Free AZ-900 Exam Dumps Preview

Box: Azure Active Directory (Azure AD)
You can enable single sign-on for an enterprise application through Azure Active Directory (Azure AD.

Azure Active Directory enables users to authenticate to multiple applications by using single sign-on.

Incorrect:
Application security groups enable you to configure network security as a natural extension of an application's structure, allowing you to group virtual machines and define network security policies based on those groups.
References:
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-setup-sso

Azure virtual machines run on Hyper-V physical servers. The physical servers are owned and managed by Microsoft. As an Azure customer, you have no access to the physical servers. Microsoft manage the replacement of failed server hardware and the security of the physical servers so you don't need to.

Incorrect Answers:
B: Microsoft have no control over the applications you run on the virtual machines. Therefore, it is your responsibility to ensure that application data is backed up.
D: Microsoft do not manage the operating systems you run on the virtual machines. Therefore, it is your responsibility to ensure that the operating systems are updated.
E: Microsoft have no control over the shared folders you host on the virtual machines. Therefore, it is your responsibility to ensure that folder permissions are configured appropriately.

https://learn.microsoft.com/azure/security/fundamentals/shared-responsibility
Azure Virtual Machines Overview:
https://learn.microsoft.com/azure/virtual-machines/overview
Physical Security in Azure Datacenters:
https://learn.microsoft.com/azure/security/fundamentals/physical-security
VM Operating System Responsibilities:
https://learn.microsoft.com/azure/virtual-machines/maintenance-and-updates
Azure Backup Overview:
https://learn.microsoft.com/azure/backup/backup-overview

A platform as a service solution provides full control of operating systems that host applications. No

Box 1: Yes
Azure security center can monitor azure resources and on-premises resources.
Azure Security Center is a unified infrastructure security management system that strengthens the security posture of your data centers, and provides advanced threat protection across your hybrid workloads in the cloud - whether they're in Azure or not - as well as on premises.

Box 2: No
Only two features: Continuous assessment and security recommendations, and Azure secure score, are free.

Box 3: Yes
The advanced monitoring capabilities in Security Center also let you track and manage compliance and governance over time. The overall compliance provides you with a measure of how much your subscriptions are compliant with policies associated with your workload.

References:
https://docs.microsoft.com/en-us/azure/security-center/security-center-intro

Database Migration Service (DMS) is used for migrating SQL databases to Azure SQL. Site Recovery is for disaster recovery replication. Azure Migrate assists with assessment but not full SQL migration.

You can install the Az PowerShell module locally on Windows, macOS, and Linux. It can also be used from a browser through Azure Cloud Shell or inside a Docker container.
Azure powershell modules can be installed on macOS. Yes

References:
https://docs.microsoft.com/en-us/powershell/azure/what-is-azure-powershell?view=azps-6.6.0
https://serverfault.com/questions/323973/how-do-i-access-the-windows-azure-management-portal-from-ubuntu

Box 1:
Azure AI bot provides a digital online assistant that provides speech support.
Bots provide an experience that feels less like using a computer and more like dealing with a person - or at least an intelligent robot. They can be used to shift simple, repetitive tasks, such as taking a dinner reservation or gathering profile information, on to automated systems that may no longer require direct human intervention. Users converse with a bot using text, interactive cards, and speech. A bot interaction can be a quick question and answer, or it can be a sophisticated conversation that intelligently provides access to services.

Box 2:
Azure Machine Learning uses past trainings to provide predictions that have high probability.
Machine learning is a data science technique that allows computers to use existing data to forecast future behaviors, outcomes, and trends. By using machine learning, computers learn without being explicitly programmed.
Forecasts or predictions from machine learning can make apps and devices smarter. For example, when you shop online, machine learning helps recommend other products you might want based on what you've bought.

Box 3:

Azure Functions provides serverless computing functionalities.
Azure Functions is a serverless compute service that lets you run event-triggered code without having to explicitly provision or manage infrastructure.

Box 4:
IoT Hub (Internet of things Hub) provides data from millions of sensors.
IoT Hub is a managed service, hosted in the cloud, that acts as a central message hub for bi-directional communication between your IoT application and the devices it manages. You can use Azure IoT Hub to build IoT solutions with reliable and secure communications between millions of IoT devices and a cloud-hosted solution backend. You can connect virtually any device to IoT Hub.

References:
https://docs.microsoft.com/en-us/azure/bot-service/bot-service-overview-introduction?view=azure-bot-service-4.0
https://docs.microsoft.com/en-us/azure/machine-learning/overview-what-is-azure-ml
https://docs.microsoft.com/en-us/azure/azure-functions/
https://docs.microsoft.com/en-us/azure/iot-hub/about-iot-hub

Elasticity in this case is the ability to provide additional compute resource when needed and reduce the compute resource when not needed to reduce costs. Autoscaling is an example of elasticity.

