AZ-900 Practice Questions

Question 1

Which Azure feature allows you to prevent accidental deletion or modification of critical Azure resources?

Accepted Answer

Azure Resource Locks. Azure Resource Locks are designed to prevent accidental deletion or modification of critical Azure resources by applying a lock at the subscription, resource group, or resource level. There are two types: CanNotDelete (prevents deletion but allows modifications) and ReadOnly (prevents both deletion and modification). This directly addresses the scenario of protecting resources from unintended changes.

Answer

Azure RBAC

Answer

Azure Policy

Answer

Azure Blueprints

Question 2

A company has a policy that all Azure Storage accounts must have diagnostic settings enabled to send logs and metrics to a specific Log Analytics workspace. The governance team wants to automatically configure these diagnostic settings when a new storage account is created, without blocking the initial creation. The solution must not require manual intervention. Which Azure Policy effect should the team use in their policy definition?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it automatically deploys a remediation task to configure diagnostic settings on storage accounts that lack them, without blocking the initial creation of the resource. This effect evaluates resources after creation and triggers a deployment to bring non-compliant resources into compliance, which aligns with the requirement for automatic configuration without manual intervention.

Answer

Audit

Answer

Deny

Answer

Append

Question 3

A global e-commerce company has web applications deployed on Azure virtual machines in the West US and West Europe regions. The company needs a single, global HTTP-based entry point that can perform SSL offloading, route requests based on the URL path (e.g., /api to one backend pool, /images to another), and provide a web application firewall (WAF) to protect against common web attacks. Additionally, the solution must automatically direct users to the closest regional deployment to minimize latency. Which Azure service should the company use?

Accepted Answer

Azure Front Door. Azure Front Door is the correct choice because it provides a global, HTTP/HTTPS-based entry point with SSL offloading, URL path-based routing to different backend pools, and a built-in web application firewall (WAF). It also uses Anycast-based routing to automatically direct users to the closest regional deployment, minimizing latency.

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Answer

Azure Load Balancer

Question 4

A company wants to proactively identify Azure resources that are misconfigured and could lead to security vulnerabilities, such as virtual machines with open management ports or unencrypted storage accounts. They also need to get prioritized recommendations for remediating these issues. Which Azure service should the company use?

Accepted Answer

Microsoft Defender for Cloud (formerly Azure Security Center). Microsoft Defender for Cloud (formerly Azure Security Center) is the correct service because it continuously assesses the security posture of Azure resources, identifies misconfigurations such as open management ports (e.g., RDP/SSH) or unencrypted storage accounts, and provides prioritized, actionable recommendations for remediation. It integrates with Azure Policy to enforce security standards and offers a secure score to track improvement over time.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Blueprints

Question 5

Which Azure service enables you to synchronize your on-premises Active Directory with Azure Active Directory?

Accepted Answer

Azure AD Connect. Azure AD Connect is the correct service because it is specifically designed to synchronize on-premises Active Directory identities with Azure Active Directory, enabling hybrid identity scenarios. It handles password hash synchronization, pass-through authentication, and federation integration, ensuring users have a single identity for both on-premises and cloud resources.

Answer

Azure AD Domain Services

Answer

Azure AD B2C

Answer

Azure Multi-Factor Authentication

Question 6

A company has an on-premises data center with a site-to-site VPN connection to Azure. The company wants to ensure that the connection remains secure by encrypting all traffic between the on-premises network and Azure virtual network. The connection must be established over the public internet. Which Azure service should the company use to create this encrypted tunnel?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct service because it creates an encrypted site-to-site VPN tunnel over the public internet using IPsec/IKE protocols. This meets the requirement for a secure connection between the on-premises data center and Azure virtual network over the public internet.

Answer

Azure ExpressRoute

Answer

Azure Virtual WAN

Answer

Azure Bastion

Question 7

A company has a critical Azure Storage account that stores immutable backups. The IT administrator wants to ensure that no one can delete or modify this storage account, even administrators with Contributor or Owner roles. The company still needs to allow read access to the data within the storage account. Which Azure governance feature should the administrator implement?

Accepted Answer

Azure Resource Manager read-only lock. An Azure Resource Manager read-only lock prevents any user, including those with Contributor or Owner roles, from deleting or modifying the storage account while still allowing read access to the data. This lock operates at the management plane, blocking DELETE and PATCH operations via the Azure Resource Manager API, but does not affect data plane operations like reading blobs or files.

Answer

Azure Policy with Deny effect

Answer

Azure Blueprint with role assignment

Answer

Azure role-based access control (RBAC) with Reader role

Question 8

A multinational company has multiple Azure subscriptions for different business units. The central governance team wants to define a standardized environment that must be automatically applied to every new subscription. The standard must include a set of Azure Policy definitions (e.g., allowed regions), a specific Azure RBAC role assignment (e.g., a contributor access for a central security group), and a preconfigured resource group with a virtual network. The team wants to package all these components together so that they can be deployed consistently and updated centrally. Which Azure service should the team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the service designed to package together Azure Policy definitions, RBAC role assignments, and Azure Resource Manager templates (including resource groups and resources) into a single, versioned artifact that can be assigned to subscriptions. This enables organizations to enforce a consistent governance and compliance baseline across multiple subscriptions. Azure Policy alone cannot deploy RBAC assignments or resources. Azure Management Groups provide hierarchical organization and policy inheritance but do not deploy resources. ARM templates can deploy resources but cannot natively include policy or RBAC assignments as a cohesive package.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Manager templates

Question 9

What does the term 'fault tolerance' mean in cloud computing?

