AZ-900 Practice Exam 56 — 20 Questions

Question 1

A company has a single Azure subscription that contains multiple resource groups for different departments. The security team needs to ensure that only members of the 'VM Operators' Azure Active Directory group can create virtual machines in the subscription. All other users, including subscription Owners, must be blocked from creating virtual machines. Which Azure feature should the security team use to enforce this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure role-based access control (RBAC). Azure RBAC allows you to assign specific roles (like 'Virtual Machine Contributor') to a security principal (e.g., the 'VM Operators' group) at a scope (the subscription). By granting the 'Virtual Machine Contributor' role only to the 'VM Operators' group and removing any built-in roles that allow VM creation from other users (including Owners), you can ensure that only that group can create VMs. This is the correct mechanism because RBAC is designed for fine-grained, role-based permission management.

Answer

Azure Policy with a deny effect

Answer

Azure Resource Lock at the subscription level

Answer

Azure Blueprints

Question 2

Which Azure feature helps organizations maintain compliance by managing and auditing privileged access to Azure resources using just-in-time access?

Accepted Answer

Azure AD Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) is the correct answer because it provides just-in-time (JIT) privileged access to Azure resources, enabling organizations to grant time-bound, approval-based roles that reduce standing admin privileges. PIM also generates audit logs for all activations and deactivations, directly supporting compliance requirements by ensuring privileged access is managed and auditable.

Answer

Azure RBAC

Answer

Azure AD Conditional Access

Answer

Azure Key Vault

Question 3

A company runs an e-commerce web application on Azure virtual machines that are part of a virtual machine scale set configured with an autoscale rule based on CPU utilization. During a flash sale, customer traffic surges, causing the average CPU utilization across all instances to exceed 75% for five minutes. The scale set automatically provisions three additional VM instances to handle the increased load. After the sale ends, traffic normalizes, CPU utilization drops below 30%, and the scale set automatically removes the extra instances. This scenario best illustrates which characteristic of cloud computing?

Accepted Answer

Elasticity. Elasticity is the ability of a cloud system to dynamically scale resources up or down based on demand. In this scenario, the virtual machine scale set automatically adds three VM instances when CPU utilization exceeds 75% for five minutes and removes them when utilization drops below 30%, demonstrating rapid, automated scaling to match workload changes.

Answer

High availability

Answer

Fault tolerance

Answer

Disaster recovery

Question 4

A manufacturing company is evaluating whether to migrate its on-premises workloads to Azure. The IT team calculates that the total cost of running the equivalent compute and storage resources in Azure is lower than operating its own datacenter. They attribute this cost advantage to the fact that Azure purchases servers, networking gear, and power in massive quantities and passes the savings on to customers by spreading the fixed costs across a vast number of tenants. This cost-saving benefit is a direct illustration of which cloud computing concept?

Accepted Answer

Economies of scale. The scenario describes a cost advantage that arises because Azure buys hardware and energy in bulk, reducing per-unit costs and spreading fixed expenses across many customers. This is the direct definition of economies of scale, a core cloud concept where large-scale operations lower the average cost per unit, enabling providers to offer services at a lower price than individual organizations could achieve on-premises.

Answer

Resource pooling

Answer

Measured service

Answer

Rapid elasticity

Question 5

A company has a resource group named 'RG-Prod' that contains critical virtual machines (VMs), virtual networks, and a SQL database. The infrastructure team needs to grant a group of developers the ability to start, stop, and restart only the VMs in RG-Prod. The developers must not be able to create new VMs, delete existing VMs, modify the virtual networks, or access the database. The company wants to follow the principle of least privilege. Which Azure role-based access control (RBAC) approach should the company use?

Accepted Answer

Create a custom RBAC role that includes only the specific actions required (e.g., Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action) and assign it to the developers.. The principle of least privilege requires granting only the exact permissions needed. The built-in Virtual Machine Contributor role includes permissions beyond start/stop/restart (e.g., it allows creating and deleting VMs), which violates the requirement. A custom RBAC role scoped to RG-Prod with only the specific actions (Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/restart/action) meets the need precisely.

Answer

Assign the Virtual Machine Contributor built-in role to the developers.

Answer

Assign the Contributor built-in role and then create an Azure Policy to deny any VM creation or deletion and VNet modifications in RG-Prod.

Answer

Assign the Reader role to the developers and use Azure Policy to automatically start, stop, and restart VMs on their behalf.

