AZ-900 Describe cloud concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Azure AD Connect

  Why this is correct

  Azure AD Connect is the dedicated tool for hybrid identity, synchronizing on-premises Active Directory objects (users, groups, passwords, and attributes) to Azure AD. It enables single sign-on by supporting password hash synchronization, pass-through authentication, or federation with AD FS. For a hybrid cloud model, this is the service that bridges on-premises directories with Azure AD, making it the correct solution.

• ✗

  Azure Site Recovery

  Why it's wrong here

  Azure Site Recovery is a disaster recovery service that continuously replicates on-premises virtual machines and physical servers to Azure, orchestrating planned failover, unplanned failover, and failback. Its purpose is business continuity and ensuring workloads remain available during outages or disasters. It does not handle authentication, directory synchronization, or identity integration; it simply protects infrastructure, making it incorrect for providing a hybrid identity solution.

  When this WOULD be correct

  A company wants to replicate on-premises virtual machines to Azure for disaster recovery, ensuring business continuity in case of a site failure. Azure Site Recovery would be the correct answer for a question about disaster recovery and failover.

• ✗

  Azure VPN Gateway

  Why it's wrong here

  Azure VPN Gateway creates encrypted IPSec VPN tunnels over the public internet, providing site-to-site or point-to-site network connectivity between on-premises networks and Azure virtual networks. It establishes network-level reachability but operates entirely at Layer 3, transmitting data packets rather than directory objects. While it is often part of a hybrid cloud architecture for secure communication, it has no mechanism to synchronize identity data or enable single sign-on, thus it cannot fulfill the stated need.

  When this WOULD be correct

  A company needs to securely connect their on-premises network to an Azure virtual network over the internet, ensuring encrypted traffic for hybrid workloads. Azure VPN Gateway would be the correct answer for establishing a site-to-site VPN connection.

• ✗

  Azure Traffic Manager

  Why it's wrong here

  Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming HTTP/HTTPS or other protocol traffic to endpoints across global Azure regions based on routing methods such as performance, priority, weighted, or geographic. Its sole purpose is to distribute network traffic and improve availability and responsiveness. It does not process identity objects, synchronize directories, or integrate on-premises AD with Azure AD, so it is unrelated to the hybrid identity requirement.

  When this WOULD be correct

  A company has multiple Azure regions or on-premises endpoints hosting the same application and needs to route user traffic to the nearest or most available endpoint for performance and high availability. Azure Traffic Manager would be the correct answer for a question about global traffic routing.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question