AZ-900 Practice Exam 52 — 20 Questions

Question 1

A large enterprise manages hundreds of Azure subscriptions. The central governance team wants to ensure that every resource deployed across all subscriptions always has two required tags: 'Department' and 'CostCenter'. If a resource is created without these tags, the governance policy must automatically add the missing tags with placeholder values (e.g., 'Department: Unknown') and generate a compliance report. The team does not want to rely on user training or manual audits. Which Azure service should the team use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Policy. Azure Policy is the correct service because it can enforce tagging rules across all subscriptions in a management group. By using a policy definition with the 'modify' effect, Azure Policy can automatically add missing tags with placeholder values (e.g., 'Department: Unknown') during resource creation or at scale via remediation tasks. It also integrates with Azure Policy compliance reports to provide continuous governance without relying on user training or manual audits.

Answer

Azure Cost Management

Answer

Azure Blueprints

Answer

Azure Resource Groups

Question 2

A company currently budgets for maximum capacity to handle peak loads, resulting in underutilized resources during off-peak times. They want a model where they can quickly adjust resources up or down based on demand. Which cloud characteristic directly addresses this concern?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that enables automatic scaling of resources up or down in response to real-time demand. This directly addresses the company's need to avoid over-provisioning for peak loads while still being able to handle spikes without manual intervention, typically implemented through auto-scaling policies in services like Azure Virtual Machine Scale Sets or Azure App Service autoscale.

Answer

High availability

Answer

Geo-redundancy

Answer

Fault tolerance

Question 3

Which Azure cloud benefit allows a company to avoid predicting exactly how much compute capacity it needs months in advance?

Accepted Answer

Elasticity. Elasticity is the Azure cloud benefit that allows a company to automatically scale compute resources up or down based on real-time demand, eliminating the need to predict capacity months in advance. With Azure Virtual Machine Scale Sets or Azure App Service auto-scale, resources can be added or removed dynamically, ensuring you only pay for what you use. This contrasts with traditional on-premises capacity planning, where over-provisioning or under-provisioning is common.

Answer

Fault tolerance

Answer

Geo-redundancy

Answer

Economies of scale

Question 4

A company runs a global e-commerce platform. During a flash sale, demand surges from 10,000 users to 500,000 users in minutes. The platform automatically provisions additional servers to handle the load and deprovisions them after the sale. Which cloud characteristic is most directly demonstrated?

Accepted Answer

Elasticity. Elasticity is the ability of a cloud system to automatically scale resources up or down based on demand. In this scenario, the platform provisions additional servers during the flash sale and deprovisions them afterward, directly demonstrating elasticity. This contrasts with other characteristics like high availability, which focuses on uptime, not dynamic scaling.

Answer

High availability

Answer

Fault tolerance

Answer

Geographic distribution

Question 5

Which of the following is an example of a SaaS (Software as a Service) offering from Microsoft?

Accepted Answer

Microsoft 365. Microsoft 365 is a SaaS offering because it provides ready-to-use productivity applications (e.g., Word, Excel, Teams) accessed via a web browser or client, with Microsoft managing the underlying infrastructure, operating system, and application updates. The customer simply consumes the software without needing to install or maintain servers or runtime environments.

Answer

Azure Virtual Machines

Answer

Azure App Service

Answer

Azure SQL Database

Question 6

A company plans to deploy a critical web application on Azure virtual machines in the West US region. The application must remain available if a single datacenter within that region experiences a complete outage. The company also requires the virtual machines to be connected to each other with low-latency network connectivity. Which Azure feature should the company use to deploy the virtual machines?

Accepted Answer

Availability Zone. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across two or more zones ensures that if one datacenter fails, the application remains available in another zone, while the VMs within the same region can still be connected via a low-latency virtual network.

Answer

Availability Set

Answer

Region Pair

Answer

Virtual Machine Scale Set

Question 7

A company hosts a critical line-of-business application on Azure virtual machines. The application must remain available even if a single virtual machine fails due to hardware failure or operating system crash. The company deploys two virtual machines in an Availability Set and configures an Azure Load Balancer to distribute traffic. If one VM becomes unavailable, the Load Balancer automatically redirects traffic to the healthy VM. This configuration primarily demonstrates which benefit of cloud computing?

Accepted Answer

Reliability – ability to recover from failures and continue functioning. This configuration demonstrates reliability, a core cloud computing benefit, because the combination of an Availability Set and Azure Load Balancer ensures that the application remains operational even when a single VM fails due to hardware or OS issues. The Availability Set spreads VMs across fault domains and update domains to isolate failures, while the Load Balancer uses health probes to detect VM unavailability and redirect traffic only to healthy instances. This built-in redundancy and automatic failover capability directly aligns with the cloud's promise of high availability and fault tolerance.

