AZ-900 Practice Exam 3

48 questions with the correct answer and an explanation for each. Topic: AZ-900. Free, no account needed.

Take this test interactively

1. A data team runs in-memory analytics workloads and wants a VM family designed for that kind of workload. Which family should they start with?

  1. E-series
  2. B-series
  3. F-series
  4. L-series

Answer: A — E-series

E-series is memory optimized and listed for in-memory databases and analytics. F-series targets CPU-intensive tiers, L-series targets storage throughput, and B-series is for burstable dev/test.

2. A company wants to give contractors and hybrid workers standardized cloud-hosted Windows desktops. Which two statements about Azure Virtual Desktop are true? (Choose two.)

  1. Desktops must be hosted on on-premises hardware.
  2. It integrates with Microsoft Entra ID for identity and access controls.
  3. It can only be accessed from devices on the corporate network.
  4. It supports both single-session and multi-session Windows experiences.
  5. Apps and data must be stored on each user's local device.

Answer: B,D — It integrates with Microsoft Entra ID for identity and access controls. / It supports both single-session and multi-session Windows experiences.

Azure Virtual Desktop integrates with Microsoft Entra ID and supports single-session and multi-session Windows. Desktops and apps stay in the cloud rather than on local devices, and users can connect from many device types and locations.

3. A website is split into containers for the front end, the back end, and storage. The back end reaches capacity while the other two are not stressed. What is the best way to improve performance?

  1. Scale all three containers together
  2. Merge the three components into one container
  3. Scale only the back-end container
  4. Replace the storage container, since all components must change together

Answer: C — Scale only the back-end container

A microservice split lets you maintain, scale, or update each part independently, so only the stressed back end needs scaling.

4. A team already hosts a web app in App Service and wants to run a PowerShell script on a schedule in the same context as that app, as a background task. Which feature fits?

  1. API apps
  2. Mobile apps
  3. Azure Virtual Desktop
  4. WebJobs

Answer: D — WebJobs

WebJobs run programs or scripts (including PowerShell) in the same context as a web, API, or mobile app, on a schedule or trigger. API apps are for REST APIs and Mobile apps for mobile back ends.

5. An IoT solution needs secure two-way communication between cloud services and devices, and must also run some workloads close to where data is generated. Which two services address these needs? (Choose two.)

  1. Azure OpenAI Service
  2. Azure Machine Learning
  3. Azure IoT Edge
  4. Azure IoT Hub
  5. Azure AI services

Answer: C,D — Azure IoT Edge / Azure IoT Hub

IoT Hub enables secure, bi-directional communication between cloud services and IoT devices, and IoT Edge extends cloud capabilities to edge devices so workloads run closer to where data is generated. Azure OpenAI Service targets generative AI such as chat and content generation, Azure Machine Learning is for custom model development, and Azure AI services provides prebuilt AI features through APIs.

6. An administrator is planning a Microsoft Entra Domain Services managed domain for a hybrid environment that also has an on-premises AD DS. Which two statements about the design are correct? (Choose two.)

  1. Resources created directly in the managed domain are synchronized back to Microsoft Entra ID
  2. Microsoft Entra Connect synchronizes on-premises identities directly into the managed domain, bypassing Microsoft Entra ID
  3. The administrator must patch and back up the domain controllers
  4. Identity information flows one way, from Microsoft Entra ID to the managed domain
  5. Two Windows Server domain controllers are deployed as a replica set in the selected Azure region

Answer: D,E — Identity information flows one way, from Microsoft Entra ID to the managed domain / Two Windows Server domain controllers are deployed as a replica set in the selected Azure region

The managed domain performs a one-way sync from Microsoft Entra ID, and creating a managed domain deploys two domain controllers as a replica set. Resources created in the managed domain are not synced back, the platform handles the DCs including backups, and Entra Connect syncs to Microsoft Entra ID first.

7. Information workers each have their own designated Windows PC. The company wants passwordless sign-in where biometric or PIN credentials are bound to that PC, with PKI integration and built-in SSO to on-premises and cloud resources. Which option fits best?

