AZ-900 Practice Exam 2

50 questions with the correct answer and an explanation for each. Topic: AZ-900. Free, no account needed.

Take this test interactively

1. A team needs a general-purpose VM with 4 vCPUs on hardware generation 5, and the VM must support Premium SSD managed disks. Which size name matches?

  1. D4s_v5
  2. E4s_v5
  3. D4_v5
  4. D5s_v4

Answer: A — D4s_v5

D is general purpose, 4 is the vCPU count, s means Premium SSD support, and v5 is the hardware generation. D4_v5 lacks the 's', D5s_v4 has the wrong vCPU count and generation, and E4s_v5 is memory optimized rather than general purpose.

2. A company deploys VMs in a region that supports Availability Zones. It wants broader failure isolation than VM-level redundancy provides. Which approach is generally preferred?

  1. An availability set, because it isolates failures more broadly than zones
  2. Azure Virtual Desktop
  3. A single larger VM size
  4. A zone-based design

Answer: D — A zone-based design

Where Availability Zones are supported, zone-based designs are often preferred because they provide broader failure isolation. Availability sets only provide VM-level redundancy.

3. A team wants a PaaS container offering with no container management overhead that also provides built-in load balancing and scaling so the design adapts to changing demand. Which service should they choose?

  1. Azure Container Instances
  2. Virtual machine scale sets
  3. Azure Container Apps
  4. Azure Virtual Machines

Answer: C — Azure Container Apps

Container Apps is PaaS and includes built-in load balancing and scaling. Container Instances is the fastest, simplest way to run a container but isn't described as including built-in load balancing and scaling.

4. A developer needs a function to track prior activity across invocations, rather than behaving as if it restarts every time it responds to an event. Which approach provides this?

  1. The default Azure Functions behavior
  2. An availability set
  3. Durable Functions
  4. Azure Container Instances

Answer: C — Durable Functions

Stateful functions are called Durable Functions, where the runtime passes a context to track prior activity. Default functions are stateless.

5. A team is building an assistant that combines an AI model with instructions, context, and tool use to complete multistep goals. How should this be treated in Azure?

  1. As a type of App Service app
  2. As an application pattern built from Azure AI capabilities and application logic
  3. As a separate compute service category
  4. As a VM size family

Answer: B — As an application pattern built from Azure AI capabilities and application logic

Agentic AI is an application pattern built by combining Azure AI services and Azure OpenAI Service with your own application logic, not a separate compute category.

6. A company wants to lift and shift a legacy application that relies on LDAP and Kerberos/NTLM and cannot use modern authentication. It does not want to deploy or maintain domain controllers in the cloud, and users must keep their existing credentials. Which service fits?

  1. Microsoft Entra Connect
  2. Microsoft Entra External ID
  3. Microsoft Entra Domain Services
  4. Microsoft Entra ID on its own

Answer: C — Microsoft Entra Domain Services

Microsoft Entra Domain Services provides managed domain join, group policy, LDAP and Kerberos/NTLM without you running domain controllers, and it integrates with your existing tenant. Microsoft Entra Connect only synchronizes identities and does not provide those legacy protocols.

7. Warehouse staff share kiosks and need a sign-in method that uses a hardware device, works over USB or NFC, requires no username or password, and cannot be phished. Which method should be used?

  1. FIDO2 security keys
  2. Microsoft Authenticator app notification with number matching
  3. Windows Hello for Business
  4. A password plus a phone call

Answer: A — FIDO2 security keys

FIDO2 security keys are unphishable hardware devices (USB, Bluetooth or NFC) that authenticate without a username or password. Windows Hello for Business ties credentials to a user's own PC rather than a portable device, and the Authenticator app relies on a phone.

8. Each quarter, a company wants the guests themselves or a business decision maker to confirm whether each guest still needs access, with reviewers seeing suggestions from the directory service, and then remove access that is no longer needed. Which capability supports this?

