AZ-900 Describe Azure management and governance Practice Test 22 — 15 Questions

Question 1

An Azure administrator needs to review all changes made to Azure resources over the past 90 days, including who made each change and when. Which Azure service provides this information?

Accepted Answer

Azure Activity Log. The Azure Activity Log is a platform log in Azure that provides insight into subscription-level events. It records all control-plane operations (e.g., creating, modifying, or deleting resources) and includes details such as who initiated the operation, what the operation was, and when it occurred. The log retains this data for 90 days by default, making it the correct service for reviewing changes over that period.

Answer

Azure Monitor Metrics

Answer

Azure Resource Health

Answer

Azure Policy compliance reports

Question 2

Which Azure feature allows an organization to provide temporary, time-limited access to Azure resources without permanent role assignment?

Accepted Answer

Azure Privileged Identity Management. Azure Privileged Identity Management (PIM) is the correct answer because it provides just-in-time (JIT) privileged access to Azure resources, allowing organizations to grant time-bound, temporary permissions that automatically expire. Unlike permanent role assignments, PIM requires activation with approval, duration, and justification, ensuring least-privilege security without persistent access.

Answer

Azure Conditional Access

Answer

Azure RBAC role assignment

Answer

Azure Policy

Question 3

Which Azure support plan provides 24/7 access to technical support engineers by phone and email for production workloads?

Accepted Answer

Azure Standard support. Azure Standard support is the lowest-tier plan that provides 24/7 access to technical support engineers via phone and email for production workloads. It includes unlimited severity A incidents with a 1-hour response time, making it suitable for production environments. Lower tiers like Developer or Basic support do not offer 24/7 phone support or are limited to non-production scenarios.

Answer

Azure Free support

Answer

Azure Developer support

Answer

Community forums only

Question 4

Which Azure feature provides audit logs that record every action taken on secrets in Azure Key Vault?

Accepted Answer

Azure Key Vault diagnostic logging. Azure Key Vault diagnostic logging captures detailed audit logs for every operation performed on secrets, keys, and certificates, including read, write, delete, and backup actions. These logs are sent to Azure Monitor Logs, Storage Accounts, or Event Hubs, enabling security auditing and compliance monitoring. This is the correct feature because it directly records all actions on secrets at the vault level.

Answer

Azure Policy

Answer

Azure Monitor Metrics

Answer

Azure RBAC access logs

Question 5

Which Azure pricing calculator helps you estimate monthly costs for Azure services before deploying them?

Accepted Answer

Azure Pricing Calculator. The Azure Pricing Calculator is the correct tool for estimating monthly costs of Azure services before deployment. It allows you to configure services (e.g., VMs, storage, databases) by specifying parameters like region, tier, and usage hours, then generates a detailed cost estimate. This pre-deployment estimation is its primary purpose, distinguishing it from post-deployment cost analysis tools.

Answer

Azure TCO Calculator

Answer

Azure Cost Management

Answer

Azure Advisor

Question 6

An organization needs to ensure that all Azure resources comply with internal standards and automatically remediate non-compliant resources. Which Azure service provides this capability?

Accepted Answer

Azure Policy with remediation tasks. Azure Policy with remediation tasks is the correct service because it allows organizations to define compliance rules for Azure resources and automatically remediate non-compliant resources using managed identities and policy effects like 'deployIfNotExists' or 'modify'. This ensures ongoing compliance with internal standards without manual intervention.

Answer

Azure Blueprints

Answer

Azure RBAC

Answer

Azure Security Center

Question 7

Which Azure RBAC built-in role allows a user to view all resources but NOT make any changes?

Accepted Answer

Reader. The Reader role is the correct answer because it grants read-only access to all Azure resources, including their properties and status, but explicitly prevents any modifications, deletions, or creations. This aligns directly with the requirement to view resources without making changes.

Answer

Contributor

Answer

Owner

Answer

User Access Administrator

Question 8

Which Azure service provides a SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct answer because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution. It provides intelligent security analytics and threat intelligence across the enterprise, enabling security teams to collect data at cloud scale, detect threats, investigate incidents, and automate responses.

