AZ-900 Practice Exam 57 — 20 Questions

Question 1

Which cloud benefit helps organizations meet workload demands during unexpected events like viral marketing campaigns without service degradation?

Accepted Answer

Elasticity. Elasticity is the correct answer because it refers to the ability of a cloud system to automatically provision and de-provision resources (such as compute instances, storage, or bandwidth) in real time to match fluctuating demand. During a viral marketing campaign, traffic spikes can be handled by scaling out resources dynamically, ensuring consistent performance without manual intervention or service degradation.

Answer

High availability

Answer

Security

Answer

Predictability

Question 2

Match each Azure identity service to its description.

Accepted Answer

Microsoft Entra ID: Cloud-based identity and access management service for employees and internal users.. Correct matches: Microsoft Entra ID for internal users, Azure AD B2C for customers, Managed Identities for Azure resources. Common confusions include swapping B2C with domain services or managed identities.

Answer

Azure AD B2C: Provides managed domain services like domain join and group policy.

Answer

Managed Identities: Identity service for managing customer identities and sign-up/sign-in.

Question 3

Which Azure service provides a hybrid connection solution for enabling applications to access on-premises resources without inbound firewall changes?

Accepted Answer

Azure Hybrid Connections. Azure Hybrid Connections (part of Azure App Service and Azure Relay) allows applications to securely connect to on-premises resources over port 443 using WebSockets and TLS, without requiring any inbound firewall rules or changes to the on-premises network. This is achieved by establishing an outbound-only tunnel from the on-premises Hybrid Connection Manager to Azure, which then relays traffic to the target resource.

Answer

Azure VPN Gateway

Answer

Azure Private Link

Answer

Azure ExpressRoute

Question 4

Which Azure service provides a virtual private network gateway for connecting on-premises networks to Azure virtual networks over the internet?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct service because it provides a dedicated virtual private network (VPN) gateway that enables secure site-to-site (S2S) or point-to-site (P2S) connectivity between on-premises networks and Azure virtual networks over the public internet using IPsec/IKE protocols. It creates an encrypted tunnel across the internet, making it the appropriate choice for internet-based hybrid connectivity.

Answer

Azure ExpressRoute

Answer

Azure Virtual Network

Answer

Azure Bastion

Question 5

Which benefit of cloud computing allows developers to test and deploy applications globally in minutes?

Accepted Answer

Speed and agility in global deployment. Cloud computing enables rapid global deployment through a distributed infrastructure of data centers and content delivery networks (CDNs). Developers can replicate applications across multiple regions in minutes using automated deployment pipelines and infrastructure-as-code tools, eliminating the need to provision physical servers in each location.

Answer

Economies of scale

Answer

Fault tolerance

Answer

Predictable pricing

Question 6

A company has a single Azure subscription that contains multiple resource groups for different departments. The security team needs to ensure that only members of the 'VM Operators' Azure Active Directory group can create virtual machines in the subscription. All other users, including subscription Owners, must be blocked from creating virtual machines. Which Azure feature should the security team use to enforce this requirement?

Accepted Answer

Azure role-based access control (RBAC). Azure RBAC allows you to assign specific roles (like 'Virtual Machine Contributor') to a security principal (e.g., the 'VM Operators' group) at a scope (the subscription). By granting the 'Virtual Machine Contributor' role only to the 'VM Operators' group and removing any built-in roles that allow VM creation from other users (including Owners), you can ensure that only that group can create VMs. This is the correct mechanism because RBAC is designed for fine-grained, role-based permission management.

Answer

Azure Policy with a deny effect

Answer

Azure Resource Lock at the subscription level

Answer

Azure Blueprints

Question 7

Which tool allows you to automate the creation and management of Azure resources using declarative JSON or Bicep templates?

Accepted Answer

ARM templates / Bicep. ARM templates and Bicep are declarative Infrastructure as Code (IaC) tools that allow you to define Azure resources in JSON or Bicep syntax. They enable repeatable, idempotent deployments by describing the desired state of resources, which Azure Resource Manager then orchestrates to create or update resources accordingly.

Answer

Azure PowerShell

Answer

Azure CLI

Answer

Azure Cloud Shell

Question 8

Which Azure networking service provides private connectivity from a virtual network to Azure PaaS services without traffic going over the internet?

