AZ-900 Describe Azure architecture and services Practice Test 9 — 15 Questions

Question 1

A company uses Azure Blob Storage to store compliance documents that are required to be kept for 10 years. The documents are very rarely accessed; on average, only 2-3 requests per year are made, usually for audits. The company needs the lowest possible storage cost. When a document is requested, the company can tolerate a retrieval time of up to 15 hours. Which Azure Blob Storage access tier should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Archive access tier. The Archive access tier is designed for data that is rarely accessed and has a flexible retrieval time, offering the lowest storage cost among Azure Blob Storage tiers. With only 2-3 requests per year and a tolerance for up to 15-hour retrieval latency, the Archive tier (which typically takes up to 15 hours to rehydrate) perfectly matches the requirements while minimizing storage expenses.

Answer

Hot access tier

Answer

Cool access tier

Answer

Premium access tier

Question 2

A company stores sensitive customer transaction records in Azure Blob Storage. The records must be available for read access at all times, even if the primary Azure region becomes unavailable. The company initially configured geo-redundant storage (GRS). During a disaster recovery test, the operations team discovers that although data is replicated to a secondary region, they cannot read the data from the secondary region until a Microsoft-initiated failover occurs. The team needs a solution that provides immediate, continuous read access to the replicated data in the secondary region without waiting for a failover. Which Azure Storage replication option should the company use?

Accepted Answer

Read-access geo-redundant storage (RA-GRS). RA-GRS extends GRS by enabling read access to the data in the secondary region at all times, without requiring a Microsoft-initiated failover. This ensures that the customer transaction records remain continuously readable from the secondary region, meeting the requirement for immediate read access during a primary region outage.

Answer

Locally-redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Question 3

A company plans to deploy a critical application across two Azure regions for disaster recovery. The compliance team requires that planned maintenance updates (such as OS patches to the underlying Azure infrastructure) must never be applied to both regions at the same time. The company also needs the data stored in the primary region to be automatically replicated to the secondary region. Which Azure architecture feature should the company rely on to meet the requirement of non-simultaneous updates?

Accepted Answer

Region Pairs. Region Pairs ensure that planned maintenance updates (e.g., OS patches) are applied to only one region in the pair at a time, with a minimum 300-minute stagger between updates. This design meets the compliance requirement for non-simultaneous updates while also supporting automatic geo-redundant storage replication from the primary to the secondary region.

Answer

Availability Zones

Answer

Azure Resource Manager

Answer

Azure Traffic Manager

Question 4

A company deploys web servers across Azure regions East US and West Europe. The application must automatically direct each user to the region that provides the lowest network latency, and if an entire region becomes unavailable, traffic must be seamlessly redirected to the remaining healthy region. Which Azure service should the company use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that directs user requests to the nearest available endpoint based on the lowest network latency. It also supports automatic failover: if a region becomes unavailable, Traffic Manager detects the endpoint health failure via health probes and redirects traffic to the remaining healthy region, providing seamless global load balancing and disaster recovery.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 5

A company runs a customer-facing e-commerce platform on multiple Azure virtual machines behind a load balancer. The platform experiences unpredictable traffic spikes during promotions. The operations team needs a solution that automatically adds new virtual machines when CPU utilization exceeds 80% and removes virtual machines when utilization drops below 30%. The solution must also ensure that if a virtual machine fails, the load balancer immediately stops routing traffic to it. Which Azure compute service should the team use?

Accepted Answer

Virtual Machine Scale Sets. Virtual Machine Scale Sets (VMSS) provide automatic scaling based on metrics like CPU utilization, enabling the platform to add VMs when CPU exceeds 80% and remove VMs when it drops below 30%. Additionally, VMSS integrates with Azure Load Balancer to automatically detect VM failures via health probes and immediately stop routing traffic to unhealthy instances, meeting all stated requirements.

