AZ-900 Practice Exam 1

54 questions with the correct answer and an explanation for each. Topic: AZ-900. Free, no account needed.

Take this test interactively

1. A company must run a legacy line-of-business application that needs a custom operating system configuration and specially installed software. The team accepts responsibility for patching and updates. Which Azure compute option fits?

  1. Azure Virtual Machines
  2. Azure App Service
  3. Azure Container Instances
  4. Azure Functions

Answer: A — Azure Virtual Machines

VMs are IaaS and give total control over the OS and the ability to run custom software, with patching left to you. App Service and Functions abstract the platform away, and Container Instances don't give you an OS to manage.

2. An administrator wants to reduce the chance that all VMs in a region are affected by a single planned maintenance event or a shared power or network failure. Which two groupings does an availability set use to achieve this? (Choose two.)

  1. Update domain
  2. Scale set
  3. Resource group
  4. Fault domain
  5. Availability zone

Answer: A,D — Update domain / Fault domain

Availability sets group VMs by update domain (rebooted together during planned maintenance) and fault domain (shared power or network failure point). Availability zones are a separate, zone-based design, and scale sets are a different feature.

3. A team is deploying a large fleet of containers and wants a service that manages the lifecycle of those containers and simplifies fleet management. Which service fits?

  1. Azure Functions
  2. Azure Virtual Desktop
  3. Azure Container Instances
  4. Azure Kubernetes Service

Answer: D — Azure Kubernetes Service

AKS is a container orchestration service that manages container lifecycle for fleets. Container Instances is the simplest way to run a container, not a fleet manager.

4. Which two statements about Azure Functions are true? (Choose two.)

  1. They scale automatically based on demand.
  2. They are stateful by default.
  3. Charges apply for the time resources sit provisioned and idle.
  4. They require a VM to be running at all times to respond to events.
  5. They can be deployed in an environment that isn't serverless to run on virtual networks or be completely isolated.

Answer: A,E — They scale automatically based on demand. / They can be deployed in an environment that isn't serverless to run on virtual networks or be completely isolated.

Functions scale automatically with demand, and if app needs change they can be deployed in a non-serverless environment to manage scaling, use virtual networks, or isolate them. They are stateless by default, are woken by events, and charge only for CPU time used.

5. A company wants to add speech recognition and image analysis to an application through APIs, without first training its own model. Which Azure option fits?

  1. Azure Kubernetes Service
  2. Azure AI services
  3. Azure IoT Hub
  4. Azure Machine Learning

Answer: B — Azure AI services

Azure AI services provides prebuilt capabilities such as speech and vision exposed through APIs. Azure Machine Learning is for building, training, and managing custom models.

6. A company runs only an on-premises Active Directory and has no visibility into suspicious sign-in attempts, such as sign-ins from unknown devices or unexpected locations. It wants this detection at no extra cost and does not want to maintain two separate sets of identities. What should it do?

  1. Enable B2B direct connect with another tenant
  2. Deploy Microsoft Entra Connect to synchronize identities with Microsoft Entra ID
  3. Create a Microsoft Entra Domain Services managed domain and move all users into it
  4. Add more on-premises domain controllers to monitor sign-in behavior

Answer: B — Deploy Microsoft Entra Connect to synchronize identities with Microsoft Entra ID

Synchronizing on-premises AD with Microsoft Entra ID through Microsoft Entra Connect avoids two separate identity sets, and once connected, Microsoft can detect suspicious sign-ins at no extra cost. On-premises Active Directory on its own does not monitor sign-in behavior, so adding more domain controllers does not help.

7. A security team wants sign-in to require factors from two different categories so that a stolen password alone is not enough. Which two combinations meet that requirement? (Choose two.)

  1. A password and a challenge question
  2. A password and a fingerprint scan
  3. A challenge question and a second challenge question
  4. A code sent to a mobile phone and a face scan
  5. Two different passwords

Answer: B,D — A password and a fingerprint scan / A code sent to a mobile phone and a face scan

A password (something you know) with a fingerprint (something you are), or a phone code (something you have) with a face scan (something you are), combine different categories. Passwords and challenge questions are all something the user knows, so combining them stays in one category.

