AZ-900 Practice Exam 4

44 questions with the correct answer and an explanation for each. Topic: AZ-900. Free, no account needed.

Take this test interactively

1. A web tier must run as a group of identical VMs that automatically scales out and in on demand or on a schedule. Traffic must also be distributed across the instances without administrators manually keeping configuration consistent. Which feature meets these requirements?

  1. Virtual machine scale set
  2. Virtual machine availability set
  3. A single VM with a larger size
  4. Azure Virtual Desktop

Answer: A — Virtual machine scale set

Scale sets manage groups of identical, load-balanced VMs and can scale automatically on demand or schedule. Availability sets only group VMs by update and fault domains and don't scale instance counts.

2. Which two statements correctly describe containers compared with virtual machines? (Choose two.)

  1. Azure doesn't support the Docker container engine.
  2. Only one instance of an application can run per host.
  3. Containers are lightweight and can be created, scaled out, and stopped dynamically.
  4. You don't manage the operating system for a container.
  5. Each container runs its own operating system that you connect to and manage.

Answer: C,D — Containers are lightweight and can be created, scaled out, and stopped dynamically. / You don't manage the operating system for a container.

Unlike VMs, containers don't require you to manage an OS, and they are lightweight and dynamic. Having its own manageable OS describes a VM, Azure supports Docker, and containers let you run multiple instances on a single host.

3. A workload runs a short piece of code in response to a message from another Azure service a few times per day. The team wants no provisioned resources while idle and to be charged only for CPU time used while the code runs. Which option fits?

  1. Azure Container Instances
  2. Azure Functions
  3. An App Service web app
  4. A virtual machine scale set

Answer: B — Azure Functions

Azure Functions is event-driven and serverless: an event wakes the function, resources are deallocated when it finishes, and Azure charges only for the CPU time used. Apps built on VMs (including scale sets) or containers (including Container Instances) need those resources to be running for the app to function.

4. A team builds a back end for iOS and Android apps using the Mobile Apps feature of App Service. Which two capabilities does it provide? (Choose two.)

  1. Running custom back-end logic written in Python only
  2. Storing app data in an on-premises SQL database only
  3. Authenticating customers against social providers such as Google and Facebook
  4. Sending push notifications
  5. SDK support limited to native iOS apps

Answer: C,D — Authenticating customers against social providers such as Google and Facebook / Sending push notifications

Mobile Apps can send push notifications and authenticate against common social providers. Custom logic runs in C# or Node.js, data goes to a cloud-based SQL database, and SDKs cover native iOS and Android, Xamarin, and React Native.

5. An organization enables single sign-on across dozens of applications to reduce password sprawl and simplify access removal when roles change. Which security consideration must it keep in mind?

  1. SSO prevents multifactor authentication from being used on the initial sign-in
  2. SSO makes it harder to remove access because identities are tied to each app separately
  3. Each application still needs its own separate password, so SSO adds no risk
  4. SSO is only as secure as the initial authenticator, because all subsequent connections rely on it

Answer: D — SSO is only as secure as the initial authenticator, because all subsequent connections rely on it

Every later connection depends on the first sign-in, so a weak initial authenticator weakens all the connected apps. SSO ties access to one identity, which makes removal easier, not harder.

6. A company collaborates with a partner's Microsoft Entra tenant and wants a mutual, two-way trust so partner users can work in Teams shared channels from their own home instance of Teams. The partner users should not be represented in the company's directory. Which capability should it use?

  1. Microsoft Entra External ID for customers
  2. B2B direct connect
  3. Microsoft Entra Domain Services
  4. B2B collaboration

Answer: B — B2B direct connect

B2B direct connect establishes a mutual trust, supports Teams shared channels, and does not create directory objects for the external users. B2B collaboration represents external users in the directory, typically as guests.

7. A company needs to require MFA for administrators and for people connecting from outside trusted network locations. Which two tasks can Conditional Access accomplish? (Choose two.)

  1. Require MFA depending on the requester's role, location, or network
  2. Replicate on-premises user identities into the cloud directory
  3. Assign the Reader role at subscription scope
  4. Require users to access an application only from managed devices
  5. Rotate encryption keys on a schedule

Answer: A,D — Require MFA depending on the requester's role, location, or network / Require users to access an application only from managed devices

Conditional Access can require MFA based on role, location or network and can restrict access to managed devices. Replicating identities is Microsoft Entra Connect, role assignments are Azure RBAC, and key rotation is a key management task.