  1. Microsoft Authenticator app
  2. FIDO2 security keys
  3. Windows Hello for Business
  4. Microsoft Entra multifactor authentication with a phone call

Answer: C — Windows Hello for Business

Windows Hello for Business ties biometric and PIN credentials directly to the user's PC and offers PKI integration and built-in SSO. The Authenticator app is phone-based and FIDO2 keys are separate hardware, so neither matches the PC-bound requirement.

8. A company wants users at a known location to sign in without a second-factor prompt, while sign-ins with unusual signals or from unexpected locations are challenged or blocked. It also wants to allow access only from managed devices that meet its security standards. Which feature provides this?

  1. Single sign-on
  2. Microsoft Entra Conditional Access
  3. Passwordless sign-in with FIDO2 keys
  4. Azure RBAC

Answer: B — Microsoft Entra Conditional Access

Conditional Access evaluates signals such as user, location and device, then allows, blocks or challenges for MFA, and it can require managed devices. RBAC controls resource permissions, not sign-in decisions.

9. An engineering team wants administrators to receive elevated access only when needed and only to the extent needed, using Just-In-Time and Just-Enough-Access. Which Zero Trust principle does this represent?

  1. Verify explicitly
  2. Use least privilege access
  3. Assume breach
  4. Trust the internal network

Answer: B — Use least privilege access

Limiting access with JIT/JEA, risk-based adaptive policies and data protection is the least privilege access principle. Verify explicitly concerns authenticating and authorizing on all available data points.

10. A development team keeps database connection strings in application configuration files. The company wants to centralize secret management, audit secret usage, and stop hard-coding credentials by having apps obtain secrets at runtime. What should it do?

  1. Use the Defender for Cloud secure score to store the secrets
  2. Keep the secrets in the configuration files and rely on encryption in transit
  3. Assign the Azure RBAC Reader role to the application at the subscription scope
  4. Store the secrets in Azure Key Vault and have the apps retrieve them at runtime by using managed identities

Answer: D — Store the secrets in Azure Key Vault and have the apps retrieve them at runtime by using managed identities

Key Vault centralizes secrets, keys and certificates, supports auditing, and with managed identities removes hard-coded credentials. Encryption in transit protects data in motion but leaves the secrets in configuration files.

11. A developer has created a storage account named contosodata and needs the endpoint to use for Data Lake Storage Gen2 operations. Which endpoint is correct?

  1. https://contosodata.file.core.windows.net
  2. https://contosodata.dfs.core.windows.net
  3. https://contosodata.table.core.windows.net
  4. https://contosodata.blob.core.windows.net

Answer: B — https://contosodata.dfs.core.windows.net

Data Lake Storage Gen2 uses the dfs endpoint. The blob endpoint is for Blob Storage, file for Azure Files, and table for Table Storage.

12. A storage account is configured for geo-zone-redundant storage. Which two statements about how its data is replicated are correct? (Choose two.)

  1. Data is copied across three availability zones in the primary region.
  2. Data is replicated to the paired secondary region using LRS.
  3. Data in the secondary region is readable by default.
  4. Data is replicated to the secondary region synchronously.
  5. Data in the secondary region is stored using ZRS.

Answer: A,B — Data is copied across three availability zones in the primary region. / Data is replicated to the paired secondary region using LRS.

GZRS uses ZRS in the primary region and LRS in the paired secondary region. Secondary data is not readable by default, and replication to it is asynchronous.

13. A team has Windows, Linux, and macOS machines that all need to mount the same Azure file shares. Which two statements about accessing Azure file shares are correct? (Choose two.)

  1. NFS Azure file shares are accessible from Windows clients.
  2. SMB Azure file shares are accessible from Windows, Linux, and macOS clients.
  3. SMB Azure file shares can't be cached on Windows Servers.
  4. The administrator must patch the operating system of the servers hosting the shares.
  5. NFS Azure file shares are accessible from Linux or macOS clients.

Answer: B,E — SMB Azure file shares are accessible from Windows, Linux, and macOS clients. / NFS Azure file shares are accessible from Linux or macOS clients.

SMB shares work from all three operating systems, while NFS shares work from Linux or macOS. Azure Files is fully managed, so no OS patching is needed, and SMB shares can be cached with Azure File Sync.

