Microsoft AZ-900 Online Practice Questions and Exam Preparation

Microsoft AZ-900 Online Questions & Answers

• Question 11:

  DRAG DROP

  You need to complete the defense-in-depth strategy used in a datacenter.

  What should you do? To answer, drag the appropriate layers to the correct positions in the model. Each layer may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  Explanation:

  Defence in depth layers (from bottom to top): Data

  In almost all cases attackers are after data.

  Data can be in database, stored on disk inside VMs, on a SaaS application such as Office 365 or in cloud storage.

  Those storing and controlling access to data to ensures that it's properly secured

  Often regulatory requirements dictates controls and processes

  to ensure confidentiality, integrity, and availability. Application

  Ensure applications are secure and free of vulnerabilities.

  Store sensitive application secrets in a secure storage medium.

  Make security a design requirement for all application development.

  Integrate security into the application development life cycle. Compute

  Secure access to virtual machines.

  Implement endpoint protection and keep systems patched and current.

  Malware, unpatched systems, and improperly secured systems open your environment to attacks. Networking

  Limit communication between resources.

  Deny by default.

  Allow only what is required

  Restrict inbound internet access and limit outbound, where appropriate.

  Implement secure connectivity to on-premises networks. Perimeter

  Use distributed denial of service (DDoS) protection to filter large-scale attacks before they can cause a denial of service for end users.

  Use perimeter firewalls to identify and alert on malicious attacks against your network. Identity and access

  Control access to infrastructure and change control.

  Access granted is only what is needed

  Use single sign-on and multi-factor authentication.

  Audit events and changes. Physical security

  Building security and controlling access to computing hardware.

  First line of defense.

  Reference: https://github.com/undergroundwires/Azure-in-bullet-points/blob/master/AZ-900%20Microsoft%20Azure%20Fundamentals/4.2.%20Defence%20in%20Depth.md

• Question 12:

  You plan to map a network drive from several computers that run Windows 10 to Azure Storage. You need to create a storage solution in Azure for the planned mapped drive.

  What should you create?

  A. an Azure SQL database
  B. a virtual machine data disk
  C. a Files service in a storage account
  D. a Blobs service in a storage account
  C. a Files service in a storage account

  ---

  Azure Files is Microsoft's easy-to-use cloud file system. Azure file shares can be seamlessly used in Windows and Windows Server.

  To use an Azure file share with Windows, you must either mount it, which means assigning it a drive letter or mount point path, or access it via its UNC path.

  Unlike other SMB shares you may have interacted with, such as those hosted on a Windows Server, Linux Samba server, or NAS device, Azure file shares do not currently support Kerberos authentication with your Active Directory (AD) or Azure Active Directory (AAD) identity, although this is a feature we are working on. Instead, you must access your Azure file share with the storage account key for the storage account containing your Azure file share. A storage account key is an administrator key for a

  storage account, including administrator permissions to all files and folders within the file share you're accessing, and for all file shares and other storage resources (blobs, queues, tables, etc) contained within your storage account.

  References:

  https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows

• Question 13:

  HOTSPOT

  Which node in the Azure portal should you use to assign a user the Reader role for a resource group? To answer, select the node in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  The Reader role is an RBAC role. RBAC assignments (Reader, Contributor, Owner, etc.) are configured under:

  Access control (IAM)

  ---

  
  

• Question 14:

  Where does Azure Monitor store performance data?

  A. a Log Analytics workspace
  B. an Azure Storage account
  C. Azure Event Hubs E3
  D. an event subscription
  A. a Log Analytics workspace

  ---

  Azure Monitor collects metrics, logs, and telemetry from Azure resources.

  The data is stored in a Log Analytics workspace for querying, visualization, and alerting.

  Incorrect Options: An Azure Storage account: Can store raw diagnostic logs if configured, but Azure Monitor primarily uses Log Analytics for structured performance data.-Azure Event Hubs: Used for streaming data to external systems, not for storing performance data.-An event subscription: Defines which events from Event Grid are sent to a destination; it is not a storage location.

  References (Microsoft Learn):

  Overview of Azure Monitor

  https://learn.microsoft.com/en-us/azure/azure-monitor/overview

  Log Analytics workspace in Azure Monitor

  https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace

• Question 15:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  

  

  Explanation:

  Box 1: Yes With azure reservations, you play less for virtual machines that with pay-as-you-go pricing.Yes A reservation is where you commit to pay for a resource (for example a virtual machine) for one or three years. This gives you a discounted price on the resource for the reservation period.

  Box 2: No

  There are other factors that influence the cost of a virtual machine such as the virtual hard disks attached to the virtual machine. You could have multiple virtual machines with the same ‘size’ (B2S in this case) but with different virtual hard disk configurations.

  Box 3: Yes

  When a virtual machine is stopped (deallocated), the virtual machine is unloaded/dismounted from the physical server in Azure. In this state, you are not charged for the virtual machine itself. However, you are still charged for the storage costs of the virtual hard disks attached to the virtual machine.

  If the virtual machine is stopped but not deallocated (this happens if you shut down the virtual machine from the operating system of the virtual machine), the virtual machine is still mounted on the physical server in Azure and you are charged for the virtual machine itself as well as the storage costs. To ensure that a virtual machine is ‘stopped (deallocated)’, you need to stop the virtual machine in the Azure portal.

