AZ-900 Practice Exam 59 — 20 Questions

Question 1

Which Azure service provides distributed tracing across microservices to help developers identify performance bottlenecks and failures?

Accepted Answer

Azure Application Insights. Azure Application Insights is the correct service because it provides distributed tracing, which allows developers to track requests as they travel across multiple microservices. This capability helps identify performance bottlenecks and failures by correlating telemetry from different components, using a correlation ID to link operations. It is part of Azure Monitor and supports OpenTelemetry for standardized instrumentation.

Answer

Azure Log Analytics

Answer

Azure Monitor Metrics

Answer

Azure Sentinel

Question 2

Which Azure service provides source control, CI/CD pipelines, project management, and artifact management in a single platform?

Accepted Answer

Azure DevOps. Azure DevOps is the correct answer because it is a comprehensive Microsoft platform that integrates source control (Git or TFVC), CI/CD pipelines (Azure Pipelines), project management (Azure Boards with Scrum/Kanban), and artifact management (Azure Artifacts) into a single, unified service. This all-in-one approach enables teams to manage the entire application lifecycle without needing separate tools for each function.

Answer

GitHub Enterprise

Answer

Azure App Service

Answer

Azure Resource Manager

Question 3

A company runs a web application that experiences sudden spikes in traffic during promotional events. They want to automatically add more virtual machines during high demand and remove them when traffic subsides, paying only for the resources used. Which cloud computing benefit does this scenario describe?

Accepted Answer

Elasticity. This scenario describes elasticity, which is the ability of a cloud system to automatically provision and de-provision resources (such as virtual machines) in response to real-time demand changes. The key phrase 'automatically add more virtual machines during high demand and remove them when traffic subsides, paying only for the resources used' directly matches the cloud computing benefit of elasticity, where scaling is dynamic and resource usage is metered, ensuring cost efficiency.

Answer

Scalability

Answer

High availability

Answer

Fault tolerance

Question 4

A company has two on-premises data centers connected to each other via a high-speed MPLS link. They plan to migrate several critical workloads to Azure. The network team requires a dedicated, private connection from each on-premises site to Azure that does not traverse the public internet. The connection must provide high bandwidth, low latency, and a Service Level Agreement (SLA) for availability. Which Azure service should the network team provision to meet these requirements?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated, private connection from on-premises data centers to Azure that does not traverse the public internet. It offers high bandwidth, low latency, and a financially backed SLA of 99.95% availability, meeting all the stated requirements for critical workloads.

Answer

Azure VPN Gateway (Site-to-Site)

Answer

Azure Virtual WAN

Answer

Azure Application Gateway

Question 5

In the shared responsibility model for cloud computing, which responsibility always remains with the customer regardless of the cloud service type?

Accepted Answer

Managing data and access identities. Under the shared responsibility model, the customer is always responsible for managing data and access identities, regardless of whether the service is IaaS, PaaS, or SaaS. This includes classifying data, encrypting data at rest and in transit, and configuring identity and access management (IAM) policies. Even in SaaS, where the provider manages the application, the customer must control who has access and how data is protected.

Answer

Managing physical network infrastructure

Answer

Patching the underlying hypervisor

Answer

Maintaining operating system patches

Question 6

A company is evaluating cloud deployment models. They need to keep sensitive data on-premises due to regulations but want to use Azure for development and testing workloads. Which cloud deployment model is most suitable?

Accepted Answer

Hybrid cloud. A hybrid cloud deployment model is most suitable because it combines on-premises infrastructure (private cloud) with public cloud services like Azure. This allows the company to keep sensitive data on-premises to meet regulatory compliance while leveraging Azure for development and testing workloads, which do not have the same data residency constraints.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 7

Which Azure storage feature enables you to recover previous versions of blob files that were accidentally deleted or overwritten?

Accepted Answer

Blob versioning and soft delete. Blob versioning and soft delete work together to protect blob data. Soft delete retains deleted blobs for a specified retention period, while versioning automatically saves previous versions of blobs when they are overwritten or deleted. This allows you to recover blob files to any previous state, directly addressing the scenario of accidental deletion or overwrite.

Answer

Azure Backup for Blob Storage

Answer

Azure Site Recovery for storage

Answer

Geo-redundant storage (GRS)

Question 8

A company needs to grant a specific user the ability to restart virtual machines in a specific resource group, but not to create, delete, or modify them in any other way. The built-in 'Virtual Machine Contributor' role grants too many permissions. What is the most appropriate solution?

Accepted Answer

Assign the 'Reader' role and create a custom RBAC role with only the 'Microsoft.Compute/virtualMachines/restart/action' permission. It combines the 'Reader' role (which allows read-only access to all resources) with a custom RBAC role that grants only the specific 'Microsoft.Compute/virtualMachines/restart/action' permission. This ensures the user can restart VMs in the target resource group without being able to create, delete, or modify them, meeting the exact requirement.

