AZ-900 Practice Test 7 — 10 Questions

Question 1

A company has a root management group that contains all Azure subscriptions. A centralized governance team needs to create and assign Azure Policy definitions and set initiatives that apply to all subscriptions. Which built-in role should be assigned to the governance team at the root management group scope to grant the minimum required permissions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Policy Contributor. The Policy Contributor built-in role grants the minimum required permissions to create and assign Azure Policy definitions and initiatives, including the ability to read policy assignments and manage policy resources, without granting full write access to all resources. Assigning this role at the root management group scope ensures the governance team can apply policies across all subscriptions while adhering to the principle of least privilege.

Answer

Owner

Answer

Contributor

Answer

Security Admin

Question 2

A multinational company has a strict data residency requirement: all Azure virtual machines must be deployed only in the East US or West Europe Azure regions. The IT governance team wants to enforce this rule automatically so that any attempt to create a virtual machine in any other region is blocked immediately at the time of deployment. Users must receive a clear error message if they try to create a VM in a disallowed region. Which Azure feature should the governance team configure to meet this requirement?

Accepted Answer

Configure an Azure Policy with the Deny effect assigned to the subscription scope.. Azure Policy with the Deny effect is the correct choice because it enforces organizational rules by evaluating resource properties during deployment and blocking any non-compliant request. In this scenario, a policy can be defined to deny virtual machine creation in any region other than East US or West Europe, and the Deny effect ensures the deployment fails with a clear error message, meeting the real-time enforcement requirement.

Answer

Create a resource lock on the subscription to prevent all resource creation.

Answer

Assign an Azure RBAC role that denies create permissions for VMs in disallowed regions.

Answer

Set up a budget alert in Cost Management to notify when a VM is created in a disallowed region.

Question 3

A company operates a hybrid IT environment with virtual machines running on-premises and in Amazon Web Services (AWS). The company also has a growing number of resources in Microsoft Azure. To simplify management, the company wants to use a single Azure service to apply Azure Policy definitions and enable unified inventory and tagging across all virtual machines, regardless of their location. Which Azure service should the company use?

Accepted Answer

Azure Arc. Azure Arc extends Azure Resource Manager (ARM) and Azure Policy to non-Azure environments, including on-premises and AWS virtual machines. By installing the Azure Connected Machine agent on each VM, the company can apply Azure Policy definitions and use unified inventory and tagging across all VMs from a single Azure control plane.

Answer

Azure Resource Manager

Answer

Azure Blueprints

Answer

Azure Management Groups

Question 4

A hospital is migrating patient data to the cloud. The hospital is responsible for managing who can access the data and for encrypting the data before upload. The cloud provider is responsible for securing the physical datacenters, network infrastructure, and hypervisor. This division of security responsibilities is described by which model?

Accepted Answer

Shared responsibility model. The shared responsibility model defines the division of security obligations between the cloud provider and the customer. In this scenario, the hospital (customer) is responsible for identity and access management (IAM) and data encryption at rest and in transit, while the cloud provider secures the physical datacenter, network infrastructure, and hypervisor. This clear separation of duties is the core of the shared responsibility model, which varies by service model (IaaS, PaaS, SaaS).

Answer

Defense in depth

Answer

Principle of least privilege

Answer

Zero trust model

Question 5

A company deploys a critical application across two Azure regions for disaster recovery. They want to automatically failover traffic to the secondary region if the primary becomes unavailable. They also want to improve performance by routing users to the closest region. Which Azure service should they use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic optimally to services across global Azure regions. It supports the 'Priority' routing method for automatic failover to a secondary region when the primary is unavailable, and the 'Performance' routing method to direct users to the closest region for improved latency. This combination directly meets the stated requirements for disaster recovery failover and performance-based routing.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure VPN Gateway

Question 6

A company has 15 Azure subscriptions organized under multiple management groups. The security team has defined a standard set of 8 Azure Policy definitions that must be applied to every subscription. These definitions enforce required tags, deny creation of public IPs, require encryption for storage accounts, and restrict VM SKUs. The team wants to assign these policies as a single entity to simplify management and ensure consistent compliance. What should the team create and assign?

Accepted Answer

An Azure Policy initiative (policy set definition) containing the policy definitions. An Azure Policy initiative (policy set definition) allows grouping multiple individual policy definitions into a single set, which can then be assigned as one entity. This simplifies management and ensures consistent compliance across all subscriptions, as the security team requires. Assigning the initiative at the root management group applies it to all 15 subscriptions under the management groups.

Answer

An Azure Blueprint containing the policy definitions

Answer

An Azure Policy assignment for each individual definition at the root management group

Answer

An Azure Resource Manager template that deploys the policy definitions

Question 7

What is the shared responsibility model in cloud computing?

Accepted Answer

A framework dividing security responsibilities between the cloud provider and the customer. The shared responsibility model defines the division of security and compliance obligations between the cloud provider and the customer. The provider is responsible for the security 'of' the cloud (physical hosts, network, hypervisor), while the customer is responsible for security 'in' the cloud (data, access management, OS configuration). This division varies by service model (IaaS, PaaS, SaaS), but the core principle is that security is a shared, not transferred, responsibility.

Answer

The provider and customer each pay half the cost of cloud services

Answer

An agreement where customers share their infrastructure with other cloud users

Answer

A service where two cloud providers share management of customer workloads

Question 8

A company's IT manager is evaluating a public cloud provider. The provider's data center contains powerful physical servers that host virtual machines from thousands of different organizations. The manager is concerned about security, but the provider assures that each organization's VMs are logically isolated and cannot access each other's data, even though they share the same hardware. Which essential characteristic of cloud computing does this scenario best describe?

Accepted Answer

Resource pooling. The scenario describes resource pooling because the provider's physical servers host VMs from multiple organizations, and logical isolation ensures each tenant's data remains separate. Resource pooling is the cloud characteristic where computing resources (e.g., storage, processing, memory) are aggregated to serve multiple customers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to demand. The provider's assurance of logical isolation (e.g., via hypervisor-level segmentation or VLANs) is a direct implementation of resource pooling's security boundary.

Answer

Rapid elasticity

Answer

Measured service

Answer

Broad network access

Question 9

A company wants to deploy a virtual machine in Azure and needs to ensure that the VM is placed in a location that provides the lowest network latency to its users in Europe. Which Azure construct should they consider to meet this requirement?

Accepted Answer

Azure region. Azure regions are geographically discrete data center groupings that provide low-latency connectivity to users within that region. By deploying the VM in a Europe-based region (e.g., West Europe or North Europe), the company ensures the shortest physical distance and network path to its European users, minimizing latency. Availability zones, resource groups, and management groups do not influence geographic placement or network latency.

Answer

Azure availability zone

Answer

Azure resource group

Answer

Azure management group

Question 10

Which Azure storage redundancy option replicates data synchronously across three availability zones within a single region?

Accepted Answer

Zone-Redundant Storage (ZRS). Zone-Redundant Storage (ZRS) is the correct answer because it synchronously replicates data across three Azure availability zones within a single region, ensuring high durability and availability even if an entire zone fails. This meets the exact requirement of the question: synchronous replication across multiple zones in one region.

Answer

Locally Redundant Storage (LRS)

Answer

Geo-Redundant Storage (GRS)

Answer

Geo-Zone-Redundant Storage (GZRS)