8. A company invites supplier staff to use its internal SaaS apps with the suppliers' own work accounts. Which two statements about this arrangement are accurate? (Choose two.)

  1. The company must create and manage separate local credentials for each supplier user
  2. The supplier users are typically represented in the company's directory as guest users
  3. The supplier users are not represented in the company's directory
  4. The arrangement is intended only for publishing Microsoft apps to consumers
  5. The external identity provider manages authentication while the company manages authorization to its applications

Answer: B,E — The supplier users are typically represented in the company's directory as guest users / The external identity provider manages authentication while the company manages authorization to its applications

With B2B collaboration, external users sign in with their preferred identity and are typically represented as guests, with the external provider handling authentication and the company handling authorization. Guests use their existing credentials, so separate local credentials are not needed.

9. A user receives one role assignment that grants read permissions on a resource group and a different role assignment that grants write permissions on the same resource group. What are the user's effective permissions on that resource group?

  1. Write only, because the most recent assignment replaces the earlier one
  2. Both read and write
  3. None until one of the assignments is removed because they conflict
  4. Read only, because the more restrictive assignment wins

Answer: B — Both read and write

Azure RBAC uses an allow model, so permissions from multiple role assignments are combined. There is no conflict or override between the two assignments.

10. A team is hardening the network layer of its defense-in-depth strategy to reduce the risk of an attack spreading between systems. Which two measures belong to this layer? (Choose two.)

  1. Deny by default and limit communication between resources
  2. Restrict inbound internet access and limit outbound access where appropriate
  3. Filter large-scale attacks with DDoS protection
  4. Implement endpoint protection and keep systems patched
  5. Store application secrets in Azure Key Vault

Answer: A,B — Deny by default and limit communication between resources / Restrict inbound internet access and limit outbound access where appropriate

The network layer limits connectivity to what is required, using deny by default and restricting inbound and outbound access. Endpoint protection and patching belong to compute, DDoS protection to the perimeter, and secrets storage to the application layer.

11. A company is building a high-performance application that needs a storage account able to host both SMB and NFS file shares. Which storage account type should they create?

  1. Standard general-purpose v2
  2. Premium page blobs
  3. Premium block blobs
  4. Premium file shares

Answer: D — Premium file shares

The premium file shares account type supports both SMB and NFS file shares. Standard general-purpose v2 is the strongest distractor, but NFS support in Azure Files requires the premium file shares type.

12. A company requires that all data replicas remain within the primary region, and that reads and writes continue if one zone becomes unavailable. Which redundancy option meets both requirements?

  1. Read-access geo-redundant storage (RA-GRS)
  2. Zone-redundant storage (ZRS)
  3. Geo-redundant storage (GRS)
  4. Locally redundant storage (LRS)

Answer: B — Zone-redundant storage (ZRS)

ZRS replicates synchronously across three availability zones in the primary region and stays available for read and write if a zone is down. LRS keeps all replicas in one datacenter, and GRS and RA-GRS replicate to a secondary region.

13. An application must survive a zone outage in the primary region without failing over, and it must survive a regional disaster. It must also be able to read the secondary-region copy while the primary region is still available. Which redundancy option meets all of these requirements?

  1. Geo-zone-redundant storage (GZRS)
  2. Read-access geo-zone-redundant storage (RA-GZRS)
  3. Read-access geo-redundant storage (RA-GRS)
  4. Zone-redundant storage (ZRS)

Answer: B — Read-access geo-zone-redundant storage (RA-GZRS)

RA-GZRS combines ZRS in the primary region with geo-replication and read access to the secondary. GZRS doesn't allow secondary reads before failover, RA-GRS uses LRS in the primary, and ZRS has no second region.

14. A company moves data from the hot tier to the cool and cold tiers to reduce costs. Which two characteristics apply to the cool and cold tiers compared with hot? (Choose two.)

