AZ-900 Describe Azure architecture and services Practice Question
A company is deploying a critical internal application in Azure. The application will run on two virtual machines. The solution must guarantee that the virtual machines are placed on separate physical servers and separate racks to minimize the impact of hardware failures. Which Azure feature should the company use?
⚠ Common exam trap
Candidates often confuse Availability Zones (which provide datacenter-level isolation) with Availability Sets (which provide rack-level isolation within a single datacenter), leading candidates to over-engineer the solution when a simpler, lower-latency option is correct.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Availability set
An availability set ensures that virtual machines are distributed across multiple fault domains (separate physical servers and racks) and update domains within an Azure datacenter. By placing the two VMs in the same availability set, Azure guarantees they will be on different physical hardware, minimizing the impact of a single hardware failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Load Balancer
Why it's wrong here
Azure Load Balancer operates at the network layer and distributes incoming traffic across a pool of healthy virtual machines based on rules and health probes. It is completely unaware of the physical server, rack, or fault domain where each VM resides. While it can reroute traffic if a VM instance becomes unhealthy, it cannot influence VM placement, so all VMs in the pool could share the same physical hardware. Therefore, it does not protect against a single hardware failure taking down multiple VMs simultaneously.
- ✓
Availability set
Why this is correct
An availability set is a logical container that tells the Azure Fabric to place VMs in different fault domains and update domains within the same datacenter. Fault domains isolate VMs onto separate physical racks with independent power and network switches, while update domains ensure planned maintenance does not reboot all VMs at once. This guarantees that a hardware failure in one rack will not affect VMs in other racks, directly satisfying the requirement for protecting a critical internal application against hardware failures.
- ✗
Availability zone
Why it's wrong here
Availability zones are geographically distinct datacenters within an Azure region, each with independent power, cooling, and networking. Placing VMs across zones provides resilience against a complete datacenter failure, which is a stronger but different redundancy model than what is needed here. The need is for protection against hardware failures within a single datacenter, such as a rack or server failing, which an availability set addresses. Zone-redundant deployments also introduce cross-zone network latency, so they are not the appropriate targeted solution for this scenario.
When this WOULD be correct
A company needs to deploy a critical application in Azure with high availability across datacenters. The solution must ensure that VMs are in different physical locations to survive a complete datacenter outage. In this scenario, Availability zones would be the correct answer.
- ✗
Virtual network
Why it's wrong here
A virtual network is a software-defined network that provides IP addressing, subnetting, routing, and security policy within Azure. It controls the logical connectivity between resources but has no governance over the physical infrastructure that hosts the underlying VMs. The Azure Fabric places VMs based on availability, capacity, and other placement constraints, but a virtual network cannot enforce separation of VMs onto different hardware racks. Therefore, it is irrelevant to mitigating physical hardware failure risks.
When this WOULD be correct
A company needs to securely connect on-premises resources to Azure and isolate network traffic for a multi-tier application. Using a virtual network with subnets and network security groups would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Availability setCorrect answer▾
Why this is correct
An availability set is a logical container that tells the Azure Fabric to place VMs in different fault domains and update domains within the same datacenter. Fault domains isolate VMs onto separate physical racks with independent power and network switches, while update domains ensure planned maintenance does not reboot all VMs at once. This guarantees that a hardware failure in one rack will not affect VMs in other racks, directly satisfying the requirement for protecting a critical internal application against hardware failures.
✗Availability zoneWrong answer — click to see why▾
Why this is wrong here
Availability zones protect against datacenter-level failures by placing VMs in separate physical locations, but the question requires separation within the same datacenter (separate racks). Availability sets provide fault domains for rack-level separation, making them the correct choice.
★ When this WOULD be the correct answer
A company needs to deploy a critical application in Azure with high availability across datacenters. The solution must ensure that VMs are in different physical locations to survive a complete datacenter outage. In this scenario, Availability zones would be the correct answer.
Why candidates choose this
Candidates may confuse 'separate physical servers and separate racks' with 'separate physical locations,' assuming zones provide rack-level isolation. The term 'zone' sounds more robust than 'set,' leading to a mistaken preference for zones.
✗Virtual networkWrong answer — click to see why▾
Why this is wrong here
A virtual network provides network isolation and connectivity for Azure resources, but it does not control physical server or rack placement. It cannot guarantee that VMs are on separate hardware to minimize hardware failure impact.
★ When this WOULD be the correct answer
A company needs to securely connect on-premises resources to Azure and isolate network traffic for a multi-tier application. Using a virtual network with subnets and network security groups would be the correct answer.
Why candidates choose this
Candidates may think that virtual networks provide high availability or fault isolation because they segment resources, but they operate at the network layer, not the physical infrastructure layer.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Availability
Availability is the measure of how often a system or service is operational and accessible when needed, typically expressed as a percentage of uptime.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.