AZ-900 Practice Exam 60 — 20 Questions

Question 1

A company uses Azure Resource Manager templates to deploy infrastructure. They need to manage secrets such as database connection strings and passwords securely. Which Azure service should they use to store and retrieve these secrets during deployment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A) Azure Key Vault. Azure Key Vault is the correct service because it is designed specifically to securely store and manage secrets such as database connection strings, passwords, and certificates. During Azure Resource Manager (ARM) template deployments, you can reference Key Vault secrets directly in the template using a linked template or a parameter file, allowing the secrets to be retrieved at deployment time without exposing them in plaintext. This integration ensures that sensitive values are never hardcoded or stored in source control.

Answer

B) Azure Policy

Answer

C) Azure Managed Identity

Answer

D) Azure Service Principal

Question 2

A company runs a web application on an Azure virtual machine. The application experiences periodic traffic surges during promotional campaigns. To handle the increased load, the IT team manually changes the VM size from Standard_D2s_v3 to Standard_D8s_v3 before each campaign and then changes it back after the campaign ends. Which cloud computing concept does this scenario exemplify?

Accepted Answer

Scalability. This scenario exemplifies scalability, specifically vertical scaling (scaling up), because the IT team manually increases the VM size to handle higher demand and then reduces it afterward. Scalability is the ability to adjust resources to meet changing workload demands, which is exactly what occurs when changing from Standard_D2s_v3 to Standard_D8s_v3.

Answer

Elasticity

Answer

High availability

Answer

Disaster recovery

Question 3

A company operates a fleet of on-premises servers running legacy applications. Due to strict regulatory compliance requirements, these servers cannot be migrated to Azure. However, the IT team wants to centrally manage these servers using Azure tools, including applying Azure Policy to enforce configuration standards and using Azure Monitor for log collection and performance monitoring. The team needs to treat these on-premises servers as Azure resources without moving them. Which Azure service should the company use?

Accepted Answer

Azure Arc. Azure Arc is the correct service because it extends Azure Resource Manager (ARM) and Azure management plane to on-premises servers, allowing them to be treated as Azure resources without migration. With Azure Arc, you can apply Azure Policy to enforce configuration standards and use Azure Monitor for log collection and performance monitoring on these servers, meeting the regulatory compliance requirement of keeping them on-premises.

Answer

Azure Stack Edge

Answer

Azure Site Recovery

Answer

Azure Policy

Question 4

A company has two Azure virtual networks: VNet-A in the East US region and VNet-B in the West US region. Both virtual networks use non-overlapping IP address spaces and are deployed in different resource groups. The company needs to enable communication between resources in VNet-A and VNet-B using private IP addresses only, with low latency and without any traffic traversing the public internet. The solution must not require deploying a virtual network gateway or any additional network appliance. Which Azure service should the company use?

Accepted Answer

Azure Virtual Network Peering. Azure Virtual Network Peering connects VNet-A and VNet-B directly over the Microsoft backbone network, enabling private IP communication with low latency and no public internet traversal. It requires no virtual network gateway or additional appliances, and works across regions (global peering) as long as IP address spaces are non-overlapping.

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Answer

Azure Load Balancer

Question 5

What is the purpose of Azure Load Balancer?

Accepted Answer

To distribute incoming network traffic across multiple backend resources. Azure Load Balancer operates at Layer 4 (TCP/UDP) of the OSI model to distribute incoming traffic across healthy backend resources, such as virtual machines or instances in a backend pool. It uses a hash-based distribution algorithm (5-tuple hash for inbound traffic) to ensure high availability and scalability by spreading requests evenly. This directly supports fault tolerance by automatically routing traffic away from unhealthy instances based on health probes.

Answer

To cache web content at edge locations globally

Answer

To connect on-premises networks to Azure

Answer

To manage domain names and DNS routing

Question 6

Which Azure service provides a way to create, test, and manage APIs, including rate limiting, authentication, and analytics?

Accepted Answer

Azure API Management. Azure API Management is a fully managed service that enables you to publish, secure, transform, maintain, and monitor APIs. It provides built-in capabilities for rate limiting (throttling), authentication (via OAuth 2.0, client certificates, or IP filtering), and analytics (through Azure Monitor and Application Insights), making it the correct choice for creating, testing, and managing APIs with these features.

Answer

Azure Functions

Answer

Azure Application Gateway

Answer

Azure Service Bus

Question 7

A global company wants to organize its Azure resources by department and project. They need to enforce cost allocation and apply governance policies consistently across all subscriptions. Which two Azure features should they use together? (Select two.)

