AZ-900 Practice Exam 64 — 20 Questions

Question 1

A company uses Azure to run a virtual machine for development. They want to ensure that if the physical server hosting the VM fails, the VM is automatically restarted on another server within the same Azure datacenter. Which Azure SLA does this scenario relate to?

Accepted Answer

99.9% VM SLA for a single instance. The scenario describes a single VM that automatically restarts on another physical host within the same datacenter after a hardware failure. This is covered by the Azure VM SLA for a single instance, which guarantees 99.9% uptime when you use premium SSD or ultra disks and have the VM deployed in a single availability zone or just within a datacenter. The SLA specifically addresses connectivity to the VM and its automatic recovery from host failures, not multi-instance redundancy.

Answer

99.95% VM SLA for multiple instances

Answer

99.99% SQL Database SLA

Answer

No SLA applied

Question 2

A company wants to enforce that all Azure storage accounts must have encryption enabled. If a storage account is created without encryption, the policy should automatically enable encryption without manual intervention. Which Azure Policy effect should they use?

Accepted Answer

Modify. The Modify effect is correct because it can automatically enable encryption on a storage account that does not have it enabled, without requiring manual intervention. Unlike DeployIfNotExists, which only deploys resources if they don't exist, Modify can alter existing properties (like encryption settings) on the resource itself. This ensures compliance by remediating non-compliant resources in real time or during evaluation cycles.

Answer

Deny

Answer

Audit

Answer

DeployIfNotExists

Question 3

A company plans to containerize a legacy web application and run it on Azure. The application experiences variable traffic volumes, with periodic spikes during lunch hours and weekends. The company wants the solution to automatically increase the number of running container instances during high demand and reduce them during low demand, without requiring any manual intervention or management of server infrastructure. Which Azure compute service should the company use?

Accepted Answer

Azure App Service. Azure App Service is correct because it supports containerized web applications with built-in autoscaling capabilities that automatically adjust the number of running container instances based on demand, such as CPU or memory thresholds, without requiring any manual intervention or server management. The platform handles the underlying infrastructure, patching, and load balancing, making it ideal for variable traffic patterns like lunch-hour spikes.

Answer

Azure Container Instances (ACI)

Answer

Azure Kubernetes Service (AKS)

Answer

Azure Functions

Question 4

What is the primary benefit of Azure Management Groups in a large enterprise with hundreds of subscriptions?

Accepted Answer

Applying governance policies and RBAC to all subscriptions in a hierarchy at once. Azure Management Groups allow you to organize subscriptions into a hierarchy and apply governance policies (via Azure Policy) and role-based access control (RBAC) at the management group level, which then cascades down to all subscriptions and resources within that group. This enables consistent governance across hundreds of subscriptions without needing to configure each one individually, which is the primary benefit for large enterprises.

Answer

Automatically reducing the cost of Azure subscriptions

Answer

Merging multiple subscriptions into a single billing account

Answer

Allowing resources in different subscriptions to share the same virtual network

Question 5

What is the main benefit of cloud computing's 'economies of scale' for customers?

Accepted Answer

Customers benefit from lower costs because the provider buys at massive scale. Economies of scale in cloud computing means that cloud providers like Microsoft Azure purchase vast amounts of hardware, networking equipment, and power at significantly reduced per-unit costs due to bulk buying. These savings are passed down to customers in the form of lower pay-as-you-go prices, making cloud services more affordable than if each customer had to procure and maintain their own infrastructure.

Answer

Customers can use unlimited resources without any cost

Answer

All customers get the same hardware regardless of need

Answer

Cloud providers always have the latest hardware immediately

Question 6

Which Azure tool helps organizations evaluate and quantify the potential impact of Azure service disruptions on their operations?

Accepted Answer

Azure Service Health (post-incident reports). Azure Service Health provides post-incident reports (Root Cause Analyses or RCAs) that detail the impact of Azure service disruptions, including affected services, regions, and timelines. This allows organizations to quantify downtime and assess operational impact, which is the specific need described in the question.

Answer

Azure Monitor Alerts

Answer

Azure Application Insights failure analysis

Answer

Azure Advisor reliability recommendations

Question 7

Which Azure cost management feature allows you to analyze historical spending and forecast future costs?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing provides tools for analyzing historical spending patterns and generating cost forecasts based on usage trends. It includes features like budgets, alerts, and cost analysis views that allow you to review past expenditures and predict future costs using machine learning models.

Answer

Azure Advisor

Answer

Azure Pricing Calculator

Answer

Azure Monitor

Question 8

A company wants to estimate the cost of a new Azure solution before deploying it. Which tool should they use?

Accepted Answer

Azure Pricing Calculator. The Azure Pricing Calculator is the correct tool because it allows users to estimate the cost of Azure services by configuring specific resources (e.g., VMs, storage, networking) with their desired settings (region, tier, quantity) before deployment. This provides a detailed, itemized cost projection based on current pay-as-you-go or reserved pricing, enabling informed budgeting without incurring actual charges.