  1. B2B direct connect
  2. An access review in Microsoft Entra ID
  3. A Conditional Access policy requiring MFA for guests
  4. An Azure RBAC Reader role assignment at the subscription scope

Answer: B — An access review in Microsoft Entra ID

Access reviews let guests or decision makers recertify access based on Microsoft Entra ID suggestions, after which access can be removed. Conditional Access governs sign-in decisions, not periodic recertification.

9. An administrator must be able to manage everything in all subscriptions that belong to a management group, using a single role assignment. Where should the Owner role be assigned?

  1. The Reader role at the management group scope
  2. At one resource group in each subscription
  3. At the management group scope
  4. At one subscription in the management group

Answer: C — At the management group scope

Azure RBAC is hierarchical, so Owner assigned at the management group is inherited by all child scopes, including every subscription. Assigning at a single subscription or resource group covers only that scope, and Reader does not allow managing.

10. A company has on-premises servers and workloads running on AWS EC2 instances, and wants to protect both with Microsoft Defender for Cloud. Which two actions apply? (Choose two.)

  1. Move the EC2 instances into an Azure subscription before they can be assessed
  2. Create a Key Vault in each cloud to receive security alerts
  3. Connect the AWS environment so Defender for Servers protections extend to EC2 instances
  4. Deploy Azure Arc and enable Defender for Cloud's enhanced security features on the on-premises machines
  5. Install Microsoft Entra Connect on each on-premises server

Answer: C,D — Connect the AWS environment so Defender for Servers protections extend to EC2 instances / Deploy Azure Arc and enable Defender for Cloud's enhanced security features on the on-premises machines

Azure Arc extends protection to on-premises machines, and connecting AWS extends Defender for Servers to EC2. Defender for Cloud can protect resources in other clouds, so migrating them is unnecessary.

11. An administrator is choosing names for new Azure storage accounts. Which two names meet the naming rules? (Choose two.)

  1. fin-data-01
  2. logs7storage
  3. Backup2024
  4. ab
  5. backup2024

Answer: B,E — logs7storage / backup2024

Names must be 3 to 24 characters and contain only numbers and lowercase letters. Backup2024 has uppercase letters, ab is too short, and fin-data-01 contains hyphens.

12. A team chooses the lowest-cost redundancy option for its storage account. Which of the following events could still cause data loss?

  1. Loss of one replica out of the three copies
  2. Failure of a single drive
  3. Failure of a server rack
  4. A disaster that affects the entire datacenter

Answer: D — A disaster that affects the entire datacenter

LRS protects against rack and drive failures, but all replicas stay in one datacenter, so a datacenter-level disaster can cause data loss.

13. Two components of an application must exchange messages reliably and asynchronously, and each message should trigger a background action through Azure Functions. Messages are no larger than 64 KB. Which Azure Storage service fits?

  1. Azure Disks
  2. Azure Blobs
  3. Azure Tables
  4. Azure Queues

Answer: D — Azure Queues

Queue storage holds large numbers of messages for asynchronous processing, supports messages up to 64 KB, and is commonly paired with Azure Functions. Tables store structured NoSQL data and disks are block volumes for VMs.

14. A company must move tens of terabytes of on-premises data to Azure as a one-time bulk transfer. Its network bandwidth is limited, so it wants a shipped device whose data is uploaded automatically once Microsoft receives it. Which service should it use?

  1. Azure Migrate
  2. AzCopy
  3. Azure Data Box
  4. Azure File Sync

Answer: C — Azure Data Box

Data Box is a physical device ideal for very large data sets when bandwidth is limited, and import data is uploaded automatically after the device is returned. AzCopy transfers over the network, which is the constraint here.

15. A help desk team using Linux and macOS workstations wants a graphical application, rather than command-line tools, to move blobs between storage accounts. Which tool fits?

  1. Azure Storage Explorer
  2. AzCopy
  3. Azure File Sync
  4. Azure Migrate

Answer: A — Azure Storage Explorer

Storage Explorer is a standalone graphical app that runs on Windows, macOS, and Linux and can move blobs and files between storage accounts. AzCopy is a command-line utility.

16. A team's single virtual machine turns out to be over-specified for its workload. They want to cut costs without changing how many machines they run. What should they do?

