AZ-900 Hard Questions — 25 Difficult Questions

Question 1

A company uses Azure Blueprints to define a repeatable set of Azure resources and policies for new subscriptions. They want to ensure that when a new subscription is created, a specific role assignment is automatically applied. What should they include in the blueprint definition?

Accepted Answer

A role assignment artifact. Azure Blueprints allow you to define artifacts that are applied to new subscriptions. A role assignment artifact is the correct choice because it directly assigns a specific Azure RBAC role to a user, group, or service principal at the subscription scope, ensuring the role is automatically applied when the blueprint is assigned to a new subscription.

Answer

An Azure Policy assignment

Answer

An Azure Resource Manager template

Answer

A resource group

Question 2

A company uses Azure SQL Database for a web application. They need to ensure that the database can automatically scale to handle sudden spikes in traffic without downtime. Which feature should they enable?

Accepted Answer

Serverless compute. Serverless compute for Azure SQL Database automatically scales compute resources based on workload demand and pauses the database during idle periods, charging only for consumed resources. This enables handling sudden traffic spikes without downtime because the service dynamically adjusts the vCore count and memory within a configurable range, ensuring continuous availability during bursts.

Answer

Geo-replication

Answer

Active geo-replication

Answer

Elastic pool

Question 3

A global company wants to organize its Azure resources by department and project. They need to enforce cost allocation and apply governance policies consistently across all subscriptions. Which two Azure features should they use together? (Select two.)

Accepted Answer

Management groups. Management groups (B) are correct because they provide a hierarchical structure above subscriptions, enabling consistent governance and policy assignment across multiple subscriptions. Tags (C) are correct because they allow you to attach metadata (e.g., department and project) to resources for cost allocation and organization. Together, management groups enforce policies at scale, while tags enable granular cost tracking and reporting.

Answer

Resource groups

Answer

Azure Policies

Question 4

A multinational company runs a web application that must serve users from around the world with low latency. The application is deployed in multiple Azure regions. The company also requires built-in protection against distributed denial-of-service (DDoS) attacks at the network layer. The solution must automatically route users to the closest healthy endpoint based on geographic location. Which Azure service should the company use?

Accepted Answer

Azure Front Door. Azure Front Door is correct because it provides global load balancing with automatic routing to the closest healthy endpoint based on geographic location (latency-based routing), and it includes built-in DDoS protection at the network layer (L3/L4) as part of the Azure infrastructure. This combination of global routing and integrated DDoS mitigation directly matches the requirements for a multinational application serving users worldwide.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Question 5

A company wants to understand who is responsible for securing the operating system on an Azure virtual machine. According to the shared responsibility model, who is responsible?

Accepted Answer

Microsoft is responsible for the physical host and network, while the customer is responsible for the guest OS and applications.. Under the shared responsibility model for IaaS like Azure VMs, Microsoft secures the physical datacenter, host OS, and network infrastructure, while the customer is responsible for securing the guest OS (e.g., applying patches, configuring firewalls) and any applications running on the VM. This division is explicit in Azure's documentation, where the customer retains control over the OS and software stack.

Answer

Microsoft is responsible for all security.

Answer

The customer is responsible for all security.

Answer

Responsibility is split 50/50.

Question 6

A financial services company is evaluating a public cloud provider. They are concerned about the shared responsibility model for security. The company must ensure that their customer data is encrypted at rest and in transit. Under the shared responsibility model, which security control is the cloud provider typically responsible for?

Accepted Answer

Physical network security. Under the shared responsibility model, the cloud provider is responsible for the security OF the cloud, which includes physical network security such as protecting the data center perimeter, network infrastructure, and hardware. This is correct because physical security controls (e.g., access badges, surveillance, and network firewalls at the provider's edge) are entirely the provider's domain and cannot be delegated to the customer.

Answer

Encrypting customer data at rest

Answer

Patching virtual machines

Answer

Managing customer access policies

Question 7

A team uses Docker containers to run microservices. They need a service that automatically manages the cluster, scales containers based on demand, and provides load balancing without requiring them to manage the underlying VMs. Which Azure compute service should they choose?

Accepted Answer

Azure Kubernetes Service. Azure Kubernetes Service (AKS) is the correct choice because it provides a managed Kubernetes cluster that automates container orchestration, scaling, and load balancing. AKS abstracts the underlying VMs, handling master node management, updates, and scaling based on demand, which aligns with the team's requirement to avoid VM management.