Elastic computing is the ability to quickly expand or decrease computer processing, memory and storage resources to meet changing demands without worrying about capacity planning and engineering for peak usage. Typically controlled by system monitoring tools, elastic computing matches the amount of resources allocated to the amount of resources actually needed without disrupting operations. With cloud elasticity, a company avoids paying for unused capacity or idle resources and doesn't have to worry about investing in the purchase or maintenance of additional resources and equipment.

References:
https://azure.microsoft.com/en-gb/overview/what-is-elastic-computing/

Reason Why This Answer Is Correct:

Although Azure Firewall can allow HTTP traffic, modifying it alone does not guarantee that VM1 will be accessible from the Internet.

To expose a VM over HTTP, ALL of the following must be true: The VM must have a Public IP address.
An NSG (Network Security Group) must allow inbound TCP port 80.
Traffic must be routed through Azure Firewall.

The solution only states that Azure Firewall is modified. It does NOT verify: That the VM has a public IP address That an NSG allows port 80
That the firewall is in the traffic path

Because none of those are guaranteed, modifying Azure Firewall alone does not meet the goal.

Why Azure Firewall Is Not the Correct Answer Here:

Azure Firewall protects networks when traffic is routed through it.
However, many VMs are directly exposed using: Public IP address
NSG rules

For most scenarios, the correct method to allow HTTP access is: Assigning a public IP to the VM
Configuring an NSG to allow inbound TCP port 80

References:
Azure Firewall: (https://learn.microsoft.com/en-us/azure/firewall/overview)
"Azure Firewall is a managed firewall service that filters traffic when deployed in the network path." Network Security Groups: (https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview)
"Network security groups allow or deny inbound and outbound traffic to Azure resources." Public IP addresses: (https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses)
"A public IP allows Azure resources to communicate with the Internet."

Box 1: No
The cost of outbound traffic from azure is the same for all azure regions. No
Within most of the areas, there are clearly more expensive regions and less expensive regions.
The least expensive regions, on average across these instance types are us-west-2, us-west-central, and korea-south.
The most expensive regions are asia-pacific-east, japan-east, and australia-east.

Box 2: Yes
Many organizations with Microsoft Enterprise Agreements (EA) are adding Azure to their EA to enjoy the benefits it offers, such as: Minimizing Azure upfront costs by locking in pricing with consumption pre-commitment Using Azure EA Portal to manage Azure Subscriptions easily and organize them under a single billing account

Box 3: No
The commercial marketplace operates on an agency model, whereby publishers set prices, Microsoft bills customers, and Microsoft pays revenue to publishers while withholding an agency fee.

https://learn.microsoft.com/en-us/azure/marketplace/plans-pricing

Box 1: Azure Queue Storage
Queue Storage
Durable queues for large-volume cloud services

Simple, cost-effective, durable message queueing for large workloads Rich client libraries for .NET, Java, Android, C++, Node.js, PHP, Ruby, and Python Data accessible via the REST API

Box 2: Azure Files
You can map a Network File Share to an Azure Windows VM.

Box 3: Azure Blob Storage
Azure Archive Storage is yet another storage tier available for blob storage. Hot, cool, and archive objects can all exist side by side in the same account. And with the introduction of blob-level tiering, you can change an object's tier with a single click in the Azure portal, or you can use the REST API (or .NET, Java, Python, and a number of other SDKs) to programmatically change as many objects as needed.

References:
https://azure.microsoft.com/en-us/products/storage/queues/#overview
https://azure.microsoft.com/en-us/products/storage/#overview
https://www.geeksforgeeks.org/microsoft-azure-map-a-network-file-share-to-azure-windows-vm/

Previously, the Azure CLI (or x-plat CLI) was the only option for managing Azure subscriptions and resources from the command-line on Linux and macOS. Now with the open source and cross-platform release of PowerShell, you'll be able to manage all your Azure resources from Windows, Linux and macOS using your tool of choice, either the Azure CLI or Azure PowerShell cmdlets.
The Azure portal runs in a web browser so can be used in either operating system.

References:
https://buildazure.com/2016/08/18/powershell-now-open-source-and-cross-platform-linux-macos-windows/

North america is represented by a single azure region. No

References:
https://azure.microsoft.com/en-us/global-infrastructure/regions/
https://azure.microsoft.com/en-us/pricing/details/bandwidth/

Authentication is the process of establishing the identity of a user or service that wants to access a resource.

Box 1: Azure Platform as a service (PaaS)
Organizations typically use PaaS for these scenarios: Development framework. PaaS provides a framework that developers can build upon to develop or customize cloud-based applications. Similar to the way you create an Excel macro, PaaS lets developers create applications using built-in software components. Cloud features such as scalability, high-availability, and multi-tenant capability are included, reducing the amount of coding that developers must do.

