AZ-900 Practice Exam 63 — 20 Questions

Question 1

A company is deploying a business-critical application on Azure virtual machines in the East US region. The application's managed disks must remain available even if an entire Azure datacenter experiences an outage. The company does not require cross-region disaster recovery. Which storage redundancy option should they select for the managed disks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Zone-Redundant Storage (ZRS). Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the East US region, ensuring the managed disks remain available even if an entire datacenter (one zone) fails. This meets the requirement for intra-region resilience without needing cross-region disaster recovery.

Answer

Locally Redundant Storage (LRS)

Answer

Geo-Redundant Storage (GRS)

Answer

Read-Access Geo-Redundant Storage (RA-GRS)

Question 2

Which Azure compute service allows you to run a group of identical virtual machines that can automatically scale in or out based on demand?

Accepted Answer

Azure Virtual Machine Scale Sets. Azure Virtual Machine Scale Sets (VMSS) is the correct answer because it is specifically designed to deploy and manage a group of identical, load-balanced VMs that can automatically increase or decrease the number of VM instances based on demand or a defined schedule. This autoscaling capability is built into the VMSS resource, using metrics like CPU or memory thresholds to trigger scale-out or scale-in operations, making it the ideal service for elastic workloads.

Answer

Azure Availability Sets

Answer

Azure Kubernetes Service

Answer

Azure Batch

Question 3

A company is migrating a custom line-of-business application to Azure. The application handles sensitive customer data. The IT team is evaluating whether to deploy the application on Azure Virtual Machines (IaaS) or Azure App Service (PaaS). They want to understand the division of security responsibilities between Microsoft and the customer under the shared responsibility model. Which responsibility remains the customer's obligation regardless of whether they choose IaaS, PaaS, or SaaS?

Accepted Answer

Managing user access to the application data and ensuring data classification policies are enforced. Under the shared responsibility model, the customer is always responsible for managing access to data and enforcing data classification policies, regardless of whether the workload runs on IaaS, PaaS, or SaaS. This is because data ownership and the associated governance obligations (such as who can read, write, or modify sensitive customer data) remain with the customer. Microsoft secures the underlying infrastructure, but the customer must control who accesses the application data and how it is classified.

Answer

Applying operating system security patches and updates to virtual machines

Answer

Managing the physical server hardware, network switches, and datacenter cooling

Answer

Configuring and maintaining the application-level network load balancer for high availability

Question 4

Which Azure service provides pre-built, customizable chatbot capabilities that can be integrated into applications and websites?

Accepted Answer

Azure Bot Service. Azure Bot Service is the correct answer because it provides a dedicated environment for building, testing, deploying, and managing intelligent bots that interact naturally with users via channels like web chat, Microsoft Teams, and Facebook Messenger. It includes the Bot Framework SDK for custom logic and pre-built templates for common scenarios like FAQ bots, making it the primary Azure service for chatbot capabilities.

Answer

Azure Logic Apps

Answer

Azure Communication Services

Answer

Azure Cognitive Search

Question 5

A company has multiple Azure subscriptions. They need to enforce a rule that only specific virtual machine sizes (e.g., Standard_D2s_v3) can be used across all subscriptions. They also want this rule to automatically apply to any future subscriptions created. Which Azure service should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules (such as allowed virtual machine SKUs) across your Azure environment. By assigning a built-in or custom policy definition (e.g., 'Allowed virtual machine SKUs') at the management group scope, the rule automatically applies to all existing and future subscriptions within that management group, ensuring consistent governance without manual intervention.

Answer

Azure Blueprints

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Resource Manager

Question 6

Which statement accurately describes the consumption-based pricing model for Azure services?

Accepted Answer

You pay only for the cloud resources you consume, with no upfront costs or wasted capacity. The consumption-based pricing model in Azure means you pay only for the resources you actually use, such as compute hours, storage GB, or data transfer, with no upfront costs or commitments. This model provides flexibility and cost efficiency because you can scale resources up or down based on demand and only incur charges for what you consume. It is a core principle of cloud computing that aligns costs directly with usage, enabling organizations to avoid over-provisioning and reduce waste.

Answer

You pay a fixed monthly fee regardless of how many resources you use

Answer

You must purchase at least 12 months of capacity regardless of usage

Answer

You pay based on the performance level of the service, not actual usage

Question 7

A company has a simple containerized web application that runs in a single container. The application processes a workload for a few minutes every hour and remains idle the rest of the time. The company wants to deploy the container in Azure without managing any virtual machines or container orchestrators. They also want to pay only for the time the container is actually running, with no cost when idle. Which Azure compute service should the company use?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it allows you to run a containerized application without managing any underlying virtual machines or container orchestrators like Kubernetes. ACI supports a per-second billing model, meaning you only pay for the compute resources consumed while the container is actively running, and incur no cost when the container is stopped or idle. This aligns perfectly with the company's requirement of a simple, single-container workload that runs intermittently.

