AZ-900 Practice Test 8 — 10 Questions

Question 1

An organization needs to ensure all VMs in Azure use approved VM sizes only. Which Azure feature enforces this?

Accepted Answer

Azure Policy with allowed VM SKU policy. Azure Policy with the 'Allowed virtual machine SKUs' built-in policy definition enforces which VM sizes can be deployed in a subscription or resource group. When assigned, this policy evaluates all VM creation or update requests and denies any that use a SKU not included in the allowed list, ensuring compliance with organizational standards.

Answer

Azure RBAC

Answer

Azure Resource Manager locks

Answer

Azure Cost Management budgets

Question 2

A company wants to run a containerized microservices application on Azure. The application requires automatic scaling, service discovery, and rolling updates without manual intervention. They prefer not to manage the underlying virtual machines. Which Azure compute service should they choose?

Accepted Answer

Azure Kubernetes Service (AKS). Azure Kubernetes Service (AKS) is the correct choice because it provides a fully managed Kubernetes orchestration platform that handles automatic scaling (via Horizontal Pod Autoscaler), service discovery (via Kubernetes DNS and Services), and rolling updates (via Deployment strategies) without requiring you to manage the underlying virtual machines. AKS abstracts the control plane and node management, allowing you to focus on deploying and managing containerized microservices.

Answer

Azure Container Instances

Answer

Azure App Service

Answer

Azure Functions

Question 3

A company runs a critical ERP system on-premises and plans to extend the application to Azure IaaS VMs for burst capacity. The network team requires a dedicated, private connection between the on-premises data center and Azure that does not traverse the public internet. The connection must offer consistent latency, high bandwidth options up to 10 Gbps, and a financially backed SLA for availability. Which Azure service should the team provision to meet these requirements?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated, private connection from on-premises to Azure that bypasses the public internet, ensuring consistent latency and high bandwidth up to 10 Gbps. It also offers a financially backed SLA for availability, making it the ideal choice for extending a critical ERP system for burst capacity with predictable performance.

Answer

Azure VPN Gateway (site-to-site)

Answer

Azure Front Door

Answer

Azure Bastion

Question 4

A company has multiple Azure subscriptions used by different departments. The security team wants to enforce a requirement that all Azure Storage accounts in every subscription must be encrypted at rest using customer-managed keys (CMK). The solution must automatically evaluate existing and new storage accounts for compliance, and it must be able to automatically remediate non-compliant resources by enabling CMK encryption. The team wants to use a single, centralized Azure feature that can be assigned once and apply to all subscriptions. Which Azure feature should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct choice because it can enforce organizational standards and assess compliance across all Azure subscriptions from a single assignment. By using a built-in or custom policy definition that requires storage accounts to use customer-managed keys (CMK) for encryption at rest, Azure Policy can automatically evaluate both existing and new storage accounts. With the 'DeployIfNotExists' effect, it can also trigger remediation tasks to enable CMK encryption on non-compliant resources without manual intervention.

Answer

Azure Blueprints

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Security Center (Microsoft Defender for Cloud)

Question 5

A global company is designing a disaster recovery solution for a critical application. They plan to deploy the application to two Azure regions. The company wants to minimize the risk of both regions failing simultaneously due to a major platform update or a widespread natural disaster. Which Azure feature provides a specific pairing of regions to meet this goal?

Accepted Answer

Azure region pairs. Azure region pairs are designed to ensure that two paired regions are updated sequentially during platform maintenance, reducing the risk of simultaneous failure. They are also physically separated by at least 300 miles to minimize the impact of natural disasters. This meets the company's goal of minimizing simultaneous failure risk from both a major platform update and a widespread natural disaster.