Box 2:
Software as a service (SaaS) allows users to connect to and use cloud-based apps over the Internet. Common examples are email, calendaring, and office tools (such as Microsoft Office 365).
SaaS provides a complete software solution that you purchase on a pay-as-you-go basis from a cloud service provider. You rent the use of an app for your organization, and your users connect to it over the Internet, usually with a web browser. All of the underlying infrastructure, middleware, app software, and app data are located in the service provider's data center. The service provider manages the hardware and software, and with the appropriate service agreement, will ensure the availability and the security of the app and your data as well. SaaS allows your organization to get quickly up and running with an app at minimal upfront cost.
References:
https://azure.microsoft.com/en-us/overview/what-is-paas/

A PowerShell script is a file that contains PowerShell cmdlets and code. A PowerShell script needs to be run in PowerShell.

With the Azure Cloud Shell, you can run PowerShell cmdlets and scripts in a Web browser. You log in to the Azure Portal and select the Azure Cloud Shell option. This will open a PowerShell session in the Web browser. The Azure Cloud Shell has the necessary Azure PowerShell module installed.

Note: to run a PowerShell script in the Azure Cloud Shell, you need to change to the directory where the PowerShell script is stored.

References:
https://docs.microsoft.com/en-us/azure/cloud-shell/quickstart-powershell

An azure subscription can have multiple account administrators.No
References:
https://k21academy.com/microsoft-azure/az-900/az-900-azure-subscriptions/
https://azure.microsoft.com/en-us/blog/organizing-subscriptions-and-resource-groups-within-the-enterprise/

You can use the Azure File Sync agent to sync on-premises data to an Azure file share.

Public Cloud: Hardware resources are owned and managed by a third-party cloud provider (e.g., Microsoft Azure).- Resources are shared between multiple tenants.- Services are accessed over the Internet, typically with pay-as-you-go pricing.
Incorrect Options:
Private Cloud: Resources are dedicated to a single organization.-Hardware is not shared between multiple tenants.
Hybrid Cloud: Combines private and public cloud resources.-Not fully shared, third-party-owned hardware.
References (Microsoft Learn):
Public, private, and hybrid cloud models overview
https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/strategy/plan-cloud-models

Azure Monitor includes the Azure Service Health feature, which provides personalized dashboards for viewing service failure notifications, planned maintenance, and health advisories that can affect the availability of resources like VM1.
Azure Advisor provides best practice recommendations but does not provide real-time service failure notifications.
Azure Service Fabric is for deploying and managing microservices, not for monitoring platform health.
Azure virtual machines is a resource management blade, not a service for platform failure notifications.
References:
Microsoft Learn: (https://learn.microsoft.com/en-us/azure/service-health/service-health-overview)
"Azure Service Health provides personalized alerts and guidance when Azure service issues like outages or maintenance affect your resources."-Microsoft Learn: (https://learn.microsoft.com/en-us/azure/azure-monitor/overview)
"Azure Monitor collects, analyzes, and acts on telemetry from your cloud and on-premises environments. It integrates Azure Service Health to notify you of platform incidents and planned maintenance."

An organization that hosts its infrastructure in the public cloud no longer requires a data center.

Azure Advisor provides personalized recommendations to optimize Azure resources.
For virtual machines, it identifies underutilized or unused VMs and recommends actions such as resizing, stopping, or deleting them to reduce costs.-Helps improve cost efficiency and resource utilization.
Incorrect Options: Azure Cost Management + Billing: Focuses on analyzing costs, budgeting, and spending trends.- Does not specifically identify underutilized or unused VMs.-Azure Reservations: Used to pre-purchase capacity for cost savings.- Does not provide insights on VM utilization.-Azure Policy: Enforces compliance and governance rules.- Does not automatically identify underutilized or unused VMs.
References (Microsoft Learn):
Azure Advisor overview
https://learn.microsoft.com/en-us/azure/advisor/advisor-overview
Optimize and manage costs for Azure VMs using Azure Advisor
https://learn.microsoft.com/en-us/azure/advisor/advisor-cost-recommendations
References:
https://docs.microsoft.com/en-us/azure/advisor/advisor-overview

Box: contains one or more data centers that are connected by using a low-latency network.

An azure region contains one or more data centers that are connected by using a low-latency network.

Each Azure region features datacenters deployed within a latency-defined perimeter. They're connected through a dedicated regional low-latency network. This design ensures that Azure services within any region offer the best possible performance and security.
References:
https://docs.microsoft.com/en-us/azure/availability-zones/az-overview

To migrate to Azure and decommission the on-premises data center, you would need to create the 5,000 user accounts in Azure Active Directory. The easy way to do this is to sync all the Active Directory user accounts to Azure Active Directory (Azure AD). You can even sync their passwords to further minimize the impact on users. The tool you would use to sync the accounts is Azure AD Connect. The Azure Active Directory Connect synchronization services (Azure AD Connect sync) is a main component of Azure AD Connect. It takes care of all the operations that are related to synchronize identity data between your on-premises environment and Azure AD.

References:
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-whatis

You can create custom azure roles to control access to resources.Yes

1. Storage: Supports up to 16 TiB, sufficient for 10 TB.
2. Premium Storage: Uses Premium SSD/v2.
3. PITR: Supports backup retention up to 35 days.-Minimizes costs compared to Memory Optimized and Hyperscale (Citus) tiers.