  1. Higher access costs
  2. Higher availability SLAs
  3. Lower access costs
  4. Lower storage costs
  5. They can't be set at the blob level

Answer: A,D — Higher access costs / Lower storage costs

Cool and cold tiers trade lower storage costs for higher access costs and lower availability SLAs. They can also be set at the blob level.

15. An administrator runs an AzCopy sync with a local folder as the source and a blob container as the destination. Later, a file is modified only in the container. What happens on the next sync run?

  1. The change is not copied back, because AzCopy sync is one-directional from source to destination.
  2. The modified blob is copied back to the local folder, based on timestamps.
  3. The sync fails because changes exist on both sides.
  4. AzCopy merges both versions using metadata.

Answer: A — The change is not copied back, because AzCopy sync is one-directional from source to destination.

AzCopy synchronization is one-direction: files are copied from the designated source to the destination. It doesn't synchronize bi-directionally based on timestamps or other metadata.

16. An architect designing for availability must account for the uptime each Azure service is promised. Where are these guarantees defined?

  1. In the service-level agreements (SLAs)
  2. In the pillars of the Microsoft Azure Well-Architected Framework
  3. In the estimates produced by the Azure Pricing Calculator
  4. In the preconfigured templates used to deploy resources

Answer: A — In the service-level agreements (SLAs)

Uptime guarantees vary by service and are part of the SLAs. The Pricing Calculator only estimates potential spend, and the Well-Architected Framework is a design framework, not the source of uptime guarantees.

17. A web app's traffic is heavily concentrated in one area, overloading it, and overall demand also spikes then falls unpredictably. The team wants part of the overload redirected to less stressed areas, and extra resources deployed only while demand requires them. Which pairing of capabilities meets both needs?

  1. Autoscaling redirects the overload; load balancing deploys extra resources and scales back
  2. Load balancing redirects the overload; autoscaling deploys extra resources and scales back
  3. Autoscaling both redirects the overload and deploys and removes resources
  4. Load balancing both redirects the overload and deploys and removes resources

Answer: B — Load balancing redirects the overload; autoscaling deploys extra resources and scales back

Load balancing redirects overload toward less stressed areas, while autoscaling deploys additional resources and scales back when demand drops. Option A swaps the two roles.

18. A compliance team needs to flag deployed resources that have drifted from its baseline and to receive suggested ways to bring them back into compliance. Which cloud capability fits?

  1. Automatic software patching
  2. Cloud-based auditing
  3. Horizontal scaling of the non-compliant resources
  4. Deploying resources from templates

Answer: B — Cloud-based auditing

Cloud-based auditing flags resources that are out of compliance with the baseline and provides mitigation strategies. Templates help new deployments meet standards but do not flag drift.

19. A sustainability lead asks why cloud providers can use resources more efficiently than many isolated on-premises environments, and what a customer can do to reduce waste. (Choose two.)

  1. Customers should keep unused resources running so they are ready when needed
  2. Customers should reserve fixed capacity sized for peak demand at all times
  3. The cloud automatically guarantees sustainability regardless of how resources are used
  4. Customers can match deployed resources to actual demand
  5. Providers operate at large scale, which can improve resource utilization

Answer: D,E — Customers can match deployed resources to actual demand / Providers operate at large scale, which can improve resource utilization

Large-scale operation can improve utilization, and matching deployed resources to actual demand reduces waste. Sustainability benefits depend on teams actively optimizing, so no automatic guarantee exists, and permanent peak capacity or idle resources add waste.

20. A team wants both the performance and the cost of its cloud solution to be predictable. Which approach influences both?

  1. Managing resources exclusively through a command line interface
  2. Building the solution around the Microsoft Azure Well-Architected Framework
  3. Relying only on uptime guarantees from service-level agreements
  4. Scaling every resource vertically as far as possible

Answer: B — Building the solution around the Microsoft Azure Well-Architected Framework

Both performance and cost predictability are heavily influenced by the Well-Architected Framework. SLAs address uptime guarantees, not predictability of cost and performance.

