AZ-900 Practice Exam 54 — 20 Questions

Question 1

Which Azure service provides intelligent threat protection across your Azure and hybrid environments by collecting and analyzing security data?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) is the correct answer because it provides unified security management and intelligent threat protection across Azure and hybrid environments. It continuously assesses the security posture of your resources, applies security recommendations, and collects and analyzes security data from various sources to detect and respond to threats. Azure Sentinel, while also a security service, is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration Automation and Response) solution that focuses on log aggregation and incident response, not the integrated workload protection and posture management that Defender for Cloud offers.

Answer

Azure Sentinel

Answer

Azure DDoS Protection

Answer

Azure Firewall

Question 2

A company hosts a web application on a single Azure virtual machine. Over the past month, the application's CPU utilization has consistently remained above 90%, causing slow response times. The administrator plans to modify the virtual machine's size from Standard_D2s_v3 (2 vCPUs) to Standard_D8s_v3 (8 vCPUs) to improve performance. Which scaling method does this change represent?

Accepted Answer

Vertical scaling (scaling up). Vertical scaling (scaling up) increases the power of an existing resource by upgrading its size or capacity. In this scenario, changing the virtual machine from Standard_D2s_v3 (2 vCPUs) to Standard_D8s_v3 (8 vCPUs) adds more CPU cores to the same VM, which is a classic example of scaling up. This approach improves performance without adding additional VM instances.

Answer

Horizontal scaling (scaling out)

Answer

Elastic scaling

Answer

Auto-scaling

Question 3

Which Azure service provides network address translation for outbound internet connectivity from private subnets without public IP addresses on individual resources?

Accepted Answer

Azure NAT Gateway. Azure NAT Gateway is the correct service because it is specifically designed to provide outbound internet connectivity for resources in private subnets without requiring public IP addresses on individual VMs. It uses source network address translation (SNAT) to map private IPs to a single public IP or prefix, enabling outbound traffic while preventing inbound connections from the internet.

Answer

Azure Load Balancer with outbound rules

Answer

Azure Firewall

Answer

Azure VPN Gateway

Question 4

A company runs a web application on Azure virtual machines. During a promotional event, the number of users increases significantly. To handle the increased load, the IT team adds five additional virtual machines to the existing pool, so that the total number of VMs increases from three to eight. Which type of scaling is the team using?

Accepted Answer

Horizontal scaling (scale out). Horizontal scaling (scale out) involves increasing the number of virtual machines (VMs) in a pool to distribute load, as seen when the team adds five VMs to go from three to eight. This approach improves capacity by adding more instances, rather than increasing the size of existing ones. In Azure, this is commonly achieved using Virtual Machine Scale Sets or Azure Load Balancer to distribute traffic across the expanded pool.

Answer

Vertical scaling (scale up)

Answer

Elasticity

Answer

High availability

Question 5

A company wants to segregate their Azure resources into logical groups based on department and environment. They also want to apply access control and management at these group levels. Which Azure construct should they use?

Accepted Answer

Resource groups. Resource groups are logical containers in Azure that allow you to group related resources (e.g., VMs, databases, storage) by department and environment. They enable you to apply access control via Azure RBAC and management policies (e.g., tags, locks) at the group level, ensuring consistent governance across all resources within the group.

Answer

Availability sets

Answer

Virtual networks

Answer

Subscriptions

Question 6

A company wants to receive proactive recommendations to reduce Azure costs, improve security, and increase reliability. They want a single dashboard that provides best practices for their deployed resources. Which Azure service should they use?

Accepted Answer

Azure Advisor. Azure Advisor is the correct service because it provides a personalized, consolidated dashboard of best-practice recommendations across cost optimization, security, reliability, operational excellence, and performance. It analyzes your deployed resources and proactively suggests actions such as resizing underutilized VMs, enabling geo-redundancy, or applying security policies, directly matching the company's need for proactive, single-pane-of-guidance.

Answer

Azure Cost Management + Billing

Answer

Azure Monitor

Answer

Azure Resource Graph

Question 7

Which Azure database service stores time-series data from IoT devices for long-term trend analysis and anomaly detection?

