AZ-900 Practice Exam 53 — 20 Questions

Question 1

Which Azure cloud benefit allows a company to avoid predicting exactly how much compute capacity it needs months in advance?

Accepted Answer

Elasticity. Elasticity is the Azure cloud benefit that allows a company to automatically scale compute resources up or down based on real-time demand, eliminating the need to predict capacity months in advance. With Azure Virtual Machine Scale Sets or Azure App Service auto-scale, resources can be added or removed dynamically, ensuring you only pay for what you use. This contrasts with traditional on-premises capacity planning, where over-provisioning or under-provisioning is common.

Answer

Fault tolerance

Answer

Geo-redundancy

Answer

Economies of scale

Question 2

A company plans to deploy a critical web application on Azure virtual machines in the West US region. The application must remain available if a single datacenter within that region experiences a complete outage. The company also requires the virtual machines to be connected to each other with low-latency network connectivity. Which Azure feature should the company use to deploy the virtual machines?

Accepted Answer

Availability Zone. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across two or more zones ensures that if one datacenter fails, the application remains available in another zone, while the VMs within the same region can still be connected via a low-latency virtual network.

Answer

Availability Set

Answer

Region Pair

Answer

Virtual Machine Scale Set

Question 3

A company's development team wants to deploy a containerized application without worrying about the underlying virtual machines or Kubernetes control plane. They need a service that automatically manages the container orchestration, scales, and provides rolling updates. Which Azure compute service should they choose?

Accepted Answer

Azure Kubernetes Service (AKS). Azure Kubernetes Service (AKS) is the correct choice because it provides a fully managed Kubernetes cluster, handling the control plane and worker node management, while allowing the development team to focus on deploying and managing containerized applications. AKS supports automatic scaling, rolling updates, and self-healing, meeting the requirement for a managed container orchestration service without worrying about underlying VMs or the Kubernetes control plane.

Answer

Azure Container Instances (ACI)

Answer

Azure Container Apps

Answer

Azure Service Fabric

Question 4

A company hosts a critical line-of-business application on Azure virtual machines. The application must remain available even if a single virtual machine fails due to hardware failure or operating system crash. The company deploys two virtual machines in an Availability Set and configures an Azure Load Balancer to distribute traffic. If one VM becomes unavailable, the Load Balancer automatically redirects traffic to the healthy VM. This configuration primarily demonstrates which benefit of cloud computing?

Accepted Answer

Reliability – ability to recover from failures and continue functioning. This configuration demonstrates reliability, a core cloud computing benefit, because the combination of an Availability Set and Azure Load Balancer ensures that the application remains operational even when a single VM fails due to hardware or OS issues. The Availability Set spreads VMs across fault domains and update domains to isolate failures, while the Load Balancer uses health probes to detect VM unavailability and redirect traffic only to healthy instances. This built-in redundancy and automatic failover capability directly aligns with the cloud's promise of high availability and fault tolerance.

Answer

Elasticity – ability to scale resources up and down

Answer

Security – protection against unauthorized access

Answer

Cost efficiency – paying only for consumed resources

Question 5

A company is deploying a mission-critical application on Azure virtual machines. The solution must remain operational even if a single Azure datacenter within a region experiences a complete outage. Which Azure feature should the company use to protect against this specific failure scenario?

Accepted Answer

Availability Zones. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By deploying the application across multiple zones, the solution remains operational if one entire datacenter fails, as the other zones continue to serve traffic. This directly addresses the requirement to survive a single datacenter outage within a region.

Answer

Region Pairs

Answer

Fault Domains

Answer

Resource Groups

Question 6

Which Azure service provides a managed relational database compatible with PostgreSQL?

Accepted Answer

Azure Database for PostgreSQL. Azure Database for PostgreSQL is a fully managed, enterprise-ready relational database service built on the open-source PostgreSQL engine. It provides built-in high availability, automated backups, and scaling, making it the correct choice for a managed PostgreSQL-compatible database in Azure.

Answer

Azure SQL Database

Answer

Azure Cosmos DB for PostgreSQL

Answer

Azure Database for MariaDB

Question 7

A company is adopting Azure and wants to ensure that every new subscription automatically includes a standard set of governance artifacts: two custom Azure Policy definitions (one for allowed locations, one for resource tagging), a custom Role-Based Access Control (RBAC) assignment for the security team, and an initial resource group with an Azure Resource Manager (ARM) template that sets up a network topology. The company wants to version these artifacts and update them over time, ensuring that new subscriptions always use the latest approved version. Which Azure service should the company use to package and deploy this standardized environment?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it is designed to orchestrate the deployment of a repeatable, versioned environment that includes policies, RBAC assignments, resource groups, and ARM templates. It allows you to define a blueprint with these artifacts, publish versions, and assign the latest approved version to new subscriptions, ensuring consistent governance across the organization.

