Azure Fundamentals (AZ-900) — All Questions

Which statement about moving Azure resources between resource groups is TRUE?

• a.Many resources can be moved, though some have restrictions✓
• b.It permanently deletes the resource being moved
• c.It always changes the region the resource runs in
• d.It is completely impossible for any type of Azure resource under all conditions

Many resources can be moved between resource groups or subscriptions, but some services have limitations. Moving does not change the resource's region. Always check move support before relying on it.

Azure Dedicated Host provides…

• a.a managed NoSQL database for global apps
• b.physical servers dedicated to a single customer's VMs✓
• c.global DNS-based traffic routing
• d.serverless event-driven functions that scale automatically with incoming demand

Azure Dedicated Host gives you physical servers dedicated to your organization's VMs. This supports compliance, licensing, and isolation requirements. You gain visibility and control over the underlying hardware.

Azure App Service can host web apps built in…

• a.only low-level assembly language compiled directly for the host processor
• b.no programming languages at all
• c.multiple languages such as .NET, Java, Node.js, Python, and PHP✓
• d.only the COBOL programming language

App Service supports many popular languages and frameworks, including .NET, Java, Node.js, Python, and PHP. It manages the hosting platform for you. This flexibility suits diverse web workloads.

To deploy a VPN or ExpressRoute gateway, a VNet needs a special subnet called…

• a.DefaultSubnet
• b.PublicSubnet
• c.BlobSubnet
• d.GatewaySubnet✓

A gateway requires a dedicated subnet named GatewaySubnet. Azure places the gateway resources there. Using the exact name is required for the gateway to deploy correctly.

Azure Private DNS zones are used to…

• a.store container images for deployment
• b.resolve names privately for resources inside your virtual networks✓
• c.assign RBAC roles to users
• d.host only public-facing marketing websites that anyone on the internet can reach

Private DNS zones provide name resolution within and between VNets without exposing records publicly. They support custom domain names for internal resources. This keeps internal naming private and manageable.

Which blob storage feature helps meet compliance by preventing data from being modified or deleted for a set period?

• a.Automatic autoscaling of the storage account
• b.Virtual network peering between two networks
• c.The hot access tier, which is optimized for frequently accessed active data
• d.Immutable (WORM) storage policies✓

Immutable, write-once-read-many (WORM) policies prevent blobs from being changed or deleted for a defined period. This helps meet regulatory retention requirements. It protects critical records from tampering.

A benefit of Azure managed disks over manually managing storage accounts for VM disks is…

• a.you must manually create and manage all of the underlying storage accounts yourself
• b.Azure handles the underlying storage accounts for you✓
• c.disks cannot be resized after creation
• d.no redundancy options are available for them

Managed disks let Azure handle the underlying storage accounts, simplifying management. You just specify disk type and size. They also improve reliability and scaling compared with unmanaged disks.

What is the relationship between a Microsoft Entra tenant and Azure subscriptions?

• a.A tenant can be associated with many subscriptions, but each subscription trusts one tenant✓
• b.Each tenant is permitted to have only one single subscription associated with it, ever
• c.Subscriptions and tenants are exactly the same thing
• d.Tenants are physical servers in a datacenter

A Microsoft Entra tenant is an identity boundary that can hold many subscriptions. Each subscription trusts exactly one tenant for authentication. This separates identity from billing and resource management.

Which ordering reflects increasing abstraction (less infrastructure to manage) for compute?

• a.Virtual machines are the most abstracted option
• b.VMs, then App Service, then Functions✓
• c.Azure Functions first, then App Service, and finally virtual machines at the end
• d.App Service is less abstracted than virtual machines

VMs (IaaS) require the most management, App Service (PaaS) less, and Functions (serverless) the least. Moving along this order, you manage less infrastructure. Choosing the right level balances control and simplicity.

To protect stored data against a complete regional outage, which redundancy level is the minimum needed?

• a.ZRS, which keeps copies within one region
• b.GRS or GZRS (geo-redundant)✓
• c.LRS, which keeps copies in one datacenter
• d.Premium solid-state disks configured for the highest possible database throughput

Protecting against a full regional outage requires geo-redundant storage (GRS or GZRS), which replicates to a second region. LRS and ZRS stay within one region. Geo-redundancy adds cross-region durability.

