AZ-900 Describe Azure architecture and services Practice Question
A company runs a critical application on multiple Azure virtual machines (VMs) in the East US region. The application requires that the VMs are physically separated from any other customer's workloads and that the underlying physical servers are dedicated to this company alone. The compliance team mandates that no other customer's VMs can run on the same physical hardware. Which Azure compute offering should the company use to meet this requirement?
⚠ Common exam trap
It's easy for candidates to confuse Azure Dedicated Host with Azure Reserved Instances or Availability Sets, mistakenly thinking that high availability or cost savings can achieve physical isolation, when only Dedicated Host provides dedicated physical servers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Dedicated Host
Azure Dedicated Host provides single-tenant physical servers dedicated to a single customer, ensuring that no other customer's VMs run on the same hardware. This meets the compliance requirement for physical separation and dedicated underlying servers. The company can deploy VMs directly onto these dedicated hosts, guaranteeing isolation at the hardware level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Dedicated Host
Why this is correct
Azure Dedicated Host is correct because it provisions a single-tenant physical server, placing your VMs on hardware that is exclusively allocated to your subscription and not shared with any other customers. This enables physical isolation at the server level, which is required for compliance standards that mandate dedicated compute resources. Unlike logical isolation, you also control the host's maintenance timing and workload placement, ensuring full hardware ownership.
- ✗
Azure Availability Set
Why it's wrong here
An Availability Set is incorrect because it only organizes VMs into fault domains and update domains to protect against software updates and hardware failures within an Azure datacenter. While this reduces the risk of a single point of failure, it does not guarantee any physical separation from other tenants' VMs; your VMs can be placed on shared physical hardware alongside other customers' workloads. The goal is high availability, not hardware isolation.
When this WOULD be correct
A company needs to ensure that its VMs remain available during planned maintenance or unplanned failures. The requirement is to distribute VMs across multiple fault domains and update domains to avoid a single point of failure, without needing dedicated physical servers.
- ✗
Azure Virtual Machine Scale Set
Why it's wrong here
Azure Virtual Machine Scale Set is incorrect because it is a service for deploying and automatically managing a group of identical, load-balanced VMs that can scale in or out based on demand. Scale sets operate on standard shared infrastructure, and while they can spread VMs across availability zones, they do not provide single-tenant physical servers or any form of dedicated hardware. Its purpose is operational efficiency and scalability, not compliance-driven physical isolation.
When this WOULD be correct
A company needs to automatically deploy and manage a group of identical VMs that scale in/out based on demand, such as a web front-end that handles variable traffic. The requirement is for elasticity and high availability, not physical isolation.
- ✗
Azure Reserved Virtual Machine Instances
Why it's wrong here
Reserved Virtual Machine Instances are incorrect because they solely represent a capacity reservation and billing discount for committing to a one- or three-year term for virtual machine usage. They do not alter the underlying hardware architecture; your VMs continue to run on the same multi-tenant physical infrastructure as others. The discount is applied to VM compute costs, but it offers no control over nor visibility into the physical server hosting your workloads.
When this WOULD be correct
A company wants to reduce costs for a predictable, long-term workload running on Azure VMs and is willing to commit to a one- or three-year term in exchange for a significant discount on compute costs, without requiring physical isolation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Dedicated HostCorrect answer▾
Why this is correct
Azure Dedicated Host is correct because it provisions a single-tenant physical server, placing your VMs on hardware that is exclusively allocated to your subscription and not shared with any other customers. This enables physical isolation at the server level, which is required for compliance standards that mandate dedicated compute resources. Unlike logical isolation, you also control the host's maintenance timing and workload placement, ensuring full hardware ownership.
✗Azure Availability SetWrong answer — click to see why▾
Why this is wrong here
Azure Availability Sets only provide high availability by distributing VMs across fault domains and update domains within a single Azure datacenter, but they do not guarantee physical isolation from other customers' workloads. Multiple customers' VMs can still run on the same physical hardware.
★ When this WOULD be the correct answer
A company needs to ensure that its VMs remain available during planned maintenance or unplanned failures. The requirement is to distribute VMs across multiple fault domains and update domains to avoid a single point of failure, without needing dedicated physical servers.
Why candidates choose this
Candidates may confuse high availability with physical isolation, thinking that spreading VMs across fault domains ensures they are on separate physical hardware, but fault domains only separate power and networking, not customer workloads.
✗Azure Virtual Machine Scale SetWrong answer — click to see why▾
Why this is wrong here
Azure Virtual Machine Scale Set provides auto-scaling and load balancing for VMs, but does not guarantee physical isolation or dedicated hardware. Multiple customers' VMs can run on the same physical servers within a scale set.
★ When this WOULD be the correct answer
A company needs to automatically deploy and manage a group of identical VMs that scale in/out based on demand, such as a web front-end that handles variable traffic. The requirement is for elasticity and high availability, not physical isolation.
Why candidates choose this
Candidates may confuse the concept of 'dedicated' with 'scalable' or think that a scale set provides dedicated resources because it manages a group of VMs, but it does not isolate them at the hardware level.
✗Azure Reserved Virtual Machine InstancesWrong answer — click to see why▾
Why this is wrong here
Azure Reserved Virtual Machine Instances provide a billing discount for committing to a one- or three-year term, but they do not ensure physical isolation or dedicated hardware; other customers' VMs can still run on the same physical server.
★ When this WOULD be the correct answer
A company wants to reduce costs for a predictable, long-term workload running on Azure VMs and is willing to commit to a one- or three-year term in exchange for a significant discount on compute costs, without requiring physical isolation.
Why candidates choose this
Candidates may confuse 'reserved' with 'dedicated,' assuming that reserving instances guarantees exclusive use of the underlying hardware, when in fact it only reserves capacity at a discounted price.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
Key term
Tenant
A dedicated and isolated instance of Microsoft Entra ID that an organization receives when signing up for a Microsoft cloud service.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.