Microsoft Azure Fundamentals (AZ-900)

Correct answer: D. Azure Virtual Machines

Azure Virtual Machines is an Infrastructure as a Service offering because you manage the operating system and applications while the provider handles the physical hardware. SQL Database and Logic Apps are higher-level services. Remember that IaaS gives you the most control over the OS.

Correct answer: B. Computing resources are available on-demand and can be rapidly provisioned.

Cloud computing relies on rapid provisioning and on-demand resource availability. Users can deploy services quickly without long waits. Options suggesting manual scaling or private restrictions misrepresent the flexible nature of public cloud services.

Correct answer: B. Azure Data Box

Azure Data Box is a physical appliance used to migrate massive datasets to the cloud when internet bandwidth is limited. It provides a secure alternative to online transfers. Azure Migrate handles assessments rather than physical shipping.

Correct answer: C. Subscription

Resource groups are logical containers that exist within a single Azure subscription. Subscriptions serve as the primary boundary for billing and access management. Management groups sit above subscriptions to organize multiple subscriptions together.

Correct answer: C. Denying access to resources to a specific individual

Denying access to a specific individual requires role-based access control, not Azure Policy. Azure Policy enforces compliance by evaluating resource properties and blocking non-compliant deployments. Use Policy for rules and access control for users.

Correct answer: B. Microsoft global network

Global virtual network peering routes traffic over the Microsoft global network backbone. This keeps your data off the public internet, providing lower latency and a more secure path, which is exactly what the exam expects you to identify.

Correct answer: C. Reduced operational costs

Serverless computing reduces operational costs for unpredictable workloads because you only pay for execution time. There is no charge for idle resources. Fixed pricing structures are rarely part of serverless architectures. Look for the consumption billing model.

Correct answer: C. Azure Disks

Azure Disks delivers block-level storage explicitly designed to attach to virtual machines. This provides essential persistent storage for operating systems and data. Blob storage is optimized for unstructured data like text files instead.

Correct answer: B. To add an extra layer of security to user accounts by requiring multiple forms of verification.

Multi-factor authentication adds a critical security layer by demanding multiple verification forms. This ensures that a compromised password alone does not grant account access. It does not necessarily eliminate passwords entirely.

Correct answer: D. Private Cloud

A private cloud delivers dedicated hardware and isolated networking for a single organization. This model provides the strict control and security necessary for compliance. Public clouds are shared, while hybrid clouds mix environments.

Correct answer: D. Management group

Management groups sit above subscriptions in the Azure resource hierarchy, allowing you to manage access, policies, and compliance across multiple subscriptions efficiently. Remember the hierarchy: root management group, management groups, subscriptions, resource groups, and resources.

Correct answer: D. To enable your organization to provide identity and access management for your customers.

Azure Active Directory B2C provides business-to-consumer identity management, letting external customers log into applications using their preferred social or enterprise credentials. This differs from standard Azure AD, which focuses on internal employee identities.

Correct answer: D. App Service Plan

An App Service Plan defines the compute resources and pricing tier used to host your web applications. It dictates the region, operating system, and instance size. Resource groups are logical containers, not compute hosts.

Correct answer: C. The level of control over the infrastructure

The primary difference between Platform as a Service and Infrastructure as a Service is the level of management control you retain. IaaS gives you control over operating systems and applications, while PaaS abstracts the underlying infrastructure entirely.

Correct answer: D. Establishing policies and processes to manage and control Azure resources effectively.

Governance in Azure involves establishing policies and processes to manage and control your resources effectively. This ensures compliance and security. Tools like Azure Policy help enforce these organizational rules across your subscriptions.

Correct answer: D. Shared responsibility

The shared responsibility model defines which security and maintenance tasks are handled by the cloud provider and which are handled by the customer. Responsibilities shift depending on the service type, from IaaS to SaaS.

Correct answer: D. A Denial of Service attack

A Denial of Service attack overwhelms a service with excessive traffic or requests, causing disruption. This is a standard cloud security concept tested in Azure fundamentals.

Correct answer: C. An Azure subscription

An Azure subscription is a logical container used to provision resources and manage billing, not a resource itself. Remember that resources are the actual deployable items like databases or virtual networks.

Correct answer: B. Azure VPN Gateway

Azure VPN Gateway provides the necessary secure connectivity bridge over the internet to an Azure Virtual Network. Virtual Network Peering, on the other hand, only connects two Azure networks directly.

Correct answer: B. Public Cloud

The Public Cloud typically leverages a consumption-based pricing model where users only pay for what they use. Private or on-premises models usually require upfront hardware investments, eliminating true consumption billing.

Correct answer: D. By providing discounts for long-term commitments.

Azure Reserved Instances provide discounts for committing to a specific term length like one or three years, which guarantees cost predictability. Pay-as-you-go pricing fluctuates based on actual usage, preventing predictable billing.

Correct answer: B. To transfer data to and from Azure storage

AzCopy is a command-line utility specifically designed to transfer data efficiently to and from Azure storage. It handles large datasets reliably, unlike general monitoring tools that track resource usage.

Correct answer: D. Password management

Microsoft Defender for Cloud focuses heavily on threat detection, vulnerability assessment, and security posture management. Password management is handled by separate identity tools like Azure Active Directory or password managers.