8. A company is concerned that a large-scale attack could make its systems unavailable to users. In a defense-in-depth strategy, which layer is responsible for filtering such attacks before they cause a denial of service?

  1. Compute
  2. Perimeter
  3. Identity and access
  4. Network

Answer: B — Perimeter

The perimeter layer uses DDoS protection to filter large-scale attacks. The network layer limits communication between resources through segmentation and access controls, which is a different purpose.

9. An application stores very large numbers of small objects, has a high transaction rate, and needs consistently low storage latency. The data must also be replicated across availability zones. Which storage account type fits?

  1. Premium block blobs
  2. Premium file shares
  3. Standard general-purpose v2
  4. Premium page blobs

Answer: A — Premium block blobs

Premium block blobs are recommended for high transaction rates, smaller objects and consistently low latency, and support ZRS. Premium page blobs support only LRS, and premium file shares are for Azure Files only.

10. A contract requires that data written to a geo-redundant storage account be guaranteed to reach the secondary region within 5 minutes. Which statement correctly describes what Azure Storage provides?

  1. The guarantee is met, because geo-redundant replication to the secondary region is synchronous.
  2. The guarantee is met only if read access to the secondary region is enabled.
  3. The guarantee can't be given: replication is asynchronous, with a typical RPO under 15 minutes but no SLA on replication time.
  4. The guarantee is met only if the primary region uses zone-redundant storage.

Answer: C — The guarantee can't be given: replication is asynchronous, with a typical RPO under 15 minutes but no SLA on replication time.

Replication to the secondary region is asynchronous, and although the RPO is typically under 15 minutes, there is no SLA on replication time. Read access and zone redundancy in the primary region don't change this.

11. A company keeps long-term backups that are rarely accessed and are retained for at least 180 days. Retrieval latency is not a concern, and the company wants the lowest storage cost. Which tier fits, and at what level can it be set?

  1. Archive tier, at the blob level only
  2. Cold tier, at either the account or blob level
  3. Cool tier, at the blob level only
  4. Archive tier, at either the account or blob level

Answer: A — Archive tier, at the blob level only

Archive is for rarely accessed data kept at least 180 days with flexible latency, and has the lowest storage cost. It can't be set at the account level, only per blob. Cold is optimized for at least 90 days and costs more to store.

12. A company wants one portal to assess its on-premises infrastructure and then migrate its servers, databases, and web apps to Azure. Which service provides this?

  1. Azure File Sync
  2. Azure Data Box
  3. Azure Storage Explorer
  4. Azure Migrate

Answer: D — Azure Migrate

Azure Migrate is a hub with a unified platform to start, run, and track assessment and migration, with integrated tools for servers, databases, and web apps. Data Box is a physical device for moving data.

13. A company wants its application to keep running even if an entire region suffers a catastrophic event. Which characteristic of the cloud supports this?

  1. A decentralized design that lets resources be deployed in regions around the world
  2. A consumption-based model in which you pay only for what you use
  3. Vertical scaling of the virtual machines in a single region
  4. Management of resources through a web portal

Answer: A — A decentralized design that lets resources be deployed in regions around the world

The decentralized design with resources in regions worldwide means other regions keep running when one fails. Vertical scaling inside one region does not protect against loss of that region.

14. A company chooses infrastructure as a service because it wants maximum control over security. Which two tasks remain the company's responsibility? (Choose two.)

  1. Patching and maintaining the installed software
  2. Managing the operating systems
  3. Providing the physical resources
  4. Nothing, because all patches are applied automatically under IaaS
  5. Absorbing large-scale distributed denial of service attacks on the provider's network

Answer: A,B — Patching and maintaining the installed software / Managing the operating systems

IaaS supplies physical resources, while the customer manages operating systems and installed software, including patches and maintenance. Automatic patching is associated with PaaS and SaaS, and DDoS handling is something providers are typically well suited for.

15. A development environment is used only during business hours. The team wants to reduce unnecessary resource consumption while still meeting its needs. Which approach fits?