14. An organization is evaluating Azure Data Box for a data transfer project. Which two statements about the service are correct? (Choose two.)

  1. After returning the device, the customer must upload the data with AzCopy.
  2. The device has a maximum usable storage capacity of 80 terabytes.
  3. The device is only usable for importing data into Azure.
  4. The device can be ordered through the Azure portal to import data to or export data from Azure.
  5. For an import order, the disks are erased as soon as the device leaves the customer's datacenter.

Answer: B,D — The device has a maximum usable storage capacity of 80 terabytes. / The device can be ordered through the Azure portal to import data to or export data from Azure.

Data Box has a maximum usable capacity of 80 TB and can be ordered via the Azure portal for import or export. Imported data is uploaded automatically, and disks are wiped only after the upload.

15. A company runs file servers on Windows Server in several offices and wants the files centralized in Azure Files while keeping local access. Which two capabilities of Azure File Sync help meet this? (Choose two.)

  1. One-directional copying from the server to Azure, like an AzCopy sync
  2. Support for only one cache across the whole organization
  3. Replacing a failed local server by installing Azure File Sync on a new server in the same datacenter
  4. Cloud tiering that keeps frequently accessed files local and infrequently accessed files in the cloud until requested
  5. Local access limited to the SMB protocol

Answer: C,D — Replacing a failed local server by installing Azure File Sync on a new server in the same datacenter / Cloud tiering that keeps frequently accessed files local and infrequently accessed files in the cloud until requested

File Sync supports cloud tiering and lets you replace a failed server by installing it on a new one. It syncs bi-directionally, supports SMB, NFS, and FTPS locally, and allows as many caches as needed.

16. A website's demand suddenly jumps steeply. The team wants to respond by changing the number of deployed resources rather than the specification of any single resource. (Choose two.)

  1. Lower the CPU specification of an existing virtual machine
  2. Add additional virtual machines
  3. Add more CPUs to an existing virtual machine
  4. Increase the RAM of an existing virtual machine
  5. Add additional containers

Answer: B,E — Add additional virtual machines / Add additional containers

Horizontal scaling out means adding more resources such as virtual machines or containers. Adding CPU or RAM, or lowering CPU, changes the capability of a single resource, which is vertical scaling.

17. A company wants operating system patches and maintenance to be handled automatically rather than by its own staff. Which two deployment models fit? (Choose two.)

  1. Platform as a service
  2. Any deployment where the company manages the operating systems on provider-supplied physical resources
  3. Software as a service
  4. Infrastructure as a service
  5. Any deployment where the company installs and maintains its own software

Answer: A,C — Platform as a service / Software as a service

PaaS and SaaS deployments take care of patches and maintenance automatically. With IaaS, the customer manages the operating systems and installed software, including patches and maintenance.

18. An operations team deploys resources from templates, monitors health in a web portal, and automates recurring tasks with CLI or PowerShell scripts. What is the main benefit of this combination?

  1. It flags resources that are out of compliance and provides mitigation strategies
  2. It reduces manual effort and helps maintain consistent configurations
  3. It converts infrastructure as a service into software as a service
  4. It improves resource utilization through the provider's large-scale operation

Answer: B — It reduces manual effort and helps maintain consistent configurations

Templates, portal monitoring and CLI or PowerShell scripting together reduce manual effort and help keep configurations consistent. Improved utilization comes from providers operating at large scale, flagging non-compliant resources with mitigation strategies is the role of cloud-based auditing, and the combination does not change the service model.

19. A company fears distributed denial of service attacks against its network and is weighing a move to the cloud. Which statement about security and governance in the cloud is accurate?

  1. Cloud providers are typically well suited to handle DDoS attacks, making the network more robust
  2. Software patches and updates can never be applied automatically
  3. Governance is best established only after the cloud footprint has grown
  4. Platform as a service gives maximum control over the operating system and its patches

Answer: A — Cloud providers are typically well suited to handle DDoS attacks, making the network more robust

Providers are typically well suited to handle DDoS attacks. Maximum OS control comes from IaaS, patches may be applied automatically, and governance should be established early.

20. A company moves all of its workloads to a cloud provider and wants to know which duties stay with it no matter which service type it chooses. Which two always remain the customer's responsibility? (Choose two.)