Accepted Answer

Azure Data Explorer. Azure Data Explorer (ADX) is a fully managed, high-performance big data analytics service optimized for interactive analysis of large volumes of time-series and log data. It uses the Kusto Query Language (KQL) to ingest, index, and query streaming telemetry from IoT devices, enabling long-term trend analysis and anomaly detection through built-in time-series functions like `series_decompose()` and `series_fit_line()`.

Answer

Azure Cosmos DB

Answer

Azure Table Storage

Answer

Azure SQL Database

Question 8

Which Azure service acts as a global load balancer that optimizes routing of user traffic to the nearest Azure endpoint for the best performance?

Accepted Answer

Azure Front Door. Azure Front Door is a global, scalable entry point that uses the Microsoft global edge network to route user traffic to the nearest available Azure endpoint based on latency and geographic proximity. It provides HTTP/HTTPS load balancing with advanced traffic acceleration, SSL offload, and application-layer security, making it the correct choice for optimizing performance across global regions.

Answer

Azure Application Gateway

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Question 9

What is the purpose of Azure Policy initiatives (policy sets)?

Accepted Answer

To group related policy definitions for assignment and management as a single unit. Azure Policy initiatives, also known as policy sets, allow you to group together multiple related policy definitions into a single, manageable unit. This simplifies assignment and management by enabling you to apply a collection of compliance rules (e.g., for security or cost control) to a scope as one entity, rather than assigning each policy individually.

Answer

To deploy a group of Azure resources as a single unit

Answer

To create hierarchical management of Azure subscriptions

Answer

To set spending limits across multiple resource groups

Question 10

How does cloud computing help with disaster recovery compared to traditional on-premises approaches?

Accepted Answer

Cloud enables geographic redundancy and automated failover at lower cost than traditional DR. Cloud computing supports disaster recovery by enabling geographic redundancy and automated failover across multiple Azure regions at a fraction of the cost of building and maintaining a secondary on-premises data center. Services like Azure Site Recovery and Azure Traffic Manager allow organizations to replicate workloads and automatically redirect traffic to a secondary region during an outage, reducing both recovery time objective (RTO) and recovery point objective (RPO) without the capital expenditure of a dedicated DR site.

Answer

Cloud eliminates the need for disaster recovery planning entirely

Answer

Cloud disaster recovery always provides faster recovery than on-premises DR

Answer

Cloud providers guarantee zero data loss in the event of a disaster

Question 11

A company wants to deploy a virtual machine in Azure and needs to ensure that the VM is placed in a location that provides the lowest network latency to its users in Europe. Which Azure construct should they consider to meet this requirement?

Accepted Answer

Azure region. Azure regions are geographically discrete data center groupings that provide low-latency connectivity to users within that region. By deploying the VM in a Europe-based region (e.g., West Europe or North Europe), the company ensures the shortest physical distance and network path to its European users, minimizing latency. Availability zones, resource groups, and management groups do not influence geographic placement or network latency.

Answer

Azure availability zone

Answer

Azure resource group

Answer

Azure management group

Question 12

Which Azure service provides a centralized console for monitoring the health, performance, and security of your entire Azure environment?

Accepted Answer

Azure Monitor. Azure Monitor is the correct answer because it provides a centralized, unified console for collecting, analyzing, and acting on telemetry data from your entire Azure environment. It covers health, performance, and security metrics, logs, and alerts across resources, enabling proactive monitoring and troubleshooting. Unlike specialized services, Azure Monitor aggregates data from multiple sources into a single pane of glass.

Answer

Azure Service Health

Answer

Microsoft Sentinel

Answer

Azure Security Center

Question 13

Which Azure service provides real-time monitoring and alerting for web application availability and performance from multiple global locations?

Accepted Answer

Application Insights Availability tests. Application Insights Availability tests (part of Azure Monitor) are specifically designed to monitor the availability and responsiveness of web applications from multiple geographically distributed locations. These tests simulate user requests from global points of presence and provide real-time alerts when an endpoint fails or responds slowly, making them the correct choice for this scenario.

