AZ-900 Practice Test 5 — 10 Questions

Question 1

A company runs a multi-tier application on Azure virtual machines in a virtual network. The web tier VMs are in a front-end subnet, and the database tier VMs are in a back-end subnet. Currently, outbound internet traffic from the VMs goes directly to the internet without any inspection or logging. The security team needs a centralized service to inspect all outbound traffic from the virtual network, log the destinations, and reject traffic to malicious domains based on threat intelligence feeds. The solution must also allow rules based on fully qualified domain names (FQDNs) instead of only IP addresses. Which Azure service should the security team deploy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-based network security service that provides centralized outbound traffic inspection, logging, and threat intelligence-based filtering. It supports application rules based on fully qualified domain names (FQDNs), allowing the security team to reject traffic to malicious domains without relying solely on IP addresses. This makes it the correct choice for inspecting and controlling outbound traffic from the virtual network.

Answer

Azure Bastion

Answer

Network Security Group (NSG)

Answer

Application Gateway

Question 2

A company plans to migrate a line-of-business application to Azure virtual machines (IaaS). The company's security team is reviewing the shared responsibility model to determine which security tasks are handled by Microsoft. Which of the following security responsibilities belongs to Microsoft?

Accepted Answer

Maintaining physical security of the datacenter where the servers are hosted. Under the shared responsibility model for IaaS, Microsoft is responsible for the physical security of its datacenters, including access controls, surveillance, and environmental safeguards. This is a foundational layer that customers cannot manage, making option C correct.

Answer

Configuring operating system firewalls on the virtual machines

Answer

Patching the guest operating system of the virtual machines

Answer

Managing application-level user authentication and authorization

Question 3

Which Azure service provides automatic threat detection and response for Azure SQL Database, detecting anomalous activities like SQL injection?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL is the correct answer because it is a cloud-native security solution specifically designed to detect and respond to threats against Azure SQL Database, including SQL injection attacks. It provides advanced threat protection by continuously monitoring database activities and generating security alerts for anomalous behaviors, such as unusual access patterns or injection attempts, without requiring manual intervention.

Answer

Azure SQL Database auditing

Answer

Azure Policy

Answer

Azure Firewall

Question 4

A company runs a web application on Azure. At the end of each month, the finance team reviews an invoice that itemizes charges by resource type, such as virtual machine compute hours, storage capacity used, and data transfer volume. The total cost directly corresponds to the exact quantity of resources consumed during the billing period. This capability is an example of which fundamental characteristic of cloud computing?

Accepted Answer

Measured service. Measured service is the correct answer because it refers to the cloud provider's ability to meter and bill customers based on actual resource consumption. In this scenario, the invoice itemizes charges by resource type (compute hours, storage, data transfer) and the total cost directly corresponds to the exact quantity consumed, which is the defining characteristic of measured service. This capability relies on metering telemetry (e.g., Azure Monitor metrics, usage logs) to track usage and generate a pay-per-use billing model.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

On-demand self-service

Question 5

A company has 30 Azure subscriptions organized under a single management group. The governance team wants to enforce that all resource groups must have a specific tag 'CostCenter' with a valid value. They create an Azure Policy definition with the 'Deny' effect and assign it to the root management group. However, the development team complains that they have a sandbox subscription where they need to create resource groups without the 'CostCenter' tag for testing. The governance team still wants the policy to apply to all other subscriptions but exempt the sandbox subscription. Which solution should the governance team use?

Accepted Answer

Use a policy exemption on the sandbox subscription with category 'Waiver'.. Azure Policy exemptions allow specific scopes (like the sandbox subscription) to be excluded from a policy's enforcement while keeping the policy assigned to the parent management group. A 'Waiver' exemption category is used when the intent is to temporarily or permanently exempt a resource from policy evaluation, which fits the governance team's requirement to exempt only the sandbox subscription without altering the policy assignment structure.

Answer

Create a second policy assignment at the sandbox subscription with the 'Disabled' effect.

