AZ-900 Describe Azure architecture and services Practice Test 6 — 15 Questions

Question 1

A company has virtual machines in a virtual network that run a critical internal application. IT administrators need to securely connect to these VMs from the internet for management purposes. They must not assign public IP addresses to the VMs, and they want to avoid managing SSH or RDP endpoints. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure and seamless RDP/SSH connectivity to virtual machines directly in the Azure portal over TLS, without exposing public IP addresses on the VMs. It eliminates the need for managing public endpoints, as the Bastion service is deployed inside the virtual network and acts as a jump server that brokers the connection. This meets the requirement of secure internet-based management without public IPs or manual SSH/RDP endpoint management.

Answer

Azure VPN Gateway

Answer

Azure Load Balancer

Answer

Azure Firewall

Question 2

A finance company is migrating a mission-critical trading application to Azure. The application must be resilient to a complete datacenter failure within the same Azure region. The solution should provide low-latency replication between separate physical locations with independent power, cooling, and networking. Which Azure feature should they use?

Accepted Answer

Availability Zones. Availability Zones (B) are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. They provide low-latency replication and protect against a complete datacenter failure by allowing the application to run in multiple zones simultaneously, ensuring high availability and resilience within a single region.

Answer

Availability Sets

Answer

Azure Site Recovery

Answer

Region Pairs

Question 3

A company is deploying a critical internal application in Azure. The application will run on two virtual machines. The solution must guarantee that the virtual machines are placed on separate physical servers and separate racks to minimize the impact of hardware failures. Which Azure feature should the company use?

Accepted Answer

Availability set. An availability set ensures that virtual machines are distributed across multiple fault domains (separate physical servers and racks) and update domains within an Azure datacenter. By placing the two VMs in the same availability set, Azure guarantees they will be on different physical hardware, minimizing the impact of a single hardware failure.

Answer

Azure Load Balancer

Answer

Availability zone

Answer

Virtual network

Question 4

A company has five Azure subscriptions, each managed by a different department. The IT governance team needs to enforce a single set of compliance policies (e.g., allowed VM SKUs) and assign a specific role to a central security team across all subscriptions. The goal is to minimize administrative overhead. Which Azure component should the governance team use as the scope for these assignments?

Accepted Answer

Place all subscriptions under a single management group and assign policies and roles at that management group level.. Management groups provide a hierarchical scope above subscriptions, enabling centralized governance. By placing all five subscriptions under a single management group, the IT governance team can assign Azure Policy definitions (e.g., allowed VM SKUs) and role-based access control (RBAC) roles (e.g., for the security team) once at that management group level. This inheritance automatically applies the policies and roles to all child subscriptions, minimizing administrative overhead compared to per-subscription or per-resource-group assignments.

Answer

Assign the policies and role at each subscription level individually.

Answer

Create a resource group in each subscription and assign policies and roles at the resource group level.

Answer

Create an Azure Blueprint definition and apply it to each subscription separately.

Question 5

A company is deploying a web application in Azure. The application consists of an Azure App Service, an Azure SQL Database, and a Storage account. The development team maintains three separate environments: development, test, and production. The team wants to be able to delete all resources associated with a specific environment (e.g., development) in a single action, without affecting the other environments. The solution must also allow applying role-based access control (RBAC) and tags consistently to all resources within each environment. Which Azure component should the team use to achieve these requirements?

Accepted Answer

Azure resource group. An Azure resource group is a logical container that holds related resources for an Azure solution. By placing all resources for a specific environment (e.g., development) into a single resource group, the team can delete the entire environment in one action by deleting the resource group, without affecting other environments. Additionally, RBAC roles and tags applied at the resource group level are inherited by all resources within that group, ensuring consistent governance.

Answer

Azure subscription

Answer

Azure management group

Answer

Azure availability zone

Question 6

A multinational bank operates a critical financial application that must remain available even if an entire Azure region experiences a prolonged outage. The bank's compliance team mandates that the disaster recovery data must reside in a separate geographic location that is at least 300 miles away from the primary region to reduce the risk of correlated failures. The solution must use Azure's built-in data replication feature without requiring manual pairing of regions. Which Azure feature meets these requirements?

Accepted Answer

Azure Region Pair. Azure Region Pairs are designed to provide built-in disaster recovery by replicating data (e.g., geo-redundant storage) to a paired region that is at least 300 miles away, ensuring geographic separation without manual pairing. This meets the bank's compliance requirement for a separate location and automatic failover capability during a prolonged regional outage.

Answer

Azure Availability Zones

Answer

Azure Resource Manager

Answer

Azure Policy

Question 7

A global e-commerce company has deployed its web application in two Azure regions: West US and East US. The company wants to automatically route end users to the region that provides the lowest latency, and if an entire region becomes unavailable, gracefully redirect all traffic to the remaining healthy region. Which Azure service should the company use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming DNS requests to the endpoint with the lowest latency based on the user's geographic location. It also supports automatic failover: if an entire region becomes unavailable, Traffic Manager detects the endpoint health probe failure and redirects all traffic to the remaining healthy region, meeting the company's requirements.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 8

A financial services company runs a critical trading application in its on-premises data center. The company is migrating some workloads to Azure and requires a dedicated, private network connection between its on-premises network and Azure. The connection must not use the public internet, must provide consistent latency and higher bandwidth than a typical internet-based VPN, and must be backed by a service-level agreement (SLA) for availability. Which Azure service should the company use to meet these requirements?

