AZ-900 Describe Azure architecture and services Practice Test 8 — 15 Questions

Question 1

A company has a simple containerized web application that runs in a single container. The application processes a workload for a few minutes every hour and remains idle the rest of the time. The company wants to deploy the container in Azure without managing any virtual machines or container orchestrators. They also want to pay only for the time the container is actually running, with no cost when idle. Which Azure compute service should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it allows you to run a containerized application without managing any underlying virtual machines or container orchestrators like Kubernetes. ACI supports a per-second billing model, meaning you only pay for the compute resources consumed while the container is actively running, and incur no cost when the container is stopped or idle. This aligns perfectly with the company's requirement of a simple, single-container workload that runs intermittently.

Answer

Azure App Service

Answer

Azure Virtual Machine Scale Sets

Answer

Azure Kubernetes Service

Question 2

A company deploys two Azure virtual machines in an availability set. The application requires that at least one VM remains running during Azure platform-initiated maintenance, such as operating system updates to the underlying host. Which component of the availability set directly ensures that the VMs are not updated at the same time?

Accepted Answer

Update domains. Update domains (B) are the correct component because they logically group VMs that are updated together during Azure platform-initiated maintenance. By placing VMs in different update domains, Azure ensures that only one update domain is taken offline at a time, guaranteeing that at least one VM remains running during host OS updates.

Answer

Fault domains

Answer

Proximity placement groups

Answer

Availability zones

Question 3

A company runs a mission-critical application on Azure virtual machines. The application must remain available even if an entire Azure datacenter in a region experiences a complete outage (e.g., power failure). The company wants all VMs to be located in the same Azure region to minimize latency. Which Azure feature should the company use to deploy the VMs?

Accepted Answer

Availability Zone. Availability Zones (AZs) are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across multiple AZs protects against a single datacenter failure while keeping all resources within the same region to minimize latency. This meets the requirement for high availability during a complete datacenter outage.

Answer

Availability Set

Answer

Resource Group

Answer

Proximity Placement Group

Question 4

A company has two Azure virtual networks: VNet-A in the East US region and VNet-B in the West US region. Each VNet hosts a set of virtual machines that run a distributed application. The application requires private, low-latency communication between the VMs in VNet-A and VNet-B. The company wants to minimize operational complexity and avoid any additional billing for data transfer between the two VNets beyond the standard Azure data transfer charges. Which Azure service should the company use to connect the two virtual networks?

Accepted Answer

Azure Virtual Network Peering. Azure Virtual Network Peering is the correct choice because it connects two virtual networks directly over the Microsoft backbone network, providing private, low-latency communication between VMs in different regions. It incurs only standard Azure data transfer charges (no additional gateway or circuit costs) and requires minimal operational overhead, as it is a simple configuration with no extra devices or bandwidth provisioning.

Answer

Azure VPN Gateway (Site-to-Site)

Answer

Azure ExpressRoute

Answer

Azure Front Door

Question 5

A company runs a web application on two Azure virtual machines in the same region. The application must be accessible from the internet, and incoming traffic should be distributed evenly across both VMs. Additionally, the company needs to offload Transport Layer Security (TLS) termination to a single service and route requests based on the URL path (e.g., /images to one set of VMs, /api to another). Which Azure service should the company use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is the correct choice because it is a Layer 7 (HTTP/HTTPS) load balancer that supports TLS termination, URL path-based routing, and cookie-based session affinity. This allows the company to offload TLS decryption to a single service and route requests like /images or /api to different backend pools, meeting all stated requirements.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 6

A company stores critical business data in an Azure Storage account. The data must remain available if a single Azure datacenter experiences a failure (e.g., fire, power outage). The company wants to minimize storage costs. Which storage redundancy option should they choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) synchronously replicates data across three Azure availability zones within a single region, ensuring data remains available if an entire datacenter fails. This meets the requirement for datacenter failure protection while minimizing costs compared to geo-redundant options, as ZRS does not incur cross-region bandwidth charges.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 7

A company runs a web application in two Azure regions: East US and West US. The company wants to route users automatically to the region that provides the lowest network latency. If one region becomes unavailable, all traffic should be rerouted to the healthy region. The company does not need to offload Transport Layer Security (TLS) or perform URL-based routing. Which Azure service should the company use to distribute traffic at the DNS level?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager operates at the DNS level, using DNS responses to direct user traffic to the region with the lowest network latency based on the Performance traffic-routing method. It also supports automatic failover: if a region becomes unavailable, Traffic Manager detects the endpoint health probe failure and reroutes all traffic to the healthy region. This matches the requirement exactly, as the company needs DNS-level distribution without TLS offloading or URL-based routing.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 8

A company runs a production web application on Azure App Service. The development team is working on a new version of the application and wants to deploy it to a staging environment to perform validation tests. After testing, they need to gradually shift a percentage of live user traffic to the new version while monitoring for issues. If any problems occur, they must be able to instantly send all traffic back to the original version with zero downtime. Which Azure App Service feature should the team use to achieve this?

Accepted Answer

Deployment slots. Deployment slots are the correct choice because Azure App Service supports deploying different versions of an application to separate slots (e.g., staging) and then swapping them into production. The swap operation allows you to gradually shift traffic using slot auto-swap or manual swap with traffic routing, and if issues arise, you can instantly swap back to the original slot with zero downtime, as the swap preserves the warm-up state of the target slot.