1. Azure Database for PostgreSQL Single Server Memory Optimized tier:
Meets technical requirements (storage, Premium SSD, 35-day PITR).
Fails the cost requirement: more expensive than General Purpose, so not optimal for minimizing costs.
2. Azure Database for PostgreSQL Single Server Basic tier:
Storage limitation: Maximum 1 TB, far below 10 TB requirement.
Storage type: Standard storage, does not meet Premium SSD requirement.
PITR limitation: Only 7 days, insufficient for the required 35 days.-Conclusion: Fails all three technical requirements.
3. Azure Database for PostgreSQL Hyperscale (Citus)): Meets storage and PITR requirements.
Cost: Designed for distributed workloads, significantly more expensive than General Purpose.
Overkill for single-server deployment; fails the "minimize costs" objective.

References (Microsoft Learn):
Flexible Server compute tiers
https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-compute
Flexible Server storage limits
https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-limits
Flexible Server storage concepts
https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-storage

Box 1: Yes
Azure advisor provides personalized recommendations.
Advisor is a personalized cloud consultant that helps you follow best practices to optimize your Azure deployments. It analyzes your resource configuration and usage telemetry and then recommends solutions that can help you improve the cost effectiveness, performance, Reliability (formerly called High availability), and security of your Azure resources.

Box 2: Yes
Advisor provides recommendations for Application Gateway, App Services, availability sets, Azure Cache, Azure Data Factory, Azure Database for MySQL, Azure Database for PostgreSQL, Azure Database for MariaDB, Azure ExpressRoute, Azure Cosmos DB, Azure public IP addresses, Azure Synapse Analytics, SQL servers, storage accounts, Traffic Manager profiles, and virtual machines.

Box 3: Yes
The Advisor dashboard displays personalized recommendations for all your subscriptions. You can apply filters to display recommendations for specific subscriptions and resource types.

References:
https://learn.microsoft.com/en-us/azure/advisor/advisor-overview

Box 1: Yes
Most services go to private preview then public preview before being released to general availability.
The private preview is only available to certain Azure customers for evaluation purposes. The public preview is available to all Azure customers.

Box 2: No
Azure services in public preview can be managed using the regular management tools: Azure Portal, Azure CLI and PowerShell.

Box 3: No
Services in private or public preview are usually offered at reduced costs. However, the costs increase, not decrease when the services are released to general availability.

Azure Monitor can create Activity Log alerts on administrative actions.
For example, when an administrator stops a VM (deallocate action), Azure Monitor can detect it and send an email, SMS, or trigger other automated actions.-This allows proactive monitoring of critical resources.
Incorrect options:
Azure Advisor: Provides recommendations for cost, performance, security, and reliability.
Does not send real-time alerts for VM actions.
Azure Service Health: Notifies about Azure service outages or planned maintenance.
Does not alert on administrator actions.
Azure Network Watcher: Monitors network connectivity and traffic.
Does not track VM power state changes.
References (Microsoft Learn):
Create Activity Log alerts in Azure Monitor
https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-activity-log
Azure Advisor overview
https://learn.microsoft.com/en-us/azure/advisor/advisor-overview
Azure Service Health overview
https://learn.microsoft.com/en-us/azure/service-health/service-health-overview
Azure Network Watcher overview
https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview

A Local Network Gateway is an object in Azure that represents your on-premise VPN device. A Virtual Network Gateway is the VPN object at the Azure end of the VPN. A 'connection' is what connects the Local Network Gateway an the Virtual Network Gateway to bring up the VPN.

The local network gateway typically refers to your on-premises location. You give the site a name by which Azure can refer to it, then specify the IP address of the on-premises VPN device to which you will create a connection. You also specify the IP address prefixes that will be routed through the VPN gateway to the VPN device. The address prefixes you specify are the prefixes located on your on-premises network. If your on-premises network changes or you need to change the public IP address for the VPN device, you can easily update the values later.

References:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal

Request a standard quota increase from Help + Support

References:
https://docs.microsoft.com/en-us/azure/azure-portal/supportability/per-vm-quota-requests

An Azure virtual machine scale set can automatically increase or decrease the number of VM instances that run your application. This automated and elastic behavior reduces the management overhead to monitor and optimize the performance of your application.

Also: Azure elasticity as a service is referred to a cloud service that enables in automatically scaling Azure hosted resources in par with the demand and configured parameters. It provides Azure Administrators with the ability to auto scale Azure infrastructure and resources as and when needed.

References:
https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-autoscale-overview
https://www.netreo.com/cloud-automation/what-is-azure-elasticity-as-a-service/

A region is a set of data centres deployed within a latency-defined perimeter and connected through a dedicated regional low-latency network.
Microsoft Azure currently has 55 regions worldwide.
Regions are divided into Availability Zones. Availability Zones are physically separate locations within an Azure region. Each Availability Zone is made up of one or more datacenters equipped with independent power, cooling, and networking.