Answer

Azure Traffic Manager health probes

Answer

Azure Monitor Action Groups

Answer

Azure Load Balancer health probes

Question 14

Which Azure service provides language understanding (NLU) capabilities to build applications that understand natural language commands?

Accepted Answer

Azure Cognitive Service for Language (LUIS). Azure Cognitive Service for Language (formerly LUIS) provides natural language understanding (NLU) capabilities, enabling applications to interpret user intent and extract entities from natural language commands. It is specifically designed to process conversational input and map it to structured data, making it the correct choice for building applications that understand natural language commands.

Answer

Azure Bot Service

Answer

Azure Speech Service

Answer

Azure Form Recognizer

Question 15

Which Azure service allows developers to build, train, and deploy machine learning models at scale using a managed cloud environment?

Accepted Answer

Azure Machine Learning. Azure Machine Learning is the correct service because it provides a fully managed cloud environment specifically designed for the end-to-end machine learning lifecycle, including building, training, and deploying models at scale. It offers capabilities like automated ML, pipeline orchestration, and integration with MLOps tools, which are not available in the other listed services.

Answer

Azure Cognitive Services

Answer

Azure Bot Service

Answer

Azure Databricks

Question 16

Which Azure service provides a managed platform for deploying and running microservices as containers without managing the Kubernetes control plane?

Accepted Answer

Azure Container Apps. Azure Container Apps is a fully managed serverless platform for deploying and running microservices as containers without requiring any management of the underlying Kubernetes control plane. It abstracts away Kubernetes orchestration, providing built-in autoscaling, ingress, and secrets management, making it ideal for event-driven or containerized microservices where operational overhead must be minimized.

Answer

Azure Kubernetes Service

Answer

Azure Container Instances

Answer

Azure App Service

Question 17

Which Azure portal feature enables you to create a customized view of the most important resources and metrics at a glance?

Accepted Answer

Azure Dashboards. Azure Dashboards allow you to create a personalized, tile-based view that can display a mix of Azure resources, metrics, and charts from different resource groups and subscriptions. This enables you to monitor the most critical data at a glance without navigating through multiple blades. The customization includes resizing, rearranging, and sharing dashboards with other team members.

Answer

Azure Advisor

Answer

Azure Resource Graph

Answer

Azure Policy compliance view

Question 18

A multinational corporation must ensure that every new Azure subscription automatically conforms to corporate security and compliance baselines. The team wants to deploy a predefined set of Azure resources (e.g., a central logging storage account, a network security group configuration) and apply a standard set of Azure Policy definitions (e.g., restricting allowed VM sizes, enforcing encryption) to any new subscription. They want to manage these as a single, versioned package that can be updated and re-assigned to existing subscriptions. Which Azure service should they use?

Accepted Answer

Azure Blueprints. Azure Blueprints is designed to package resource templates (ARM templates), policy assignments, role assignments, and resource groups into a single versioned artifact that can be assigned to subscriptions. It supports updating the blueprint and re-publishing versions, then re-assigning to existing subscriptions, which matches the requirement for a versioned, re-assignable governance package. Azure Policy alone cannot deploy resources, and ARM templates alone cannot bundle policy definitions with resource deployments in a managed, versioned way.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Manager templates

Question 19

Which Azure networking service provides a private connection from an on-premises network to Azure without using the public internet?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute is the correct answer because it establishes a dedicated, private connection from an on-premises network directly into Azure, bypassing the public internet entirely. This is achieved through a Layer 3 BGP peering session over a provider-managed circuit, ensuring low latency, higher reliability, and data does not traverse the public internet.

Answer

Azure VPN Gateway

Answer

Azure Virtual Network

Answer

Azure Bastion

Question 20

Which Azure service allows developers to store application configuration settings centrally and toggle feature flags?

Accepted Answer

Azure App Configuration. Azure App Configuration is a managed service specifically designed for centrally storing application configuration settings and feature flags. It provides a unified hub for managing configuration across multiple environments and applications, with built-in support for dynamic updates and feature management without redeploying code.

Answer

Azure Key Vault

Answer

Azure App Service settings

Answer

Azure Storage Table