AZ-900 Practice Exam 61 — 20 Questions

Question 1

A company needs to grant a specific user the ability to restart virtual machines in a specific resource group, but not to create, delete, or modify them in any other way. The built-in 'Virtual Machine Contributor' role grants too many permissions. What is the most appropriate solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the 'Reader' role and create a custom RBAC role with only the 'Microsoft.Compute/virtualMachines/restart/action' permission. It combines the 'Reader' role (which allows read-only access to all resources) with a custom RBAC role that grants only the specific 'Microsoft.Compute/virtualMachines/restart/action' permission. This ensures the user can restart VMs in the target resource group without being able to create, delete, or modify them, meeting the exact requirement.

Answer

Assign the 'Virtual Machine Operator' built-in role

Answer

Create a custom role with 'Contributor' and then add a deny assignment for delete and create

Answer

Assign the 'Owner' role and then remove permissions

Question 2

A company deploys a web application on Azure Virtual Machines across multiple availability zones within a single region. They need to distribute incoming network traffic across these VM instances to ensure high availability. Which Azure service should they use?

Accepted Answer

Azure Load Balancer. Azure Load Balancer is the correct choice because it operates at Layer 4 (TCP/UDP) and distributes incoming traffic across healthy virtual machines within a single region, including across availability zones. It provides high availability by automatically routing traffic only to healthy VM instances based on health probes, and it supports both public and internal load balancing scenarios.

Answer

Azure Application Gateway

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 3

A company deploys virtual machines in Azure. They want to ensure that the VMs are distributed across multiple fault domains and update domains within an Azure datacenter to protect against hardware failures and maintenance. Which Azure construct should they use?

Accepted Answer

A) Availability Set. An Availability Set is the correct Azure construct because it logically groups VMs to protect against both hardware failures (via fault domains) and planned maintenance (via update domains) within a single Azure datacenter. Fault domains distribute VMs across separate racks with independent power, cooling, and network, while update domains ensure VMs in different groups are not rebooted simultaneously during Azure host updates. This directly matches the requirement to isolate VMs across multiple fault and update domains within a datacenter.

Answer

B) Availability Zone

Answer

C) Region Pair

Answer

D) Resource Group

Question 4

Which Azure service provides a fully managed, serverless data warehouse for enterprise analytics with massive parallel processing?

Accepted Answer

Azure Synapse Analytics. Azure Synapse Analytics (formerly SQL Data Warehouse) is the correct answer because it is a fully managed, serverless data warehouse that uses massive parallel processing (MPP) to run complex queries across large datasets. It separates compute from storage, allowing you to scale compute resources independently and pause them when not in use, which is ideal for enterprise analytics workloads.

Answer

Azure SQL Database

Answer

Azure Cosmos DB

Answer

Azure HDInsight

Question 5

A company's security team needs to audit all virtual machines (VMs) that have a public IP address directly attached, across more than 50 Azure subscriptions organized under several management groups. The team wants to run a single query to get a list of these VMs along with the subscription and resource group details. The solution must provide fast results without the need to write custom scripts or iterate through each subscription individually. Which Azure service should the team use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph (ARG) is the correct choice because it provides a powerful, queryable interface (using Kusto Query Language, KQL) that can search across all Azure subscriptions, management groups, and resource groups in a single query. It can quickly return a list of VMs with public IPs attached, along with their subscription and resource group metadata, without requiring custom scripts or iterative loops. This directly meets the requirement for fast, cross-subscription auditing with minimal overhead.

Answer

Azure Policy

Answer

Azure Monitor

Answer

Azure Resource Manager

Question 6

A company wants to ensure that all Azure resources they deploy are created in the Europe West region to comply with data sovereignty requirements. They want to block creation of resources in any other region. Which Azure service should they use?

Accepted Answer

Azure Policy with allowed locations. Azure Policy with the 'allowed locations' built-in policy definition can enforce that all resources are deployed only in the Europe West region. When assigned to a subscription or resource group scope, this policy denies any resource creation outside the specified regions, directly meeting the data sovereignty requirement.

Answer

Resource groups

Answer

Management groups

Answer

Azure Blueprints

Question 7

A company uses Azure Policy to enforce that all virtual machines must have the Azure Monitor agent extension installed. The policy is assigned to a subscription and uses the 'DeployIfNotExists' effect, which automatically installs the agent on new VMs. However, the security team notices that several existing VMs are non-compliant because they were provisioned before the policy was assigned. The team wants to automatically make these existing VMs compliant without manual intervention. What should the team do?

Accepted Answer

Create a remediation task for the policy assignment.. A remediation task on a 'DeployIfNotExists' policy assignment triggers the policy engine to evaluate existing non-compliant resources and automatically deploy the required extension (Azure Monitor agent) to those VMs. This is the designed mechanism to bring pre-existing resources into compliance without manual intervention.

Answer

Change the policy effect to 'Deny'.

Answer

Assign the policy at the management group scope.

Answer

Use Azure Automation Update Management.