  1. Scale up vertically by adding CPU or RAM
  2. Scale in horizontally by removing machines
  3. Scale out horizontally by adding machines
  4. Scale down vertically by lowering the CPU or RAM specification

Answer: D — Scale down vertically by lowering the CPU or RAM specification

Vertical scaling changes the capability of a resource, so lowering CPU or RAM is a vertical scale down. Scaling in changes the number of resources, which the team wants to keep the same.

17. A team already runs workloads in the cloud and wants to forecast future cloud spend so it can adjust resources as needed. Which two practices support this? (Choose two.)

  1. Tracking resource use in real time
  2. Choosing infrastructure as a service for maximum control of the operating system
  3. Deploying resources from a preconfigured template
  4. Vertically scaling every virtual machine up in advance
  5. Applying data analytics to find patterns and trends in usage

Answer: A,E — Tracking resource use in real time / Applying data analytics to find patterns and trends in usage

Cost predictability comes from tracking use in real time and applying analytics to spot patterns and trends. Templates remove manual configuration and IaaS gives control over the OS, but neither forecasts spend.

18. An operations team wants failing resources to be replaced without manual effort and wants to be told about performance in real time. Which two capabilities provide this? (Choose two.)

  1. Managing the environment through a command line interface
  2. Automatic alerts based on configured metrics
  3. Managing the environment through a web portal
  4. Monitoring the health of resources and automatically replacing failing ones
  5. Managing the environment using PowerShell

Answer: B,D — Automatic alerts based on configured metrics / Monitoring the health of resources and automatically replacing failing ones

Automatic replacement of failing resources and metric-based alerts are management of the cloud capabilities. The CLI, PowerShell and web portal are ways of managing in the cloud and do not by themselves replace resources or raise alerts.

19. After a seasonal peak ends, a company reduces its deployed resources and sees its cloud bill fall accordingly. Which characteristic of the cloud explains the lower bill?

  1. It is a consumption-based model, so you pay only for what you use
  2. Cloud-based auditing lowers the price of compliant resources
  3. Its decentralized design moves workloads to cheaper regions automatically
  4. Service-level agreements guarantee lower prices off-peak

Answer: A — It is a consumption-based model, so you pay only for what you use

Because the cloud is consumption-based, reducing resources when demand drops reduces cost. SLAs concern uptime guarantees, not pricing.

20. Demand for an application has dropped significantly. The team runs many virtual machines and containers and wants to reduce how many are deployed, either automatically or manually. Which action describes this?

  1. Scaling in horizontally
  2. Scaling down vertically
  3. Scaling up vertically
  4. Scaling out horizontally

Answer: A — Scaling in horizontally

Reducing the number of deployed resources after a drop in demand is scaling in, a horizontal action. Scaling down vertically would lower the specification of a resource instead of removing resources.

21. A team runs an SQL database that it installed on a virtual machine it deployed. It moves to an SQL database managed by the cloud provider. Which responsibility passes to the provider, while the team remains responsible for the data ingested?

  1. Maintaining the actual database
  2. Governing which accounts and identities may access the data
  3. Protecting the information stored in the database
  4. Controlling which devices are allowed to connect

Answer: A — Maintaining the actual database

With a cloud SQL database the provider maintains the database itself, while the consumer keeps responsibility for the data. Data, identities and connecting devices always stay with the consumer.

22. A company adopts a SaaS application. Which description of identity and access responsibility is correct?

  1. The company manages its own users, roles and policies, while the provider runs the authentication platform, such as Microsoft Entra ID
  2. The company is fully responsible for both the users and the authentication platform
  3. The provider handles all identity and access, so the company has no identity duties
  4. The provider manages the company's users, roles and policies, and the company runs the authentication platform

Answer: A — The company manages its own users, roles and policies, while the provider runs the authentication platform, such as Microsoft Entra ID

In PaaS and SaaS, identity and access is shared: the customer manages users, roles and policies, and the provider runs the authentication platform.

23. A finance team is classifying cost items against traditional IT budgeting categories. Which two items are capital expenditures? (Choose two.)

