AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Deploy VMs in an Availability Set across multiple fault domains.

  Why it's wrong here

  An Availability Set distributes VMs across fault domains (pods of shared hardware) and update domains within a single Azure datacenter. This protects against individual hardware failures such as a rack failure or a server component failing, and also handles planned maintenance events by cycling up domain-by-updt. However, a complete datacenter outage like a power or cooling failure will affect all fault domains since they all reside in the same physical facility. Thus, an Availability Set cannot provide resilience against a whole-datacenter failure, which is what Availability Zones are designed to handle.

  When this WOULD be correct

  If the requirement is to protect against hardware failures (e.g., server rack or network switch failure) within a single datacenter, and the solution does not need to survive a full datacenter outage, deploying VMs in an Availability Set with multiple fault domains is the correct answer.

• ✓

  Deploy VMs in an Availability Zone across multiple zones.

  Why this is correct

  Availability Zones are unique physical locations within an Azure region. Each zone has independent power, cooling, and networking. Deploying VMs across two or more zones ensures the application remains available even if one entire datacenter fails.

• ✗

  Deploy VMs in a single scale set with autoscale.

  Why it's wrong here

  A virtual machine scale set with autoscaling adjusts the number of VM instances based on demand (e.g., CPU load). It does not protect against a datacenter failure because all instances are typically placed within the same datacenter unless explicitly configured across zones.

  When this WOULD be correct

  A company needs high availability for a stateless web application within a single datacenter, with automatic scaling based on demand, and can tolerate brief downtime during a rack failure.

• ✗

  Deploy VMs in a virtual network with a VPN gateway to a secondary region.

  Why it's wrong here

  Deploying VMs with a VPN gateway to a secondary region is a disaster recovery strategy, not an in-region high-availability solution. This approach requires a second full deployment in a different Azure region, adds recurring VPN gateway costs, and introduces cross-region latency and configuration complexity. It also does not automatically fail over or balance traffic between the two sites—you need additional orchestration such as Azure Traffic Manager or manual intervention. Compared to a zone-based deployment within a single region, this is significantly more expensive and operationally heavy, making it unsuitable for the simple scenario described.

  When this WOULD be correct

  If the requirement were to connect an on-premises network to Azure or to replicate data between two regions for disaster recovery, a VPN gateway would be correct. For example, a question asking for a site-to-site VPN connection between a company's on-premises datacenter and Azure.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question