Microsoft Azure AZ-900 Practice Test: Azure Fundamentals

Use this AZ-900 exam simulator page when you want realistic AZ-900 practice questions, clearer explanations, and a fast route into the full IT Mastery experience on web, iOS, and Android. This page is built for search intent like AZ-900 mock exam, AZ-900 practice test, Azure Fundamentals exam simulator, and AZ-900 practice questions.

Why this AZ-900 practice page is useful

• it lets you try realistic AZ-900 practice exam questions before subscribing
• it gives you a direct path into full IT Mastery practice
• it gives you a clear web path for immediate practice
• it helps existing subscribers continue with the same account across mobile and web
• it focuses on exam-style service-choice and fundamentals questions, not long theory-heavy study notes

What premium unlocks in IT Mastery

• the full AZ-900 question bank instead of the smaller free preview
• more timed mock exams and mixed domain sets
• progress tracking and review history
• access across web, iPhone, iPad, and Android with the same subscription

AZ-900 exam snapshot

• Issuer: Microsoft
• Platform: Microsoft Azure
• Certification: Microsoft Azure Fundamentals (AZ-900)
• Audience: students, beginners, business and technical stakeholders, and career-switchers
• Experience target: 0-6 months with cloud and Azure concepts; light labs recommended
• Format: multiple choice, multiple response, short concept items, matching, and drag-and-drop
• Timing: about 60-90 minutes depending on form
• Passing: scaled score 700

What AZ-900 measures

1) Cloud concepts

• IaaS vs PaaS vs SaaS; CapEx vs OpEx; elasticity, scalability, availability
• Shared responsibility model; reliability vs fault tolerance vs disaster recovery

2) Azure architecture and core services

• Global infrastructure: regions, availability zones, region pairs
• Compute, storage, networking, and data services at fundamentals level

3) Security, identity, and governance

• Microsoft Entra ID basics; authentication vs authorization; RBAC
• Defender for Cloud, Key Vault, Network Security Groups, Private Endpoints
• Governance with management groups, subscriptions, resource groups, tags, and Azure Policy

4) Cost management and SLAs

• Pricing calculator, TCO basics, budgets, and alerts
• Service-level agreements and how redundancy affects availability

What a good AZ-900 simulator should train

• picking the right cloud service model for a scenario
• distinguishing Azure governance tools that sound similar
• understanding resiliency basics without over-engineering
• interpreting cost, SLA, and security requirements at fundamentals level
• recognizing when the simplest managed service is the best answer

Next Azure routes after AZ-900

• Move into operations and administration: AZ-104
• Compare developer and architect paths: AZ-204 and AZ-305
• Browse the Microsoft Azure family: Azure exam pages

24 AZ-900 sample questions with detailed explanations

These sample questions include the same mix of single-answer and multiple-response items you should practice for AZ-900. Use them to check your readiness here, then move into the full IT Mastery question bank for broader timed coverage.

Question 1

Topic: Domain 2: Describe Azure architecture and services

When planning to deploy an Azure virtual machine, which Azure resource is required to provide the private IP addressing and network isolation that allow the VM to communicate securely with other resources in your subscription?

Options:

• A. Network security group
• B. Managed disk
• C. Virtual network
• D. Resource group

Best answer: C

Explanation: The choice describing a virtual network is correct because a VNet is the Azure resource that defines private IP address ranges, subnets, and network isolation. Virtual machines attach their network interfaces to a subnet within a VNet, which enables private, secure communication with other resources in that network and, if configured, to on-premises networks or the internet via additional components.

Question 2

Topic: Domain 2: Describe Azure architecture and services

A company runs a two-VM web application in a single Azure region. Both VMs must remain IaaS-based and should keep running if Azure performs maintenance on one host or if a single physical server fails. Which Azure configuration should you implement?

Options:

• A. Create a separate virtual network for each virtual machine
• B. Move each virtual machine into a different resource group
• C. Place both virtual machines in an availability set
• D. Connect the virtual machines to the same Azure Load Balancer

Best answer: C

Explanation: Placing both virtual machines in an availability set is correct because an availability set explicitly controls fault domain and update domain distribution. This means Azure places the VMs so that a single physical server failure or a single maintenance event will not affect all instances, directly satisfying the requirement to keep the application running during host maintenance or hardware failure within the region.

Question 3

Topic: Domain 2: Describe Azure architecture and services

A company must perform a one-time migration of 500TB of on-premises file data into Azure Blob storage. They have a 200Mbps VPN connection to Azure and must complete the migration during a 7-day maintenance window without saturating the link needed for daily operations.

You propose several approaches.

Which TWO options should you AVOID? (Select TWO.)