21. A retailer expects a heavy traffic spike during a one-month seasonal launch. It wants to avoid ordering and configuring physical servers months in advance, and it wants spending to follow actual demand. Which approach fits?

  1. Deploy additional cloud compute capacity for the launch period and scale down afterward
  2. Convert the on-site datacenter to a private cloud and buy extra hardware
  3. Purchase enough physical servers ahead of time to cover the peak load
  4. Build a second datacenter to hold the launch capacity

Answer: A — Deploy additional cloud compute capacity for the launch period and scale down afterward

Cloud compute can be provisioned on demand for the launch and released afterward, so spending tracks demand. Buying servers, building a datacenter or adding private hardware all require up-front procurement.

22. A company is reviewing which responsibilities change with the cloud service type. Which two vary depending on whether it uses IaaS, PaaS or SaaS? (Choose two.)

  1. The physical hosts
  2. The accounts and identities of people, services, and devices
  3. Applications
  4. The information and data stored in the cloud
  5. Operating systems

Answer: C,E — Applications / Operating systems

Operating systems and applications depend on the service type. Data and identities always stay with the consumer, and physical hosts always belong to the provider.

23. A company must keep its existing private cloud, but it sometimes faces increased, temporary demand beyond that capacity. It wants to cover those surges without permanently adding hardware. Which approach fits?

  1. Run two public cloud providers side by side
  2. Use a hybrid cloud, deploying public cloud resources when the private cloud needs to surge
  3. Expand the private cloud by purchasing more hardware
  4. Shut down the private cloud and rebuild it as a traditional datacenter

Answer: B — Use a hybrid cloud, deploying public cloud resources when the private cloud needs to surge

A hybrid cloud lets a private cloud surge for temporary demand by deploying public cloud resources. Multicloud involves only public providers and does not keep the private cloud.

24. An organization is established with VMware in a private cloud and wants to move to a public or hybrid cloud. It wants to run its existing VMware workloads in Azure with seamless integration and scalability. Which fits?

  1. A multicloud deployment with a second provider
  2. Azure VMware Solution
  3. Microsoft Entra ID
  4. Azure Arc

Answer: B — Azure VMware Solution

Azure VMware Solution runs VMware workloads in Azure. Azure Arc manages environments rather than hosting those workloads.

25. A company moves from an on-premises datacenter to a cloud provider. Which of the following does it still keep responsibility for, rather than passing it to the provider?

  1. Physical security of the datacenter
  2. Power and cooling for the servers
  3. Network connectivity of the datacenter
  4. The accounts and identities of the people, services and devices in its environment

Answer: D — The accounts and identities of the people, services and devices in its environment

Identities and accounts always stay with the consumer. Physical security, power, cooling and network connectivity move to the provider, since the consumer is not collocated with the datacenter.

26. A company wants to use hardware in a cloud datacenter but decide entirely for itself what runs on it. Which description matches the service model it is choosing?

  1. Using a fully developed application such as email or financial software
  2. Paying for a complete, already deployed solution
  3. Renting the hardware in a cloud datacenter and being free to decide what to do with it
  4. Using a development environment where the provider maintains the operating systems, middleware, and development tools

Answer: C — Renting the hardware in a cloud datacenter and being free to decide what to do with it

This is IaaS, which amounts to renting hardware in a cloud datacenter, with the use of that hardware left to the customer. The other options describe PaaS or SaaS, where the provider manages more of the stack.

27. A software company wants to deploy its own custom application but no longer wants to worry about licensing or patching the operating systems and databases beneath it. Which service type fits?

  1. IaaS with provider-maintained hardware
  2. SaaS
  3. PaaS
  4. IaaS

Answer: C — PaaS

In PaaS the provider maintains the operating systems and middleware, so licensing and patching of operating systems and databases are not the customer's concern, yet the customer still builds its own application. SaaS is wrong because it means renting a fully developed application rather than running your own.