Answer

Azure App Service

Answer

Azure Virtual Machine Scale Sets

Answer

Azure Kubernetes Service

Question 8

Which Azure service provides a flexible, highly available LDAP (Lightweight Directory Access Protocol) and Kerberos service without managing domain controllers?

Accepted Answer

Azure AD Domain Services. Azure AD Domain Services (Azure AD DS) provides managed domain services such as LDAP and Kerberos authentication without the need to deploy, patch, or maintain domain controllers. It automatically synchronizes identities from Azure AD or an on-premises Active Directory, offering a fully managed, highly available service that supports legacy directory-aware applications and lift-and-shift scenarios.

Answer

Azure Active Directory (Azure AD)

Answer

Azure AD B2C

Answer

Azure Active Directory Connect

Question 9

A company has a policy that every Azure resource must have a 'CostCenter' tag assigned at creation time. The governance team wants to automatically prevent any resource creation if the tag is missing, without requiring manual review after deployment. Which Azure feature should they use to enforce this requirement?

Accepted Answer

Azure Policy. Azure Policy is correct because it enables the enforcement of organizational standards by evaluating resources against custom or built-in policies at creation time. In this scenario, a policy can be configured with a 'deny' effect to automatically block any resource deployment that lacks the required 'CostCenter' tag, preventing non-compliant resources from being created without manual intervention.

Answer

Azure Blueprints

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Tags

Question 10

Which Azure service provides a fully managed, cloud-hosted Kubernetes environment for AI and machine learning workloads?

Accepted Answer

Azure Kubernetes Service with GPU nodes. Azure Kubernetes Service (AKS) with GPU nodes is the correct answer because it provides a fully managed Kubernetes cluster that can be configured with GPU-enabled virtual machines, making it ideal for running AI and machine learning workloads that require accelerated computing. AKS handles the control plane, patching, and scaling, while allowing you to deploy containerized ML models or training jobs using Kubernetes orchestration.

Answer

Azure Machine Learning compute clusters

Answer

Azure Batch AI

Answer

Azure Neural Network Computing

Question 11

A company needs to store large amounts of unstructured data, such as images and videos, which will be accessed by multiple applications over the internet. The data must be highly durable and available. Which Azure storage service should they use?

Accepted Answer

Azure Blob Storage. Azure Blob Storage is designed for storing massive amounts of unstructured data, such as images and videos, and provides high durability (99.9999999999% with LRS) and availability through geo-replication options. It supports access via HTTP/HTTPS from any internet-connected application, making it ideal for this scenario.

Answer

Azure Files

Answer

Azure Queue Storage

Answer

Azure Disk Storage

Question 12

A company runs business-critical ERP software on Azure. If the ERP application has a 99.9% SLA and the Azure SQL Database backing it has a 99.99% SLA, what is the overall composite SLA?

Accepted Answer

Approximately 99.89%. The composite SLA for dependent services is calculated by multiplying their individual SLAs. Here, 99.9% (0.999) multiplied by 99.99% (0.9999) equals approximately 0.9989, or 99.89%. This reflects the overall availability when both the ERP application and the Azure SQL Database must be operational for the system to function.

Answer

99.99% (take the highest SLA)

Answer

99.9% (take the lowest SLA)

Answer

200% because two services are running

Question 13

A company wants to connect their on-premises data center to Azure with a dedicated, private connection that does not traverse the internet. They also need to ensure high availability by having two active connections. Which Azure service and configuration should they use?

Accepted Answer

Azure ExpressRoute with two circuits.. Azure ExpressRoute provides a dedicated, private connection from on-premises to Azure that does not traverse the public internet. To achieve high availability with two active connections, you must configure two ExpressRoute circuits, each connecting to different Microsoft Enterprise Edge (MSEE) devices, ensuring redundancy at the physical and network layer.

Answer

Azure VPN Gateway with active-active mode.

Answer

Azure Virtual WAN with a single connection.

Answer

Azure Point-to-Site VPN.

Question 14

A company has deployed hundreds of virtual machines in Azure across multiple subscriptions. The governance team wants to generate a compliance report that identifies which VMs are using approved VM sizes and which are not, according to a corporate policy. The team must not block the deployment of non-compliant VMs; they only want to track compliance. Which Azure Policy effect should they use in the policy definition?

