View Full Microsoft AZ-900 Exam Dumps and Practice Test Dumps.

 

Question 81

Which Azure service is designed to provide centralized identity and access management for users and applications?

1. Azure Monitor
2. Microsoft Entra ID
3. Azure Storage
4. Azure Advisor

Correct Answer: 2

Explanation

Microsoft Entra ID is Microsoft’s cloud-based identity and access management service. It helps organizations authenticate users, manage identities, and control access to applications and resources. Entra ID supports capabilities such as single sign-on, multifactor authentication, and application identity management. It plays an important role in securing cloud environments by ensuring that users and applications receive appropriate access. Azure Monitor focuses on monitoring, Storage provides data storage, and Advisor provides recommendations. Entra ID is therefore a foundational service for identity management in Azure.

Question 82

Which Azure service provides a managed platform for hosting web applications, APIs, and mobile back ends?

1. Azure App Service
2. Azure Blob Storage
3. Azure VPN Gateway
4. Azure Policy

Correct Answer: 1

Explanation

Azure App Service is a platform-as-a-service offering designed to host web applications, REST APIs, and supported mobile back ends. Microsoft manages much of the underlying infrastructure, allowing developers to concentrate on application development and configuration. App Service supports capabilities such as automatic scaling, authentication, deployment options, and integration with other Azure services. Blob Storage is intended for object data, VPN Gateway provides network connectivity, and Azure Policy provides governance. App Service is therefore appropriate when organizations want managed application hosting without directly managing virtual machine infrastructure.

Question 83

What is the primary purpose of Azure role-based access control (RBAC)?

1. To calculate Azure resource costs
2. To distribute application traffic
3. To control what actions users and identities can perform on Azure resources
4. To store application files

Correct Answer: 3

Explanation

Azure role-based access control, or Azure RBAC, manages authorization by assigning roles to users, groups, applications, and managed identities. These roles define which actions an identity can perform on Azure resources at a specific scope. RBAC supports the principle of least privilege by allowing organizations to provide only the permissions required for a person’s responsibilities. It is different from authentication, which verifies identity. Cost Management handles spending, Load Balancer distributes traffic, and Storage manages data. RBAC is primarily an authorization mechanism.

Question 84

Which Azure service helps detect potential security vulnerabilities and improve the security posture of Azure resources?

1. Azure Advisor
2. Microsoft Defender for Cloud
3. Azure DNS
4. Azure Queue Storage

Correct Answer: 2

Explanation

Microsoft Defender for Cloud provides security management and threat protection capabilities for cloud environments. It can help organizations assess security posture, identify recommendations, and detect potential threats across supported resources and workloads. Defender for Cloud can provide security insights and help organizations improve their protection strategies. Azure Advisor also provides recommendations, but its scope includes cost, reliability, performance, and security optimization rather than being a dedicated cloud security posture service. DNS and Queue Storage serve networking and messaging purposes respectively.

Question 85

Which Azure service can help create private connections between Azure resources and supported platform services without exposing traffic to the public internet?

1. Azure Private Link
2. Azure Monitor
3. Azure Advisor
4. Azure Cost Management

Correct Answer: 1

Explanation

Azure Private Link enables private connectivity to supported Azure services and customer-owned services through private endpoints. Traffic can remain within the Azure private network rather than traversing the public internet, depending on the architecture. This can improve network isolation and help organizations meet security requirements for sensitive workloads. Azure Monitor provides telemetry, Advisor provides recommendations, and Cost Management analyzes spending. Private Link is especially useful when applications need secure private access to platform services such as supported databases and storage resources.

Question 86

Which Azure service provides a managed relational database service compatible with PostgreSQL workloads?

1. Azure Cosmos DB
2. Azure Database for PostgreSQL
3. Azure Blob Storage
4. Azure Functions

Correct Answer: 2

Explanation

Azure Database for PostgreSQL is a managed database service designed for PostgreSQL workloads. Microsoft manages much of the underlying infrastructure and platform maintenance, allowing organizations to focus on their databases and applications. Managed database services can reduce administrative overhead associated with hardware, operating system maintenance, and other infrastructure tasks. Azure Cosmos DB is a globally distributed NoSQL database, Blob Storage is object storage, and Azure Functions provides serverless compute. A managed PostgreSQL service is appropriate when applications require PostgreSQL relational database capabilities.

Question 87

Which Azure feature provides a way to organize subscriptions into a hierarchy for governance and policy management?