Options:

• A. Use Azure Data Box Disk devices for smaller branch-office datasets and Azure Data Box Heavy for the main datacenter so that nearly all of the 500TB is shipped offline to Azure.
• B. Copy all 500TB directly over the existing 200Mbps VPN connection during the 7-day maintenance window, running transfers 24/7 and relying entirely on network-based transfer.
• C. Use your own encrypted external hard drives, ship them by courier directly to an Azure datacenter, and request that Microsoft operations staff plug them in and copy the data into your storage account as a special one-time service.
• D. Order Azure Data Box devices well before the maintenance window, preload them with the bulk of the data, ship them to Azure, and then use the 7-day window only for a small final synchronization over the VPN.
• E. Order multiple Azure Data Box or Azure Data Box Heavy devices to transfer most of the 500TB offline, then use the VPN connection only for incremental changes before the final cutover.

Correct answers: B and C

Explanation: The option that copies all 500TB directly over the existing 200Mbps VPN connection during the 7-day window should be avoided because the available throughput is far too low for such a large dataset in such a short period, especially given that the VPN is also needed for normal operations. This ignores Azure Data Box, which is specifically designed to handle large, time-bound transfers more reliably.

The option that uses customer-owned external drives shipped directly to an Azure datacenter should also be avoided because this is not a supported or secure ingestion method. Microsoft does not accept arbitrary drives for manual import. Instead, Azure Data Box provides secure, tamper-evident devices with a documented chain of custody and a supported ingestion workflow, making this ad-hoc drive-shipping approach an anti-pattern.

Question 4

Topic: Domain 2: Describe Azure architecture and services

Which of the following statements about using Azure Data Box to move data to Azure is NOT correct?

Options:

• A. Azure Data Box is a fully online service that moves data directly over the internet without using any physical hardware.
• B. Azure Data Box involves Microsoft shipping you a secure physical device that you connect on-premises to copy your data.
• C. Azure Data Box is designed for bulk data migrations when transferring data over the network would take too long or is not feasible.
• D. Azure Data Box is suitable when you need to migrate tens of terabytes or more of data within a limited time window.

Best answer: A

Explanation: The statement that Azure Data Box is a “fully online service” that moves data directly over the internet without using any physical hardware is incorrect because it reverses the core idea of the service. Azure Data Box is built around Microsoft shipping a physical device to your location, you copying data locally to that device, and then shipping it back so Microsoft can ingest the data into your storage account. That physical, offline model is what makes Data Box suitable when network-based transfer is too slow or unreliable for very large datasets.

Question 5

Topic: Domain 3: Describe Azure management and governance

Your team must deploy the same set of virtual machines, storage accounts, and networking resources to three Azure subscriptions every month. Deployments must be automated, repeatable, and defined as code stored in a Git repository, with minimal use of the Azure portal. Which of the following actions/solutions will meet these requirements? (Select TWO.)

Options:

• A. Rely on Azure Advisor recommendations to automatically create and configure the required resources every month.
• B. Define the entire environment in a Bicep file, store it in a Git repository, and deploy it to each subscription using a CI/CD pipeline.
• C. Use the Azure portal each month to manually recreate all required resources in each subscription by following a written checklist.
• D. Create an Azure Resource Manager (ARM) template for the environment and use Azure CLI to deploy it with different parameter files for each subscription.
• E. Create the resources once in a single subscription and give all teams access to that subscription instead of redeploying to each subscription.

Correct answers: B and D

Explanation: - ✔ Define the entire environment in a Bicep file, store it in a Git repository, and deploy it to each subscription using a CI/CD pipeline. This directly implements Infrastructure as Code with automation and version control, so deployments are repeatable across subscriptions.

• ✔ Create an Azure Resource Manager (ARM) template for the environment and use Azure CLI to deploy it with different parameter files for each subscription. This also uses declarative templates plus automation, meeting the needs for code-based, repeatable deployments with minimal portal use.

Question 6

Topic: Domain 2: Describe Azure architecture and services

Your company created a separate Windows virtual machine in Azure for each remote user so they can sign in with RDP and use corporate desktop applications. Users can connect, but IT reports high management overhead and rising costs for maintaining many individual VMs. You need a simpler Azure-based way to deliver Windows desktops and apps from the cloud. Which Azure service should you use?

Options:

• A. Azure Virtual Machines with autoscale
• B. Azure Virtual Desktop
• C. Azure App Service
• D. Azure VPN Gateway

Best answer: B

Explanation: Azure Virtual Desktop is purpose-built to provide cloud-hosted Windows desktops and applications to users. It reduces the need to manage many individual user-assigned VMs and instead offers a centralized, managed environment for virtual desktops and app streaming from Azure, which directly addresses the overhead and cost concerns in the scenario.

