AZ-900 Describe Azure architecture and services Practice Test 7 — 15 Questions

Question 1

A company is developing a web application that will be deployed to Azure App Service. The application experiences unpredictable spikes in traffic, and the company wants the number of instances to automatically increase during high demand and decrease during low demand to optimize costs. The company also needs to use a custom domain name and ensure the application is accessible over HTTPS. Which App Service plan tier should the company choose?

Accepted Answer

Standard. The Standard tier is the correct choice because it supports all three requirements: autoscaling (the ability to automatically increase or decrease the number of instances based on traffic), custom domains, and HTTPS (SNI-based SSL/TLS binding). The Free and Shared tiers do not support autoscaling or custom domains, and the Basic tier supports custom domains and HTTPS but lacks autoscaling.

Answer

Free

Answer

Shared

Answer

Basic

Question 2

A company stores critical business data in an Azure Storage account. The data must remain available if a single Azure datacenter experiences a failure (e.g., fire, power outage). The company wants to minimize storage costs. Which storage redundancy option should they choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) synchronously replicates data across three Azure availability zones within a single region, ensuring data remains available if an entire datacenter fails. This meets the requirement for datacenter failure protection while minimizing costs compared to geo-redundant options, as ZRS does not incur cross-region bandwidth charges.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 3

A company runs a web application in two Azure regions: East US and West US. The company wants to route users automatically to the region that provides the lowest network latency. If one region becomes unavailable, all traffic should be rerouted to the healthy region. The company does not need to offload Transport Layer Security (TLS) or perform URL-based routing. Which Azure service should the company use to distribute traffic at the DNS level?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager operates at the DNS level, using DNS responses to direct user traffic to the region with the lowest network latency based on the Performance traffic-routing method. It also supports automatic failover: if a region becomes unavailable, Traffic Manager detects the endpoint health probe failure and reroutes all traffic to the healthy region. This matches the requirement exactly, as the company needs DNS-level distribution without TLS offloading or URL-based routing.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 4

A company runs a production web application on Azure App Service. The development team is working on a new version of the application and wants to deploy it to a staging environment to perform validation tests. After testing, they need to gradually shift a percentage of live user traffic to the new version while monitoring for issues. If any problems occur, they must be able to instantly send all traffic back to the original version with zero downtime. Which Azure App Service feature should the team use to achieve this?

Accepted Answer

Deployment slots. Deployment slots are the correct choice because Azure App Service supports deploying different versions of an application to separate slots (e.g., staging) and then swapping them into production. The swap operation allows you to gradually shift traffic using slot auto-swap or manual swap with traffic routing, and if issues arise, you can instantly swap back to the original slot with zero downtime, as the swap preserves the warm-up state of the target slot.

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 5

A company has deployed several Windows and Linux virtual machines in an Azure virtual network. For security reasons, the virtual machines have no public IP addresses assigned. The IT administrators need to securely connect to these VMs using Remote Desktop Protocol (RDP) for Windows and Secure Shell (SSH) for Linux without deploying any additional agents on the VMs. The connection must be established directly from the Azure portal, and the service must provide protection against port scanning and brute-force attacks. Which Azure service should the company use?

Accepted Answer

Azure Bastion. Azure Bastion is the correct choice because it provides secure, seamless RDP and SSH connectivity to virtual machines directly from the Azure portal over TLS, without requiring any public IP addresses on the VMs or additional agent installations. It uses a hardened bastion host inside the virtual network, and by default it protects against port scanning and brute-force attacks by not exposing the VMs' RDP/SSH ports to the internet.

Answer

Just-in-time (JIT) VM access (Microsoft Defender for Cloud)

Answer

Azure Firewall

Answer

Azure VPN Gateway

Question 6

A financial services company must migrate a critical application to Azure. Regulatory compliance requires that the virtual machines (VMs) hosting this application run on physical servers that are dedicated solely to the company and not shared with any other Azure customer. The company needs full control over server hardware maintenance, including the ability to schedule updates and isolate the environment at the physical layer. Which Azure compute solution should the company use?

Accepted Answer

Azure Dedicated Host. Azure Dedicated Host provides physical servers dedicated to a single Azure subscription, ensuring that no other customer's VMs share the hardware. This meets the regulatory requirement for physical isolation and gives the company full control over server hardware maintenance, including the ability to schedule updates and manage the host lifecycle independently.

Answer

Azure Reserved Instances

Answer

Azure Virtual Machine Scale Sets

Answer

Azure Confidential Computing

Question 7

A company plans to deploy a critical web application on Azure virtual machines in the West US region. The application must remain available if a single datacenter within that region experiences a complete outage. The company also requires the virtual machines to be connected to each other with low-latency network connectivity. Which Azure feature should the company use to deploy the virtual machines?

Accepted Answer

Availability Zone. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across two or more zones ensures that if one datacenter fails, the application remains available in another zone, while the VMs within the same region can still be connected via a low-latency virtual network.

Answer

Availability Set

Answer

Region Pair

Answer

Virtual Machine Scale Set

Question 8

A company hosts a web application in the West US region on two Azure virtual machines that are in the same virtual network. The application handles user sessions that must persist on the same virtual machine for the duration of a checkout process. The company needs to load balance incoming HTTP traffic across the two virtual machines. If one virtual machine becomes unhealthy, the load balancer must automatically stop sending new traffic to that machine. Which Azure service should the company use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is correct because it provides HTTP/HTTPS layer-7 load balancing with session affinity (also known as sticky sessions) using cookie-based persistence, which ensures that all requests from a user during the checkout process are routed to the same virtual machine. It also includes built-in health probes that automatically stop sending traffic to an unhealthy backend VM, meeting both requirements precisely.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Front Door

Question 9

Company A deploys several Linux virtual machines (VMs) across multiple Azure availability zones in the West US region. The VMs run a cluster application that needs to read and write data concurrently to a shared file system. The solution must support the Server Message Block (SMB) protocol and must be accessible from all zones with low latency. Which Azure storage service should the company use?

