AZ-900 : Microsoft Azure Fundamentals Practice Tests 2025 4 Flashcards
A _____________ endpoint is a network interface that uses a private IP address from your virtual network.
Private
Internal
Hybrid
Public
Private
Explanation:
A private endpoint is a network interface that uses a private IP address from your virtual network. This network interface connects you privately and securely to a service that’s powered by Azure Private Link. By enabling a private endpoint, you’re bringing the service into your virtual network.
The service could be an Azure service such as:
Azure Storage
Azure Cosmos DB
Azure SQL Database
Your own service, using Private Link service.
Which of the following is NOT a benefit of using Azure Arc?
Increased visibility and control over resources
Improved security and compliance for resources
Consistent management of resources across hybrid environments
Centralized billing and cost management for all resources
Centralized billing and cost management for all resources
Explanation:
Azure Arc is a hybrid management service that allows you to manage your servers, Kubernetes clusters, and applications across on-premises, multi-cloud, and edge environments. Some of the benefits of using Azure Arc include consistent management of resources across hybrid environments, improved security and compliance for resources, and increased visibility and control over resources.
Centralized billing and cost management for all resources: Thus is not a benefit of using Azure Arc. While Azure provides centralized billing and cost management for resources in the cloud, Azure Arc is focused on managing resources across hybrid environments and does not provide billing or cost management features.
Other options -
Consistent management of resources across hybrid environments: This is a key benefit of using Azure Arc. With Azure Arc, you can apply policies, monitor and manage resources, and automate tasks across all of your environments, including on-premises, multi-cloud, and edge environments.
Improved security and compliance for resources: This is another benefit of using Azure Arc. Azure Arc allows you to apply security and compliance policies to resources across all of your environments, providing consistent protection against threats and helping you maintain regulatory compliance.
Increased visibility and control over resources: This is also a benefit of using Azure Arc. With Azure Arc, you can gain a unified view of all your resources across hybrid environments, and apply policies, automate tasks, and monitor resources from a single location. This provides greater control and visibility over your entire IT estate.
Which type of scaling focuses on adjusting the capabilities of resources, such as increasing processing power?
Vertical scaling
Static scaling
Elastic scaling
Horizontal scaling
Vertical scaling
Explanation:
Vertical scaling involves adjusting the capabilities of resources, such as adding more CPUs or RAM to a virtual machine. It focuses on enhancing the capacity of individual resources.
With horizontal scaling, if you suddenly experienced a steep jump in demand, your deployed resources could be scaled out (either automatically or manually). For example, you could add additional virtual machines or containers, scaling out. In the same manner, if there was a significant drop in demand, deployed resources could be scaled in (either automatically or manually), scaling in.
_____________________ enforcement is at the center of a Zero Trust architecture.
Identities
Applications
Devices
Data
Security policy
Network
Security policy
Explanation:
Zero Trust is a new security model that assumes breach and verifies each request as though it originated from an uncontrolled network
A Zero Trust approach extends throughout the entire digital estate and serves as an integrated security philosophy and end-to-end strategy.
This illustration provides a representation of the primary elements that contribute to Zero Trust.
In the illustration:
Security policy enforcement is at the center of a Zero Trust architecture. This includes Multi Factor authentication with conditional access that takes into account user account risk, device status, and other criteria and policies that you set.
Identities, devices (also called endpoints), data, applications, network, and other infrastructure components are all configured with appropriate security. Policies that are configured for each of these components are coordinated with your overall Zero Trust strategy. For example, device policies determine the criteria for healthy devices and conditional access policies require healthy devices for access to specific apps and data.
Threat protection and intelligence monitors the environment, surfaces current risks, and takes automated action to remediate attacks.
Which of the following is NOT a feature of Azure Monitor?
Metrics
Database management
Alerts
Log Analytics
Database management
Explanation:
Azure Monitor is a service that provides full-stack monitoring capabilities for applications and infrastructure in Azure. It collects and analyzes telemetry data from a variety of sources, including Azure resources, third-party resources, and custom applications. The key features of Azure Monitor include:
Log Analytics: This feature allows you to collect and analyze log data from various sources, including Azure resources, operating systems, and custom applications. It provides advanced querying and visualization capabilities to help you understand and troubleshoot issues.