Answer

Assign the 'Virtual Machine Operator' built-in role

Answer

Create a custom role with 'Contributor' and then add a deny assignment for delete and create

Answer

Assign the 'Owner' role and then remove permissions

Question 9

A company deploys a web application on Azure Virtual Machines across multiple availability zones within a single region. They need to distribute incoming network traffic across these VM instances to ensure high availability. Which Azure service should they use?

Accepted Answer

Azure Load Balancer. Azure Load Balancer is the correct choice because it operates at Layer 4 (TCP/UDP) and distributes incoming traffic across healthy virtual machines within a single region, including across availability zones. It provides high availability by automatically routing traffic only to healthy VM instances based on health probes, and it supports both public and internal load balancing scenarios.

Answer

Azure Application Gateway

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 10

A company deploys virtual machines in Azure. They want to ensure that the VMs are distributed across multiple fault domains and update domains within an Azure datacenter to protect against hardware failures and maintenance. Which Azure construct should they use?

Accepted Answer

A) Availability Set. An Availability Set is the correct Azure construct because it logically groups VMs to protect against both hardware failures (via fault domains) and planned maintenance (via update domains) within a single Azure datacenter. Fault domains distribute VMs across separate racks with independent power, cooling, and network, while update domains ensure VMs in different groups are not rebooted simultaneously during Azure host updates. This directly matches the requirement to isolate VMs across multiple fault and update domains within a datacenter.

Answer

B) Availability Zone

Answer

C) Region Pair

Answer

D) Resource Group

Question 11

Which Azure service provides a fully managed, serverless data warehouse for enterprise analytics with massive parallel processing?

Accepted Answer

Azure Synapse Analytics. Azure Synapse Analytics (formerly SQL Data Warehouse) is the correct answer because it is a fully managed, serverless data warehouse that uses massive parallel processing (MPP) to run complex queries across large datasets. It separates compute from storage, allowing you to scale compute resources independently and pause them when not in use, which is ideal for enterprise analytics workloads.

Answer

Azure SQL Database

Answer

Azure Cosmos DB

Answer

Azure HDInsight

Question 12

Which Azure feature allows you to prevent accidental deletion or modification of critical Azure resources?

Accepted Answer

Azure Resource Locks. Azure Resource Locks are designed to prevent accidental deletion or modification of critical Azure resources by applying a lock at the subscription, resource group, or resource level. There are two types: CanNotDelete (prevents deletion but allows modifications) and ReadOnly (prevents both deletion and modification). This directly addresses the scenario of protecting resources from unintended changes.

Answer

Azure RBAC

Answer

Azure Policy

Answer

Azure Blueprints

Question 13

A company's security team needs to audit all virtual machines (VMs) that have a public IP address directly attached, across more than 50 Azure subscriptions organized under several management groups. The team wants to run a single query to get a list of these VMs along with the subscription and resource group details. The solution must provide fast results without the need to write custom scripts or iterate through each subscription individually. Which Azure service should the team use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph (ARG) is the correct choice because it provides a powerful, queryable interface (using Kusto Query Language, KQL) that can search across all Azure subscriptions, management groups, and resource groups in a single query. It can quickly return a list of VMs with public IPs attached, along with their subscription and resource group metadata, without requiring custom scripts or iterative loops. This directly meets the requirement for fast, cross-subscription auditing with minimal overhead.

Answer

Azure Policy

Answer

Azure Monitor

Answer

Azure Resource Manager

Question 14

A company wants to ensure that all Azure resources they deploy are created in the Europe West region to comply with data sovereignty requirements. They want to block creation of resources in any other region. Which Azure service should they use?

Accepted Answer

Azure Policy with allowed locations. Azure Policy with the 'allowed locations' built-in policy definition can enforce that all resources are deployed only in the Europe West region. When assigned to a subscription or resource group scope, this policy denies any resource creation outside the specified regions, directly meeting the data sovereignty requirement.

Answer

Resource groups

Answer

Management groups

Answer

Azure Blueprints

Question 15

A company is migrating a web application to Azure. The web tier will run on Azure App Service (PaaS) and the database tier will use Azure SQL Database (PaaS). The company's IT team wants to understand their patching responsibilities for the underlying operating system (OS) of each service. According to the shared responsibility model, which statement is correct?

Accepted Answer

Microsoft is responsible for patching the operating system of both Azure App Service and Azure SQL Database.. In the shared responsibility model, Microsoft manages the underlying infrastructure for Platform as a Service (PaaS) services. Both Azure App Service and Azure SQL Database are PaaS offerings, meaning Microsoft handles OS patching, updates, and security for the host OS. The customer is responsible only for their application code and data, not the OS. Therefore, option D is correct.

Answer

The customer is responsible for patching the operating system of both Azure App Service and Azure SQL Database.

