AZ-900 Describe Azure architecture and services Practice Test 12 — 15 Questions

Question 1

A company runs an Azure SQL Database that stores sensitive customer data. The security team mandates that all traffic to the database must remain entirely within the Microsoft Azure backbone network and never traverse the public internet. The database can only be accessed by a specific application running on virtual machines in a specific Azure virtual network. Which Azure feature should they configure to meet this requirement?

Accepted Answer

Azure Private Endpoint. Azure Private Endpoint assigns a private IP address from your virtual network to the Azure SQL Database, allowing traffic to reach the database over the Microsoft backbone network without ever leaving the Azure network or traversing the public internet. This ensures that all communication between the application VMs and the database remains private and secure, meeting the mandate that traffic must never traverse the public internet.

Answer

Azure Service Endpoint

Answer

VNet Peering

Answer

Azure Firewall

Question 2

A multinational e-commerce company runs its customer-facing web application on Azure virtual machines deployed in two Azure regions: East US and West Europe. The company wants to automatically route user traffic to the nearest regional deployment based on the user's geographic location. Additionally, if one region becomes unavailable, all traffic should automatically be redirected to the remaining healthy region. The company wants a solution that works at the DNS level and does not require terminating HTTPS traffic at the routing layer. Which Azure service should they use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming DNS requests to the nearest available endpoint based on geographic location (using the Performance traffic-routing method) and automatically fails over to the next healthy region when a region becomes unavailable. It operates at the DNS level, so it does not terminate HTTPS traffic, meeting the requirement to avoid SSL/TLS termination at the routing layer.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 3

A development team is building a proof-of-concept microservice that is packaged as a Docker container. They want to deploy it to Azure with the fastest provisioning time and the least operational overhead. The team does not need to manage virtual machines, orchestrate multiple containers, or configure scaling rules. Which Azure compute service should they use?

Accepted Answer

Azure Container Instances (ACI). Azure Container Instances (ACI) is the correct choice because it allows you to deploy a single Docker container directly to Azure without managing any underlying virtual machines or orchestration. It offers the fastest provisioning time (typically seconds) and the least operational overhead, as it is a serverless platform that automatically handles container startup, networking, and resource allocation. The team's requirement to avoid managing VMs, orchestrating multiple containers, or configuring scaling rules aligns perfectly with ACI's design for simple, isolated container workloads.

Answer

Azure Kubernetes Service (AKS)

Answer

Azure Virtual Machines

Answer

Azure Batch

Question 4

A US-based financial services company must ensure that all customer data remains within the United States at all times to comply with regulatory requirements. The company plans to replicate its Azure SQL database between two Azure regions for disaster recovery. The solution must guarantee that if a region experiences a major outage, the paired region is prioritized for recovery. Additionally, the solution should ensure that during planned maintenance, only one region in the pair is updated at a time. Which Azure architecture feature should the company use?

Accepted Answer

Region Pairs. Region Pairs are the correct choice because Azure guarantees that each region is paired with another region within the same geography (e.g., East US with West US) to provide physical isolation, prioritized disaster recovery, and sequential planned maintenance updates. This ensures that during an outage, recovery is directed to the paired region, and during maintenance, only one region in the pair is updated at a time, meeting the company's regulatory and availability requirements.

Answer

Availability Zones

Answer

Resource Groups

Answer

Azure Policy

Question 5

A company deploys two Azure virtual machines (VMs) into the same availability set. The first VM runs a web server and the second runs a database server. The company's primary concern is that during Azure platform maintenance events (e.g., OS updates to the underlying host) or in the event of a hardware failure in the datacenter, both VMs should not be impacted at the same time. Which benefit does placing the VMs in the same availability set provide?

Accepted Answer

The VMs will be distributed across different fault domains and update domains within the datacenter.. An availability set ensures that VMs are distributed across different fault domains (separate power, cooling, and network racks) and update domains (groups that are updated sequentially during planned maintenance). This isolation guarantees that a hardware failure or a platform maintenance event will not affect both VMs simultaneously, meeting the company's primary concern.

Answer

Both VMs will be placed on the same physical server for performance consistency.

Answer

The VMs will be automatically load-balanced and scaled based on CPU usage.

