Microsoft Azure Fundamentals (AZ-900)

Correct answer: C. To overwhelm and exhaust application resources

A distributed denial of service attack attempts to overwhelm and exhaust application resources, disrupting availability for legitimate users. Tricking users relates to phishing, while extracting data is associated with vulnerabilities like SQL injection.

Correct answer: C. To offer Azure services that comply with specific government regulations and data residency requirements.

Azure Sovereign Regions, such as Azure Government, exist to provide strict compliance with specific government regulations and data residency requirements. They isolate sensitive workloads, unlike standard global regions designed primarily for performance.

Correct answer: A. Azure Key Vault

Azure Key Vault provides secure, centralized storage for cryptographic keys, certificates, and secrets. Hardcoding secrets inside application code creates a massive security risk and violates core cloud security principles.

Correct answer: C. IaaS

Infrastructure as a Service is the easiest cloud model for migrating existing applications using a lift-and-shift strategy. Serverless or Platform as a Service models require code changes to fit their specific architectural designs.

Correct answer: B. Azure Functions App

Azure Functions is a serverless Platform as a Service offering, meaning you do not manage underlying servers. Virtual machines, network interfaces, and virtual networks are categorized as Infrastructure as a Service.

Correct answer: D. Azure VPN Gateway

Azure VPN Gateway provides encrypted connections over the public internet. ExpressRoute is the main distractor, but it uses private, dedicated connections rather than the public internet to establish connectivity.

Correct answer: B. Azure Firewall

Azure Firewall includes threat intelligence-based filtering that automatically blocks traffic to and from known malicious IP addresses and domains. Network Security Groups require manual rule creation and lack built-in threat intelligence.

Correct answer: B. Privileged Identity Management

Privileged Identity Management allows administrators to enforce additional security requirements, like multi-factor authentication, specifically for elevated roles. Standard policies apply broadly to all users, rather than targeting role-based privileges.

Correct answer: D. It provides a pre-configured, browser-based shell for managing Azure resources without requiring local installations.

Azure Cloud Shell provides an accessible, browser-based shell for managing resources without requiring local software installations. The Azure portal provides the graphical interface, whereas Cloud Shell offers command-line access.

Correct answer: C. Separating your application into multiple subnets allows you to have different NSG security rules for each subnet, which can make it harder for a hacker to get from one compromised server onto another.

Segmenting resources into separate subnets allows you to apply distinct Network Security Group rules to each one, limiting lateral movement during an attack. Option B is a distractor; while subnets do have IP limits, security isolation is the primary architectural driver for deploying multi-tier applications.

Correct answer: A. Management Groups

Management groups are organizational containers used to manage access, policy, and compliance across multiple Azure subscriptions. Remember the Azure hierarchy: resources sit inside resource groups, which sit inside subscriptions, which are then nested inside management groups.

Correct answer: D. It enables users to access virtualized desktops and applications from anywhere, on any device.

Azure Virtual Desktop provides remote access to virtualized desktops and applications from almost any device. While other options describe valid Azure services, only this choice directly matches the core functionality of AVD.

Correct answer: A. Azure Advisor

Azure Advisor evaluates your Azure resources and provides personalized recommendations for cost, security, performance, and reliability. Azure Monitor tracks health and alerts, but it does not generate optimization recommendations.

Correct answer: D. Providing a centralized identity management solution for hybrid cloud environments.

Microsoft Entra ID is an enterprise identity and access management service that centralizes user sign-in for cloud and hybrid environments. The other options describe data, compute, and monitoring services that do not manage identities.

Correct answer: C. You must select a region when creating most resources, and the region is the area of the world where those resources will be physically located.

A region represents a specific physical geographic location where your Azure resources are deployed. While you can use multiple regions, they are not just organizational folders like resource groups.

Correct answer: D. Autoscaling of virtual machines · E. Load balancing between virtual machines

Virtual Machine Scale Sets natively provide automatic scaling and load balancing across identical virtual machines. You must still manually configure the operating system and deploy custom code to these underlying machines.

