AZ-900 Describe Azure architecture and services Practice Test 12 — 15 Questions

Question 1

A company is developing a REST API that processes incoming HTTP requests. The API usage is highly unpredictable; sometimes it receives thousands of requests per minute, and at other times it receives zero requests for hours. The company wants to pay only for the compute time consumed when the API code is actually executing. They also want Microsoft to automatically handle scaling and maintenance of the underlying server infrastructure. Which Azure compute service should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Functions (Consumption plan). Azure Functions with the Consumption plan is the correct choice because it is a serverless compute service that executes code only when triggered by incoming HTTP requests, automatically scaling to handle unpredictable workloads. The Consumption plan charges only for the compute time consumed during execution, with no cost when the function is idle, and Microsoft fully manages the underlying infrastructure, including scaling and maintenance.

Answer

Azure App Service (Basic tier)

Answer

Azure Container Instances

Answer

Azure Logic Apps

Question 2

A company stores a critical database in Azure Blob Storage. The data must remain available even if an entire Azure datacenter fails. The company uses the East US region, which supports availability zones. They want the lowest-cost storage redundancy option that protects against a full datacenter failure while keeping all data within the East US region. Which redundancy option should they choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) is the correct choice because it synchronously replicates data across three availability zones within the East US region, ensuring data remains accessible even if an entire datacenter (one zone) fails. This meets the requirement for intra-region protection against a full datacenter failure at the lowest cost, as ZRS does not incur the additional expense of geo-replication.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 3

A company plans to deploy a critical application in two Azure regions to ensure disaster recovery. The company wants to guarantee that during a major regional outage, the recovery region is physically separated from the primary region and that planned maintenance updates are rolled out sequentially to minimize downtime. Which Azure feature should the company leverage when selecting the secondary region?

Accepted Answer

Region Pairs. Region Pairs are the correct Azure feature because they guarantee physical separation between paired regions (e.g., at least 300 miles apart) and ensure that planned maintenance updates are applied sequentially across the pair, with only one region updated at a time. This minimizes downtime during disaster recovery by reducing the risk of simultaneous failures and providing a predictable recovery window.

Answer

Availability Zones

Answer

Azure Front Door

Answer

Azure Site Recovery

Question 4

A company runs a critical ERP system on-premises and plans to extend the application to Azure IaaS VMs for burst capacity. The network team requires a dedicated, private connection between the on-premises data center and Azure that does not traverse the public internet. The connection must offer consistent latency, high bandwidth options up to 10 Gbps, and a financially backed SLA for availability. Which Azure service should the team provision to meet these requirements?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated, private connection from on-premises to Azure that bypasses the public internet, ensuring consistent latency and high bandwidth up to 10 Gbps. It also offers a financially backed SLA for availability, making it the ideal choice for extending a critical ERP system for burst capacity with predictable performance.

Answer

Azure VPN Gateway (site-to-site)

Answer

Azure Front Door

Answer

Azure Bastion

Question 5

A global e-commerce company has web applications deployed on Azure virtual machines in the West US and West Europe regions. The company needs a single, global HTTP-based entry point that can perform SSL offloading, route requests based on the URL path (e.g., /api to one backend pool, /images to another), and provide a web application firewall (WAF) to protect against common web attacks. Additionally, the solution must automatically direct users to the closest regional deployment to minimize latency. Which Azure service should the company use?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it provides a global, HTTP/HTTPS-based entry point with SSL offloading, URL path-based routing to different backend pools, and a built-in web application firewall (WAF). It also uses Anycast-based routing to automatically direct users to the closest regional deployment, minimizing latency.

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Answer

Azure Load Balancer

Question 6

A company plans to containerize a legacy web application and run it on Azure. The application experiences variable traffic volumes, with periodic spikes during lunch hours and weekends. The company wants the solution to automatically increase the number of running container instances during high demand and reduce them during low demand, without requiring any manual intervention or management of server infrastructure. Which Azure compute service should the company use?

Accepted Answer

Azure App Service. Azure App Service is correct because it supports containerized web applications with built-in autoscaling capabilities that automatically adjust the number of running container instances based on demand, such as CPU or memory thresholds, without requiring any manual intervention or server management. The platform handles the underlying infrastructure, patching, and load balancing, making it ideal for variable traffic patterns like lunch-hour spikes.

Answer

Azure Container Instances (ACI)

Answer

Azure Kubernetes Service (AKS)

Answer

Azure Functions

Question 7

A company plans to migrate its on-premises SQL Server database to Azure. The database uses many features including SQL Server Agent jobs, cross-database queries, and CLR integration. The company wants a fully managed PaaS service that minimizes application code changes and supports native virtual network (VNet) integration without requiring a private endpoint. Which Azure service should the company use?

Accepted Answer

Azure SQL Managed Instance. Azure SQL Managed Instance is the correct choice because it provides near 100% compatibility with on-premises SQL Server, including SQL Server Agent jobs, cross-database queries, and CLR integration, while being a fully managed PaaS service. It supports native VNet integration without requiring a private endpoint, allowing the database to be placed directly into a customer's virtual network for secure, isolated connectivity.

Answer

Azure SQL Database

Answer

SQL Server on Azure Virtual Machine

Answer

Azure Cosmos DB

Question 8

A company runs a critical order-processing application on two Azure virtual machines in the West US region. The application must remain available even if an entire datacenter in that region experiences a complete outage. The company wants to place the two VMs in separate physical locations within the same region to provide fault tolerance against a datacenter-level failure. Which Azure feature should they use?