  1. Devices that are allowed to connect to the cloud environment
  2. The information and data stored in the cloud
  3. The physical network
  4. The physical hosts
  5. The physical datacenter

Answer: A,B — Devices that are allowed to connect to the cloud environment / The information and data stored in the cloud

Data and connecting devices always stay with the consumer. The physical datacenter, network and hosts are always the provider's.

21. An organization requires cloud resources dedicated to a single entity, but it does not want to host them in its own on-site datacenter. Which statement is correct?

  1. It cannot be a private cloud, because dedicated single-entity resources must be on-site
  2. It must use a hybrid cloud, because offsite hosting always involves a public cloud
  3. It can still be a private cloud, hosted in a dedicated offsite datacenter, potentially by a third party
  4. It must use a public cloud, because only public clouds can be hosted offsite

Answer: C — It can still be a private cloud, hosted in a dedicated offsite datacenter, potentially by a third party

A private cloud is used by a single entity and can be hosted on-site or in a dedicated offsite datacenter, even by a third party.

22. A company's workloads run in two different public cloud providers while it migrates from one to the other. Which description fits, and what must the company manage?

  1. Hybrid cloud, managing a public and a private environment
  2. Public cloud, managing resources and security only at the new provider
  3. Multicloud, managing resources and security in both provider environments
  4. Private cloud, managing hardware at both providers

Answer: C — Multicloud, managing resources and security in both provider environments

Using two or more public cloud providers is multicloud, and the customer manages resources and security in each. Hybrid requires a private cloud.

23. A company moves to a consumption-based cloud model. Which two benefits does it gain? (Choose two.)

  1. No upfront costs for hardware or datacenter infrastructure
  2. The need to purchase and manage capacity that may go underutilized
  3. The need to estimate future resource needs far in advance
  4. Responsibility for power and cooling of the underlying infrastructure
  5. The ability to release resources when demand decreases

Answer: A,E — No upfront costs for hardware or datacenter infrastructure / The ability to release resources when demand decreases

Consumption-based pricing removes upfront hardware costs and lets you release resources when demand falls. Managing underutilized capacity and estimating needs in advance are traditional-datacenter burdens, and the provider handles power and cooling.

24. A company wants to leave its on-premises datacenter by recreating a similar setup in the cloud and moving its existing workloads onto it. Its administrators must keep control of the operating system and network configuration. Which service type fits?

  1. IaaS
  2. SaaS
  3. PaaS, so the provider maintains the operating systems during and after the migration
  4. PaaS

Answer: A — IaaS

Lift-and-shift migration is a classic IaaS scenario, and IaaS leaves OS and network configuration with the customer. In PaaS the provider maintains the operating systems, so that control is not available.

25. A startup wants its developers to have a complete development environment for building its own applications, without the burden of maintaining all the underlying development infrastructure. Which approach is best suited?

  1. Using PaaS
  2. Building a new on-premises datacenter
  3. Adopting a ready-made productivity application
  4. Renting virtual machines and installing every development tool itself

Answer: A — Using PaaS

PaaS is well suited to providing a complete development environment without the headache of maintaining the development infrastructure. Renting VMs (IaaS) would leave that maintenance with the startup.

26. A planning team wants tools that let it analyze and mine its data, find patterns, and predict outcomes, without running the analytics infrastructure itself. Which service type matches this scenario?

  1. IaaS
  2. SaaS
  3. PaaS
  4. SaaS, because it requires the least technical knowledge to employ

Answer: C — PaaS

Analytics and business intelligence tools delivered as a service are a PaaS scenario. IaaS would leave the team to build and run the analytics environment itself.

27. Which two workloads are typical candidates for a SaaS solution? (Choose two.)

  1. Building custom applications on a development framework
  2. Finance and expense tracking
  3. Migrating on-premises servers to the cloud with a similar setup
  4. Email and messaging
  5. Rapidly replicating test environments with full control

Answer: B,D — Finance and expense tracking / Email and messaging

Email and messaging, productivity applications, and finance and expense tracking are common SaaS scenarios. Lift-and-shift and test environments are IaaS scenarios, and a development framework is a PaaS scenario.

