AZ-900 Practice Exam 58 — 20 Questions

Question 1

A company wants to ensure that all new Azure resources in a subscription are automatically tagged with a 'Department' tag. Which Azure service should they use to enforce this requirement?

Accepted Answer

Azure Policy. Azure Policy is correct because it allows you to create, assign, and manage policies that enforce specific rules on your Azure resources. In this scenario, you can use a built-in or custom policy definition to require a 'Department' tag on all new resources, and Azure Policy will automatically evaluate and enforce this rule during resource creation, preventing non-compliant resources from being provisioned.

Answer

Azure Blueprints

Answer

Azure RBAC

Answer

Azure Resource Lock

Question 2

A company runs a global e-commerce platform. During a flash sale, demand surges from 10,000 users to 500,000 users in minutes. The platform automatically provisions additional servers to handle the load and deprovisions them after the sale. Which cloud characteristic is most directly demonstrated?

Accepted Answer

Elasticity. Elasticity is the ability of a cloud system to automatically scale resources up or down based on demand. In this scenario, the platform provisions additional servers during the flash sale and deprovisions them afterward, directly demonstrating elasticity. This contrasts with other characteristics like high availability, which focuses on uptime, not dynamic scaling.

Answer

High availability

Answer

Fault tolerance

Answer

Geographic distribution

Question 3

Which Azure tool enables administrators to run PowerShell or Bash commands to manage Azure resources directly from a web browser without installing any tools locally?

Accepted Answer

Azure Cloud Shell. Azure Cloud Shell is a browser-accessible shell environment that provides both PowerShell and Bash interfaces, allowing administrators to run commands against Azure resources without any local installation. It authenticates automatically via the Azure portal session and includes pre-installed tools like Azure CLI, AzCopy, and kubectl, making it the correct answer for managing Azure resources directly from a web browser.

Answer

Azure portal dashboard

Answer

Azure DevOps

Answer

Azure Mobile App

Question 4

Which Azure RBAC built-in role allows a user to view all resources but NOT make any changes?

Accepted Answer

Reader. The Reader role is the correct answer because it grants read-only access to all Azure resources, including their properties and status, but explicitly prevents any modifications, deletions, or creations. This aligns directly with the requirement to view resources without making changes.

Answer

Contributor

Answer

Owner

Answer

User Access Administrator

Question 5

A company wants to ensure that their cloud provider's physical data centers are located in specific geographic areas to comply with data residency requirements. Which cloud concept is this related to?

Accepted Answer

Data sovereignty. Data sovereignty is the concept that data is subject to the laws and regulations of the country or region where it is physically stored. By ensuring their cloud provider's data centers are located in specific geographic areas, the company is directly addressing data sovereignty requirements to comply with local data residency laws, such as GDPR in Europe or the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada.

Answer

Availability

Answer

Disaster recovery

Answer

Hybrid cloud

Question 6

Which Azure security service provides a cloud-native firewall with built-in high availability and unrestricted cloud scalability?

Accepted Answer

Azure Firewall. Azure Firewall is a cloud-native, stateful firewall as a service that provides built-in high availability and scales automatically to accommodate changing network traffic patterns. Unlike other options, it is designed specifically as a managed firewall service with unrestricted cloud scalability, supporting both inbound and outbound traffic filtering at the network and application layers.

Answer

Network Security Groups

Answer

Azure WAF

Answer

Azure DDoS Protection

Question 7

How does cloud computing help with disaster recovery compared to traditional on-premises approaches?

Accepted Answer

Cloud enables geographic redundancy and automated failover at lower cost than traditional DR. Cloud computing supports disaster recovery by enabling geographic redundancy and automated failover across multiple Azure regions at a fraction of the cost of building and maintaining a secondary on-premises data center. Services like Azure Site Recovery and Azure Traffic Manager allow organizations to replicate workloads and automatically redirect traffic to a secondary region during an outage, reducing both recovery time objective (RTO) and recovery point objective (RPO) without the capital expenditure of a dedicated DR site.

Answer

Cloud eliminates the need for disaster recovery planning entirely

Answer

Cloud disaster recovery always provides faster recovery than on-premises DR

Answer

Cloud providers guarantee zero data loss in the event of a disaster

Question 8

A manufacturing company is building a web-based dashboard to display real-time production metrics from sensors. The development team wants to deploy the application without managing the underlying infrastructure, including the web server and operating system. The application uses ASP.NET Core. Which Azure service should they use?