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 9

A company has deployed several Windows and Linux virtual machines in an Azure virtual network. For security reasons, the virtual machines have no public IP addresses assigned. The IT administrators need to securely connect to these VMs using Remote Desktop Protocol (RDP) for Windows and Secure Shell (SSH) for Linux without deploying any additional agents on the VMs. The connection must be established directly from the Azure portal, and the service must provide protection against port scanning and brute-force attacks. Which Azure service should the company use?

Accepted Answer

Azure Bastion. Azure Bastion is the correct choice because it provides secure, seamless RDP and SSH connectivity to virtual machines directly from the Azure portal over TLS, without requiring any public IP addresses on the VMs or additional agent installations. It uses a hardened bastion host inside the virtual network, and by default it protects against port scanning and brute-force attacks by not exposing the VMs' RDP/SSH ports to the internet.

Answer

Just-in-time (JIT) VM access (Microsoft Defender for Cloud)

Answer

Azure Firewall

Answer

Azure VPN Gateway

Question 10

A financial services company must migrate a critical application to Azure. Regulatory compliance requires that the virtual machines (VMs) hosting this application run on physical servers that are dedicated solely to the company and not shared with any other Azure customer. The company needs full control over server hardware maintenance, including the ability to schedule updates and isolate the environment at the physical layer. Which Azure compute solution should the company use?

Accepted Answer

Azure Dedicated Host. Azure Dedicated Host provides physical servers dedicated to a single Azure subscription, ensuring that no other customer's VMs share the hardware. This meets the regulatory requirement for physical isolation and gives the company full control over server hardware maintenance, including the ability to schedule updates and manage the host lifecycle independently.

Answer

Azure Reserved Instances

Answer

Azure Virtual Machine Scale Sets

Answer

Azure Confidential Computing

Question 11

A company plans to deploy a critical web application on Azure virtual machines in the West US region. The application must remain available if a single datacenter within that region experiences a complete outage. The company also requires the virtual machines to be connected to each other with low-latency network connectivity. Which Azure feature should the company use to deploy the virtual machines?

Accepted Answer

Availability Zone. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across two or more zones ensures that if one datacenter fails, the application remains available in another zone, while the VMs within the same region can still be connected via a low-latency virtual network.

Answer

Availability Set

Answer

Region Pair

Answer

Virtual Machine Scale Set

Question 12

A company hosts a web application in the West US region on two Azure virtual machines that are in the same virtual network. The application handles user sessions that must persist on the same virtual machine for the duration of a checkout process. The company needs to load balance incoming HTTP traffic across the two virtual machines. If one virtual machine becomes unhealthy, the load balancer must automatically stop sending new traffic to that machine. Which Azure service should the company use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is correct because it provides HTTP/HTTPS layer-7 load balancing with session affinity (also known as sticky sessions) using cookie-based persistence, which ensures that all requests from a user during the checkout process are routed to the same virtual machine. It also includes built-in health probes that automatically stop sending traffic to an unhealthy backend VM, meeting both requirements precisely.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Front Door

Question 13

Company A deploys several Linux virtual machines (VMs) across multiple Azure availability zones in the West US region. The VMs run a cluster application that needs to read and write data concurrently to a shared file system. The solution must support the Server Message Block (SMB) protocol and must be accessible from all zones with low latency. Which Azure storage service should the company use?

Accepted Answer

Azure Files. Azure Files provides fully managed file shares in the cloud that support the SMB protocol, making it the correct choice for a shared file system accessible from multiple Azure availability zones with low latency. It allows concurrent read/write access from Linux VMs across zones, meeting the cluster application's requirements.

Answer

Azure Blob Storage

Answer

Azure Managed Disks

Answer

Azure Queue Storage

Question 14

A company has two on-premises data centers connected to each other via a high-speed MPLS link. They plan to migrate several critical workloads to Azure. The network team requires a dedicated, private connection from each on-premises site to Azure that does not traverse the public internet. The connection must provide high bandwidth, low latency, and a Service Level Agreement (SLA) for availability. Which Azure service should the network team provision to meet these requirements?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated, private connection from on-premises data centers to Azure that does not traverse the public internet. It offers high bandwidth, low latency, and a financially backed SLA of 99.95% availability, meeting all the stated requirements for critical workloads.

Answer

Azure VPN Gateway (Site-to-Site)

Answer

Azure Virtual WAN

Answer

Azure Application Gateway

Question 15

A company uses Azure Blob Storage to store backup files that must survive a complete regional outage. The company needs the data to be automatically accessible from a secondary region if the primary region becomes unavailable, without any manual failover. Which storage redundancy option should the company use?

Accepted Answer

Read-Access Geo-Redundant Storage (RA-GRS). Read-Access Geo-Redundant Storage (RA-GRS) is the correct choice because it provides geo-redundancy (data replicated to a secondary region for disaster recovery) and, crucially, enables read access to the secondary region without requiring a manual failover. This ensures that if the primary region becomes unavailable, the data is automatically accessible from the secondary region for read operations, meeting the requirement of no manual intervention.

Answer

Locally Redundant Storage (LRS)

Answer

Zone-Redundant Storage (ZRS)

Answer

Geo-Redundant Storage (GRS)