AZ-900 Practice Exam 53 — 20 Questions

Question 1

A company migrates its on-premises infrastructure to Azure. The IT manager notes that Azure dynamically allocates and reallocates compute and storage resources across multiple customers based on demand, while ensuring each customer's data and workloads remain isolated from others. Which cloud computing characteristic does this describe?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Resource pooling. Resource pooling is the cloud computing characteristic where the provider's computing resources are pooled to serve multiple customers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to demand. This ensures each customer's data and workloads remain isolated while the provider can efficiently allocate compute and storage across tenants. The scenario directly describes this multi-tenant isolation and dynamic allocation, which is the essence of resource pooling.

Answer

Rapid elasticity

Answer

Measured service

Answer

On-demand self-service

Question 2

Which Azure service enables you to securely connect remote users to Azure and on-premises resources using an SSL-based VPN?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway supports site-to-site, point-to-site, and VNet-to-VNet connections. Point-to-site (P2S) VPN uses SSTP (Secure Socket Tunneling Protocol) or IKEv2 VPN, and when configured with SSTP, it provides an SSL-based VPN tunnel (TCP port 443) that allows remote users to securely connect to Azure and on-premises resources through the gateway.

Answer

Azure ExpressRoute

Answer

Azure Bastion

Answer

Azure Application Gateway

Question 3

A company needs to store large amounts of unstructured data, such as images and videos, for a web application. They need to access data from anywhere via HTTP/HTTPS. Which Azure storage service should they use?

Accepted Answer

A) Azure Blob Storage. Azure Blob Storage is designed for storing large amounts of unstructured data, such as images and videos, and provides REST-based access over HTTP/HTTPS from anywhere. It supports scalable object storage with global accessibility, making it ideal for web application content delivery.

Answer

B) Azure File Storage

Answer

C) Azure Queue Storage

Answer

D) Azure Table Storage

Question 4

Which Azure service provides a managed Apache Kafka-compatible event streaming service for ingesting millions of events per second?

Accepted Answer

Azure Event Hubs. Azure Event Hubs is a fully managed, real-time data ingestion service that is natively compatible with Apache Kafka, allowing you to use existing Kafka clients and tooling to stream millions of events per second. It provides a partitioned consumer model, high throughput, and low-latency event ingestion, making it the correct choice for a managed Kafka-compatible event streaming service.

Answer

Azure Service Bus

Answer

Azure Event Grid

Answer

Azure Queue Storage

Question 5

A company uses Azure to host multiple virtual machines and virtual networks. The network team is responsible for configuring and maintaining virtual networks, subnets, and network security groups. The company wants to ensure that the network team can manage these network resources but cannot modify or delete virtual machines. Which Azure built-in role should the company assign to the network team?

Accepted Answer

Network Contributor. The Network Contributor role grants full management permissions for network resources, including virtual networks, subnets, and network security groups, but does not allow modification or deletion of virtual machines. This aligns exactly with the requirement to restrict the network team to network resources only.

Answer

Owner

Answer

Contributor

Answer

Virtual Machine Contributor

Question 6

What is a key difference between vertical scaling and the benefit of cloud elasticity?

Accepted Answer

Vertical scaling resizes one resource while elasticity adds/removes instances automatically without downtime. Vertical scaling (scaling up) increases the capacity of a single resource, such as adding more RAM or CPU to a virtual machine, but it typically requires downtime to apply the changes. Cloud elasticity, on the other hand, automatically adds or removes instances (horizontal scaling) based on demand, often without downtime, enabling the system to handle variable workloads seamlessly. Option B correctly captures this distinction by contrasting the resizing of one resource with the automated, no-downtime addition or removal of instances.

Answer

Vertical scaling works faster than horizontal scaling

Answer

Vertical scaling is more cost-effective than elasticity for all workloads

Answer

Both vertical and horizontal scaling require manual intervention in cloud environments

Question 7

A startup company is developing a new mobile application. The development team needs to quickly create test environments to validate new features. They can provision virtual machines and databases in Azure within minutes, use them for a few hours, and then delete them when done. This ability to rapidly deploy and decommission resources directly supports which cloud computing benefit?

Accepted Answer

Agility. The scenario describes the ability to rapidly provision and decommission Azure resources like virtual machines and databases in minutes, use them for a few hours, and then delete them. This directly supports cloud agility, which is the cloud computing benefit that enables organizations to quickly adapt to changing requirements by deploying and releasing resources on demand. Agility is about speed and flexibility in resource management, not just scaling or metering.