Answer

Azure Cost Management + Billing

Answer

Azure Advisor

Answer

Azure TCO Calculator

Question 9

A company has a critical Azure Storage account that stores immutable backups. The IT administrator wants to ensure that no one can delete or modify this storage account, even administrators with Contributor or Owner roles. The company still needs to allow read access to the data within the storage account. Which Azure governance feature should the administrator implement?

Accepted Answer

Azure Resource Manager read-only lock. Option C is correct because an Azure Resource Manager read-only lock prevents any user, including those with Contributor or Owner roles, from deleting or modifying the storage account while still allowing read access to the data. This lock operates at the management plane, blocking DELETE and PATCH operations via the Azure Resource Manager API, but does not affect data plane operations like reading blobs or files.

Answer

Azure Policy with Deny effect

Answer

Azure Blueprint with role assignment

Answer

Azure role-based access control (RBAC) with Reader role

Question 10

A company uses Azure to host a web application. At the end of each month, the finance team receives an invoice that details charges for compute hours, storage consumption, and outbound data transfer. The IT manager explains that this granular billing is possible because Azure continuously monitors resource usage and provides detailed usage data for cost allocation. This capability is a direct example of which essential characteristic of cloud computing as defined by the National Institute of Standards and Technology (NIST)?

Accepted Answer

Measured service. The correct answer is D, Measured service, because the scenario describes Azure's ability to continuously monitor resource usage (compute hours, storage, data transfer) and provide detailed billing data. This aligns with NIST's definition of measured service, where cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). The granular invoice is a direct output of this metering and reporting feature.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 11

A company runs an Azure SQL Database that stores sensitive customer data. The security team mandates that all traffic to the database must remain entirely within the Microsoft Azure backbone network and never traverse the public internet. The database can only be accessed by a specific application running on virtual machines in a specific Azure virtual network. Which Azure feature should they configure to meet this requirement?

Accepted Answer

Azure Private Endpoint. Azure Private Endpoint assigns a private IP address from your virtual network to the Azure SQL Database, allowing traffic to reach the database over the Microsoft backbone network without ever leaving the Azure network or traversing the public internet. This ensures that all communication between the application VMs and the database remains private and secure, meeting the mandate that traffic must never traverse the public internet.

Answer

Azure Service Endpoint

Answer

VNet Peering

Answer

Azure Firewall

Question 12

A company is deploying a web application in Azure. The application consists of an Azure App Service, an Azure SQL Database, and a Storage account. The development team maintains three separate environments: development, test, and production. The team wants to be able to delete all resources associated with a specific environment (e.g., development) in a single action, without affecting the other environments. The solution must also allow applying role-based access control (RBAC) and tags consistently to all resources within each environment. Which Azure component should the team use to achieve these requirements?

Accepted Answer

Azure resource group. An Azure resource group is a logical container that holds related resources for an Azure solution. By placing all resources for a specific environment (e.g., development) into a single resource group, the team can delete the entire environment in one action by deleting the resource group, without affecting other environments. Additionally, RBAC roles and tags applied at the resource group level are inherited by all resources within that group, ensuring consistent governance.

Answer

Azure subscription

Answer

Azure management group

Answer

Azure availability zone

Question 13

A company has an Azure subscription with hundreds of existing virtual machines. The governance team wants to enforce a policy that every virtual machine must have a tag named 'CostCenter' with a valid value. The team wants to automatically add the 'CostCenter' tag with a default value of 'Undefined' to any existing or new virtual machine that is missing the tag. They do not want to block the creation of virtual machines that are missing the tag, but they do want the tag to be added automatically within a few minutes of detection. Which Azure Policy effect should the team use?

Accepted Answer

Modify. The Modify effect is correct because it can automatically add or change tags on existing and new resources without blocking creation. Unlike Append, which only works during resource creation and cannot modify existing resources, Modify uses a 'remediation' task to fix non-compliant resources after they are created, aligning with the requirement to add the tag within minutes of detection.

Answer

Audit

Answer

Deny

Answer

Append

Question 14

A company runs a web application on Azure. At the end of each month, the finance team reviews an invoice that itemizes charges by resource type, such as virtual machine compute hours, storage capacity used, and data transfer volume. The total cost directly corresponds to the exact quantity of resources consumed during the billing period. This capability is an example of which fundamental characteristic of cloud computing?

Accepted Answer

Measured service. Measured service is the correct answer because it refers to the cloud provider's ability to meter and bill customers based on actual resource consumption. In this scenario, the invoice itemizes charges by resource type (compute hours, storage, data transfer) and the total cost directly corresponds to the exact quantity consumed, which is the defining characteristic of measured service. This capability relies on metering telemetry (e.g., Azure Monitor metrics, usage logs) to track usage and generate a pay-per-use billing model.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

On-demand self-service

Question 15

A company uses Azure Policy to enforce governance rules across its Azure subscriptions. The security team wants to ensure that all virtual machines deployed in a subscription must be of an approved size from a predefined list. If a user attempts to deploy a virtual machine with a size not on the list, the deployment must be immediately blocked. Which Azure Policy effect should the company use in the policy definition?