Metrics: This feature provides a comprehensive view of the performance and health of your Azure resources, including virtual machines, databases, and web applications. It allows you to set up custom charts and alerts based on specific metrics.
Alerts: This feature enables you to set up notifications for specific conditions or events in your Azure environment, such as high CPU usage, application errors, or security threats. It supports various notification channels, including email, SMS, and webhooks.
Other option -
Database management: This is not a feature of Azure Monitor. There are other Azure services, such as Azure SQL Database and Azure Database for MySQL, that provide database management capabilities.
Which of the following is a benefit of using Azure Cloud Shell for managing Azure resources?
It offers more advanced features than other Azure management tools
It eliminates the need to install and configure command-line interfaces on your local machine
It allows for easier integration with third-party tools and services
It provides faster access to Azure resources
It eliminates the need to install and configure command-line interfaces on your local machine
Explanation:
‘It eliminates the need to install and configure command-line interfaces on your local machine’ is correct because Azure Cloud Shell provides a browser-based command-line interface that allows you to manage your Azure resources without having to install and configure command-line interfaces on your local machine. This makes it easier and more convenient to manage your Azure resources from any device and location.
Other options:
It provides faster access to Azure resources is incorrect because the speed of access to Azure resources is not determined by the management tool used, but rather by factors such as network latency and the size and complexity of the resources being accessed.
It offers more advanced features than other Azure management tools is incorrect because Azure Cloud Shell provides the same set of features as other Azure management tools, such as Azure CLI and Azure PowerShell, and does not offer any advanced features that are not available in other tools.
It allows for easier integration with third-party tools and services is incorrect because the integration of Azure Cloud Shell with third-party tools and services is not any easier or more seamless than the integration of other Azure management tools.
Which of the following scenarios is a suitable use case for applying a resource lock?
Automating the deployment of resources using templates.
Preventing read access to a development virtual machine.
Ensuring a critical storage account is not accidentally deleted.
Restricting network access to an Azure SQL database.
Ensuring a critical storage account is not accidentally deleted.
Explanation:
Using a lock, READ access is never affected. Read below from the official Azure docs:
As an administrator, you can lock an Azure subscription, resource group, or resource to protect them from accidental user deletions and modifications. The lock overrides any user permissions.
You can set locks that prevent either deletions or modifications. In the portal, these locks are called Delete and Read-only. In the command line, these locks are called CanNotDelete and ReadOnly.
CanNotDelete means authorized users can read and modify a resource, but they can’t delete it.
ReadOnly means authorized users can read a resource, but they can’t delete or update it. Applying this lock is similar to restricting all authorized users to the permissions that the Reader role provides.
Reference: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json
Which of the following best describes Azure Arc?
A platform for building microservices-based applications that run across multiple nodes
A bridge that extends the Azure platform to help you build apps with the flexibility to run across datacenters
A cloud-based identity and access management service
A service for analyzing and visualizing large datasets in the cloud
A bridge that extends the Azure platform to help you build apps with the flexibility to run across datacenters
Explanation:
Azure Arc is a service from Microsoft that allows organizations to manage and govern their on-premises servers, Kubernetes clusters, and applications using Azure management tools and services. With Azure Arc, customers can use Azure services such as Azure Policy, Azure Security Center, and Azure Monitor to manage their resources across on-premises, multi-cloud, and edge environments. Azure Arc also enables customers to deploy and manage Azure services on-premises or on other clouds using the same tools and APIs as they use in Azure.
Each zone is made up of one or more datacentres equipped with common power, cooling, and networking.
True
False
False
Explanation:
Azure Availability Zones are unique physical locations within an Azure region and offer high availability to protect your applications and data from datacentre failures. Each zone is made up of one or more datacentres equipped with independent power, cooling, and networking.
Which of the following best describes the concept of “immutable infrastructure” in the context of IaC?
Infrastructure that cannot be changed once deployed.
Infrastructure that is managed through a graphical user interface.
Infrastructure that is stored in a physical data center.
Infrastructure that is recreated rather than modified in place.
Infrastructure that is recreated rather than modified in place.
