AZ-900 Practice Exam 62 — 20 Questions

Question 1

A company runs a seasonal e-commerce application. During the holiday season, demand spikes significantly, but the company does not want to pay for idle resources the rest of the year. They want the cloud to automatically add or remove compute resources based on real-time demand. Which cloud computing characteristic does this scenario best describe?

Accepted Answer

Elasticity. Elasticity is the cloud characteristic that enables automatic scaling of resources up or down in real-time to match demand. In this scenario, the e-commerce application needs to add compute resources during holiday spikes and remove them when demand drops, avoiding paying for idle resources. This aligns directly with elasticity, which is often implemented via auto-scaling groups and load balancers that adjust capacity based on metrics like CPU utilization or request count.

Answer

Scalability

Answer

High availability

Answer

Disaster recovery

Question 2

A company uses a public cloud service where they share physical hardware with other customers. This allows the provider to offer low prices due to economies of scale. Which cloud characteristic is being described?

Accepted Answer

Multi-tenancy. Multi-tenancy is the cloud characteristic where a single instance of physical hardware (or software) serves multiple customers (tenants), isolating their data and configurations while sharing underlying resources. This sharing enables the provider to achieve economies of scale, reducing per-customer costs and allowing low prices. The scenario explicitly describes sharing physical hardware with other customers, which is the core definition of multi-tenancy.

Answer

Elasticity

Answer

Scalability

Answer

High availability

Question 3

A company provides a software-as-a-service (SaaS) application to multiple enterprise customers. Each customer's usage of compute and storage resources is tracked separately. At the end of each month, the company generates detailed invoices that reflect each customer's exact resource consumption, including CPU hours, storage GB-months, and data transfer. The cloud provider automatically measures all resource usage and makes the data available through an API. Which essential characteristic of cloud computing does this scenario primarily demonstrate?

Accepted Answer

Measured service. The scenario describes a SaaS provider that tracks each customer's exact resource consumption (CPU hours, storage GB-months, data transfer) and generates invoices based on that metered usage. This aligns directly with the 'measured service' characteristic of cloud computing, where resource usage is automatically monitored, controlled, and reported, providing transparency for both the provider and consumer. The cloud provider's API making usage data available is a key enabler of this metering and billing capability.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 4

A company is subject to strict data residency regulations that require all personally identifiable information (PII) to remain on their own physical servers. However, they want to use Azure for compute-intensive analytics that do not process PII. They also need a consistent set of management tools to manage resources across both environments. Which cloud deployment model should the company adopt?

Accepted Answer

Hybrid cloud. The hybrid cloud model is correct because it allows the company to keep PII on-premises (private cloud) to satisfy data residency regulations while running compute-intensive analytics in Azure (public cloud). Azure Arc provides a consistent set of management tools to govern resources across both environments, enabling unified policy, compliance, and monitoring.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 5

A company runs a latency-sensitive application on Azure virtual machines and needs to connect its on-premises data center to Azure. The connection must offer high reliability, predictable performance, and a service-level agreement (SLA) from the connectivity provider. It must also bypass the public internet for security and performance reasons. Which Azure service should the company use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute is the correct choice because it provides a dedicated, private connection from the on-premises data center to Azure that bypasses the public internet entirely. This ensures high reliability, predictable performance (low latency and jitter), and a financially backed SLA of up to 99.95% availability. For latency-sensitive applications, ExpressRoute offers consistent network performance that VPNs over the internet cannot guarantee.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Application Gateway

Question 6

A company needs to run a legacy application that requires full control over the operating system, including custom kernel modules. They also need to ensure high availability with multiple instances. Which Azure compute service should they use?

Accepted Answer

Azure Virtual Machines. Azure Virtual Machines (VMs) are the correct choice because they provide full control over the operating system, including the ability to install custom kernel modules, and support high availability through availability sets or zones. This is essential for legacy applications that require OS-level customization and fault-tolerant deployment.

Answer

Azure App Service

Answer

Azure Functions

Answer

Azure Container Instances

Question 7

A company stores critical customer data in Azure Blob Storage. The compliance team requires that the data remains available for read operations even if the primary Azure region experiences a complete outage. They plan to use an Azure storage redundancy option that automatically replicates data to a secondary region and allows read access from that secondary region during an outage, without requiring any manual failover action. Which storage redundancy option should they configure on the storage account?

Accepted Answer

Read-access geo-redundant storage (RA-GRS). RA-GRS (Read-access geo-redundant storage) is correct because it replicates data to a secondary region (geo-redundancy) and, crucially, enables read access to that secondary replica during a primary region outage without requiring any manual failover. This meets the compliance requirement for automatic read availability during a complete primary region failure.

Answer

Locally-redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Question 8

A company plans to migrate a line-of-business application to Azure. The application will run on a virtual machine (IaaS). The company wants to ensure that the operating system is kept up to date with security patches. According to the shared responsibility model, who is primarily responsible for applying these patches?