1. Resource groups
2. Azure regions
3. Management groups
4. Availability zones

Correct Answer: 3

Explanation

Azure management groups provide a hierarchical structure for organizing multiple Azure subscriptions. Organizations can apply governance policies and access controls at management group levels, with appropriate inheritance to subscriptions and resources below them. This is especially useful for large organizations that have many subscriptions and need consistent governance. Resource groups organize resources within subscriptions, while regions and availability zones represent physical or geographic deployment concepts. Management groups therefore provide an organizational layer above subscriptions for governance and administration.

Question 88

Which Azure service provides an encrypted connection between Azure and an on-premises network over the public internet?

1. Azure VPN Gateway
2. Azure ExpressRoute
3. Azure Load Balancer
4. Azure DNS

Correct Answer: 1

Explanation

Azure VPN Gateway can establish encrypted VPN connections between Azure virtual networks and on-premises networks over the public internet. A site-to-site VPN can create a secure tunnel between the environments, allowing resources to communicate while protecting traffic from direct exposure. ExpressRoute provides private connectivity through a connectivity provider rather than a typical internet VPN connection. Load Balancer distributes traffic, while Azure DNS provides name resolution. VPN Gateway is therefore a practical option for many hybrid connectivity scenarios where dedicated private connectivity is not required.

Question 89

Which Azure service provides centralized visibility into service incidents, planned maintenance, and health advisories that may affect resources?

1. Azure Monitor
2. Azure Service Health
3. Azure Policy
4. Azure Storage

Correct Answer: 2

Explanation

Azure Service Health provides personalized information about Azure service incidents, planned maintenance, and health advisories that may affect an organization’s resources. It helps customers understand potential service disruptions and take appropriate action. Service Health differs from Azure Monitor, which focuses on monitoring resource and application telemetry. Azure Policy manages governance requirements, while Storage provides data storage. Service Health is valuable because it provides information related to Azure platform conditions that may affect workloads, helping organizations respond to relevant service events.

Question 90

Which Azure storage service is best suited for storing files that need to be accessed through a traditional shared file system?

1. Azure Queue Storage
2. Azure Blob Storage
3. Azure Files
4. Azure Table Storage

Correct Answer: 3

Explanation

Azure Files provides managed file shares that applications and users can access using supported standard file protocols. It is useful when workloads require shared storage that behaves similarly to traditional network file shares. Multiple systems can access files according to configured permissions and connectivity. Blob Storage is optimized for object storage, Queue Storage provides asynchronous messaging, and Table Storage provides a NoSQL key-value data model. Azure Files is therefore the appropriate choice when an application requires shared file-based storage rather than object or message storage.

Question 91

Which cloud model combines services from a public cloud with infrastructure that remains on-premises or in a private cloud?

1. Public cloud
2. Private cloud
3. Hybrid cloud
4. Community cloud

Correct Answer: 3

Explanation

A hybrid cloud combines public cloud services with on-premises infrastructure or a private cloud environment. Organizations may choose this model to retain certain workloads locally while using Azure for scalability, modernization, or selected cloud services. Hybrid architectures can also support gradual migration strategies and specific regulatory or operational requirements. Successful hybrid environments require appropriate networking, identity, security, and management. Public cloud uses provider infrastructure, while private cloud is dedicated to one organization. Hybrid cloud connects or integrates these different environments to meet business requirements.

Question 92

What is the primary purpose of Azure Resource Manager templates?

1. To provide automated and repeatable infrastructure deployments
2. To monitor application performance
3. To store user passwords
4. To provide DNS resolution

Correct Answer: 1

Explanation

Azure Resource Manager templates allow organizations to define Azure infrastructure declaratively and deploy it consistently. Templates can describe resources, configurations, dependencies, and other deployment requirements. This supports infrastructure as code and reduces the risk of manual configuration differences between environments. Templates can be used to create repeatable development, testing, and production deployments. Monitoring is handled by Azure Monitor, Key Vault can protect secrets, and Azure DNS manages DNS capabilities. ARM templates are therefore useful for standardized and automated infrastructure deployment.

Question 93

Which Azure service can automatically execute a workflow when a supported event occurs?

1. Azure Logic Apps
2. Azure Virtual Network
3. Azure Disk Storage
4. Azure Load Balancer

Correct Answer: 1

Explanation

Azure Logic Apps provides workflow automation capabilities using triggers and actions. A workflow can start when a supported event occurs and then perform one or more actions across connected applications and services. Logic Apps supports many connectors and can automate business and integration processes without requiring organizations to build all orchestration logic manually. Virtual Network provides networking, Disk Storage provides persistent storage, and Load Balancer distributes network traffic. Logic Apps is particularly useful for event-driven business process automation and service integration.

Question 94

Which Azure capability helps organizations estimate expected cloud spending before deploying resources?

