AZ-900 Hard Questions — 25 Difficult Questions

Question 1

Which Azure service provides dedicated physical servers for regulatory or licensing requirements where hardware cannot be shared with other customers?

Accepted Answer

Azure Dedicated Host. Azure Dedicated Host provides physical servers dedicated to a single Azure subscription, ensuring that hardware is not shared with other customers. This meets regulatory or licensing requirements that mandate hardware isolation, such as specific compliance standards or software licensing agreements that restrict usage to dedicated hardware.

Answer

Azure Reserved VM Instances

Answer

Azure Spot VMs

Answer

Azure Isolated VM sizes

Question 2

A company has a management group hierarchy: Root > Europe > Production. They assign a policy at the Root level that denies creation of resources without a tag. Later, they assign a different policy at the Europe level. What is the effective effect on the Production subscription?

Accepted Answer

Both policies apply. Azure Policy is inherited by default from higher-level management groups down to subscriptions. When a policy is assigned at the Root management group, it applies to all child management groups and subscriptions, including the Production subscription. Assigning an additional policy at the Europe management group does not remove or override the Root-level policy; instead, both policies are evaluated and enforced, with the most restrictive effect taking precedence. Therefore, the Production subscription is subject to both policies.

Answer

Only the policy at the Europe level applies

Answer

Only the policy at the Root level applies

Answer

The policy at the lower level overrides the Root policy

Question 3

A company has multiple on-premises sites that need to connect to Azure over high-throughput, low-latency private connections. They want a dedicated private connection that does not traverse the internet. Which Azure service should they use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated private connection from on-premises sites to Azure that does not traverse the public internet, ensuring high throughput and low latency. It uses a Layer 3 VPN or direct peering via a connectivity provider, bypassing internet-based routing entirely. This makes it ideal for scenarios requiring consistent performance and security for hybrid connectivity.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Peering Service

Question 4

A company deploys a critical application across two Azure regions for disaster recovery. They want to automatically failover traffic to the secondary region if the primary becomes unavailable. They also want to improve performance by routing users to the closest region. Which Azure service should they use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic optimally to services across global Azure regions. It supports the 'Priority' routing method for automatic failover to a secondary region when the primary is unavailable, and the 'Performance' routing method to direct users to the closest region for improved latency. This combination directly meets the stated requirements for disaster recovery failover and performance-based routing.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure VPN Gateway

Question 5

A company deploys a web application on Azure App Service. During a marketing campaign, they expect traffic to double. The app uses a Standard tier App Service plan. They want to ensure that the additional load is handled without performance degradation while keeping costs minimal. Which action should they take?

Accepted Answer

Scale out the App Service plan by increasing the instance count.. Scaling out (increasing instance count) for the Standard tier App Service plan allows the application to handle the doubled traffic by distributing requests across multiple instances, ensuring no performance degradation. This approach is cost-minimal because the Standard tier supports manual scale-out without requiring a tier upgrade, and you only pay for the additional instances while they are needed.

Answer

Scale up the App Service plan to a Premium tier for more resources.

Answer

Enable autoscale on the existing plan to let Azure handle scaling automatically.

Answer

Deploy Azure CDN to cache static content.

Question 6

A team uses Docker containers to run microservices. They need a service that automatically manages the cluster, scales containers based on demand, and provides load balancing without requiring them to manage the underlying VMs. Which Azure compute service should they choose?

Accepted Answer

Azure Kubernetes Service. Azure Kubernetes Service (AKS) is the correct choice because it provides a managed Kubernetes cluster that automates container orchestration, scaling, and load balancing. AKS abstracts the underlying VMs, handling master node management, updates, and scaling based on demand, which aligns with the team's requirement to avoid VM management.

Answer

Azure Container Instances

Answer

Azure Batch

Answer

Azure Virtual Machine Scale Sets

Question 7

A company has a management group hierarchy: Root (tenant root group) > Contoso > Sales, Marketing. They want to assign an Azure policy that applies to all subscriptions under the Sales and Marketing management groups only. The policy must not affect any other subscriptions in the hierarchy. Where should they assign the policy?

Accepted Answer

Assign the policy separately at both the Sales and Marketing management groups.. Azure Policy assignments are inherited by all child resources within the scope where the policy is assigned. To restrict the policy to only the Sales and Marketing management groups without affecting other subscriptions under Contoso, you must assign the policy separately to each of those two management groups. Assigning at a higher scope (e.g., Contoso or Root) would cause the policy to apply to all subscriptions under that scope, including any other child management groups or subscriptions.

