AZ-900 Practice Exam 55 — 20 Questions

Question 1

Which Azure database service provides a fully managed MariaDB database in the cloud?

Accepted Answer

Azure Database for MariaDB. Azure Database for MariaDB is the correct answer because it is the specific Azure service designed to provide a fully managed, enterprise-ready MariaDB database in the cloud. MariaDB is a community-developed fork of MySQL, and Azure offers a dedicated managed service for it, including built-in high availability, automated backups, and scaling, without requiring you to manage the underlying infrastructure.

Answer

Azure Database for MySQL

Answer

Azure SQL Database

Answer

Azure Database for PostgreSQL

Question 2

Which Azure service provides code repository hosting with features like pull requests, code review, and branch protection?

Accepted Answer

Azure Repos. Azure Repos is the correct answer because it provides Git-based code repository hosting with full support for pull requests, code review workflows, and branch protection policies. These features enable teams to collaborate on code changes, enforce quality gates, and prevent direct pushes to critical branches.

Answer

Azure Artifacts

Answer

Azure Pipelines

Answer

Azure Boards

Question 3

Which Azure feature provides Just-In-Time (JIT) VM access to reduce the attack surface of management ports?

Accepted Answer

JIT VM Access in Microsoft Defender for Cloud. Just-In-Time (JIT) VM access in Microsoft Defender for Cloud reduces the attack surface by locking down inbound traffic to VMs, only opening management ports (e.g., RDP port 3389 or SSH port 22) when requested and for a specific time window. This is the correct feature because it directly implements JIT access to management ports, as described in the question.

Answer

Azure Bastion

Answer

Azure AD Privileged Identity Management

Answer

Azure Key Vault Certificate access

Question 4

A company has multiple Azure subscriptions for different departments. The IT team wants to ensure that all resources in a specific subscription are only deployed in the 'West Europe' region. Which Azure feature should they use to enforce this restriction?

Accepted Answer

Azure Policy. Azure Policy is correct because it allows you to create, assign, and manage policies that enforce specific rules or effects on your resources. By defining a policy that restricts allowed locations to 'West Europe' and assigning it to the subscription scope, Azure Policy will deny or audit any resource deployment that does not comply with this geographic restriction.

Answer

Azure RBAC

Answer

Azure Blueprints

Answer

Azure Resource Graph

Question 5

A company runs multiple virtual machines (VMs) in Azure. The IT team notices that their VMs are hosted on physical hardware that is shared among multiple customers. The team has no ability to specify or control which physical server their VMs run on, and they cannot see the underlying hardware details. The VMs are, however, always available when requested. This scenario exemplifies which essential characteristic of cloud computing as defined by the National Institute of Standards and Technology (NIST)?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because the scenario describes the cloud provider's ability to serve multiple customers from the same physical hardware, with the customer having no control or knowledge of the exact underlying server. This is a core NIST characteristic where computing resources (including storage, processing, memory, and network bandwidth) are pooled to serve multiple consumers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to consumer demand. The fact that VMs are always available when requested further aligns with the elasticity and on-demand nature of resource pooling, but the key is the shared, abstracted infrastructure.

Answer

On-demand self-service

Answer

Broad network access

Answer

Rapid elasticity

Question 6

Which Azure service provides a way to run Windows-based desktop applications from any device without installing them locally?

Accepted Answer

Azure Virtual Desktop. Azure Virtual Desktop (AVD) is a desktop and app virtualization service that runs on Azure. It enables users to access full Windows desktops and applications from virtually any device (including non-Windows devices) without requiring local installation, as the applications execute on remote session hosts in Azure.

Answer

Azure App Service

Answer

Azure Container Instances

Answer

Azure Virtual Machines

Question 7

What is the Microsoft Trust Center?

Accepted Answer

A website providing information about Microsoft's security, privacy, and compliance practices. The Microsoft Trust Center is a dedicated website that provides detailed information about Microsoft's security, privacy, and compliance practices. It serves as a central resource for customers to review certifications, audit reports, and documentation that demonstrate how Microsoft cloud services adhere to industry standards and regulatory requirements.