References:
https://azure.microsoft.com/en-gb/global-infrastructure/regions/

Azure App Service is a PaaS web-hosting service that runs applications without managing virtual machines or operating systems.
Azure Storage is also a PaaS service that provides fully managed storage services.

Both services are managed by Microsoft and do not require infrastructure management.
Since no IaaS services (such as virtual machines) are used, the solution complies with the PaaS-only policy.

Incorrect solutions would include: Azure Virtual Machines Self-managed databases Custom operating systems

All of these would violate the PaaS-only requirement.

REFERENCES (Microsoft Learn):

Azure App Service overview
https://learn.microsoft.com/en-us/azure/app-service/overview

Azure Storage introduction
https://learn.microsoft.com/en-us/azure/storage/common/storage-introduction

PaaS definition and examples
https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/strategy/cloud-service-models

IaaS vs PaaS vs SaaS (comparison guide)
https://learn.microsoft.com/en-us/azure/architecture/framework/technology-choices/compute-decision-tree

Azure App Service and Azure SQL databases are examples of Azure PaaS solutions. Therefore, this solution does meet the goal.
**Azure App Service** is a PaaS offering for hosting web apps without managing the VM or OS.
**Azure SQL Database** is a fully managed PaaS database service.
This combination satisfies the requirement to use only PaaS solutions.

Incorrect Options:
1. Azure storage accounts and web server in Azure virtual machines: Using a VM for the web server is **IaaS**, not PaaS.
2. Azure virtual machines, Azure SQL databases, and Azure Storage accounts: Virtual machines are **IaaS**, violating the migration plan requirement.
3. Azure App Service and Azure virtual machines with SQL Server installed: Using a VM for SQL Server is **IaaS**, which is not allowed per the plan.

References:
https://learn.microsoft.com/en-us/azure/architecture/cloud-adoption/ready/saas-paas-iaas
https://learn.microsoft.com/en-us/azure/azure-sql/database/sql-database-paas-overview
https://learn.microsoft.com/en-us/azure/app-service/overview

Azure Budgets allows you to monitor and track costs for Azure resources and subscriptions.

You can set a budget for a specific scope (subscription, resource group, or management group) and receive alerts when spending approaches or exceeds the budgeted amount.
This is the recommended way to track and control Azure costs over time.
Incorrect Options:
Tags: Help organize and categorize Azure resources, but do not track costs directly.
Usage and quotas: Provide information about resource usage limits and consumption but do not provide cost tracking or alerts.
Azure Quickstart templates: Used to deploy resources quickly in Azure; they do not track costs.
References:
https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-acm-create-budgets
https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/cost-analysis-overview

Box 1: No
Authorization to access azure resources can be provided only to azure active directory users. No
Authorization to access Azure resources can be provided by other identity providers by using federation. A commonly used example of this is to federate your on-premises Active Directory environment with Azure AD and use this federation for authentication and authorization.

Box 2: Yes
As described above, third-party cloud services and on-premises Active Directory can be used to access Azure resources. This is known as 'federation'.
Federation is a collection of domains that have established trust. The level of trust may vary, but typically includes authentication and almost always includes authorization. A typical federation might include a number of organizations that have established trust for shared access to a set of resources.

Box 3: Yes
Azure Active Directory (Azure AD) is a centralized identity provider in the cloud. This is the primary built-in authentication and authorization service to provide secure access to Azure resources.

References:
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-fed
https://docs.microsoft.com/en-us/azure/active-directory/develop/authentication-scenarios

Box 1:
Azure Monitor is used to monitor the health of Azure services.
Azure Monitor maximizes the availability and performance of your applications and services by delivering a comprehensive solution for collecting, analyzing, and acting on telemetry from your cloud and on-premises environments. It helps you understand how your applications are performing and proactively identifies issues affecting them and the resources they depend on.

Box 2:
You can browse available virtual machine images in the Azure Marketplace.
Azure Marketplace provides access and information on solutions and services available from Microsoft and their partners. Customers can discover, try, or buy cloud software solutions built on or for Azure. The catalog of 8,000+ listings provides Azure building blocks, such as Virtual Machines (VMs), APIs, Azure apps, Solution Templates and managed applications, SaaS apps, containers, and consulting services.

Box 3.
Azure Advisor displays security recommendations.
Azure Advisor provides you with a consistent, consolidated view of recommendations for all your Azure resources. It integrates with Azure Security Center to bring you security recommendations. You can get security recommendations from the Security tab on the Advisor dashboard.

Security Center helps you prevent, detect, and respond to threats with increased visibility into and control over the security of your Azure resources. It periodically analyzes the security state of your Azure resources. When Security Center identifies potential security vulnerabilities, it creates recommendations. The recommendations guide you through the process of configuring the controls you need.