Answer

The VMs will be replicated to a second Azure region for disaster recovery.

Question 6

A company is building a mobile app backend that handles HTTP requests from thousands of users. The traffic pattern is highly unpredictable: there can be sudden spikes to hundreds of requests per second followed by long periods of no activity. The development team wants a solution that automatically scales from zero to hundreds of instances based on demand, and they want to pay only for the compute time consumed when the code is actually executing. They do not want to manage any underlying infrastructure, such as virtual machines or containers. Which Azure compute service should they choose?

Accepted Answer

Azure Functions. Azure Functions is the correct choice because it is a serverless compute service that automatically scales from zero to hundreds of instances based on incoming HTTP requests, and you pay only for the compute time consumed when your code executes. It handles unpredictable traffic patterns with sudden spikes and idle periods without requiring any infrastructure management, as it runs on a consumption plan that provides dynamic scaling.

Answer

Azure App Service

Answer

Azure Kubernetes Service (AKS)

Answer

Azure Virtual Machines

Question 7

A company runs a critical transaction-processing application on Azure virtual machines in the East US region. The application writes data to Azure managed disks and also stores files in Azure Blob Storage. The company's disaster recovery policy requires that all storage data must survive a complete failure of an Azure availability zone within the same region without any data loss. The solution must use synchronous replication and must not replicate data to a different Azure region. Which Azure storage redundancy option should the company configure for the Blob Storage account?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) synchronously replicates data across three Azure availability zones within the same region, ensuring no data loss if an entire zone fails. This meets the disaster recovery requirement for synchronous replication and intra-region resilience without replicating to a different region.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 8

A company has multiple on-premises file servers that store user home directories and department shares. The company wants to migrate these file shares to Azure Files to eliminate on-premises server maintenance. However, users frequently access large files, and the company wants to cache the most frequently accessed files locally on a small Windows Server machine at each branch office to minimize latency and bandwidth usage. The company also wants a single unified namespace so users can access files using the same path regardless of whether the files are cached locally or stored in Azure. Which Azure service should the company use?

Accepted Answer

Azure File Sync. Azure File Sync is the correct choice because it enables caching of frequently accessed files on a local Windows Server at each branch office while maintaining a single unified namespace (the same UNC path). It synchronizes files between Azure Files and on-premises servers, allowing users to access files locally for low latency and bandwidth savings, while changes are synced to Azure. This directly addresses the requirement to eliminate on-premises server maintenance by using Azure Files as the primary storage, with local caching for performance.

Answer

Azure Blob Storage with Azure Content Delivery Network (CDN)

Answer

Azure Site Recovery

Answer

Azure Migrate

Question 9

A company has two Azure virtual networks: VNet-A in the East US region and VNet-B in the West US region. Both virtual networks use non-overlapping IP address spaces and are deployed in different resource groups. The company needs to enable communication between resources in VNet-A and VNet-B using private IP addresses only, with low latency and without any traffic traversing the public internet. The solution must not require deploying a virtual network gateway or any additional network appliance. Which Azure service should the company use?

Accepted Answer

Azure Virtual Network Peering. Azure Virtual Network Peering connects VNet-A and VNet-B directly over the Microsoft backbone network, enabling private IP communication with low latency and no public internet traversal. It requires no virtual network gateway or additional appliances, and works across regions (global peering) as long as IP address spaces are non-overlapping.

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Answer

Azure Load Balancer

Question 10

A company runs several Azure virtual machines (VMs) in a virtual network. Administrators need to connect to these VMs using Remote Desktop Protocol (RDP) to perform maintenance tasks. The security team mandates that the VMs must not have any public IP addresses assigned. All RDP traffic must be routed through a fully managed Azure service that provides secure TLS-based access directly from the Azure portal, without requiring any client software installation on the administrator's workstation. Which Azure service should the company use?

Accepted Answer

Azure Bastion. Azure Bastion is a fully managed Platform as a Service (PaaS) that provides secure and seamless RDP/SSH connectivity to virtual machines directly from the Azure portal over TLS. It eliminates the need for public IP addresses on the VMs by deploying a Bastion host in the same virtual network, acting as a jump server that brokers the connection. Because it requires no client software on the administrator's workstation and enforces TLS-based access, it perfectly meets the security mandate and connectivity requirements described.