Correct answer: D. AD Connect

Microsoft Entra Connect, formerly Azure AD Connect, synchronizes your on-premises identities directly to the cloud. Federation Services or Domain Services serve different purposes and do not handle this core synchronization task.

Correct answer: B. Azure AI services (formerly Cognitive Services)

Azure AI services provide prebuilt application programming interfaces for capabilities like image recognition and voice processing. Azure Machine Learning Studio is a workspace for data scientists building custom models from scratch.

Correct answer: A. Azure Advisor

Azure Advisor evaluates your Azure resources and provides recommendations to improve cost, security, performance, and reliability. Azure Service Health is a strong distractor, but it tracks outages and maintenance rather than providing optimization suggestions.

Correct answer: A. Configuration · C. Packaged code

Azure App Service is a platform as a service offering where you deploy your packaged code and configuration. Microsoft handles the underlying operating system, networking, and infrastructure updates. Database scripts are separate data components.

Correct answer: B. Application gateway understands the HTTP protocol and can interpret the URL and make decisions based on the URL.

Application Gateway is a layer seven load balancer capable of inspecting HTTP requests and making routing decisions based on URL paths. Standard Azure Load Balancers operate at layer four and route traffic based solely on IP addresses and ports.

Correct answer: B. It is the level at which services are billed. All resources created under a subscription are billed to that subscription.

An Azure subscription acts as a logical container that groups resources and establishes billing boundaries. Any resources deployed within a specific subscription generate charges billed directly to that subscription's payment method.

Correct answer: C. Trust Center

The Microsoft Trust Center is the designated destination for reviewing compliance standards that Microsoft adheres to across its cloud services. While Azure Service Center or Microsoft Defender for Cloud help manage your specific resources, they do not host the overarching official compliance certification reports.

Correct answer: B. You have to apply to get selected in order to use that service

Private Preview features require an application process and explicit approval before they can be accessed. Remember the progression: public previews are open to everyone, while general availability guarantees production support and service level agreements.

Correct answer: C. A refrigerator that monitors how much milk you have left and sends you a text message when you are running low

An Internet of Things device is specialized hardware with sensors that collects data and interacts with the physical world, like a smart appliance. Standard computing devices such as laptops, mobile phones, or virtual machines hosting web applications do not count as IoT devices.

Correct answer: D. The ability to group policies together

An initiative in Azure Policy is simply a collection of individual policy definitions grouped together for easier management and assignment. This concept is highly similar to how resource groups bundle individual resources, rather than dictating specific permissions or tags.

Correct answer: A. You can save money. · D. You can serve users better during peak traffic periods by automatically adding more capacity.

Elasticity provides cost savings by automatically scaling resources down during low demand, while ensuring performance by automatically scaling up during peak traffic. It is distinct from high availability, which focuses on uptime and surviving hardware failures rather than dynamic capacity adjustments.

Correct answer: A. You need to avoid single points of failure

High availability requires eliminating single points of failure through redundancy so that an individual component failure does not bring down the entire application. Although having backups is good practice, merely keeping a standby copy does not prevent an initial outage.

Correct answer: D. All services are stopped and you must decide whether you want to convert to a paid account or not.

When you exhaust your free trial credit, Azure disables your resources and stops the services to prevent unexpected charges. You must upgrade to a paid tier to restart them, as Azure will not bill you automatically.

Correct answer: A. Both users and Azure have responsibilities for security.

The shared responsibility model means Microsoft secures the cloud infrastructure while the customer secures what they put in the cloud. The exact division of duties depends entirely on the service model, whether it is IaaS, PaaS, or SaaS.

Correct answer: B. Azure Container Instances

Azure Container Instances lets you run a container directly without provisioning or managing underlying virtual machines. While Azure Kubernetes Service also handles infrastructure, it is designed for complex orchestration rather than simple execution.