Answer

Azure Management Groups

Answer

Azure Policy Initiatives

Answer

Azure Resource Manager (ARM) Templates

Question 8

A company runs an e-commerce application on multiple Azure virtual machines in a single region. The IT team needs to distribute incoming web traffic across the VMs, offload SSL/TLS termination to improve VM performance, and route requests based on URL path (for example, /images to one pool of VMs and /api to another). The solution must handle these requirements within a single Azure region. Which Azure service should the company use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a layer 7 load balancer that can distribute incoming web traffic based on URL path, offload SSL/TLS termination to reduce VM CPU overhead, and route requests to different backend pools (e.g., /images and /api) within a single Azure region. It supports HTTP/HTTPS traffic and provides Web Application Firewall (WAF) capabilities, making it the correct choice for this scenario.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Front Door

Question 9

A company has an Azure subscription used by multiple development teams. The security team wants to ensure that every virtual network (VNet) created in the subscription automatically has a specific network security group (NSG) associated with its default subnet. The NSG rules are defined by the security team, and developers should not have to perform any extra steps after creating a VNet. Which Azure Policy effect should the security team use in the policy definition?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it automatically deploys a specific NSG to the default subnet of any VNet that does not already have it, ensuring compliance without requiring developer intervention. This effect evaluates the resource after creation and triggers a deployment to remediate non-compliant states, aligning with the requirement for zero extra steps.

Answer

Deny

Answer

Audit

Answer

Append

Question 10

A company stores sensitive customer transaction records in Azure Blob Storage. The records must be available for read access at all times, even if the primary Azure region becomes unavailable. The company initially configured geo-redundant storage (GRS). During a disaster recovery test, the operations team discovers that although data is replicated to a secondary region, they cannot read the data from the secondary region until a Microsoft-initiated failover occurs. The team needs a solution that provides immediate, continuous read access to the replicated data in the secondary region without waiting for a failover. Which Azure Storage replication option should the company use?

Accepted Answer

Read-access geo-redundant storage (RA-GRS). RA-GRS extends GRS by enabling read access to the data in the secondary region at all times, without requiring a Microsoft-initiated failover. This ensures that the customer transaction records remain continuously readable from the secondary region, meeting the requirement for immediate read access during a primary region outage.

Answer

Locally-redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Question 11

A company hosts a public-facing web application on Azure Virtual Machines in two separate Azure regions for disaster recovery. The application's domain is managed by a third-party registrar. The company needs a solution that can route user traffic to the nearest healthy regional endpoint based on geographic location and provides automatic failover if an entire region becomes unavailable. The solution should not inspect or modify the HTTP traffic (no SSL termination or web application firewall). Which Azure service should the company use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming DNS requests to the nearest healthy regional endpoint based on geographic location or latency. It supports automatic failover by monitoring endpoint health and redirecting traffic if an entire region becomes unavailable, and it operates at the DNS level without inspecting or modifying HTTP traffic, so no SSL termination or web application firewall is involved.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 12

A company uses Azure Policy to govern its Azure environment. The governance team wants to enforce that all virtual machines (VMs) deployed in the production subscription use only approved operating system images from a specific Azure Compute Gallery. However, during a transition period, the team does not want to block the creation of VMs that use non-approved images; instead, they need to identify and report on any non-compliant VMs. They also want to track compliance over time. Which Azure Policy effect should the governance team use in the policy definition to meet these requirements?

Accepted Answer

Audit. The Audit effect is correct because it enables the governance team to identify and report non-compliant VMs without blocking their creation. Azure Policy's Audit effect logs a warning in the activity log for resources that violate the policy, allowing the team to track compliance over time via Azure Policy compliance reports and Azure Monitor, while the transition period remains unblocked.

Answer

Deny

Answer

Append

Answer

Modify

Question 13

A company wants to encrypt data at rest in Azure SQL Database using customer-managed keys stored in Azure Key Vault. They also need to be able to rotate the keys without downtime. Which feature should they use?

Accepted Answer

Transparent Data Encryption with customer-managed keys. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault allows you to encrypt the database at rest using your own keys, which you can rotate without downtime because Azure SQL Database handles the re-encryption of the database encryption key (DEK) transparently in the background, without requiring database offline or performance impact.

Answer

Always Encrypted

Answer

Dynamic Data Masking

Answer

Row-level security

Question 14

A company is migrating a customer-facing web application to Azure. The application requires a relational database with built-in high availability, automatic backups, and automatic patching of the database engine. The development team is familiar with SQL Server and wants to minimize administrative overhead. They do not want to manage virtual machines or operating systems. Which Azure database service should the team choose?

