure Key Vault Standard tier

Answer

Azure Key Vault Premium tier

Answer

Azure Confidential Computing

Question 10

Which Azure service provides a set of APIs and tools for building real-time communication features into applications, such as voice and video calling?

Accepted Answer

Azure Communication Services. Azure Communication Services is the correct answer because it provides a set of REST APIs and client SDKs specifically designed to integrate real-time communication features—such as voice, video, and chat—into custom applications. Unlike other Azure services, it offers managed WebRTC-based media streaming and PSTN telephony capabilities, making it the dedicated solution for embedding communication experiences.

Answer

Azure Media Services

Answer

Azure Event Grid

Answer

Azure Bot Service

Question 11

Which Azure service provides a managed Kubernetes environment for deploying and managing containerized applications?

Accepted Answer

Azure Kubernetes Service (AKS). Azure Kubernetes Service (AKS) is the correct answer because it is Azure's managed Kubernetes orchestration service, which handles the control plane (including the API server, etcd, and scheduler) for you, while you manage the worker nodes and your containerized applications. This allows you to deploy, scale, and manage containerized applications using Kubernetes without the operational overhead of maintaining the control plane infrastructure.

Answer

Azure Container Instances

Answer

Azure App Service

Answer

Azure Container Registry

Question 12

Which Azure feature provides continuous application performance monitoring with automatic anomaly detection?

Accepted Answer

Azure Application Insights. Azure Application Insights is the correct answer because it is an extensible Application Performance Management (APM) service specifically designed for continuous monitoring of live applications. It automatically detects performance anomalies through features like Smart Detection, which uses machine learning algorithms to analyze telemetry data (e.g., request rates, response times, failure rates) and proactively identify unusual patterns without manual threshold configuration.

Answer

Azure Monitor

Answer

Azure Log Analytics

Answer

Azure Network Watcher

Question 13

A company is migrating its on-premises workloads to Azure. Previously, they purchased servers every three years as a large capital investment. Now, they pay a monthly subscription for virtual machines based on actual usage, with no long-term commitment. Which type of cloud expenditure model does this represent?

Accepted Answer

Capital expenditure (CapEx) to operational expenditure (OpEx). This scenario describes a shift from Capital Expenditure (CapEx), where the company made large upfront investments in hardware every three years, to Operational Expenditure (OpEx), where they pay a monthly subscription for Azure virtual machines based on actual usage with no long-term commitment. This is a core benefit of cloud computing, converting fixed, upfront costs into variable, ongoing expenses that align with consumption.

Answer

Operational expenditure (OpEx) to capital expenditure (CapEx)

Answer

Pay-as-you-go to reserved

Answer

Consumption-based to fixed cost

Question 14

Which Azure pricing calculator helps you estimate monthly costs for Azure services before deploying them?

Accepted Answer

Azure Pricing Calculator. The Azure Pricing Calculator is the correct tool for estimating monthly costs of Azure services before deployment. It allows you to configure services (e.g., VMs, storage, databases) by specifying parameters like region, tier, and usage hours, then generates a detailed cost estimate. This pre-deployment estimation is its primary purpose, distinguishing it from post-deployment cost analysis tools.

Answer

Azure TCO Calculator

Answer

Azure Cost Management

Answer

Azure Advisor

Question 15

Which Azure tool helps estimate the cost savings of migrating on-premises workloads to Azure compared to current on-premises costs?

Accepted Answer

Azure TCO Calculator. The Azure TCO (Total Cost of Ownership) Calculator is specifically designed to compare the costs of running on-premises workloads against the equivalent Azure services. It takes inputs such as server, storage, and network specifications, then estimates the cost savings by factoring in Azure pricing, labor, and operational expenses. This makes it the correct tool for estimating cost savings from migration.

Answer

Azure Pricing Calculator

Answer

Azure Cost Management

Answer

Azure Advisor