Microsoft Certified: Azure Fundamentals — Practice Set 1

Question 1

Which cloud model allows an organization to keep sensitive workloads on on-premises infrastructure while using public cloud services for less sensitive workloads?

Accepted Answer

A hybrid cloud model combines on-premises (private) infrastructure with public cloud services, allowing organizations to keep sensitive or regulated workloads on-premises while leveraging the scalability of the public cloud for other workloads. A public cloud is hosted entirely by a third-party provider. A private cloud is dedicated to a single organization. Community cloud is not one of the standard Azure cloud model types tested on AZ-900.

Question 2

In the cloud shared responsibility model, which responsibility does a customer ALWAYS retain regardless of the cloud service type (IaaS, PaaS, or SaaS)?

Accepted Answer

Regardless of whether an organization uses IaaS, PaaS, or SaaS, the customer always retains responsibility for managing identities and access to their own data and accounts. Operating system patching is the customer's responsibility in IaaS but shifts to the provider in PaaS and SaaS. Network hardware and hypervisor management are always the cloud provider's responsibility.

Question 3

A startup wants to avoid large upfront capital expenditures on servers and instead pay only for the compute resources they consume each month. Which cloud pricing model aligns with this requirement?

Accepted Answer

The consumption-based model in cloud computing converts capital expenditure into operational expenditure — you pay only for the resources you actually use, with no upfront hardware cost. A CapEx model requires purchasing infrastructure upfront. A fixed subscription charges a set fee regardless of usage, which does not optimize for variable load. A perpetual license is a software licensing concept and does not describe cloud pricing.

Question 4

An e-commerce company needs to handle a sudden 10x traffic spike during a holiday sale without pre-purchasing hardware. Which cloud benefit best describes the ability to rapidly add resources on demand?

Accepted Answer

Scalability refers to the ability to increase (scale out/up) or decrease (scale in/down) resources dynamically to meet changing demand. This is the core benefit that allows handling traffic spikes without pre-purchasing capacity. High availability ensures uptime but is about redundancy, not capacity growth. Predictability refers to consistent performance and cost forecasting. Manageability is about tools and interfaces for operating cloud resources.

Question 5

Woodgrove Bank needs to run a compliance-sensitive application that cannot leave their country due to regulatory requirements, but they also want to use managed Azure services for analytics. A cloud architect recommends a specific cloud deployment model. Which model is most appropriate?

Accepted Answer

A hybrid cloud deployment is the appropriate model when some workloads must remain on-premises due to regulatory requirements while others can benefit from public cloud services like Azure analytics. Using public cloud only (A) may not satisfy strict data residency regulations for all workloads. A private cloud only (B) foregoes the managed analytics capabilities of Azure. Serverless (D) is a compute execution model, not a deployment model.

Question 6

Which cloud service type gives the customer the most control over the operating system, middleware, and runtime environment?

Accepted Answer

Infrastructure as a Service (IaaS) provides the highest level of customer control: the customer manages the OS, middleware, runtime, applications, and data, while the provider manages the physical hardware, networking, and hypervisor. PaaS abstracts the OS and runtime, leaving the customer to manage only the application and data. SaaS delivers a complete application managed by the provider. FaaS (serverless functions) is a subset of PaaS with even less customer control.

Question 7

A company's finance team uses Microsoft 365 for email and document collaboration. Their IT department runs a web application on Azure App Service. Their data engineering team uses Azure Virtual Machines with custom GPU drivers. Which statement correctly maps these scenarios to cloud service types?

Accepted Answer

Microsoft 365 is a SaaS product — the provider manages everything, and users consume the application. Azure App Service is PaaS — Microsoft manages the runtime and OS while the customer deploys and manages the application code. Azure Virtual Machines is IaaS — the customer is responsible for the OS, drivers, middleware, and everything above the hypervisor. The other options incorrectly map these services.

Question 8

An organization wants to ensure their Azure application continues running even if an entire Azure datacenter fails. Which Azure feature should be used to distribute virtual machine instances across separate physical locations within the same region?

Accepted Answer

Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across multiple Availability Zones protects against datacenter-level failures. Resource Groups are logical containers for organizing resources, not for physical redundancy. Management Groups and Subscriptions are organizational and billing constructs, not availability features.

Question 9

A developer needs to run a small event-driven function that executes only when triggered by an HTTP request, and the team wants to pay only when the function runs. Which Azure compute option is most appropriate?

Accepted Answer

Azure Functions is the serverless compute service that executes code in response to triggers (such as HTTP requests) and charges only for the execution time consumed (Consumption plan). Virtual Machines require always-on compute and OS management. Container Instances are for containerized workloads and charge while the container is running. Azure Virtual Desktop is a desktop virtualization service, not a compute option for functions.