Answer

Elasticity – ability to scale resources up and down

Answer

Security – protection against unauthorized access

Answer

Cost efficiency – paying only for consumed resources

Question 8

Which Azure service provides a managed relational database compatible with PostgreSQL?

Accepted Answer

Azure Database for PostgreSQL. Azure Database for PostgreSQL is a fully managed, enterprise-ready relational database service built on the open-source PostgreSQL engine. It provides built-in high availability, automated backups, and scaling, making it the correct choice for a managed PostgreSQL-compatible database in Azure.

Answer

Azure SQL Database

Answer

Azure Cosmos DB for PostgreSQL

Answer

Azure Database for MariaDB

Question 9

A company is adopting Azure and wants to ensure that every new subscription automatically includes a standard set of governance artifacts: two custom Azure Policy definitions (one for allowed locations, one for resource tagging), a custom Role-Based Access Control (RBAC) assignment for the security team, and an initial resource group with an Azure Resource Manager (ARM) template that sets up a network topology. The company wants to version these artifacts and update them over time, ensuring that new subscriptions always use the latest approved version. Which Azure service should the company use to package and deploy this standardized environment?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it is designed to orchestrate the deployment of a repeatable, versioned environment that includes policies, RBAC assignments, resource groups, and ARM templates. It allows you to define a blueprint with these artifacts, publish versions, and assign the latest approved version to new subscriptions, ensuring consistent governance across the organization.

Answer

Azure Management Groups

Answer

Azure Policy Initiatives

Answer

Azure Resource Manager (ARM) Templates

Question 10

A company runs an e-commerce application on multiple Azure virtual machines in a single region. The IT team needs to distribute incoming web traffic across the VMs, offload SSL/TLS termination to improve VM performance, and route requests based on URL path (for example, /images to one pool of VMs and /api to another). The solution must handle these requirements within a single Azure region. Which Azure service should the company use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a layer 7 load balancer that can distribute incoming web traffic based on URL path, offload SSL/TLS termination to reduce VM CPU overhead, and route requests to different backend pools (e.g., /images and /api) within a single Azure region. It supports HTTP/HTTPS traffic and provides Web Application Firewall (WAF) capabilities, making it the correct choice for this scenario.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Front Door

Question 11

A company has an Azure subscription used by multiple development teams. The security team wants to ensure that every virtual network (VNet) created in the subscription automatically has a specific network security group (NSG) associated with its default subnet. The NSG rules are defined by the security team, and developers should not have to perform any extra steps after creating a VNet. Which Azure Policy effect should the security team use in the policy definition?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it automatically deploys a specific NSG to the default subnet of any VNet that does not already have it, ensuring compliance without requiring developer intervention. This effect evaluates the resource after creation and triggers a deployment to remediate non-compliant states, aligning with the requirement for zero extra steps.

Answer

Deny

Answer

Audit

Answer

Append

Question 12

A company stores sensitive customer transaction records in Azure Blob Storage. The records must be available for read access at all times, even if the primary Azure region becomes unavailable. The company initially configured geo-redundant storage (GRS). During a disaster recovery test, the operations team discovers that although data is replicated to a secondary region, they cannot read the data from the secondary region until a Microsoft-initiated failover occurs. The team needs a solution that provides immediate, continuous read access to the replicated data in the secondary region without waiting for a failover. Which Azure Storage replication option should the company use?

Accepted Answer

Read-access geo-redundant storage (RA-GRS). RA-GRS extends GRS by enabling read access to the data in the secondary region at all times, without requiring a Microsoft-initiated failover. This ensures that the customer transaction records remain continuously readable from the secondary region, meeting the requirement for immediate read access during a primary region outage.

Answer

Locally-redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Question 13

A company hosts a public-facing web application on Azure Virtual Machines in two separate Azure regions for disaster recovery. The application's domain is managed by a third-party registrar. The company needs a solution that can route user traffic to the nearest healthy regional endpoint based on geographic location and provides automatic failover if an entire region becomes unavailable. The solution should not inspect or modify the HTTP traffic (no SSL termination or web application firewall). Which Azure service should the company use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming DNS requests to the nearest healthy regional endpoint based on geographic location or latency. It supports automatic failover by monitoring endpoint health and redirecting traffic if an entire region becomes unavailable, and it operates at the DNS level without inspecting or modifying HTTP traffic, so no SSL termination or web application firewall is involved.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 14

A company uses Azure Policy to govern its Azure environment. The governance team wants to enforce that all virtual machines (VMs) deployed in the production subscription use only approved operating system images from a specific Azure Compute Gallery. However, during a transition period, the team does not want to block the creation of VMs that use non-approved images; instead, they need to identify and report on any non-compliant VMs. They also want to track compliance over time. Which Azure Policy effect should the governance team use in the policy definition to meet these requirements?