Answer

A portal for managing Azure subscriptions and billing

Answer

A service for encrypting data stored in Azure

Answer

A compliance management tool for creating organizational policies

Question 8

A company uses Azure Policy to enforce resource tagging. The governance team creates a policy that requires all resources in a subscription to have a 'CostCenter' tag. However, the team does not want to block resource creation if the tag is missing. Instead, they want the policy to automatically add the tag with a default value of 'Unassigned' to any new resource that is created without the tag. Which Azure Policy effect should the team configure in the policy definition?

Accepted Answer

Modify. The Modify effect is correct because it allows Azure Policy to automatically add or change a tag on a resource during creation or update without blocking the operation. This matches the requirement to add the 'CostCenter' tag with a default value of 'Unassigned' to any new resource missing it, while still permitting resource creation.

Answer

Deny

Answer

Audit

Answer

DeployIfNotExists

Question 9

A company needs to run a containerized application without managing any virtual machines or cluster orchestration. Which Azure service is best suited for this?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it allows you to run a containerized application directly on Azure without provisioning or managing any underlying virtual machines, cluster orchestration, or scheduling. ACI provides a serverless, per-second billing model, making it ideal for simple, isolated containers that do not require the complexity of a full orchestration platform.

Answer

Azure Kubernetes Service

Answer

Azure App Service

Answer

Azure Batch

Question 10

A financial services company runs a critical trading application in its on-premises data center. The company is migrating some workloads to Azure and requires a dedicated, private network connection between its on-premises network and Azure. The connection must not use the public internet, must provide consistent latency and higher bandwidth than a typical internet-based VPN, and must be backed by a service-level agreement (SLA) for availability. Which Azure service should the company use to meet these requirements?

Accepted Answer

ExpressRoute. ExpressRoute is the correct choice because it provides a dedicated, private connection between on-premises networks and Azure that bypasses the public internet entirely. This ensures consistent latency, higher bandwidth options (up to 100 Gbps), and a financially backed SLA of at least 99.95% availability, meeting all the stated requirements for a critical trading application.

Answer

Azure VPN Gateway

Answer

Azure Firewall

Answer

Azure Front Door

Question 11

A company has a policy that requires all storage accounts to have secure transfer enabled. They want to automatically audit all existing storage accounts and enforce the setting on new ones. They also want to automatically fix non-compliant new storage accounts. Which Azure Policy effect combination should they use?

Accepted Answer

D) modify and audit. The correct combination is 'audit' and 'modify'. 'audit' logs non-compliant existing storage accounts without changing them, satisfying the audit requirement. 'modify' automatically changes the secure transfer property on new storage accounts during creation, enforcing the policy without blocking deployment. 'deployIfNotExists' is incorrect because it only deploys additional resources (e.g., a diagnostic setting), it does not modify properties of the resource itself.

Answer

A) audit and deny

Answer

B) audit and deployIfNotExists

Answer

C) append and deny

Question 12

A company manages multiple Azure subscriptions for different business units. They want to define a standard set of policies, such as allowed VM SKUs and required resource tags, and ensure these policies are always applied whenever a new subscription is created. Which Azure feature should they use to enforce governance at this level?

Accepted Answer

Azure Management Groups. Azure Management Groups allow you to organize subscriptions into a hierarchy and apply governance policies at the management group level. When a new subscription is created under a management group, it automatically inherits the policies assigned to that group, ensuring consistent enforcement across all subscriptions without manual intervention.

Answer

Azure Policy

Answer

Azure Resource Manager templates

Answer

Azure Blueprints

Question 13

Which Azure database service provides ACID-compliant transactional support with row-level locking, ideal for online retail order processing?

Accepted Answer

Azure SQL Database. Azure SQL Database is a fully managed relational database engine that provides full ACID (Atomicity, Consistency, Isolation, Durability) compliance and supports row-level locking, making it ideal for online transaction processing (OLTP) workloads such as retail order processing. It ensures data integrity and concurrency control, which are critical for handling simultaneous order transactions without conflicts.