Answer

Availability Zones within a single region

Answer

Azure Traffic Manager with geographic routing

Answer

Azure Site Recovery replication between any two regions of your choice

Question 6

A company has a policy that all Azure resources must have a tag named 'CostCenter'. The governance team wants to automatically add the tag with a default value 'IT' to any new resource that is created without it. The team wants the tag to be applied during resource creation, not just report non-compliance. The solution must also support remediation for existing non-compliant resources if needed later. Which Azure Policy effect should the team use in their policy definition?

Accepted Answer

Modify. The Modify effect is correct because it can automatically add or change tags on resources during creation or update, enforcing compliance in real-time. Unlike Append, Modify supports both creation and remediation of existing resources, and unlike DeployIfNotExists, it directly alters the resource properties without deploying a separate remediation task.

Answer

Append

Answer

DeployIfNotExists

Answer

Audit

Question 7

A company migrates its web application to Azure App Service (Platform as a Service). The application processes sensitive customer data and must ensure that all data in memory is encrypted while the application is running. According to the shared responsibility model, which party is responsible for implementing encryption of data in memory for this application?

Accepted Answer

The company, because it is responsible for securing its own application data and code.. In the shared responsibility model for PaaS like Azure App Service, Microsoft secures the physical host, OS, and platform runtime, but the customer retains responsibility for securing application-level data, including data in memory. Encrypting data in memory requires application code changes (e.g., using .NET's `ProtectedMemory` or Windows DPAPI), which is solely the customer's responsibility because Microsoft cannot access or manage the application's runtime memory contents.

Answer

Microsoft Azure, because it provides the hosting infrastructure and manages the runtime environment.

Answer

Both Microsoft and the company share this responsibility equally.

Answer

A third-party encryption service that is automatically enabled for all Azure App Service deployments.

Question 8

A small business runs its IT infrastructure in a small on-premises server room. The business owner is considering moving to Azure and asks the IT manager: 'How can a large cloud provider like Microsoft offer compute and storage at a lower per-unit cost than I can get by purchasing my own servers, even though I only need a few virtual machines?' Which cloud computing benefit best answers this question?

Accepted Answer

Economies of scale. Economies of scale allow Microsoft to spread massive capital and operational costs (data center construction, power, cooling, hardware procurement) across millions of customers. This per-unit cost reduction means even a small business consuming only a few virtual machines benefits from the same low-cost infrastructure that a large enterprise would, making Azure's compute and storage cheaper than purchasing and maintaining dedicated on-premises servers.

Answer

High availability

Answer

Elasticity

Answer

Fault tolerance

Question 9

A company migrates its web application to Azure. The CFO wants to view detailed reports of CPU usage, storage consumption, and network bandwidth for each team's resources to accurately allocate costs. The company uses Azure Cost Management and Billing to generate these reports. Which characteristic of cloud computing does this capability best illustrate?

Accepted Answer

Measured service. Measured service is the cloud characteristic that enables providers to track and report resource usage (CPU, storage, bandwidth) for billing and cost allocation. Azure Cost Management and Billing leverages this capability by aggregating consumption metrics from Azure Monitor and resource providers, then generating detailed reports that allow the CFO to allocate costs per team. Without measured service, granular usage-based billing and cost attribution would not be possible.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

On-demand self-service

Question 10

A development team frequently needs to create and tear down test environments. In their on-premises datacenter, they must submit a ticket to the IT operations team, which often takes several days to provision the required servers. After migrating to Azure, developers can now create virtual machines, databases, and other resources directly through the Azure portal or using PowerShell scripts, without any interaction from the IT operations team. This ability to provision cloud resources directly is a direct example of which fundamental characteristic of cloud computing?

Accepted Answer

On-demand self-service. The scenario describes developers provisioning virtual machines, databases, and other resources directly through the Azure portal or PowerShell scripts without needing to interact with the IT operations team. This is the definition of on-demand self-service, a core characteristic of cloud computing defined by NIST (SP 800-145) as a consumer being able to unilaterally provision computing capabilities without requiring human interaction with each service provider.

Answer

Resource pooling

Answer

Measured service

Answer

Rapid elasticity