28. A new user signs up for an Azure free account to explore the platform. Which two statements describe what the free account includes? (Choose two.)

  1. Access to more than 65 services that are always free
  2. A credit that can be used throughout the first 12 months
  3. Free access to popular Azure products for 12 months
  4. Automatic charges to the credit card once the credit is used up
  5. Free access to certain software developer tools

Answer: A,C — Access to more than 65 services that are always free / Free access to popular Azure products for 12 months

The free account gives 12 months of popular products plus more than 65 always-free services. Its credit lasts only 30 days, the developer tools belong to the student offer, and nothing is charged until you upgrade to a paid subscription.

29. A team must place a VM in a specific zone of its choosing, and also wants its SQL database replicated across zones automatically by the platform. Which pairing of service categories matches these needs?

  1. VM: zonal; SQL Database: zone-redundant
  2. VM: zonal; SQL Database: non-regional
  3. VM: zone-redundant; SQL Database: zonal
  4. VM: non-regional; SQL Database: zone-redundant

Answer: A — VM: zonal; SQL Database: zone-redundant

Zonal services such as VMs are pinned to a chosen zone, while zone-redundant services such as SQL Database are replicated automatically across zones. Non-regional services are always available from Azure geographies and are a different category.

30. A workload runs in Italy North, a region without a traditional region pair. Which approach provides its resiliency?

  1. Hosting it only in a non-regional service
  2. Automatic failover to a paired region in the same geography
  3. Failover to a sovereign region
  4. Availability zones and geo-redundant storage

Answer: D — Availability zones and geo-redundant storage

Regions like Italy North have no traditional pair and rely on availability zones and geo-redundant storage. Automatic failover to a pair is not available for them.

31. An organization needs separate invoices for development and production spending, with different access rules for each. Which construct provides both?

  1. A separate subscription for each environment
  2. A separate region for each environment
  3. A separate resource group for each environment
  4. A single subscription with two availability zones

Answer: A — A separate subscription for each environment

A subscription is both a billing boundary, for which Azure generates separate billing reports and invoices, and an access control boundary where access-management policies are applied. Creating one subscription per environment gives separate invoices and separate access rules.

32. An organization wants one subscription to inherit governance conditions from both a Finance management group and a Production management group at the same time. Why is this not possible?

  1. A directory supports only one management group besides the root
  2. Management groups cannot contain subscriptions directly
  3. Each management group and subscription can have only one parent
  4. Policies from management groups can be overridden by subscription owners

Answer: C — Each management group and subscription can have only one parent

A subscription can sit under only one management group, so it cannot inherit from two. Management groups do contain subscriptions, their policies can't be overridden by owners, and a directory supports up to 10,000 groups.

33. A student signs up for an Azure free trial subscription and wants to know what they get. Which description is accurate?

  1. Credit that can be spent for 12 months, plus unlimited use of every Azure product for the first 30 days
  2. Credit to spend in the first 30 days only, with no free products after that period
  3. Free access to all products for 12 months, with credit that renews every 30 days
  4. Access to a number of products that are free for 12 months, credit to spend in the first 30 days, and more than 25 always-free products

Answer: D — Access to a number of products that are free for 12 months, credit to spend in the first 30 days, and more than 25 always-free products

The free trial combines 12-month free products, 30-day credit, and more than 25 always-free products. The other options mix up these durations or invent benefits.

34. An organization with an Enterprise Agreement wants alerts that apply only to EA customers. Which two alert types in Cost Management fit? (Choose two.)

  1. Tag compliance alerts
  2. Spot eviction alerts
  3. Credit alerts
  4. Budget alerts
  5. Department spending quota alerts

Answer: C,E — Credit alerts / Department spending quota alerts

Credit alerts relate to Azure Prepayment, which is for EA organizations, and department spending quota alerts are specific to EA customers. Budget alerts are user-defined thresholds, and Spot eviction and tag compliance alerts are not Cost Management alert types.

35. A finance lead is setting up budgets for several teams. Which two statements about budgets are accurate? (Choose two.)