Accepted Answer

Management groups. Management groups (B) are correct because they provide a hierarchical structure above subscriptions, enabling consistent governance and policy assignment across multiple subscriptions. Tags (C) are correct because they allow you to attach metadata (e.g., department and project) to resources for cost allocation and organization. Together, management groups enforce policies at scale, while tags enable granular cost tracking and reporting.

Answer

Resource groups

Answer

Azure Policies

Question 8

A company uses Azure to host a web application. At the end of each month, the finance team receives an invoice that details charges for compute hours, storage consumption, and outbound data transfer. The IT manager explains that this granular billing is possible because Azure continuously monitors resource usage and provides detailed usage data for cost allocation. This capability is a direct example of which essential characteristic of cloud computing as defined by the National Institute of Standards and Technology (NIST)?

Accepted Answer

Measured service. Measured service, because the scenario describes Azure's ability to continuously monitor resource usage (compute hours, storage, data transfer) and provide detailed billing data. This aligns with NIST's definition of measured service, where cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). The granular invoice is a direct output of this metering and reporting feature.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 9

A company runs a latency-sensitive application on Azure virtual machines and needs to connect its on-premises data center to Azure. The connection must offer high reliability, predictable performance, and a service-level agreement (SLA) from the connectivity provider. It must also bypass the public internet for security and performance reasons. Which Azure service should the company use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute is the correct choice because it provides a dedicated, private connection from the on-premises data center to Azure that bypasses the public internet entirely. This ensures high reliability, predictable performance (low latency and jitter), and a financially backed SLA of up to 99.95% availability. For latency-sensitive applications, ExpressRoute offers consistent network performance that VPNs over the internet cannot guarantee.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Application Gateway

Question 10

A company's finance team wants to proactively monitor Azure spending and receive automated email notifications when costs reach 80% of a predefined monthly limit. They want to avoid manual cost tracking and set up alerts without custom scripting. Which Azure feature should they use?

Accepted Answer

Create a budget in Azure Cost Management with an alert at 80% of the budget amount.. Azure Cost Management budgets allow you to set a spending limit and configure alert thresholds (e.g., 80%) that trigger automated email notifications when costs reach that percentage. This meets the finance team's requirement for proactive monitoring without custom scripting or manual tracking.

Answer

Use Azure Advisor cost recommendations and configure an alert on the recommendations.

Answer

Configure an Azure Policy with a deny effect to block any spending that exceeds the monthly limit.

Answer

Use the Azure Pricing Calculator to estimate costs and set a manual reminder to check the Azure portal each month.

Question 11

A company deploys an Azure SQL Database. The company is billed based on the amount of data stored and the number of transactions per second (DTUs). At the end of each month, the company receives an invoice that itemizes the exact usage and the corresponding charges. Which of the five essential characteristics of cloud computing does this billing model primarily demonstrate?

Accepted Answer

Measured service. The billing model for Azure SQL Database, which itemizes usage based on data stored and transactions per second (DTUs), directly demonstrates the 'Measured service' characteristic. This is because cloud providers meter and charge for resource consumption (storage and DTUs) with pay-per-use billing, providing transparency for both the provider and consumer. The detailed invoice showing exact usage and charges is the hallmark of measured service, where usage is monitored, controlled, and reported.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 12

Which Azure service provides distributed tracing across microservices to help developers identify performance bottlenecks and failures?

Accepted Answer

Azure Application Insights. Azure Application Insights is the correct service because it provides distributed tracing, which allows developers to track requests as they travel across multiple microservices. This capability helps identify performance bottlenecks and failures by correlating telemetry from different components, using a correlation ID to link operations. It is part of Azure Monitor and supports OpenTelemetry for standardized instrumentation.

Answer

Azure Log Analytics

Answer

Azure Monitor Metrics

Answer

Azure Sentinel

Question 13

Which Azure service provides source control, CI/CD pipelines, project management, and artifact management in a single platform?

Accepted Answer

Azure DevOps. Azure DevOps is the correct answer because it is a comprehensive Microsoft platform that integrates source control (Git or TFVC), CI/CD pipelines (Azure Pipelines), project management (Azure Boards with Scrum/Kanban), and artifact management (Azure Artifacts) into a single, unified service. This all-in-one approach enables teams to manage the entire application lifecycle without needing separate tools for each function.

