AZ-900 Practice Exam 52 — 20 Questions

Question 1

Which Azure feature can be used to prevent Azure resources in a subscription from being moved to a different resource group?

Accepted Answer

Azure Resource Locks (ReadOnly). Azure Resource Locks can prevent resources from being modified or deleted. A CanNotDelete lock prevents deletion. A ReadOnly lock prevents both modification and deletion — including moving a resource to a different resource group (which is considered a modification operation). Locks are inherited by child resources.

Answer

Azure Policy deny effect for resource moves

Answer

Azure RBAC without 'move' permissions

Answer

Azure Subscription spending limits

Question 2

What does 'reliability' mean as a cloud benefit?

Accepted Answer

The platform is designed for consistent performance and rapid recovery from failures. Reliability in cloud computing means the platform is designed for high uptime and rapid recovery from failures. Azure achieves reliability through redundant infrastructure, global distribution, automatic failover, and SLAs that commit to specific uptime percentages.

Answer

The cloud is always 100% available with no interruptions ever

Answer

All data is automatically backed up to multiple locations daily

Answer

Security vulnerabilities are never present in cloud services

Question 3

Which of the following BEST describes the concept of 'security' as a cloud benefit?

Accepted Answer

Cloud providers invest in extensive security teams and technologies that most organizations can't match. Cloud providers like Microsoft invest heavily in physical and digital security — building teams of security experts, applying the latest threat intelligence, and maintaining compliance certifications. Most organizations cannot match this investment on-premises, making cloud security a net benefit for many customers.

Answer

Cloud is inherently insecure because data is shared with other customers

Answer

Moving to cloud automatically makes you compliant with all regulations

Answer

Cloud security means you never need to patch your applications

Question 4

Match each Azure support plan to its key feature.

Accepted Answer

Developer: Tailored for non-production environments, includes email support during business hours.. Azure support plans: Basic is free and provides community support only (no technical support). The statement 'Billed monthly' is incorrect; Basic is included free with Azure subscription. Developer provides email support for non-production. Standard provides phone/email with 1-hour critical response. Professional Direct provides proactive guidance and 15-minute critical response.

Answer

Basic: Billed monthly with access to community forums and no technical support.

Answer

Basic: Provides phone support and 1-hour response time.

Answer

Standard: For non-production environments with community support only.

Question 5

Match each Azure compute option to its description.

Accepted Answer

Azure Virtual Machines: Provides full control over the operating system and allows custom software installations. Azure Virtual Machines provide IaaS with full OS control; Azure App Service is a PaaS for web apps; Azure Functions is serverless compute. Common confusions involve swapping definitions between IaaS, PaaS, and serverless services.

Answer

Azure Virtual Machines: A serverless compute service for running code on demand

Answer

Azure App Service: Provides full control over the virtual machine including OS updates

Answer

Azure Functions: A fully managed platform for building web applications

Question 6

An Azure service guarantees 99.95% uptime for virtual machines deployed with two or more instances in an availability set. If the monthly uptime falls below this percentage, customers can receive a service credit. What does this guarantee represent?

Accepted Answer

Service Level Agreement (SLA). This guarantee is a Service Level Agreement (SLA) because it is a formal, published commitment from Microsoft regarding the uptime percentage (99.95%) for a specific Azure service (Virtual Machines in an Availability Set), and it includes a financial remedy (service credits) if the commitment is not met. SLAs are contractual agreements that define the level of service a customer can expect and the compensation for failures.

Answer

Service Level Objective (SLO)

Answer

Service Level Indicator (SLI)

Answer

Service Health

Question 7

A startup wants to avoid managing physical servers and instead focus on developing their application. Which cloud service model provides them with the most control over the operating system and applications while still not managing hardware?

Accepted Answer

Infrastructure as a Service (IaaS). Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet, giving the startup full control over the operating system, storage, and deployed applications without managing the underlying physical hardware. This model is ideal for a startup that wants to avoid hardware maintenance while retaining the flexibility to configure and manage their own OS and application stack.

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Answer

Functions as a Service (FaaS)

Question 8

Which Azure networking feature allows you to filter outbound internet traffic from Azure VMs using a managed cloud firewall?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It is a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability, allowing you to centrally create, enforce, and log application and network connectivity policies across subscriptions and virtual networks. Specifically, it can filter outbound internet traffic from Azure VMs by inspecting traffic at Layers 3-7 of the OSI model, which is precisely what the question asks for.