28. A security architect reviews a PaaS deployment and asks who is responsible for networking and application security settings. Which statement is accurate?

  1. Some of them are shared, depending on how the service is configured
  2. The provider handles them because it maintains the operating system
  3. The customer always handles all of them
  4. The provider always handles all of them because it manages the platform

Answer: A — Some of them are shared, depending on how the service is configured

In PaaS, some networking and application security settings are shared depending on service configuration. Neither party owns all of them.

29. A company adopts a SaaS collaboration platform. Which two areas does the company primarily manage itself? (Choose two.)

  1. Data governance
  2. Service availability
  3. Application updates
  4. Infrastructure patching
  5. Device access posture

Answer: A,E — Data governance / Device access posture

With SaaS the customer manages its data, identity and access settings, and device access posture, including data governance. Infrastructure patching, application updates, and availability are handled by the provider.

30. A cloud architect ranks the three service types from the one giving the customer the most control over cloud resources to the one giving the least. Which ranking is correct?

  1. IaaS, SaaS, PaaS
  2. SaaS, PaaS, IaaS
  3. PaaS, IaaS, SaaS
  4. IaaS, PaaS, SaaS

Answer: D — IaaS, PaaS, SaaS

IaaS is the most flexible with maximum control, PaaS is a middle ground, and SaaS may be the least flexible. The other rankings misplace PaaS or reverse the order.

31. An internal application sees large seasonal demand spikes. The organization wants to handle the peaks but avoid paying for unused capacity year-round. Which approach fits?

  1. Move the application to a sovereign region
  2. Scale resources up or out as demand increases, then scale back when demand drops
  3. Provision resources for peak demand and keep them running all year
  4. Create a separate subscription to hold the peak-season capacity

Answer: B — Scale resources up or out as demand increases, then scale back when demand drops

Azure lets you scale resources up or out when demand rises and scale back when it falls, so you aren't paying for unused capacity year-round. Keeping peak capacity running permanently wastes exactly that spend.

32. An administrator needs to deploy a service whose deployment does not require choosing a particular region. Which service fits?

  1. A virtual machine of a size offered only in certain regions
  2. Zone-redundant storage
  3. Azure Traffic Manager
  4. A managed disk

Answer: C — Azure Traffic Manager

Azure Traffic Manager is a global service that doesn't require selecting a region. VM sizes and storage types can be limited to certain regions, and zonal or zone-redundant resources live within a region.

33. An architect evaluates the benefits of using paired regions for a workload. Which two statements are true? (Choose two.)

  1. Planned updates are rolled out to paired regions one region at a time
  2. Planned updates are applied to both regions of a pair at the same time
  3. Every Azure service automatically replicates data to the paired region
  4. Data may reside in any geography regardless of the pairing
  5. In an extensive outage, one region of each pair is prioritized for restoration

Answer: A,E — Planned updates are rolled out to paired regions one region at a time / In an extensive outage, one region of each pair is prioritized for restoration

Pairs prioritize one region for recovery and receive planned updates one at a time to reduce risk. Not all services replicate automatically, updates are not simultaneous, and data stays in the pair's geography.

34. A company needs a sovereign region for compliance or legal reasons. Which two statements about sovereign regions are true? (Choose two.)

  1. China regions are available through a partnership with 21Vianet, and Microsoft doesn't directly maintain those datacenters
  2. They are instances of Azure isolated from the main instance of Azure
  3. Microsoft directly maintains all China region datacenters
  4. US Gov regions are logically isolated but share the physical network of the main Azure instance
  5. US Gov datacenters can be operated by personnel of any nationality

Answer: A,B — China regions are available through a partnership with 21Vianet, and Microsoft doesn't directly maintain those datacenters / They are instances of Azure isolated from the main instance of Azure

Sovereign regions are isolated instances of Azure, and China's are delivered via 21Vianet without Microsoft maintaining the datacenters directly. US Gov regions are both physically and logically network-isolated and are operated by screened U.S. personnel.

