Free AZ-900 practice test

Reliability in the cloud comes from designing across fault domains — multiple facilities, zones, and regions — so no single failure takes the workload down; a single server room cannot offer that. Option C is a convenience, not a reliability argument. Option A is false: individual hardware still fails in the cloud; the difference is the platform's ability to recover and distribute. Option D is a billing characteristic, irrelevant to reliability.

The consumption-based model means you pay only for the resources you use, when you use them — an operational expenditure (OpEx) approach. Option B is the opposite: CapEx means large upfront investments in physical infrastructure. Option C describes traditional software licensing, not cloud billing. Option D (vertical scaling) is about resizing a resource, not how you pay for it.

With IaaS the customer manages the guest operating system, including patching; with PaaS the platform (Microsoft) takes over OS and runtime maintenance. Options A, C, and D — identities, data, and devices — always remain customer responsibilities in every service model, so they don't shift.

Private cloud suits workloads where the organization must fully control hardware, physical access, and data locality — often for strict regulatory or sovereignty reasons. Options A, B, and D are classic public-cloud cases: variable or unpredictable demand and global scale benefit from shared elastic capacity, and none requires physical control of infrastructure.

SaaS delivers a complete, ready-to-use application (like Microsoft 365) where the provider manages everything from infrastructure to application updates — the customer just manages users and data. IaaS (D) would leave them managing VMs, OS patches, and the email software itself. PaaS (A) targets developers deploying their own applications. Option B reintroduces the server management they want to avoid.

Azure Virtual Desktop is Azure's desktop and application virtualization service — full Windows desktops and apps hosted in Azure, streamed to nearly any device. Container Instances (B) run containers, App Service (A) hosts web applications, and Functions (C) runs event-driven code; none delivers a virtualized Windows desktop experience.

Microsoft Defender for Cloud provides security posture management and threat protection: it scores your environment, flags misconfigurations, and recommends hardening steps across Azure and hybrid resources. Service Health (A) reports Azure platform incidents. Entra Domain Services (B) provides managed domain services like LDAP/Kerberos. Azure DNS (C) hosts DNS zones — none of these assess security posture.

Virtual Machine Scale Sets create and manage a group of identical, load-balanced VMs that scale in and out automatically based on rules or demand. Availability sets (A) spread existing VMs across fault domains but don't autoscale. Azure Bastion (C) provides secure browser-based RDP/SSH access — unrelated to scaling. Option D requires manual scaling, which fails the 'automatic' requirement.

Conditional Access evaluates signals — user, location, device state, risk — at sign-in time and applies policies like block or require MFA. RBAC (A) controls what a signed-in identity can do to Azure resources, not the conditions of sign-in itself. Resource locks (D) prevent accidental resource deletion/modification. Azure Policy (B) governs resource configuration compliance, not user sign-in behavior.

Azure Blob storage tiers trade storage cost against access cost and latency: Hot for frequently accessed data, Cool for infrequently accessed data stored at least 30 days, Archive for rarely accessed data tolerating hours of rehydration time. Option C would make images unusable (archive retrieval takes hours and costs per read). Option A wastes money storing cold data at hot rates. Option D inverts the correct mapping entirely.

Virtual network peering (global peering when the VNets are in different regions) connects VNets privately over the Microsoft backbone with no gateways, no public internet, and low latency. A VPN (B) works but requires gateways and encrypts over tunnels — more overhead than needed and the question excludes gateways. ExpressRoute (C) connects on-premises sites to Azure, not VNet-to-VNet. Option D exposes traffic publicly — exactly what must be avoided.

A private endpoint gives a PaaS service a private IP address inside your VNet, so traffic stays on the private network and the public endpoint can be disabled. Option A still exposes a public endpoint, just restricted — the requirement is to eliminate it. Option C isn't possible — you can't peer a VNet directly with a PaaS service. Option D connects on-premises networks to Azure; it doesn't by itself give the PaaS service a private address in the VNet.

Azure Data Box is a physical appliance shipped to your site — you load data locally and ship it back to Microsoft for import, which is exactly right for large volumes over poor connectivity. AzCopy (B) and portal uploads (A) depend on the slow, unreliable link and would likely miss the deadline. Azure File Sync (D) keeps on-premises file servers synchronized with Azure Files; it's a sync service, not a bulk offline migration tool.

Azure CLI is a cross-platform command-line tool with Bash-friendly syntax (az storage account create ...) that scripts naturally on macOS/Linux. The portal (A) is graphical — clicking 20 times isn't scripting. Option D alone isn't a scripting tool (templates would still need CLI/PowerShell/portal to deploy, and 'designer only' rules that out). Service Health (B) is a monitoring dashboard.

Region is a genuine cost factor in Azure — the same VM size can be priced differently across regions because underlying infrastructure, power, and demand differ. Option A is false; the creation tool never affects pricing. Option D is false — free-tier offers are specific limited services, not 'first VM free'. Option C is misleading: OS licensing affects price, but regional variance exists even for identical images.

Management groups exist precisely for governance at scale: group subscriptions, assign policy (or RBAC) once at the management-group level, and it inherits down to every subscription and resource beneath. Option A works but is 40× the effort and drifts over time. Option C is impossible — resource groups live inside a single subscription. Option D labels subscriptions but enforces nothing.

Azure Policy defines and enforces organizational rules: it can deny non-compliant deployments, audit existing resources, and auto-remediate (e.g., enforce HTTPS-only on storage). Advisor (A) gives best-practice recommendations but enforces nothing. Locks (C) prevent deletion or changes wholesale — they can't express configuration rules. Service Health (B) reports Azure platform incidents, unrelated to governance.

Microsoft Purview is the data-governance service: it maps the data estate, catalogs assets, tracks lineage, and classifies sensitive data across clouds and on-premises. Azure Monitor (C) is telemetry, Azure Arc (A) is hybrid resource management, and Azure Advisor (B) is best-practice recommendations — none of them govern data.

Azure Cloud Shell is a browser-based shell offering both Bash (Azure CLI) and PowerShell environments with tools pre-installed and authenticated — nothing to install locally. Option B requires local installation, which is excluded. Option C is unrelated to running Azure management commands and adds risk. Option D can surface alerts but is not a command-line environment (though the mobile app does embed Cloud Shell, notifications are not it).

Cost Management provides budgets (with threshold alerts, e.g. at 80%) and cost analysis views that break spending down by service, resource group, or tags. Option D misuses governance tools — Policy and locks don't track spending. Option A monitors platform health and logs, not costs. Option C estimates future costs but can't track or alert on actual spend.