  1. Budget alerts are always generated at fixed thresholds of 90% and 100%.
  2. When a budget alert level is hit, an alert appears in cost alerts and an email goes to the budget's alert recipients.
  3. A budget can be set based on a subscription, resource group, or service type.
  4. Budgets created in the Azure portal can be defined by consumption usage quantity.
  5. Budgets can only send notifications and can never trigger automation.

Answer: B,C — When a budget alert level is hit, an alert appears in cost alerts and an email goes to the budget's alert recipients. / A budget can be set based on a subscription, resource group, or service type.

Budgets can be scoped by subscription, resource group, or service type, and a triggered alert appears in cost alerts and is emailed to the recipients list. Portal budgets are defined by cost, thresholds are user-defined (90%/100% apply to credit alerts), and budgets can trigger automation.

36. A mixed web/API workload has steady usage but shifts among different compute services over time. The team wants a one- or three-year discount without being tied to a specific VM family or instance type. Which option fits?

  1. Reservations
  2. Azure savings plan for compute
  3. Pay-as-you-go with resource tags
  4. Azure Spot Virtual Machines

Answer: B — Azure savings plan for compute

A savings plan commits to an hourly spend on eligible compute for one or three years, giving flexibility across compute services. Reservations tie the commitment to specific resources, and Spot offers no commitment and can be evicted.

37. A company keeps data in Azure, in on-premises SQL and Hive databases, and in Amazon S3. The data team needs a single, up-to-date map of this estate that includes data classification and end-to-end lineage. Which tool should they use?

  1. Azure Policy initiative
  2. Resource locks
  3. Microsoft Purview unified data governance
  4. Service Trust Portal

Answer: C — Microsoft Purview unified data governance

Purview's unified data governance covers Azure, SQL and Hive databases, on-premises data and other clouds such as Amazon S3, and builds a map with classification and lineage. Azure Policy governs resource configuration, not a data map.

38. A governance team requires every resource to carry an AppName tag. They want missing tags added automatically instead of only being reported. Which approach fits?

  1. Microsoft Purview data classification
  2. Azure Policy with automatic remediation
  3. Assigning the Reader role to users
  4. A ReadOnly resource lock

Answer: B — Azure Policy with automatic remediation

Azure Policy can automatically remediate noncompliant resources, for example by adding a missing AppName tag. Locks only block deletion or updates, and Purview classifies data.

39. Teams use Copilot recommendations and agent-like automation to propose Azure changes. Management wants standards enforced regardless of how a change was proposed. Which two requirements can Azure Policy enforce? (Choose two.)

  1. Sign-in rules for downloading audit reports
  2. Approved resource SKUs
  3. Allowed resource locations
  4. Cataloguing of Amazon S3 data
  5. Prevention of resource group deletion

Answer: B,C — Approved resource SKUs / Allowed resource locations

Azure Policy can require allowed locations, required tags, approved SKUs and security baseline controls however a change was proposed. Deletion protection is a resource lock, report access is the Service Trust Portal, and cataloguing data is Purview.

40. An auditor needs details of how Microsoft implements the controls and processes that protect its cloud services and customer data. Some of this content requires accepting a Microsoft non-disclosure agreement. Where should the auditor look?

  1. Service Trust Portal
  2. Microsoft Purview data map
  3. Azure Policy built-in initiative definitions
  4. Azure resource lock settings

Answer: A — Service Trust Portal

The Service Trust Portal holds details of Microsoft's controls and processes, and some content requires accepting the non-disclosure agreement for compliance materials. Purview and Azure Policy govern the customer's own data and resources.

41. A team is evaluating Azure Cloud Shell for daily administration. Which two statements about it are correct? (Choose two.)

  1. It requires the Azure CLI to be installed locally before it can be used.
  2. It supports both Azure PowerShell and the Azure CLI, so users can pick the shell they know.
  3. It can only be started from a locally installed shell on Windows.
  4. It is authenticated to the signed-in user's Azure credentials and so knows their permissions.
  5. It supports only Bash, so PowerShell users must install a separate tool.

Answer: B,D — It supports both Azure PowerShell and the Azure CLI, so users can pick the shell they know. / It is authenticated to the signed-in user's Azure credentials and so knows their permissions.

Cloud Shell offers both Azure PowerShell and the Bash-based Azure CLI, and it inherits the user's Azure identity and permissions. It is browser-based with no local installation required, so B and E are wrong, and C is wrong because PowerShell is supported.