  1. A charge for compute capacity rented only while it is needed
  2. Up-front purchase of servers
  3. Up-front purchase of network hardware
  4. Cloud services paid for as they are consumed
  5. Ongoing spending on services over time

Answer: B,C — Up-front purchase of servers / Up-front purchase of network hardware

CapEx is up-front spending on physical infrastructure such as servers and network hardware. Ongoing and consumption-based spending is OpEx.

24. A datacenter team forecasts resource needs in advance using only on-premises hardware. Which two outcomes can result from forecasting errors? (Choose two.)

  1. Overestimating leads to degraded application performance
  2. Underestimating leads to degraded application performance
  3. Overestimating leads to overspending on infrastructure that sits idle
  4. Underestimating is resolved instantly because capacity is added with no hardware ordering
  5. Overestimating costs nothing because idle capacity is not billed

Answer: B,C — Underestimating leads to degraded application performance / Overestimating leads to overspending on infrastructure that sits idle

In a traditional datacenter, overestimating means idle, overpaid infrastructure and underestimating degrades performance. Fixing it requires ordering, installing and provisioning hardware, power and cooling.

25. A company runs its workloads on IaaS virtual machines. Which two tasks remain the company's responsibility rather than the cloud provider's? (Choose two.)

  1. Physical security of the datacenter
  2. Database and storage configuration
  3. Providing network connectivity to the internet
  4. Maintaining the physical hardware
  5. Operating system installation, configuration, and maintenance

Answer: B,E — Database and storage configuration / Operating system installation, configuration, and maintenance

In IaaS the customer handles the operating system and the database and storage configuration. The provider keeps the hardware, internet connectivity, and physical security.

26. In a PaaS solution, which two items are maintained by the cloud provider in addition to the physical infrastructure? (Choose two.)

  1. Identity and access settings
  2. Application code
  3. Development tools
  4. Analytics services
  5. Customer data

Answer: C,D — Development tools / Analytics services

The PaaS provider maintains development tools and analytics services as part of the cloud solution. Application code, data, and access controls are what the customer focuses on.

27. A team is documenting who does what for a web application hosted on PaaS. Which division of responsibility is correct?

  1. Provider: infrastructure, platform, and the application. Customer: data and device access posture.
  2. Provider: application code and data. Customer: operating systems and middleware.
  3. Provider: only the physical infrastructure. Customer: everything above it.
  4. Provider: operating systems, middleware, and managed runtimes. Customer: application code, data, and access controls.

Answer: D — Provider: operating systems, middleware, and managed runtimes. Customer: application code, data, and access controls.

In PaaS the provider manages the platform components and the customer focuses on code, data, and access controls. Option C describes IaaS and option D describes SaaS.

28. A team uses a SaaS collaboration platform and wants to concentrate its own effort on user onboarding and access controls. Which of its needs will the provider cover?

  1. Setting up and removing user accounts
  2. Governing how organizational data is used
  3. Applying application updates and keeping the service available
  4. Configuring who can access which resources

Answer: C — Applying application updates and keeping the service available

In SaaS the provider handles infrastructure patching, application updates, and availability. Onboarding, access controls, and data governance stay with the customer.

29. An organization is deciding where to host three workloads: (1) company-wide email, (2) a migrated datacenter application that needs custom operating system settings, and (3) a new internal application whose developers do not want to manage operating systems. Which assignment of service types, in that order, is best?

  1. IaaS, SaaS, PaaS
  2. SaaS, IaaS, PaaS
  3. SaaS, PaaS, IaaS
  4. PaaS, IaaS, SaaS

Answer: B — SaaS, IaaS, PaaS

Email is a SaaS scenario, a migrated application needing OS control suits IaaS, and a custom application without OS maintenance suits PaaS. The other orders put a workload on a model that either removes needed control or leaves unwanted maintenance.

30. A company wants to buy Azure access bundled with a complete managed-cloud solution, rather than operating everything itself. Which purchasing route fits?