Answer

Azure DDoS Protection

Answer

Network Security Groups (outbound rules)

Answer

Azure Web Application Firewall

Question 9

A company has an Azure subscription with 200 virtual machines. The compliance team requires that all virtual machines have diagnostic settings enabled to send metrics and logs to a central Log Analytics workspace. The team wants Azure to automatically configure these diagnostic settings on any VM that currently lacks them, without manual intervention. Which Azure Policy effect should the team use in the policy definition?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it automatically deploys a diagnostic settings configuration to any VM that lacks it, ensuring compliance without manual intervention. This effect evaluates resources and, if they do not meet the condition (missing diagnostic settings), triggers a deployment to remediate them. Audit only logs non-compliance without fixing it, and Deny blocks non-compliant creation but does not remediate existing VMs.

Answer

Audit

Answer

Deny

Answer

Modify

Question 10

A startup frequently deploys identical environments for development, testing, and production. They want to ensure all deployments are consistent and follow best practices without manual configuration. They need a declarative JSON-based method to define the entire infrastructure (virtual machines, databases, networking) so that the same template can be reused across environments. Which Azure service should the startup use?

Accepted Answer

Azure Resource Manager templates. Azure Resource Manager (ARM) templates are the correct choice because they provide a declarative JSON-based syntax to define and deploy entire Azure infrastructures consistently. This allows the startup to reuse the same template across development, testing, and production environments, ensuring identical configurations without manual intervention. ARM templates also enforce idempotent deployments, meaning the same template can be applied repeatedly to achieve the same state.

Answer

Azure PowerShell scripts

Answer

Azure CLI commands

Answer

Azure Blueprints

Question 11

What is the key difference between capital expenditure (CapEx) and operational expenditure (OpEx) in the context of cloud computing?

Accepted Answer

CapEx is upfront investment in owned infrastructure; OpEx is ongoing pay-as-you-go service costs. Capital expenditure (CapEx) involves a large upfront investment to purchase and own physical infrastructure (servers, storage, networking), while operational expenditure (OpEx) represents ongoing, consumption-based costs where you pay only for the resources you use (e.g., per-hour VM billing, per-GB storage fees). In cloud computing, the shift from CapEx to OpEx is a fundamental financial model change, enabling organizations to avoid large capital outlays and instead align costs with actual usage.

Answer

CapEx is for cloud spending; OpEx is for on-premises spending

Answer

CapEx and OpEx are identical in cloud environments

Answer

OpEx covers hardware costs; CapEx covers software licensing costs

Question 12

A company runs a web application on two Azure virtual machines (VMs) in different availability zones within the same region. The application maintains user session state in memory on the VMs. The company needs a load balancing solution that distributes incoming HTTP requests across both VMs, ensures all requests from a specific user session are routed to the same VM (session persistence), and terminates SSL/TLS to offload encryption from the VMs. Which Azure service should the company use?

Accepted Answer

Azure Application Gateway v2. Azure Application Gateway v2 is a layer-7 load balancer that supports HTTP/HTTPS traffic, SSL/TLS termination, and session persistence (sticky sessions) via cookie-based affinity. This makes it the correct choice for distributing HTTP requests across VMs in different availability zones while maintaining user session state and offloading encryption.

Answer

Azure Load Balancer (Standard)

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 13

Which Azure cost management practice helps identify which teams or projects are consuming Azure resources through cost allocation?

Accepted Answer

Cost allocation using tags and cost allocation rules. Azure cost allocation uses tags and cost allocation rules to attribute resource consumption to specific teams, projects, or cost centers. By applying metadata tags (e.g., 'Department: Sales' or 'Project: Alpha') to resources and defining allocation rules in Cost Management, you can split shared costs and track spending per business unit. This directly answers the question of identifying which teams or projects are consuming resources.

Answer

Azure Reservations

Answer

Azure Advisor efficiency recommendations

Answer

Azure Budgets and alerts

Question 14

A company has deployed several Azure virtual machines that host a critical internal application. The IT team needs to provide secure remote desktop access to these VMs for system administrators without assigning public IP addresses to the VMs or maintaining a VPN connection. The solution must provide seamless, browser-based RDP connectivity using SSL. Which Azure service should the IT team use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure virtual machines directly from the Azure portal over SSL, without requiring public IP addresses on the VMs or a VPN connection. It uses a hardened bastion host deployed inside the same virtual network, proxying traffic via TLS on port 443, which satisfies the requirement for browser-based, secure remote access.

