Microsoft AZ-900 Online Practice Questions and Exam Preparation

Microsoft AZ-900 Online Questions & Answers

• Question 161:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  Explanation:

  Most azure services are introduced in private preview before being introduced in public preview, and then in general availability. Yes

• Question 162:

  Your Azure environment contains multiple Azure virtual machines.

  You need to ensure that a virtual machine named VM1 is accessible from the Internet over HTTP.

  What are two possible solutions? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Modify an Azure Traffic Manager profile
  B. Modify a network security group (NSG)
  C. Modify a DDoS protection plan
  D. Modify an Azure firewall
  B. Modify a network security group (NSG)
  D. Modify an Azure firewall

  ---

  A network security group works like a firewall. You can attach a network security group to a virtual network and/or individual subnets within the virtual network. You can also attach a network security group to a network interface assigned to a virtual machine. You can use multiple network security groups within a virtual network to restrict traffic between resources such as virtual machines and subnets.

  You can filter network traffic to and from Azure resources in an Azure virtual network with a network security group. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources.

  In this question, we need to add a rule to the network security group to allow the connection to the virtual machine on port 80 (HTTP).

  https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

• Question 163:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true, Otherwise, select No.

  NOTE: Each correct match is worth one point.

  

  

  Explanation:

  The microsoft service trust portal can be accessed by using a microsoft cloud services account. Yes.

• Question 164:

  Your company has an on-premises network that contains multiple servers.

  The company plans to reduce the following administrative responsibilities of network administrators:

  1. Backing up application data

  2. Replacing failed server hardware

  3. Managing physical server security

  4. Updating server operating systems

  5. Managing permissions to shared documents

  The company plans to migrate several servers to Azure virtual machines.

  You need to identify which administrative responsibilities will be eliminated after the planned migration.

  Which two responsibilities should you identify? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Replacing failed server hardware
  B. Backing up application data
  C. Managing physical server security
  D. Updating server operating systems
  E. Managing permissions to shared documents
  A. Replacing failed server hardware
  C. Managing physical server security

  ---

  Azure virtual machines run on Hyper-V physical servers. The physical servers are owned and managed by Microsoft. As an Azure customer, you have no access to the physical servers. Microsoft manage the replacement of failed server hardware and the security of the physical servers so you don't need to.

  Incorrect Answers:

  B: Microsoft have no control over the applications you run on the virtual machines. Therefore, it is your responsibility to ensure that application data is backed up.

  D: Microsoft do not manage the operating systems you run on the virtual machines. Therefore, it is your responsibility to ensure that the operating systems are updated.

  E: Microsoft have no control over the shared folders you host on the virtual machines. Therefore, it is your responsibility to ensure that folder permissions are configured appropriately.

  https://learn.microsoft.com/azure/security/fundamentals/shared-responsibility Azure Virtual Machines Overview: https://learn.microsoft.com/azure/virtual-machines/overview Physical Security in Azure Datacenters: https://learn.microsoft.com/azure/security/fundamentals/physical-security VM Operating System Responsibilities: https://learn.microsoft.com/azure/virtual-machines/maintenance-and-updates Azure Backup Overview: https://learn.microsoft.com/azure/backup/backup-overview

• Question 165:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  

  

  Explanation:

  Availability zones can be implemented in all azure regions. no

• Question 166:

  This question requires that you evaluate the underlined text to determine if it is correct.

  Azure Germany can be used by legal residents of Germany only.

  Instructions: Review the underlined text. If it makes the statement correct, select "No change is needed". If the statement is incorrect, select the answer choice that makes the statement correct.

  A. no change is needed
  B. only enterprises that are registered in Germany
  C. only enterprises that purchase their azure licenses from a partner based in Germany
  D. any user or enterprise that requires its data to reside in Germany
  D. any user or enterprise that requires its data to reside in Germany

  ---

  Azure Germany is available to eligible customers and partners globally who intend to do business in the EU/EFTA, including the United Kingdom.

  Azure Germany offers a separate instance of Microsoft Azure services from within German datacenters. The datacenters are in two locations, Frankfurt/Main and Magdeburg. This placement ensures that customer data remains in Germany and that the datacenters connect to each other through a private network. All customer data is exclusively stored in those datacenters. A designated German company--the German data trustee--controls access to customer data and the systems and infrastructure that

  hold customer data.

  References:

  https://docs.microsoft.com/en-us/azure/germany/germany-welcome?toc=%2fazure%2fgermany%2ftoc.json

  https://docs.microsoft.com/en-us/azure/germany/germany-overview-data-trustee

• Question 167:

  DRAG DROP

  Match the Azure service to the correct description.

  Instructions: To answer, drag the appropriate Azure service from the column on the left to its description on the right. Each service may be used once, more than once, or not at all.