  1. Sign up directly on the Azure website
  2. Purchase through a Cloud Solution Provider partner
  3. Start with an Azure free account and upgrade it
  4. Purchase through a Microsoft representative

Answer: B — Purchase through a Cloud Solution Provider partner

The document lists three ways to buy Azure: directly on the Azure website, through a Microsoft representative, or through a Microsoft partner. Of these, only Cloud Solution Provider partners are described as offering a range of complete managed-cloud solutions for Azure.

31. A company spreads its VMs and storage across availability zones in a single region. Which two statements are true? (Choose two.)

  1. Duplicating services and transferring data between zones can add cost
  2. All zones in a region share the same power, cooling, and networking
  3. Every Azure region supports availability zones
  4. If one zone goes down, the other zones continue working
  5. Each availability zone is located in a different region

Answer: A,D — Duplicating services and transferring data between zones can add cost / If one zone goes down, the other zones continue working

A zone is an isolation boundary, so other zones keep working, and replicating across zones can incur duplication and transfer costs. Zones have independent power, cooling, and networking, sit within one region, and not all regions support them.

32. An architect designs a failover plan around the pairing of Brazil South and South Central US. Which statement is correct?

  1. Brazil South has no pair and relies on availability zones and geo-redundant storage
  2. Brazil South's secondary region is South Central US, but South Central US's secondary region is not Brazil South
  3. Both regions belong to the same geography
  4. The two regions back each other up in both directions

Answer: B — Brazil South's secondary region is South Central US, but South Central US's secondary region is not Brazil South

Brazil South is paired in one direction only, with a region outside its geography. Option D describes regions such as Italy North that have no traditional pair.

33. A team sets up a temporary dev environment that should be removable in one step, and wants other teams to see only their own resources. Which design is supported?

  1. Rename the resource group after the project changes
  2. Put the dev resources in their own resource group and delete the group when finished
  3. Place a VM in two resource groups at once so both teams can manage it
  4. Nest the dev resource group inside a team resource group

Answer: B — Put the dev resources in their own resource group and delete the group when finished

Deleting a resource group deletes everything in it, and a separate group per project limits what each team sees. A resource belongs to exactly one group, and groups can't be nested or renamed.

34. An administrator manages permissions across many subscriptions. Which two statements about management groups are true? (Choose two.)

  1. One Azure RBAC assignment on a management group is inherited by its sub-management groups, subscriptions, resource groups, and resources
  2. A directory supports no more than 100 management groups
  3. Management group nesting is unlimited in depth
  4. Role assignments must be scripted separately for each subscription under a management group
  5. Every Microsoft Entra tenant has a single top-level Tenant Root Group that all other management groups and subscriptions fold up to

Answer: A,E — One Azure RBAC assignment on a management group is inherited by its sub-management groups, subscriptions, resource groups, and resources / Every Microsoft Entra tenant has a single top-level Tenant Root Group that all other management groups and subscriptions fold up to

RBAC assignments on a management group are inherited downward, and the Tenant Root Group sits at the top of every tenant. A directory supports up to 10,000 management groups, nesting is limited to six levels, and no per-subscription scripting is needed.

35. A company copies large volumes of data out of an Azure region in Europe to a region in South America, and wants to understand why this costs more than copying the same volume between two European regions. Which concept determines outbound data-transfer pricing here?

  1. The billing zone, a geographical grouping of regions used for data-transfer pricing
  2. The availability zone in which the source resources are deployed
  3. The resource group that contains the source resources
  4. The volume of inbound data, since all inbound transfers are billed

Answer: A — The billing zone, a geographical grouping of regions used for data-transfer pricing

Outbound data-transfer pricing is based on billing zones, which group regions geographically for data-transfer pricing and are different from availability zones. Inbound transfers are partly free, so C is wrong.

36. A finance manager wants to see where costs accrue across the organization and whether monthly spending is trending above budget. Which two tasks can be done with cost analysis? (Choose two.)

  1. View aggregated costs by subscription, resource group, or service.
  2. Estimate the cost of resources that have not yet been provisioned.
  3. Automatically reapply tags that were removed from resources.
  4. Require that all new resources are tagged with an owner.
  5. View accumulated costs over time to estimate monthly, quarterly, or yearly trends against a budget.