In Azure Cosmos DB, provisioned throughput is measured in…

• a.gigabytes transferred per second across the global replication network
• b.Request Units per second (RU/s)✓
• c.the number of DNS queries answered
• d.the count of virtual CPUs assigned

Cosmos DB measures throughput in Request Units per second (RU/s). RUs abstract the CPU, memory, and IOPS needed for operations. You provision or autoscale RU/s to match workload demand.

How can Azure App Service handle increased web traffic automatically?

• a.By deleting the app to reduce the load on servers
• b.By reducing available memory down to zero
• c.By turning off the connected database to conserve resources during peak traffic
• d.By scaling out to more instances based on rules✓

App Service can scale out automatically, adding instances when rules or metrics indicate higher demand. It scales back in when demand falls. This keeps performance steady while managing cost.

Which service provides outbound-only internet connectivity with a stable public IP for resources in a subnet?

• a.Azure Key Vault for secrets and certificates
• b.Azure NAT Gateway✓
• c.Azure DNS for resolving domain names
• d.Azure Bastion, providing secure browser-based RDP and SSH into virtual machines

Azure NAT Gateway provides scalable outbound internet connectivity with a consistent public IP. Resources initiate outbound traffic without needing individual public IPs. Inbound connections are not allowed through it.

How can you restrict a storage account so only specific networks can reach it?

• a.Add several additional DNS records
• b.Move all blobs to the archive access tier
• c.Configure storage firewall and virtual network rules✓
• d.Delete the entire storage account and recreate it in a different Azure region

Storage account firewalls and virtual network rules restrict access to selected networks or IP ranges. Combined with private endpoints, they limit exposure. This strengthens the security of stored data.

By default, data in Azure managed disks and Storage is protected with…

• a.encryption applied only to blob objects and never to any virtual machine disks
• b.encryption only if you purchase a separate add-on
• c.encryption at rest using Storage Service Encryption✓
• d.no encryption of any kind

Azure encrypts data at rest by default using Storage Service Encryption. This applies to Storage and managed disks without extra configuration. You can also use customer-managed keys for more control.

What is an Azure geography?

• a.A billing currency used on invoices
• b.A discrete market, often a country, containing one or more regions for data residency✓
• c.A single physical server installed within one specific rack inside a datacenter room
• d.A particular virtual machine size family

An Azure geography is a discrete market, typically aligning with a country, that contains one or more regions. Geographies preserve data residency and compliance boundaries. Region pairs stay within the same geography.

Can a resource group in one region contain resources located in other regions?

• a.Yes, resources in a group can reside in different regions✓
• b.Only when the resources are in the same server rack
• c.Only if all of the resources involved happen to be blob storage objects specifically
• d.No, this is never possible under any circumstances

A resource group has its own metadata location, but the resources it contains can live in different regions. The group is a logical, not physical, boundary. This gives flexibility in organizing resources.

Which App Service tier provides a fully isolated, dedicated environment for high scale and security?

• a.The Free tier for small test apps
• b.The cool storage tier for infrequent data
• c.The Isolated (App Service Environment) tier✓
• d.The archive access tier used for rarely accessed long-term storage of blob data

The Isolated tier, using an App Service Environment, runs apps in a dedicated, network-isolated environment. It supports high scale and stricter security. It suits workloads with demanding compliance needs.

For running many interdependent microservices with automated scaling and self-healing, which is most appropriate?

• a.One standalone Azure Container Instance
• b.A single Azure Function triggered occasionally by an incoming HTTP request only
• c.A single static blob in storage
• d.Azure Kubernetes Service (AKS)✓

AKS orchestrates many containers with automated scaling, rolling upgrades, and self-healing. It suits complex microservices architectures. ACI or a single Function is better for simpler, isolated tasks.

An Azure VM typically has an OS disk, optional data disks, and a…

• a.queue disk for messages
• b.blob disk for object storage
• c.DNS disk used specifically for hosting the machine's public domain records
• d.temporary disk✓

An Azure VM has an OS disk, optional data disks, and a temporary disk for short-lived data like a page file. The temporary disk is not persistent and can be lost on deallocation. Persistent data belongs on managed disks.