42. A platform team is adopting Azure Arc for resources outside Azure. Which two statements about Azure Arc are correct? (Choose two.)

  1. It lets teams configure custom locations as an abstraction layer on top of Azure Arc-enabled Kubernetes clusters.
  2. It replaces Azure Resource Manager with a separate management API.
  3. It is limited to on-premises servers and cannot manage resources in another public cloud.
  4. It requires workloads to be migrated into Azure datacenters before they can be managed.
  5. It projects existing non-Azure resources into Azure Resource Manager.

Answer: A,E — It lets teams configure custom locations as an abstraction layer on top of Azure Arc-enabled Kubernetes clusters. / It projects existing non-Azure resources into Azure Resource Manager.

Arc projects non-Azure resources into Azure Resource Manager and supports custom locations on Arc-enabled Kubernetes clusters. It works with Azure Resource Manager rather than replacing it, and it manages resources wherever they live, including multicloud, without migrating them.

43. A team wants to describe only the desired end state of its Azure environment, let Azure work out how to deploy it, and reuse the same definition across several environments for consistent outcomes. Which approach fits best?

  1. A PowerShell script of cmdlets that creates each resource step by step
  2. Manual configuration of each environment in the Azure portal
  3. A Bash script of Azure CLI commands run manually in order
  4. A declarative Azure Resource Manager template

Answer: D — A declarative Azure Resource Manager template

ARM templates are declarative: you define what to deploy and Resource Manager handles execution, with repeatable results across environments. Cmdlet and CLI scripts are step-by-step imperative commands.

44. An operations team wants an organized, tailored view of selected resources for daily monitoring in a graphical web interface, rather than using command-line tools. Which capability provides this?

  1. Custom dashboards in the Azure portal
  2. Nested ARM templates
  3. Custom locations in Azure Arc
  4. Cmdlets run in Azure PowerShell

Answer: A — Custom dashboards in the Azure portal

The Azure portal lets you create custom dashboards for an organized view of resources. Custom locations apply to Arc-enabled Kubernetes, and cmdlets and templates are not graphical views.

45. An engineering lead wants suggestions for improving the team's workflows and deployment practices, rather than for security, speed, or spending. Which Azure Advisor category should they review?

  1. Cost
  2. Performance
  3. Reliability
  4. Operational Excellence

Answer: D — Operational Excellence

Operational Excellence suggests workflow and deployment improvements. Reliability flags configuration risks to keep applications running, and Performance targets application speed.

46. A company wants to be notified about planned maintenance in the regions it uses, and also needs to determine whether a specific VM's problem originates on Azure's side or in its own configuration. Which two Azure Service Health views should it use? (Choose two.)

  1. Resource Health
  2. Log Analytics
  3. Azure Status
  4. Service Health
  5. Azure Advisor

Answer: A,D — Resource Health / Service Health

Service Health shows planned maintenance for the services and regions you use, and Resource Health reports on a single resource and whether the issue is Azure's or yours. Azure Status is only a global picture and is not tailored to the customer's environment.

47. An operations team wants to be notified when a specific error pattern shows up in the logs of several different resources. Which type of Azure Monitor alert fits best?

  1. An Azure Advisor recommendation
  2. A log alert
  3. A metric alert
  4. An Application Insights availability test

Answer: B — A log alert

A log alert can watch for a specific error pattern across multiple resources. A metric alert is the type used for numeric thresholds such as a VM's CPU staying above 80%.

48. A team wants to track the performance of a web application's dependency calls and observe user counts and session trends. Which two items can Application Insights monitor? (Choose two.)

  1. Dependency calls and their performance
  2. Whether a VM issue is on Azure's side or the customer's
  3. User counts and session trends
  4. Opportunities to reduce Azure spending
  5. Planned maintenance events on Azure services

Answer: A,C — Dependency calls and their performance / User counts and session trends

Application Insights monitors dependency calls and user/session data. Planned maintenance belongs to Service Health, cost savings to Advisor, and the Azure-versus-customer determination to Resource Health.

Take this test interactively

More Microsoft Azure Fundamentals (AZ-900) practice tests