Question 8

A company is migrating a web application to Azure. The web tier will run on Azure App Service (PaaS) and the database tier will use Azure SQL Database (PaaS). The company's IT team wants to understand their patching responsibilities for the underlying operating system (OS) of each service. According to the shared responsibility model, which statement is correct?

Accepted Answer

Microsoft is responsible for patching the operating system of both Azure App Service and Azure SQL Database.. In the shared responsibility model, Microsoft manages the underlying infrastructure for Platform as a Service (PaaS) services. Both Azure App Service and Azure SQL Database are PaaS offerings, meaning Microsoft handles OS patching, updates, and security for the host OS. The customer is responsible only for their application code and data, not the OS. Therefore, option D is correct.

Answer

The customer is responsible for patching the operating system of both Azure App Service and Azure SQL Database.

Answer

Microsoft is responsible for patching the operating system of Azure App Service, and the customer is responsible for patching the operating system of Azure SQL Database.

Answer

The customer is responsible for patching the operating system of Azure App Service, and Microsoft is responsible for patching the operating system of Azure SQL Database.

Question 9

A company plans to deploy two Azure virtual machines that host a critical web application. Both VMs will be in the same Azure region and the same virtual network. The company’s requirements are: 1) During Azure platform-initiated maintenance (e.g., OS updates), at least one VM must remain running. 2) If a hardware failure occurs in the server rack that hosts one VM, the other VM must not be affected. 3) The solution must not incur additional costs beyond the VMs themselves. Which Azure feature should the company configure?

Accepted Answer

Availability Set. An Availability Set distributes VMs across multiple fault domains (different server racks with independent power and networking) and update domains (groups that undergo platform maintenance sequentially). This ensures that during Azure-initiated maintenance, only one update domain is rebooted at a time, leaving at least one VM running, and that a hardware failure in one fault domain does not affect VMs in other fault domains. Availability Sets are free of charge beyond the cost of the VMs themselves, meeting all requirements.

Answer

Availability Zones

Answer

Azure Site Recovery

Answer

Azure Load Balancer

Question 10

A company runs a critical line-of-business application on a single on-premises server. The company is migrating the application to Azure and wants to minimize downtime if the server hardware fails. The architect proposes deploying the application on two Azure virtual machines (VMs) in the same region, placed in an availability set. This configuration is designed to ensure that if one VM fails due to hardware failure or planned maintenance, the other VM remains running and the application stays available. Which cloud computing concept does this configuration primarily illustrate?

Accepted Answer

High availability. High availability (HA) is the correct concept because the configuration uses two VMs in an availability set to ensure the application remains accessible despite hardware failures or planned maintenance. An availability set distributes VMs across fault domains and update domains, guaranteeing that at least one VM stays operational during Azure platform events. This directly aligns with HA's goal of minimizing downtime and maximizing uptime for critical workloads.

Answer

Fault tolerance

Answer

Disaster recovery

Answer

Elasticity

Question 11

A company subscribes to a SaaS-based customer relationship management (CRM) application hosted in the cloud. The CRM provider manages the application, runtime, and infrastructure. The company's employees access the CRM via a web browser. According to the shared responsibility model, which security responsibility belongs solely to the company?

Accepted Answer

Safeguarding the company's customer data and user identities.. In a SaaS model, the provider manages the application, runtime, and infrastructure, including patching the OS and physical security. The customer retains responsibility for what they bring into the cloud: their data and user identities. Option C is correct because safeguarding customer data and managing user identities (e.g., via Azure AD) is solely the company's responsibility under the shared responsibility model.

Answer

Patching the underlying operating system of the CRM servers.

Answer

Managing network access controls to the CRM application.

Answer

Ensuring physical security of the data centers hosting the CRM.

Question 12

A company is developing a REST API that processes incoming HTTP requests. The API usage is highly unpredictable; sometimes it receives thousands of requests per minute, and at other times it receives zero requests for hours. The company wants to pay only for the compute time consumed when the API code is actually executing. They also want Microsoft to automatically handle scaling and maintenance of the underlying server infrastructure. Which Azure compute service should the company use?

Accepted Answer

Azure Functions (Consumption plan). Azure Functions with the Consumption plan is the correct choice because it is a serverless compute service that executes code only when triggered by incoming HTTP requests, automatically scaling to handle unpredictable workloads. The Consumption plan charges only for the compute time consumed during execution, with no cost when the function is idle, and Microsoft fully manages the underlying infrastructure, including scaling and maintenance.

Answer

Azure App Service (Basic tier)

Answer

Azure Container Instances

Answer

Azure Logic Apps

Question 13

A multinational company uses Azure management groups to organize its subscriptions. The company has a root management group (tenant root group) containing three child management groups: 'Finance', 'HR', and 'IT'. Each child management group contains multiple subscriptions. The global governance team needs to enforce an Azure Policy that restricts all resource deployments across every subscription in the organization to only the 'West US' and 'East US' regions. The policy must automatically apply to any new subscriptions that are created under any management group in the future. The team wants to assign the policy once and have it affect all current and future subscriptions with minimal administrative overhead. At which Azure scope should the team assign the policy?

