AZ-900 Practice Exam 59 — 20 Questions

Question 1

A company is migrating a legacy application to Azure. The application stores data on a network file share that is accessed using the SMB protocol. After migration, multiple Azure virtual machines must be able to mount the same file share simultaneously. The company wants a fully managed service that eliminates the need to maintain a file server. Which Azure storage service should the company use?

Accepted Answer

Azure Files. Azure Files provides fully managed file shares that use the SMB protocol, allowing multiple Azure VMs to mount the same share simultaneously. It eliminates the need to maintain a file server because Microsoft handles the underlying infrastructure, patching, and high availability. This makes it the ideal choice for migrating legacy applications that rely on SMB-based network file shares.

Answer

Azure Blob Storage

Answer

Azure Managed Disks

Answer

Azure Queue Storage

Question 2

A company needs to find all virtual machines that have the tag 'Environment:Production' and were created more than 6 months ago. They want to run a complex query across all subscriptions in their tenant. Which Azure tool should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct tool because it is designed to efficiently query across multiple subscriptions, resource groups, and resource types using the Kusto Query Language (KQL). It can filter virtual machines by the tag 'Environment:Production' and compare the 'createdTime' property to a date six months ago, all in a single, complex query that spans the entire tenant.

Answer

Azure CLI

Answer

Azure PowerShell

Answer

Azure Cost Management

Question 3

A company requires that all resources deployed in a production Azure subscription must include a 'Department' tag. Resources without this tag must be automatically prevented from being created. Which Azure service should the company use to enforce this requirement?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules on your Azure resources. In this scenario, you can define a policy that requires the 'Department' tag on all resources, and configure a deny effect to automatically prevent the creation of any resource that does not include this tag. This ensures compliance at the time of resource creation, without manual intervention.

Answer

Azure Blueprints

Answer

Azure Resource Manager

Answer

Azure Cost Management

Question 4

A company's data engineering team needs to process CSV files that are uploaded to an Azure Blob Storage container. For each uploaded file, the team must run a custom Python script to clean and transform the data. The team wants a solution that automatically triggers the script upon file upload, does not require them to manage any virtual machines or containers, and charges only when code executes. Which Azure service should the team use?

Accepted Answer

Azure Functions. Azure Functions is the correct choice because it provides a serverless compute service that can be triggered directly by an HTTP request or a Blob Storage event (via an Event Grid subscription or a Blob trigger). This allows the custom Python script to execute automatically when a CSV file is uploaded, without provisioning or managing any virtual machines or containers. The consumption plan ensures you are charged only for the duration of code execution, meeting all stated requirements.

Answer

Azure Logic Apps

Answer

Azure Container Instances

Answer

Azure Batch

Question 5

A company runs a containerized application on Azure. They want to use Kubernetes for orchestration but do not want to manage the control plane nodes. They need a managed Kubernetes service. Which Azure service should they choose?

Accepted Answer

Azure Kubernetes Service (AKS). Azure Kubernetes Service (AKS) is the correct choice because it provides a fully managed Kubernetes orchestration service. With AKS, Azure manages the control plane nodes (including the API server, etcd, and scheduler) automatically, so the company does not need to manage them. This meets the requirement for a managed Kubernetes service without control plane management overhead.

Answer

Azure Container Instances

Answer

Azure Container Registry

Answer

Azure App Service

Question 6

A company is moving its on-premises data center to the cloud. Previously, they purchased servers and paid for maintenance. Now they pay a monthly subscription for compute and storage based on actual usage. This is an example of shifting from capital expenditure (CapEx) to which type of expenditure?

Accepted Answer

Operating expenditure (OpEx). This scenario describes a shift from upfront capital investment in physical servers and maintenance (CapEx) to a pay-as-you-go model where costs are incurred based on actual usage. In cloud computing, this is the definition of operating expenditure (OpEx), as the company pays a recurring monthly subscription for compute and storage resources rather than making a large initial purchase.

Answer

Variable expenditure

Answer

Direct expenditure

Answer

Indirect expenditure

Question 7

A company plans to run a large-scale batch processing job on Azure that runs for 10 hours every night. The job is fault-tolerant and can be interrupted. They want to minimize cost as much as possible. Which Azure virtual machine pricing option should they use?

Accepted Answer

Spot VMs. Spot VMs allow you to use unused Azure compute capacity at a significant discount (up to 90% compared to pay-as-you-go). Because the batch job is fault-tolerant and can be interrupted, it is an ideal workload for Spot VMs, which can be evicted when Azure needs the capacity back. This minimizes cost while meeting the job's requirements.

