Microsoft
Microsoft Azure Fundamentals (AZ-900)
Question 49 of 280Your company manages access to several Software-as-a-Service (SaaS) applications like Salesforce and ServiceNow. They want employees to sign in once and then access all apps without re-entering passwords. Which Microsoft Entra ID feature should the company implement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Single Sign-On (SSO)
Single Sign-On allows users to authenticate once and access multiple applications without re-entering their credentials. Conditional Access evaluates conditions like user risk before granting access, but it does not eliminate the need to sign into each application separately.
Question 50 of 280A company wants to run seasonal workloads in Azure where capacity can automatically expand during peak demand and shrink afterward. Which benefit of cloud computing provides this capability?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Elasticity
Elasticity is the ability to automatically add or remove resources based on current demand, making it ideal for seasonal workloads. High availability keeps services running during outages, while elasticity handles the scaling of compute capacity.
Question 51 of 280Which of the following is NOT an example of Infrastructure as a Service (IaaS) in Azure?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: E. Azure SQL Database
Azure SQL Database is a Platform as a Service offering, meaning Microsoft manages the underlying infrastructure. Virtual machines, networks, and SQL hosted on VMs are IaaS. For the exam, remember that PaaS abstracts OS management away from you.
Question 52 of 280A company hosts a web application on Azure App Service. They're unsure which security tasks are their responsibility and which are Microsoft's. Which action is the company responsible for?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Securing the application code from vulnerabilities
Securing application code remains solely the customer's responsibility, even when utilizing Platform as a Service models. Microsoft actively manages physical datacenters, network isolation, and underlying operating system patching for shared Azure infrastructure.
Question 53 of 280Which Azure pricing option provides significant discounts for committing to a specific amount of resource usage for a 1-year or 3-year term?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Reserved Instances
Azure Reserved Instances provide deep discounts when you commit to a one or three-year term for specific resources. Spot pricing offers unused capacity discounts but lacks guarantees, while Pay-As-You-Go requires no upfront commitment.
Question 54 of 280Which Azure Storage service is best suited for storing unstructured data such as text or binary data?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Azure Blob Storage
Azure Blob Storage is optimized for storing massive amounts of unstructured data, such as text and binary files. Table Storage handles structured data, while Queue and File Storage serve message queues and shared file mounts respectively.
Question 55 of 280Which Azure database service is specifically designed to provide extremely low-latency responses for small, frequent read/write requests?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Cosmos DB
Azure Cosmos DB is correct because it is a globally distributed database optimized for single-digit millisecond latency on fast operations. SQL Database is a strong distractor for relational needs, but Cosmos DB is the definitive exam answer for extreme low latency and high throughput.
Question 56 of 280In what way does Multi-Factor Authentication (MFA) increase the security of a user account?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. It requires the user to possess something like their phone to read an SMS, use a mobile app, or biometric identification.
Multi-Factor Authentication increases account security by requiring an additional verification factor, such as a phone or biometric scan. Single sign-on improves the login experience but does not inherently provide the extra layer of identity proofing that multi-factor authentication does.
Question 57 of 280Which Azure pricing model allows you to pay for compute resources by the second, with no long-term commitment?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Pay-As-You-Go
The Pay-As-You-Go model lets you pay for compute resources by the second without any upfront or long-term commitment. Reserved Instances require a one or three-year commitment to receive a discount, making them less flexible than pay-as-you-go pricing.
Question 58 of 280Which of the following scenarios would Azure Policy be a recommended method for enforcement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Prevent certain Azure Virtual Machine instance types from being used in a resource group
Azure Policy evaluates resources before they are created, allowing you to block specific virtual machine sizes in a resource group. Role-based access control handles user permissions, while Azure Policy focuses on resource configuration and compliance.
Question 59 of 280Which of the following is a disadvantage of using capital expenditures (CapEx) instead of operating expenditures (OpEx)?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. You must wait over a period of years to depreciate that investment on your taxes
Capital expenditures require large upfront investments that must be depreciated over several years on your taxes. Operating expenses are deducted in the same year they occur, making them much more flexible for businesses to manage.
Question 60 of 280A startup is experimenting with Azure but wants to avoid unexpected costs while testing services. They plan to deploy and delete resources frequently. Which statement best describes how Azure charges for resource usage?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Azure charges only for the resources that are provisioned and running.