35. A central governance team wants to restrict VM locations to US West across 40 subscriptions, and subscription owners must not be able to override the restriction. Where should the policy be applied?

  1. On each resource group, by the resource owners
  2. On each VM at deployment time
  3. On each subscription, by the subscription owners
  4. On a management group containing the subscriptions

Answer: D — On a management group containing the subscriptions

A policy on a management group is inherited by all its subscriptions and cannot be overridden by the resource or subscription owner. Lower-level assignments would be left to owners.

36. A team deleted several virtual machines last week, yet the monthly bill is still higher than expected. They did not deliberately keep anything running. What is the most likely explanation?

  1. The VMs' tags are inherited by the resource group, so charges continue under the group.
  2. The storage and networking resources provisioned alongside the VMs may not have been deprovisioned with them.
  3. The subscription's billing zone changed when the VMs were deleted, raising data-transfer prices.
  4. The pricing calculator provisioned placeholder resources when the original estimate was built.

Answer: B — The storage and networking resources provisioned alongside the VMs may not have been deprovisioned with them.

Provisioning a VM also provisions storage and networking, and those may remain when the VM is deprovisioned, so they keep generating cost. The pricing calculator provisions nothing and charges nothing, so D is wrong.

37. A team plans a new web application and must compare monthly estimates across regions, service tiers, and redundancy options before anything is deployed. They also want to be sure no resources are created and no charges are incurred while modeling. Which tool fits?

  1. The Total Cost of Ownership (TCO) calculator
  2. Cost analysis in Cost Management
  3. The pricing calculator
  4. A budget with a budget alert

Answer: C — The pricing calculator

The pricing calculator estimates costs for resources without provisioning anything or charging for selected services. Cost analysis looks at existing spend, and the TCO calculator has been retired.

38. A team wants nonproduction resources shut down automatically once monthly spend reaches a limit they define, and wants the alert recipients emailed when that threshold is hit. Which approach meets both requirements?

  1. A department spending quota alert
  2. A cost analysis view grouped by resource group
  3. A budget with an alert threshold, configured to trigger automation
  4. A credit alert on the Azure Prepayment balance

Answer: C — A budget with an alert threshold, configured to trigger automation

Budgets let you set a limit with an alert that emails recipients, and they can be configured to trigger automation such as shutting down nonproduction resources. Credit and department quota alerts only notify, and cost analysis only shows data.

39. A company uses an Impact tag to show how important resources are to operations, in order to formulate SLAs. It decides to apply the tag only to mission-critical resources. How should untagged resources be interpreted?

  1. They are non-compliant and must be tagged before deployment.
  2. They are not considered mission-critical.
  3. They inherit the Impact tag from their subscription.
  4. They are treated as high-impact by default.

Answer: B — They are not considered mission-critical.

A specific tag need not be enforced on all resources; if only mission-critical resources carry Impact, untagged ones are not considered mission-critical. Tags are also not inherited from subscriptions.

40. Finance will approve only pricing options that involve a commitment of one or three years. Which two options qualify? (Choose two.)

  1. Azure Spot Virtual Machines
  2. Always-free products in a free trial subscription
  3. Azure savings plan for compute
  4. Pay-as-you-go
  5. Reservations

Answer: C,E — Azure savings plan for compute / Reservations

Reservations commit to specific resources for one or three years, and a savings plan commits to an hourly spend for one or three years. Spot and pay-as-you-go involve no term commitment, and free-trial products are not a commitment option.

41. A data steward wants to keep current on a changing data landscape without cataloguing data by hand. Which two Microsoft Purview capabilities support this? (Choose two.)

  1. Hosting downloadable third-party audit reports
  2. Automated data discovery
  3. End-to-end data lineage
  4. Blocking creation of virtual machines that use disallowed sizes
  5. Preventing accidental deletion of resource groups

Answer: B,C — Automated data discovery / End-to-end data lineage

Microsoft Purview keeps the data landscape current through automated data discovery, sensitive data classification and end-to-end data lineage. Blocking VM sizes is Azure Policy, deletion protection is resource locks, and audit reports are in the Service Trust Portal.