Explanation:
Immutable infrastructure refers to the practice of recreating infrastructure components whenever changes are needed rather than modifying them in place. This approach aligns with IaC principles, enhancing consistency and reducing configuration drift.
________________ asynchronously replicates the same applications and data across other Azure regions for disaster recovery protection.
Across-Region Replication
Auto-Region Replicas
Cross-region replication
Auto-Region Replication
Cross-region replication
Explanation:
To ensure customers are supported across the world, Azure maintains multiple geographies. These discrete demarcations define a disaster recovery and data residency boundary across one or multiple Azure regions.
Cross-region replication is one of several important pillars in the Azure business continuity and disaster recovery strategy. Cross-region replication builds on the synchronous replication of your applications and data that exists by using availability zones within your primary Azure region for high availability. Cross-region replication asynchronously replicates the same applications and data across other Azure regions for disaster recovery protection.
Some Azure services take advantage of cross-region replication to ensure business continuity and protect against data loss. Azure provides several storage solutions that make use of cross-region replication to ensure data availability. For example, Azure geo-redundant storage (GRS) replicates data to a secondary region automatically. This approach ensures that data is durable even if the primary region isn’t recoverable.
Which of the following authentication protocols is not supported by Azure AD?
SAML
NTLM
OpenID Connect
OAuth 2.0
NTLM
Explanation:
Azure AD does support SAML, OAuth 2.0, and OpenID Connect authentication protocols. However, NTLM is not supported by Azure AD.
NTLM is a legacy authentication protocol that is not recommended for modern authentication scenarios due to its security limitations. Azure AD recommends using modern authentication protocols such as SAML, OAuth 2.0, and OpenID Connect, which provide stronger security and support features such as multi-factor authentication and conditional access.
Therefore, the correct answer is NTLM.
Which type of resource lock allows you to modify the resource, but not delete it?
Restrict lock
CanNotModify lock
Read-only lock
CanNotDelete lock
CanNotDelete lock
Explanation:
As an administrator, you can lock an Azure subscription, resource group, or resource to protect them from accidental user deletions and modifications. The lock overrides any user permissions.
You can set locks that prevent either deletions or modifications. In the portal, these locks are called Delete and Read-only. In the command line, these locks are called CanNotDelete and ReadOnly.
CanNotDelete means authorized users can read and modify a resource, but they can’t delete it.
ReadOnly means authorized users can read a resource, but they can’t delete or update it. Applying this lock is similar to restricting all authorized users to the permissions that the Reader role provides.
Reference: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json
As the Cloud Admin of your organization, you want to Block your employees from accessing your apps from specific locations. Which of the following can help you achieve this?
Azure Role Based Access Control (RBAC)
Azure Active Directory Conditional Access
Azure Sentinel
Azure Single Sign On (SSO)
Azure Active Directory Conditional Access
Explanation:
The modern security perimeter now extends beyond an organization’s network to include user and device identity. Organizations can use identity-driven signals as part of their access control decisions.
Conditional Access brings signals together, to make decisions, and enforce organizational policies. Azure AD Conditional Access is at the heart of the new identity-driven control plane.
Conditional Access policies at their simplest are if-then statements, if a user wants to access a resource, then they must complete an action. Example: A payroll manager wants to access the payroll application and is required to do multi-factor authentication to access it.
You want to ensure that all virtual machines deployed in your Azure environment are configured with specific antivirus software. Which Azure service can you use to enforce this policy?
Azure Security Center
Azure Monitor
Azure Policy
Azure Advisor
Azure Policy
Explanation:
The correct option is Azure Policy. Azure Policy is the service that allows you to enforce organizational standards and compliance across all your resources in Azure. With Azure Policy, you can create policies that enforce specific configurations and settings for resources, including virtual machines, at the time of deployment or during their lifecycle. In this scenario, you can create a policy that enforces the installation of specific antivirus software on all virtual machines, ensuring that all resources in your environment are compliant with your organization’s security requirements.
Azure Advisor provides recommendations to optimize your resources, Azure Security Center helps to identify and remediate potential security threats, and Azure Monitor provides insights into the performance and health of your applications and resources. While these services are useful for monitoring and optimizing your environment, they do not enforce specific policies or configurations on your resources.