Answer

Microsoft is responsible for patching the operating system of Azure App Service, and the customer is responsible for patching the operating system of Azure SQL Database.

Answer

The customer is responsible for patching the operating system of Azure App Service, and Microsoft is responsible for patching the operating system of Azure SQL Database.

Question 16

A company plans to deploy two Azure virtual machines that host a critical web application. Both VMs will be in the same Azure region and the same virtual network. The company’s requirements are: 1) During Azure platform-initiated maintenance (e.g., OS updates), at least one VM must remain running. 2) If a hardware failure occurs in the server rack that hosts one VM, the other VM must not be affected. 3) The solution must not incur additional costs beyond the VMs themselves. Which Azure feature should the company configure?

Accepted Answer

Availability Set. An Availability Set distributes VMs across multiple fault domains (different server racks with independent power and networking) and update domains (groups that undergo platform maintenance sequentially). This ensures that during Azure-initiated maintenance, only one update domain is rebooted at a time, leaving at least one VM running, and that a hardware failure in one fault domain does not affect VMs in other fault domains. Availability Sets are free of charge beyond the cost of the VMs themselves, meeting all requirements.

Answer

Availability Zones

Answer

Azure Site Recovery

Answer

Azure Load Balancer

Question 17

A company runs a critical line-of-business application on a single on-premises server. The company is migrating the application to Azure and wants to minimize downtime if the server hardware fails. The architect proposes deploying the application on two Azure virtual machines (VMs) in the same region, placed in an availability set. This configuration is designed to ensure that if one VM fails due to hardware failure or planned maintenance, the other VM remains running and the application stays available. Which cloud computing concept does this configuration primarily illustrate?

Accepted Answer

High availability. High availability (HA) is the correct concept because the configuration uses two VMs in an availability set to ensure the application remains accessible despite hardware failures or planned maintenance. An availability set distributes VMs across fault domains and update domains, guaranteeing that at least one VM stays operational during Azure platform events. This directly aligns with HA's goal of minimizing downtime and maximizing uptime for critical workloads.

Answer

Fault tolerance

Answer

Disaster recovery

Answer

Elasticity

Question 18

A company subscribes to a SaaS-based customer relationship management (CRM) application hosted in the cloud. The CRM provider manages the application, runtime, and infrastructure. The company's employees access the CRM via a web browser. According to the shared responsibility model, which security responsibility belongs solely to the company?

Accepted Answer

Safeguarding the company's customer data and user identities.. In a SaaS model, the provider manages the application, runtime, and infrastructure, including patching the OS and physical security. The customer retains responsibility for what they bring into the cloud: their data and user identities. Option C is correct because safeguarding customer data and managing user identities (e.g., via Microsoft Entra ID) is solely the company's responsibility under the shared responsibility model.

Answer

Patching the underlying operating system of the CRM servers.

Answer

Managing network access controls to the CRM application.

Answer

Ensuring physical security of the data centers hosting the CRM.

Question 19

A company is developing a REST API that processes incoming HTTP requests. The API usage is highly unpredictable; sometimes it receives thousands of requests per minute, and at other times it receives zero requests for hours. The company wants to pay only for the compute time consumed when the API code is actually executing. They also want Microsoft to automatically handle scaling and maintenance of the underlying server infrastructure. Which Azure compute service should the company use?

Accepted Answer

Azure Functions (Consumption plan). Azure Functions with the Consumption plan is the correct choice because it is a serverless compute service that executes code only when triggered by incoming HTTP requests, automatically scaling to handle unpredictable workloads. The Consumption plan charges only for the compute time consumed during execution, with no cost when the function is idle, and Microsoft fully manages the underlying infrastructure, including scaling and maintenance.

Answer

Azure App Service (Basic tier)

Answer

Azure Container Instances

Answer

Azure Logic Apps

Question 20

A multinational company uses Azure management groups to organize its subscriptions. The company has a root management group (tenant root group) containing three child management groups: 'Finance', 'HR', and 'IT'. Each child management group contains multiple subscriptions. The global governance team needs to enforce an Azure Policy that restricts all resource deployments across every subscription in the organization to only the 'West US' and 'East US' regions. The policy must automatically apply to any new subscriptions that are created under any management group in the future. The team wants to assign the policy once and have it affect all current and future subscriptions with minimal administrative overhead. At which Azure scope should the team assign the policy?

Accepted Answer

The root management group. Assigning the policy to the root management group ensures it is inherited by all child management groups (Finance, HR, IT) and their subscriptions, including any new subscriptions created in the future. This approach enforces the allowed regions policy across the entire tenant with a single assignment, minimizing administrative overhead. Azure Policy inheritance flows from the root management group down through all levels of the hierarchy.

Answer

Each subscription individually

Answer

Each child management group (Finance, HR, IT) individually

Answer

A single resource group