AZ-900 Practice Exam 65 — 20 Questions

Question 1

A company wants to proactively monitor and control its Azure spending. The finance team has set a monthly budget of $10,000 for the 'Marketing' subscription. They want to receive an email notification when the actual spending reaches 80% of the budget and another notification when it reaches 100%. Additionally, if the spending ever exceeds $12,000 in a month, they want to automatically trigger a runbook that scales down non-critical resources. Which Azure feature should the finance team use to achieve all these requirements?

Accepted Answer

Azure Budgets in Microsoft Cost Management with action groups. Azure Budgets in Microsoft Cost Management allows you to set spending thresholds and configure alerts based on actual or forecasted costs. By linking an action group to the budget, you can trigger email notifications at 80% and 100% of the $10,000 budget, and also invoke an Azure Automation runbook when spending exceeds $12,000, meeting all requirements.

Answer

Azure Advisor cost recommendations

Answer

Azure Policy with the 'append' effect

Answer

Azure Cost Management invoices

Question 2

A development team needs to quickly provision a new virtual machine for a short-term testing environment. The team uses the Azure portal to create the VM without submitting a request to the IT operations team or waiting for any manual approval. The VM is provisioned and available within minutes. Which cloud computing characteristic does this scenario best represent?

Accepted Answer

On-demand self-service. The scenario describes the development team provisioning a virtual machine directly through the Azure portal without any manual approval or intervention from IT operations. This is the essence of on-demand self-service, a core cloud computing characteristic defined by NIST SP 800-145, where a consumer can unilaterally provision computing capabilities as needed automatically without requiring human interaction with each service provider.

Answer

Rapid elasticity

Answer

Measured service

Answer

Resource pooling

Question 3

A company wants to set monthly spending limits for each department and receive alert emails when spending reaches 80% of the budget. Which Azure tool should they use?

Accepted Answer

Azure Budgets. Azure Budgets is the correct tool because it allows you to set specific spending limits (budgets) at the subscription, resource group, or management group scope and configure alert rules that trigger when costs reach a defined threshold, such as 80% of the budget. This directly meets the requirement for monthly departmental spending limits and proactive email alerts.

Answer

Azure Cost Management + Billing

Answer

Azure Advisor

Answer

Azure Policy

Question 4

A healthcare company is planning to migrate its on-premises data center to Azure. The CFO wants to shift from making large upfront hardware purchases to paying for IT resources as an ongoing operational cost. Which cloud computing benefit does this scenario describe?

Accepted Answer

Operational expenditure (OpEx). Option C is correct because the scenario describes shifting from capital expenditure (CapEx) for upfront hardware purchases to operational expenditure (OpEx) for ongoing, pay-as-you-go IT resource consumption. This is a core financial benefit of cloud computing, where costs are treated as variable operating expenses rather than fixed capital investments.

Answer

High availability

Answer

Elasticity

Answer

Fault tolerance

Question 5

A company wants to run a containerized application quickly without managing any virtual machines or orchestration infrastructure. They just need to start a container and have it run. Which Azure service is best suited for this?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it provides a serverless container platform that allows you to run a container directly without managing any underlying virtual machines or orchestration infrastructure. You simply specify the container image and resource requirements, and ACI launches the container in seconds, making it ideal for quick, isolated container workloads.

Answer

Azure Kubernetes Service

Answer

Azure App Service

Answer

Azure Functions

Question 6

A company wants to reduce its carbon footprint by using a cloud provider that invests in renewable energy. They want to ensure that their workloads in Azure run in datacenters that are among the most energy-efficient. Which Azure benefit is most directly related to this goal?

Accepted Answer

Environmental sustainability. Environmental sustainability is the Azure benefit that directly addresses the company's goal of reducing its carbon footprint by using a cloud provider that invests in renewable energy and operates energy-efficient datacenters. Microsoft has committed to being carbon negative by 2030 and powers its Azure datacenters with 100% renewable energy, making this the most relevant benefit for the stated objective.

Answer

Economies of scale

Answer

Scalability

Answer

Security and compliance

Question 7

A company uses a public cloud provider that shares the same physical infrastructure among many customers. This allows the provider to offer lower prices due to economies of scale. Which cloud characteristic describes the sharing of infrastructure?

