AZ-900 Describe Azure architecture and services Practice Test 9 — 15 Questions

Question 1

A global company is designing a disaster recovery solution for a critical application. They plan to deploy the application to two Azure regions. The company wants to minimize the risk of both regions failing simultaneously due to a major platform update or a widespread natural disaster. Which Azure feature provides a specific pairing of regions to meet this goal?

Accepted Answer

Azure region pairs. Azure region pairs are designed to ensure that two paired regions are updated sequentially during platform maintenance, reducing the risk of simultaneous failure. They are also physically separated by at least 300 miles to minimize the impact of natural disasters. This meets the company's goal of minimizing simultaneous failure risk from both a major platform update and a widespread natural disaster.

Answer

Availability Zones within a single region

Answer

Azure Traffic Manager with geographic routing

Answer

Azure Site Recovery replication between any two regions of your choice

Question 2

A company has deployed several Azure virtual machines that host a critical internal application. The IT team needs to provide secure remote desktop access to these VMs for system administrators without assigning public IP addresses to the VMs or maintaining a VPN connection. The solution must provide seamless, browser-based RDP connectivity using SSL. Which Azure service should the IT team use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure virtual machines directly from the Azure portal over SSL, without requiring public IP addresses on the VMs or a VPN connection. It uses a hardened bastion host deployed inside the same virtual network, proxying traffic via TLS on port 443, which satisfies the requirement for browser-based, secure remote access.

Answer

Azure Front Door

Answer

Azure Application Gateway

Answer

Azure Virtual Network NAT

Question 3

A company has an on-premises datacenter with critical line-of-business applications. They plan to migrate some workloads to Azure but need a reliable, high-bandwidth, and low-latency connection that does not traverse the public internet. The connection must be dedicated and guaranteed for a consistent network experience. Which Azure service should the company use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated, private connection from on-premises to Azure that does not traverse the public internet, offering higher reliability, lower latency, and higher bandwidth than internet-based connections. This meets the requirement for a guaranteed, consistent network experience for critical line-of-business applications.

Answer

Azure VPN Gateway (site-to-site)

Answer

Azure Virtual WAN

Answer

Azure Bastion

Question 4

A company deploys three Azure virtual machines (VMs) that host a critical line-of-business application. All three VMs are located in the same Azure region. The company notices that during planned maintenance events triggered by the Azure platform, such as host OS updates, all three VMs are updated simultaneously, causing the application to become unavailable. The company requires that during such maintenance, at least two VMs remain running to preserve application uptime. Which Azure feature should the company implement to logically group the VMs and ensure they are updated in separate batches?

Accepted Answer

Azure Availability Set. An Azure Availability Set logically groups VMs to protect against platform updates and faults. By placing VMs into an availability set, Azure assigns them to different update domains (default 5) and fault domains (default 2). During planned maintenance, only one update domain is rebooted at a time, ensuring that at most one of the three VMs is updated simultaneously, thus keeping at least two VMs running.

Answer

Azure Availability Zone

Answer

Azure Virtual Machine Scale Set

Answer

Azure Site Recovery

Question 5

A company's data engineering team needs to process CSV files that are uploaded to an Azure Blob Storage container. For each uploaded file, the team must run a custom Python script to clean and transform the data. The team wants a solution that automatically triggers the script upon file upload, does not require them to manage any virtual machines or containers, and charges only when code executes. Which Azure service should the team use?

Accepted Answer

Azure Functions. Azure Functions is the correct choice because it provides a serverless compute service that can be triggered directly by an HTTP request or a Blob Storage event (via an Event Grid subscription or a Blob trigger). This allows the custom Python script to execute automatically when a CSV file is uploaded, without provisioning or managing any virtual machines or containers. The consumption plan ensures you are charged only for the duration of code execution, meeting all stated requirements.

Answer

Azure Logic Apps

Answer

Azure Container Instances

Answer

Azure Batch

Question 6

A company plans to deploy a web application on Azure Virtual Machines. The solution must remain available even if a physical datacenter in the region experiences a complete outage. The company wants to use the simplest and most cost-effective architecture that meets this requirement within a single Azure region. What should the company configure?

Accepted Answer

Deploy VMs in an Availability Zone across multiple zones.. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across multiple zones protects against a single datacenter outage while remaining in one region, making it the simplest and most cost-effective solution for this requirement.

Answer

Deploy VMs in an Availability Set across multiple fault domains.

Answer

Deploy VMs in a single scale set with autoscale.

Answer

Deploy VMs in a virtual network with a VPN gateway to a secondary region.

Question 7

A company is designing a highly available application deployment in Azure. The solution must ensure that virtual machines are placed in physically separate data centers within the same Azure region to protect against a single data center failure. Which Azure feature should the company use?

Accepted Answer

Availability Zone. Availability Zones are physically separate data centers within an Azure region, each with independent power, cooling, and networking. By deploying VMs across multiple zones, the application remains available even if a single data center fails, meeting the requirement for physical separation within the same region.

Answer

Availability Set

Answer

Virtual Machine Scale Set

Answer

Azure Resource Manager

Question 8

A manufacturing company is building a web-based dashboard to display real-time production metrics from sensors. The development team wants to deploy the application without managing the underlying infrastructure, including the web server and operating system. The application uses ASP.NET Core. Which Azure service should they use?