Why might an enterprise choose ExpressRoute over a site-to-site VPN?

• a.It runs entirely over the shared public internet
• b.It offers more predictable latency and higher reliability over a private link✓
• c.It requires no connectivity provider at all
• d.It is always the cheapest possible connectivity option in every single scenario

ExpressRoute uses a private connection with more predictable latency and higher reliability than an internet VPN. It suits mission-critical or high-bandwidth hybrid workloads. It does require a connectivity provider and typically costs more.

Azure Storage accounts come in performance tiers named…

• a.Fast and Slow
• b.Bronze and Gold
• c.Hot and Cold
• d.Standard and Premium✓

Storage account performance comes in Standard and Premium tiers. Premium uses SSDs for low latency and high throughput. Standard is cost-effective for general-purpose data.

Which Cosmos DB option automatically scales throughput within a range based on usage?

• a.Autoscale (autoscale throughput)✓
• b.Only fixed, manually provisioned throughput that never changes automatically at all
• c.No scaling of any kind is possible
• d.DNS-based scaling of the database

Cosmos DB autoscale adjusts provisioned throughput automatically within a set maximum range. It handles variable workloads without manual tuning. You pay for the throughput actually used within that range.

Do Azure resources automatically inherit tags from their resource group?

• a.Tags cannot exist on individual resources
• b.No, tags are not inherited by default, though policy can add them✓
• c.Only blob objects inherit tags automatically
• d.Yes, every resource always automatically inherits every tag from its resource group

Resources do not inherit resource group tags by default. Azure Policy can enforce or append tags to achieve consistency. Tags support cost tracking and organization.

By default, resources in a VNet use which DNS unless you configure custom servers?

• a.No DNS resolution at all
• b.Only their own local host file with statically defined name-to-address mappings
• c.A random public resolver chosen each time
• d.Azure-provided DNS✓

By default, VNet resources use Azure-provided DNS for name resolution. You can configure custom DNS servers or Private DNS zones if needed. This default handles basic resolution automatically.

Azure App Service lets you add a custom domain and secure it with…

• a.a blob storage container
• b.no security controls at all
• c.only manually generated self-signed certificates that browsers do not trust
• d.a TLS/SSL certificate✓

App Service supports custom domains secured with TLS/SSL certificates, including managed certificates. This enables HTTPS on your own domain name. It protects traffic between users and the app.

Which storage service would you use to store large media files served to a website?

• a.Azure Blob Storage✓
• b.Azure Table Storage for key-value data
• c.Azure Queue Storage for messages
• d.Azure SQL Database for relational data

Blob Storage is designed for large unstructured objects like images and video. It integrates with CDN for fast delivery. It is the natural choice for website media assets.

Virtual Machine Scale Sets can automatically add or remove VM instances based on…

• a.nothing at all, because the number of instances always remains completely fixed
• b.only the current time zone name of the region
• c.the color assigned to the virtual machine
• d.metrics such as CPU usage or a defined schedule✓

Scale sets autoscale by adding or removing instances based on metrics like CPU or on a schedule. This matches capacity to demand automatically. It supports elastic, highly available workloads.

Virtual Network service endpoints allow…

• a.faster DNS resolution only
• b.the automatic deletion of a virtual network
• c.a subnet to reach specific Azure services over the backbone✓
• d.the full public internet exposure of every single resource in the subscription

Service endpoints extend a subnet's identity to selected Azure services over the Microsoft backbone. This keeps traffic off the public internet and can restrict service access to the VNet. It improves security for PaaS connectivity.

Which pairing correctly matches the database to its type?

• a.Azure SQL Database is a NoSQL store while Azure Cosmos DB is a relational engine
• b.Both Azure SQL Database and Cosmos DB are container registries
• c.Azure SQL Database is relational; Azure Cosmos DB is NoSQL✓
• d.Both Azure SQL Database and Cosmos DB are file shares

Azure SQL Database is a relational (SQL) database, while Cosmos DB is a globally distributed NoSQL database. Choosing between them depends on data model and scale needs. Matching workloads to the right type is a key skill.