References:
https://docs.microsoft.com/en-us/azure/azure-monitor/overview
https://docs.microsoft.com/en-us/azure/marketplace/marketplace-faq-publisher-guide
https://docs.microsoft.com/en-us/azure/advisor/advisor-security-recommendations

Azure policies can be used to define requirements for resource properties during deployment and for already existing resources. Azure Policy controls properties such as the types or locations of resources.

Azure Policy is a service in Azure that you use to create, assign, and manage policies. These policies enforce different rules and effects over your resources, so those resources stay compliant with your corporate standards and service level agreements. Azure Policy meets this need by evaluating your resources for non-compliance with assigned policies. All data stored by Azure Policy is encrypted at rest.

Azure Policy offers several built-in policies that are available by default. In this question, we would use the `Allowed Locations' policy to define the locations where resources can be deployed.

References:
https://docs.microsoft.com/en-us/azure/governance/policy/overview

There are different payment options in Azure including pay-as-you-go (PAYG), Enterprise Agreement (EA), and Microsoft Customer Agreement (MCA) accounts.

Your Azure costs are `per subscription'. You are charged monthly for all resources in a subscription. Therefore, to use different payment options per department, you will need to create a separate subscription per department. You can create multiple subscriptions in a single Azure Active Directory tenant.

Incorrect Answers:
A: A reservation is where you commit to a resource (for example a virtual machine) for one or three years. This gives you a discounted price on the resource for the reservation period. Reservations do not provide a way to use different
payment options per department.
C: A resource group is a logical container for Azure resources. You can view the total cost of all the resources in a resource group. However, resource groups do not provide a way to use different payment options per department.
D: A container instance is an Azure resource used to run an application. Container instances do not provide a way to use different payment options per department.

References:
https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/create-subscription

All Azure support plans allow you to open a support request. The difference between plans is the type of support, response times, and access to support engineers.
- Basic: Limited support, includes billing and subscription support.- Developer: Technical support during business hours.- Standard: 24x7 support for production workloads.
Professional Direct: 24x7 support with faster response times and access to ProDirect delivery manager.
Premier: Enterprise-level support with prioritized response and dedicated support resources.
Reasons why other answers are incorrect: Limiting to only Premier and Professional Direct, or Standard and Developer, is incorrect because even the Basic and Developer plans can open support requests, though with different response times and severity levels.

References:
https://azure.microsoft.com/en-us/support/plans/
https://azure.microsoft.com/en-us/support/plans/

The first thing you create in Azure is a subscription. You can think of an Azure subscription as an `Azure account'. You get billed per subscription.
A subscription is an agreement with Microsoft to use one or more Microsoft cloud platforms or services, for which charges accrue based on either a per-user license fee or on cloud-based resource consumption.

Microsoft's Software as a Service (SaaS)-based cloud offerings (Office 365, Intune/EMS, and Dynamics 365) charge per-user license fees.
Microsoft's Platform as a Service (PaaS) and Infrastructure as a Service (IaaS) cloud offerings (Azure) charge based on cloud resource consumption.

You can also use a trial subscription, but the subscription expires after a specific amount of time or consumption charges. You can convert a trial subscription to a paid subscription. Organizations can have multiple subscriptions for Microsoft's cloud offerings.

References:
https://docs.microsoft.com/en-us/office365/enterprise/subscriptions-licenses-accounts-and-tenants-for-microsoft-cloud-offerings

Availability zones expand the level of control you have to maintain the availability of the applications and data on your VMs. Availability Zones are unique physical locations within an Azure region. Each zone is made up of one or more datacenters equipped with independent power, cooling, and networking. To ensure resiliency, there are a minimum of three separate zones in all enabled regions. The physical separation of Availability Zones within a region protects applications and data from datacenter failures.
With Availability Zones, Azure offers industry best 99.99% VM uptime SLA. By architecting your solutions to use replicated VMs in zones, you can protect your applications and data from the loss of a datacenter. If one zone is compromised, then replicated apps and data are instantly available in another zone.

You can use availability zones in azure to protect azure virtual machines from a datacenter failure. Yes
You can use availability zones in azure to protect azure virtual machines from a region failure. No
You can use availability zones in azure to protect azure managed disks from a datacenter failure. Yes

References:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability

Application Insights: An application performance monitoring service that collects telemetry and integrates with Azure Monitor to provide insights into application health, performance, and usage.
Log Analytics: A service that collects and analyzes log data from Azure resources and integrates with Azure Monitor for advanced query and alerting capabilities.

Incorrect Options:

Azure Status: Provides the current health of Azure services globally; it does not integrate directly with Azure Monitor.
Azure Service Health: Provides notifications and guidance about Azure service issues; while it complements Azure Monitor, it is not a data integration point for monitoring.
Azure Advisor: Provides recommendations for cost, performance, and security optimization; it does not provide telemetry data to Azure Monitor.