Accepted Answer

Azure App Service. Azure App Service is the correct choice because it provides a fully managed platform for hosting web applications, including ASP.NET Core, without requiring the user to manage the underlying web server or operating system. It supports continuous deployment, auto-scaling, and built-in load balancing, making it ideal for a real-time dashboard that needs high availability and minimal operational overhead.

Answer

Azure Functions

Answer

Azure Kubernetes Service (AKS)

Answer

Azure Virtual Machines

Question 9

A company is designing a disaster recovery solution for a critical application. The solution must ensure that if an entire Azure region becomes unavailable due to a natural disaster, the application can fail over to a different region. The company wants to minimize latency between the primary and secondary regions for data replication. Which Azure feature should the company use?

Accepted Answer

Azure Paired Regions. Azure Paired Regions are designed to provide disaster recovery by replicating data across two geographically separated regions within the same geopolitical boundary. If an entire region fails, the paired region can serve as the failover target, and the physical proximity of paired regions minimizes replication latency compared to arbitrary region pairs.

Answer

Availability Zones

Answer

Azure Resource Manager

Answer

Azure Traffic Manager

Question 10

An international e-commerce company has deployed its web application in two Azure regions to serve customers globally. The solution must automatically route users to the region with the lowest latency, provide high availability with automatic failover if one region becomes unavailable, and protect the application from common web exploits such as SQL injection and cross-site scripting at the edge. Which Azure service should the company use?

Accepted Answer

Azure Front Door. Azure Front Door is a global, scalable entry point that provides HTTP(S) load balancing with latency-based routing, automatic failover across regions, and built-in web application firewall (WAF) protection against common exploits like SQL injection and cross-site scripting. It operates at Layer 7 (application layer) and integrates with Azure WAF policies at the edge, making it the correct choice for this scenario.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Question 11

A software company develops a microservices application using Docker containers. The application consists of multiple services that need to be deployed, scaled, and managed together. The company wants to use Azure to orchestrate and manage these containers without provisioning or managing the underlying virtual machines. Which Azure service should they use?

Accepted Answer

Azure Kubernetes Service (AKS). Azure Kubernetes Service (AKS) is the correct choice because it provides a fully managed Kubernetes orchestration platform that automates the deployment, scaling, and management of containerized microservices. AKS abstracts the underlying virtual machines, allowing the company to focus on application logic without provisioning or managing the VM infrastructure, which directly matches the requirement for orchestration without VM management.

Answer

Azure Container Instances

Answer

Azure App Service

Answer

Azure Batch

Question 12

A company runs a latency-sensitive application on Azure virtual machines and needs to connect its on-premises data center to Azure. The connection must offer high reliability, predictable performance, and a service-level agreement (SLA) from the connectivity provider. It must also bypass the public internet for security and performance reasons. Which Azure service should the company use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute is the correct choice because it provides a dedicated, private connection from the on-premises data center to Azure that bypasses the public internet entirely. This ensures high reliability, predictable performance (low latency and jitter), and a financially backed SLA of up to 99.95% availability. For latency-sensitive applications, ExpressRoute offers consistent network performance that VPNs over the internet cannot guarantee.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Application Gateway

Question 13

A company uses Azure Blob Storage to store archival backups of financial records. The company requires that the data is protected against a complete regional outage by replicating it to another Azure region. However, they do not need to access the replicated copy unless the primary region fails. The company wants to minimize storage costs while meeting this requirement. Which type of storage replication should the company configure?

Accepted Answer

Geo-redundant storage (GRS). Geo-redundant storage (GRS) replicates your data synchronously three times within the primary region using LRS, then asynchronously to a secondary region hundreds of miles away. This meets the requirement of protecting against a complete regional outage while minimizing costs, because the secondary copy is not accessible for reads unless Microsoft initiates a failover, and GRS is less expensive than RA-GRS which includes read-access to the secondary region.

Answer

Locally redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 14

A company has deployed several virtual machines in an Azure virtual network. The IT administrators need to connect to these VMs using RDP and SSH from the internet. However, the company's security policy prohibits assigning any public IP addresses to the VMs and also prohibits exposing the VMs directly to the internet. The solution must be fully managed by Azure and require no additional infrastructure in the virtual network. Which Azure service should the company use?

Accepted Answer

Azure Bastion. Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to virtual machines directly in the Azure portal over TLS. It eliminates the need for public IP addresses on the VMs and does not require any additional infrastructure in the virtual network, as it is deployed inside the virtual network and uses a private IP to connect to the VMs.

Answer

Azure Virtual Network Peering

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Question 15

A company has an on-premises data center with a site-to-site VPN connection to Azure. The company wants to ensure that the connection remains secure by encrypting all traffic between the on-premises network and Azure virtual network. The connection must be established over the public internet. Which Azure service should the company use to create this encrypted tunnel?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct service because it creates an encrypted site-to-site VPN tunnel over the public internet using IPsec/IKE protocols. This meets the requirement for a secure connection between the on-premises data center and Azure virtual network over the public internet.

Answer

Azure ExpressRoute

Answer

Azure Virtual WAN

Answer

Azure Bastion