Accepted Answer

Resource pooling. Resource pooling is the cloud characteristic that allows a provider to serve multiple customers from the same physical infrastructure, using multi-tenant models. This sharing enables economies of scale because the provider can amortize hardware costs across many tenants, reducing per-customer pricing. The scenario directly describes multi-tenancy and shared infrastructure, which is the essence of resource pooling.

Answer

Measured service

Answer

Rapid elasticity

Answer

On-demand self-service

Question 8

A company wants to proactively identify Azure resources that are misconfigured and could lead to security vulnerabilities, such as virtual machines with open management ports or unencrypted storage accounts. They also need to get prioritized recommendations for remediating these issues. Which Azure service should the company use?

Accepted Answer

Microsoft Defender for Cloud (formerly Azure Security Center). Microsoft Defender for Cloud (formerly Azure Security Center) is the correct service because it continuously assesses the security posture of Azure resources, identifies misconfigurations such as open management ports (e.g., RDP/SSH) or unencrypted storage accounts, and provides prioritized, actionable recommendations for remediation. It integrates with Azure Policy to enforce security standards and offers a secure score to track improvement over time.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Blueprints

Question 9

A company wants to ensure that no one can create virtual machines without approval from the IT department. They want to block all VM creation attempts and notify the requester that they need to request access. Which Azure Policy effect should they use?

Accepted Answer

Deny. The Deny effect is correct because it actively prevents the creation of virtual machines by blocking the resource creation request at the Azure Resource Manager level. When a policy with the Deny effect is assigned, any attempt to create a VM that does not meet the policy's conditions is rejected with a 403 (Forbidden) status code, and the requester receives an error message indicating the policy violation and the need to request access. This directly enforces the requirement to block all VM creation attempts without requiring manual intervention.

Answer

Audit

Answer

Append

Answer

Disabled

Question 10

A hospital maintains its patient records on physical servers located within its own on-premises data center due to strict data residency regulations that prohibit patient data from leaving the country. For analytical workloads that process only anonymized data, the hospital uses Azure virtual machines and Azure Synapse Analytics. This combination of on-premises and cloud resources best describes which cloud deployment model?

Accepted Answer

Hybrid cloud. The hospital uses a combination of on-premises physical servers (for patient records due to data residency regulations) and Azure cloud resources (VMs and Synapse Analytics for anonymized data analytics). This integration of on-premises and public cloud services is the defining characteristic of a hybrid cloud deployment model, as it allows workloads to span both environments while maintaining compliance.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 11

Which cloud computing characteristic allows an organization to avoid purchasing excess capacity to handle occasional peak loads?

Accepted Answer

Elasticity. Elasticity is the cloud computing characteristic that allows resources to automatically scale up to meet peak demand and scale down when demand decreases, so organizations only pay for what they use and avoid over-provisioning. This eliminates the need to purchase and maintain excess capacity for occasional load spikes, as the cloud provider dynamically allocates resources in real time.

Answer

High availability

Answer

Geo-distribution

Answer

Durability

Question 12

Which Azure service provides intelligent threat protection across your Azure and hybrid environments by collecting and analyzing security data?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) is the correct answer because it provides unified security management and intelligent threat protection across Azure and hybrid environments. It continuously assesses the security posture of your resources, applies security recommendations, and collects and analyzes security data from various sources to detect and respond to threats. Azure Sentinel, while also a security service, is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration Automation and Response) solution that focuses on log aggregation and incident response, not the integrated workload protection and posture management that Defender for Cloud offers.

Answer

Azure Sentinel

Answer

Azure DDoS Protection

Answer

Azure Firewall

Question 13

What does 'compliance' mean in the context of Azure?

Accepted Answer

Meeting regulatory standards, laws, and organizational policies for data and security. In Azure, compliance refers to adhering to regulatory standards, laws, and organizational policies that govern data security, privacy, and handling. Azure provides a compliance framework with over 100 offerings (e.g., ISO 27001, SOC 2, GDPR, HIPAA) and tools like Microsoft Purview Compliance Manager to assess and manage compliance posture. This ensures that workloads meet specific legal and industry requirements, not just performance or error-free operation.

Answer

Achieving maximum performance for Azure workloads

Answer

Ensuring all Azure resources are running without errors

Answer

Using only Microsoft-approved Azure services in your environment

Question 14

Which Azure service helps you manage and automate the deployment of virtual machines at scale across development, testing, and production environments?