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Answer

Azure Security Center

Question 9

Which Azure service provides compliance documentation, audit reports, and regulatory certifications to help organizations meet their own compliance obligations?

Accepted Answer

Microsoft Service Trust Portal. The Microsoft Service Trust Portal (STP) is the dedicated Azure service that provides access to compliance documentation, audit reports, and regulatory certifications. It aggregates detailed information about Microsoft's security and compliance practices, including ISO 27001, SOC 2, and FedRAMP reports, enabling organizations to verify Azure's adherence to standards and fulfill their own compliance obligations.

Answer

Azure Policy compliance dashboard

Answer

Microsoft Defender for Cloud

Answer

Azure Security Center

Question 10

Sequence the steps to implement Azure Policy to enforce compliance.

Accepted Answer

Create policy definition, assign policy, review compliance, remediate non-compliant resources.. Policy implementation involves definition, assignment, compliance review, and remediation.

Answer

Assign policy, create policy definition, review compliance, remediate non-compliant resources.

Answer

Create policy definition, review compliance, assign policy, remediate non-compliant resources.

Answer

Remediate non-compliant resources, create policy definition, assign policy, review compliance.

Question 11

Match each Azure storage type to its use case.

Accepted Answer

Blob Storage: Stores large amounts of unstructured data, such as text or binary data.. The correct matches are: Blob Storage for unstructured data, File Storage for SMB file shares, Queue Storage for messages, and Table Storage for structured NoSQL data. Common confusions include mixing up Blob Storage with relational data (which is Table Storage or SQL) and File Storage with Queue Storage.

Answer

Blob Storage: Stores structured relational data.

Answer

File Storage: Stores messages in a queue.

Question 12

Match each Azure pricing model to its definition.

Accepted Answer

Pay-as-you-go: You pay only for what you use, with no upfront commitment.. Correct matches: Pay-as-you-go = pay per use; Reserved Instances = prepay for discount; Spot VMs = discounted but evictable capacity; Azure Hybrid Benefit = use existing licenses. Common confusions involve swapping prepayment with pay-as-you-go or confusing spot with license benefits.

Answer

Pay-as-you-go: You prepay for 1 or 3 years to get a discounted rate.

Answer

Spot Virtual Machines: You use your existing on-premises licenses to save costs.

Question 13

Match each Azure database service to its type.

Accepted Answer

Azure SQL Database: Relational. In this matching exercise, the correct pairs are: Azure SQL Database (Relational), Azure Cosmos DB (NoSQL), Azure Database for MySQL (Relational), Azure Database for PostgreSQL (Relational). The distractors swap the types, incorrectly labeling Cosmos DB as relational and SQL Database as NoSQL.

Answer

Azure Cosmos DB: Relational

Answer

Azure SQL Database: NoSQL

Question 14

A cloud operations team manages Azure resources across several resource groups. Leadership wants to know which user made a specific configuration change to a virtual network three weeks ago so they can determine whether the change was authorized. The team needs to find this information using a built-in Azure capability without deploying additional monitoring agents. What should they use?

Accepted Answer

Azure Activity log. The Azure Activity log captures control-plane operations at the subscription level, including the identity of the caller, the operation performed, the target resource, and the timestamp. A virtual network configuration change is exactly this kind of administrative action, so the log can answer who changed it and when. It is available by default without installing agents, which matches the stated constraint.

Answer

Azure Service Health

Answer

Azure Monitor metrics

Answer

Azure Advisor

Question 15

A small company runs a noncritical development workload in Azure. The IT administrator wants to estimate the monthly cost of the planned virtual machines, storage accounts, and outbound bandwidth before creating anything, and needs the estimate to reflect a chosen Azure region and currency. Which Azure tool should the administrator use?

Accepted Answer

Azure Pricing calculator. The Azure Pricing calculator is the pre-deployment estimation tool: you add services, set regions and quantities, and it returns projected monthly costs in the selected currency. Because nothing has been deployed, tools that analyze existing usage such as Microsoft Cost Management or Advisor are unsuitable. The calculator directly supports comparing regional pricing, which the administrator explicitly needs.

Answer

Azure Advisor

Answer

Azure Migrate

Answer

Microsoft Cost Management