AZ-900 Practice Exam 57 — 20 Questions

Question 1

A company has an Azure subscription that contains production resources. The IT manager is concerned that a user who has the Contributor role might accidentally delete the entire subscription. The company wants a solution that prevents anyone from deleting the subscription, even users with the Owner role, while still allowing modifications to the resources inside the subscription. What should the administrator configure?

Accepted Answer

Apply a resource lock of type 'Delete' at the subscription level.. Option C is correct because a resource lock of type 'Delete' at the subscription level prevents any user, including those with the Owner role, from deleting the subscription. This lock overrides all RBAC permissions, ensuring that while modifications to resources inside the subscription are still allowed, the subscription itself cannot be removed. This directly addresses the IT manager's concern about accidental deletion.

Answer

Assign a custom role-based access control (RBAC) role that denies the delete action for all users.

Answer

Configure an Azure Policy with the 'Deny' effect to block deletion of the subscription.

Answer

Apply a resource lock of type 'ReadOnly' at the subscription level.

Question 2

A company is adopting Azure and needs to deploy a standardized environment that includes a resource group, a virtual network with specific IP address ranges, and a set of Azure Policy definitions to restrict allowed deployment locations. The environment will be deployed to multiple subscriptions used by different departments. The company requires a repeatable, versioned package that defines the resources, policies, and role assignments as a single item. The solution must allow updates to be managed and enforced over time. Which Azure feature should the company use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it enables the orchestrated deployment of a standardized environment—including resource groups, virtual networks, Azure Policy definitions, and role assignments—as a single, versioned, and updatable package. Unlike ARM templates, Blueprints natively supports versioning, policy assignment, and role assignment as first-class artifacts, and it allows the blueprint to be assigned to multiple subscriptions while maintaining a central source of truth for updates and enforcement.

Answer

Azure Policy

Answer

ARM templates

Answer

Management groups

Question 3

A cloud provider purchases hardware in bulk and shares physical infrastructure among many customers, which allows them to offer lower prices per customer. This benefit is known as:

Accepted Answer

Economies of scale. Option C is correct because economies of scale refer to the cost advantage that cloud providers achieve by purchasing hardware in bulk and sharing physical infrastructure across many customers. This reduces the per-unit cost of compute, storage, and networking resources, enabling providers to offer lower prices per customer. The scenario directly describes the cost benefits of large-scale operations, which is the defining characteristic of economies of scale.

Answer

Elasticity

Answer

Resource pooling

Answer

High availability

Question 4

A company has an Azure Policy assigned at the root management group that denies the creation of resources without a 'Department' tag. The IT team needs to deploy a temporary set of resources in a specific resource group under a child management group. These resources will not have the required tag. The team must not alter the original policy definition or the policy assignment. What should the team create to allow this deployment?

Accepted Answer

Create a policy exemption on the resource group.. Option B is correct because a policy exemption allows the IT team to bypass the 'Department' tag denial policy for a specific scope (the resource group) without modifying the original policy definition or assignment. Exemptions are designed for temporary or special circumstances where compliance is not required, such as deploying resources that lack the required tag. This aligns with the requirement to not alter the original policy, as exemptions are additive and scoped to the resource group.

Answer

Create a policy exclusion on the resource group.

Answer

Modify the policy assignment to include a compliance exception.

Answer

Create a resource lock on the resource group.

Question 5

A company deploys a web application on Azure Virtual Machines across multiple availability zones within a single region. They need to distribute incoming network traffic across these VM instances to ensure high availability. Which Azure service should they use?

Accepted Answer

Azure Load Balancer. Azure Load Balancer is the correct choice because it operates at Layer 4 (TCP/UDP) and distributes incoming traffic across healthy virtual machines within a single region, including across availability zones. It provides high availability by automatically routing traffic only to healthy VM instances based on health probes, and it supports both public and internal load balancing scenarios.

Answer

Azure Application Gateway

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 6

A cloud provider offers resources on-demand and measures usage. Customers pay only for what they consume. Which characteristic of cloud computing is this?

Accepted Answer

Measured service. This describes the 'measured service' characteristic, where cloud providers meter resource usage (e.g., compute hours, storage GB, network I/O) and bill customers based on actual consumption. This pay-per-use model is enabled by telemetry and monitoring systems that track metrics like CPU time, bandwidth, and API calls, allowing granular cost allocation.

Answer

Resource pooling

Answer

Broad network access

Answer

Rapid elasticity

Question 7

A company has 10 Azure subscriptions used by different departments. The finance team wants to receive automated, prioritized recommendations to reduce cloud costs. Specifically, they want suggestions for identifying idle virtual machines and rightsizing underutilized resources across all subscriptions. Which Azure service should the finance team use to get these recommendations?