Azure charges you only for the resources you have provisioned and are actively running. Once you stop or delete a virtual machine, you stop incurring compute charges, which helps teams avoid unnecessary costs during testing.
Question 61 of 280In the Azure portal, where do you browse and acquire third-party virtual machine images and other third-party offers?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Azure Marketplace
The Azure Marketplace is the designated portal for finding, trying, and purchasing third-party applications and virtual machine images. While you pick an image during creation, the marketplace is the actual catalog where you browse and acquire these offers.
Question 62 of 280A company runs two web servers in Azure across different Availability Zones in the same region. Which benefit does this configuration primarily provide?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Fault tolerance against datacenter failure
Deploying resources across different Availability Zones provides fault tolerance by protecting your architecture from a single datacenter failure. Availability zones are distinct physical datacenters within the same Azure region, ensuring high availability.
Question 63 of 280Your company requires a disaster recovery strategy ensuring that if one Azure region becomes unavailable, resources and data remain accessible. How does Azure help meet this requirement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. By replicating data automatically to a paired region within the same geography
Azure pairs regions within the same geography and provides automatic data replication to ensure business continuity if a primary region fails. This regional pairing ensures data residency and compliance while providing a reliable disaster recovery solution.
Question 64 of 280Your organization needs to ensure that all Azure resources comply with internal naming conventions and can only be deployed in approved regions. Which Azure service should you use?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Azure Policy
Azure Policy evaluates resources during creation to enforce rules like region limits and naming conventions. Resource Manager handles the actual deployment but lacks built-in governance controls, making Policy the correct exam choice.
Question 65 of 280Your organization has several teams deploying resources in Azure. You need a way to apply consistent naming conventions and restrict which regions resources can be created in. Which Azure feature should you use?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Azure Policy
Azure Policy evaluates resources during creation to enforce rules like region limits and naming conventions. Azure Advisor recommends cost and performance improvements, while Resource Locks prevent accidental deletion.
Question 66 of 280Your company hosts a global web application that serves large media files and static website assets. Users in different regions report slow loading times. How can Azure Content Delivery Network (CDN) improve performance for these users?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. By caching static content such as images, videos, and scripts at edge locations closer to users
Azure Content Delivery Network caches static content at edge locations closer to users to reduce latency. It handles media files efficiently, whereas resizing compute resources does not address the physical distance.
Question 67 of 280Which cloud service model places the greatest responsibility on the customer for managing the operating system and underlying infrastructure?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. IaaS
Infrastructure as a Service places the greatest management burden on the customer because you control everything above the physical hardware. Software as a Service shifts almost all responsibility to the cloud provider.
Question 68 of 280Which Microsoft cloud service provides Identity-as-a-Service (IDaaS) for authentication, single sign-on, and identity management in Azure?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Microsoft Entra ID
Microsoft Entra ID provides identity and access management capabilities like single sign-on in Azure. Azure Front Door handles web traffic routing rather than authentication or identity management.
Question 69 of 280Which of the following is NOT a typical characteristic of Azure Functions?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. They are designed for long-running backend batch applications that run continuously
Azure Functions are serverless and event-driven, making them unsuitable for long-running batch applications. They scale automatically based on triggers, such as a new file arriving in Azure Storage.
Question 70 of 280What is the Azure Service Level Agreement (SLA) uptime guarantee for two or more Virtual Machines deployed in the same Availability Set?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. 99.95%
Deploying two or more virtual machines in an availability set provides a 99.95% SLA. Availability zones offer a higher 99.99% SLA, so memorize the distinct uptime guarantees for both architectures.
Question 71 of 280Which of the following is an example of a perimeter (network-boundary) security control?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Use a firewall
A firewall is a perimeter security control because it filters traffic crossing the boundary between trusted internal networks and untrusted external networks. Door locks represent physical security, while subnet separation is internal network segmentation.
Question 72 of 280A development team runs test environments in Azure that are used only eight hours per day, Monday through Friday. They want to minimize cost while keeping the environments available during working hours. Which combination of pricing and resource management practices should they use?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Pay-as-you-go pricing with automation to stop VMs after hours
Pay-as-you-go pricing allows billing to stop automatically when virtual machines are deallocated outside working hours. Reserved instances require long-term commitments, while spot virtual machines risk eviction, making both poor choices for reliable testing.