Answer: A,E — View aggregated costs by subscription, resource group, or service. / View accumulated costs over time to estimate monthly, quarterly, or yearly trends against a budget.

Cost analysis aggregates existing costs by subscription, resource group, or service and shows accumulated costs over time against a budget. Estimating unprovisioned costs is the pricing calculator's role, and tag enforcement and reapplication are Azure Policy's.

37. A platform team needs a budget defined by consumption usage rather than by monetary cost. How can they create it?

  1. By using cost analysis to save a usage-based view as a budget
  2. In the Azure portal, which defines budgets by either cost or usage
  3. By configuring a credit alert at 90% of usage
  4. Through the Azure Consumption API

Answer: D — Through the Azure Consumption API

Budgets in the portal are defined by cost; only the Azure Consumption API also allows defining budgets by consumption usage.

38. A production SQL workload runs 24/7 and its resource needs are stable and predictable for years. The company wants a discount in exchange for a one- or three-year commitment to specific resource capacity. Which option fits best?

  1. Azure savings plan for compute
  2. Reservations
  3. Pay-as-you-go
  4. Spot pricing

Answer: B — Reservations

Reservations suit stable, long-running workloads with predictable needs and commit to specific resource capacity. The savings plan commits to hourly spend for flexibility, and Spot is for interruptible workloads.

39. A team wants to protect sensitive data across clouds, apps, and devices and manage regulatory compliance requirements. They want to use Microsoft 365 services such as Teams, OneDrive, and Exchange as the core of the solution. Which Microsoft Purview solution area fits?

  1. Azure Policy initiatives
  2. Service Trust Portal
  3. Unified data governance
  4. Risk and compliance

Answer: D — Risk and compliance

Microsoft 365 is a core component of the Purview risk and compliance solutions, which protect sensitive data and help manage regulatory compliance. Unified data governance focuses on mapping and managing the data estate.

40. A policy allowing only certain VM sizes is created after many VMs already exist, and some of them use other sizes. Without anyone resizing a VM, what does Azure Policy do with the existing VMs?

  1. Applies only to VMs created after the policy
  2. Automatically deletes the noncompliant VMs
  3. Ignores them until each one is resized
  4. Evaluates and monitors them and highlights those that are not compliant

Answer: D — Evaluates and monitors them and highlights those that are not compliant

Azure Policy also evaluates and monitors current VMs, including those created before the policy, and highlights noncompliant ones. It is not limited to creation and resize events.

41. A team uses Azure DevOps continuous integration and delivery pipelines. They want the same compliance rules that govern their Azure resources to apply during both the pre-deployment and post-deployment phases. Which service integrates with the pipelines for this?

  1. Azure Policy
  2. Service Trust Portal
  3. Resource locks
  4. Microsoft Purview

Answer: A — Azure Policy

Azure Policy integrates with Azure DevOps and applies pipeline policies in the pre-deployment and post-deployment phases.

42. The owner of a resource protected by a Delete lock needs to delete it. Which two actions allow this? (Choose two.)

  1. Change the lock type to ReadOnly
  2. Delete it directly, because owners bypass locks
  3. Remove the lock first
  4. After the lock is removed, perform the deletion with permissions they already hold
  5. Assign themselves an additional RBAC role

Answer: C,D — Remove the lock first / After the lock is removed, perform the deletion with permissions they already hold

Modifying a locked resource is a two-step process: remove the lock, then perform any action you have permissions for. Locks apply regardless of RBAC permissions, so ownership or extra roles do not bypass them, and ReadOnly also blocks deletion.

43. A contractor uses a locked-down laptop on which no software can be installed. They need to run Azure CLI commands immediately, already signed in with their own Azure identity and permissions. What should they use?

  1. A locally installed Azure CLI configured with their credentials
  2. A Bicep file deployed from a local editor
  3. Azure Cloud Shell opened from the browser
  4. A locally installed Azure PowerShell module

Answer: C — Azure Cloud Shell opened from the browser

Azure Cloud Shell is browser-based, needs no local installation or configuration, and is authenticated to the user's Azure credentials. A local Azure CLI install would require installing software, which is not possible here.