Question 10

A company has multiple Azure Virtual Machines that must be updated (patched) at different times to ensure at least one VM is always available during maintenance. Which Azure feature helps achieve this by grouping VMs so they are not all restarted simultaneously during platform updates?

Accepted Answer

Availability sets use update domains (for planned maintenance) and fault domains (for hardware failures) to ensure that not all VMs are restarted at the same time during platform updates. Azure guarantees that VMs in different update domains are patched at different times. Availability Zones protect against datacenter-level failure but don't control update sequencing within the same datacenter. VM Scale Sets provide auto-scaling, not controlled update scheduling. Virtual Desktop is a desktop virtualization service.

Question 11

An organization wants to establish a high-speed, private, dedicated connection between their on-premises datacenter and Azure that does not traverse the public internet. Which Azure networking service should they use?

Accepted Answer

Azure ExpressRoute provides a private, dedicated connection between on-premises networks and Azure through a connectivity provider, bypassing the public internet entirely. This delivers more reliability, faster speeds, and lower latencies than internet-based connections. Azure VPN Gateway creates an encrypted tunnel over the public internet. Virtual Network peering connects Azure VNets to each other, not on-premises networks. Azure DNS is a domain name resolution service, not a connectivity solution.

Question 12

An administrator is evaluating Azure storage redundancy options. Which TWO redundancy options replicate data to a secondary Azure region? Choose 2.

Accepted Answer

GRS replicates data synchronously within the primary region using LRS and asynchronously to a secondary region. GZRS combines zone-redundant replication in the primary region with geo-replication to a secondary region. LRS replicates within a single datacenter. ZRS replicates across availability zones in the same region. Premium SSD is a disk type, not a storage redundancy option.

Question 13

A company wants to transfer 80 TB of data from their on-premises datacenter to Azure. Due to their slow internet connection, an online transfer would take months. Which Azure service allows them to ship physical storage devices to Microsoft for offline data ingestion?

Accepted Answer

Azure Data Box is a physical appliance service where Microsoft ships a rugged storage device to the customer, who copies their data to the device and ships it back to Microsoft for ingestion into Azure. This is ideal for large data transfers where internet bandwidth is insufficient. Azure File Sync synchronizes files continuously over the internet. AzCopy is a command-line tool for online data transfer. Azure Migrate assesses and migrates workloads, not bulk raw data.

Question 14

Which Microsoft Entra ID feature allows an administrator to enforce that users must complete a second form of verification (such as a phone app approval) before accessing corporate resources, regardless of their password?

Accepted Answer

Multifactor authentication (MFA) requires users to provide two or more verification factors — something they know (password), something they have (authenticator app), or something they are (biometric). MFA prevents unauthorized access even if a password is compromised. SSO reduces sign-in friction by allowing a single login for multiple applications but doesn't add a second factor. RBAC controls what authenticated users can do, not how they prove identity. Entra Domain Services provides AD DS-compatible services, not MFA enforcement.

Question 15

Tailspin Toys' security team requires that employees can only access the Azure portal from devices that are managed by the company and from specific corporate IP ranges. Which Microsoft Entra ID feature should be used to enforce this policy?

Accepted Answer

Microsoft Entra Conditional Access policies evaluate signals such as user identity, device compliance state, IP location, and application being accessed, then grant or block access accordingly. Configuring conditions for compliant devices and named corporate IP locations meets both requirements. Azure RBAC controls permissions on resources after authentication — it cannot block authentication based on device or location. Defender for Cloud monitors security posture but doesn't enforce authentication conditions. Azure Policy governs Azure resource configurations, not user sign-in conditions.

Question 16

A security architect is designing Azure access control and wants to grant a developer the minimum permissions needed to deploy resources to a specific resource group only — not the entire subscription. Which Azure feature enforces this boundary?

Accepted Answer

Azure Role-Based Access Control (RBAC) allows roles to be assigned at different scopes: management group, subscription, resource group, or individual resource. Scoping a role assignment to a specific resource group ensures the developer has permissions only within that group, following the principle of least privilege. An Azure Policy initiative enforces compliance rules but does not grant deployment permissions. Global Administrator grants unrestricted Azure AD access — far more than needed. Resource locks prevent modification or deletion — they don't grant permissions.

Question 17

Which Azure security service continuously assesses the security posture of Azure workloads, provides a Secure Score, and generates prioritized recommendations to reduce risk?

Accepted Answer

Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and workload protection service. It continuously assesses Azure (and multi-cloud) resources, calculates a Secure Score based on implemented controls, and provides prioritized, actionable remediation recommendations. Azure Firewall is a managed network firewall. Azure DDoS Protection defends against volumetric attacks. Azure Key Vault is a secrets and key management service — not a posture management tool.

Question 18

A finance team wants to estimate the monthly cost of running two Azure Virtual Machines and an Azure SQL Database before deploying anything. Which Azure tool should they use?