Accepted Answer

The ability to continue operating despite component failures. Fault tolerance is the ability of a system to continue operating without interruption when one or more of its components fail. In Azure, this is achieved through redundancy at multiple layers—such as using Availability Zones or redundant hardware—so that a failure in a single server, network path, or power supply does not bring down the entire workload. This is distinct from high availability, which focuses on minimizing downtime, whereas fault tolerance aims for zero downtime even during failures.

Answer

The ability to scale resources up and down automatically

Answer

The ability to recover data after accidental deletion

Answer

The ability to deploy applications across multiple regions

Question 10

A company is developing a new web application. The development team wants to deploy the application code without having to manage the underlying virtual machines, operating systems, or runtime environments. They only want to focus on writing code and let the cloud provider handle the infrastructure, platform, and scaling automatically. Which cloud service model does this scenario describe?

Accepted Answer

Platform as a Service (PaaS). This scenario describes Platform as a Service (PaaS) because the development team wants to deploy application code without managing the underlying virtual machines, operating systems, or runtime environments. PaaS provides a managed hosting environment where the cloud provider handles infrastructure, platform updates, and automatic scaling, allowing developers to focus solely on writing and deploying code. In contrast, IaaS would require managing VMs and OS, while SaaS delivers fully built applications, not a platform for custom code deployment.

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Question 11

A company manages hundreds of Azure SQL databases across multiple subscriptions. The compliance team requires that every Azure SQL database has diagnostic settings enabled to send logs to a central Log Analytics workspace. The team wants a solution that automatically configures diagnostic settings for any new Azure SQL database when it is created, without requiring manual intervention or additional scripting. Which Azure governance feature should the team use?

Accepted Answer

Azure Policy with the DeployIfNotExists effect. Azure Policy with the DeployIfNotExists effect is the correct choice because it automatically evaluates new Azure SQL databases against a policy rule and, if diagnostic settings are missing, triggers a remediation task to deploy them to the specified Log Analytics workspace. This effect operates at resource creation time without manual intervention or scripting, fulfilling the compliance team's requirement for automatic, consistent configuration across all subscriptions.

Answer

Azure Blueprints with a resource group artifact

Answer

Azure Resource Manager templates deployed via Azure DevOps

Answer

Azure Monitor with a data collection rule

Question 12

What is an Azure availability zone?

Accepted Answer

A physically separate datacenter within an Azure region with independent power and cooling. An Azure availability zone is a physically separate datacenter within an Azure region, each with its own independent power, cooling, and networking. This isolation ensures that if one zone fails, applications and data in other zones remain unaffected, providing high availability and fault tolerance for critical workloads.

Answer

A geographic region with multiple Azure datacenters

Answer

A pair of geographically distant Azure regions

Answer

A logical grouping of Azure resources for billing

Question 13

Which Azure service provides dedicated physical servers for regulatory or licensing requirements where hardware cannot be shared with other customers?

Accepted Answer

Azure Dedicated Host. Azure Dedicated Host provides physical servers dedicated to a single Azure subscription, ensuring that hardware is not shared with other customers. This meets regulatory or licensing requirements that mandate hardware isolation, such as specific compliance standards or software licensing agreements that restrict usage to dedicated hardware.

Answer

Azure Reserved VM Instances

Answer

Azure Spot VMs

Answer

Azure Isolated VM sizes

Question 14

A company uses a public cloud provider that shares the same physical infrastructure among many customers. This allows the provider to offer lower prices due to economies of scale. Which cloud characteristic describes the sharing of infrastructure?

Accepted Answer

Resource pooling. Resource pooling is the cloud characteristic that allows a provider to serve multiple customers from the same physical infrastructure, using multi-tenant models. This sharing enables economies of scale because the provider can amortize hardware costs across many tenants, reducing per-customer pricing. The scenario directly describes multi-tenancy and shared infrastructure, which is the essence of resource pooling.

Answer

Measured service

Answer

Rapid elasticity

Answer

On-demand self-service

Question 15

Which Azure service provides a way to enforce organizational standards and assess compliance at scale across Azure resources?

Accepted Answer

Azure Policy. Azure Policy allows you to create, assign, and manage policies that enforce rules over your resources. These policies ensure resources stay compliant with corporate standards and service level agreements. Azure Policy can deny non-compliant deployments or audit existing resources.

Answer

Azure RBAC

Answer

Azure Blueprints

Answer

Azure Advisor

Microsoft Azure Fundamentals AZ-900 practice test

Three ways to study

Study AZ-900 by domain

Study AZ-900 by topic

Describe cloud concepts practice questions

Describe Azure architecture and services practice questions

Describe Azure management and governance practice questions

AZ-900 Azure services practice questions

AZ-900 pricing and support practice questions

AZ-900 security and compliance practice questions

AZ-900 governance practice questions

Top AZ-900 questions

Microsoft Azure Fundamentals AZ-900 practice questions

How to use these AZ-900 questions

Quick answer