Question 7

Topic: Domain 3: Describe Azure management and governance

Your company wants to break down Azure costs by department and project using Azure Cost Management. You are defining a tagging strategy for new and existing resources. Which of the following approaches should you AVOID? (Select TWO.)

Options:

• A. Require all teams to apply a costCenter tag and a project tag to their resources using a standard set of values.
• B. Rely only on subscription-level totals for cost analysis and leave most individual resources untagged.
• C. Let each team freely choose its own tag names and values for costs, skipping shared standards or conventions.
• D. Create Azure Policy assignments that audit or enforce required cost-related tags on new resources.
• E. Use resource groups to separate major applications, and apply tags to identify the owning department and environment (such as Production or Test).

Correct answers: B and C

Explanation: The option that lets each team freely choose its own tag names and values for costs, skipping shared standards, is an anti-pattern because it destroys consistency. If teams use different tag keys (for example, Dept, Department, DeptName) and arbitrary values, you cannot easily group or filter costs across the whole organization.

The option that relies only on subscription-level totals and leaves most resources untagged is also an anti-pattern. Subscription-level data shows high-level spend but does not reveal which department or project consumes those costs. Without tags, Azure Cost Management cannot break costs down by business dimension, defeating the goal of detailed departmental and project reporting.

Question 8

Topic: Domain 2: Describe Azure architecture and services

You move an existing Azure web app to a higher pricing tier App Service plan that provides more CPU and memory and enables automatic scale-out to additional instances during traffic spikes. Which cloud principle does this change primarily demonstrate?

Options:

• A. Security and defense in depth
• B. Scalability and elasticity
• C. High availability and fault tolerance
• D. Cost optimization

Best answer: B

Explanation: Choosing scalability and elasticity is correct because changing the App Service plan pricing tier increases available compute resources and allows the app to scale out automatically when demand rises. App Service plans define the capacity and scale characteristics of web apps, so adjusting the plan to handle variable load is a direct application of the scalability principle.

Question 9

Topic: Domain 1: Describe cloud concepts

Which statement BEST describes Azure’s consumption-based pricing model?

Options:

• A. You pay only for user licenses, and resource usage is always unlimited for those licensed users.
• B. You pay a one-time upfront cost for hardware, then use Azure services at no additional charge.
• C. You pay only for the Azure resources and services you actually use, with costs based on metered usage.
• D. You pay a fixed monthly fee for a predefined amount of compute, storage, and networking capacity, whether you use it or not.

Best answer: C

Explanation: The statement that you “pay only for the Azure resources and services you actually use, with costs based on metered usage” directly captures the idea of consumption-based pricing. Azure meters usage of services (such as VM runtime, storage capacity, and data transfer) and bills you according to that actual consumption, which aligns exactly with the exam objective for cloud economics.

Question 10

Topic: Domain 2: Describe Azure architecture and services

Which TWO of the following statements about Azure availability sets are INCORRECT? (Select TWO.)

Options:

• A. Using an availability set automatically backs up or replicates your VMs to another Azure region for disaster recovery.
• B. To benefit from the platform SLA that availability sets provide, you typically deploy at least two VMs in the same availability set and distribute your workload across them.
• C. An availability set ensures that all VMs in it are rebooted at the same time during planned maintenance so operating system updates stay consistent.
• D. An availability set helps ensure that virtual machines (VMs) are placed in different fault domains so a single hardware failure is less likely to affect all VMs.
• E. Availability sets operate within a single Azure datacenter/region and do not provide cross-region disaster recovery by themselves.

Correct answers: A and C

Explanation: The statement that availability sets ensure all VMs are rebooted at the same time during planned maintenance is incorrect because the purpose of update domains is the opposite: to stagger reboots so at least some VMs stay running while others are updated.

The statement that using an availability set automatically backs up or replicates VMs to another region is also incorrect because availability sets only control VM placement across fault and update domains in a single region. Cross-region replication or backup requires separate services such as Azure Backup, geo-redundant storage, or Azure Site Recovery.

Question 11

Topic: Domain 3: Describe Azure management and governance

In Azure, what is the primary purpose of assigning tags to resources?

Options:

• A. To enforce security boundaries and access permissions by replacing role-based access control (RBAC) assignments
• B. To add name-value metadata (such as cost center or environment) so resources can be organized, filtered, and reported on for tasks like cost allocation
• C. To group related resources into a single container that shares the same lifecycle, making it easier to deploy and delete them together
• D. To define which Azure region a resource is deployed in so that data residency requirements are met

Best answer: B

Explanation: The choice that describes tags as name-value metadata used to organize, filter, and report on resources—including scenarios like cost allocation by cost center or environment—is correct because it captures the core purpose of Azure tags at a fundamentals level. Tags are specifically designed for classification and reporting, not for deployment, security, or runtime behavior changes.