Other Options :
Azure Advisor: This service provides recommendations to optimize Azure resources based on best practices, but it does not have the capability to enforce policies.
Azure Security Center: This service focuses on security and threat protection for Azure resources. It provides recommendations to improve security posture and allows for continuous monitoring and alerting of security-related events, but it does not enforce policies related to antivirus software.
Azure Monitor: This service provides real-time monitoring and alerting for Azure resources, but it does not have the capability to enforce policies.
Reference: https://learn.microsoft.com/en-us/azure/governance/policy/overview#azure-policy-objects
What is the maximum number of cloud-only user accounts that can be created in Azure AD?
50,000
100,000
500,000
1,000,000
1,000,000
Explanation:
The correct answer is 1,000,000.
Azure AD has the capability to hold up to 1,000,000 cloud-only user accounts. This limit can be extended further by contacting Microsoft support.
Reference: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/service-limits-restrictions
Which of the following is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) for all of your Azure, On-Premises, AND Multicloud (Amazon AWS and Google GCP) resources?
Azure Sentinel
Azure Key Vault
Microsoft Defender for Cloud
Azure DDoS Protection
Azure Front Door
Microsoft Defender for Cloud
Explanation:
Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) for all of your Azure, on-premises, and multicloud (Amazon AWS and Google GCP) resources. Defender for Cloud fills three vital needs as you manage the security of your resources and workloads in the cloud and on-premises:
Defender for Cloud secure score continually assesses your security posture so you can track new security opportunities and precisely report on the progress of your security efforts.
Defender for Cloud recommendations secures your workloads with step-by-step actions that protect your workloads from known security risks.
Defender for Cloud alerts defends your workloads in real-time so you can react immediately and prevent security events from developing.
Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction
Your company has deployed a web application to Azure, and you want to restrict access to it from the internet while allowing access from your company’s on-premises network. Which Network Security Group (NSG) rule would you configure?
Inbound rule allowing traffic from your company’s on-premises network to the web application’s private IP address.
Outbound rule allowing traffic from any destination to your company’s on-premises network.
Inbound rule allowing traffic from any source to the web application’s public IP address.
Outbound rule allowing traffic from the web application’s private IP address to any destination.
Inbound rule allowing traffic from your company’s on-premises network to the web application’s private IP address.
Explanation:
The correct answer is : Inbound rule allowing traffic from your company’s on-premises network to the web application’s private IP address.
To restrict access to the web application from the internet while allowing access from your company’s on-premises network, you need to create an inbound NSG rule that allows traffic from your company’s on-premises network to the web application’s private IP address. This can be achieved by creating a rule with a source IP address range that matches your company’s on-premises network and a destination IP address range that matches the web application’s private IP address.
Inbound rule allowing traffic from any source to the web application’s public IP address: This is incorrect because it allows traffic from any source, including the internet, to the web application’s public IP address.
Outbound rule allowing traffic from any destination to your company’s on-premises network: This is incorrect because it allows traffic from any destination, including the internet, to your company’s on-premises network, which could be a security risk.
Outbound rule allowing traffic from the web application’s private IP address to any destination: This is incorrect because it allows outbound traffic from the web application’s private IP address to any destination, but does not restrict inbound traffic to the web application.
In the context of Infrastructure as Code (IaC), _________ are independent files, typically containing set of resources meant to be deployed together.
Functions
Modules
Units
Methods
Modules
Explanation:
One of the goals of using code to deploy infrastructure is to avoid duplicating work or creating multiple templates for the same or similar purposes. Infrastructure modules should be reusable and flexible and should have a clear purpose.
Modules are independent files, typically containing set of resources meant to be deployed together. Modules allow you to break complex templates into smaller, more manageable sets of code. You can ensure that each module focuses on a specific task and that all modules are reusable for multiple deployments and workloads.
Is it possible for you to run BOTH Bash and Powershell based scripts from the Azure Cloud shell?
No
Yes
Yes
Explanation:
Azure Cloud Shell is an interactive, authenticated, browser-accessible shell for managing Azure resources. It provides the flexibility of choosing the shell experience that best suits the way you work, either Bash or PowerShell.
Select Cloud Shell.
Select Bash or PowerShell.
