AZ-900 Practice Exam 54 — 20 Questions

Question 1

A company runs a critical transaction processing application on two Azure virtual machines. The infrastructure is designed so that if one virtual machine encounters a hardware failure and stops functioning, the other virtual machine continues to serve traffic without any interruption or loss of service. Which cloud computing characteristic does this design primarily address?

Accepted Answer

Fault tolerance. The design ensures that if one virtual machine fails due to a hardware failure, the other continues serving traffic without any interruption or loss of service. This is the definition of fault tolerance, which eliminates any single point of failure and maintains continuous operation even when a component fails. High availability reduces downtime but may allow brief interruptions during failover, whereas fault tolerance guarantees zero interruption.

Answer

High availability

Answer

Disaster recovery

Answer

Scalability

Question 2

A company uses Azure Policy to enforce governance rules across its subscriptions. The governance team wants to ensure that every resource in the 'Production' subscription has a tag named 'Environment' with the value 'Production'. If a resource is created without this tag, or with a different value, the tag must be automatically corrected to 'Production' without blocking the creation of the resource. Which Azure Policy effect should the team configure?

Accepted Answer

Modify. The Modify effect is correct because it automatically applies the required tag value to resources during creation or update without blocking the operation. Unlike Append, which only adds tags to new resources but cannot change existing values, Modify can alter both new and existing resources to enforce the desired tag value. This ensures that any resource created without the 'Environment' tag or with a different value is automatically corrected to 'Production'.

Answer

Deny

Answer

Audit

Answer

Append

Question 3

A retail company runs an e-commerce application on Azure virtual machines. Traffic follows a predictable daily pattern: peak load occurs from 9 AM to 5 PM on weekdays. To handle this, the company configures an Azure autoscale rule that adds virtual machines at 8:30 AM and removes them at 5:30 PM each weekday. This scenario best demonstrates which cloud computing characteristic?

Accepted Answer

Elasticity. Elasticity is the ability to dynamically scale resources up or down to match demand. In this scenario, the autoscale rule adds VMs at 8:30 AM to handle the predictable peak load and removes them at 5:30 PM, demonstrating automatic resource provisioning and de-provisioning based on a schedule. This is a textbook example of elasticity in cloud computing.

Answer

High availability

Answer

Agility

Answer

Fault tolerance

Question 4

An IT administrator needs to query all Azure resources across multiple subscriptions to find all virtual machines that were created in the last 30 days. They want to use a powerful query language. Which Azure service should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct service because it provides a powerful, Kusto Query Language (KQL)-based query engine that can efficiently explore and query Azure resources across multiple subscriptions, resource groups, and locations. It is specifically designed for resource discovery and inventory scenarios, such as finding all virtual machines created in the last 30 days, by filtering on properties like `createdTime`.

Answer

Azure Monitor

Answer

Azure Resource Manager

Answer

Azure CLI

Question 5

A developer is building a serverless application that requires integration with an on-premises SQL Server database for real-time data processing. The on-premises network is connected to Azure via a site-to-site VPN. Which Azure service would allow the function to securely access the on-premises database without exposing it to the public internet?

Accepted Answer

Azure Functions in Premium plan with VNet integration. Option B is correct because Azure Functions in the Premium plan supports VNet integration, allowing the function to securely access resources in a connected on-premises network via a site-to-site VPN without exposing the database to the public internet. The Consumption plan lacks VNet integration, and Azure SQL Database is a PaaS service, not a compute service for running serverless code.

Answer

Azure Functions in Consumption plan

Answer

Azure SQL Database

Answer

Hybrid Connections

Question 6

A solutions architect is designing a storage solution for a large media company. The company needs to store video files that are accessed infrequently but must be retained for several years for compliance. Which two Azure storage options meet these requirements? (Select two.)

Accepted Answer

Blob Storage - Cool tier. Blob Storage Cool tier is correct because it is designed for data that is accessed infrequently but needs to be stored for at least 30 days, offering lower storage costs than the Hot tier while maintaining low-latency access. Blob Storage Archive tier is correct because it is the lowest-cost storage option for data that is rarely accessed and has a flexible retrieval time (hours), making it ideal for long-term compliance retention of video files.

Answer

Blob Storage - Hot tier

Answer

Azure Files - Premium tier

Question 7

A company wants to enforce a set of security policies across all their Azure subscriptions. They have created several individual policy definitions. Which Azure construct should they use to group these policies together and assign them as a single package?

Accepted Answer

Policy Initiative. A Policy Initiative (also known as a policy set) in Azure allows you to group multiple individual policy definitions into a single package. This enables you to assign the entire set of security policies together across subscriptions, ensuring consistent enforcement. It simplifies management by applying a collection of related policies as one unit.

