Microsoft AZ-900 Online Practice Questions and Exam Preparation

Microsoft AZ-900 Online Questions & Answers

• Question 61:

  You need to purchase a third-party virtual security appliance that you will deploy to an Azure subscription.

  What should you use?

  A. Azure subscriptions
  B. Azure Security Center
  C. Azure Marketplace
  D. Microsoft Store
  C. Azure Marketplace

  ---

  You can access these enhanced network security features by using an Azure partner solution. You can find the most current Azure partner network security solutions by visiting the Azure Marketplace, and searching for "security" and "network security." Some third-party reseller services available on Azure Marketplace now consume your Enterprise Agreement (EA) Azure Prepayment balance.

  https://docs.microsoft.com/en-us/azure/security/fundamentals/network-overview https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/ea-azure-marketplace

• Question 62:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  Explanation:

  The total cost of ownership calculator displays the cost of running workloads in a datacenter. Yes

• Question 63:

  What does a customer provide in a software as a service (SaaS) model?

  A. application data
  B. data storage
  C. compute resources
  D. application software
  A. application data

  ---

  SaaS provides a complete software solution which you purchase on a pay-as-you-go basis from a cloud service provider. You rent the use of an app for your organization and your users connect to it over the Internet, usually with a web browser. All of the underlying infrastructure, middleware, app software and app data are located in the service provider's data center. The service provider manages the hardware and software and with the appropriate service agreement, will ensure the availability and the security of the app and your data as well.

  https://azure.microsoft.com/en-in/overview/what-is-saas/

• Question 64:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  Explanation:

  The archive access tier is set at the storage account level. No

  Reference:

  https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers

• Question 65:

  This question requires that you evaluate the underlined text to determine if it is correct.

  When you need to delegate permissions to several Azure virtual machines simultaneously, you must deploy the Azure virtual machines to the same Azure region.

  Instructions: Review the underlined text. If it makes the statement correct, select "No change is needed". If the statement is incorrect, select the answer choice that makes the statement correct.

  A. No change is needed
  B. by using the same Azure Resource Manager template
  C. to the same resource group
  D. to the same availability zone
  C. to the same resource group

  ---

  When you need to delegate permissions to several Azure virtual machines simultaneously, you must deploy the Azure virtual machines to (the same resource group).

  Azure Role-Based Access Control (RBAC) allows you to assign permissions at the subscription, resource group, or individual resource level.

  To delegate permissions to multiple VMs at once, place them in the same resource group and assign the RBAC role to that group.

  Deploying VMs to the same region, availability zone, or using the same ARM template does not automatically allow delegation of permissions.

  Microsoft Learn:

  https://learn.microsoft.com/en-us/azure/role-based-access-control/overview

  "Azure role-based access control (RBAC) helps you manage who has access to Azure resources, what they can do with those resources, and what areas they have access to. You can assign roles at the subscription, resource group, or individual resource level."-Microsoft Learn:

  https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

  "To delegate permissions to multiple resources at once, assign a role to the resource group containing the resources. This applies the role to all resources within that group."

  References:

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview#resource-groups

  https://docs.microsoft.com/en-us/azure/role-based-access-control/overview

• Question 66:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  Explanation:

  Box 1: Yes

  Microsoft defender for cloud can monitor azure resources and on-premises resources.

  Microsoft Defender for Cloud is a solution for cloud security posture management (CSPM) and cloud workload protection (CWP) that finds weak spots across your cloud configuration, helps strengthen the overall security posture of your environment, and can protect workloads across multicloud and hybrid environments from evolving threats.

  You can enable threat protection for workloads running in Azure, AWS, Google Cloud Platform, and on premises.

  Box 2: No

  Defender for Cloud offers a number of enhanced security features that can help protect your organization against threats and attacks.

  *

  Basic security features (Free) - When you open Defender for Cloud in the Azure portal for the first time or if you enable it through the API, Defender for Cloud is enabled for free on all your Azure subscriptions.

  *

  Enhanced security features (Paid) - When you enable the enhanced security features, Defender for Cloud can provide unified security management and threat protection across your hybrid cloud workloads, including:

  Microsoft Defender for Endpoint.

  Etc.

  Box 3: Yes

  From Azure Security Center, you can download a Regulatory Compliance report.

  Reference:

  https://azure.microsoft.com/en-us/products/defender-for-cloud/#overview

• Question 67:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  Explanation:

  Cloud computing offers lower capital expenditure costs than on-premises deployments. Yes

  CapEx (Capital Expenditures): Purchasing an asset (factory, computer system, company car) is considered a capital expenditure. It requires payment for the entire asset, and the cost becomes an entry on the company's balance sheet, depreciated over some period of time. This asset strategy also includes other costs such as upkeep, insurance, and personnel tied to the assets use.

  Reference:

  https://www.archive360.com/blog/capex-or-opex-on-premise-versus-the-cloud-which-saves-more-money

• Question 68:

  What can you use to make recommendations that will reduce Azure costs?

  A. Azure Advisor
  B. Log Analytics
  C. Azure Service Health
  D. the Azure pricing calculator
  A. Azure Advisor

• Question 69:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct select is worth one point.

  

  

  Explanation:

  Box 1: Yes

  You can assign an azure policy to a virtual machine.

  Azure policies can be used to define the desired behavior for your organization's VMs.

  Box 2: No

  If you assign a policy while existing resources are present nothing should happen to them by default, if you are using built in policies.

  If you're assigning a policy from the portal you should see the following statement:

  By default, this assignment will only take effect on newly created resources. Existing resources can be updated via a remediation task after the policy is assigned. For deployIfNotExists policies, the remediation task will deploy the specified template. For modify policies, the remediation task will edit tags on the existing resources.

  Box 3: Yes

  Reference:

  https://learn.microsoft.com/en-us/azure/virtual-machines/security-policy

  https://stackoverflow.com/questions/61607529/what-happens-to-existing-resource-if-it-violates-azure-policy

• Question 70:

  You plan to deploy several Azure virtual machines.

  You need to control the ports that devices on the Internet can use to access the virtual machines.

  What should you use?

  A. a network security group (NSG)
  B. an Azure Active Directory (Azure AD) role
  C. an Azure Active Directory group
  D. an Azure key vault
  A. a network security group (NSG)

  ---

  A network security group works like a firewall. You can attach a network security group to a virtual network and/or individual subnets within the virtual network. You can also attach a network security group to a network interface assigned to a virtual machine. You can use multiple network security groups within a virtual network to restrict traffic between resources such as virtual machines and subnets.

  You can filter network traffic to and from Azure resources in an Azure virtual network with a network security group. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources.

  References: https://docs.microsoft.com/en-us/azure/virtual-network/security-overview