AZ-900 Practice Exam 56 — 20 Questions

Question 1

A company has a critical Azure resource group that contains all production virtual machines and databases. The IT security administrator wants to ensure that no user, including members of the 'Owner' role, can accidentally or intentionally delete this resource group. The solution must not prevent modification of resources inside the resource group. The administrator needs to apply a governance control at the resource group level. What should the administrator do?

Accepted Answer

Apply a 'CanNotDelete' lock on the resource group.. Option B is correct because applying a 'CanNotDelete' lock at the resource group level prevents any user, including those with the Owner role, from deleting the resource group while still allowing modifications (e.g., adding or updating resources) inside it. This lock overrides all RBAC permissions for delete operations, making it the appropriate governance control for this requirement.

Answer

Apply a 'ReadOnly' lock on the resource group.

Answer

Assign a custom RBAC role that denies delete actions at the resource group scope.

Answer

Move the resource group to a separate subscription with billing separation.

Question 2

A company has three departments: Sales, Marketing, and IT. Each department has its own Azure subscription. The IT department manages all networking and security policies across all subscriptions. The Sales and Marketing departments should be able to create and manage their own resources but cannot modify networking or security policies. The IT department wants to apply a consistent set of policies (e.g., enforce tagging, restrict VM SKUs) across all subscriptions without needing to assign policies to each subscription individually. Additionally, the IT department wants to delegate administration of a specific custom role to a junior administrator who can assign that role to users within the Sales subscription only. Which combination of Azure governance features should the IT department use?

Accepted Answer

Create a management group containing all three subscriptions, assign Azure Policy initiatives at the management group, and use Azure RBAC with a custom role scoped to the Sales subscription.. Option A is correct because Azure management groups allow hierarchical policy inheritance: assigning an Azure Policy initiative at the management group level automatically applies it to all child subscriptions (Sales, Marketing, IT). This satisfies the requirement for consistent policies without individual assignment. Additionally, Azure RBAC with a custom role scoped to the Sales subscription enables the IT department to delegate administration of that role to a junior administrator, who can then assign it only within the Sales subscription, meeting the delegation requirement precisely.

Answer

Create a management group for each department, assign Azure Policy initiatives at each management group, and use Azure Blueprints to manage role assignments.

Answer

Use Azure Resource Manager templates to deploy policies and role assignments to each subscription, and use Azure Active Directory administrative units to manage delegation.

Answer

Assign Azure Policy initiatives to each subscription individually, and create a custom role that is scoped to the management group.

Question 3

A company has several Azure subscriptions that contain hundreds of virtual machines. A new corporate standard requires that all VMs must use Azure managed disks instead of unmanaged disks. The governance team needs to automatically identify existing VMs with unmanaged disks and convert them to managed disks without requiring manual intervention for each VM. The team also wants to ensure that any new VMs created in the future automatically use managed disks. Which Azure feature should they use to meet both requirements?

Accepted Answer

Azure Policy with the DeployIfNotExists effect (with remediation). Azure Policy with the DeployIfNotExists effect can automatically identify VMs using unmanaged disks and, when combined with remediation tasks, convert them to managed disks without manual intervention. It also enforces that any new VMs are created with managed disks by evaluating and automatically deploying the required configuration at creation time. This meets both the identification/conversion of existing resources and the enforcement for future resources.

Answer

Azure Blueprints

Answer

Azure Resource Manager (ARM) templates

Answer

Azure Cost Management + Budgets

Question 4

A company has deployed applications in two separate Azure virtual networks (VNets) in the East US and West Europe regions. Each VNet contains multiple subnets with application servers and databases. The network team needs to enable direct, private IP connectivity between the VNets, ensuring that all traffic stays within the Azure backbone network and never traverses the public internet. The solution must also provide low latency for cross-region communication. They currently do not need a dedicated private connection to an on-premises datacenter. Which Azure service should they use?

Accepted Answer

VNet Peering. VNet Peering is the correct choice because it enables direct, private IP connectivity between two Azure virtual networks using the Microsoft backbone infrastructure, ensuring traffic never traverses the public internet. It provides low-latency, high-bandwidth cross-region communication without requiring a VPN gateway or dedicated circuits. Since the scenario involves only cloud-to-cloud connectivity (no on-premises requirement), VNet Peering is the simplest and most cost-effective solution.