Answer

Azure App Service

Answer

Availability Sets

Answer

Azure Batch

Question 6

A company manages 50 Azure SQL Databases, each used by a different department. Each database experiences low average usage (less than 5 DTU on average) but unpredictable hourly peaks that can reach up to 50 DTU for short bursts. The company wants to minimize total cost while ensuring every database can handle its peak load without performance degradation. Which Azure SQL Database deployment option should the company choose?

Accepted Answer

Azure SQL Database elastic pool. Azure SQL Database elastic pool is the correct choice because it allows multiple databases to share a fixed pool of DTU resources, enabling the aggregated peak loads to be handled efficiently without over-provisioning each database individually. With low average usage (less than 5 DTU) but unpredictable bursts up to 50 DTU, an elastic pool provides the necessary headroom for spikes while minimizing total cost by only paying for the pooled eDTUs, not per-database maximums.

Answer

Azure SQL Database single database with 50 DTU

Answer

Azure SQL Managed Instance

Answer

SQL Server on an Azure virtual machine

Question 7

A company runs a critical application on multiple Azure virtual machines (VMs) in the East US region. The application requires that the VMs are physically separated from any other customer's workloads and that the underlying physical servers are dedicated to this company alone. The compliance team mandates that no other customer's VMs can run on the same physical hardware. Which Azure compute offering should the company use to meet this requirement?

Accepted Answer

Azure Dedicated Host. Azure Dedicated Host provides single-tenant physical servers dedicated to a single customer, ensuring that no other customer's VMs run on the same hardware. This meets the compliance requirement for physical separation and dedicated underlying servers. The company can deploy VMs directly onto these dedicated hosts, guaranteeing isolation at the hardware level.

Answer

Azure Availability Set

Answer

Azure Virtual Machine Scale Set

Answer

Azure Reserved Virtual Machine Instances

Question 8

A company has deployed several Azure virtual machines in a VNet. The security policy requires that no VM has a public IP address. However, administrators need to connect to the VMs using RDP and SSH for management. The administrators currently use the Azure portal and must not install any additional client software on their local workstations. Which Azure service should they use to meet these requirements?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP and SSH connectivity to Azure VMs directly from the Azure portal over TLS, without exposing any public IP addresses on the VMs. It uses a browser-based HTML5 client, so administrators do not need to install any additional client software on their local workstations, meeting all stated requirements.

Answer

Azure VPN Gateway

Answer

Azure Firewall

Answer

Azure ExpressRoute

Question 9

A multinational company runs a web application that must serve users from around the world with low latency. The application is deployed in multiple Azure regions. The company also requires built-in protection against distributed denial-of-service (DDoS) attacks at the network layer. The solution must automatically route users to the closest healthy endpoint based on geographic location. Which Azure service should the company use?

Accepted Answer

Azure Front Door. Azure Front Door is correct because it provides global load balancing with automatic routing to the closest healthy endpoint based on geographic location (latency-based routing), and it includes built-in DDoS protection at the network layer (L3/L4) as part of the Azure infrastructure. This combination of global routing and integrated DDoS mitigation directly matches the requirements for a multinational application serving users worldwide.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Question 10

A company has deployed applications in two separate Azure virtual networks (VNets) in the East US and West Europe regions. Each VNet contains multiple subnets with application servers and databases. The network team needs to enable direct, private IP connectivity between the VNets, ensuring that all traffic stays within the Azure backbone network and never traverses the public internet. The solution must also provide low latency for cross-region communication. They currently do not need a dedicated private connection to an on-premises datacenter. Which Azure service should they use?

Accepted Answer

VNet Peering. VNet Peering is the correct choice because it enables direct, private IP connectivity between two Azure virtual networks using the Microsoft backbone infrastructure, ensuring traffic never traverses the public internet. It provides low-latency, high-bandwidth cross-region communication without requiring a VPN gateway or dedicated circuits. Since the scenario involves only cloud-to-cloud connectivity (no on-premises requirement), VNet Peering is the simplest and most cost-effective solution.