Question 73 of 280Which Azure service lets you automatically scale a group of identical virtual machines (auto-scale from a single instance to many instances) and provides built-in load balancing for those VMs?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Virtual Machine Scale Sets
Virtual machine scale sets automatically manage and scale identical virtual machines while providing built-in load balancing. Standard virtual machines lack native autoscaling, and application gateway handles web traffic routing rather than compute provisioning.
Question 74 of 280An IT administrator wants to ensure that only users in the HR department can access a payroll app registered in Microsoft Entra ID. Which feature should the administrator use?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Conditional Access
Conditional Access policies evaluate group membership and other signals to grant or block application access. While role-based access control manages Azure resource permissions, conditional access specifically secures Microsoft Entra ID application sign-ins.
Question 75 of 280Which free Azure network security feature evaluates traffic entering or leaving a subnet against rule-based filters and allows or denies it?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Network Security Group
Network security groups provide free basic traffic filtering by evaluating custom rules against subnets or network interfaces. Azure firewall is a paid centralized service offering enterprise-scale filtering rather than basic subnet protection.
Question 76 of 280A company wants to forecast its future Azure spending based on planned usage before actually deploying any resources. Which Azure tool should they use?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Azure Pricing Calculator
The Azure Pricing Calculator estimates expected costs for planned deployments before provisioning actual resources. Cost Management tracks ongoing spending for existing resources rather than forecasting future deployment expenses.
Question 77 of 280An organization wants to strengthen sign-in security. They decide that users can log in from managed corporate devices without extra verification, but all other sign-ins must require Multi-Factor Authentication. Which Microsoft Entra ID feature should they configure?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Conditional Access policies based on device state
Conditional Access policies evaluate signals like device state to enforce rules, such as bypassing multi-factor authentication on trusted corporate devices. Identity Protection focuses on real-time risk detection rather than device compliance, making it the wrong tool here.
Question 78 of 280A company needs secure, private communication between its virtual machines in different subnets within the same Azure region. Which Azure component enables this?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Virtual Network (VNet)
An Azure Virtual Network enables secure private communication between resources across different subnets within the same region. A VPN Gateway or ExpressRoute is used for cross-premises connectivity rather than linking subnets locally.
Question 79 of 280A company needs to deploy Azure resources in a specific country to meet local data residency laws while maintaining low latency for users in that area. Which Azure concept allows them to choose the best location for deployment?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Azure Regions
Azure Regions are geographic locations where resources are deployed, allowing companies to meet local data residency laws and reduce latency. Availability Zones protect against datacenter failures but do not dictate geographic data boundaries.
Question 80 of 280Which optional security feature does Azure Application Gateway provide that the Azure Load Balancer does not?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Web Application Firewall (or WAF)
Azure Application Gateway optionally integrates a Web Application Firewall to inspect traffic and protect against common web vulnerabilities. Standard Azure Load Balancer operates at layer four, handling network traffic without application-level threat inspection.
Question 81 of 280An administrator wants to manage Azure resources from a browser without installing any tools locally. They prefer using command-line interfaces like Bash or PowerShell. Which Azure tool should they use?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Azure Cloud Shell
Azure Cloud Shell provides an accessible browser-based shell for managing resources with Bash or PowerShell without local installations. The Azure CLI and PowerShell module require direct installation, making them incorrect for this specific browser scenario.
Question 82 of 280Your company operates in the European Union and must ensure that customer data stored in Azure meets strict privacy and data protection requirements. Which Azure tool or resource helps you understand how Microsoft services comply with global standards such as GDPR and ISO 27001?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Microsoft Purview Compliance Manager
Microsoft Purview Compliance Manager is correct because it tracks compliance status and provides assessments for regulatory standards like GDPR and ISO 27001. Expect Azure Policy as a common distractor, which enforces resource rules but does not generate compliance assessments.
Question 83 of 280What is the primary purpose of Microsoft Purview in Azure?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. To offer a unified data governance solution for managing on-premises, multi-cloud, and SaaS data.
Microsoft Purview is correct because it provides a unified data governance service to discover and manage data across on-premises, multi-cloud, and SaaS environments. Do not confuse this with operational performance monitoring or infrastructure deployment, which handle separate infrastructure tasks.
Question 84 of 280You're using the Azure CLI from a command prompt to manage Azure resources. Which command do you run to sign in interactively to your Azure account using the Azure CLI?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. az login
Running az login is correct because this specific command triggers an interactive browser-based authentication prompt for the Azure CLI. A common exam mistake is guessing variations like az connect, which is an invalid command that the CLI will not recognize.