Accepted Answer

The customer, because the customer manages the guest operating system and is responsible for patching it.. In the shared responsibility model for IaaS, the customer retains control over the guest operating system, including applying security patches. Microsoft manages the physical host and hypervisor but does not patch the OS running inside the VM. Therefore, the customer is primarily responsible for keeping the OS up to date.

Answer

Microsoft, because they manage all operating system updates in Azure.

Answer

Both Microsoft and the customer share responsibility equally for operating system patching.

Answer

The cloud service provider, as a general rule for all services in Azure.

Question 9

A company runs a web application on Azure VMs. They want to distribute incoming traffic evenly across multiple VMs to ensure no single VM is overwhelmed. Which Azure load balancing solution should they use?

Accepted Answer

Azure Load Balancer. Azure Load Balancer (Option D) operates at Layer 4 (TCP/UDP) and distributes incoming traffic across a set of backend VMs based on a hash of the source IP and port, ensuring even distribution and high availability. It is the correct choice for balancing traffic within a single Azure region across multiple VMs to prevent any single VM from being overwhelmed.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure Traffic Manager

Question 10

A company is planning to migrate its customer relationship management (CRM) system to the cloud. The company is evaluating three service models: deploying the CRM on Azure Virtual Machines (IaaS), using Azure App Service to host a custom CRM web application (PaaS), and subscribing to a cloud-based CRM software like Dynamics 365 (SaaS). According to the Microsoft shared responsibility model, which of the following statements accurately describes the division of security responsibilities across these three options?

Accepted Answer

In all three models, Microsoft is responsible for securing the physical datacenter and network infrastructure. For IaaS, the customer is responsible for the guest OS and applications; for PaaS, the customer is responsible for the application code and data; for SaaS, the customer is responsible for data and user accounts.. Option A is correct because it accurately reflects the Microsoft shared responsibility model across IaaS, PaaS, and SaaS. In all three models, Microsoft is responsible for the physical datacenter and network infrastructure. For IaaS (Azure VMs), the customer manages the guest OS and applications; for PaaS (Azure App Service), the customer manages the application code and data; for SaaS (Dynamics 365), the customer manages data and user accounts. This division aligns with the principle that responsibility shifts from the customer to Microsoft as the service model moves from IaaS to SaaS.

Answer

In IaaS, Microsoft is responsible for the guest OS; in PaaS, Microsoft is responsible for the application code; in SaaS, the customer is responsible only for data.

Answer

In IaaS, the customer is responsible for everything from the physical infrastructure up; in PaaS, Microsoft is responsible for the application runtime and the customer is responsible only for data; in SaaS, Microsoft is responsible for everything.

Answer

In all three models, the customer is responsible for securing all application code and data, while Microsoft secures the underlying hardware and operating system.

Question 11

A company uses a single Azure subscription for its development and production workloads. The finance team wants to set a monthly spending limit for the entire subscription and receive an email alert when the costs are projected to exceed 80% of that limit. The company does not want any resources to be automatically stopped or deleted when the limit is reached. Which Azure feature should the finance team configure?

Accepted Answer

Azure Budgets in Azure Cost Management + Billing. Azure Budgets in Azure Cost Management + Billing allows you to set a spending limit (budget) for a subscription and configure alert thresholds (e.g., 80% of the budget) that trigger email notifications when costs are projected to exceed that percentage. Crucially, Azure Budgets only sends alerts and does not automatically stop or delete resources, matching the company's requirement to avoid any automatic resource termination.

Answer

Azure Policy with the 'deny' effect

Answer

Azure Advisor cost recommendations

Answer

Azure Service Health alerts

Question 12

A company runs a web application on Azure App Service. During a marketing campaign, the application's traffic surges to five times its normal level. The application is configured to automatically add more instances to handle the increased load and then remove them when demand returns to normal. This ability to dynamically provision and de-provision resources based on real-time demand is a direct example of which cloud computing characteristic?

Accepted Answer

Elasticity. The scenario describes automatically adding and removing App Service instances in response to real-time traffic spikes, which is the definition of elasticity. Elasticity is the ability to dynamically scale resources up or down to match demand, ensuring you only pay for what you use. In Azure, this is implemented via autoscale rules that adjust the instance count based on metrics like CPU or request queue length.

Answer

Scalability

Answer

High availability

Answer

Fault tolerance

Question 13

A company stores sensitive customer data in an Azure Blob Storage account. The company's security policy requires that all data traffic between the virtual network (VNet) and the storage account must never traverse the public internet. Additionally, the storage account must remain accessible from an on-premises data center through a Site-to-Site VPN connection. Which Azure feature should the company configure on the storage account?

Accepted Answer

Azure Private Link (using a private endpoint). Azure Private Link with a private endpoint is correct because it assigns a private IP address from the VNet to the storage account, ensuring all traffic between the VNet and the storage account stays within the Microsoft Azure backbone network and never traverses the public internet. Additionally, the storage account can still be accessed from an on-premises data center via a Site-to-Site VPN connection that terminates in the same VNet, as the private endpoint is reachable over the VPN.

