Microsoft AZ-900 Online Practice Questions and Exam Preparation

Microsoft AZ-900 Online Questions & Answers

• Question 51:

  What is the most severe failure from which an Azure Availability Zone can be used to protect access to Azure service?

  A. a physical server failure
  B. an Azure region failure
  C. a storage failure
  D. an Azure data center failure
  D. an Azure data center failure

  ---

  Availability zones expand the level of control you have to maintain the availability of the applications and data on your VMs. An Availability Zone is a physically separate zone, within an Azure region. There are three Availability Zones per supported Azure region.

  Each Availability Zone has a distinct power source, network, and cooling. By architecting your solutions to use replicated VMs in zones, you can protect your apps and data from the loss of a datacenter. If one zone is compromised, then replicated apps and data are instantly available in another zone.

  https://docs.microsoft.com/en-us/azure/virtual-machines/availability

• Question 52:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  Explanation:

  Box 1: Yes

  Azure advisor provides personalized recommendations.

  Advisor is a personalized cloud consultant that helps you follow best practices to optimize your Azure deployments. It analyzes your resource configuration and usage telemetry and then recommends solutions that can help you improve the cost effectiveness, performance, Reliability (formerly called High availability), and security of your Azure resources.

  Box 2: Yes

  Advisor provides recommendations for Application Gateway, App Services, availability sets, Azure Cache, Azure Data Factory, Azure Database for MySQL, Azure Database for PostgreSQL, Azure Database for MariaDB, Azure ExpressRoute, Azure Cosmos DB, Azure public IP addresses, Azure Synapse Analytics, SQL servers, storage accounts, Traffic Manager profiles, and virtual machines.

  Box 3: Yes

  The Advisor dashboard displays personalized recommendations for all your subscriptions. You can apply filters to display recommendations for specific subscriptions and resource types.

  Reference:

  https://learn.microsoft.com/en-us/azure/advisor/advisor-overview

• Question 53:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has an Azure subscription that contains the following unused resources:

  1. 20 user accounts in Azure Active Directory (Azure AD)

  2. Five groups in Azure AD

  3. 10 public IP addresses

  4. 10 network interfaces

  You need to reduce the Azure costs for the company.

  Solution: You remove the unused user accounts. Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Removing unused Azure AD user accounts does not reduce Azure costs, because user accounts in Azure AD (Free or included tiers) do not incur charges.

  Resources that contribute to cost in this scenario are public IP addresses and network interfaces, which are billed based on usage or allocation.

  To effectively reduce Azure costs, the company should remove or deallocate unused public IP addresses and network interfaces.

  Unused groups in Azure AD also do not generate costs, so removing them would not affect the bill.

  References: Microsoft Learn:

  https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/cost-management-best-practices

  "To reduce Azure costs, focus on deleting or deallocating unused or underutilized resources that incur charges, such as virtual machines, public IP addresses, and networking resources."-Microsoft Learn:

  https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis

  "Azure Active Directory free user accounts and groups do not generate charges. Costs are typically associated with premium features or consumed services."

  References:

  https://docs.microsoft.com/en-us/azure/advisor/advisor-cost-recommendations#reduce-costs-by-deleting- or-reconfiguring-idle-virtual-network-gateways

• Question 54:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  Explanation:

  Box 1: Yes

  Identities stored in an on-premises active directory can be synchronized to azure active directory.

  The tool you would use to sync the accounts is Azure AD Connect. The Azure Active Directory Connect synchronization services (AzureAD Connect sync) is a main component of Azure AD Connect. It takes care of all the operations that are related to synchronize identity data between your on-premises environment and Azure AD.

  Box 2: Yes

  As described above, third-party cloud services and on-premises Active Directory can be used to access Azure resources. This is known as ~federation TM.

  Federation is a collection of domains that have established trust. The level of trust may vary, but typically includes authentication and almost always includes authorization. A typical federation might include a number of organizations that have established trust for shared access to a set of resources.

  Box 3: Yes

  Azure Active Directory (Azure AD) isacentralized identity provider in thecloud. This isthe primary built-in authentication andauthorization service to provide secure access to Azure resources.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-whatis

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-fed

  https://docs.microsoft.com/en-us/azure/active-directory/develop/authentication-scenarios

• Question 55:

  You need to recommend a service that provides continuous integration and continuous delivery (CI/CD) automation for code deployed to Azure. What should you recommend?

  A. Azure DevOps Pipelines
  B. Azure Virtual Desktop
  C. Azure Stream Analytics
  D. Azure Traffic Manager
  A. Azure DevOps Pipelines

  ---

  Azure DevOps Pipelines automates build, test, and release workflows for CI/CD. The other services do not provide CI/CD functionality.

• Question 56:

  HOTSPOT

  Select the answer that correctly completes the sentence.

  

  

  Explanation:

  You can use Advisor recommendations in Azure to send email alerts when the cost of the current billing period ....

• Question 57:

  Which service provides network traffic filtering across multiple Azure subscriptions and virtual networks?

  A. Azure Firewall
  B. an application security group
  C. Azure DDoS protection
  D. a network security group (NSG)
  A. Azure Firewall

  ---

  You can restrict traffic to multiple virtual networks in multiple subscriptions with a single Azure firewall.

  Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It's a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability.

  You can centrally create, enforce, and log application and network connectivity policies across subscriptions and virtual networks. Azure Firewall uses a static public IP address for your virtual network resources allowing outside firewalls to identify traffic originating from your virtual network.

  References:

  https://docs.microsoft.com/en-us/azure/firewall/overview

• Question 58:

  DRAG DROP

  Match the Azure Services service to the correct description.

  Instructions: To answer, drag the appropriate service from the column on the left to its description on the right. Each service may be used once, more than once, or not at all.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  Explanation:

• Question 59:

  Which service can replace a resource lock automatically if the lock is removed?

  A. Azure Blueprints
  B. Azure Information Protection (AIP)
  C. Azure Backup
  D. Azure Advisor
  A. Azure Blueprints

  ---

  You can protect new resources with Azure Blueprints resource locks.

  With Azure Blueprints resource locks, you can protect newly deployed resources from being tampered with, even by an account with the Owner role. You can add this protection in the blueprint definitions of resources created by an Azure Resource Manager template (ARM template) artifact. The Blueprint resource lock is set during blueprint assignment.

  https://learn.microsoft.com/en-us/azure/governance/blueprints/tutorials/protect-new-resources

• Question 60:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  Explanation:

  Box 1: No

  By creating additional resource groups in an azure subscription, additional costs are incurred.

  Resource groups are logical containers for Azure resources. You do not pay for resource groups.

  Box 2: No

  Data ingress over a VPN is data ~coming in TM to Azure over the VPN. You are not charged data transfer costs for data ingress.

  Box 3: Yes

  Data egress over a VPN is data ~going out TM of Azure over the VPN. You are charged for data egress.

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/manage-resource-groups-portal

  https://azure.microsoft.com/en-us/pricing/details/bandwidth/

  https://azure.microsoft.com/en-us/pricing/details/bandwidth/