Question 85 of 280Why is Azure App Services considered Platform as a Service?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. You give Azure the code and configuration, and you have no access to the underlying hardware
Providing code and configuration without hardware access is correct because PaaS abstracts the underlying infrastructure completely, leaving Microsoft to manage it. Options suggesting you patch the OS or select specific VM series contradict the managed nature of PaaS offerings.
Question 86 of 280How do you get access to services in Private Preview mode?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. You must apply to use them.
Private previews require users to apply for access, as Microsoft grants entry selectively to gather feedback. Public previews are open to all, while a service in general availability is fully supported and ready for production use.
Question 87 of 280What is a primary benefit of using a command-line tool (PowerShell or the Azure CLI) instead of the Azure portal?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Automation
Automation is the primary advantage of command-line tools because they allow repetitive deployment tasks to be scripted. The Azure portal provides a visual interface, but manual clicking is slower and prone to human error.
Question 88 of 280An analytics team needs to process and visualize petabytes of structured and unstructured data from IoT devices in near real time. Which Azure service is most appropriate for this scenario?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Azure Synapse Analytics
Azure Synapse Analytics unifies data ingestion and processing for petabytes of data. Azure SQL Database handles traditional relational workloads, while Power BI primarily provides visualization rather than big data processing.
Question 89 of 280Which Azure service should they use to confirm whether Microsoft is aware of an outage in that region and receive alerts automatically if similar incidents occur in the future?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Azure Service Health
Azure Service Health provides personalized alerts and details about regional outages affecting your specific subscriptions. Azure Monitor tracks your individual resource metrics, but it does not confirm Microsoft's underlying infrastructure incidents.
Question 90 of 280Which concept describes the ability to run your applications and access data in another environment quickly after an outage or failure?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Business Continuity / Disaster Recovery (BC/DR)
Business Continuity and Disaster Recovery focuses on keeping applications running and data accessible during regional outages or failures. Reproducible deployments simply standardize infrastructure creation but do not inherently provide rapid failover during unexpected downtime.
Question 91 of 280Administrators use Remote Desktop Protocol (RDP) to access Windows VMs and SSH to access Linux VMs. What is the recommended approach to secure these management protocols in Azure?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Do not allow public Internet access over the RDP and SSH ports directly to the server. Instead use a secure server like Bastion to control access to the servers behind.
Using Azure Bastion is correct because it provides secure RDP and SSH access directly from the Azure portal without exposing VMs to the public internet. While strong passwords are helpful, preventing direct public internet access via a managed jumpbox is the primary security best practice.
Question 92 of 280What is the service level agreement for two or more Azure Virtual Machines that have been manually placed into different Availability Zones in the same region?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. 99.99%
The 99.99 percent option is correct because placing VMs across different Availability Zones protects against entire datacenter failures and yields the highest standard VM uptime. Memorize this exact figure, as a single VM with premium storage only provides a 99.9 percent uptime guarantee.
Question 93 of 280If you are a US federal, state, local, or tribal government entity or their solution providers, which Azure option should you be looking to register for?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Azure Government
Azure Government is correct because it is a dedicated cloud environment built to meet strict US government compliance requirements like FedRAMP and CJIS. The standard Azure Public Portal lacks the necessary regulatory certifications and physical isolation required for these entities.
Question 94 of 280What would be a good reason to have multiple Azure subscriptions?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. There is one person/credit card paying for resources, but many people who have accounts in Azure, and you need to separate out resources between clients so that there is absolutely no chance of resources being exposed between them.
Using multiple subscriptions provides strict isolation for environments when multiple users need access. Resource groups only organize logically, but subscriptions act as boundaries for management and security.
Question 95 of 280Which of the following is a good example of a Hybrid cloud?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. A server runs in your own environment, but places files in the cloud so that it can extend the amount of storage it has access to.
A hybrid cloud explicitly combines public cloud resources with on-premises private infrastructure. A mobile app using a cloud database simply represents a public cloud consumption model rather than a true integrated hybrid environment.
Question 96 of 280Besides Azure Service Health, where else can you find information about issues affecting the Azure global network that affect you?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Each Virtual Machine has a Resource Health blade
The Resource Health blade inside individual virtual machines displays personalized status updates regarding underlying platform issues. Unlike general blogs, it specifically confirms if your current resource is impacted by global networking problems.
Study on mobile
Get CertPunch for iOS or Android.