Reference : https://docs.microsoft.com/en-us/azure/cloud-shell/overview
Which service would you use to reduce the overhead of manually assigning permissions to a set of resources?
Azure Logic Apps
Azure Policy
Azure Trust Center
Azure Resource Manager
Azure Resource Manager
Explanation:
Azure Resource Manager is the deployment and management service for Azure. It provides a management layer that enables you to create, update, and delete resources in your Azure account. You use management features, like access control, locks, and tags, to secure and organize your resources after deployment.
Which of the following endpoints for a managed instance enables data access to your managed instance from outside a virtual network?
Hybrid
Public
External
Private
Public
Explanation:
Public endpoint for a managed instance enables data access to your managed instance from outside the virtual network. You are able to access your managed instance from multi-tenant Azure services like Power BI, Azure App Service, or an on-premises network. By using the public endpoint on a managed instance, you do not need to use a VPN, which can help avoid VPN throughput issues.
How can you apply a resource lock to an Azure resource?
By configuring a network security group.
By using the Azure portal or Azure PowerShell
By creating a new resource group for the resource.
By assigning a custom role to the resource.
By using the Azure API for RBAC
By using the Azure portal or Azure PowerShell
Explanation:
You can apply a resource lock to an Azure resource using the Azure portal or Azure PowerShell. This allows you to control access and modifications to the resource.
Someone in your organization accidentally deleted an important Virtual Machine that has led to huge revenue losses. Your senior management has tasked you with investigating who was responsible for the deletion. Which Azure service can you leverage for this task?
Azure Arc
Azure Event Hubs
Azure Service Health
Azure Monitor
Azure Advisor
Azure Monitor
Explanation:
Log Analytics is a tool in the Azure portal that’s used to edit and run log queries with data in Azure Monitor (Correct) Logs.
You might write a simple query that returns a set of records and then use features of Log Analytics to sort, filter, and analyze them. Or you might write a more advanced query to perform statistical analysis and visualize the results in a chart to identify a particular trend.
Whether you work with the results of your queries interactively or use them with other Azure Monitor features, such as log query alerts or workbooks, Log Analytics is the tool that you’ll use to write and test them.
Azure Advisor (incorrect) analyzes your configurations and usage telemetry and offers personalized, actionable recommendations to help you optimize your Azure resources for reliability, security, operational excellence, performance, and cost.
Azure Service Health (incorrect) helps you stay informed and take action, with alerts for outages and a personalised dashboard for service issues.
______________ is a security framework that uses the principles of explicit verification, least privileged access, and assuming breach to keep users and data secure while allowing for common scenarios like access to applications from outside the network perimeter.
Less Trust
Least Trust
Zero Trust
No Trust
Zero Trust
Explanation:
Zero Trust is a security framework that does not rely on the implicit trust afforded to interactions behind a secure network perimeter. Instead, it uses the principles of explicit verification, least privileged access, and assuming breach to keep users and data secure while allowing for common scenarios like access to applications from outside the network perimeter.
App developers can improve app security, minimize the impact of breaches, and ensure that their applications meet their customers’ security requirements by adopting Zero Trust principles.
If your organization has many Azure subscriptions, which of the following is useful to efficiently manage access, policies, and compliance for those subscriptions?
Azure Subscriptions
Azure Blueprints
Azure Management Groups
Azure Policy
Azure Management Groups
Explanation:
If your organization has many Azure subscriptions, you may need a way to efficiently manage access, policies, and compliance for those subscriptions. Management groups provide a governance scope above subscriptions. You organize subscriptions into management groups the governance conditions you apply cascade by inheritance to all associated subscriptions.
Management groups give you enterprise-grade management at scale no matter what type of subscriptions you might have. However, all subscriptions within a single management group must trust the same Azure Active Directory (Azure AD) tenant.
For example, you can apply policies to a management group that limits the regions available for virtual machine (VM) creation. This policy would be applied to all nested management groups, subscriptions, and resources, and allow VM creation only in authorized regions.
In a Public Cloud model, you get dedicated hardware, storage, and network devices than the other organizations or cloud “tenants”.