Answer

Azure Blueprint

Answer

Management Group

Answer

Resource Group

Question 8

A company has an Azure tenant with a management group hierarchy. The 'Production' management group contains five subscriptions used by the operations team. The IT security team wants to grant the 'Network Contributor' role to a group of network administrators for all subscriptions under the 'Production' management group. The role assignment must automatically apply to any new subscription added under the 'Production' management group in the future. The network administrators already exist as a security group in Azure AD. What is the most efficient way to achieve this?

Accepted Answer

Assign the 'Network Contributor' role to the security group at the 'Production' management group scope.. Assigning the 'Network Contributor' role at the 'Production' management group scope is the most efficient method because management groups provide a hierarchical scope that automatically inherits role assignments to all child subscriptions, including any new subscriptions added in the future. This eliminates the need for manual assignments per subscription and ensures consistent access control across the entire management group hierarchy.

Answer

Assign the 'Network Contributor' role at the scope of each existing subscription individually, and remember to assign it to new subscriptions manually.

Answer

Create an Azure Policy that assigns the 'Network Contributor' role to the security group for all subscriptions under 'Production'.

Answer

Assign the 'Network Contributor' role to the security group at the root management group scope.

Question 9

A company deploys a multi-tier application using Azure virtual machines. The web tier VMs must be evenly distributed across two distinct data centers within an Azure region to avoid a single point of failure from an infrastructure outage. Which Azure construct should they use to meet this requirement?

Accepted Answer

Availability zone. Availability zones are physically separate data centers within an Azure region, each with independent power, cooling, and networking. By deploying the web tier VMs across two distinct zones, the application avoids a single point of failure from an infrastructure outage at the data center level, meeting the requirement for high availability across distinct data centers.

Answer

Availability set

Answer

Proximity placement group

Answer

Azure Load Balancer

Question 10

A company deploys two Azure virtual machines in an availability set. The application requires that at least one VM remains running during Azure platform-initiated maintenance, such as operating system updates to the underlying host. Which component of the availability set directly ensures that the VMs are not updated at the same time?

Accepted Answer

Update domains. Update domains (B) are the correct component because they logically group VMs that are updated together during Azure platform-initiated maintenance. By placing VMs in different update domains, Azure ensures that only one update domain is taken offline at a time, guaranteeing that at least one VM remains running during host OS updates.

Answer

Fault domains

Answer

Proximity placement groups

Answer

Availability zones

Question 11

A company deploys a line-of-business application on an Azure virtual machine. The IT team wants to ensure the application remains secure. According to the shared responsibility model, which of the following security tasks is the sole responsibility of the customer (the company)?

Accepted Answer

Configuring the network security group (NSG) rules to restrict inbound traffic to the virtual machine.. Option B is correct because configuring Network Security Group (NSG) rules to restrict inbound traffic is a customer responsibility under the shared responsibility model. The customer controls the virtual network and VM-level access, including defining allow/deny rules for protocols like TCP/UDP on specific ports. Azure manages the underlying infrastructure, but the customer must secure their own application traffic.

Answer

Protecting the physical servers in the Azure datacenter with video surveillance and access controls.

Answer

Ensuring the hypervisor that isolates virtual machines is free from vulnerabilities.

Answer

Maintaining the security of the Azure Fabric Controller that manages the host servers.

Question 12

A company develops a web API that runs on Azure App Service. The development team wants to deploy a new version of the API to a staging environment, run integration tests against it, and then gradually shift production traffic to the new version. If any issues are detected, they want to immediately roll back to the previous version without redeploying. Which Azure App Service feature should the team use to meet these requirements?

Accepted Answer

Deployment slots. Deployment slots are separate, live environments within Azure App Service that allow you to stage a new version of your web API, run integration tests against it, and then swap it into production with zero downtime. The swap operation also enables instant rollback by swapping back to the previous slot, which preserves the old version without requiring a redeployment.

Answer

Autoscale

Answer

Traffic Manager profiles

Answer

Application Insights

Question 13

A company deploys a critical application across two Azure regions for disaster recovery. They want to automatically failover traffic to the secondary region if the primary becomes unavailable. They also want to improve performance by routing users to the closest region. Which Azure service should they use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic optimally to services across global Azure regions. It supports the 'Priority' routing method for automatic failover to a secondary region when the primary is unavailable, and the 'Performance' routing method to direct users to the closest region for improved latency. This combination directly meets the stated requirements for disaster recovery failover and performance-based routing.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure VPN Gateway

Question 14

A company currently runs its application on-premises in a data center. The IT manager calculates that the cost per server per month is approximately $200 when considering hardware depreciation, electricity, cooling, and staff. The company is considering moving to Azure and discovers that Azure can provision the same server capacity for $150 per month, but only if the company commits to a three-year reservation. Which cloud concept best explains why Azure can offer a lower price even with the reservation commitment?