Correct answer: B. By analyzing resource utilization and identifying underutilized resources

Azure Cost Management analyzes your resource utilization to pinpoint underutilized assets, enabling informed financial optimization. While it can provide forecasts, the core mechanism for finding immediate actionable savings is identifying and right-sizing idle resources.

Correct answer: D. Hybrid Cloud

A hybrid cloud model seamlessly blends public and private environments, letting you keep sensitive patient records secure on-premises or in a private cloud. A purely public or private model lacks the necessary flexibility for these strict, mixed compliance requirements.

Correct answer: D. To deliver virtualized Windows desktops to users

Azure Virtual Desktop delivers remote, virtualized Windows desktops and applications directly to end users over the internet. It is distinct from simple virtual machine management or web app hosting, focusing entirely on end-user desktop-as-a-service scenarios.

Correct answer: C. subnet

A subnet logically divides a virtual network, allowing you to organize, isolate, and secure Azure resources efficiently. Network security groups or IP addresses are applied to these subnets to control traffic, but the division itself is the subnet.

Correct answer: C. Virtual Machine Scale Sets

Virtual Machine Scale Sets let you centrally manage, configure, and automatically scale a large fleet of identical virtual machines. Azure Kubernetes Service is for containers, not managing the base infrastructure of individual virtual machines.

Correct answer: D. To ensure data residency compliance

Sovereign regions, like Azure Government, exist to enforce strict legal data residency and compliance boundaries for specific jurisdictions. They operate independently from standard public regions to meet specialized government or regional regulatory requirements.

Correct answer: B. You must include an additional service such as Load Balancing or Application Gateway

A Virtual Machine Scale Set handles scaling compute resources but relies on integrated services like Azure Load Balancer or Application Gateway to distribute incoming traffic. The scale set itself provisions the instances, while the load balancer routes client requests.

Correct answer: A. Availability zones

Availability zones allow you to deploy virtual machines into distinct, physically separated data centers within an Azure region. While a region sets the geographic boundary, the zone pins the VM to a specific data center for resiliency.

Correct answer: B. Table Storage

Azure Table Storage provides a highly available, low-cost NoSQL key-attribute store for structured, non-relational data. While Cosmos DB also stores non-relational data, Table Storage is the budget-friendly baseline option.

Correct answer: A. Never trust, always verify.

The Zero Trust model operates on the strict rule to never trust and always verify, regardless of whether a request originates from inside or outside the corporate network. This enforces continuous authentication and strict access limits.

Correct answer: B. Management in the cloud

Management in the cloud refers to how you interact with and control your cloud resources programmatically, such as using scripts or APIs. Management of the cloud instead refers to operating the underlying cloud platform itself.

Correct answer: C. By automatically replicating resources across multiple regions or zones

High availability minimizes downtime by automatically replicating resources across multiple regions or zones. This redundancy ensures seamless failover. Limiting resource usage during peak times relates to cost management or throttling, not fault tolerance.

Correct answer: D. ZRS

Zone-redundant storage keeps three copies of your data across three different availability zones in a single region. If a single zone fails, your storage remains accessible. Locally redundant storage keeps copies in a single datacenter.

Correct answer: A. To manage Azure resources including delegating user permissions

The Owner role grants full access to manage all resources, including the ability to assign permissions to other users. The Contributor role also allows full resource management but specifically lacks the ability to delegate access.

Correct answer: C. PaaS

In a Platform as a Service environment, the cloud provider manages the underlying operating system, middleware, and runtime. You focus only on your application code. IaaS options like virtual machines require you to handle operating system maintenance.

Correct answer: A. Yes

Management groups can absolutely be nested to create a hierarchical organizational structure. You can build a tree of management groups and subscriptions to efficiently apply policies and access controls across your entire organization.

Correct answer: A. Scaling out (horizontal scaling)

Scaling out adds more instances of resources like virtual machines to handle increased workloads. Scaling up simply adds more power like CPU or RAM to a single virtual machine, which has hardware limits.

Correct answer: A. Planned downtime

Update domains protect against planned downtime by ensuring Azure updates and restarts virtual machine groups sequentially, never all at once. Fault domains, on the other hand, are the mechanism used to guard against unplanned hardware failures.

Correct answer: A. To minimize the impact of individual component failures.

Fault tolerance relies on redundancy to minimize the operational impact when individual hardware or software components fail. Remember that fault tolerance differs from disaster recovery, which focuses on restoring entire systems after massive regional outages.

Correct answer: B. Availability Zones are physically separate locations within the same Azure region.

Availability Zones are distinct physical data centers within a single Azure region, providing protection against local hardware failures. They do not replicate data across tenants, and regions typically contain three zones, not two.

Correct answer: C. The ability of a system to handle increased workload by adding resources dynamically.

Scalability is the ability of a system to handle increased workload by dynamically adding resources, such as compute or storage. Contrast this with reliability, which measures a system's ability to stay operational and avoid downtime.

Correct answer: A. Extend AD DS to the cloud.

Microsoft Entra Domain Services extends traditional Active Directory Domain Services capabilities to the cloud. It provides managed domain services like domain join and group policy without needing to deploy domain controllers manually.

Correct answer: A. They provide significant cost savings.

Spot instances offer significant cost savings compared to standard pay-as-you-go pricing by utilizing unused Azure capacity. The tradeoff is that Azure can evict them at any time, making option B factually incorrect.