Accepted Answer

Azure Advisor. Azure Advisor is the correct service because it provides personalized, prioritized recommendations across Azure subscriptions, including cost optimization suggestions such as identifying idle virtual machines and rightsizing underutilized resources. It analyzes resource usage and configuration to deliver actionable insights, making it ideal for the finance team's needs.

Answer

Azure Cost Management + Billing

Answer

Azure Policy

Answer

Azure Monitor

Question 8

A company has deployed hundreds of virtual machines in Azure across multiple subscriptions. The governance team wants to generate a compliance report that identifies which VMs are using approved VM sizes and which are not, according to a corporate policy. The team must not block the deployment of non-compliant VMs; they only want to track compliance. Which Azure Policy effect should they use in the policy definition?

Accepted Answer

Audit. The Audit effect is the correct choice because it enables the governance team to log non-compliant resources (such as VMs using unapproved sizes) in the Azure Activity Log without blocking their deployment. This effect generates a compliance report while allowing the deployment to proceed, exactly matching the requirement to track compliance without enforcement.

Answer

Deny

Answer

Append

Answer

DeployIfNotExists

Question 9

A company has multiple Azure subscriptions for different projects. They want to apply a common set of policies and role assignments to all subscriptions under the 'Research' department. They also plan to add more subscriptions for Research in the future. What should they use?

Accepted Answer

Azure management group. Azure management groups allow you to efficiently manage access, policies, and compliance across multiple Azure subscriptions. By placing all 'Research' subscriptions under a single management group, you can apply a common set of Azure Policy assignments and Azure role-based access control (RBAC) assignments at the management group scope, which automatically cascades to all current and future subscriptions within that group. This hierarchical structure is specifically designed for enterprise-scale governance across departments.

Answer

Azure resource group

Answer

Azure Blueprint

Answer

Azure Policy initiative

Question 10

A company has an application running on Azure VMs across multiple availability zones to protect against data center failures. They need to distribute incoming traffic evenly across all VMs in a single region. Which Azure load balancing solution should they use?

Accepted Answer

Azure Load Balancer. Azure Load Balancer operates at Layer 4 (TCP/UDP) and distributes incoming traffic across healthy VM instances in the backend pool. By deploying VMs across multiple availability zones within a single region, the Load Balancer can route traffic evenly to all zone-resilient VMs, providing high availability and load distribution without application-layer inspection.

Answer

Azure Application Gateway

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 11

A company is designing a disaster recovery solution for an application hosted on Azure VMs. They want to replicate the VMs to a secondary Azure region and automatically failover if the primary region fails. Which Azure service should they use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) orchestrates replication, failover, and failback of Azure VMs between regions. It continuously replicates VM disks to the secondary region and, upon a failure, allows you to initiate a planned or unplanned failover with a single click, meeting the stated disaster recovery and automatic failover requirements.

Answer

Azure Backup

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Question 12

A company has a policy that every Azure resource must have a 'CostCenter' tag assigned at creation time. The governance team wants to automatically prevent any resource creation if the tag is missing, without requiring manual review after deployment. Which Azure feature should they use to enforce this requirement?

Accepted Answer

Azure Policy. Azure Policy is correct because it enables the enforcement of organizational standards by evaluating resources against custom or built-in policies at creation time. In this scenario, a policy can be configured with a 'deny' effect to automatically block any resource deployment that lacks the required 'CostCenter' tag, preventing non-compliant resources from being created without manual intervention.

Answer

Azure Blueprints

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Tags

Question 13

A company hosts a customer relationship management (CRM) application on Azure virtual machines. The sales team needs to access the CRM from various locations, including the airport, home, and client offices, using company-issued laptops and personal mobile devices. The application is accessible via a standard web browser over the internet without requiring any special client software or dedicated network connections. Which fundamental characteristic of cloud computing does this scenario primarily demonstrate?

Accepted Answer

Broad network access. The scenario describes users accessing the CRM application from various locations (airport, home, client offices) using different devices (company laptops and personal mobile phones) over the internet via a standard web browser without special client software or dedicated network connections. This directly maps to the cloud computing characteristic of broad network access, which is defined by NIST SP 800-145 as resources that are available over the network and accessed through standard mechanisms (e.g., web browsers, HTTPS) that promote use by heterogeneous client platforms (e.g., mobile phones, laptops, workstations).

Answer

On-demand self-service

Answer

Resource pooling

Answer

Rapid elasticity

Question 14

A company is developing a new web application. The development team wants to deploy the application code without having to manage the underlying virtual machines, operating systems, or runtime environments. They only want to focus on writing code and let the cloud provider handle the infrastructure, platform, and scaling automatically. Which cloud service model does this scenario describe?