  1. Scale the environment out to more virtual machines after hours
  2. Move the environment to infrastructure as a service for more control
  3. Automatically shut the environment down overnight and on weekends
  4. Provision peak capacity permanently so the environment is always ready

Answer: C — Automatically shut the environment down overnight and on weekends

Automatically shutting down idle resources reduces consumption while meeting team needs. Permanent peak capacity and scaling out add waste rather than removing it.

16. A regulated company must make sure every newly deployed resource meets its technical standards and regulatory requirements, and must be able to update existing resources at scale when those standards change. Which approach best fits?

  1. Vertically scale resources to the highest specification
  2. Configure each resource manually after it is deployed
  3. Rely on load balancing to keep resources compliant
  4. Use templates to deploy and update resources

Answer: D — Use templates to deploy and update resources

Templates help ensure deployed resources meet technical and regulatory standards, and resources can be updated at scale as standards change. Manual configuration does not provide that consistency at scale.

17. A team wants a service model in which responsibility is distributed evenly between itself and the provider. It does not want the heaviest consumer burden, and it does not want the provider to take on nearly everything. Which cloud service type fits?

  1. Software as a service (SaaS)
  2. Platform as a service (PaaS)
  3. Infrastructure as a service (IaaS)
  4. A traditional on-premises datacenter

Answer: B — Platform as a service (PaaS)

PaaS is the middle ground that evenly distributes responsibility. IaaS puts the most on the consumer, and SaaS puts most on the provider.

18. A startup wants to scale without capital expenditures, provision and deprovision applications quickly, and pay only for what it uses. It accepts that it will not have complete control over resources and security. Which cloud model fits?

  1. Private cloud
  2. A cloud built from purchased, dedicated hardware
  3. Hybrid cloud
  4. Public cloud

Answer: D — Public cloud

Public cloud means no capital expenditure to scale, quick provisioning and pay-per-use, at the cost of complete control. Private cloud requires hardware purchases and maintenance.

19. An organization has resources in its own datacenter, in Azure and with another public cloud provider. It wants one set of technologies to help manage all of them. Which fits?

  1. Azure Arc
  2. Azure VMware Solution
  3. A private cloud hosted offsite
  4. Microsoft Entra ID

Answer: A — Azure Arc

Azure Arc helps manage public, private, hybrid and multicloud environments. Azure VMware Solution only runs VMware workloads in Azure.

20. Beyond traditional IT infrastructure such as virtual machines, storage, databases and networking, which set of offerings does cloud computing expand into?

  1. Capital expenditure planning and hardware procurement
  2. Physical security, power and cooling
  3. Datacenter construction and hardware replacement
  4. Internet of Things, machine learning and artificial intelligence

Answer: D — Internet of Things, machine learning and artificial intelligence

Cloud services extend traditional infrastructure with IoT, ML and AI. The other options describe provider facility duties or traditional procurement tasks.

21. An engineering team must repeatedly replicate established configurations for development and test environments, start and shut them down quickly, and keep complete control over each environment. Which service type fits best?

  1. PaaS
  2. SaaS
  3. IaaS
  4. SaaS, because it is the easiest model to get up and running

Answer: C — IaaS

IaaS lets teams start up or shut down environments rapidly while maintaining complete control. PaaS is tempting for development work, but the provider maintains the operating systems there, so the team does not have complete control.

22. Developers are building a cloud application on a PaaS development framework and want to write as little code as possible for common platform needs. Which two capabilities come included with such a framework? (Choose two.)

  1. Scalability
  2. Developer-managed operating system installation
  3. Customer-run physical security of the datacenter
  4. Customer maintenance of the server hardware
  5. Multitenant capability

Answer: A,E — Scalability / Multitenant capability

A PaaS framework includes scalability, high availability, and multitenant capability, which reduces the coding developers must do. Operating systems, hardware, and physical security are maintained by the provider in PaaS, not by developers.

23. A small company has almost no operations staff. It wants the provider to manage the infrastructure, the platform, and the application, so the company carries the lowest possible operational overhead. Which service type fits?

  1. IaaS
  2. PaaS
  3. SaaS
  4. Any of the three, since operational overhead is the same across service types

Answer: C — SaaS

In SaaS the provider manages almost all of the application stack, giving customers the lowest operational overhead. In PaaS the customer still owns application code, data, and access controls.