Accepted Answer

The Azure Pricing Calculator lets you select Azure services, configure their settings (size, region, tier), and estimate the monthly cost before deploying anything. Azure Cost Management + Billing analyzes actual spending on deployed resources. Azure Advisor provides recommendations after resources are deployed. The TCO Calculator helps compare on-premises costs with Azure cloud costs, not estimate the cost of specific Azure resource configurations.

Question 19

An administrator needs to prevent users from accidentally deleting a production Azure SQL Database. After applying the protection, the database should be readable but cannot be deleted even by subscription owners. Which Azure feature should be applied?

Accepted Answer

A Delete resource lock (CanNotDelete) allows users to read and modify a resource but prevents anyone, including subscription owners, from deleting it until the lock is explicitly removed. Azure Policy with audit effect only logs non-compliance — it does not block deletion. Assigning Reader to all users would prevent modifications but is too restrictive for legitimate operations. Tags are metadata for organization and do not enforce access controls.

Question 20

A large enterprise has 50 Azure subscriptions across 10 business units. The compliance team wants to enforce a company-wide policy that all Azure resources must have a 'CostCenter' tag applied at creation. Which Azure governance feature should be used to enforce this at scale across all subscriptions?

Accepted Answer

Azure Policy can be assigned at the Management Group scope, which automatically applies it to all subscriptions and resource groups beneath it. A Deny policy effect prevents resource creation without the required tag. Applying policies to individual resource groups (A) is unmanageable at 50 subscriptions. Azure Blueprints can include policies but are typically used for initial environment setup, not ongoing enforcement of a single tag policy at scale. Azure Advisor provides recommendations but cannot enforce policies.

Question 21

Which Azure service allows an administrator to manage resources across multiple clouds (Azure, AWS, Google Cloud) and on-premises servers from a single control plane using Azure management tools?

Accepted Answer

Azure Arc extends Azure management capabilities to resources outside of Azure — including servers on other cloud providers and on-premises datacenters. It allows organizations to apply Azure Policies, use Azure Monitor, and manage Kubernetes clusters on non-Azure infrastructure through the Azure portal and ARM. ARM manages only Azure-hosted resources. Azure Monitor collects telemetry but does not extend control plane management to other clouds. Cloud Shell is a browser-based command-line interface.

Question 22

A cloud team is evaluating infrastructure as code (IaC) tools for deploying Azure resources. Which TWO tools are native Azure IaC options? Choose 2.

Accepted Answer

ARM templates are the native JSON-based IaC format for deploying Azure resources, and Bicep is a domain-specific language (DSL) that compiles to ARM templates, providing a simpler authoring experience. Both are native to Azure and maintained by Microsoft. Terraform, Ansible, and Chef are third-party IaC/configuration management tools that support Azure but are not native Azure offerings.

Question 23

An operations team wants to receive a notification when an Azure region experiences a service outage that affects their virtual machines. Which Azure service provides this type of platform-level incident notification?

Accepted Answer

Azure Service Health provides personalized notifications about Azure platform issues including service outages, planned maintenance, and health advisories that may affect the specific services and regions a customer uses. Azure Monitor CPU metric alerts fire based on resource-level performance, not platform incidents. Azure Advisor provides proactive recommendations for cost, security, reliability, and performance — not incident notifications. Microsoft Purview is a data governance service.

Question 24

A cloud architect is reviewing Azure cost management best practices. Which TWO actions can directly reduce Azure VM compute costs without reducing availability? Choose 2.

Accepted Answer

Azure Reservations lock in a 1- or 3-year commitment for VM compute in exchange for up to 72% cost savings compared to pay-as-you-go pricing — without reducing availability. Azure Hybrid Benefit allows customers with Software Assurance-covered Windows Server or SQL Server licenses to use them in Azure, reducing the OS licensing component of VM cost. Spot VMs use spare Azure capacity and can be evicted with short notice, making them unsuitable for production databases. Deleting resource tags has no cost impact. Moving workloads to a distant region does not reduce compute cost and increases latency.

Question 25

A compliance officer wants to ensure that data stored in Azure Blob Storage and Azure SQL Database is automatically classified, labeled, and audited for sensitive personal data to meet GDPR requirements. Which Azure service provides unified data governance including automated sensitive data discovery across Azure data sources?

Accepted Answer

Microsoft Purview is a unified data governance service that provides automated data discovery, sensitive data classification, data cataloging, and compliance insights across Azure and multi-cloud data sources including Blob Storage and Azure SQL. It directly supports GDPR compliance by identifying and labeling personal data. Azure Security Center (now Defender for Cloud) focuses on security posture, not data governance. Azure Monitor is a telemetry and observability service. Azure Policy enforces resource configuration compliance but does not classify data.

AZ-900 — Azure Fundamentals