Question 6

Which Azure service provides a SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct answer because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution. It provides intelligent security analytics and threat intelligence across the enterprise, enabling security teams to collect data at cloud scale, detect threats, investigate incidents, and automate responses.

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Answer

Azure Security Center

Question 7

What does Azure Auto-Shutdown for virtual machines provide?

Accepted Answer

Automatic daily power-off of VMs at a configured time to reduce costs. Azure Auto-Shutdown is a cost-saving feature that automatically powers off virtual machines at a user-defined schedule (e.g., nightly at 7 PM). It helps reduce compute costs by ensuring VMs are not running when not needed, but does not delete or modify the VM's configuration or resources.

Answer

Automatic deletion of VMs that haven't been used for 30 days

Answer

Automatic scaling down of VM CPU when under low utilization

Answer

Automatic failover of VMs to another region during outages

Question 8

Which term describes the practice of deploying resources across multiple Azure availability zones to protect against datacenter-level failures?

Accepted Answer

Zone-redundant deployment. Zone-redundant deployment (B) is the correct term because it specifically refers to replicating resources across multiple Azure availability zones within a single Azure region. Availability zones are physically separate datacenters with independent power, cooling, and networking, so deploying across them protects against a single datacenter-level failure while keeping the application within the same low-latency region.

Answer

Geo-redundancy

Answer

Horizontal scaling

Answer

Disaster recovery

Question 9

Which Azure service provides an enterprise messaging service with advanced features like topics, subscriptions, and dead-letter queues?

Accepted Answer

Azure Service Bus. Azure Service Bus is a fully managed enterprise message broker that supports advanced messaging patterns including topics (publish/subscribe), subscriptions (filtered message delivery), and dead-letter queues (for handling undeliverable messages). It is designed for reliable, ordered message delivery with features like sessions, transactions, and duplicate detection, making it the correct choice for this question.

Answer

Azure Queue Storage

Answer

Azure Event Grid

Answer

Azure Event Hubs

Question 10

A multinational corporation wants to deploy a standard set of Azure resources—including virtual networks, virtual machines, and SQL databases—to multiple departments. Each deployment must automatically include assigned Azure Policy definitions to enforce security rules, role-based access control (RBAC) assignments for the operations team, and a predefined naming convention. The solution must provide a single, repeatable package that can be versioned and updated centrally. Which Azure service should the company use?

Accepted Answer

Azure Blueprints. Azure Blueprints is designed to package resource templates, policy assignments, RBAC assignments, and naming conventions into a single versioned, repeatable artifact that can be assigned to subscriptions or management groups. It is the only Azure service that natively bundles governance artifacts (policy, RBAC) with resource deployment in one deployable unit, satisfying the versioning and central-update requirements.

Answer

Azure Policy

Answer

Azure Resource Manager templates

Answer

Azure Management Groups

Question 11

Which Azure service provides managed relational database compatible with open-source PostgreSQL?

Accepted Answer

Azure Database for PostgreSQL. Azure Database for PostgreSQL is a fully managed relational database service specifically built for PostgreSQL, providing high availability, automated backups, and built-in security. It is the correct choice because it directly offers a managed PostgreSQL-compatible database without requiring any middleware or translation layer.

Answer

Azure SQL Managed Instance

Answer

Azure Cosmos DB for PostgreSQL

Answer

Azure SQL Database Hyperscale

Question 12

A company plans to deploy a mission-critical application on three Azure virtual machines. The application must remain available even if an entire Azure datacenter becomes unavailable due to a catastrophic event like a fire or flood. The company wants to deploy the VMs across multiple physical locations within a single Azure region, with each location having independent power, cooling, and networking. Which Azure feature should the company use?

Accepted Answer

Availability zones. Availability zones are physically separate locations within an Azure region, each with independent power, cooling, and networking. By deploying the three VMs across different availability zones, the application remains available even if an entire datacenter (one zone) fails due to a catastrophic event. This meets the requirement for high availability across multiple physical locations within a single region.

Answer

Availability sets

Answer

Azure Site Recovery

Answer

Virtual machine scale sets

Question 13

A company wants to ensure that all new Azure resources in a subscription are automatically tagged with a 'Department' tag. Which Azure service should they use to enforce this requirement?