Answer

Scalability

Answer

Elasticity

Answer

Measured service

Question 8

A company runs several Azure virtual machines (VMs) in a virtual network. Administrators need to connect to these VMs using Remote Desktop Protocol (RDP) to perform maintenance tasks. The security team mandates that the VMs must not have any public IP addresses assigned. All RDP traffic must be routed through a fully managed Azure service that provides secure TLS-based access directly from the Azure portal, without requiring any client software installation on the administrator's workstation. Which Azure service should the company use?

Accepted Answer

Azure Bastion. Azure Bastion is a fully managed Platform as a Service (PaaS) that provides secure and seamless RDP/SSH connectivity to virtual machines directly from the Azure portal over TLS. It eliminates the need for public IP addresses on the VMs by deploying a Bastion host in the same virtual network, acting as a jump server that brokers the connection. Because it requires no client software on the administrator's workstation and enforces TLS-based access, it perfectly meets the security mandate and connectivity requirements described.

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Answer

Azure Application Gateway

Question 9

A global software company hosts its SaaS product on Azure. Thousands of different customers' virtual machines and databases run on the same physical servers in Microsoft's data centers, yet each customer can only access their own resources and cannot see or interact with other customers' data. Which cloud computing characteristic does this scenario primarily describe?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because the scenario describes a multi-tenant architecture where Microsoft's Azure data centers use a shared physical infrastructure (servers, storage, network) to serve multiple customers. Each customer's VMs and databases are isolated via hypervisor-level virtualization and network segmentation, ensuring they cannot access each other's data. This pooling of resources to serve many customers, with dynamic assignment and reassignment of physical and virtual resources, is the defining characteristic of resource pooling as per the NIST definition of cloud computing.

Answer

Rapid elasticity

Answer

Measured service

Answer

On-demand self-service

Question 10

Which Azure service provides a dedicated, hardware-isolated physical server for hosting virtual machines to meet compliance and licensing requirements?

Accepted Answer

Azure Dedicated Host. Azure Dedicated Host provides a single-tenant, hardware-isolated physical server dedicated to your Azure subscription. This ensures that virtual machines run on a server that is not shared with any other customer, meeting strict compliance and licensing requirements such as those for Windows Server per-core licensing or SQL Server licensing that require dedicated hardware.

Answer

Azure Isolated VM sizes

Answer

Azure Reserved Instances

Answer

Azure Spot VMs

Question 11

Which Azure compliance feature allows organizations to understand which standards and regulations Azure services comply with?

Accepted Answer

Azure Compliance Documentation / Trust Center. Azure Compliance Documentation (often accessed via the Trust Center) provides detailed information about certifications, attestations, and regulatory standards that Azure services adhere to, such as ISO 27001, SOC 2, and GDPR. This is the dedicated resource for understanding which specific compliance frameworks Azure meets, rather than enforcing or monitoring compliance.

Answer

Azure Security Center

Answer

Azure Policy

Answer

Azure Blueprints

Question 12

What is a key characteristic of the public cloud model?

Accepted Answer

Resources are shared among multiple tenants over the internet. The public cloud model is defined by multi-tenancy, where computing resources such as virtual machines, storage, and networks are shared across multiple customers (tenants) over the internet. Microsoft Azure, AWS, and Google Cloud all operate on this principle, using hypervisor-level isolation to ensure each tenant's data and workloads remain separate. This shared infrastructure enables the cloud provider to achieve economies of scale, offering pay-as-you-go pricing and elastic scalability.

Answer

Resources are dedicated exclusively to one organization

Answer

Resources are always hosted on-premises

Answer

The organization owns all hardware

Question 13

Which of the following is NOT a benefit of moving to the cloud?

Accepted Answer

Elimination of internet connectivity requirements. Moving to the cloud does not eliminate the need for internet connectivity; in fact, cloud services are accessed over the internet or dedicated network connections. Option B is correct because it presents a false benefit—cloud computing still requires network connectivity to reach the provider's endpoints, and without it, resources become inaccessible. The other options are legitimate benefits: faster provisioning, global data center reach, and converting CapEx to OpEx.

Answer

Reduced time to provision new resources

Answer

Access to a global network of data centers

Answer

Conversion of capital expenses to operational expenses

Question 14

Which Azure tool helps identify compliance issues by continuously evaluating your resource configurations against defined policies?