Accepted Answer

The root management group. Assigning the policy to the root management group ensures it is inherited by all child management groups (Finance, HR, IT) and their subscriptions, including any new subscriptions created in the future. This approach enforces the allowed regions policy across the entire tenant with a single assignment, minimizing administrative overhead. Azure Policy inheritance flows from the root management group down through all levels of the hierarchy.

Answer

Each subscription individually

Answer

Each child management group (Finance, HR, IT) individually

Answer

A single resource group

Question 14

Which Azure feature enables governance teams to define standard, repeatable Azure environments for new projects?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct answer because it enables governance teams to define a repeatable set of Azure resources that adheres to organizational standards, patterns, and requirements. Unlike ARM templates, Blueprints can include role assignments, policy assignments, and resource groups, and they maintain a live linkage to the original blueprint for ongoing compliance tracking.

Answer

ARM templates in Azure Repos

Answer

Azure Cost Management budgets

Answer

Azure AD application registration templates

Question 15

A company is moving from an on-premises data center to Azure. Instead of paying a large upfront cost for servers, they will pay a monthly subscription fee based on usage. This represents a shift from which type of expenditure to which?

Accepted Answer

Capital expenditure to Operational expenditure. This scenario describes a shift from Capital Expenditure (CapEx) to Operational Expenditure (OpEx). CapEx involves upfront, long-term investments in physical assets like servers, while OpEx is a pay-as-you-go model where costs are incurred based on actual usage. Azure's subscription model eliminates the need for large initial capital outlays, aligning costs with consumption.

Answer

Operational expenditure to Capital expenditure

Answer

Direct cost to Indirect cost

Answer

Fixed cost to Variable cost

Question 16

Which Azure service monitors the health of Azure services and infrastructure in your region, and provides notifications about planned maintenance?

Accepted Answer

Azure Service Health. Azure Service Health is the correct service because it provides a personalized view of the health of Azure services, regions, and resources you use, including notifications about planned maintenance. It combines three layers: Azure Status (global view), Service Health (personalized view), and Resource Health (individual resource status). This makes it the specific tool for monitoring regional service health and planned maintenance events.

Answer

Azure Monitor

Answer

Azure Advisor

Answer

Azure Status Page

Question 17

A company historically purchased physical servers and networking equipment for its data center, paying the full cost upfront before using the hardware. The company is now migrating its workloads to Azure and will only pay for the compute and storage resources it consumes each month, with no long-term commitments or upfront hardware purchases. This financial model change best represents which cloud computing benefit?

Accepted Answer

Consumption-based pricing. The scenario describes a shift from upfront capital expenditure (CapEx) for physical hardware to a model where the company pays only for the resources it consumes each month, without long-term commitments. This directly aligns with consumption-based pricing, a core Azure benefit where costs are incurred based on actual usage of compute, storage, and other services, eliminating the need for upfront hardware purchases.

Answer

High availability

Answer

Elasticity

Answer

Disaster recovery

Question 18

A company plans to migrate its on-premises SQL Server database to Azure. The database uses many features including SQL Server Agent jobs, cross-database queries, and CLR integration. The company wants a fully managed PaaS service that minimizes application code changes and supports native virtual network (VNet) integration without requiring a private endpoint. Which Azure service should the company use?

Accepted Answer

Azure SQL Managed Instance. Azure SQL Managed Instance is the correct choice because it provides near 100% compatibility with on-premises SQL Server, including SQL Server Agent jobs, cross-database queries, and CLR integration, while being a fully managed PaaS service. It supports native VNet integration without requiring a private endpoint, allowing the database to be placed directly into a customer's virtual network for secure, isolated connectivity.

Answer

Azure SQL Database

Answer

SQL Server on Azure Virtual Machine

Answer

Azure Cosmos DB

Question 19

Which aspect of Azure governance ensures that resources are protected from accidental or unauthorized deletion regardless of RBAC role?

Accepted Answer

Azure Resource Locks overriding RBAC. Azure Resource Locks override RBAC because they are applied at the subscription, resource group, or resource level and enforce a 'Deny' effect that cannot be bypassed by any RBAC role, including Owner. This ensures that even users with Contributor or Owner permissions cannot delete or modify a locked resource unless the lock is first removed by an Owner or User Access Administrator.

Answer

Azure RBAC deny assignments

Answer

Azure Policy deny effects

Answer

Azure AD Privileged Identity Management restrictions

Question 20

Which Azure service enables you to monitor, diagnose, and gain insights into the performance of web applications, including user behavior analytics?

Accepted Answer

Azure Application Insights. Azure Application Insights is an extensible Application Performance Management (APM) service for web developers. It automatically detects performance anomalies, includes powerful analytics tools to help diagnose issues, and provides user behavior analytics (e.g., page views, session duration, click patterns) via its telemetry pipeline. This makes it the correct choice for monitoring, diagnosing, and gaining insights into web application performance and user behavior.

Answer

Azure Monitor Logs

Answer

Azure Service Health

Answer

Azure Security Center