  Reference:

  https://azure.microsoft.com/en-us/reservations/

  https://docs.microsoft.com/en-us/azure/virtual-machines/linux/b-series-burstable

  https://blogs.technet.microsoft.com/uspartner_ts2team/2014/10/10/azure-virtual-machines-stopping-versus-stopping-deallocating/

• Question 16:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company plans to purchase Azure.

  The company's support policy states that the Azure environment must provide an option to access support engineers by phone or email.

  You need to recommend which support plan meets the support policy requirement.

  Solution: Recommend a Standard support plan.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  The Azure Standard plan provides 24/7 access to technical support by email and phone.

  That satisfies the requirement that support engineers must be reachable by phone or email.

  Standard is intended for production-workload environments, appropriate when a company purchases Azure for real use.

  Why not other plans:

  Basic plan only offers billing/subscription support and community/self-help - no technical support by phone or email.

  Developer plan offers email-only support during business hours (no guaranteed phone support), so may not satisfy a policy needing phone contact.

  Higher plans (e.g., Professional Direct) provide additional features - but are not necessary merely to meet the “phone/email support” requirement.

  References:

  Azure Support Plans Comparison

  https://azure.microsoft.com/en-us/support/plans/

  Azure Support: Standard details

  https://azure.microsoft.com/en-us/support/plans/standard

  Azure Support overview (production workload recommendation)

  https://azure.microsoft.com/en-us/support/

• Question 17:

  HOTSPOT

  To complete the sentence, select the appropriate option in the answer area.

  

  

  Explanation:

  Azure site recovery provides disaster recovery for virtual machines.

• Question 18:

  Your company wants to deploy a globally distributed API with automatic failover between regions. Which Azure service should you use?

  A. Azure Front Door
  B. Azure ExpressRoute
  C. Azure Virtual WAN
  D. Azure Bastion
  A. Azure Front Door

  ---

  Azure Front Door provides global HTTP(S) load balancing, routing, accelerated networking, and automatic failover between Azure regions. ExpressRoute, Virtual WAN, and Bastion serve different networking roles.

• Question 19:

  HOTSPOT

  Select the answer that correctly completes the sentence.

  

  

  Explanation:

  Application Insights is a feature of Azure Monitor that provides extensible application performance management (APM) and monitoring for live web apps.

  Application Insights is a feature of azure monitor.

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-monitor/app/app-insights-overview

• Question 20:

  This question requires that you evaluate the underlined text to determine if it is correct.

  Resource groups provide organizations with the ability to manage the compliance of Azure resources across multiple subscriptions.

  Instructions: Review the underlined text. If it makes the statement correct, select "No change is needed". If the statement is incorrect, select the answer choice that makes the statement correct.

  A. No change is needed
  B. Management groups
  C. Azure policies
  D. Azure App Service plans
  B. Management groups

  ---

  Management groups are the Azure feature for managing compliance across multiple subscriptions, while resource groups are logical containers for resources within a single subscription. To manage compliance at scale, organizations should use management groups to apply policies and access controls to a collection of subscriptions. Resource Groups Function: Act as logical containers to group related resources like virtual machines, storage accounts, and web apps that share the same lifecycle,

  permissions, and policies.

  Scope: Limited to a single subscription.

  Compliance: Compliance is managed at the subscription level or for resources within the group, not across multiple subscriptions using only resource groups.

  Management Groups

  Function: Provide a level of governance above subscriptions. They allow you to manage access, policies, and compliance for multiple subscriptions at once.

  Scope: Can contain other management groups and subscriptions, allowing for the creation of a hierarchy.

  Compliance: By applying Azure Policy or role-based access controls at the management group level, you can enforce compliance standards across all subscriptions within that group.

  How they work together

  To effectively manage compliance across multiple subscriptions, you would place your subscriptions under a management group. Then, you would apply a policy or governance standard to that management group, and the policy would be enforced on all subscriptions and their resources within that group. Resource groups still exist within individual subscriptions, but their management is now part of the broader governance applied at the management group level.

  (Management groups) provide organizations with the ability to manage the compliance of Azure resources across multiple subscriptions.

  Reasoning: Management groups allow you to organize multiple Azure subscriptions into a hierarchy for unified management, including policy enforcement and compliance tracking.

  Resource groups are limited to organizing resources within a single subscription and cannot manage compliance across multiple subscriptions.

  Other options: "No change is needed" . Incorrect. Resource groups do not span multiple subscriptions, so they cannot enforce compliance across subscriptions.- "Azure policies" . Partially correct. Azure Policy is used to enforce compliance but must be applied at a scope such as management groups, subscriptions, or resource groups. Policies alone do not provide cross-subscription management without management groups.-"Azure App Service plans" . Incorrect. App Service plans are used to host web

  apps and do not provide compliance management.

  References: Microsoft Learn:

  https://learn.microsoft.com/en-us/azure/governance/management-groups/overview

  "Management groups provide a level of scope above subscriptions. You organize subscriptions into containers called 'management groups' and apply your governance conditions to the management groups."-Microsoft Learn:

  https://learn.microsoft.com/en-us/azure/governance/policy/overview

  "Azure Policy helps enforce organizational standards and assess compliance, and it can be applied at management group scope to span multiple subscriptions."