Microsoft AZ-900 Online Practice Questions and Exam Preparation

Microsoft AZ-900 Online Questions & Answers

• Question 371:

  You have an Azure subscription and 100 Windows 10 devices.

  You need to ensure that only users whose devices have the latest security patches installed can access Azure Active Directory (Azure AD)-integrated applications.

  What should you implement?

  A. a conditional access policy
  B. Azure Bastion
  C. Azure Firewall
  D. Azure Policy
  A. a conditional access policy

  ---

  Conditional Access allows you to control access to Azure AD-integrated applications based on conditions such as device compliance, location, risk, and other signals.

  By integrating with Intune device compliance policies, you can ensure that only devices with up-to-date security patches are granted access.

  Incorrect Options:

  Azure Bastion: Provides secure RDP/SSH access to VMs without exposing them to the public internet; it does not enforce device compliance for application access.

  Azure Firewall: Provides network-level traffic filtering; it cannot enforce device compliance.

  Azure Policy: Enforces governance on Azure resources (like VM configurations or tagging), but does not control user access to applications based on device security patches.

  References:

  https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview

  https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows

  https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device

  https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policies

• Question 372:

  DRAG DROP

  Match the term to the correct definition.

  Instructions: To answer, drag the appropriate term from the column on the left to its description on the right. Each term may be used once, more than once, or not at all.

  NOTE: Each correct match is worth one point.

  Select and Place:

  

  

  Explanation:

  Box 1: ISO

  ISO is the International Organization for Standardization. Companies can be certified to ISO standards, for example ISO 9001 or 27001 are commonly used in IT companies.

  Box 2: NIST

  The National Institute of Standards and Technology (NIST) is a physical sciences laboratory, and a non-regulatory agency of the United States Department of Commerce.

  Box 3: GDPR

  GDPR is the General Data Protection Regulations. This standard was adopted across Europe in May 2018 and replaces the now deprecated Data Protection Directive.

  The General Data Protection Regulation (EU) (GDPR) is a regulation in EU law on data protection and privacy in the European Union (EU) and the European Economic Area (EEA). It also addresses the transfer of personal data outside the EU and EEA areas. The GDPR aims primarily to give control to individuals over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU.

  Box 4: Azure Government

  US government agencies or their partners interested in cloud services that meet government security and compliance requirements, can be confident that Microsoft Azure Government provides world-class security, protection, and compliance services. Azure Government delivers a dedicated cloud enabling government agencies and their partners to transform mission-critical workloads to the cloud. Azure Government services handle data that is subject to certain government regulations and requirements,

  such as FedRAMP, NIST 800.171 (DIB), ITAR, IRS 1075, DoD L4, and CJIS. In order to provide you with the highest level of security and compliance, Azure Government uses physically isolated datacenters and networks (located in U.S. only).

  References:

  https://en.wikipedia.org/wiki/National_Institute_of_Standards_and_Technology

  https://en.wikipedia.org/wiki/General_Data_Protection_Regulation

  https://docs.microsoft.com/en-us/azure/azure-government/documentation-government-welcome

• Question 373:

  This question requires that you evaluate the underlined text to determine if it is correct.

  One of the benefits of Azure SQL Data Warehouse is that high availability is built into the platform.

  Instructions: Review the underlined text. If it makes the statement correct, select "No change is needed". If the statement is incorrect, select the answer choice that makes the statement correct.

  A. No change is needed
  B. automatic scaling
  C. data compression
  D. versioning
  A. No change is needed

  ---

  Azure SQL Data Warehouse (now Azure Synapse Analytics) is a fully managed platform as a service (PaaS) that automatically provides high availability.

  High availability is built into the platform, handling hardware failures and node outages without user intervention.

  Other features such as automatic scaling, data compression, or versioning are important, but they do not replace or constitute high availability.

  Microsoft Learn: https://learn.microsoft.com/en-us/azure/synapse-analytics/sql-data-warehouse/sql-data-warehouse-overview

  "Azure Synapse Analytics is a fully managed, scalable, and highly available cloud data warehouse. High availability is built into the platform so that you can focus on data analytics rather than managing infrastructure."

  Microsoft Learn: https://learn.microsoft.com/en-us/azure/synapse-analytics/sql-data-warehouse/sql-data-warehouse-faq#availability

  "Azure Synapse Analytics is designed for high availability by default. The service automatically handles hardware failures and node outages, ensuring minimal disruption to your workload."

  References:

  https://docs.microsoft.com/en-us/azure/sql-data-warehouse/sql-data-warehouse-overview-faq

• Question 374:

  HOTSPOT

  Azure Sentinel uses playbooks to ___________________.

  Select the answer that correctly completes the sentence.

  

  

  Explanation:

  ---

  
  

• Question 375:

  This question requires that you evaluate the underlined text to determine if it is correct.

  Data that is stored in the Archive access tier of an Azure Storage account can be accessed at any time by using azcopy.exe.

  Instructions: Review the underlined text. If it makes the statement correct, select "No change is needed". If the statement is incorrect, select the answer choice that makes the statement correct.

  A. No change is needed.
  B. can only be read by using Azure Backup
  C. must be restored before the data can be accessed
  D. must be rehydrated before the data can be accessed
  D. must be rehydrated before the data can be accessed

  ---

  Corrected Statement:

  Data that is stored in the Archive access tier of an Azure Storage account (must be rehydrated before the data can be accessed).