Answer

Azure Cosmos DB

Answer

Azure Table Storage

Answer

Azure Blob Storage

Question 14

A company has multiple Azure subscriptions that are managed by different departments. The governance team needs to ensure that every new subscription follows a standardized set of compliance requirements, including specific Azure Policy definitions, a predefined role assignment for a central security group, and a base set of network resources. The solution must be reusable and allow the governance team to update the requirements centrally, with changes automatically applied to all subscriptions that use the same definition. Which Azure service should the governance team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it enables the governance team to define a repeatable set of Azure resources and policies—including Azure Policy definitions, role assignments, and Resource Manager templates—that can be assigned to multiple subscriptions. When the blueprint definition is updated, all subscriptions using that blueprint receive the changes automatically, ensuring centralized compliance and versioning.

Answer

Azure Management Groups

Answer

Azure Resource Manager (ARM) templates

Answer

Azure Policy

Question 15

What does 'infrastructure as code' (IaC) mean in the context of Azure?

Accepted Answer

Defining Azure resources in configuration files that can be version-controlled and reused. Infrastructure as Code (IaC) in Azure involves defining and managing Azure resources (e.g., virtual networks, VMs, storage accounts) using declarative configuration files such as ARM templates, Bicep, or Terraform. These files can be stored in version control (e.g., Git), enabling repeatable, consistent deployments and rollbacks through automation, rather than manual or imperative steps.

Answer

Writing code that runs directly on Azure hardware

Answer

Using Azure CLI scripts to deploy one resource at a time imperatively

Answer

Converting physical server hardware into virtual machines

Question 16

Which Azure service provides a high-performance computing environment for running scientific, financial, and engineering simulations?

Accepted Answer

Azure Batch. Azure Batch is a cloud-based job scheduling and compute management service designed for large-scale parallel and high-performance computing (HPC) workloads. It automatically provisions and manages a pool of virtual machines, installs the required software, schedules tasks, and scales resources based on job demands, making it ideal for running scientific simulations, financial risk modeling, and engineering analysis.

Answer

Azure Functions

Answer

Azure Container Instances

Answer

Azure App Service

Question 17

Match each Azure identity service to its description.

Accepted Answer

Microsoft Entra ID: Cloud-based identity and access management service for employees and internal users.. Correct matches: Microsoft Entra ID for internal users, Azure AD B2C for customers, Managed Identities for Azure resources. Common confusions include swapping B2C with domain services or managed identities.

Answer

Azure AD B2C: Provides managed domain services like domain join and group policy.

Answer

Managed Identities: Identity service for managing customer identities and sign-up/sign-in.

Question 18

Which Azure service provides a hybrid connection solution for enabling applications to access on-premises resources without inbound firewall changes?

Accepted Answer

Azure Hybrid Connections. Azure Hybrid Connections (part of Azure App Service and Azure Relay) allows applications to securely connect to on-premises resources over port 443 using WebSockets and TLS, without requiring any inbound firewall rules or changes to the on-premises network. This is achieved by establishing an outbound-only tunnel from the on-premises Hybrid Connection Manager to Azure, which then relays traffic to the target resource.

Answer

Azure VPN Gateway

Answer

Azure Private Link

Answer

Azure ExpressRoute

Question 19

Which Azure service provides a virtual private network gateway for connecting on-premises networks to Azure virtual networks over the internet?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct service because it provides a dedicated virtual private network (VPN) gateway that enables secure site-to-site (S2S) or point-to-site (P2S) connectivity between on-premises networks and Azure virtual networks over the public internet using IPsec/IKE protocols. It creates an encrypted tunnel across the internet, making it the appropriate choice for internet-based hybrid connectivity.

Answer

Azure ExpressRoute

Answer

Azure Virtual Network

Answer

Azure Bastion

Question 20

Which benefit of cloud computing allows developers to test and deploy applications globally in minutes?

Accepted Answer

Speed and agility in global deployment. Cloud computing enables rapid global deployment through a distributed infrastructure of data centers and content delivery networks (CDNs). Developers can replicate applications across multiple regions in minutes using automated deployment pipelines and infrastructure-as-code tools, eliminating the need to provision physical servers in each location.

Answer

Economies of scale

Answer

Fault tolerance

Answer

Predictable pricing