Answer

Azure VPN Gateway

Answer

Azure ExpressRoute

Answer

Azure Virtual WAN

Question 11

A company runs a multi-tier application on Azure virtual machines in a virtual network. The web tier VMs are in a front-end subnet, and the database tier VMs are in a back-end subnet. Currently, outbound internet traffic from the VMs goes directly to the internet without any inspection or logging. The security team needs a centralized service to inspect all outbound traffic from the virtual network, log the destinations, and reject traffic to malicious domains based on threat intelligence feeds. The solution must also allow rules based on fully qualified domain names (FQDNs) instead of only IP addresses. Which Azure service should the security team deploy?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-based network security service that provides centralized outbound traffic inspection, logging, and threat intelligence-based filtering. It supports application rules based on fully qualified domain names (FQDNs), allowing the security team to reject traffic to malicious domains without relying solely on IP addresses. This makes it the correct choice for inspecting and controlling outbound traffic from the virtual network.

Answer

Azure Bastion

Answer

Network Security Group (NSG)

Answer

Application Gateway

Question 12

A company runs a web application on Azure App Service. The application experiences variable traffic patterns with occasional sudden spikes. The company wants to automatically increase the number of instances during high demand and decrease them during low demand to optimize cost and performance. The solution must require no manual intervention after initial configuration. Which Azure App Service feature should the company enable?

Accepted Answer

Autoscale. Autoscale is the correct feature because it automatically adjusts the number of App Service instances based on predefined rules (e.g., CPU > 70% or memory pressure) or schedules, matching the variable traffic patterns and sudden spikes described. This ensures cost optimization by scaling down during low demand and performance during high demand, all without manual intervention after initial configuration.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Availability Zones

Question 13

A company runs a web application on two Azure virtual machines (VMs) in different availability zones within the same region. The application maintains user session state in memory on the VMs. The company needs a load balancing solution that distributes incoming HTTP requests across both VMs, ensures all requests from a specific user session are routed to the same VM (session persistence), and terminates SSL/TLS to offload encryption from the VMs. Which Azure service should the company use?

Accepted Answer

Azure Application Gateway v2. Azure Application Gateway v2 is a layer-7 load balancer that supports HTTP/HTTPS traffic, SSL/TLS termination, and session persistence (sticky sessions) via cookie-based affinity. This makes it the correct choice for distributing HTTP requests across VMs in different availability zones while maintaining user session state and offloading encryption.

Answer

Azure Load Balancer (Standard)

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 14

A company operates a global e-commerce API that serves customers worldwide. The development team needs a solution that provides the following capabilities: global load balancing across deployed instances in multiple Azure regions, web application firewall (WAF) protection against common exploits like SQL injection and cross-site scripting, TLS termination at the edge to reduce backend processing, and caching of static API responses to improve response times for repeated requests. The team wants a single Azure service that integrates all these features natively. Which Azure service should they use?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it is a global, scalable entry point that natively integrates global load balancing, web application firewall (WAF) protection, TLS termination at the edge, and caching of static API responses. Unlike other services, Front Door provides all these capabilities in a single, unified service, making it ideal for a global e-commerce API that requires both security and performance optimization across multiple Azure regions.

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Answer

Azure Content Delivery Network (CDN)

Question 15

A company plans to migrate a legacy application to Azure virtual machines. The application requires a shared file store that can be mounted simultaneously from multiple VMs using the Server Message Block (SMB) protocol. The company needs a fully managed cloud file share that supports SMB 3.0 and integrates with Active Directory Domain Services for authentication. Which Azure service should the company use?

Accepted Answer

Azure Files. Azure Files provides fully managed SMB file shares in the cloud, supporting SMB 3.0 and integration with Azure Active Directory Domain Services (Azure AD DS) for identity-based authentication. This allows multiple Azure VMs to mount the same file share simultaneously using the SMB protocol, meeting all the stated requirements.

Answer

Azure Blob Storage

Answer

Azure NetApp Files

Answer

Azure Disk Storage