Accepted Answer

Deny. The 'Deny' effect is correct because it actively blocks any deployment that violates the policy rule, such as deploying a virtual machine with a size not on the approved list. This effect evaluates the request during resource creation or update and denies it if the condition is met, ensuring immediate enforcement. In contrast, other effects like 'Audit' only log non-compliant resources without blocking them, which does not meet the security team's requirement to prevent unauthorized VM sizes.

Answer

Audit

Answer

DeployIfNotExists

Answer

Append

Question 16

A company has a production Azure subscription used by multiple teams. The governance team wants to enforce a rule that only virtual machines (VMs) of specific SKU sizes (e.g., Standard_D2s_v3 and Standard_D4s_v3) can be deployed. If a team attempts to deploy a VM of a different SKU size, the deployment must be blocked immediately and the user must see an error message explaining the restriction. Which Azure feature should the governance team use?

Accepted Answer

Azure Policy with the 'Deny' effect. Azure Policy with the 'Deny' effect is the correct choice because it allows the governance team to define and enforce rules that prevent the deployment of non-compliant resources, such as VMs with disallowed SKU sizes. When a policy with the 'Deny' effect is assigned, any attempt to create or update a resource that violates the policy is blocked immediately, and the user receives a clear error message explaining the restriction. This is the only Azure feature that provides proactive, resource-level enforcement with a built-in denial mechanism.

Answer

Azure Role-Based Access Control (RBAC) with a custom role that denies the 'Microsoft.Compute/virtualMachines/write' action

Answer

Azure Blueprints with a resource lock

Answer

Azure resource locks at the resource group level

Question 17

A company is migrating a custom-built inventory management application to the cloud. The application runs on a specific version of Windows Server and requires custom registry settings that are not supported in a platform as a service (PaaS) offering. The company wants to avoid the overhead of managing physical servers but still needs full control over the operating system and application dependencies. Which cloud service model should the company use?

Accepted Answer

Infrastructure as a Service (IaaS). The company needs full control over the operating system and custom registry settings, which are not supported in PaaS. Infrastructure as a Service (IaaS) provides virtualized computing resources (e.g., virtual machines) where the customer manages the OS, applications, and dependencies, while the cloud provider handles the physical hardware. This model allows the company to run a specific version of Windows Server with custom registry configurations without managing physical servers.

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Question 18

A company migrates its web application to Azure App Service (Platform as a Service). The application processes sensitive customer data and must ensure that all data in memory is encrypted while the application is running. According to the shared responsibility model, which party is responsible for implementing encryption of data in memory for this application?

Accepted Answer

The company, because it is responsible for securing its own application data and code.. In the shared responsibility model for PaaS like Azure App Service, Microsoft secures the physical host, OS, and platform runtime, but the customer retains responsibility for securing application-level data, including data in memory. Encrypting data in memory requires application code changes (e.g., using .NET's `ProtectedMemory` or Windows DPAPI), which is solely the customer's responsibility because Microsoft cannot access or manage the application's runtime memory contents.

Answer

Microsoft Azure, because it provides the hosting infrastructure and manages the runtime environment.

Answer

Both Microsoft and the company share this responsibility equally.

Answer

A third-party encryption service that is automatically enabled for all Azure App Service deployments.

Question 19

A company uses Azure SQL Database (PaaS). According to the shared responsibility model, who is responsible for applying security patches to the underlying operating system that runs the database service?

Accepted Answer

Microsoft. Microsoft is responsible for applying security patches to the underlying operating system that hosts Azure SQL Database because it is a Platform as a Service (PaaS) offering. In the PaaS shared responsibility model, the cloud provider manages the infrastructure, including the OS, runtime, and network, while the customer is responsible for data and access management. Azure SQL Database abstracts the OS layer entirely, so Microsoft handles all patching and maintenance to ensure security and compliance.

Answer

The customer

Answer

Both

Answer

Neither

Question 20

A large enterprise manages multiple Azure subscriptions for different business units. The central governance team wants to deploy a consistent landing zone across all subscriptions. The landing zone must include pre-defined Azure Policy definitions (e.g., allowed locations, allowed VM SKUs), standard RBAC role assignments (e.g., Owner, Contributor for specific security groups), and a predefined resource group structure (e.g., 'Networking', 'Security', 'Workloads'). The team wants a single, versioned artifact that can be assigned to any subscription to apply all these configurations together, with the ability to update the artifact and have changes propagate to existing assignments. Which Azure service should the team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it is designed to orchestrate the deployment of a consistent environment by packaging together Azure Policy definitions, RBAC role assignments, and resource groups into a single, versioned artifact. When the blueprint is updated and published, existing assignments can be updated to the latest version, ensuring changes propagate across all subscriptions.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Graph