Accepted Answer

Availability Zones. Availability Zones (B) are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By placing each VM in a different zone, the application remains available even if an entire datacenter fails, providing fault tolerance at the datacenter level within the same region.

Answer

Availability Set

Answer

Azure Region Pair

Answer

Virtual Machine Scale Set

Question 9

A company stores critical customer data in Azure Blob Storage. The compliance team requires that the data remains available for read operations even if the primary Azure region experiences a complete outage. They plan to use an Azure storage redundancy option that automatically replicates data to a secondary region and allows read access from that secondary region during an outage, without requiring any manual failover action. Which storage redundancy option should they configure on the storage account?

Accepted Answer

Read-access geo-redundant storage (RA-GRS). RA-GRS (Read-access geo-redundant storage) is correct because it replicates data to a secondary region (geo-redundancy) and, crucially, enables read access to that secondary replica during a primary region outage without requiring any manual failover. This meets the compliance requirement for automatic read availability during a complete primary region failure.

Answer

Locally-redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Question 10

A company runs its line-of-business application on a virtual machine in an on-premises data center. The business continuity team wants to replicate the entire server (including operating system, applications, and data) to Azure so that if the on-premises site fails, the workload can be quickly started in an Azure region. The team also needs the ability to perform non-disruptive disaster recovery drills to validate the failover process. Which Azure service should the team use?

Accepted Answer

Azure Site Recovery. Azure Site Recovery (ASR) is the correct service because it provides orchestrated replication of entire on-premises virtual machines—including OS, applications, and data—to Azure. It supports planned and unplanned failover, and crucially allows non-disruptive disaster recovery drills via test failover, which isolates the replicated environment without impacting the production workload.

Answer

Azure Backup

Answer

Azure Migrate

Answer

Azure Traffic Manager

Question 11

A company wants to proactively identify Azure resources that are misconfigured and could lead to security vulnerabilities, such as virtual machines with open management ports or unencrypted storage accounts. They also need to get prioritized recommendations for remediating these issues. Which Azure service should the company use?

Accepted Answer

Microsoft Defender for Cloud (formerly Azure Security Center). Microsoft Defender for Cloud (formerly Azure Security Center) is the correct service because it continuously assesses the security posture of Azure resources, identifies misconfigurations such as open management ports (e.g., RDP/SSH) or unencrypted storage accounts, and provides prioritized, actionable recommendations for remediation. It integrates with Azure Policy to enforce security standards and offers a secure score to track improvement over time.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Blueprints

Question 12

A company develops a web API that runs on Azure App Service. The development team wants to deploy a new version of the API to a staging environment, run integration tests against it, and then gradually shift production traffic to the new version. If any issues are detected, they want to immediately roll back to the previous version without redeploying. Which Azure App Service feature should the team use to meet these requirements?

Accepted Answer

Deployment slots. Deployment slots are separate, live environments within Azure App Service that allow you to stage a new version of your web API, run integration tests against it, and then swap it into production with zero downtime. The swap operation also enables instant rollback by swapping back to the previous slot, which preserves the old version without requiring a redeployment.

Answer

Autoscale

Answer

Traffic Manager profiles

Answer

Application Insights

Question 13

A company has deployed several Azure virtual machines in a virtual network. The security policy requires that administrators must be able to connect to these VMs using Remote Desktop Protocol (RDP) from the Azure portal, but the VMs must not have any public IP addresses assigned. The company wants to minimize management overhead and avoid deploying additional jump-box virtual machines. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure and seamless RDP/SSH connectivity to virtual machines directly from the Azure portal over TLS, without requiring public IP addresses on the VMs. It is a fully managed PaaS service that is deployed inside the virtual network, eliminating the need for a jump-box or additional management overhead. This meets the security policy by ensuring VMs remain isolated from the internet while administrators can still connect via the portal.

Answer

Azure Front Door

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Question 14

A company plans to deploy a mission-critical application on three Azure virtual machines. The application must remain available even if an entire Azure datacenter becomes unavailable due to a catastrophic event like a fire or flood. The company wants to deploy the VMs across multiple physical locations within a single Azure region, with each location having independent power, cooling, and networking. Which Azure feature should the company use?

Accepted Answer

Availability zones. Availability zones are physically separate locations within an Azure region, each with independent power, cooling, and networking. By deploying the three VMs across different availability zones, the application remains available even if an entire datacenter (one zone) fails due to a catastrophic event. This meets the requirement for high availability across multiple physical locations within a single region.

Answer

Availability sets

Answer

Azure Site Recovery

Answer

Virtual machine scale sets

Question 15

A company runs an Azure SQL Database that stores sensitive customer data. The security team mandates that all traffic to the database must remain entirely within the Microsoft Azure backbone network and never traverse the public internet. The database can only be accessed by a specific application running on virtual machines in a specific Azure virtual network. Which Azure feature should they configure to meet this requirement?

Accepted Answer

Azure Private Endpoint. Azure Private Endpoint assigns a private IP address from your virtual network to the Azure SQL Database, allowing traffic to reach the database over the Microsoft backbone network without ever leaving the Azure network or traversing the public internet. This ensures that all communication between the application VMs and the database remains private and secure, meeting the mandate that traffic must never traverse the public internet.

Answer

Azure Service Endpoint

Answer

VNet Peering

Answer

Azure Firewall