Accepted Answer

Azure Policy. Azure Policy is correct because it allows you to create, assign, and manage policies that enforce specific rules on your Azure resources. In this scenario, you can use a built-in or custom policy definition to require a 'Department' tag on all new resources, and Azure Policy will automatically evaluate and enforce this rule during resource creation, preventing non-compliant resources from being provisioned.

Answer

Azure Blueprints

Answer

Azure RBAC

Answer

Azure Resource Lock

Question 14

Which Azure tool enables administrators to run PowerShell or Bash commands to manage Azure resources directly from a web browser without installing any tools locally?

Accepted Answer

Azure Cloud Shell. Azure Cloud Shell is a browser-accessible shell environment that provides both PowerShell and Bash interfaces, allowing administrators to run commands against Azure resources without any local installation. It authenticates automatically via the Azure portal session and includes pre-installed tools like Azure CLI, AzCopy, and kubectl, making it the correct answer for managing Azure resources directly from a web browser.

Answer

Azure portal dashboard

Answer

Azure DevOps

Answer

Azure Mobile App

Question 15

Which Azure RBAC built-in role allows a user to view all resources but NOT make any changes?

Accepted Answer

Reader. The Reader role is the correct answer because it grants read-only access to all Azure resources, including their properties and status, but explicitly prevents any modifications, deletions, or creations. This aligns directly with the requirement to view resources without making changes.

Answer

Contributor

Answer

Owner

Answer

User Access Administrator

Question 16

A company wants to ensure that their cloud provider's physical data centers are located in specific geographic areas to comply with data residency requirements. Which cloud concept is this related to?

Accepted Answer

Data sovereignty. Data sovereignty is the concept that data is subject to the laws and regulations of the country or region where it is physically stored. By ensuring their cloud provider's data centers are located in specific geographic areas, the company is directly addressing data sovereignty requirements to comply with local data residency laws, such as GDPR in Europe or the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada.

Answer

Availability

Answer

Disaster recovery

Answer

Hybrid cloud

Question 17

Which Azure security service provides a cloud-native firewall with built-in high availability and unrestricted cloud scalability?

Accepted Answer

Azure Firewall. Azure Firewall is a cloud-native, stateful firewall as a service that provides built-in high availability and scales automatically to accommodate changing network traffic patterns. Unlike other options, it is designed specifically as a managed firewall service with unrestricted cloud scalability, supporting both inbound and outbound traffic filtering at the network and application layers.

Answer

Network Security Groups

Answer

Azure WAF

Answer

Azure DDoS Protection

Question 18

A manufacturing company is building a web-based dashboard to display real-time production metrics from sensors. The development team wants to deploy the application without managing the underlying infrastructure, including the web server and operating system. The application uses ASP.NET Core. Which Azure service should they use?

Accepted Answer

Azure App Service. Azure App Service is the correct choice because it provides a fully managed platform for hosting web applications, including ASP.NET Core, without requiring the user to manage the underlying web server or operating system. It supports continuous deployment, auto-scaling, and built-in load balancing, making it ideal for a real-time dashboard that needs high availability and minimal operational overhead.

Answer

Azure Functions

Answer

Azure Kubernetes Service (AKS)

Answer

Azure Virtual Machines

Question 19

Which Azure service provides centralized log collection, querying, and analysis from multiple Azure resources and services?

Accepted Answer

Azure Log Analytics. Azure Log Analytics is the correct answer because it is the primary Azure service designed for centralized log collection, querying, and analysis across multiple Azure resources and services. It uses a powerful query language (Kusto Query Language, KQL) to aggregate and analyze data from various sources, including Azure Monitor, virtual machines, and custom logs, providing a unified workspace for troubleshooting and monitoring.

Answer

Azure Application Insights

Answer

Azure Service Health

Answer

Azure Network Watcher

Question 20

A multinational company runs a web application that must serve users from around the world with low latency. The application is deployed in multiple Azure regions. The company also requires built-in protection against distributed denial-of-service (DDoS) attacks at the network layer. The solution must automatically route users to the closest healthy endpoint based on geographic location. Which Azure service should the company use?

Accepted Answer

Azure Front Door. Azure Front Door is correct because it provides global load balancing with automatic routing to the closest healthy endpoint based on geographic location (latency-based routing), and it includes built-in DDoS protection at the network layer (L3/L4) as part of the Azure infrastructure. This combination of global routing and integrated DDoS mitigation directly matches the requirements for a multinational application serving users worldwide.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Application Gateway