AZ-900 Describe Azure architecture and services Practice Test 11 — 15 Questions

Question 1

A company has deployed several virtual machines in an Azure virtual network. The IT administrators need to connect to these VMs using RDP and SSH from the internet. However, the company's security policy prohibits assigning any public IP addresses to the VMs and also prohibits exposing the VMs directly to the internet. The solution must be fully managed by Azure and require no additional infrastructure in the virtual network. Which Azure service should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Bastion. Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to virtual machines directly in the Azure portal over TLS. It eliminates the need for public IP addresses on the VMs and does not require any additional infrastructure in the virtual network, as it is deployed inside the virtual network and uses a private IP to connect to the VMs.

Answer

Azure Virtual Network Peering

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Question 2

A company has an on-premises data center with a site-to-site VPN connection to Azure. The company wants to ensure that the connection remains secure by encrypting all traffic between the on-premises network and Azure virtual network. The connection must be established over the public internet. Which Azure service should the company use to create this encrypted tunnel?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct service because it creates an encrypted site-to-site VPN tunnel over the public internet using IPsec/IKE protocols. This meets the requirement for a secure connection between the on-premises data center and Azure virtual network over the public internet.

Answer

Azure ExpressRoute

Answer

Azure Virtual WAN

Answer

Azure Bastion

Question 3

A company runs an e-commerce application on multiple Azure virtual machines in a single region. The IT team needs to distribute incoming web traffic across the VMs, offload SSL/TLS termination to improve VM performance, and route requests based on URL path (for example, /images to one pool of VMs and /api to another). The solution must handle these requirements within a single Azure region. Which Azure service should the company use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a layer 7 load balancer that can distribute incoming web traffic based on URL path, offload SSL/TLS termination to reduce VM CPU overhead, and route requests to different backend pools (e.g., /images and /api) within a single Azure region. It supports HTTP/HTTPS traffic and provides Web Application Firewall (WAF) capabilities, making it the correct choice for this scenario.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Front Door

Question 4

A company is deploying two Azure virtual machines that host a critical line-of-business application. The application is stateful and requires that the VMs are located in the same datacenter but on separate physical hardware to protect against a rack-level failure. Additionally, the VMs must be updated during Azure platform maintenance in a staggered manner to ensure the application remains available. Which Azure feature should the company configure for these VMs?

Accepted Answer

Azure Availability Set. Azure Availability Set ensures that VMs are placed in the same datacenter (same fault domain) but on separate physical hardware (different fault domains) to protect against rack-level failures. It also distributes VMs across update domains so that during Azure platform maintenance, only one update domain is rebooted at a time, ensuring the application remains available in a staggered manner.

Answer

Azure Availability Zones

Answer

Azure Virtual Machine Scale Set with autoscale

Answer

Azure Application Gateway

Question 5

A company hosts a public-facing e-commerce website on Azure virtual machines deployed in two Azure regions (East US and West Europe). The company wants to automatically route users to the region that provides the lowest network latency based on their geographic location. The solution must use DNS-based traffic routing and does not require terminating HTTP traffic at the load balancer. Which Azure service should the company use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming DNS requests to the most appropriate endpoint based on the traffic-routing method selected. The 'Performance' routing method directs users to the region with the lowest network latency, and because it operates at the DNS level, it does not terminate HTTP traffic, meeting all stated requirements.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure Load Balancer

Question 6

A company develops a data processing application that runs only when new files are uploaded to an Azure Blob Storage container. The application must scale automatically to handle hundreds of simultaneous file uploads and must not incur cost when no files are being processed. The development team wants the simplest solution that requires no infrastructure management. Which Azure compute service should they use?

Accepted Answer

Azure Functions with a Blob Storage trigger. Azure Functions with a Blob Storage trigger is the correct choice because it provides an event-driven, serverless compute model that automatically scales to handle hundreds of concurrent file uploads without requiring any infrastructure management. The function executes only when a new blob is created in the container, ensuring zero cost when no files are being processed, and the platform handles scaling out to meet demand.