  NOTE: Each correct match is worth one point.

  Select and Place:

  

  

  Explanation:

  Box 1: Azure SQL Database

  SQL Server is a relational database service. Azure SQL Database is a managed SQL Server Database in Azure. The SQL Server is managed by Microsoft; you just have access to the database.

  Box 2: Azure SQL Data Warehouse

  Azure SQL Data Warehouse (SQL DW) is a cloud-based Platform-as-a-Service (PaaS) offering from Microsoft. It is a large-scale, distributed, MPP (massively parallel processing) relational database technology in the same class of competitors as Amazon Redshift or Snowflake. Azure SQL DW is an important component of the Modern Data Warehouse multi-platform architecture. Because Azure SQL DW is an MPP system with a shared-nothing architecture across distributions, it is meant for large-scale

  analytical workloads which can take advantage of parallelism.

  Box 3: Azure Data Lake Analytics

  You can process big data jobs in seconds with Azure Data Lake Analytics. You can process petabytes of data for diverse workload categories such as querying, ETL, analytics, machine learning, machine translation, image processing and sentiment analysis by leveraging existing libraries written in .NET languages, R or Python.

  Box 4: Azure HDInsight.

  Apache Hadoop was the original open-source framework for distributed processing and analysis of big data sets on clusters. The Hadoop ecosystem includes related software and utilities, including Apache Hive, Apache HBase, Spark, Kafka, and many others.

  Azure HDInsight is a fully managed, full-spectrum, open-source analytics service in the cloud for enterprises. The Apache Hadoop cluster type in Azure HDInsight allows you to use HDFS, YARN resource management, and a simple MapReduce programming model to process and analyze batch data in parallel.

  References:

  https://azure.microsoft.com/en-us/services/sql-database/

  https://docs.microsoft.com/en-us/azure/sql-data-warehouse/sql-data-warehouse-overview-what-is

  https://docs.microsoft.com/bs-latn-ba/azure/hdinsight/hadoop/apache-hadoop-introduction

  https://www.blue-granite.com/blog/is-azure-sql-data-warehouse-a-good-fit-updated

  https://azure.microsoft.com/en-gb/services/data-lake-analytics/

• Question 168:

  Your company uses management groups to manage resources in your Azure tenant more efficiently.

  User1 should be able to assign access and assign policies to management groups.

  You need to determine to which role-based access control (RBAC) role User1 should be added.

  Your solution should follow the principle of least privilege. To which role should you add User1?

  A. Owner
  B. User Access Administrator
  C. Management Group Contributor
  D. Contributor
  B. User Access Administrator

  ---

  User Access Administrator allows managing user access to Azure resources, including assigning roles and policies to management groups.

  Follows the principle of least privilege by granting only necessary permissions for access and policy management.

  Incorrect Options:

  Owner: Full control over all resources, including deleting resources.-Exceeds minimum permissions; violates least privilege.

  Use the PowerApps portal: Not an RBAC role; cannot assign access or policies.

  Management Group Contributor:

  Can create/manage management groups but cannot assign access or policies.

  Contributor:

  Can create/manage resources but cannot manage access or assign policies.

  References (Microsoft Learn):

  Azure RBAC built-in roles

  https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

  This is reflected in the “management group access” chart.

  References:

  Management Groups Overview (includes role permission table)

  https://learn.microsoft.com/en-us/azure/governance/management-groups/overview

  Elevate Access (explains User Access Administrator at root scope)

  https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin

• Question 169:

  HOTSPOT

  If a resource group named RG1 has a delete lock, ______________________ can delete RG1.

  Select the answer that correctly completes the sentence.

  

  

  Explanation:

• Question 170:

  Which resources can be used as a source for a Network security group inbound security rule?

  A. Application security groups only
  B. IP Addressess only
  C. Service Tags only
  D. IP Addresses, Service tags and Application security groups
  D. IP Addresses, Service tags and Application security groups

  ---

  NSG inbound rules control which traffic is allowed or denied to resources.-Sources for inbound rules include:

  1.IP Addresses-individual IPs, ranges, or CIDR blocks.

  2.Application Security Groups (ASGs)-logical groups of VMs for simplified management.

  3.Service Tags-predefined Azure services representing IP ranges (e.g., Internet, Storage, VirtualNetwork).-Using any of these sources allows flexible and precise network access control.

  Incorrect Options: Application Security Groups only: NSGs can also use IP addresses and Service Tags; limiting to ASGs is incomplete.-IP Addresses only: NSGs can also use ASGs and Service Tags; limiting to IPs is incomplete.-Service Tags only: NSGs can also use IP addresses and ASGs; limiting to service tags is incomplete.

  References (Microsoft Learn):

  Network security groups overview

  https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

  Create, change, or delete NSG security rules

  https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview#security-rules