Accepted Answer

Azure SQL Database (PaaS). Azure SQL Database is a fully managed Platform-as-a-Service (PaaS) offering that provides built-in high availability (99.99% SLA), automatic backups with point-in-time restore, and automatic patching of the database engine. It allows the development team to use their existing SQL Server skills without managing any virtual machines or operating systems, directly meeting the requirement to minimize administrative overhead.

Answer

Azure Cosmos DB

Answer

SQL Server on Azure Virtual Machines (IaaS)

Answer

Azure Database for PostgreSQL

Question 15

A company has deployed several Azure virtual machines in a virtual network. The security policy requires that administrators must be able to connect to these VMs using Remote Desktop Protocol (RDP) from the Azure portal, but the VMs must not have any public IP addresses assigned. The company wants to minimize management overhead and avoid deploying additional jump-box virtual machines. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure and seamless RDP/SSH connectivity to virtual machines directly from the Azure portal over TLS, without requiring public IP addresses on the VMs. It is a fully managed PaaS service that is deployed inside the virtual network, eliminating the need for a jump-box or additional management overhead. This meets the security policy by ensuring VMs remain isolated from the internet while administrators can still connect via the portal.

Answer

Azure Front Door

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Question 16

A company has an Azure subscription that contains hundreds of virtual machines (VMs) across multiple resource groups. The security team needs to enforce two governance rules: 1) All VMs must use managed disks. 2) All VMs must be deployed only in the East US region. The team wants to assign a single governance artifact that combines both rules so that the compliance state is evaluated as a group. The solution must not require assigning each rule individually. Which Azure feature should the team use to define and assign this combined set of rules?

Accepted Answer

Azure Policy initiative (policy set) definition. Azure Policy initiative (policy set) definitions allow you to group multiple individual policy definitions into a single, combined set of rules. By assigning the initiative, both the managed disks requirement and the East US region restriction are evaluated together as a single compliance artifact, meeting the requirement to avoid assigning each rule individually.

Answer

Azure Policy group definition

Answer

Azure Blueprints artifact

Answer

Azure compliance bundle

Question 17

A company is evaluating moving its on-premises datacenter to Azure. The CFO points out that Microsoft purchases servers, networking equipment, and cooling systems in enormous quantities, enabling them to negotiate lower prices from hardware vendors. The company expects to benefit from these lower hardware costs as it migrates. Which cloud computing benefit does this scenario primarily describe?

Accepted Answer

Economies of scale. The scenario describes how Microsoft's massive purchasing power reduces per-unit costs for hardware like servers and cooling systems, which is the definition of economies of scale. This benefit is passed to customers through lower Azure service prices, not through any operational or architectural feature of the cloud itself.

Answer

Elasticity

Answer

High availability

Answer

Measured service

Question 18

A company is considering moving its IT infrastructure to the cloud. The CFO wants to understand the financial impact: instead of purchasing servers and paying for maintenance, the company will pay a monthly fee based on usage. This shift represents moving from which type of expenditure to which?

Accepted Answer

From capital expenditure (CapEx) to operational expenditure (OpEx). This shift represents moving from capital expenditure (CapEx) to operational expenditure (OpEx). CapEx involves upfront costs for physical assets like servers, which depreciate over time, while OpEx involves ongoing, usage-based payments for cloud services. In Azure, this aligns with the consumption-based model where you pay only for resources consumed (e.g., VM hours, storage GBs), eliminating large initial investments and shifting financial risk to the provider.

Answer

From operational expenditure (OpEx) to capital expenditure (CapEx)

Answer

From direct expenditure to indirect expenditure

Answer

From variable expenditure to fixed expenditure

Question 19

A company migrates its on-premises infrastructure to Azure. The IT manager notes that Azure dynamically allocates and reallocates compute and storage resources across multiple customers based on demand, while ensuring each customer's data and workloads remain isolated from others. Which cloud computing characteristic does this describe?

Accepted Answer

Resource pooling. Resource pooling is the cloud computing characteristic where the provider's computing resources are pooled to serve multiple customers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to demand. This ensures each customer's data and workloads remain isolated while the provider can efficiently allocate compute and storage across tenants. The scenario directly describes this multi-tenant isolation and dynamic allocation, which is the essence of resource pooling.

Answer

Rapid elasticity

Answer

Measured service

Answer

On-demand self-service

Question 20

Which Azure service enables you to securely connect remote users to Azure and on-premises resources using an SSL-based VPN?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway supports site-to-site, point-to-site, and VNet-to-VNet connections. Point-to-site (P2S) VPN uses SSTP (Secure Socket Tunneling Protocol) or IKEv2 VPN, and when configured with SSTP, it provides an SSL-based VPN tunnel (TCP port 443) that allows remote users to securely connect to Azure and on-premises resources through the gateway.

Answer

Azure ExpressRoute

Answer

Azure Bastion

Answer

Azure Application Gateway