Accepted Answer

Azure App Service. Azure App Service is the correct choice because it provides a fully managed platform for hosting web applications, including ASP.NET Core, without requiring the user to manage the underlying web server or operating system. It supports continuous deployment, auto-scaling, and built-in load balancing, making it ideal for a real-time dashboard that needs high availability and minimal operational overhead.

Answer

Azure Functions

Answer

Azure Kubernetes Service (AKS)

Answer

Azure Virtual Machines

Question 9

Which Azure service provides centralized log collection, querying, and analysis from multiple Azure resources and services?

Accepted Answer

Azure Log Analytics. Azure Log Analytics is the correct answer because it is the primary Azure service designed for centralized log collection, querying, and analysis across multiple Azure resources and services. It uses a powerful query language (Kusto Query Language, KQL) to aggregate and analyze data from various sources, including Azure Monitor, virtual machines, and custom logs, providing a unified workspace for troubleshooting and monitoring.

Answer

Azure Application Insights

Answer

Azure Service Health

Answer

Azure Network Watcher

Question 10

A multinational company runs a web application that must serve users from around the world with low latency. The application is deployed in multiple Azure regions. The company also requires built-in protection against distributed denial-of-service (DDoS) attacks at the network layer. The solution must automatically route users to the closest healthy endpoint based on geographic location. Which Azure service should the company use?

Accepted Answer

Azure Front Door. Azure Front Door is correct because it provides global load balancing with automatic routing to the closest healthy endpoint based on geographic location (latency-based routing), and it includes built-in DDoS protection at the network layer (L3/L4) as part of the Azure infrastructure. This combination of global routing and integrated DDoS mitigation directly matches the requirements for a multinational application serving users worldwide.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Question 11

Which Azure pricing option offers the GREATEST discount compared to pay-as-you-go pricing for a stable, predictable workload that will run continuously for one year?

Accepted Answer

Azure Reserved VM Instances. Azure Reserved VM Instances provide a significant discount (up to 72%) over pay-as-you-go pricing when you commit to a one-year or three-year term. For a stable, predictable workload that runs continuously for one year, this option offers the greatest savings because it is specifically designed for long-term, steady-state usage.

Answer

Azure Spot VMs

Answer

Azure Hybrid Benefit

Answer

Azure Dev/Test pricing

Question 12

A company has multiple on-premises sites that need to connect to Azure over high-throughput, low-latency private connections. They want a dedicated private connection that does not traverse the internet. Which Azure service should they use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated private connection from on-premises sites to Azure that does not traverse the public internet, ensuring high throughput and low latency. It uses a Layer 3 VPN or direct peering via a connectivity provider, bypassing internet-based routing entirely. This makes it ideal for scenarios requiring consistent performance and security for hybrid connectivity.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Peering Service

Question 13

A manufacturing company wants to process IoT sensor data locally at their factory floor to reduce latency before sending summarized data to the cloud. Which cloud computing concept does this represent?

Accepted Answer

Edge computing. Edge computing is the correct concept because it involves processing data near the source (the factory floor) rather than sending it to a centralized cloud data center. This reduces latency by performing initial analysis locally, with only summarized results transmitted to the cloud. The scenario explicitly describes local processing to minimize delay, which is the core purpose of edge computing.

Answer

Hybrid cloud

Answer

Public cloud

Answer

Disaster recovery

Question 14

Which Azure service provides a fully managed, cloud-based data integration service for creating data-driven workflows?

Accepted Answer

Azure Data Factory. Azure Data Factory (ADF) is a fully managed, cloud-based data integration service that allows you to create, schedule, and orchestrate data-driven workflows (pipelines). It supports over 90 built-in connectors to ingest, transform, and move data across on-premises and cloud sources, making it the correct choice for this scenario.