Accepted Answer

ExpressRoute. ExpressRoute is the correct choice because it provides a dedicated, private connection between on-premises networks and Azure that bypasses the public internet entirely. This ensures consistent latency, higher bandwidth options (up to 100 Gbps), and a financially backed SLA of at least 99.95% availability, meeting all the stated requirements for a critical trading application.

Answer

Azure VPN Gateway

Answer

Azure Firewall

Answer

Azure Front Door

Question 9

A company has a large dataset of historical financial records that must be retained for 10 years to comply with regulatory requirements. The data is accessed only a few times per year during audits. When accessed, a retrieval delay of up to 15 hours is acceptable. The company wants to minimize storage costs for this dataset. Which Azure Blob storage access tier should the company use?

Accepted Answer

Archive tier. The Archive tier is the correct choice because it is the lowest-cost storage tier for data that is rarely accessed and has a flexible retrieval time. With a 10-year retention requirement and only a few accesses per year, the Archive tier's retrieval time of up to 15 hours (actual range is 1–15 hours for standard retrieval) is acceptable, and it minimizes storage costs compared to other tiers.

Answer

Hot tier

Answer

Cool tier

Answer

Premium tier

Question 10

A company plans to deploy two Azure virtual machines that host a critical web application. Both VMs will be in the same Azure region and the same virtual network. The company’s requirements are: 1) During Azure platform-initiated maintenance (e.g., OS updates), at least one VM must remain running. 2) If a hardware failure occurs in the server rack that hosts one VM, the other VM must not be affected. 3) The solution must not incur additional costs beyond the VMs themselves. Which Azure feature should the company configure?

Accepted Answer

Availability Set. An Availability Set distributes VMs across multiple fault domains (different server racks with independent power and networking) and update domains (groups that undergo platform maintenance sequentially). This ensures that during Azure-initiated maintenance, only one update domain is rebooted at a time, leaving at least one VM running, and that a hardware failure in one fault domain does not affect VMs in other fault domains. Availability Sets are free of charge beyond the cost of the VMs themselves, meeting all requirements.

Answer

Availability Zones

Answer

Azure Site Recovery

Answer

Azure Load Balancer

Question 11

A company has a simple containerized web application that runs in a single container. The application processes a workload for a few minutes every hour and remains idle the rest of the time. The company wants to deploy the container in Azure without managing any virtual machines or container orchestrators. They also want to pay only for the time the container is actually running, with no cost when idle. Which Azure compute service should the company use?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it allows you to run a containerized application without managing any underlying virtual machines or container orchestrators like Kubernetes. ACI supports a per-second billing model, meaning you only pay for the compute resources consumed while the container is actively running, and incur no cost when the container is stopped or idle. This aligns perfectly with the company's requirement of a simple, single-container workload that runs intermittently.

Answer

Azure App Service

Answer

Azure Virtual Machine Scale Sets

Answer

Azure Kubernetes Service

Question 12

A company deploys two Azure virtual machines in an availability set. The application requires that at least one VM remains running during Azure platform-initiated maintenance, such as operating system updates to the underlying host. Which component of the availability set directly ensures that the VMs are not updated at the same time?

Accepted Answer

Update domains. Update domains (B) are the correct component because they logically group VMs that are updated together during Azure platform-initiated maintenance. By placing VMs in different update domains, Azure ensures that only one update domain is taken offline at a time, guaranteeing that at least one VM remains running during host OS updates.

Answer

Fault domains

Answer

Proximity placement groups

Answer

Availability zones

Question 13

A company runs a mission-critical application on Azure virtual machines. The application must remain available even if an entire Azure datacenter in a region experiences a complete outage (e.g., power failure). The company wants all VMs to be located in the same Azure region to minimize latency. Which Azure feature should the company use to deploy the VMs?

Accepted Answer

Availability Zone. Availability Zones (AZs) are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across multiple AZs protects against a single datacenter failure while keeping all resources within the same region to minimize latency. This meets the requirement for high availability during a complete datacenter outage.

Answer

Availability Set

Answer

Resource Group

Answer

Proximity Placement Group

Question 14

A company has two Azure virtual networks: VNet-A in the East US region and VNet-B in the West US region. Each VNet hosts a set of virtual machines that run a distributed application. The application requires private, low-latency communication between the VMs in VNet-A and VNet-B. The company wants to minimize operational complexity and avoid any additional billing for data transfer between the two VNets beyond the standard Azure data transfer charges. Which Azure service should the company use to connect the two virtual networks?

Accepted Answer

Azure Virtual Network Peering. Azure Virtual Network Peering is the correct choice because it connects two virtual networks directly over the Microsoft backbone network, providing private, low-latency communication between VMs in different regions. It incurs only standard Azure data transfer charges (no additional gateway or circuit costs) and requires minimal operational overhead, as it is a simple configuration with no extra devices or bandwidth provisioning.

Answer

Azure VPN Gateway (Site-to-Site)

Answer

Azure ExpressRoute

Answer

Azure Front Door

Question 15

A company runs a web application on two Azure virtual machines in the same region. The application must be accessible from the internet, and incoming traffic should be distributed evenly across both VMs. Additionally, the company needs to offload Transport Layer Security (TLS) termination to a single service and route requests based on the URL path (e.g., /images to one set of VMs, /api to another). Which Azure service should the company use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 (HTTP/HTTPS) load balancer that supports TLS termination, URL path-based routing, and cookie-based session affinity. This allows the company to offload TLS decryption to a single service and route requests like /images or /api to different backend pools, meeting all stated requirements.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door