42. An administrator must apply an allowed-locations rule to every resource group in a subscription, including resource groups created later, using as little effort as possible. Where should the policy be assigned?

  1. To the subscription as a Delete lock
  2. To each existing resource group individually
  3. To each individual resource
  4. To the subscription

Answer: D — To the subscription

Azure Policy is inherited, so a policy set at the subscription automatically applies to everything within it. Assigning at lower levels needs repeated work, and a Delete lock only prevents deletion.

43. A security team wants to track compliance against one larger goal. The goal consists of many related rules, such as monitoring unencrypted SQL databases, OS vulnerabilities, and missing endpoint protection. What should they use?

  1. A single policy definition with an exception
  2. A Delete lock on the subscription
  3. An Azure RBAC role assignment
  4. An Azure Policy initiative

Answer: D — An Azure Policy initiative

An initiative groups related policy definitions to track compliance state for a larger goal. A single definition covers one rule only.

44. An administrator wants all resources in a production resource group to be viewable but not updatable or deletable by anyone, including resources added later. The control should be applied once. What should they do?

  1. Assign an Azure Policy initiative to the resource group
  2. Apply a ReadOnly lock to each resource separately
  3. Apply a ReadOnly lock to the resource group
  4. Apply a Delete lock to the resource group

Answer: C — Apply a ReadOnly lock to the resource group

Locks are inherited, so a ReadOnly lock on the resource group applies to all resources within it, and ReadOnly blocks both updates and deletion. A Delete lock still allows modification, and per-resource locks are not a single application.

45. A compliance officer wants quick access to a handful of audit documents and wants to be notified when those documents are updated. What should they do on the Service Trust Portal?

  1. Download the reports once, since they stay available indefinitely
  2. Use the Service Trust Portal home page hyperlink
  3. Rely on the All Documents page to send update notifications
  4. Pin the documents from All Documents to My Library and set up notifications

Answer: D — Pin the documents from All Documents to My Library and set up notifications

Documents pinned to My Library can be accessed quickly, and notifications can be set up for updates. All Documents is just a landing place, and downloads are available only for at least 12 months or until a new version appears.

46. An operations lead wants a web-based graphical console for managing a subscription. It must stay available if a single datacenter fails, avoid network slowdowns for users in different locations, and never go offline for maintenance. Which tool fits?

  1. An ARM template deployed from a build server
  2. Azure PowerShell installed on each administrator's workstation
  3. Azure Arc
  4. The Azure portal

Answer: D — The Azure portal

The Azure portal maintains a presence in every Azure datacenter, so it survives individual datacenter failures, sits close to users, and is updated continuously without downtime. Azure PowerShell is a command-line tool and is not a hosted, always-available graphical console.

47. An engineer is learning Azure PowerShell. Which two statements about it are correct? (Choose two.)

  1. Its cmdlets call the Azure REST API to perform management tasks.
  2. It is available only inside Azure Cloud Shell and cannot be installed locally.
  3. Cmdlets can be captured in a script so a process becomes repeatable and automatable.
  4. It uses Bash syntax for its commands.
  5. Cmdlets can only be run one at a time and cannot be combined.

Answer: A,C — Its cmdlets call the Azure REST API to perform management tasks. / Cmdlets can be captured in a script so a process becomes repeatable and automatable.

Cmdlets call the Azure REST API and can be captured in scripts to make processes repeatable and automatable. It can also be installed on Windows, Linux, and Mac, it uses PowerShell syntax (Bash belongs to the Azure CLI), and cmdlets can be combined for complex actions.

48. A team deploys a web app, a database, and storage as one solution. The resources must be created in the correct order, and the team wants to deploy, manage, and monitor them together rather than one by one. (Choose two.) Which two Azure Resource Manager capabilities address these needs?