Accepted Answer

Azure Private Link. Azure Private Link (option B) is correct because it exposes Azure PaaS services via private IP addresses within a virtual network, using private endpoints that map the service to a network interface in the VNet. This ensures all traffic to the PaaS service traverses the Microsoft Azure backbone network, never the public internet, providing true private connectivity.

Answer

Azure Service Endpoints

Answer

Azure VNet Peering

Answer

Azure ExpressRoute

Question 9

Which Azure feature helps organizations maintain compliance by managing and auditing privileged access to Azure resources using just-in-time access?

Accepted Answer

Azure AD Privileged Identity Management (PIM). Azure AD Privileged Identity Management (PIM) is the correct answer because it provides just-in-time (JIT) privileged access to Azure resources, enabling organizations to grant time-bound, approval-based roles that reduce standing admin privileges. PIM also generates audit logs for all activations and deactivations, directly supporting compliance requirements by ensuring privileged access is managed and auditable.

Answer

Azure RBAC

Answer

Azure AD Conditional Access

Answer

Azure Key Vault

Question 10

A company runs an e-commerce web application on Azure virtual machines that are part of a virtual machine scale set configured with an autoscale rule based on CPU utilization. During a flash sale, customer traffic surges, causing the average CPU utilization across all instances to exceed 75% for five minutes. The scale set automatically provisions three additional VM instances to handle the increased load. After the sale ends, traffic normalizes, CPU utilization drops below 30%, and the scale set automatically removes the extra instances. This scenario best illustrates which characteristic of cloud computing?

Accepted Answer

Elasticity. Elasticity is the ability of a cloud system to dynamically scale resources up or down based on demand. In this scenario, the virtual machine scale set automatically adds three VM instances when CPU utilization exceeds 75% for five minutes and removes them when utilization drops below 30%, demonstrating rapid, automated scaling to match workload changes.

Answer

High availability

Answer

Fault tolerance

Answer

Disaster recovery

Question 11

A manufacturing company is evaluating whether to migrate its on-premises workloads to Azure. The IT team calculates that the total cost of running the equivalent compute and storage resources in Azure is lower than operating its own datacenter. They attribute this cost advantage to the fact that Azure purchases servers, networking gear, and power in massive quantities and passes the savings on to customers by spreading the fixed costs across a vast number of tenants. This cost-saving benefit is a direct illustration of which cloud computing concept?

Accepted Answer

Economies of scale. The scenario describes a cost advantage that arises because Azure buys hardware and energy in bulk, reducing per-unit costs and spreading fixed expenses across many customers. This is the direct definition of economies of scale, a core cloud concept where large-scale operations lower the average cost per unit, enabling providers to offer services at a lower price than individual organizations could achieve on-premises.

Answer

Resource pooling

Answer

Measured service

Answer

Rapid elasticity

Question 12

A company has a resource group named 'RG-Prod' that contains critical virtual machines (VMs), virtual networks, and a SQL database. The infrastructure team needs to grant a group of developers the ability to start, stop, and restart only the VMs in RG-Prod. The developers must not be able to create new VMs, delete existing VMs, modify the virtual networks, or access the database. The company wants to follow the principle of least privilege. Which Azure role-based access control (RBAC) approach should the company use?

Accepted Answer

Create a custom RBAC role that includes only the specific actions required (e.g., Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action) and assign it to the developers.. The principle of least privilege requires granting only the exact permissions needed. The built-in Virtual Machine Contributor role includes permissions beyond start/stop/restart (e.g., it allows creating and deleting VMs), which violates the requirement. A custom RBAC role scoped to RG-Prod with only the specific actions (Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/restart/action) meets the need precisely.

Answer

Assign the Virtual Machine Contributor built-in role to the developers.

Answer

Assign the Contributor built-in role and then create an Azure Policy to deny any VM creation or deletion and VNet modifications in RG-Prod.

Answer

Assign the Reader role to the developers and use Azure Policy to automatically start, stop, and restart VMs on their behalf.

Question 13

A company has multiple Azure subscriptions, each belonging to a different department. The finance department wants to set spending limits per subscription and receive automated email notifications whenever actual spending reaches 80% of the allocated budget. Which Azure feature should they configure?