Correct answer: A. 4

An uptime of 99.99 percent allows for roughly 4.32 minutes of downtime per month, making 4 minutes the correct approximation. Remembering the 9s scale helps quickly calculate acceptable SLA downtime during the exam.

Correct answer: B. Azure Monitor

Azure Monitor collects and analyzes telemetry from your environment, letting you set alerts for specific actions like virtual machine creation. Azure Policy enforces compliance rules, but it is not the native alerting tool.

Correct answer: B. Implement the Azure spending limit in the Account Center

Spending limits suspend your subscription when you hit the cap, preventing surprise overages. Billing alerts are great for notifications, but they do not automatically stop services from running once the threshold is reached.

Correct answer: B. You will be financially refunded a small amount of your monthly fee

If Azure fails to meet its Service Level Agreement, you receive service credits as a small financial refund. The exact refund percentage varies depending on the specific service and the severity of the outage.

Correct answer: C. 750 hrs

The free account provides exactly 750 hours of B1S virtual machine usage per month for the first year. This hour allotment allows you to run a single instance continuously throughout the entire month.

Correct answer: C. Role

The acronym RBAC stands for role-based access control. For the exam, remember that RBAC manages access to Azure resources through role assignments rather than individual user rules or blanket permissions.

Correct answer: B. Azure Service Health

Azure Service Health alerts you to issues affecting Azure itself, such as regional outages. Azure Monitor is a strong distractor, but it focuses strictly on metrics and logs for your specific resources.

Correct answer: E. Windows and Linux

Azure Virtual Machines support both Windows and Linux operating systems. macOS is not supported as a host operating system, so options including it can be eliminated immediately on the exam.

Correct answer: D. JSON

ARM templates are written in JSON, allowing declarative infrastructure deployment. While YAML is used for other deployment methods like pipelines or Bicep serialization, standard ARM templates specifically rely on JSON.

Correct answer: A. TRUE

Features in general availability are fully supported by Microsoft support channels and include service level agreements. Preview features lack full support, so they should never be used in critical production environments.

Correct answer: D. It requires the user to have access to their verified phone in order to log in

Multi-factor authentication increases security by requiring an additional verification factor, such as a code sent to a verified phone. This layered approach stops unauthorized access even if a primary password gets compromised by an attacker.

Correct answer: B. A list of standards that Microsoft follows, pen test results, security assessments, white papers, faqs, and other documents that can be used to show Microsoft's compliance efforts

The Service Trust Portal provides compliance documentation such as audit reports, white papers, and penetration tests. Do not confuse this with Microsoft Defender for Cloud, which provides actionable recommendations about your own specific Azure usage and resource configurations.

Correct answer: A. TRUE

The Azure public cloud is universally accessible, allowing anyone to sign up with a valid credit card and deploy services immediately. This open availability contrasts directly with private clouds, which restrict access to a single organization's internal users.

Correct answer: B. 99.95%

Two or more virtual machines placed in the same Availability Set are protected against localized hardware failures and provide a 99.95 percent uptime guarantee. For the exam, associate 99.99 percent specifically with Availability Zones, which rely on separate physical datacenters.

Correct answer: C. Assurance that your code, data and applications are running on isolated hardware, and on an isolated network.

A private cloud provides isolation by running your workloads on dedicated hardware and networks. It is generally more expensive than the public cloud, making the cheaper cost option an incorrect distractor.

Correct answer: A. A folder structure in Azure in which you organize resources like databases, virtual machines, virtual networks, or almost any resource

Resource groups act as logical containers to organize and manage related resources like databases and virtual machines. They are not automatically generated by type, nor are they security groups used for user permissions.

Correct answer: A. Reduced upfront capital expenditure (CapEx) by paying only for what you use.

Using cloud services reduces upfront capital expenditure by shifting to a pay-as-you-go model. Fixed costs are a strong distractor, but cloud pricing intentionally varies based on actual service consumption.