Accepted Answer

Platform as a Service (PaaS). This scenario describes Platform as a Service (PaaS) because the development team wants to deploy application code without managing the underlying virtual machines, operating systems, or runtime environments. PaaS provides a managed hosting environment where the cloud provider handles infrastructure, platform updates, and automatic scaling, allowing developers to focus solely on writing and deploying code. In contrast, IaaS would require managing VMs and OS, while SaaS delivers fully built applications, not a platform for custom code deployment.

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Question 15

A company is deploying a critical application on Azure Virtual Machines. They need to ensure that the application remains available during Azure platform updates. They also want to distribute the VMs across fault domains within an availability set. What is the primary purpose of fault domains?

Accepted Answer

To distribute VMs across different power and cooling racks. Fault domains represent groupings of hardware that share a common power source and network switch. By distributing VMs across multiple fault domains within an availability set, Azure ensures that if a power or cooling failure occurs in one rack, only the VMs in that fault domain are affected, keeping the application available on VMs in other fault domains.

Answer

To distribute VMs across different Azure regions

Answer

To distribute VMs across different availability zones

Answer

To distribute VMs across different virtual networks

Question 16

A company hosts a web application on Azure App Service. The application must be accessible from any internet-connected device, including smartphones and laptops. Employees also use the Azure portal and Azure CLI from various locations to manage the application and other Azure resources. This scenario best illustrates which characteristic of cloud computing?

Accepted Answer

Broad network access. Broad network access is the correct characteristic because the scenario explicitly describes the web application being accessible from any internet-connected device (smartphones, laptops) and employees managing resources via the Azure portal and CLI from various locations. This aligns with the NIST definition of broad network access, where resources are available over the network and accessed through standard protocols (e.g., HTTPS, SSH) by heterogeneous thin or thick client platforms.

Answer

On-demand self-service

Answer

Resource pooling

Answer

Measured service

Question 17

A company has multiple Azure subscriptions for different departments. The governance team needs to ensure that every new subscription is automatically provisioned with a consistent set of resources, including a predefined network topology, mandatory Azure Policy assignments (e.g., allowed locations), and specific role-based access control (RBAC) assignments for the security team. The solution must be repeatable, version-controlled, and allow the team to update the defined artifacts and apply updates to existing subscriptions. Which Azure service should the team use to define and deploy this collection of governance artifacts?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it enables the orchestrated deployment of a repeatable set of Azure resources, policies, and RBAC assignments as a single, version-controlled artifact. Unlike Azure Policy alone, Blueprints can include resource templates (e.g., network topology) and RBAC assignments, and it supports updating existing subscriptions by publishing new versions of the blueprint and assigning them to subscriptions.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Manager templates

Question 18

A company is building a mobile app backend that handles HTTP requests from thousands of users. The traffic pattern is highly unpredictable: there can be sudden spikes to hundreds of requests per second followed by long periods of no activity. The development team wants a solution that automatically scales from zero to hundreds of instances based on demand, and they want to pay only for the compute time consumed when the code is actually executing. They do not want to manage any underlying infrastructure, such as virtual machines or containers. Which Azure compute service should they choose?

Accepted Answer

Azure Functions. Azure Functions is the correct choice because it is a serverless compute service that automatically scales from zero to hundreds of instances based on incoming HTTP requests, and you pay only for the compute time consumed when your code executes. It handles unpredictable traffic patterns with sudden spikes and idle periods without requiring any infrastructure management, as it runs on a consumption plan that provides dynamic scaling.

Answer

Azure App Service

Answer

Azure Kubernetes Service (AKS)

Answer

Azure Virtual Machines

Question 19

A company is deploying a business-critical application on Azure virtual machines in the East US region. The application's managed disks must remain available even if an entire Azure datacenter experiences an outage. The company does not require cross-region disaster recovery. Which storage redundancy option should they select for the managed disks?

Accepted Answer

Zone-Redundant Storage (ZRS). Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the East US region, ensuring the managed disks remain available even if an entire datacenter (one zone) fails. This meets the requirement for intra-region resilience without needing cross-region disaster recovery.

Answer

Locally Redundant Storage (LRS)

Answer

Geo-Redundant Storage (GRS)

Answer

Read-Access Geo-Redundant Storage (RA-GRS)

Question 20

A company is designing a disaster recovery solution for a critical application. The solution must ensure that if an entire Azure region becomes unavailable due to a natural disaster, the application can fail over to a different region. The company wants to minimize latency between the primary and secondary regions for data replication. Which Azure feature should the company use?

Accepted Answer

Azure Paired Regions. Azure Paired Regions are designed to provide disaster recovery by replicating data across two geographically separated regions within the same geopolitical boundary. If an entire region fails, the paired region can serve as the failover target, and the physical proximity of paired regions minimizes replication latency compared to arbitrary region pairs.

Answer

Availability Zones

Answer

Azure Resource Manager

Answer

Azure Traffic Manager