Answer

Azure Synapse Analytics

Answer

Azure Databricks

Answer

Azure Stream Analytics

Question 15

A company operates a global e-commerce API that serves customers worldwide. The development team needs a solution that provides the following capabilities: global load balancing across deployed instances in multiple Azure regions, web application firewall (WAF) protection against common exploits like SQL injection and cross-site scripting, TLS termination at the edge to reduce backend processing, and caching of static API responses to improve response times for repeated requests. The team wants a single Azure service that integrates all these features natively. Which Azure service should they use?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it is a global, scalable entry point that natively integrates global load balancing, web application firewall (WAF) protection, TLS termination at the edge, and caching of static API responses. Unlike other services, Front Door provides all these capabilities in a single, unified service, making it ideal for a global e-commerce API that requires both security and performance optimization across multiple Azure regions.

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Answer

Azure Content Delivery Network (CDN)

Question 16

A company stores sensitive customer data in an Azure Blob Storage account. The company's security policy requires that all data traffic between the virtual network (VNet) and the storage account must never traverse the public internet. Additionally, the storage account must remain accessible from an on-premises data center through a Site-to-Site VPN connection. Which Azure feature should the company configure on the storage account?

Accepted Answer

Azure Private Link (using a private endpoint). Azure Private Link with a private endpoint is correct because it assigns a private IP address from the VNet to the storage account, ensuring all traffic between the VNet and the storage account stays within the Microsoft Azure backbone network and never traverses the public internet. Additionally, the storage account can still be accessed from an on-premises data center via a Site-to-Site VPN connection that terminates in the same VNet, as the private endpoint is reachable over the VPN.

Answer

Azure service endpoints

Answer

Azure VPN Gateway connection to the storage account

Answer

Azure route tables

Question 17

A retail company migrates its e-commerce platform to Azure Virtual Machines. The workload is seasonal, with high traffic during holiday sales and low traffic otherwise. To manage costs, the IT team configures Azure Automation to power off VMs during low-traffic periods and power them back on when demand increases. The company's monthly bill reflects charges only for the hours each VM was actually running; no charges are incurred for the time the VMs were in the 'Stopped (deallocated)' state. This consumption-based billing model is a direct example of which fundamental characteristic of cloud computing?

Accepted Answer

Measured service. The scenario describes a consumption-based billing model where charges are incurred only for the hours each VM is actually running, and no charges apply when VMs are in the 'Stopped (deallocated)' state. This directly exemplifies the 'measured service' characteristic of cloud computing, where resource usage (e.g., compute hours) is metered and billed based on actual consumption, enabling pay-as-you-go pricing.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

Broad network access

Question 18

Which Azure service acts as a reverse proxy with Web Application Firewall (WAF) capabilities to protect web applications from common web exploits?

Accepted Answer

Azure Application Gateway with WAF. Azure Application Gateway with WAF is the correct choice because it operates as a Layer 7 reverse proxy, inspecting HTTP/HTTPS traffic and using a Web Application Firewall (WAF) to block common exploits such as SQL injection and cross-site scripting (XSS). The WAF is based on the OWASP Core Rule Set (CRS), providing centralized protection for web applications.

Answer

Azure Firewall

Answer

Network Security Groups

Answer

Azure DDoS Protection

Question 19

According to Microsoft, which factor does NOT affect the SLA percentage for an Azure service?

Accepted Answer

The number of users concurrently accessing the service. The SLA percentage for an Azure service is determined by factors such as redundancy, fault tolerance, and resource configuration, not by the number of concurrent users. Microsoft's SLAs are based on uptime guarantees tied to architectural choices like availability zones, disk types, and availability sets, while user load is managed through scaling and is not a factor in the SLA calculation.

Answer

Whether resources are deployed across availability zones

Answer

Whether Premium SSD or Standard HDD disks are used for VMs

Answer

Whether a single VM or availability set is used

Question 20

A company uses Azure Blueprints to define a standard environment. They publish a new version of the blueprint with an updated role assignment. All existing subscriptions that were created from an older version need to receive the new role assignment. What should they do?

Accepted Answer

Use the 'Update existing assignments' option. Azure Blueprints provides a built-in 'Update existing assignments' option that propagates changes from a published blueprint version to all existing assigned subscriptions. This ensures that updated role assignments are applied without manual intervention, maintaining consistency across the environment.

Answer

Reassign the blueprint to each subscription manually

Answer

The blueprint updates automatically

Answer

Manually add the role assignment to each subscription