24. An executive asks what trade-off comes with choosing SaaS over the other cloud service types. Which two statements are accurate? (Choose two.)

  1. It carries the largest operational responsibility for customers
  2. It may be the least flexible of the service types
  3. It gives customers the most control over the underlying resources
  4. Customers must maintain the middleware
  5. It is the easiest to get up and running

Answer: B,E — It may be the least flexible of the service types / It is the easiest to get up and running

SaaS may be the least flexible model but is the easiest to get running. Maximum control and the largest operational responsibility belong to IaaS, and the SaaS provider manages the platform.

25. A university student has no credit card and wants to try Azure with a starting credit and free developer tools. Which offer fits?

  1. Purchase through a Cloud Solution Provider partner
  2. Azure free account
  3. A new paid subscription on an existing account
  4. Azure free student account

Answer: D — Azure free student account

The student offer provides $100 credit and free developer tools and can be signed up for without a credit card. The regular free account requires a credit card for identity verification.

26. A company must keep its data within the same geography for compliance, and its disaster recovery site must stay isolated from a natural disaster that could affect an entire region, including all of its availability zones. Which design fits?

  1. Use the paired region in the same geography, at least 300 miles away
  2. Use a region in a different geography that is close to the primary region
  3. Spread resources across additional availability zones in the primary region
  4. Use a sovereign region as the recovery site

Answer: A — Use the paired region in the same geography, at least 300 miles away

Region pairs sit in the same geography at least 300 miles apart, keeping data in-geography and isolated from a region-wide event. Availability zones may all be hit by a very large event in one region.

27. A U.S. government agency needs a physically and logically network-isolated instance of Azure whose datacenters are operated by screened U.S. personnel and carry additional compliance certifications. Which option fits?

  1. A regular region with availability zones enabled
  2. West US, paired with East US
  3. China East, operated through a partnership with 21Vianet
  4. US Gov Virginia

Answer: D — US Gov Virginia

US Gov regions are isolated instances of Azure for U.S. government agencies, operated by screened U.S. personnel. China regions are run through a partnership with 21Vianet, and regular regions are not isolated from the main instance.

28. A company is deciding whether to create additional subscriptions in the same Azure account. Which two statements support doing so? (Choose two.)

  1. A subscription is required in order to nest resource groups
  2. Subscriptions are placed inside resource groups, so each project's resource group needs its own subscription
  3. Access control occurs at the subscription level, so subscriptions are a natural boundary between environments such as development and production
  4. Giving each project its own subscription makes costs easy to track
  5. An account can hold only one subscription, so each team needs a new account

Answer: C,D — Access control occurs at the subscription level, so subscriptions are a natural boundary between environments such as development and production / Giving each project its own subscription makes costs easy to track

Subscriptions separate environments by access control and let each project's costs be tracked separately. An account can have multiple subscriptions, resource groups can never be nested, and resource groups go into subscriptions, not the other way around.

29. A company buys a virtual machine with specialized software preinstalled from a third-party vendor through Azure Marketplace. Which two statements about the charges are accurate? (Choose two.)

  1. The billing structure for the product is set by the vendor.
  2. The company may pay for the Azure services used and also for the vendor's services or expertise.
  3. Marketplace solutions are exempt from Azure policies and standards, so their pricing is unregulated.
  4. Microsoft sets one uniform billing structure for all Marketplace offerings.
  5. Only the vendor's fee applies, because Azure infrastructure used by Marketplace products is free.

Answer: A,B — The billing structure for the product is set by the vendor. / The company may pay for the Azure services used and also for the vendor's services or expertise.

Marketplace purchases can include both Azure service costs and the vendor's charges, and the vendor sets the billing structure. Solutions are certified and compliant with Azure policies and standards, so E is wrong.

30. An organization with an Enterprise Agreement wants to be warned automatically as its Azure Prepayment balance is used up. At which points are these alerts generated?

  1. At 50% and 75% of the balance
  2. At 80% and 100% of the balance
  3. Only when the balance reaches 100%
  4. At 90% and 100% of the balance

Answer: D — At 90% and 100% of the balance

Credit alerts are generated automatically at 90% and 100% of the Azure credit balance. The 50% and 75% figures are examples of department spending quota thresholds, and 80% was a sample budget threshold.