Accepted Answer

Azure Files. Azure Files provides fully managed file shares in the cloud that support the SMB protocol, making it the correct choice for a shared file system accessible from multiple Azure availability zones with low latency. It allows concurrent read/write access from Linux VMs across zones, meeting the cluster application's requirements.

Answer

Azure Blob Storage

Answer

Azure Managed Disks

Answer

Azure Queue Storage

Question 10

A company has two on-premises data centers connected to each other via a high-speed MPLS link. They plan to migrate several critical workloads to Azure. The network team requires a dedicated, private connection from each on-premises site to Azure that does not traverse the public internet. The connection must provide high bandwidth, low latency, and a Service Level Agreement (SLA) for availability. Which Azure service should the network team provision to meet these requirements?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated, private connection from on-premises data centers to Azure that does not traverse the public internet. It offers high bandwidth, low latency, and a financially backed SLA of 99.95% availability, meeting all the stated requirements for critical workloads.

Answer

Azure VPN Gateway (Site-to-Site)

Answer

Azure Virtual WAN

Answer

Azure Application Gateway

Question 11

A company uses Azure Blob Storage to store backup files that must survive a complete regional outage. The company needs the data to be automatically accessible from a secondary region if the primary region becomes unavailable, without any manual failover. Which storage redundancy option should the company use?

Accepted Answer

Read-Access Geo-Redundant Storage (RA-GRS). Read-Access Geo-Redundant Storage (RA-GRS) is the correct choice because it provides geo-redundancy (data replicated to a secondary region for disaster recovery) and, crucially, enables read access to the secondary region without requiring a manual failover. This ensures that if the primary region becomes unavailable, the data is automatically accessible from the secondary region for read operations, meeting the requirement of no manual intervention.

Answer

Locally Redundant Storage (LRS)

Answer

Zone-Redundant Storage (ZRS)

Answer

Geo-Redundant Storage (GRS)

Question 12

A company uses Azure Blob Storage to store compliance documents that are required to be kept for 10 years. The documents are very rarely accessed; on average, only 2-3 requests per year are made, usually for audits. The company needs the lowest possible storage cost. When a document is requested, the company can tolerate a retrieval time of up to 15 hours. Which Azure Blob Storage access tier should the company use?

Accepted Answer

Archive access tier. The Archive access tier is designed for data that is rarely accessed and has a flexible retrieval time, offering the lowest storage cost among Azure Blob Storage tiers. With only 2-3 requests per year and a tolerance for up to 15-hour retrieval latency, the Archive tier (which typically takes up to 15 hours to rehydrate) perfectly matches the requirements while minimizing storage expenses.

Answer

Hot access tier

Answer

Cool access tier

Answer

Premium access tier

Question 13

A company stores sensitive customer transaction records in Azure Blob Storage. The records must be available for read access at all times, even if the primary Azure region becomes unavailable. The company initially configured geo-redundant storage (GRS). During a disaster recovery test, the operations team discovers that although data is replicated to a secondary region, they cannot read the data from the secondary region until a Microsoft-initiated failover occurs. The team needs a solution that provides immediate, continuous read access to the replicated data in the secondary region without waiting for a failover. Which Azure Storage replication option should the company use?

Accepted Answer

Read-access geo-redundant storage (RA-GRS). RA-GRS extends GRS by enabling read access to the data in the secondary region at all times, without requiring a Microsoft-initiated failover. This ensures that the customer transaction records remain continuously readable from the secondary region, meeting the requirement for immediate read access during a primary region outage.

Answer

Locally-redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Question 14

A company plans to deploy a three-tier web application in Azure. The application consists of web servers, application servers, and database servers. The company wants to protect the virtual machines (VMs) from planned maintenance events (e.g., OS updates) and unplanned hardware failures. They want to ensure that at least one VM in each tier remains available during such events. The solution should be deployed entirely within a single Azure region. What should the company use for the VMs?

Accepted Answer

Create an Availability Set containing two VMs per tier, configured with two fault domains and five update domains.. Option B is correct because an Availability Set with two fault domains and five update domains ensures that VMs are distributed across separate physical hardware (fault domains) and that planned maintenance (update domains) is staggered, so at least one VM per tier remains available during both planned and unplanned events. This meets the requirement of high availability within a single Azure region without needing multiple zones.

Answer

Deploy the VMs across three Availability Zones (Zone 1, Zone 2, and Zone 3) within the region.

Answer

Configure a single Virtual Machine Scale Set that includes all the VMs for all three tiers.

Answer

Use a Virtual Machine Scale Set with autoscale configured to always keep a minimum number of VMs running.

Question 15

A company plans to deploy a critical application across two Azure regions for disaster recovery. The compliance team requires that planned maintenance updates (such as OS patches to the underlying Azure infrastructure) must never be applied to both regions at the same time. The company also needs the data stored in the primary region to be automatically replicated to the secondary region. Which Azure architecture feature should the company rely on to meet the requirement of non-simultaneous updates?

Accepted Answer

Region Pairs. Region Pairs ensure that planned maintenance updates (e.g., OS patches) are applied to only one region in the pair at a time, with a minimum 300-minute stagger between updates. This design meets the compliance requirement for non-simultaneous updates while also supporting automatic geo-redundant storage replication from the primary to the secondary region.

Answer

Availability Zones

Answer

Azure Resource Manager

Answer

Azure Traffic Manager