Answer

Azure service endpoints

Answer

Azure VPN Gateway connection to the storage account

Answer

Azure route tables

Question 14

A company operates a global e-commerce API that serves customers worldwide. The development team needs a solution that provides the following capabilities: global load balancing across deployed instances in multiple Azure regions, web application firewall (WAF) protection against common exploits like SQL injection and cross-site scripting, TLS termination at the edge to reduce backend processing, and caching of static API responses to improve response times for repeated requests. The team wants a single Azure service that integrates all these features natively. Which Azure service should they use?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it is a global, scalable entry point that natively integrates global load balancing, web application firewall (WAF) protection, TLS termination at the edge, and caching of static API responses. Unlike other services, Front Door provides all these capabilities in a single, unified service, making it ideal for a global e-commerce API that requires both security and performance optimization across multiple Azure regions.

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Answer

Azure Content Delivery Network (CDN)

Question 15

A company wants to deploy a custom Linux-based application in Azure. They need full control over the operating system, including installing custom software and configuration. Which Azure compute service should they choose?

Accepted Answer

Azure Virtual Machines. Azure Virtual Machines (VMs) provide full control over the operating system, allowing you to install custom software, configure the kernel, and manage system-level settings. This is the correct choice for a custom Linux-based application that requires complete OS-level access, unlike platform-as-a-service offerings that abstract away the underlying infrastructure.

Answer

Azure App Service

Answer

Azure Container Instances

Answer

Azure Functions

Question 16

A company runs a critical application on Azure VMs. They need to ensure that if one VM fails, the application continues to serve users with another VM. The VMs should be placed in a configuration that protects against failures within a single datacenter. Which feature should they use?

Accepted Answer

Availability Set. An Availability Set ensures that VMs are distributed across multiple fault domains (separate racks with independent power, cooling, and network) and update domains within a single Azure datacenter. This protects against hardware failures or maintenance events within that datacenter, so if one VM fails, another in a different fault domain continues serving users.

Answer

Availability Zone

Answer

Resource Group

Answer

Scale Set

Question 17

A company runs several virtual machines on Azure that are hosted on physical servers shared with other customers. The company is concerned that another customer's high workload ('noisy neighbor') could degrade their own application performance. However, Azure's infrastructure ensures that each virtual machine receives a dedicated allotment of CPU and memory resources, and performance remains consistent regardless of the activity of other tenants. Which characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

Resource pooling. Resource pooling is the correct answer because it describes how Azure's multi-tenant architecture allows physical resources (CPU, memory, storage, network) to be shared among multiple customers while ensuring each virtual machine receives a dedicated allocation of resources. This isolation prevents a 'noisy neighbor' scenario from degrading performance, as each VM's resource allotment is guaranteed regardless of other tenants' activity.

Answer

Measured service

Answer

Rapid elasticity

Answer

On-demand self-service

Question 18

A company needs to grant a group of users the ability to restart and start/stop virtual machines, but not to create or delete them. They want to assign this permission at the resource group level. What should they do?

Accepted Answer

Create a custom role with the required actions. Option B is correct because Azure's built-in roles do not provide a granular permission set that allows restarting and starting/stopping VMs while explicitly denying creation and deletion. A custom role must be created with specific actions such as 'Microsoft.Compute/virtualMachines/start/action', 'Microsoft.Compute/virtualMachines/restart/action', and 'Microsoft.Compute/virtualMachines/deallocate/action', and exclude actions like 'Microsoft.Compute/virtualMachines/write' and 'Microsoft.Compute/virtualMachines/delete'. This custom role can then be assigned at the resource group scope to grant the precise permissions required.

Answer

Assign the built-in Contributor role

Answer

Assign the built-in Virtual Machine Contributor role

Answer

Use Azure Policy to restrict operations

Question 19

A company uses Azure for its infrastructure. A developer needs a new virtual machine to test a feature. The developer goes to the Azure portal, selects an image, and provisions the VM within minutes without any interaction with the IT procurement department. This capability directly demonstrates which essential characteristic of cloud computing as defined by NIST?

Accepted Answer

On-demand self-service. The scenario describes a developer provisioning a virtual machine directly through the Azure portal without needing to submit a request or obtain approval from IT procurement. This aligns with the NIST definition of on-demand self-service, which states that a consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider. The key enabler here is the self-service portal (Azure portal) that allows the developer to select an image and deploy the VM instantly, bypassing any manual approval workflow.

Answer

Rapid elasticity

Answer

Measured service

Answer

Resource pooling

Question 20

A company wants to be able to increase and decrease resources automatically based on demand without manual intervention. Which cloud characteristic does this describe?

Accepted Answer

Rapid elasticity. Rapid elasticity is the cloud characteristic that enables resources to be automatically and dynamically scaled out (increased) or scaled in (decreased) in response to real-time demand, without requiring manual intervention. This is typically implemented through autoscaling policies that monitor metrics like CPU utilization or request count and trigger provisioning or de-provisioning of virtual machines or containers via APIs. The key differentiator is that scaling happens automatically and often in near real-time, matching the elasticity definition in NIST SP 800-145.

Answer

Measured service

Answer

Resource pooling

Answer

On-demand self-service