Answer

Remove the policy assignment from the management group and assign it individually to all subscriptions except the sandbox.

Answer

Configure an Azure Blueprint for the management group and exclude the sandbox subscription.

Question 6

A large enterprise manages hundreds of Azure subscriptions. The compliance team needs to run an on-demand report that shows all virtual machines with their current power state (running or deallocated), operating system, and VM size, filtering by specific resource groups or subscriptions. The team wants to use a native Azure tool that allows querying Azure resources at scale using a Kusto Query Language (KQL) syntax. Which Azure service should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct choice because it is a native Azure service designed for querying Azure resources at scale using Kusto Query Language (KQL). It allows you to run on-demand, complex queries across multiple subscriptions, resource groups, and resource types, and can return properties such as power state, operating system, and VM size. This directly matches the compliance team's requirement for a scalable, KQL-based query tool that works across hundreds of subscriptions.

Answer

Azure Monitor Logs

Answer

Azure Resource Explorer

Answer

Azure Advisor

Question 7

A company uses Azure for its infrastructure. A developer needs a new virtual machine to test a feature. The developer goes to the Azure portal, selects an image, and provisions the VM within minutes without any interaction with the IT procurement department. This capability directly demonstrates which essential characteristic of cloud computing as defined by NIST?

Accepted Answer

On-demand self-service. The scenario describes a developer provisioning a virtual machine directly through the Azure portal without needing to submit a request or obtain approval from IT procurement. This aligns with the NIST definition of on-demand self-service, which states that a consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider. The key enabler here is the self-service portal (Azure portal) that allows the developer to select an image and deploy the VM instantly, bypassing any manual approval workflow.

Answer

Rapid elasticity

Answer

Measured service

Answer

Resource pooling

Question 8

A cloud provider uses virtualization technology to host multiple customers on the same physical server. Each customer's data, applications, and operating systems are logically isolated and secured from one another. Which characteristic of cloud computing does this scenario best describe?

Accepted Answer

Resource pooling. This scenario describes resource pooling, where the provider's computing resources (such as storage, memory, and network bandwidth) are pooled to serve multiple customers using a multi-tenant model. Virtualization technology creates isolated virtual machines for each tenant, ensuring logical separation of data and applications while sharing the same physical hardware. This is a core characteristic of cloud computing as defined by NIST SP 800-145.

Answer

Rapid elasticity

Answer

Measured service

Answer

On-demand self-service

Question 9

A company wants to track and manage costs across multiple Azure subscriptions. They have created a hierarchy of management groups: Root -> Department A -> Project 1, Project 2. They want to see the total cost for Department A across all its projects. Which Azure tool should they use?

Accepted Answer

Cost Management + Billing. Cost Management + Billing is the correct tool because it provides consolidated cost tracking and analysis across multiple subscriptions and management groups. By organizing subscriptions under the Department A management group, Cost Management can aggregate costs from Project 1 and Project 2, allowing the company to view the total cost for Department A in a single dashboard or report.

Answer

Azure Policy

Answer

Azure Advisor

Answer

Azure Monitor

Question 10

A company runs an e-commerce web application on a set of Azure virtual machines behind a load balancer. The application experiences unpredictable traffic surges during flash sales. The company configures an autoscale setting that automatically adds virtual machines when the average CPU usage across the existing VMs exceeds 75% for five minutes, and removes virtual machines when CPU usage drops below 30% for ten minutes. Which essential characteristic of cloud computing does this configuration primarily demonstrate?

Accepted Answer

Rapid elasticity. B is correct because the autoscale configuration dynamically adds and removes virtual machines in response to real-time CPU usage thresholds, which is the defining characteristic of rapid elasticity. This allows the e-commerce application to scale computing resources up and down automatically and seamlessly to match unpredictable traffic surges, ensuring performance during flash sales without manual intervention.

Answer

Measured service

Answer

Resource pooling

Answer

Broad network access