AZ-900 Describe Azure management and governance Practice Test 16 — 15 Questions

Question 1

Which Azure identity feature ensures that users must provide an additional form of verification beyond their password when signing in?

Accepted Answer

Azure Multi-Factor Authentication (MFA). Azure Multi-Factor Authentication (MFA) is the correct answer because it explicitly requires users to provide an additional verification factor—such as a phone call, text message, or app notification—beyond just their password. This implements a second layer of security, making it harder for unauthorized users to gain access even if a password is compromised. MFA is a core identity security feature in Microsoft Entra ID that directly addresses the requirement for extra verification.

Answer

Azure AD Single Sign-On

Answer

Azure AD Conditional Access

Answer

Azure Identity Protection

Question 2

What is a Service Principal in Azure Active Directory?

Accepted Answer

An identity for applications and automated processes to access Azure resources. A Service Principal is an identity created for use with applications, hosted services, and automated tools to access Azure resources. It functions as a security principal that can be assigned roles (via Azure RBAC) to authenticate and authorize operations, enabling secure, programmatic access without requiring a user account.

Answer

A special high-privilege user account for Azure administrators

Answer

A role that grants full access to all Azure resources in a subscription

Answer

A security group for organizing users with similar access needs

Question 3

Which Azure feature enables you to create policy definitions, RBAC role assignments, and ARM templates as a single package and track their deployment relationship?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct answer because it is specifically designed to package together policy definitions, RBAC role assignments, ARM templates, and other artifacts into a single, versioned, and trackable deployment unit. Unlike individual ARM templates or policy initiatives, Blueprints maintain a relationship between the deployed resources and the blueprint definition, enabling you to audit and track which blueprint version was used for each deployment.

Answer

ARM Templates

Answer

Azure Policy Initiative

Answer

Azure DevOps Pipelines

Question 4

What is a key difference between Azure Public regions and Azure Government regions?

Accepted Answer

Azure Government regions are isolated, restricted-access clouds for US government compliance. Azure Government regions are physically and logically isolated cloud environments dedicated to US federal, state, local, and tribal government agencies and their partners, designed to meet compliance regimes such as FedRAMP High, DoD IL4/IL5, ITAR, and CJIS. They are operated by screened US personnel and use separate instances of Azure services, which is the defining difference from commercial Azure public regions. This isolation and compliance posture — not performance or pricing — is the key distinction.

Answer

Azure Government regions provide faster network speeds

Answer

Azure Government regions have more available services than commercial regions

Answer

Azure Government regions offer lower pricing than commercial regions

Question 5

Which Azure cost optimization practice involves analyzing resource usage and removing or resizing underutilized resources?

Accepted Answer

Right-sizing underutilized resources. Right-sizing underutilized resources is a core Azure cost optimization practice that involves analyzing resource usage metrics (e.g., CPU, memory, disk I/O) and then either resizing to a smaller SKU or deallocating idle resources. This directly reduces compute, storage, and licensing costs by aligning capacity with actual demand, as opposed to paying for over-provisioned capacity.

Answer

Reserved Instance purchasing

Answer

Enabling geo-redundant storage

Answer

Using Premium SSD disks for all workloads

Question 6

Which Azure feature automatically identifies cost savings opportunities like orphaned resources and idle VMs?

Accepted Answer

Azure Advisor cost recommendations. Azure Advisor is a built-in, personalized cloud consultant that continuously analyzes your Azure resource usage and configuration. It provides proactive cost recommendations by identifying specific optimization opportunities, such as orphaned disks, idle virtual machines (VMs), and underutilized ExpressRoute circuits, helping you reduce spending without manual auditing.

Answer

Azure Cost Management budgets

Answer

Azure Pricing Calculator

Answer

Azure Policy cost controls

Question 7

What is the purpose of Azure AD Identity Protection?

Accepted Answer

To detect and automatically respond to suspicious identity-related risks. Microsoft Entra ID Protection is a security tool that uses machine learning and heuristics to detect suspicious activities such as leaked credentials, impossible travel, and anonymous IP address sign-ins. It can automatically respond to these risks by requiring multi-factor authentication or blocking sign-ins, thereby protecting identities without manual intervention.

Answer

To encrypt user passwords stored in Azure AD

Answer

To manage the lifecycle of user accounts in Azure AD

Answer

To synchronize identities between on-premises AD and Azure AD

Question 8

What is Azure DDoS Protection Standard?