No
Yes
No
Explanation:
Public clouds are the most common type of cloud computing deployment. The cloud resources (like servers and storage) are owned and operated by a third-party cloud service provider and delivered over the internet. With a public cloud, all hardware, software, and other supporting infrastructure are owned and managed by the cloud provider. Microsoft Azure is an example of a public cloud.
In a public cloud, you share the same hardware, storage, and network devices with other organisations or cloud “tenants,” and you access services and manage your account using a web browser. Public cloud deployments are frequently used to provide web-based email, online office applications, storage, and testing and development environments.
Reference: https://azure.microsoft.com/en-ca/resources/cloud-computing-dictionary/what-are-private-public-hybrid-clouds/#deployment-options
A(n) ________________ in Azure Monitor monitors your telemetry and captures a signal to see if the signal meets the criteria of a preset condition. If the conditions are met, an alert is triggered, which initiates the associated action group.
preset condition
alert rule
alert condition
preset rule
alert rule
Explanation:
Alerts help you detect and address issues before users notice them by proactively notifying you when Azure Monitor data indicates that there may be a problem with your infrastructure or application.
You can alert on any metric or log data source in the Azure Monitor data platform.
An alert rule monitors your telemetry and captures a signal that indicates that something is happening on a specified target. The alert rule captures the signal and checks to see if the signal meets the criteria of the condition. If the conditions are met, an alert is triggered, which initiates the associated action group and updates the state of the alert.
_________________ is a strategy that employs a series of mechanisms to slow the advance of an attack that’s aimed at acquiring unauthorized access to information. Each layer provides protection so that if one layer is breached, a subsequent layer is already in place to prevent further exposure.
Defense in Layers
Defense in Depth
Defense in Steps
Defense in Series
Defense in Depth
Explanation:
Defense in depth is a strategy that employs a series of mechanisms to slow the advance of an attack that’s aimed at acquiring unauthorized access to information. Each layer provides protection so that if one layer is breached, a subsequent layer is already in place to prevent further exposure.
Microsoft applies a layered approach to security, both in its physical datacenters and across Azure services. The objective of defense in depth is to protect information and prevent it from being stolen by individuals who aren’t authorized to access it
What is the primary purpose of external identities in Azure Active Directory?
To provide secure access to Azure resources for employees within the organization.
To enable single sign-on between Azure subscriptions.
To manage user identities exclusively for on-premises applications.
To allow external partners and customers to access resources in your Azure environment.
To allow external partners and customers to access resources in your Azure environment.
Explanation:
External identities in Azure AD enable organizations to extend their identity management beyond their own employees. This allows external partners, vendors, and customers to access specific resources within the organization’s Azure environment without requiring them to have internal accounts.
__________________ lets you extend your on-premises networks into the Microsoft cloud over a private connection with the help of a connectivity provider.
Azure Virtual Network
Azure Firewall
Azure Sentinel
Azure ExpressRoute
Azure DNS
Azure ExpressRoute
Explanation:
ExpressRoute lets you extend your on-premises networks into the Microsoft cloud over a private connection with the help of a connectivity provider. With ExpressRoute, you can establish connections to Microsoft cloud services, such as Microsoft Azure and Microsoft 365.
Connectivity can be from an any-to-any (IP VPN) network, a point-to-point Ethernet network, or a virtual cross-connection through a connectivity provider at a colocation facility. ExpressRoute connections don’t go over the public Internet. This allows ExpressRoute connections to offer more reliability, faster speeds, consistent latencies, and higher security than typical connections over the Internet. For information on how to connect your network to Microsoft using ExpressRoute, see ExpressRoute connectivity models.
In the context of Azure networking, what is the purpose of a Network Security Group (NSG) associated with a private endpoint?
To manage IP address assignments for the private endpoint.
To ensure the availability and uptime of the private endpoint.
To encrypt data traffic between the private endpoint and the Azure service.
To enforce access control rules on inbound and outbound traffic to the private endpoint.
To enforce access control rules on inbound and outbound traffic to the private endpoint.
Explanation:
A Network Security Group (NSG) associated with a private endpoint is used to enforce access control rules on the inbound and outbound traffic to the private endpoint. This helps in controlling and restricting the network traffic flow to and from the private endpoint, enhancing security and compliance.