31. A finance team applies a CostCenter tag to a resource group and wants consistent tagging on the resources inside it going forward. Which two statements are accurate? (Choose two.)

  1. Resources don't inherit tags from resource groups, so tags must be applied at each level where they are wanted.
  2. Every tag in the schema must be present on every resource.
  3. Tags can be modified only through the Azure portal.
  4. Every resource in the group automatically inherits the CostCenter tag.
  5. Azure Policy can define rules that reapply tags that have been removed.

Answer: A,E — Resources don't inherit tags from resource groups, so tags must be applied at each level where they are wanted. / Azure Policy can define rules that reapply tags that have been removed.

Tags are not inherited from subscriptions or resource groups, and Azure Policy can enforce tagging, including reapplying removed tags. Tags can be managed via PowerShell, CLI, ARM templates, and REST too, and specific tags need not be on every resource.

32. A nightly rendering job can be restarted without affecting results, and the top priority is the lowest possible compute cost. The team accepts that the VMs may be stopped when Azure needs capacity back. Which option fits?

  1. Azure Spot Virtual Machines
  2. Azure savings plan for compute
  3. A three-year Reservation
  4. Standard pay-as-you-go VMs

Answer: A — Azure Spot Virtual Machines

Spot uses unused Azure capacity at reduced prices and suits fault-tolerant, interruptible workloads where lowest cost is the priority. Reservations and savings plans require commitments and are for steady workloads.

33. A data team must find where sensitive data is stored across its estate and control who can access that data across the whole estate at scale. Which two Microsoft Purview unified data governance capabilities address this? (Choose two.)

  1. Managing access to the data in the estate securely and at scale
  2. Automatically adding a missing AppName tag to resources
  3. Providing compliance documents that require accepting a non-disclosure agreement
  4. Identifying where sensitive data is stored in the estate
  5. Preventing deletion by applying a ReadOnly lock

Answer: A,D — Managing access to the data in the estate securely and at scale / Identifying where sensitive data is stored in the estate

Unified data governance helps identify where sensitive data lives and manage access to estate data securely and at scale. Tag remediation is Azure Policy, ReadOnly locks are resource locks, and NDA-gated documents are the Service Trust Portal.

34. Azure Policy enforces a required-tag rule across a subscription. One legacy resource must be left alone while the rule stays in force for everything else. What does Azure Policy allow?

  1. Marking the legacy resource as an exception
  2. Converting the policy into an initiative
  3. Waiting for the policy to evaluate it as compliant
  4. Removing the policy from the whole subscription

Answer: A — Marking the legacy resource as an exception

Resources can be marked as exceptions, so the administrator keeps full control of the environment. Removing the policy would drop enforcement everywhere.

35. A database team must be able to change the settings of a production database but must never be able to delete it. Which control meets both requirements?

  1. A ReadOnly lock
  2. The Reader role
  3. An Azure Policy initiative
  4. A Delete lock

Answer: D — A Delete lock

A Delete lock lets authorized users read and modify the resource but not delete it. A ReadOnly lock would also block updates, as would restricting users to the Reader role.

36. A new compliance analyst wants to open protected compliance materials on the Service Trust Portal. Which two things are required? (Choose two.)

  1. Access to the Microsoft Purview data map
  2. Owner role on an Azure subscription
  3. Sign in with a Microsoft Entra work or school account
  4. Acceptance of the Microsoft non-disclosure agreement for compliance materials
  5. Reader role on a resource group

Answer: C,D — Sign in with a Microsoft Entra work or school account / Acceptance of the Microsoft non-disclosure agreement for compliance materials

Access to some resources requires signing in with a Microsoft cloud services account (Entra work or school) and accepting the non-disclosure agreement. Azure roles and Purview access are not mentioned as requirements.

37. A team of Linux administrators who already write Bash scripts wants to automate repeatable Azure resource management from their own machines as well as from the browser. Which tool is the most natural fit?