Accepted Answer

Enhanced protection against distributed denial of service attacks for Azure VNet resources. Azure DDoS Protection Standard provides enhanced mitigation capabilities specifically for Azure Virtual Network (VNet) resources, defending against volumetric, protocol, and application-layer DDoS attacks. It integrates with Azure's global network to automatically detect and scrub malicious traffic, offering adaptive tuning and attack analytics. This is distinct from basic DDoS protection, which is included by default but lacks the dedicated mitigation capacity and reporting features of the Standard tier.

Answer

A firewall service that filters HTTP/HTTPS traffic based on rules

Answer

A service that encrypts data in transit between Azure regions

Answer

An intrusion detection system for monitoring network traffic

Question 9

Which Azure service enables automated configuration management and desired state enforcement for Windows and Linux VMs?

Accepted Answer

Azure Automation State Configuration. Azure Automation State Configuration (DSC) is the correct service because it provides PowerShell Desired State Configuration (DSC) for Windows and Linux VMs, enabling automated configuration management and enforcement of a desired state. It uses a pull or push model to ensure VMs remain compliant with defined configurations, such as installed software or registry settings, without manual intervention.

Answer

Azure Policy

Answer

Azure Monitor

Answer

Azure Blueprints

Question 10

Which Azure feature enables you to create custom roles with specific permissions when built-in RBAC roles do not meet your requirements?

Accepted Answer

Custom RBAC role definitions. Custom RBAC role definitions allow you to create roles with granular permissions tailored to your specific needs when built-in roles are insufficient. This Azure feature uses JSON-based role definitions that specify actions, notActions, dataActions, and assignable scopes to control access to Azure resources.

Answer

Azure AD application permissions

Answer

Azure Policy custom definitions

Answer

Azure AD group membership rules

Question 11

Which Azure feature ensures that users accessing sensitive applications must be on compliant corporate devices?

Accepted Answer

Azure AD Conditional Access with device compliance. Microsoft Entra Conditional Access with device compliance enforces policies that require users to access sensitive applications only from devices that meet compliance standards (e.g., managed by Intune, patched, encrypted). This integrates with Microsoft Intune to check device health before granting access, ensuring corporate data is protected.

Answer

Azure AD Identity Protection

Answer

Azure RBAC with device restrictions

Answer

Azure Firewall with IP restrictions

Question 12

What is the purpose of the Azure portal?

Accepted Answer

A web-based graphical interface for managing all Azure services and resources. The Azure portal is a web-based, unified console that provides a graphical user interface (GUI) for provisioning, configuring, monitoring, and managing all Azure services and resources. It is built on HTML5 and JavaScript, allowing users to perform administrative tasks without needing to write code or use command-line tools.

Answer

A command-line tool for automating Azure resource management

Answer

A development environment for writing and testing Azure code

Answer

A marketplace for purchasing third-party software

Question 13

Which Azure cost management practice helps identify which teams or projects are consuming Azure resources through cost allocation?

Accepted Answer

Cost allocation using tags and cost allocation rules. Azure cost allocation uses tags and cost allocation rules to attribute resource consumption to specific teams, projects, or cost centers. By applying metadata tags (e.g., 'Department: Sales' or 'Project: Alpha') to resources and defining allocation rules in Cost Management, you can split shared costs and track spending per business unit. This directly answers the question of identifying which teams or projects are consuming resources.

Answer

Azure Reservations

Answer

Azure Advisor efficiency recommendations

Answer

Azure Budgets and alerts

Question 14

What happens when an Azure subscription reaches its spending limit?

Accepted Answer

Azure services are stopped and deallocated until the limit is removed or reset. When an Azure subscription reaches its spending limit, Azure suspends the subscription, stopping and deallocating all running services. This prevents any further charges beyond the configured budget. The limit must be removed or reset to resume services; no automatic increase occurs.

Answer

Azure automatically increases the subscription limit to handle additional charges

Answer

Azure notifies the account owner but continues running services

Answer

All data is permanently deleted to prevent additional storage charges

Question 15

Which Azure tool provides a unified command-line experience for managing Azure resources across Windows, macOS, and Linux?

Accepted Answer

Azure CLI. Azure CLI (Command-Line Interface) is a cross-platform tool that provides a unified command-line experience for managing Azure resources on Windows, macOS, and Linux. It uses Python-based scripting and can be installed locally or run interactively, offering consistent syntax and commands across all supported operating systems.

Answer

Azure PowerShell only

Answer

Azure Cloud Shell

Answer

Azure Resource Manager API