Answer

Azure Container Instances

Answer

Azure Batch

Answer

Azure Virtual Machine Scale Sets

Question 8

A company has created an Azure Blueprint to define a standard environment with role assignments and policies. They have published multiple versions. They want all existing subscriptions that were created from an older version to automatically receive the updates from the latest version. What should they do?

Accepted Answer

Upgrade the blueprint assignment on the existing subscriptions. Option B is correct because Azure Blueprints allow you to update assignments on existing subscriptions to the latest published version. When you upgrade the blueprint assignment, it applies any new role assignments, policies, or artifacts defined in the newer version to the target subscriptions, ensuring they remain compliant with the updated standard environment.

Answer

Create a new subscription from the latest blueprint version

Answer

Reassign the blueprint to the subscriptions

Answer

Nothing, updates apply automatically

Question 9

A company has multiple on-premises sites that need to connect to Azure over high-throughput, low-latency private connections. They want a dedicated private connection that does not traverse the internet. Which Azure service should they use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated private connection from on-premises sites to Azure that does not traverse the public internet, ensuring high throughput and low latency. It uses a Layer 3 VPN or direct peering via a connectivity provider, bypassing internet-based routing entirely. This makes it ideal for scenarios requiring consistent performance and security for hybrid connectivity.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Peering Service

Question 10

A company has a management group hierarchy: Root > Europe > Production. They assign a policy at the Root level that denies creation of resources without a tag. Later, they assign a different policy at the Europe level. What is the effective effect on the Production subscription?

Accepted Answer

Both policies apply. Azure Policy is inherited by default from higher-level management groups down to subscriptions. When a policy is assigned at the Root management group, it applies to all child management groups and subscriptions, including the Production subscription. Assigning an additional policy at the Europe management group does not remove or override the Root-level policy; instead, both policies are evaluated and enforced, with the most restrictive effect taking precedence. Therefore, the Production subscription is subject to both policies.

Answer

Only the policy at the Europe level applies

Answer

Only the policy at the Root level applies

Answer

The policy at the lower level overrides the Root policy

Question 11

A company deploys a web application on Azure App Service. During a marketing campaign, they expect traffic to double. The app uses a Standard tier App Service plan. They want to ensure that the additional load is handled without performance degradation while keeping costs minimal. Which action should they take?

Accepted Answer

Scale out the App Service plan by increasing the instance count.. Scaling out (increasing instance count) for the Standard tier App Service plan allows the application to handle the doubled traffic by distributing requests across multiple instances, ensuring no performance degradation. This approach is cost-minimal because the Standard tier supports manual scale-out without requiring a tier upgrade, and you only pay for the additional instances while they are needed.

Answer

Scale up the App Service plan to a Premium tier for more resources.

Answer

Enable autoscale on the existing plan to let Azure handle scaling automatically.

Answer

Deploy Azure CDN to cache static content.

Question 12

A company has a policy that requires all storage accounts to have secure transfer enabled. They want to automatically audit all existing storage accounts and enforce the setting on new ones. They also want to automatically fix non-compliant new storage accounts. Which Azure Policy effect combination should they use?

Accepted Answer

B) audit and deployIfNotExists. The correct combination is 'audit' and 'deployIfNotExists'. The 'audit' effect logs non-compliant existing storage accounts without changing them, satisfying the audit requirement. The 'deployIfNotExists' effect automatically remediates new non-compliant storage accounts by enabling secure transfer (HTTPS) during deployment, enforcing the policy on new resources without blocking creation.

Answer

A) audit and deny

Answer

C) append and deny

Answer

D) modify and audit

Question 13

A company runs a workload that requires predictable performance and dedicated physical servers. They also need to ensure no other tenant uses the same hardware. Which cloud deployment model meets these requirements?

Accepted Answer

Private. A private cloud deployment model is correct because it provides dedicated physical servers and ensures that no other tenant shares the same hardware. In a private cloud, the infrastructure is provisioned for exclusive use by a single organization, offering predictable performance and complete isolation from other tenants. This model can be hosted on-premises or by a third-party provider, but the key requirement of dedicated hardware is met.

Answer

Public

Answer

Hybrid

Answer

Community

Question 14

A company is migrating its on-premises workloads to Azure. Previously, they purchased servers every three years as a large capital investment. Now, they pay a monthly subscription for virtual machines based on actual usage, with no long-term commitment. Which type of cloud expenditure model does this represent?