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Answer

Azure Virtual WAN

Question 5

A company has an Azure subscription with multiple resource groups. The governance team wants to ensure that every new resource created in the subscription automatically receives a 'Department' tag with a default value of 'Finance' if the creator did not specify one. The team wants the tag to be applied without blocking the creation of the resource. Which Azure feature should they use?

Accepted Answer

Azure Policy with the 'Append' effect. Azure Policy with the 'Append' effect is the correct choice because it adds the 'Department' tag with a default value of 'Finance' to a resource during creation or update, without blocking the operation. Unlike 'Deny', which prevents non-compliant resources, 'Append' modifies the resource request to include the missing tag, ensuring compliance without interrupting the creation process.

Answer

Azure Policy with the 'Deny' effect

Answer

Azure Resource Lock

Answer

Azure role-based access control (RBAC) with a custom role

Question 6

A company has multiple Azure subscriptions that are managed by different departments. The governance team needs to ensure that every new subscription follows a standardized set of compliance requirements, including specific Azure Policy definitions, a predefined role assignment for a central security group, and a base set of network resources. The solution must be reusable and allow the governance team to update the requirements centrally, with changes automatically applied to all subscriptions that use the same definition. Which Azure service should the governance team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it enables the governance team to define a repeatable set of Azure resources and policies—including Azure Policy definitions, role assignments, and Resource Manager templates—that can be assigned to multiple subscriptions. When the blueprint definition is updated, all subscriptions using that blueprint receive the changes automatically, ensuring centralized compliance and versioning.

Answer

Azure Management Groups

Answer

Azure Resource Manager (ARM) templates

Answer

Azure Policy

Question 7

A company has multiple departments, each with its own Azure subscription. They want to apply the same set of policies and role assignments to all subscriptions under the Sales department. They also plan to create more subscriptions for Sales in the future. Which Azure construct should they use?

Accepted Answer

Management group. Management groups allow you to apply Azure Policy and role-based access control (RBAC) assignments hierarchically across multiple subscriptions. By placing all Sales department subscriptions under a single management group, any policies or role assignments defined at that management group level will be inherited by all current and future subscriptions within it, ensuring consistent governance.

Answer

Resource group

Answer

Policy initiative

Answer

Blueprint

Question 8

A company has virtual machines in a virtual network that run a critical internal application. IT administrators need to securely connect to these VMs from the internet for management purposes. They must not assign public IP addresses to the VMs, and they want to avoid managing SSH or RDP endpoints. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure and seamless RDP/SSH connectivity to virtual machines directly in the Azure portal over TLS, without exposing public IP addresses on the VMs. It eliminates the need for managing public endpoints, as the Bastion service is deployed inside the virtual network and acts as a jump server that brokers the connection. This meets the requirement of secure internet-based management without public IPs or manual SSH/RDP endpoint management.

Answer

Azure VPN Gateway

Answer

Azure Load Balancer

Answer

Azure Firewall

Question 9

A company deploys a critical application on Azure virtual machines across three different availability zones in the East US region. The application is designed to handle the failure of one zone by automatically failing over to the remaining healthy zones. Which type of failure does this architecture primarily protect against?

Accepted Answer

A failure of an entire Azure data center. Option C is correct because deploying a critical application across multiple availability zones protects against the failure of an entire Azure data center. Each availability zone is a physically separate data center within an Azure region, with independent power, cooling, and networking. If one zone fails, the application automatically fails over to the remaining healthy zones, ensuring high availability at the data center level.

Answer

A regional disaster that affects the entire East US region

Answer

A failure of a single physical server

Answer

A failure of the Azure network backbone

Question 10

A company has deployed a production Azure SQL Database that is used by a critical line-of-business application. The database administrators need to be able to change the database schema and scaling settings. However, the operations team must ensure that no one can accidentally delete the database or its server. The company does not want to implement a complex backup strategy for this prevention; they want a simple control that can be applied at the resource level without affecting other management operations. What should the operations team configure to meet these requirements?

Accepted Answer

A 'CanNotDelete' resource lock on the database and the server. A 'CanNotDelete' resource lock on the database and the server prevents accidental deletion while still allowing all other management operations, including schema changes and scaling. This meets the requirement for a simple, resource-level control that does not affect read or update permissions.