References:
https://learn.microsoft.com/en-us/azure/azure-monitor/overview
https://learn.microsoft.com/en-us/azure/azure-monitor/insights/application-insights
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-overview

References:
https://docs.microsoft.com/learn/modules/fundamental-azure-concepts/benefits-of-cloud-computing

Azure availability zones are physically separate locations within each Azure region that are tolerant to local failures. Failures can range from software and hardware failures to events such as earthquakes, floods, and fires. Tolerance to failures is achieved because of redundancy and logical isolation of Azure services. To ensure resiliency, a minimum of three separate availability zones are present in all availability zone-enabled regions.

References:
https://docs.microsoft.com/en-us/azure/availability-zones/az-overview

A resource group is a logical container for Azure resources. When you create a resource group, you specify which location to create the resource group in. However, when you create a virtual machine and place it in the resource group, the virtual machine can still be in a different location (different datacenter). Therefore, creating multiple resource groups, even if they are in separate datacenters does not ensure that the services running on the virtual machines are available if a
single data center fails.

References:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview#resource-groups

You must install Azure Cloud Shell on your computer before you can use it. No

Defence in depth layers (from bottom to top): Data
- In almost all cases attackers are after data.
- Data can be in database, stored on disk inside VMs, on a SaaS application such as Office 365 or in cloud storage.
- Those storing and controlling access to data to ensures that it's properly secured
- Often regulatory requirements dictates controls & processes
- to ensure confidentiality, integrity, and availability.
Application
- Ensure applications are secure and free of vulnerabilities.
- Store sensitive application secrets in a secure storage medium.
- Make security a design requirement for all application development.
- Integrate security into the application development life cycle.
Compute
- Secure access to virtual machines.
- Implement endpoint protection and keep systems patched and current.
- Malware, unpatched systems, and improperly secured systems open your environment to attacks.
Networking
- Limit communication between resources.
- Deny by default.
- Allow only what is required
- Restrict inbound internet access and limit outbound, where appropriate.
- Implement secure connectivity to on-premises networks.
Perimeter
- Use distributed denial of service (DDoS) protection to filter large-scale attacks before they can cause a denial of service for end users.
- Use perimeter firewalls to identify and alert on malicious attacks against your network.
Identity and access
- Control access to infrastructure and change control.
- Access granted is only what is needed
- Use single sign-on and multi-factor authentication.
- Audit events and changes.
Physical security
- Building security & controlling access to computing hardware.
- First line of defense.

References:
https://github.com/undergroundwires/Azure-in-bullet-points/blob/master/AZ-900%20Microsoft%20Azure%20Fundamentals/4.2.%20Defence%20in%20Depth.md

Azure files is an example of infrastructure as a service. No

References:
https://azure.microsoft.com/en-gb/overview/what-is-iaas/
https://azure.microsoft.com/en-gb/overview/what-is-paas/
https://azure.microsoft.com/en-gb/overview/what-is-saas/

Azure Information Protection is used to automatically add a watermark to Microsoft Word documents that contain credit card information.

You use Azure Information Protection labels to apply classification to documents and emails. When you do this, the classification is identifiable regardless of where the data is stored or with whom it's shared. The labels can include visual markings such as a header, footer, or watermark.

Labels can be applied automatically by administrators who define rules and conditions, manually by users, or a combination where users are given recommendations. In this question, we would configure a label to be automatically applied to Microsoft Word documents that contain credit card information. The label would then add the watermark to the documents.

References:
https://docs.microsoft.com/en-us/azure/information-protection/what-is-information-protection
https://docs.microsoft.com/en-us/azure/information-protection/infoprotect-quick-start-tutorial

Box 1:
Azure Functions provides the platform for serverless code.
Azure Functions is a serverless compute service that lets you run event-triggered code without having to explicitly provision or manage infrastructure.

Box 2:
Azure Databricks is a big analysis service for machine learning.
Azure Databricks is an Apache Spark-based analytics platform. The platform consists of several components including 'MLib'. Mlib is a Machine Learning library consisting of common learning algorithms and utilities, including classification, regression, clustering, collaborative filtering, dimensionality reduction, as well as underlying optimization primitives.

Box 3:
Azure Application Insights detects and diagnoses anomalies in web apps.
Application Insights, a feature of Azure Monitor, is an extensible Application Performance Management (APM) service for developers and DevOps professionals. Use it to monitor your live applications. It will automatically detect performance anomalies, and includes powerful analytics tools to help you diagnose issues and to understand what users actually do with your app.

Box 4:
Azure App Service hosts web apps.
Azure App Service is an HTTP-based service for hosting web applications, REST APIs, and mobile back ends. You can develop in your favorite language, be it .NET, .NET Core, Java, Ruby, Node.js, PHP, or Python. Applications run and scale with ease on both Windows and Linux-based environments.

References:
https://docs.microsoft.com/en-us/azure/azure-functions/
https://docs.microsoft.com/en-us/azure/azure-databricks/what-is-azure-databricks#apache-spark-based-analytics-platform
https://docs.microsoft.com/en-us/azure/azure-monitor/app/app-insights-overview
https://docs.microsoft.com/en-us/azure/app-service/overview

Box 1: No
Adding more ram to a virtual machine is an example of horizontal scaling. No
Horizontal scaling refers to adding more instances, or removing instances, of resources used by a workload. For example, extending an application from one compute instance to five compute instances. The Microsoft Azure cloud supports automatic horizontal scaling for compute instances, called virtual machines (VMs).