Accepted Answer

Azure Budgets. Azure Budgets is the correct feature because it allows you to set spending limits (budgets) on Azure subscriptions or resource groups and configure alerts that trigger automated email notifications when actual spending reaches a specified threshold, such as 80% of the allocated budget. This directly meets the finance department's requirement for per-subscription spending limits and proactive notifications.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Resource Graph

Question 14

Which Azure service provides a SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct answer because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution. It provides intelligent security analytics and threat intelligence across the enterprise, enabling security teams to collect data at cloud scale, detect threats, investigate incidents, and automate responses.

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Answer

Azure Security Center

Question 15

What does Azure Auto-Shutdown for virtual machines provide?

Accepted Answer

Automatic daily power-off of VMs at a configured time to reduce costs. Azure Auto-Shutdown is a cost-saving feature that automatically powers off virtual machines at a user-defined schedule (e.g., nightly at 7 PM). It helps reduce compute costs by ensuring VMs are not running when not needed, but does not delete or modify the VM's configuration or resources.

Answer

Automatic deletion of VMs that haven't been used for 30 days

Answer

Automatic scaling down of VM CPU when under low utilization

Answer

Automatic failover of VMs to another region during outages

Question 16

Which term describes the practice of deploying resources across multiple Azure availability zones to protect against datacenter-level failures?

Accepted Answer

Zone-redundant deployment. Zone-redundant deployment (B) is the correct term because it specifically refers to replicating resources across multiple Azure availability zones within a single Azure region. Availability zones are physically separate datacenters with independent power, cooling, and networking, so deploying across them protects against a single datacenter-level failure while keeping the application within the same low-latency region.

Answer

Geo-redundancy

Answer

Horizontal scaling

Answer

Disaster recovery

Question 17

Which Azure service provides an enterprise messaging service with advanced features like topics, subscriptions, and dead-letter queues?

Accepted Answer

Azure Service Bus. Azure Service Bus is a fully managed enterprise message broker that supports advanced messaging patterns including topics (publish/subscribe), subscriptions (filtered message delivery), and dead-letter queues (for handling undeliverable messages). It is designed for reliable, ordered message delivery with features like sessions, transactions, and duplicate detection, making it the correct choice for this question.

Answer

Azure Queue Storage

Answer

Azure Event Grid

Answer

Azure Event Hubs

Question 18

A company deploys their application across multiple availability zones in an Azure region. This is done to improve which aspect of the application?

Accepted Answer

High availability. Deploying an application across multiple availability zones within an Azure region ensures that if one zone experiences an outage (e.g., due to power failure or network disruption), the application can continue serving traffic from the remaining zones. This architecture directly improves high availability by eliminating a single point of failure at the datacenter level, typically achieving a service-level agreement (SLA) of 99.99% for virtual machines when using two or more instances across zones.

Answer

Scalability

Answer

Elasticity

Answer

Cost efficiency

Question 19

Which Azure service provides managed relational database compatible with open-source PostgreSQL?

Accepted Answer

Azure Database for PostgreSQL. Azure Database for PostgreSQL is a fully managed relational database service specifically built for PostgreSQL, providing high availability, automated backups, and built-in security. It is the correct choice because it directly offers a managed PostgreSQL-compatible database without requiring any middleware or translation layer.

Answer

Azure SQL Managed Instance

Answer

Azure Cosmos DB for PostgreSQL

Answer

Azure SQL Database Hyperscale

Question 20

A company plans to deploy a mission-critical application on three Azure virtual machines. The application must remain available even if an entire Azure datacenter becomes unavailable due to a catastrophic event like a fire or flood. The company wants to deploy the VMs across multiple physical locations within a single Azure region, with each location having independent power, cooling, and networking. Which Azure feature should the company use?

Accepted Answer

Availability zones. Availability zones are physically separate locations within an Azure region, each with independent power, cooling, and networking. By deploying the three VMs across different availability zones, the application remains available even if an entire datacenter (one zone) fails due to a catastrophic event. This meets the requirement for high availability across multiple physical locations within a single region.

Answer

Availability sets

Answer

Azure Site Recovery

Answer

Virtual machine scale sets