Accepted Answer

Audit. The Audit effect is correct because it enables the governance team to identify and report non-compliant VMs without blocking their creation. Azure Policy's Audit effect logs a warning in the activity log for resources that violate the policy, allowing the team to track compliance over time via Azure Policy compliance reports and Azure Monitor, while the transition period remains unblocked.

Answer

Deny

Answer

Append

Answer

Modify

Question 15

A company wants to encrypt data at rest in Azure SQL Database using customer-managed keys stored in Azure Key Vault. They also need to be able to rotate the keys without downtime. Which feature should they use?

Accepted Answer

Transparent Data Encryption with customer-managed keys. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault allows you to encrypt the database at rest using your own keys, which you can rotate without downtime because Azure SQL Database handles the re-encryption of the database encryption key (DEK) transparently in the background, without requiring database offline or performance impact.

Answer

Always Encrypted

Answer

Dynamic Data Masking

Answer

Row-level security

Question 16

A company is migrating a customer-facing web application to Azure. The application requires a relational database with built-in high availability, automatic backups, and automatic patching of the database engine. The development team is familiar with SQL Server and wants to minimize administrative overhead. They do not want to manage virtual machines or operating systems. Which Azure database service should the team choose?

Accepted Answer

Azure SQL Database (PaaS). Azure SQL Database is a fully managed Platform-as-a-Service (PaaS) offering that provides built-in high availability (99.99% SLA), automatic backups with point-in-time restore, and automatic patching of the database engine. It allows the development team to use their existing SQL Server skills without managing any virtual machines or operating systems, directly meeting the requirement to minimize administrative overhead.

Answer

Azure Cosmos DB

Answer

SQL Server on Azure Virtual Machines (IaaS)

Answer

Azure Database for PostgreSQL

Question 17

A company has deployed several Azure virtual machines in a virtual network. The security policy requires that administrators must be able to connect to these VMs using Remote Desktop Protocol (RDP) from the Azure portal, but the VMs must not have any public IP addresses assigned. The company wants to minimize management overhead and avoid deploying additional jump-box virtual machines. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure and seamless RDP/SSH connectivity to virtual machines directly from the Azure portal over TLS, without requiring public IP addresses on the VMs. It is a fully managed PaaS service that is deployed inside the virtual network, eliminating the need for a jump-box or additional management overhead. This meets the security policy by ensuring VMs remain isolated from the internet while administrators can still connect via the portal.

Answer

Azure Front Door

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Question 18

A company has an Azure subscription that contains hundreds of virtual machines (VMs) across multiple resource groups. The security team needs to enforce two governance rules: 1) All VMs must use managed disks. 2) All VMs must be deployed only in the East US region. The team wants to assign a single governance artifact that combines both rules so that the compliance state is evaluated as a group. The solution must not require assigning each rule individually. Which Azure feature should the team use to define and assign this combined set of rules?

Accepted Answer

Azure Policy initiative (policy set) definition. Azure Policy initiative (policy set) definitions allow you to group multiple individual policy definitions into a single, combined set of rules. By assigning the initiative, both the managed disks requirement and the East US region restriction are evaluated together as a single compliance artifact, meeting the requirement to avoid assigning each rule individually.

Answer

Azure Policy group definition

Answer

Azure Blueprints artifact

Answer

Azure compliance bundle

Question 19

A company is evaluating moving its on-premises datacenter to Azure. The CFO points out that Microsoft purchases servers, networking equipment, and cooling systems in enormous quantities, enabling them to negotiate lower prices from hardware vendors. The company expects to benefit from these lower hardware costs as it migrates. Which cloud computing benefit does this scenario primarily describe?

Accepted Answer

Economies of scale. The scenario describes how Microsoft's massive purchasing power reduces per-unit costs for hardware like servers and cooling systems, which is the definition of economies of scale. This benefit is passed to customers through lower Azure service prices, not through any operational or architectural feature of the cloud itself.

Answer

Elasticity

Answer

High availability

Answer

Measured service

Question 20

A company is considering moving its IT infrastructure to the cloud. The CFO wants to understand the financial impact: instead of purchasing servers and paying for maintenance, the company will pay a monthly fee based on usage. This shift represents moving from which type of expenditure to which?

Accepted Answer

From capital expenditure (CapEx) to operational expenditure (OpEx). This shift represents moving from capital expenditure (CapEx) to operational expenditure (OpEx). CapEx involves upfront costs for physical assets like servers, which depreciate over time, while OpEx involves ongoing, usage-based payments for cloud services. In Azure, this aligns with the consumption-based model where you pay only for resources consumed (e.g., VM hours, storage GBs), eliminating large initial investments and shifting financial risk to the provider.

Answer

From operational expenditure (OpEx) to capital expenditure (CapEx)

Answer

From direct expenditure to indirect expenditure

Answer

From variable expenditure to fixed expenditure