Answer

GitHub Enterprise

Answer

Azure App Service

Answer

Azure Resource Manager

Question 14

A company wants to deploy a web application that automatically scales based on traffic, without managing any virtual machines. They need high availability and support for multiple development frameworks. Which Azure service should they use?

Accepted Answer

Azure App Service. Azure App Service is a fully managed Platform-as-a-Service (PaaS) offering that automatically scales web applications based on traffic using built-in autoscale rules, without requiring any virtual machine management. It provides high availability through its SLA-backed multi-instance deployment and supports multiple development frameworks including .NET, Java, Node.js, Python, and PHP, making it the ideal choice for this scenario.

Answer

Azure Virtual Machines

Answer

Azure Functions

Answer

Azure Kubernetes Service

Question 15

A company runs a web application that experiences sudden spikes in traffic during promotional events. They want to automatically add more virtual machines during high demand and remove them when traffic subsides, paying only for the resources used. Which cloud computing benefit does this scenario describe?

Accepted Answer

Elasticity. This scenario describes elasticity, which is the ability of a cloud system to automatically provision and de-provision resources (such as virtual machines) in response to real-time demand changes. The key phrase 'automatically add more virtual machines during high demand and remove them when traffic subsides, paying only for the resources used' directly matches the cloud computing benefit of elasticity, where scaling is dynamic and resource usage is metered, ensuring cost efficiency.

Answer

Scalability

Answer

High availability

Answer

Fault tolerance

Question 16

A company has two on-premises data centers connected to each other via a high-speed MPLS link. They plan to migrate several critical workloads to Azure. The network team requires a dedicated, private connection from each on-premises site to Azure that does not traverse the public internet. The connection must provide high bandwidth, low latency, and a Service Level Agreement (SLA) for availability. Which Azure service should the network team provision to meet these requirements?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated, private connection from on-premises data centers to Azure that does not traverse the public internet. It offers high bandwidth, low latency, and a financially backed SLA of 99.95% availability, meeting all the stated requirements for critical workloads.

Answer

Azure VPN Gateway (Site-to-Site)

Answer

Azure Virtual WAN

Answer

Azure Application Gateway

Question 17

In the shared responsibility model for cloud computing, which responsibility always remains with the customer regardless of the cloud service type?

Accepted Answer

Managing data and access identities. Under the shared responsibility model, the customer is always responsible for managing data and access identities, regardless of whether the service is IaaS, PaaS, or SaaS. This includes classifying data, encrypting data at rest and in transit, and configuring identity and access management (IAM) policies. Even in SaaS, where the provider manages the application, the customer must control who has access and how data is protected.

Answer

Managing physical network infrastructure

Answer

Patching the underlying hypervisor

Answer

Maintaining operating system patches

Question 18

A company is evaluating cloud deployment models. They need to keep sensitive data on-premises due to regulations but want to use Azure for development and testing workloads. Which cloud deployment model is most suitable?

Accepted Answer

Hybrid cloud. A hybrid cloud deployment model is most suitable because it combines on-premises infrastructure (private cloud) with public cloud services like Azure. This allows the company to keep sensitive data on-premises to meet regulatory compliance while leveraging Azure for development and testing workloads, which do not have the same data residency constraints.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 19

An organization needs to meet GDPR data residency requirements ensuring personal data of EU residents is stored only within the EU. How does Azure support this?

Accepted Answer

Azure provides EU regions and contractual commitments enabling customers to keep EU data within EU boundaries. Azure supports GDPR data residency by offering data center regions within the EU (e.g., West Europe, North Europe, France Central) and including contractual commitments in the Microsoft Online Services Terms that guarantee customer data remains stored in the chosen EU region. Customers must explicitly select these regions during resource deployment and can use Azure Policy to enforce region restrictions, but the core support comes from Azure's physical infrastructure and legal agreements, not automatic enforcement.

Answer

Azure automatically stores all EU customer data in EU regions without configuration

Answer

Azure cannot support GDPR data residency as it's a US company

Answer

Data residency is automatically enforced by Azure Policy without customer configuration

Question 20

Which Azure storage feature enables you to recover previous versions of blob files that were accidentally deleted or overwritten?

Accepted Answer

Blob versioning and soft delete. Blob versioning and soft delete work together to protect blob data. Soft delete retains deleted blobs for a specified retention period, while versioning automatically saves previous versions of blobs when they are overwritten or deleted. This allows you to recover blob files to any previous state, directly addressing the scenario of accidental deletion or overwrite.

Answer

Azure Backup for Blob Storage

Answer

Azure Site Recovery for storage

Answer

Geo-redundant storage (GRS)