Horizontal scaling is flexible in a cloud situation because you can use it to run a large number of VMs to handle load. In contrast, scaling up and down, or vertical scaling, keeps the same number of resource instances constant but gives them more capacity in terms of memory, CPU speed, disk space, and network.

Box 2: No

Box 3: Yes
Autoscale scales in and out, or horizontally. Scaling horizontally is an increase or decrease of the number of resource instances.

References:
https://learn.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-overview

Corrected Statement:
Data that is stored in the Archive access tier of an Azure Storage account (must be rehydrated before the data can be accessed).

Reasoning:
The **Archive access tier** in Azure Storage is intended for long-term, infrequently accessed data.
Data in the Archive tier is **offline** and must be **rehydrated** to an online tier (Hot or Cool) before it can be read or accessed.
Other options:
"No change is needed" Incorrect. Data cannot be accessed immediately; it must be rehydrated first.
"Can only be read by using Azure Backup" Incorrect. Azure Backup is a separate service; Archive data can be restored via any supported storage access method after rehydration.
"Must be restored before the data can be accessed" Partially correct but vague; the technical term is **rehydration**.

References:
Microsoft Learn: (https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers#archive)
"Data in the Archive tier is offline and cannot be read or modified. To access the data, you must first rehydrate it to the Hot or Cool tier." Microsoft Learn: (https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-rehydration-overview)
"Rehydration is the process of moving data from the Archive tier to an online tier so it can be accessed or read."

Azure pay-as-you-go pricing is an example of capex. No

One of the benefits of zure sql data warehouse is that high availability is built into the platform

RBAC roles: Role-Based Access Control (RBAC) in Azure is used to grant users, groups, or applications specific permissions to Azure resources. For Azure Virtual Desktop, you assign RBAC roles to control access to host pools, application groups, and workspaces. This ensures that only authorized users can manage or access resources.
Incorrect Answers:
Tags: Tags are used for organizing resources and tracking costs; they do not grant access permissions.
Resource groups: Resource groups are containers for Azure resources; they do not control permissions themselves, although you can assign RBAC roles at the resource group level.
Application security groups: These are used to group virtual machines for network security purposes, not for granting access permissions.
https://learn.microsoft.com/en-us/azure/role-based-access-control/overview
https://learn.microsoft.com/en-us/azure/virtual-desktop/manage-rbac

References:
https://docs.microsoft.com/en-us/azure/virtual-desktop/rbac

If the SLA for an Azure service is not met, you receive credits for that service and that service only. The credits are deducted from your monthly bill for that service. If you stopped using the service where the SLA was not met, your account would remain in credit for that service. The credits would not be applied to any other services that you may be using.

Service Credits apply only to fees paid for the particular Service, Service Resource, or Service tier for which a Service Level has not been met. In cases where Service Levels apply to individual Service Resources or to separate Service tiers, Service Credits apply only to fees paid for the affected Service Resource or Service tier, as applicable. The Service Credits awarded in any billing month for a particular Service or Service Resource will not, under any circumstance, exceed your monthly service fees for that Service or Service Resource, as applicable, in the billing month.

References:
https://azure.microsoft.com/en-gb/support/legal/sla/analysis-services/v1_0/

Infrastructure as a service (IaaS) is an instant computing infrastructure, provisioned and managed over the internet. The IaaS service provider manages the infrastructure, while you purchase, install, configure, and manage your own software

Incorrect Answers:
A: Software as a service (SaaS) allows users to connect to and use cloud-based apps over the Internet. Common examples are email, calendaring, and office tools. In this scenario, you need to run your own apps, and therefore require an infrastructure.

B:Platform as a service (PaaS) is a complete development and deployment environment in the cloud. PaaS includes infrastructure--servers, storage, and networking--but also middleware, development tools, business intelligence (BI) services, database management systems, and more. PaaS is designed to support the complete web application lifecycle: building, testing, deploying, managing, and updating.

References:
https://azure.microsoft.com/en-us/overview/what-is-iaas/

Azure Service Health provides a personalized view of the health of the Azure services and regions you're using. This is the best place to look for service impacting communications about outages, planned maintenance activities, and other health advisories because the authenticated Service Health experience knows which services and resources you currently use.

References:
https://docs.microsoft.com/en-us/azure/service-health/overview

Box: for data that is accessed infrequently and stored for at least 30 days Cool tier - An online tier optimized for storing data that is infrequently accessed or modified. Data in the cool tier should be stored for a minimum of 30 days. The cool tier has lower storage costs and higher access costs compared to the hot tier.

Incorrect:
* for data that is accessed rarely, is stored for at least 180 days, ..

References:
https://learn.microsoft.com/en-us/azure/storage/blobs/access-tiers-overview