Accepted Answer

Economies of scale. Azure can offer a lower price for a three-year reserved instance because of economies of scale. Microsoft operates massive, globally distributed data centers that purchase hardware, power, and cooling in bulk, significantly reducing per-unit costs. This cost advantage is passed to customers who commit to longer-term reservations, as the provider can better predict and optimize resource utilization.

Answer

Rapid elasticity

Answer

High availability

Answer

Measured service

Question 15

A cloud provider uses virtualization technology to host multiple customers on the same physical server. Each customer's data, applications, and operating systems are logically isolated and secured from one another. Which characteristic of cloud computing does this scenario best describe?

Accepted Answer

Resource pooling. This scenario describes resource pooling, where the provider's computing resources (such as storage, memory, and network bandwidth) are pooled to serve multiple customers using a multi-tenant model. Virtualization technology creates isolated virtual machines for each tenant, ensuring logical separation of data and applications while sharing the same physical hardware. This is a core characteristic of cloud computing as defined by NIST SP 800-145.

Answer

Rapid elasticity

Answer

Measured service

Answer

On-demand self-service

Question 16

A company has a policy that all Azure resources deployed to production subscriptions must be tagged with a 'CostCenter' tag. They want to automatically prevent the creation of any resource that does not include this tag. Which Azure Policy effect should they use in their policy definition?

Accepted Answer

Deny. The Deny effect is correct because it actively prevents the creation or deployment of any Azure resource that does not comply with the policy rule, such as missing the required 'CostCenter' tag. Unlike Audit, which only logs compliance violations without blocking the operation, Deny enforces the policy at the time of the resource creation request, ensuring non-compliant resources are never provisioned.

Answer

Audit

Answer

DeployIfNotExists

Answer

Modify

Question 17

A company has a policy that all Azure resources must have a tag named 'CostCenter'. The governance team wants to automatically add the tag with a default value 'IT' to any new resource that is created without it. The team wants the tag to be applied during resource creation, not just report non-compliance. The solution must also support remediation for existing non-compliant resources if needed later. Which Azure Policy effect should the team use in their policy definition?

Accepted Answer

Modify. The Modify effect is correct because it can automatically add or change tags on resources during creation or update, enforcing compliance in real-time. Unlike Append, Modify supports both creation and remediation of existing resources, and unlike DeployIfNotExists, it directly alters the resource properties without deploying a separate remediation task.

Answer

Append

Answer

DeployIfNotExists

Answer

Audit

Question 18

A company deploys a mission-critical application across three Azure availability zones. The application is designed to continue operating without any interruption if an entire availability zone becomes unavailable. Which cloud computing characteristic does this scenario best illustrate?

Accepted Answer

Fault tolerance. B is correct because fault tolerance is the ability of a system to continue operating without any interruption when a component fails. Deploying a mission-critical application across three Azure availability zones ensures that if an entire zone goes down, the application remains operational with zero downtime, which is the defining characteristic of fault tolerance.

Answer

Elasticity

Answer

High availability

Answer

Scalability

Question 19

A company has a regulatory requirement that all Azure resources must be deployed only in the West Europe region. The governance team needs to automatically prevent any user or application from creating resources in any other region. The team must also ensure that this restriction is applied to all existing and future subscriptions within the tenant. Which Azure service should the governance team use?

Accepted Answer

Azure Policy. Azure Policy is correct because it enforces organizational standards by evaluating resources for compliance with defined rules, such as restricting allowed regions. By creating a policy definition that denies resource creation outside West Europe and assigning it at the management group scope, the restriction applies to all existing and future subscriptions within the tenant automatically.

Answer

Azure Blueprints

Answer

Management Groups

Answer

Azure Role-Based Access Control (RBAC)

Question 20

A company has a policy that all Azure resources must have a 'CostCenter' tag. They want to automatically audit and deny the creation of any resource that does not include this tag. Which Azure Policy effect should they use?

Accepted Answer

Deny. The 'Deny' effect is correct because the company's policy requires that any resource creation attempt missing the 'CostCenter' tag must be blocked entirely, not just reported or modified. Azure Policy's Deny effect actively prevents the resource from being provisioned by rejecting the API call at the Azure Resource Manager level, ensuring non-compliant resources are never created.

Answer

Audit

Answer

Append

Answer

DeployIfNotExists