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Answer

Azure Application Gateway

Question 11

A company runs an on-premises line-of-business application that uses a SQL Server database. The database currently has 500 GB of data and is accessed by 50 users simultaneously. The company is planning to migrate this database to Azure. The IT team wants to minimize administrative overhead for patching the operating system and database engine, and for performing automated backups with point-in-time restore. The team also wants the ability to scale compute and storage independently without managing virtual machines. Which Azure service should they choose?

Accepted Answer

Azure SQL Database (Platform-as-a-Service). Azure SQL Database is a Platform-as-a-Service (PaaS) offering that fully manages the underlying operating system and SQL Server engine, including patching and updates. It provides automated backups with point-in-time restore (up to 35 days retention) and allows independent scaling of compute (DTUs/vCores) and storage without any virtual machine management. This directly meets the team's requirements to minimize administrative overhead while supporting 500 GB of data and 50 concurrent users.

Answer

SQL Server on Azure Virtual Machine (Infrastructure-as-a-Service)

Answer

Azure Cosmos DB

Answer

Azure Database for MySQL

Question 12

A company deploys a critical application on Azure virtual machines across three different availability zones in the East US region. The application is designed to handle the failure of one zone by automatically failing over to the remaining healthy zones. Which type of failure does this architecture primarily protect against?

Accepted Answer

A failure of an entire Azure data center. Option C is correct because deploying a critical application across multiple availability zones protects against the failure of an entire Azure data center. Each availability zone is a physically separate data center within an Azure region, with independent power, cooling, and networking. If one zone fails, the application automatically fails over to the remaining healthy zones, ensuring high availability at the data center level.

Answer

A regional disaster that affects the entire East US region

Answer

A failure of a single physical server

Answer

A failure of the Azure network backbone

Question 13

A global e-commerce company runs its website on Azure virtual machines in two different Azure regions: West US and East US. The company wants to distribute incoming web traffic to the region that provides the lowest latency for each user. Additionally, if one region becomes unavailable, all traffic should automatically fail over to the healthy region. The solution must not require any changes to the web application code. Which Azure service should the company use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that directs incoming web traffic to the region with the lowest latency based on the user's DNS resolver location. It supports automatic failover by routing traffic to the next healthy endpoint if a region becomes unavailable, and it requires no changes to the web application code because it operates at the DNS level.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 14

A company is migrating its on-premises batch processing jobs to Azure. The jobs are triggered by file uploads to an on-premises file share. After migration, the files will be uploaded to Azure Blob Storage. The company wants a solution where code runs automatically whenever a new blob is created, with no requirement to manage servers or containers. The code must process the blob and then terminate. Compute resources should be used only when there is a file to process. Which Azure compute service should the company use?

Accepted Answer

Azure Functions. Azure Functions is the correct choice because it provides a serverless compute service that can be triggered automatically by Azure Blob Storage events (e.g., new blob creation). The code runs only when a blob is uploaded, processes it, and then terminates, ensuring zero compute cost when idle. No servers or containers need to be managed, aligning perfectly with the requirement for event-driven, ephemeral execution.

Answer

Azure App Service

Answer

Azure Kubernetes Service (AKS)

Answer

Azure Virtual Machine Scale Sets

Question 15

A company stores sensitive customer data in an Azure Blob Storage account. The company's security policy requires that all data traffic between the virtual network (VNet) and the storage account must never traverse the public internet. Additionally, the storage account must remain accessible from an on-premises data center through a Site-to-Site VPN connection. Which Azure feature should the company configure on the storage account?

Accepted Answer

Azure Private Link (using a private endpoint). Azure Private Link with a private endpoint is correct because it assigns a private IP address from the VNet to the storage account, ensuring all traffic between the VNet and the storage account stays within the Microsoft Azure backbone network and never traverses the public internet. Additionally, the storage account can still be accessed from an on-premises data center via a Site-to-Site VPN connection that terminates in the same VNet, as the private endpoint is reachable over the VPN.

Answer

Azure service endpoints

Answer

Azure VPN Gateway connection to the storage account

Answer

Azure route tables