1. Azure Pricing Calculator
2. Azure Service Health
3. Azure Bastion
4. Azure Key Vault

Correct Answer: 1

Explanation

The Azure Pricing Calculator helps organizations estimate the potential cost of Azure services before deployment. Users can select services, configurations, regions, quantities, and other applicable options to develop an estimated cost. This is useful during planning and architecture decisions because organizations can compare deployment approaches and identify potentially expensive components. Pricing Calculator provides estimates rather than guaranteed final invoices. Service Health, Bastion, and Key Vault serve operational, networking, and security purposes respectively. Cost estimation should be combined with ongoing cost monitoring after deployment.

Question 95

Which Azure service can help organizations identify resources that are underutilized and may be candidates for cost optimization?

1. Azure DNS
2. Azure Advisor
3. Azure Queue Storage
4. Azure Files

Correct Answer: 2

Explanation

Azure Advisor can analyze resource usage and provide recommendations for optimizing Azure environments. Cost recommendations may identify underutilized resources or suggest changes that could reduce unnecessary spending. Organizations can use these recommendations to review resource sizing, usage patterns, and deployment configurations. Advisor does not automatically guarantee cost reductions, and recommendations should be evaluated against workload requirements before implementation. Azure DNS, Queue Storage, and Azure Files provide networking, messaging, and file storage capabilities rather than broad resource optimization recommendations.

Question 96

Which Azure security principle recommends using multiple layers of protection instead of relying on a single security control?

1. Least privilege
2. Defense in depth
3. Elasticity
4. Fault tolerance

Correct Answer: 2

Explanation

Defense in depth is a security strategy that uses multiple layers of protection so that the failure or bypass of one control does not automatically compromise the entire environment. Layers can include identity controls, network security, encryption, endpoint protection, monitoring, and application security. This approach reduces reliance on a single security mechanism. Least privilege focuses on limiting permissions, elasticity concerns dynamic resource scaling, and fault tolerance concerns resilience against failures. Defense in depth is a fundamental concept for designing layered security in Azure environments.

Question 97

Which Azure service is primarily used to provide object storage for large amounts of unstructured data?

1. Azure Blob Storage
2. Azure SQL Database
3. Azure Virtual Network
4. Azure Functions

Correct Answer: 1

Explanation

Azure Blob Storage is Microsoft’s object storage service for large amounts of unstructured data. It can store documents, images, videos, backups, logs, and many other types of files or binary content. Blob Storage provides scalable and durable storage and can be accessed by applications through supported interfaces. Azure SQL Database provides relational database capabilities, Virtual Network provides networking, and Azure Functions provides serverless compute. Blob Storage is therefore an appropriate choice when an application needs scalable storage for objects rather than relational records.

Question 98

Which Azure service provides centralized management of identities, authentication, and access to applications?

1. Azure Monitor
2. Microsoft Entra ID
3. Azure Storage
4. Azure Load Balancer

Correct Answer: 2

Explanation

Microsoft Entra ID provides identity and access management capabilities for users, applications, and services. It supports authentication, authorization integrations, single sign-on, multifactor authentication, and application identity scenarios. Entra ID helps organizations control access to cloud resources and applications while supporting centralized identity management. Azure Monitor focuses on telemetry, Storage provides data storage, and Load Balancer distributes network traffic. Identity and access management is a core part of cloud security because unauthorized access can expose applications, data, and infrastructure.

Question 99

Which Azure service is designed to help protect virtual machines by providing secure browser-based administrative access?

1. Azure Bastion
2. Azure Advisor
3. Azure Cost Management
4. Azure DNS

Correct Answer: 1

Explanation

Azure Bastion provides secure browser-based management access to supported virtual machines through the Azure portal. It can provide RDP or SSH connectivity without requiring a public IP address directly on the virtual machines. This can reduce exposure of management ports to the public internet and simplify administrative access. Azure Advisor provides recommendations, Cost Management handles spending analysis, and DNS provides domain name resolution. Bastion is therefore useful when administrators need secure management connectivity while reducing direct exposure of virtual machine management endpoints.

Question 100

Which statement best describes the benefit of cloud elasticity?

1. Resources remain fixed regardless of workload changes
2. Organizations must purchase hardware before scaling
3. Resources can adjust to changing workload demand
4. Applications can never experience performance problems

Correct Answer: 3

Explanation

Cloud elasticity allows resources to increase or decrease as workload demand changes. For example, an application may require additional compute capacity during periods of high traffic and fewer resources when demand falls. This capability can help organizations maintain performance while avoiding unnecessary resource consumption during low-demand periods. Elasticity does not guarantee perfect application performance or eliminate the need for proper architecture and monitoring. Instead, it provides flexibility to adapt resource capacity to changing workload conditions, which is one of the important advantages of cloud computing.