Accepted Answer

Azure Policy compliance dashboard. Azure Policy compliance dashboard is the correct answer because it provides a centralized view of the compliance state of your Azure resources against the defined policy assignments. It continuously evaluates resource configurations and displays which resources are compliant or non-compliant, allowing you to identify and remediate compliance issues proactively.

Answer

Azure Monitor

Answer

Azure Advisor

Answer

Azure Resource Graph

Question 15

A company deploys two Azure virtual machines (VMs) into the same availability set. The first VM runs a web server and the second runs a database server. The company's primary concern is that during Azure platform maintenance events (e.g., OS updates to the underlying host) or in the event of a hardware failure in the datacenter, both VMs should not be impacted at the same time. Which benefit does placing the VMs in the same availability set provide?

Accepted Answer

The VMs will be distributed across different fault domains and update domains within the datacenter.. An availability set ensures that VMs are distributed across different fault domains (separate power, cooling, and network racks) and update domains (groups that are updated sequentially during planned maintenance). This isolation guarantees that a hardware failure or a platform maintenance event will not affect both VMs simultaneously, meeting the company's primary concern.

Answer

Both VMs will be placed on the same physical server for performance consistency.

Answer

The VMs will be automatically load-balanced and scaled based on CPU usage.

Answer

The VMs will be replicated to a second Azure region for disaster recovery.

Question 16

Which Azure service enables automatic scaling of compute resources based on rules or schedules?

Accepted Answer

Azure Autoscale. Azure Autoscale is the native service that automatically adjusts the number of compute instances (e.g., Virtual Machines, App Service plans, or Cloud Services) based on predefined rules (e.g., CPU > 75%) or fixed schedules (e.g., scale out at 8 AM). It works by monitoring metrics via Azure Monitor and triggering scale operations to maintain performance and optimize cost.

Answer

Azure Elastic Pool

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Question 17

A company has a global web application deployed on Azure virtual machines in three separate Azure regions: West US, West Europe, and Southeast Asia. The application must automatically direct each user to the region that is geographically closest to the user's location in order to minimize latency. The solution must expose a single DNS name that does not change if regions are added or removed. The company does not need to offload SSL certificates or perform URL-based routing at the global level. Which Azure service should the company use to meet these requirements?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that can route users to the closest regional endpoint based on geographic location using the 'Performance' routing method. It exposes a single DNS name (e.g., myapp.trafficmanager.net) that remains constant even when endpoints are added or removed, and it does not require SSL offloading or URL-based routing, matching the requirements exactly.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 18

What does 'manageability' mean as a benefit of cloud computing?

Accepted Answer

The ability to manage cloud resources through portal, CLI, APIs, and automated monitoring. Manageability in cloud computing refers to the ability to efficiently administer and control cloud resources through multiple interfaces such as the Azure portal, command-line interface (CLI), APIs, and automated monitoring tools. This allows administrators to deploy, configure, update, and scale resources programmatically or via a web interface without needing physical access to hardware, enabling rapid changes and consistent management across large environments.

Answer

The ability to physically access and repair cloud hardware

Answer

The right to audit the cloud provider's security practices

Answer

The guarantee that resources will always be available

Question 19

A company stores a critical database in Azure Blob Storage. The data must remain available even if an entire Azure datacenter fails. The company uses the East US region, which supports availability zones. They want the lowest-cost storage redundancy option that protects against a full datacenter failure while keeping all data within the East US region. Which redundancy option should they choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) is the correct choice because it synchronously replicates data across three availability zones within the East US region, ensuring data remains accessible even if an entire datacenter (one zone) fails. This meets the requirement for intra-region protection against a full datacenter failure at the lowest cost, as ZRS does not incur the additional expense of geo-replication.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 20

Which Azure identity feature automatically assigns permissions when a user joins a specific group, and removes them when they leave?

Accepted Answer

Azure AD Dynamic Groups. Microsoft Entra ID Dynamic Groups automatically manage user membership based on rules defined using user or device attributes. When a user meets the rule criteria (e.g., department equals 'Sales'), they are added to the group and receive the associated permissions; when they no longer meet the criteria, they are removed, and permissions are revoked. This is the only Azure identity feature that directly ties group membership and permission assignment to attribute-based rules without manual intervention.

Answer

Azure AD Privileged Identity Management

Answer

Azure AD Conditional Access

Answer

Azure AD Identity Protection