Answer

Reserved Instances

Answer

Pay-as-you-go

Answer

Dedicated Hosts

Question 8

A company plans to migrate a steady-state application to Azure. The application requires a fixed number of virtual machines running 24/7 for the next three years. The company wants to minimize the total cost of ownership for these virtual machines over the three-year period. Which Azure pricing option should the company select when purchasing the virtual machines?

Accepted Answer

Reserved Instances. Reserved Instances (RIs) provide a significant discount (up to 72% compared to pay-as-you-go) in exchange for a one- or three-year commitment. Since the application requires a fixed number of VMs running 24/7 for exactly three years, RIs align perfectly with this predictable, steady-state workload, minimizing total cost of ownership.

Answer

Pay-as-you-go pricing

Answer

Spot Virtual Machines

Answer

Azure Hybrid Benefit

Question 9

A company runs a multi-tier application on Azure virtual machines in a virtual network. The web tier VMs are in a front-end subnet, and the database tier VMs are in a back-end subnet. Currently, outbound internet traffic from the VMs goes directly to the internet without any inspection or logging. The security team needs a centralized service to inspect all outbound traffic from the virtual network, log the destinations, and reject traffic to malicious domains based on threat intelligence feeds. The solution must also allow rules based on fully qualified domain names (FQDNs) instead of only IP addresses. Which Azure service should the security team deploy?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-based network security service that provides centralized outbound traffic inspection, logging, and threat intelligence-based filtering. It supports application rules based on fully qualified domain names (FQDNs), allowing the security team to reject traffic to malicious domains without relying solely on IP addresses. This makes it the correct choice for inspecting and controlling outbound traffic from the virtual network.

Answer

Azure Bastion

Answer

Network Security Group (NSG)

Answer

Application Gateway

Question 10

A company runs a development and testing environment on Azure virtual machines. The environment is only needed during standard business hours (9:00 AM to 5:00 PM), Monday through Friday. The IT team configures an automated schedule that deallocates all VMs at 5:00 PM each weekday and starts them again at 8:00 AM the next morning. The team reports a significant reduction in their monthly Azure bill after implementing this schedule. Which essential characteristic of cloud computing does this scenario primarily demonstrate?

Accepted Answer

Measured service and consumption-based pricing. The scenario demonstrates measured service and consumption-based pricing because Azure charges for VM compute costs only when the VM is in the 'Running' state. Deallocating the VM releases the reserved compute resources, stopping billing for the VM's vCPU and RAM while retaining the disk and other resources. By scheduling deallocation outside business hours, the company pays only for the hours the VMs are actually running, directly reducing costs based on usage.

Answer

Rapid elasticity and scaling

Answer

High availability

Answer

Geographic distribution

Question 11

A company stores billions of image files that are accessed frequently via HTTP from a web application. They need a highly scalable and durable storage solution with global accessibility. Which Azure storage service should they use?

Accepted Answer

Azure Blob Storage. Azure Blob Storage is designed for storing massive amounts of unstructured data, such as image files, and provides HTTP/HTTPS access via REST APIs. It offers high scalability (up to petabytes), durability (99.9999999999% with LRS/RA-GRS), and global accessibility through a globally unique endpoint and optional CDN integration. This makes it the ideal choice for frequently accessed image files in a web application.

Answer

Azure Files

Answer

Azure Queue Storage

Answer

Azure Disk Storage

Question 12

A company's finance team needs to track Azure costs by project. Each resource is tagged with a 'Project' tag, but some resources were created without tags. The finance team wants to generate a report that shows costs grouped by project and also identifies untagged resources. Which Azure tool should they use?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing provides built-in cost analysis capabilities that allow you to group costs by tags (such as 'Project') and filter for untagged resources. It can generate reports that break down spending by tag values and explicitly show costs associated with resources that have no tags, meeting both requirements.

Answer

Azure Budgets

Answer

Azure Advisor

Answer

Azure Resource Graph

Question 13

A company manages a production Azure subscription that contains critical resources. The security team wants to prevent any user, including users with the Owner role, from accidentally deleting the entire subscription or any resource within it. The team still wants authorized users to be able to modify settings and create new resources. Which Azure feature should the team use?

Accepted Answer

Apply a global 'CanNotDelete' resource lock at the subscription scope.. Option B is correct because a 'CanNotDelete' resource lock at the subscription scope prevents any user, including those with the Owner role, from deleting the subscription or any resource within it. This lock overrides all RBAC permissions for delete operations, while still allowing authorized users to modify settings and create new resources, meeting the security team's requirement.

Answer

Create a custom RBAC role that denies the 'Microsoft.Resources/subscriptions/delete' action and assign it to the subscription.

Answer

Configure an Azure Policy that audits delete operations and sends an alert to the security team.

Answer

Create a management group, move the subscription into it, and assign an Azure Policy definition with the 'Deny' effect targeting delete operations.