Accepted Answer

Azure DevTest Labs. Azure DevTest Labs is the correct answer because it provides a managed environment specifically designed to create, manage, and automate the deployment of virtual machines (VMs) across development, testing, and production environments at scale. It offers built-in policies for auto-shutdown, cost management, and custom images, making it ideal for non-production workloads that require rapid provisioning and teardown.

Answer

Azure Virtual Machine Scale Sets

Answer

Azure Batch

Answer

Azure Automation

Question 15

What is the primary difference between a public cloud and a private cloud?

Accepted Answer

Public cloud infrastructure is shared among multiple customers; private is dedicated to one organization. The primary difference is that a public cloud uses a multi-tenant architecture where infrastructure resources like compute, storage, and networking are shared across multiple unrelated customers, while a private cloud provisions dedicated infrastructure for a single organization, either on-premises or hosted by a third party. This distinction is fundamental to cloud deployment models as defined by NIST SP 800-145, which emphasizes resource pooling in public clouds versus single-tenant isolation in private clouds.

Answer

Public cloud is more secure than private cloud

Answer

Private cloud is always hosted by a third-party provider

Answer

Public cloud can only be accessed from within the organization's network

Question 16

What is the purpose of Azure Marketplace?

Accepted Answer

A catalog for browsing and purchasing third-party software and solutions that run on Azure. Azure Marketplace is an online catalog that allows customers to browse, purchase, and deploy third-party software, services, and solutions that are certified to run on Azure. It provides pre-configured solutions from independent software vendors (ISVs) and simplifies deployment by integrating directly with the Azure portal and Azure Resource Manager.

Answer

A store for buying Azure hardware for on-premises use

Answer

A repository for sharing Azure Resource Manager templates with other organizations

Answer

A portal for comparing prices across different cloud providers

Question 17

An organization wants to ensure that no one can create Azure resources outside of approved geographic locations across all of their subscriptions. What is the most scalable way to enforce this?

Accepted Answer

Assign 'Allowed locations' Azure Policy at the Management Group level. Azure Policy at the Management Group level allows you to define a single 'Allowed locations' policy that applies to all subscriptions within that group, ensuring consistent enforcement across the entire organization. This approach is the most scalable because it centralizes governance, automatically covering new subscriptions added to the management group without manual intervention.

Answer

Configure RBAC to deny resource creation permissions in all subscriptions

Answer

Create separate 'Allowed locations' policies in each subscription

Answer

Use Azure Blueprints to restrict locations in each new subscription

Question 18

Which Azure governance feature enables organizations to enforce that all virtual machines be tagged with a specific 'Owner' tag before deployment?

Accepted Answer

Azure Policy with 'Require tag' in deny mode. Azure Policy with the 'Require tag' effect in deny mode is the correct choice because it can enforce tagging rules at resource creation time by evaluating the request against the policy definition and denying any deployment that does not include the specified 'Owner' tag. This is a native governance feature designed to ensure compliance before resources are provisioned, unlike RBAC or templates which do not enforce tag values.

Answer

Azure RBAC with custom permissions

Answer

Azure Resource Manager template validation

Answer

Azure DevOps deployment gates

Question 19

A company wants to run Windows and Linux containers together in Azure without managing Kubernetes cluster infrastructure. Which service should they use?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it allows you to run Windows and Linux containers directly in Azure without managing any underlying orchestration infrastructure like Kubernetes. ACI provides a serverless, per-second billing model for containers, making it ideal for simple container workloads where you want to avoid cluster management overhead.

Answer

Azure Kubernetes Service

Answer

Azure Container Apps

Answer

Azure App Service

Question 20

Which Azure service provides a centralized view of all Azure resources and their health status, showing which resources are healthy, degraded, or unavailable?

Accepted Answer

Azure Resource Health. Azure Resource Health is the correct answer because it provides a personalized dashboard that shows the health of your individual Azure resources, indicating whether they are available, degraded, or unavailable. Unlike Azure Service Health, which focuses on Azure service-wide outages, Resource Health gives a resource-by-resource view, including past health events and root cause analyses.

Answer

Azure Monitor

Answer

Azure Service Health

Answer

Azure Advisor