Answer

At the Root management group.

Answer

At the Contoso management group.

Answer

At the Sales management group only.

Question 8

Which Azure feature allows you to save money on Azure SQL Database and Azure SQL Managed Instance using existing on-premises SQL Server licenses?

Accepted Answer

Azure Hybrid Benefit. Azure Hybrid Benefit allows you to use your existing on-premises SQL Server licenses with Software Assurance to reduce the cost of Azure SQL Database and Azure SQL Managed Instance. By applying this benefit, you pay only for the underlying compute infrastructure at the base compute rate, effectively saving up to 55% on SQL licensing costs. This is specifically designed to maximize value from existing license investments when migrating to Azure.

Answer

Azure Reserved Instances

Answer

Azure Spot VMs

Answer

Azure Dev/Test pricing

Question 9

A company needs to connect their on-premises network to Azure with a dedicated, private, and high-bandwidth connection that does not traverse the public internet. They require an SLA for availability and performance. Which Azure service should they use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute is the correct choice because it provides a dedicated, private connection from on-premises networks to Azure that does not traverse the public internet. It offers a Service-Level Agreement (SLA) for availability (e.g., 99.95% for a single connection with redundancy) and performance, which is not guaranteed over internet-based VPNs. This meets the requirement for high bandwidth, privacy, and a guaranteed SLA.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Peering Service

Question 10

A company wants to prevent any Azure resource from being accidentally deleted by anyone, including subscription owners. Which Azure feature accomplishes this?

Accepted Answer

Azure Resource Manager CanNotDelete lock. The Azure Resource Manager CanNotDelete lock is the correct feature because it prevents any user, including subscription owners, from deleting a resource. This lock overrides all RBAC permissions, ensuring that even users with Owner or Contributor roles cannot delete the resource until the lock is removed. It is specifically designed for accidental deletion prevention at the resource, resource group, or subscription level.

Answer

Azure Policy with Deny effect

Answer

RBAC Reader role

Answer

Azure Blueprints

Question 11

A healthcare organization stores patient records in Azure Blob Storage. They require that data remains available even if an entire Azure datacenter fails, and they also need to ensure data is replicated within the same region for low latency. Which storage redundancy option should they choose?

Accepted Answer

Zone-Redundant Storage (ZRS). Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region, ensuring data remains available even if an entire datacenter (one zone) fails. This meets both the availability requirement and the low-latency requirement because replication stays within the region, avoiding cross-region latency.

Answer

Locally Redundant Storage (LRS)

Answer

Geo-Redundant Storage (GRS)

Answer

Read-Access Geo-Redundant Storage (RA-GRS)

Question 12

Which Azure compute option is best for running a batch processing job that can be interrupted and resumed without data loss, at the lowest possible cost?

Accepted Answer

Azure Spot Virtual Machines. Azure Spot Virtual Machines are designed for interruptible workloads, such as batch processing jobs, because they use unused Azure capacity at a significant discount (up to 90% compared to pay-as-you-go). When Azure needs the capacity back, these VMs can be evicted with a 30-second notice, but the job can be resumed without data loss if the application is designed to handle interruptions (e.g., using checkpointing or saving state to persistent storage). This makes Spot VMs the most cost-effective option for fault-tolerant, interruptible batch processing.

Answer

Azure Reserved VM Instances

Answer

Azure Dedicated Host

Answer

Standard Pay-as-you-Go VMs

Question 13

A company deploys a critical application on Azure virtual machines. They want to ensure that the VMs are distributed across physically separate datacenters within a single Azure region to protect against a single datacenter failure. Which Azure feature should they use?

Accepted Answer

Availability zones. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By deploying VMs across multiple zones, the application is protected from a single datacenter failure, as Azure ensures at least one zone remains operational during an outage.

Answer

Availability sets

Answer

Resource groups

Answer

Azure Site Recovery

Question 14

A company wants to track resource usage across departments and projects. They have multiple Azure subscriptions. They need to assign costs to specific departments based on resource usage. Which Azure feature enables them to view and analyze costs by resource tags?

Accepted Answer

A) Azure Cost Management + Billing. Azure Cost Management + Billing provides the tools to view, analyze, and allocate costs across subscriptions and resources. By enabling tag inheritance and using cost analysis filters, you can group costs by resource tags (e.g., Department or Project) to assign spending to specific departments. This is the correct feature because it directly supports cost tracking and allocation by tags.