Answer

Azure Front Door

Answer

Azure Application Gateway

Answer

Azure Virtual Network NAT

Question 15

A company wants to ensure that no one can create virtual machines without approval from the IT department. They want to block all VM creation attempts and notify the requester that they need to request access. Which Azure Policy effect should they use?

Accepted Answer

Deny. The Deny effect is correct because it actively prevents the creation of virtual machines by blocking the resource creation request at the Azure Resource Manager level. When a policy with the Deny effect is assigned, any attempt to create a VM that does not meet the policy's conditions is rejected with a 403 (Forbidden) status code, and the requester receives an error message indicating the policy violation and the need to request access. This directly enforces the requirement to block all VM creation attempts without requiring manual intervention.

Answer

Audit

Answer

Append

Answer

Disabled

Question 16

Which Azure RBAC role allows a user to manage all Azure resources but cannot grant access to others?

Accepted Answer

Contributor. The Contributor role in Azure RBAC grants full management access to all Azure resources, including the ability to create, modify, and delete them, but explicitly denies the ability to assign roles to other users. This makes it the correct answer because the question specifies a user who can manage all resources but cannot grant access to others.

Answer

Owner

Answer

Reader

Answer

User Access Administrator

Question 17

What does the Azure SLA for a storage account guarantee?

Accepted Answer

The percentage of time the storage service is available for read/write requests. The Azure SLA for a storage account guarantees a specific percentage of uptime (e.g., 99.9% for Standard tier) during which the service is available to process read and write requests. This is a commitment to availability, not to data durability, performance, or financial compensation for all causes. The SLA defines the maximum allowed downtime per month and is measured against the service's ability to respond to authenticated requests.

Answer

That data will never be lost under any circumstances

Answer

That data will be retrieved within 5 milliseconds

Answer

That Microsoft will pay for all downtime regardless of the cause

Question 18

A company plans to run a large-scale batch processing job on Azure that runs for 10 hours every night. The job is fault-tolerant and can be interrupted. They want to minimize cost as much as possible. Which Azure virtual machine pricing option should they use?

Accepted Answer

Spot VMs. Spot VMs allow you to use unused Azure compute capacity at a significant discount (up to 90% compared to pay-as-you-go). Because the batch job is fault-tolerant and can be interrupted, it is an ideal workload for Spot VMs, which can be evicted when Azure needs the capacity back. This minimizes cost while meeting the job's requirements.

Answer

Reserved Instances

Answer

Pay-as-you-go

Answer

Dedicated Hosts

Question 19

A large enterprise manages hundreds of Azure subscriptions. The central governance team wants to ensure that every resource deployed across all subscriptions always has two required tags: 'Department' and 'CostCenter'. If a resource is created without these tags, the governance policy must automatically add the missing tags with placeholder values (e.g., 'Department: Unknown') and generate a compliance report. The team does not want to rely on user training or manual audits. Which Azure service should the team use to meet these requirements?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it can enforce tagging rules across all subscriptions in a management group. By using a policy definition with the 'modify' effect, Azure Policy can automatically add missing tags with placeholder values (e.g., 'Department: Unknown') during resource creation or at scale via remediation tasks. It also integrates with Azure Policy compliance reports to provide continuous governance without relying on user training or manual audits.

Answer

Azure Cost Management

Answer

Azure Blueprints

Answer

Azure Resource Groups

Question 20

A company migrates its on-premises SQL Server database to Azure SQL Database. The company's security team is concerned about who is responsible for applying security updates to the operating system that hosts the database engine. According to the shared responsibility model for cloud computing, who is responsible for patching the operating system of the underlying host?

Accepted Answer

Microsoft (Azure). In the shared responsibility model for Azure SQL Database, Microsoft is responsible for the underlying infrastructure, including the operating system that hosts the database engine. Azure SQL Database is a Platform as a Service (PaaS) offering, where Microsoft manages the host OS, applies security patches, and ensures the physical and virtual environment is secure. The customer is only responsible for data, access management, and database-level configurations.

Answer

The company (customer)

Answer

Both the company and Microsoft share this responsibility

Answer

A third-party managed service provider