Answer

Azure Virtual Machines Scale Set with autoscale rules

Answer

Azure Batch

Answer

Azure Container Instances

Question 7

A company is migrating a customer-facing web application to Azure. The application requires a relational database with built-in high availability, automatic backups, and automatic patching of the database engine. The development team is familiar with SQL Server and wants to minimize administrative overhead. They do not want to manage virtual machines or operating systems. Which Azure database service should the team choose?

Accepted Answer

Azure SQL Database (PaaS). Azure SQL Database is a fully managed Platform-as-a-Service (PaaS) offering that provides built-in high availability (99.99% SLA), automatic backups with point-in-time restore, and automatic patching of the database engine. It allows the development team to use their existing SQL Server skills without managing any virtual machines or operating systems, directly meeting the requirement to minimize administrative overhead.

Answer

Azure Cosmos DB

Answer

SQL Server on Azure Virtual Machines (IaaS)

Answer

Azure Database for PostgreSQL

Question 8

A company stores historical sales data in Azure Blob Storage. The data is accessed frequently during the first 30 days after upload, but after that, it is rarely accessed. The company wants to automatically move blobs to a lower-cost storage tier after 30 days without any manual scripting or custom code. Which Azure feature should they use?

Accepted Answer

Azure Blob Storage lifecycle management policies. Azure Blob Storage lifecycle management policies allow you to define rules that automatically transition blobs to a lower-cost storage tier (e.g., from Hot to Cool or Archive) based on the age of the data. This feature operates natively within Azure Storage, requires no custom code or scripting, and can be configured directly in the Azure portal or via ARM templates. The scenario's requirement for automatic, rule-based tiering after 30 days is exactly what lifecycle management policies are designed to do.

Answer

Azure Automation runbooks with a schedule

Answer

Azure Logic Apps with a recurrence trigger

Answer

Azure Policy to enforce storage tier at creation

Question 9

A company runs a critical application on-premises and plans to extend its data center to Azure. The company needs a dedicated, private network connection between the on-premises network and Azure that bypasses the public internet. The connection must provide higher bandwidth and more reliable, lower-latency connectivity than a site-to-site VPN. The company also requires a Service Level Agreement (SLA) for the connection's availability. Which Azure service should the company use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute is the correct choice because it provides a dedicated, private network connection from on-premises to Azure that bypasses the public internet entirely. It offers higher bandwidth, lower latency, and more reliable connectivity than a site-to-site VPN, and it includes a financially backed SLA for availability (typically 99.95% or higher). This makes it ideal for critical applications requiring consistent, private, and high-performance connectivity.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Application Gateway

Question 10

A company is deploying a business-critical application on Azure virtual machines in the East US region. The application's managed disks must remain available even if an entire Azure datacenter experiences an outage. The company does not require cross-region disaster recovery. Which storage redundancy option should they select for the managed disks?

Accepted Answer

Zone-Redundant Storage (ZRS). Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the East US region, ensuring the managed disks remain available even if an entire datacenter (one zone) fails. This meets the requirement for intra-region resilience without needing cross-region disaster recovery.

Answer

Locally Redundant Storage (LRS)

Answer

Geo-Redundant Storage (GRS)

Answer

Read-Access Geo-Redundant Storage (RA-GRS)

Question 11

A company plans to deploy a mission-critical application on Azure virtual machines. The application must remain available if a single Azure datacenter fails. The company chooses to deploy the VMs in the East US Azure region. The solution should provide the highest availability within that single region. What should the company configure?

Accepted Answer

Deploy the VMs in different availability zones within East US.. Deploying VMs across availability zones within a single region provides the highest availability within that region. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. This configuration protects against a single datacenter failure while keeping all resources in the same region, meeting the requirement for high availability without cross-region complexity.