  1. Azure Cloud Shell only, because the Azure CLI cannot be installed on Linux machines
  2. Azure Arc, because it runs Bash commands against Azure
  3. Azure PowerShell, because it is the only scriptable option on Linux
  4. The Azure CLI, which uses Bash commands and is available locally and in Cloud Shell

Answer: D — The Azure CLI, which uses Bash commands and is available locally and in Cloud Shell

The Azure CLI uses Bash commands and can be installed on Windows, Linux, and Mac or used through Cloud Shell. Azure PowerShell is functionally equivalent and also installable on Linux, so the choice comes down to the language the team knows.

38. An administrator creates the same resource once through the Azure portal and once through a REST-based SDK, and sees identical capabilities and results both times. What explains this consistency?

  1. Each tool ships its own copy of the service logic, and the copies are kept in sync.
  2. Azure Arc proxies requests from all tools to the target service.
  3. All requests, from any tool, API, or SDK, are received, authenticated, and authorized by Azure Resource Manager through the same API.
  4. Azure Cloud Shell translates every request before it reaches Azure.

Answer: C — All requests, from any tool, API, or SDK, are received, authenticated, and authorized by Azure Resource Manager through the same API.

Azure Resource Manager receives every request, authenticates and authorizes it, and forwards it to the Azure service, so all tools share the same API. Cloud Shell and Arc are not in the path of every request.

39. A team finds its JSON ARM templates verbose and hard to read. It wants a declarative, more concise language that is idempotent, supports reusable modules, and still deploys through Azure Resource Manager. What should it adopt?

  1. A longer set of nested JSON templates
  2. Azure PowerShell cmdlet scripts
  3. Bicep
  4. Azure Cloud Shell

Answer: C — Bicep

Bicep is a declarative language for deploying Azure resources through ARM that is generally simpler and more concise than JSON templates, with idempotent files and modules. Cmdlet scripts are imperative, and nested JSON templates do not make the syntax simpler.

40. An organization plans to bring several kinds of resources hosted outside Azure under Azure Arc management and wants to know which of the supported outside-Azure resource types is currently in preview. Which one is it?

  1. Servers
  2. Kubernetes clusters
  3. Virtual machines
  4. SQL Server

Answer: C — Virtual machines

Virtual machines are the type marked as preview among the resources Azure Arc can manage outside Azure; servers, Kubernetes clusters, Azure data services, and SQL Server are listed without that label.

41. A security officer wants to find threats and vulnerabilities that could lead to breaches, and the finance team wants ways to reduce Azure spending. Which two Azure Advisor categories cover these needs? (Choose two.)

  1. Cost
  2. Security
  3. Operational Excellence
  4. Reliability
  5. Performance

Answer: A,B — Cost / Security

Security detects threats and vulnerabilities that could lead to breaches, and Cost finds ways to reduce Azure spending. Reliability, Performance, and Operational Excellence address configuration risks, application speed, and workflow/deployment respectively.

42. An Azure event begins affecting one of a company's production workloads, and the operations team needs a fast path to get help from Microsoft. Which tool provides links to support for that event?

  1. Log Analytics
  2. Azure Advisor
  3. Azure Service Health
  4. Application Insights

Answer: C — Azure Service Health

Azure Service Health provides links to support when an event affects one of your workloads. Advisor offers recommendations, not event-driven support links.

43. An administrator wants Azure Monitor to notify a team whenever a condition they define is met. Which two items must they set up? (Choose two.)

  1. An Azure Advisor recommendation
  2. An action group that controls who is notified and what happens next
  3. The Azure Status page
  4. An alert rule that specifies the condition
  5. A Log Analytics dashboard

Answer: B,D — An action group that controls who is notified and what happens next / An alert rule that specifies the condition

An alert rule defines the condition and an action group controls who is notified and what happens next. The other options are a global health page, a recommendation, and a query/visualization surface, none of which define alert conditions or recipients.

44. A web application receives almost no visitors overnight, but the team still wants confirmation that it is responding during those hours. Which capability should they use?

  1. A Service Health alert
  2. An Azure Advisor reliability recommendation
  3. A Resource Health check
  4. An Application Insights availability test

Answer: D — An Application Insights availability test

Availability tests send synthetic requests so the team knows the application is responding even during low-traffic periods. Service Health alerts cover Azure events rather than app responsiveness.

Take this test interactively

More Microsoft Azure Fundamentals (AZ-900) practice tests