Answer

An Azure Policy definition with the 'Deny' effect assigned to the resource group containing the database

Answer

A custom Azure Role-Based Access Control (RBAC) role that excludes the delete action

Answer

An Azure Blueprint that includes a policy enforcing a read-only state

Question 11

A company has a critical resource group named 'Prod-Databases' that contains Azure SQL databases and virtual machines used by a production order-processing system. The database administrator wants to prevent any user, including administrators, from accidentally deleting or modifying resources in this resource group. The operations team needs a safeguard that requires an explicit action to be taken before any changes become possible, without affecting the ability to manage resources in other resource groups. Which Azure feature should the team implement?

Accepted Answer

Azure Resource Lock (CanNotDelete). Option C is correct because Azure Resource Locks provide a safeguard that prevents accidental deletion or modification of critical resources at the subscription, resource group, or individual resource level. The CanNotDelete lock specifically blocks delete operations while allowing all read and update operations, and it requires an explicit unlock action before any changes can be made, even by administrators. This meets the requirement of protecting the 'Prod-Databases' resource group without affecting other resource groups.

Answer

Azure Policy with the Deny effect

Answer

Azure RBAC role assignment (e.g., restrict to Reader role)

Answer

Azure management group

Question 12

A company has five Azure subscriptions, each managed by a different department. The IT governance team needs to enforce a single set of compliance policies (e.g., allowed VM SKUs) and assign a specific role to a central security team across all subscriptions. The goal is to minimize administrative overhead. Which Azure component should the governance team use as the scope for these assignments?

Accepted Answer

Place all subscriptions under a single management group and assign policies and roles at that management group level.. Management groups provide a hierarchical scope above subscriptions, enabling centralized governance. By placing all five subscriptions under a single management group, the IT governance team can assign Azure Policy definitions (e.g., allowed VM SKUs) and role-based access control (RBAC) roles (e.g., for the security team) once at that management group level. This inheritance automatically applies the policies and roles to all child subscriptions, minimizing administrative overhead compared to per-subscription or per-resource-group assignments.

Answer

Assign the policies and role at each subscription level individually.

Answer

Create a resource group in each subscription and assign policies and roles at the resource group level.

Answer

Create an Azure Blueprint definition and apply it to each subscription separately.

Question 13

A company deploys a web application on Azure VMs across two different physical locations within the same Azure region. These locations are isolated from each other in terms of power, cooling, and networking. If one location fails, the application remains available from the other location. Which feature achieves this?

Accepted Answer

Availability zones. Availability zones are physically separate locations (datacenters) within an Azure region, each with independent power, cooling, and networking. By deploying VMs across two zones, the application remains available if one zone fails, achieving high availability. This matches the scenario exactly.

Answer

Availability sets

Answer

Resource groups

Answer

Virtual machine scale sets

Question 14

A company has a management group hierarchy: Root → UK → Production. They assign a policy at the Root level that allows only certain VM sizes. Later, they assign another policy at the UK level that denies all resources. What is the effective effect on the Production subscription?

Accepted Answer

Both policies apply, and the most restrictive (Deny) takes precedence.. D is correct because Azure Policy is inherited and cumulative down the management group hierarchy. The Root-level policy (allow only certain VM sizes) and the UK-level policy (deny all resources) both apply to the Production subscription. When a deny policy conflicts with an allow policy, the deny effect always takes precedence, making the most restrictive policy effective.

Answer

Only the Root policy applies because it is at the highest level.

Answer

Only the UK policy applies because it is more specific.

Answer

Both policies apply, and the order of evaluation could cause a conflict.

Question 15

A company has two Azure virtual networks: VNet-A in the East US region and VNet-B in the West US region. Each VNet hosts a set of virtual machines that run a distributed application. The application requires private, low-latency communication between the VMs in VNet-A and VNet-B. The company wants to minimize operational complexity and avoid any additional billing for data transfer between the two VNets beyond the standard Azure data transfer charges. Which Azure service should the company use to connect the two virtual networks?

Accepted Answer

Azure Virtual Network Peering. Azure Virtual Network Peering is the correct choice because it connects two virtual networks directly over the Microsoft backbone network, providing private, low-latency communication between VMs in different regions. It incurs only standard Azure data transfer charges (no additional gateway or circuit costs) and requires minimal operational overhead, as it is a simple configuration with no extra devices or bandwidth provisioning.