  Reasoning:

  The **Archive access tier** in Azure Storage is intended for long-term, infrequently accessed data.

  Data in the Archive tier is **offline** and must be **rehydrated** to an online tier (Hot or Cool) before it can be read or accessed.

  Other options:

  "No change is needed" Incorrect. Data cannot be accessed immediately; it must be rehydrated first.

  "Can only be read by using Azure Backup" Incorrect. Azure Backup is a separate service; Archive data can be restored via any supported storage access method after rehydration.

  "Must be restored before the data can be accessed" Partially correct but vague; the technical term is **rehydration**.

  References:

  Microsoft Learn:

  https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers#archive

  "Data in the Archive tier is offline and cannot be read or modified. To access the data, you must first rehydrate it to the Hot or Cool tier."

  Microsoft Learn: https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-rehydration-overview "Rehydration is the process of moving data from the Archive tier to an online tier so it can be accessed or read."

• Question 376:

  HOTSPOT

  Select the answer that correctly completes the sentence.

  

  

  Explanation:

  Azure policies provide organizations with the ability to manage the compliance of azure resources across multiple subsciptions.

• Question 377:

  Your network contains an Active Directory forest. The forest contains 5,000 user accounts.

  Your company plans to migrate all network resources to Azure and to decommission the on-premises data center.

  You need to recommend a solution to minimize the impact on users after the planned migration.

  What should you recommend?

  A. Implement Azure Multi-Factor Authentication (MFA)
  B. Sync all the Active Directory user accounts to Azure Active Directory (Azure AD)
  C. Instruct all users to change their password
  D. Create a guest user account in Azure Active Directory (Azure AD) for each user
  B. Sync all the Active Directory user accounts to Azure Active Directory (Azure AD)

  ---

  To migrate to Azure and decommission the on-premises data center, you would need to create the 5,000 user accounts in Azure Active Directory. The easy way to do this is to sync all the Active Directory user accounts to Azure Active Directory (Azure AD). You can even sync their passwords to further minimize the impact on users. The tool you would use to sync the accounts is Azure AD Connect. The Azure Active Directory Connect synchronization services (Azure AD Connect sync) is a main component of Azure AD Connect. It takes care of all the operations that are related to synchronize identity data between your on-premises environment and Azure AD.

  References: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-whatis

• Question 378:

  HOTSPOT

  An azure policy initiative definition is a ___________________.

  Select the answer that correctly completes the sentence.

  

  

  Explanation:

  Box: collection of policy definitions

  An Azure Policy initiative is a collection of Azure Policy definitions, or rules, that are grouped together towards a specific goal or purpose. Azure initiatives simplify management of your policies by grouping a set of policies together, logically, as a single item.

  Reference:

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/security-policy-concept

• Question 379:

  In the infrastructure as a service (laaS) cloud service model, which two components are the responsibility of the cloud service provider? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

  A. the configuration and maintenance of storage
  B. the installation and configuration of the operating system
  C. maintaining the hardware
  D. the network configuration
  E. physical security of the datacenter infrastructure
  C. maintaining the hardware
  E. physical security of the datacenter infrastructure

  ---

  Infrastructure as a service (IaaS) is a type of cloud computing service that offers essential compute, storage, and networking resources on demand, on a pay-as-you-go basis. IaaS is one of the four types of cloud services, along with software as a service (SaaS), platform as a service (PaaS), and serverless.

  Migrating your organization's infrastructure to an IaaS solution helps you reduce maintenance of on-premises data centers, save money on hardware costs, and gain real-time business insights. IaaS solutions give you the flexibility to scale your IT resources up and down with demand. They also help you quickly provision new applications and increase the reliability of your underlying infrastructure.

  IaaS lets you bypass the cost and complexity of buying and managing physical servers and datacenter infrastructure. Each resource is offered as a separate service component, and you only pay for a particular resource for as long as you need it. A cloud computing service provider like Azure manages the infrastructure, while you purchase, install, configure, and manage your own software - including operating systems, middleware, and applications.

• Question 380:

  HOTSPOT

  You plan to use Azure to host two apps named App1 and App2 The apps must meet the following requirements:

  1. You must be able to modify the code of App1

  2. Administrative effort to manage the operating system of App1 must be minimized.

  3. App2 must run interactively with the operating system of the server. Which type of cloud service should you use for each app?

  

  

  Explanation:

  Box 1: Azure Platform as a service (PaaS)

  Organizations typically use PaaS for these scenarios:

  Development framework. PaaS provides a framework that developers can build upon to develop or customize cloud-based applications. Similar to the way you create an Excel macro, PaaS lets developers create applications using built-in software components. Cloud features such as scalability, high-availability, and multi-tenant capability are included, reducing the amount of coding that developers must do.

  

  Box 2:

  Software as a service (SaaS) allows users to connect to and use cloud-based apps over the Internet. Common examples are email, calendaring, and office tools (such as Microsoft Office 365).

  SaaS provides a complete software solution that you purchase on a pay-as-you-go basis from a cloud service provider. You rent the use of an app for your organization, and your users connect to it over the Internet, usually with a web browser. All of the underlying infrastructure, middleware, app software, and app data are located in the service provider's data center. The service provider manages the hardware and software, and with the appropriate service agreement, will ensure the availability and the security of the app and your data as well. SaaS allows your organization to get quickly up and running with an app at minimal upfront cost.

  Reference:

  https://azure.microsoft.com/en-us/overview/what-is-paas/