Accepted Answer

Audit. The Audit effect is the correct choice because it enables the governance team to log non-compliant resources (such as VMs using unapproved sizes) in the Azure Activity Log without blocking their deployment. This effect generates a compliance report while allowing the deployment to proceed, exactly matching the requirement to track compliance without enforcement.

Answer

Deny

Answer

Append

Answer

DeployIfNotExists

Question 15

A company runs multiple projects in Azure, each project is placed in a separate resource group. The finance team wants to set a monthly spending limit of $10,000 per project and receive automated email alerts when a project's spending reaches 80% of the limit and again when it exceeds the limit. The solution must use native Azure capabilities and be configurable per resource group. Which Azure service should the finance team use?

Accepted Answer

Azure Cost Management budgets with alert rules. Azure Cost Management budgets allow you to set spending limits at the scope of a resource group and configure alert rules that trigger automated email notifications when costs reach a specified threshold (e.g., 80% of the budget) and again when the limit is exceeded. This meets all requirements natively without additional automation or custom scripting.

Answer

Azure Policy with a built-in policy definition to enforce spending limits

Answer

Azure Advisor cost recommendations

Answer

Azure Resource Graph queries triggered by Azure Automation runbooks on a schedule

Question 16

A company uses Azure Policy to require that all storage accounts must have blob soft delete enabled. They also want to automatically create a remediation task that fixes any existing non-compliant storage accounts. Which policy effect should they include in the policy definition to achieve automatic remediation?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is designed to automatically remediate non-compliant resources by deploying a defined template (e.g., enabling blob soft delete) when the resource is evaluated as non-compliant. This effect triggers a remediation task that can be run on existing resources, ensuring all storage accounts meet the policy requirement without manual intervention.

Answer

Deny

Answer

Audit

Answer

Append

Question 17

A company is migrating its on-premises virtual machines (VMs) to Azure using the Infrastructure as a Service (IaaS) model. The VMs run a custom legacy application that requires specific OS-level configurations. The company's IT team wants to understand which party is responsible for applying operating system security patches after the migration. According to the shared responsibility model, who is responsible for patching the OS of the Azure VMs?

Accepted Answer

The company is responsible for patching the operating system on the virtual machines.. In the shared responsibility model for IaaS, the customer retains control over the operating system, including applying security patches. Microsoft manages the physical host, hypervisor, and Azure infrastructure, but the customer is responsible for OS-level configurations and updates on their virtual machines. This applies to both Windows and Linux VMs, regardless of whether the OS is provided by Azure or the customer.

Answer

Microsoft is fully responsible for applying OS patches to the virtual machines.

Answer

Responsibility is shared equally between Microsoft and the company for OS patching.

Answer

Responsibility depends on whether the VM uses Windows or Linux; Microsoft patches Windows VMs and the company patches Linux VMs.

Question 18

A company is migrating a legacy application to Azure. The application stores data on a network file share that is accessed using the SMB protocol. After migration, multiple Azure virtual machines must be able to mount the same file share simultaneously. The company wants a fully managed service that eliminates the need to maintain a file server. Which Azure storage service should the company use?

Accepted Answer

Azure Files. Azure Files provides fully managed file shares that use the SMB protocol, allowing multiple Azure VMs to mount the same share simultaneously. It eliminates the need to maintain a file server because Microsoft handles the underlying infrastructure, patching, and high availability. This makes it the ideal choice for migrating legacy applications that rely on SMB-based network file shares.

Answer

Azure Blob Storage

Answer

Azure Managed Disks

Answer

Azure Queue Storage

Question 19

Which Azure service provides recommendations for improving the security posture of your Azure SQL databases?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL (formerly Azure Defender for SQL) provides security assessments and actionable recommendations to improve the security posture of Azure SQL databases. It identifies vulnerabilities, misconfigurations, and potential threats, then offers remediation steps directly in the Azure Security Center or Microsoft Defender for Cloud interface.

Answer

Azure SQL Auditing

Answer

Azure Key Vault for SQL

Answer

Azure Monitor SQL Insights

Question 20

Which Azure service enables businesses to migrate and modernize their SQL Server databases to the cloud with built-in intelligence?

Accepted Answer

Azure SQL Database. Azure SQL Database is a fully managed Platform-as-a-Service (PaaS) offering specifically designed for SQL Server workloads. It provides built-in intelligence features such as automatic tuning, performance insights, and advanced threat protection, making it the correct service for migrating and modernizing SQL Server databases to the cloud.

Answer

Azure Cosmos DB

Answer

Azure Database for PostgreSQL

Answer

Azure Synapse Analytics