Answer

Deploy the VMs in an availability set.

Answer

Deploy the VMs in different Azure regions connected with Azure Traffic Manager.

Answer

Deploy all VMs in the same availability set but in different fault domains.

Question 12

A company plans to migrate a multi-tier web application to Azure. The frontend web tier must automatically scale out based on CPU utilization, and Microsoft must manage the underlying virtual machines and operating system. The backend tier requires a relational database with built-in high availability and automatic backups. The company wants to minimize administrative overhead. Which two Azure services should the company use?

Accepted Answer

Azure App Service and Azure SQL Database. The frontend requires Microsoft-managed VMs and OS, which is a PaaS offering like Azure App Service. Azure App Service provides automatic scaling based on CPU utilization without managing underlying infrastructure. For the backend, a relational database with built-in high availability and automatic backups is best served by Azure SQL Database, which is fully managed with minimal administrative overhead. Option A (Azure Virtual Machines + Azure SQL Managed Instance) does not meet the requirement because Azure Virtual Machines is IaaS, where the customer manages the OS and VMs. Option C (AKS + Cosmos DB) involves managing Kubernetes clusters and Cosmos DB is NoSQL, not relational. Option D (Azure Functions + Table Storage) is serverless but not relational. Therefore, only option B satisfies both requirements.

Answer

Azure Virtual Machines and Azure SQL Managed Instance

Answer

Azure Kubernetes Service and Azure Cosmos DB

Answer

Azure Functions and Azure Table Storage

Question 13

A company has three Azure subscriptions: one for the engineering department, one for marketing, and one for finance. The central IT team needs to apply a common set of Azure Policy definitions (e.g., allowed locations for resources) that must be enforced across all three subscriptions. Additionally, each department manager must be able to apply custom policies that only affect their own subscription. The IT team wants to organize the subscriptions into a hierarchy where they can assign the common policy at the top level and delegate custom policy assignment at the subscription level. Which Azure feature should the IT team use to create this hierarchical structure?

Accepted Answer

Management groups. Management groups allow you to create a hierarchical structure of Azure subscriptions, enabling you to assign common Azure Policy definitions (like allowed locations) at a top-level management group that applies to all child subscriptions. Each department subscription can then have its own custom policy assignments, as management groups support inheritance and delegation of policy assignments across the hierarchy.

Answer

Resource groups

Answer

Azure Policy

Answer

Azure role-based access control (RBAC)

Question 14

A company has a global web application deployed on Azure virtual machines in three separate Azure regions: West US, West Europe, and Southeast Asia. The application must automatically direct each user to the region that is geographically closest to the user's location in order to minimize latency. The solution must expose a single DNS name that does not change if regions are added or removed. The company does not need to offload SSL certificates or perform URL-based routing at the global level. Which Azure service should the company use to meet these requirements?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that can route users to the closest regional endpoint based on geographic location using the 'Performance' routing method. It exposes a single DNS name (e.g., myapp.trafficmanager.net) that remains constant even when endpoints are added or removed, and it does not require SSL offloading or URL-based routing, matching the requirements exactly.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 15

A company plans to use an infrastructure-as-code approach to deploy its Azure resources. The company wants to define all resources (virtual networks, virtual machines, storage accounts) in a declarative JSON file. This file must ensure that resources are created in the correct order, handle dependencies automatically, and allow the same configuration to be deployed to multiple environments (dev, test, production) with parameterized values. The solution should be a native Azure feature. Which Azure feature should the company use?

Accepted Answer

Azure Resource Manager (ARM) templates. Azure Resource Manager (ARM) templates are the native Azure feature for infrastructure-as-code using a declarative JSON format. They define resources, handle dependencies automatically via the 'dependsOn' element, and support parameterization for deploying the same template to multiple environments (dev, test, production) by passing different parameter files. This directly matches the scenario's requirements for declarative JSON, dependency management, and multi-environment deployment.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Automation State Configuration