44. A company runs servers on-premises and virtual machines and Kubernetes clusters in another public cloud. It wants to apply Azure governance to all of them as if they ran in Azure, by projecting them into Azure Resource Manager, while operations staff keep using traditional ITOps. Which service meets this need?

  1. Bicep
  2. Azure Cloud Shell
  3. Azure Arc
  4. Azure Resource Manager templates

Answer: C — Azure Arc

Azure Arc projects existing non-Azure resources into Azure Resource Manager and extends Azure compliance and monitoring to hybrid and multicloud environments. Bicep and ARM templates define deployments of Azure resources rather than bringing external resources under Azure management.

45. A finance team needs to report cost by department across the resources in a subscription. Which Azure Resource Manager capability supports this?

  1. Role-based access control assignments
  2. Defining dependencies between resources
  3. Custom locations on Arc-enabled Kubernetes clusters
  4. Applying tags to resources

Answer: D — Applying tags to resources

Tags applied to resources organize a subscription and support cost reporting. RBAC controls access, not cost grouping, and dependencies only control deployment order.

46. An administrator asks Copilot in Azure to draft a deployment command for a production environment. What is the appropriate next step?

  1. Validate the recommendation, confirm permissions, and review the deployment changes before applying them
  2. Check the command's syntax and apply it; permission checks are unnecessary because Copilot's guidance is already contextual to the environment
  3. Apply it directly, because agent-like Copilot workflows coordinate multi-step tasks on the administrator's behalf
  4. Apply it to production first and review the deployment changes afterward if problems appear

Answer: A — Validate the recommendation, confirm permissions, and review the deployment changes before applying them

Copilot should be treated as an operational assistant: recommendations must be validated, permissions confirmed, and changes reviewed before production use. Humans remain responsible for validation and approval.

47. A cloud team wants to be told proactively when new best-practice recommendations appear for their resources, without having to open the portal to check for them. What should they configure?

  1. An Application Insights availability test
  2. A Service Health alert for planned maintenance
  3. Notifications in Azure Advisor
  4. A Resource Health check on each virtual machine

Answer: C — Notifications in Azure Advisor

Advisor can be set up to send notifications when new recommendations appear. Service Health alerts cover outages, maintenance, and advisories, not Advisor recommendations.

48. News reports describe a widespread outage affecting a major cloud provider. An administrator wants a global picture of Azure health across all services and regions to see whether Azure is affected. Which should they check?

  1. Azure Status
  2. Resource Health
  3. Service Health
  4. Azure Advisor

Answer: A — Azure Status

Azure Status gives the global view across all services and regions. Service Health is narrowed to the services and regions the signed-in customer actually uses.

49. An analyst needs to explore the data Azure Monitor has collected on an ad hoc basis. Which two tasks can they perform in Log Analytics? (Choose two.)

  1. Send synthetic requests to an application to confirm it is responding
  2. Run advanced analytics to visualize trends over time
  3. Determine whether a resource problem is on Azure's side or the customer's
  4. Filter data to find all errors in the last hour
  5. Define an action group that controls who gets notified

Answer: B,D — Run advanced analytics to visualize trends over time / Filter data to find all errors in the last hour

Log Analytics is where queries are run, from simple filtering to advanced trend analytics. Synthetic requests belong to availability tests, action groups to alerts, and the Azure-versus-customer determination to Resource Health.

50. A company's web application runs on-premises and its source code cannot be modified. The team still wants to monitor request rates and response times. How can they enable Application Insights?

  1. Use Azure Advisor performance recommendations in place of instrumentation
  2. Add the Application Insights SDK to the application code
  3. Enable the Application Insights agent without code changes
  4. Move the application to Azure first, since on-premises apps are unsupported

Answer: C — Enable the Application Insights agent without code changes

Application Insights can be enabled through its agent without code changes and supports applications running on-premises. The SDK approach requires altering the application code.

Take this test interactively

More Microsoft Azure Fundamentals (AZ-900) practice tests