Answer

Azure VPN Gateway (Site-to-Site)

Answer

Azure ExpressRoute

Answer

Azure Front Door

Question 16

A company develops a data processing application that runs only when new files are uploaded to an Azure Blob Storage container. The application must scale automatically to handle hundreds of simultaneous file uploads and must not incur cost when no files are being processed. The development team wants the simplest solution that requires no infrastructure management. Which Azure compute service should they use?

Accepted Answer

Azure Functions with a Blob Storage trigger. Azure Functions with a Blob Storage trigger is the correct choice because it provides an event-driven, serverless compute model that automatically scales to handle hundreds of concurrent file uploads without requiring any infrastructure management. The function executes only when a new blob is created in the container, ensuring zero cost when no files are being processed, and the platform handles scaling out to meet demand.

Answer

Azure Virtual Machines Scale Set with autoscale rules

Answer

Azure Batch

Answer

Azure Container Instances

Question 17

A company has a single Azure subscription that contains multiple resource groups for different departments. The security team needs to ensure that only members of the 'VM Operators' Azure Active Directory group can create virtual machines in the subscription. All other users, including subscription Owners, must be blocked from creating virtual machines. Which Azure feature should the security team use to enforce this requirement?

Accepted Answer

Azure role-based access control (RBAC). Azure RBAC allows you to assign specific roles (like 'Virtual Machine Contributor') to a security principal (e.g., the 'VM Operators' group) at a scope (the subscription). By granting the 'Virtual Machine Contributor' role only to the 'VM Operators' group and removing any built-in roles that allow VM creation from other users (including Owners), you can ensure that only that group can create VMs. This is the correct mechanism because RBAC is designed for fine-grained, role-based permission management.

Answer

Azure Policy with a deny effect

Answer

Azure Resource Lock at the subscription level

Answer

Azure Blueprints

Question 18

A company has a legacy on-premises application that processes sensitive financial data. Due to regulatory requirements, certain data cannot leave the company's on-premises data center. However, the company wants to take advantage of the cloud's scalability for the application's compute-intensive batch processing jobs. The batch jobs need to access the sensitive data but must process it without the data ever being stored in the cloud. The batch jobs will be orchestrated from the cloud. Which cloud deployment model best describes this architecture?

Accepted Answer

Hybrid cloud. This architecture is a hybrid cloud because it combines on-premises infrastructure (where sensitive data resides and must remain) with public cloud resources (for compute-intensive batch processing). The batch jobs are orchestrated from the cloud but access the sensitive data on-premises without storing it in the cloud, which is a classic hybrid deployment pattern. Hybrid cloud enables workload portability and orchestration across private and public environments while meeting data residency and regulatory requirements.

Answer

Public cloud

Answer

Private cloud

Answer

Multi-cloud

Question 19

A company has a large dataset of historical financial records that must be retained for 10 years to comply with regulatory requirements. The data is accessed only a few times per year during audits. When accessed, a retrieval delay of up to 15 hours is acceptable. The company wants to minimize storage costs for this dataset. Which Azure Blob storage access tier should the company use?

Accepted Answer

Archive tier. The Archive tier is the correct choice because it is the lowest-cost storage tier for data that is rarely accessed and has a flexible retrieval time. With a 10-year retention requirement and only a few accesses per year, the Archive tier's retrieval time of up to 15 hours (actual range is 1–15 hours for standard retrieval) is acceptable, and it minimizes storage costs compared to other tiers.

Answer

Hot tier

Answer

Cool tier

Answer

Premium tier

Question 20

A company has a global web application deployed on Azure virtual machines in three separate Azure regions: West US, West Europe, and Southeast Asia. The application must automatically direct each user to the region that is geographically closest to the user's location in order to minimize latency. The solution must expose a single DNS name that does not change if regions are added or removed. The company does not need to offload SSL certificates or perform URL-based routing at the global level. Which Azure service should the company use to meet these requirements?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that can route users to the closest regional endpoint based on geographic location using the 'Performance' routing method. It exposes a single DNS name (e.g., myapp.trafficmanager.net) that remains constant even when endpoints are added or removed, and it does not require SSL offloading or URL-based routing, matching the requirements exactly.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door