Question 14

A company runs a legacy database on a single Azure virtual machine. The database is experiencing performance issues as the dataset grows. The IT team decides to increase the virtual machine size from Standard_D2s_v3 (2 vCPUs, 8 GB RAM) to Standard_D8s_v3 (8 vCPUs, 32 GB RAM) to improve performance. This process is an example of which cloud computing concept?

Accepted Answer

Vertical scaling. Vertical scaling (also known as scaling up) involves increasing the capacity of a single resource, such as adding more vCPUs and RAM to an existing virtual machine. In this scenario, the IT team is resizing the Azure VM from Standard_D2s_v3 to Standard_D8s_v3, which increases the compute and memory resources of the same instance. This directly matches the definition of vertical scaling, where performance is improved by upgrading the existing machine rather than adding more machines.

Answer

Horizontal scaling

Answer

Elasticity

Answer

High availability

Question 15

A company needs to ensure that all Azure resources have a mandatory 'CostCenter' tag. If a resource is created without this tag, the resource creation should be blocked. Which Azure Policy effect should they use?

Accepted Answer

Deny. The Deny effect is correct because it actively blocks any resource creation or update that does not comply with the policy rule, such as missing the mandatory 'CostCenter' tag. This ensures that non-compliant resources are never provisioned, enforcing governance at the point of creation.

Answer

Append

Answer

Audit

Answer

DeployIfNotExists

Question 16

A company runs a mission-critical application on Azure virtual machines. The application must remain available even if an entire Azure datacenter in a region experiences a complete outage (e.g., power failure). The company wants all VMs to be located in the same Azure region to minimize latency. Which Azure feature should the company use to deploy the VMs?

Accepted Answer

Availability Zone. Availability Zones (AZs) are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across multiple AZs protects against a single datacenter failure while keeping all resources within the same region to minimize latency. This meets the requirement for high availability during a complete datacenter outage.

Answer

Availability Set

Answer

Resource Group

Answer

Proximity Placement Group

Question 17

A company manages 50 Azure subscriptions that contain thousands of resources. The DevOps team needs to identify all virtual machines that are tagged with 'Environment: Production' across all subscriptions. They need a single query that returns the VM name, resource group, and location for every such VM. The team does not want to write PowerShell commands or loop through each subscription manually. Which Azure service should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph (ARG) is the correct service because it enables efficient, cross-subscription querying of Azure resources using the Kusto Query Language (KQL). With a single ARG query, the DevOps team can filter all virtual machines tagged with 'Environment: Production' across all 50 subscriptions and project only the VM name, resource group, and location, without needing to loop through subscriptions or write PowerShell scripts.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Resource Manager

Question 18

A company runs its production database on an Azure SQL Database (PaaS) and its custom application on an Azure virtual machine (IaaS). The company needs to ensure that operating system security patches are applied. According to the shared responsibility model, which resource requires the company to apply OS patches?

Accepted Answer

Azure virtual machine only. In the shared responsibility model, the customer is responsible for securing the operating system on IaaS resources like Azure virtual machines. Azure SQL Database is a PaaS service where Microsoft manages the underlying OS, including patch management. Therefore, only the Azure virtual machine requires the company to apply OS security patches.

Answer

Azure SQL Database only

Answer

Both Azure SQL Database and the virtual machine

Answer

Neither resource requires the company to apply OS patches

Question 19

A company's field employees use a custom mobile app to upload sales data from their smartphones while at client sites. The app connects to an Azure-hosted backend API. The company's IT team notes that the mobile app can connect to the Azure service using standard HTTPS from any location with internet connectivity, without requiring a VPN. This ability to access cloud resources over the internet from various devices and locations is an example of which key characteristic of cloud computing?

Accepted Answer

Broad network access. Broad network access means cloud resources can be accessed over standard network protocols (like HTTPS) from a wide range of devices (smartphones, laptops, tablets) and locations without requiring a private connection such as a VPN. In this scenario, the mobile app uses HTTPS to reach the Azure backend API from any internet-connected location, which directly matches the NIST definition of broad network access.

Answer

Rapid elasticity

Answer

Measured service

Answer

Resource pooling

Question 20

A company runs a web application on two Azure virtual machines in the same region. The application must be accessible from the internet, and incoming traffic should be distributed evenly across both VMs. Additionally, the company needs to offload Transport Layer Security (TLS) termination to a single service and route requests based on the URL path (e.g., /images to one set of VMs, /api to another). Which Azure service should the company use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 (HTTP/HTTPS) load balancer that supports TLS termination, URL path-based routing, and cookie-based session affinity. This allows the company to offload TLS decryption to a single service and route requests like /images or /api to different backend pools, meeting all stated requirements.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door