Answer

B) Azure Policy

Answer

C) Azure Tags

Answer

D) Azure Resource Groups

Question 15

A company has a management group hierarchy: Root → UK → Production. They assign a policy at the Root level that allows only certain VM sizes. Later, they assign another policy at the UK level that denies all resources. What is the effective effect on the Production subscription?

Accepted Answer

Both policies apply, and the most restrictive (Deny) takes precedence.. D is correct because Azure Policy is inherited and cumulative down the management group hierarchy. The Root-level policy (allow only certain VM sizes) and the UK-level policy (deny all resources) both apply to the Production subscription. When a deny policy conflicts with an allow policy, the deny effect always takes precedence, making the most restrictive policy effective.

Answer

Only the Root policy applies because it is at the highest level.

Answer

Only the UK policy applies because it is more specific.

Answer

Both policies apply, and the order of evaluation could cause a conflict.

Question 16

An organization wants to ensure that no one can create Azure resources outside of approved geographic locations across all of their subscriptions. What is the most scalable way to enforce this?

Accepted Answer

Assign 'Allowed locations' Azure Policy at the Management Group level. Azure Policy at the Management Group level allows you to define a single 'Allowed locations' policy that applies to all subscriptions within that group, ensuring consistent enforcement across the entire organization. This approach is the most scalable because it centralizes governance, automatically covering new subscriptions added to the management group without manual intervention.

Answer

Configure RBAC to deny resource creation permissions in all subscriptions

Answer

Create separate 'Allowed locations' policies in each subscription

Answer

Use Azure Blueprints to restrict locations in each new subscription

Question 17

A company uses Azure Blueprints to define a standard environment for all new development subscriptions. The blueprint includes a set of Azure policies, role assignments, and resource templates. However, after applying the blueprint, some resources are created that do not comply with the policies. The company wants to be notified of these non-compliant resources without blocking their creation. Which Azure Policy effect should be used in the blueprint?

Accepted Answer

Audit. The Audit effect is correct because it enables Azure Policy to evaluate resources against the defined policies and log compliance warnings in the activity log without blocking resource creation. This meets the requirement to be notified of non-compliant resources while allowing them to be created.

Answer

Deny

Answer

Append

Answer

DeployIfNotExists

Question 18

An e-commerce application needs to handle sudden traffic spikes during flash sales while maintaining consistent performance. Which combination of Azure services BEST addresses this requirement?

Accepted Answer

Azure Front Door with autoscaling backend. Azure Front Door provides global load balancing and traffic acceleration with built-in SSL offload and path-based routing, while its autoscaling backend (e.g., Virtual Machine Scale Sets or App Service) automatically adds or removes instances based on CPU or request metrics. This combination ensures that sudden traffic spikes during flash sales are absorbed without manual intervention, maintaining consistent performance and high availability.

Answer

Azure Load Balancer with manual VM scaling

Answer

Azure Traffic Manager with static VMs

Answer

Azure CDN alone

Question 19

An application needs to store session state that can be accessed by multiple web server instances. The state must be retrieved in under 1 millisecond. Which Azure service BEST meets this requirement?

Accepted Answer

Azure Cache for Redis. Azure Cache for Redis is an in-memory data store that provides extremely low-latency (sub-millisecond) read and write operations, making it ideal for storing session state that must be accessed quickly by multiple web server instances. Unlike disk-based storage services, Redis keeps data in RAM, ensuring consistent retrieval times under 1 millisecond even under load.

Answer

Azure SQL Database

Answer

Azure Blob Storage

Answer

Azure Table Storage

Question 20

A global e-commerce platform runs on Azure App Service in multiple regions. They need to route user traffic to the nearest region based on geographic location, and also provide automatic failover if a region becomes unavailable. Which Azure service includes these capabilities with integrated Web Application Firewall (WAF)?

Accepted Answer

Azure Front Door. Azure Front Door is a global, scalable entry point that uses the Microsoft global edge network to route user traffic to the nearest region based on geographic location (latency-based routing) and provides automatic failover across regions. It natively integrates Web Application Firewall (WAF) at the edge, protecting against common web exploits like SQL injection and cross-site scripting, making it the correct choice for this scenario.

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Answer

Azure Load Balancer