  1. Using tags to enforce the order in which resources are deployed
  2. Deploying, managing, and monitoring all the resources for the solution as a group
  3. Defining dependencies between resources so they are deployed in the correct order
  4. Applying RBAC separately to each service because access control is not integrated into the platform
  5. Requiring each resource to be deployed and managed individually

Answer: B,C — Deploying, managing, and monitoring all the resources for the solution as a group / Defining dependencies between resources so they are deployed in the correct order

Resource Manager lets you define dependencies for correct ordering and handle all of a solution's resources as a group. Tags only organize resources and support cost reporting, and RBAC is natively integrated, not separate.

49. A team is choosing between ARM templates and Bicep. Which two statements about Bicep are correct? (Choose two.)

  1. Bicep is harder to read and write than equivalent JSON templates.
  2. Bicep deployments skip Azure Resource Manager and go directly to each service.
  3. Bicep files are idempotent, giving consistent results across lifecycle deployments.
  4. Developers must manually order dependent resources because Bicep bypasses Azure Resource Manager orchestration.
  5. Deployments can be organized into Bicep modules to reuse logic.

Answer: C,E — Bicep files are idempotent, giving consistent results across lifecycle deployments. / Deployments can be organized into Bicep modules to reuse logic.

Bicep files are idempotent and support modules for reuse. Bicep has simpler syntax than JSON and deploys through ARM, which handles dependencies and parallel deployment automatically.

50. A manager oversees several Azure subscriptions and wants to see only the best-practice recommendations tied to one resource group, in a single view. What should they do?

  1. Write a Log Analytics query scoped to the resource group
  2. Filter the Azure Advisor dashboard by resource group
  3. Open the Azure Status page and select the resource group
  4. Check Resource Health for each resource in the group

Answer: B — Filter the Azure Advisor dashboard by resource group

The Advisor dashboard shows recommendations for all subscriptions and can be filtered by subscription, resource group, or service. Azure Status is a global health page and does not list recommendations.

51. An administrator reviews an Azure Advisor recommendation and decides not to implement it right now. Which two actions are available to them instead of acting on it immediately? (Choose two.)

  1. Apply the suggested action right away
  2. Forward the recommendation to the Azure Status page
  3. Dismiss the recommendation
  4. Postpone the recommendation
  5. Convert the recommendation into a metric alert

Answer: C,D — Dismiss the recommendation / Postpone the recommendation

Each recommendation can be acted on right away, postponed, or dismissed; postponing and dismissing are the two that avoid immediate implementation. Applying the action right away is the option the administrator is declining.

52. A company runs workloads in Azure, in its own datacenter, and in another cloud provider. It wants one platform that collects logs and metrics from applications, operating systems, and network layers across all of them. Which service fits?

  1. Azure Monitor
  2. Azure Service Health
  3. Azure Advisor
  4. Resource Health

Answer: A — Azure Monitor

Azure Monitor collects, analyzes, and acts on data from Azure, on-premises, and multicloud environments. Advisor evaluates Azure resources for recommendations and Service Health reports on Azure's own health.

53. An administrator has already built an action group for Azure Monitor alerts and wants the same recipients and responses used for Service Health alerts and Azure Advisor notifications. What is the best approach?

  1. Reuse the existing action group across all three services
  2. Copy the Azure Monitor alert rule into Service Health
  3. Use Log Analytics to forward the notifications
  4. Recreate a separate action group inside each service

Answer: A — Reuse the existing action group across all three services

Action groups are reusable across Azure Monitor, Service Health, and Azure Advisor, so no duplication is needed. Recreating them in each service is unnecessary.

54. An operations team runs a customer-facing website in another cloud provider and wants to track page load times and user counts. Which tool should they use?

  1. Azure Advisor Performance recommendations
  2. Resource Health
  3. Application Insights
  4. Azure Service Health

Answer: C — Application Insights

Application Insights monitors page load times and user counts for web applications running in Azure, on-premises, or another cloud. Azure Advisor evaluates your Azure resources, and its Performance category only identifies changes that can speed up your applications; it does not monitor page load times or user counts.

Take this test interactively

More Microsoft Azure Fundamentals (AZ-900) practice tests