Accepted Answer

Capital expenditure (CapEx) to operational expenditure (OpEx). This scenario describes a shift from Capital Expenditure (CapEx), where the company made large upfront investments in hardware every three years, to Operational Expenditure (OpEx), where they pay a monthly subscription for Azure virtual machines based on actual usage with no long-term commitment. This is a core benefit of cloud computing, converting fixed, upfront costs into variable, ongoing expenses that align with consumption.

Answer

Operational expenditure (OpEx) to capital expenditure (CapEx)

Answer

Pay-as-you-go to reserved

Answer

Consumption-based to fixed cost

Question 15

A company is moving to the cloud to achieve economies of scale. Which of the following best describes how cloud computing enables economies of scale?

Accepted Answer

Cloud providers purchase large quantities of hardware, reducing per-unit costs, which are passed to customers.. Economies of scale in cloud computing are achieved because providers like AWS, Microsoft Azure, or Google Cloud purchase hardware (servers, networking gear, storage) in massive volumes, negotiating lower per-unit costs from vendors. These savings are passed to customers via lower pay-as-you-go prices, making cloud services cheaper than what an individual company would pay for equivalent on-premises infrastructure.

Answer

Customers can reserve resources in advance for a discount.

Answer

Multiple customers share the same physical hardware, reducing security.

Answer

Customers only pay for resources they use, reducing waste.

Question 16

A company needs to connect their on-premises network to Azure with a dedicated, private, and high-bandwidth connection that does not traverse the public internet. They require an SLA for availability and performance. Which Azure service should they use?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute is the correct choice because it provides a dedicated, private connection from on-premises networks to Azure that does not traverse the public internet. It offers a Service-Level Agreement (SLA) for availability (e.g., 99.95% for a single connection with redundancy) and performance, which is not guaranteed over internet-based VPNs. This meets the requirement for high bandwidth, privacy, and a guaranteed SLA.

Answer

Azure VPN Gateway

Answer

Azure Virtual WAN

Answer

Azure Peering Service

Question 17

A company wants to connect their on-premises data center to Azure with a dedicated, private connection that does not traverse the internet. They also need to ensure high availability by having two active connections. Which Azure service and configuration should they use?

Accepted Answer

Azure ExpressRoute with two circuits.. Azure ExpressRoute provides a dedicated, private connection from on-premises to Azure that does not traverse the public internet. To achieve high availability with two active connections, you must configure two ExpressRoute circuits, each connecting to different Microsoft Enterprise Edge (MSEE) devices, ensuring redundancy at the physical and network layer.

Answer

Azure VPN Gateway with active-active mode.

Answer

Azure Virtual WAN with a single connection.

Answer

Azure Point-to-Site VPN.

Question 18

According to Microsoft, which factor does NOT affect the SLA percentage for an Azure service?

Accepted Answer

The number of users concurrently accessing the service. The SLA percentage for an Azure service is determined by factors such as redundancy, fault tolerance, and resource configuration, not by the number of concurrent users. Microsoft's SLAs are based on uptime guarantees tied to architectural choices like availability zones, disk types, and availability sets, while user load is managed through scaling and is not a factor in the SLA calculation.

Answer

Whether resources are deployed across availability zones

Answer

Whether Premium SSD or Standard HDD disks are used for VMs

Answer

Whether a single VM or availability set is used

Question 19

A company plans to use Azure Site Recovery to replicate on-premises virtual machines to Azure for disaster recovery. Due to regulatory restrictions, they cannot use the paired region and must replicate to a specific Azure region in the same continent. Can they select this non-paired region as the recovery target?

Accepted Answer

Yes, you can select any Azure region as the target for replication.. Azure Site Recovery allows you to replicate on-premises virtual machines to any Azure region that supports the service, not just the paired region. The paired region is a default recommendation for cost and latency optimization, but it is not a mandatory requirement. Therefore, you can select a non-paired region as the recovery target as long as it is within the same continent and meets regulatory restrictions.

Answer

No, replication is only allowed to the paired region.

Answer

Yes, but only if both regions are within the same availability zone.

Answer

No, only to regions that are within the same geography.

Question 20

A company uses a hybrid cloud model where some workloads run on-premises and some in Azure. They need a consistent identity management system across both environments, allowing single sign-on for users accessing resources in either location. What should they implement?

Accepted Answer

Azure AD Connect. Azure AD Connect is the correct solution because it synchronizes on-premises Active Directory identities with Azure Active Directory, enabling a unified identity management system. This allows users to use the same credentials (single sign-on) to access both on-premises resources and Azure cloud services, fulfilling the hybrid cloud requirement.

Answer

Azure Site Recovery

Answer

Azure VPN Gateway

Answer

Azure Traffic Manager