Question 12

Topic: Domain 1: Describe cloud concepts

Your company stores sensitive customer data in Azure SQL Database and Azure Blob Storage. The security team requires that only authorized users can read or modify this data and that the data is encrypted with keys managed by your organization rather than only using Microsoft-managed defaults. According to the shared responsibility model, which tasks are your responsibility. Which of the following actions/solutions will meet these requirements? (Select TWO.)

Options:

• A. Ask Microsoft Support to create user accounts and assign database access permissions on your behalf.
• B. Define Microsoft Entra ID groups and assign least-privilege Azure role-based access control (RBAC) roles on the SQL database and storage account.
• C. Configure customer-managed keys (CMK) in Azure Key Vault and enable encryption at rest using those keys for Azure SQL Database and the storage account.
• D. Rely only on the default Microsoft-managed encryption settings without making any additional configuration changes.
• E. Enable resource locks (Read-only or Delete) on the storage account and SQL server to prevent accidental deletion.

Correct answers: B and C

Explanation: The option to define Microsoft Entra ID groups and assign least-privilege RBAC roles directly addresses the need to ensure that only authorized users can read or modify the data. The option to configure customer-managed keys (CMK) in Azure Key Vault and enable encryption at rest with those keys satisfies the requirement to use organization-managed keys instead of relying solely on Microsoft-managed defaults.

Question 13

Topic: Domain 2: Describe Azure architecture and services

A company runs a mission-critical web application in a single Azure region. They want the app to stay online even if one datacenter in the region loses power, cooling, or networking. You plan to use availability zones. Which TWO deployment approaches should you AVOID? (Select TWO.)

Options:

• A. Deploy all virtual machine instances for the application into the same availability zone within the region.
• B. Use Azure platform services that offer zone-redundant or zone-aware deployments (for example, zone-redundant databases) within the region.
• C. Run the production application on a single virtual machine in one availability zone and rely on daily backups to another region for recovery.
• D. Deploy virtual machine instances across at least two availability zones in the region and front them with a load balancer that supports zone redundancy.
• E. Use storage that supports zone redundancy for application data and deploy compute instances across multiple availability zones in the same region.

Correct answers: A and C

Explanation: The choice that deploys all virtual machine instances into the same availability zone is something to avoid because it creates a clear single point of failure. If that zone loses power, cooling, or network connectivity, all instances fail together, contradicting the goal of surviving a datacenter-level issue.

The choice that runs the production application on a single VM in one zone and merely relies on daily backups to another region is also an anti-pattern in this context. Backups provide disaster recovery, not continuous availability. During a zone outage, the production app would be down until you restore from backup elsewhere, which does not meet the requirement to keep the app online if a zone fails.

Question 14

Topic: Domain 1: Describe cloud concepts

A company runs a critical line-of-business web app on a single on-premises server and often experiences downtime during hardware failures. They plan to move the app to Azure and want it to keep running even if one Azure datacenter in a region becomes unavailable, while minimizing management effort. Which approach in Azure is the most appropriate?

Options:

• A. Keep the app on-premises and use Azure VPN Gateway only to back up data to Azure Storage.
• B. Move the app to one Azure Virtual Machine and keep a copy of the VM image in the same datacenter for fast restore.
• C. Host the app on Azure App Service and run multiple instances across Azure availability zones within a single region.
• D. Deploy the app on a single large Azure Virtual Machine in one region and take daily backups to Azure Storage.

Best answer: C

Explanation: Hosting the app on Azure App Service with multiple instances across availability zones uses multiple datacenters in one region for built-in redundancy while offloading most platform management to Azure, directly meeting the high-availability and low-management requirements.

Question 15

Topic: Domain 1: Describe cloud concepts

Your team is designing a new event-driven backend API in Azure. You want to minimize infrastructure management and pay only when your code or workflows run by using fully serverless services. Which of the following Azure services should you AVOID choosing? (Select TWO.)

Options:

• A. Azure Kubernetes Service (AKS)
• B. Azure Logic Apps
• C. Azure Functions
• D. Azure Virtual Machines
• E. Azure Event Grid

Correct answers: A and D

Explanation: Azure Virtual Machines is a classic IaaS offering. You must provision, configure, patch, and scale the virtual machines, and you pay for allocated compute capacity, not just for code executions. This conflicts with the requirement to avoid infrastructure management and pay only when code runs.

Azure Kubernetes Service (AKS) is a managed Kubernetes service, but it is still a cluster-based model. You manage node pools, capacity, and workloads. It is not classified as serverless in Azure Fundamentals. Therefore, both Azure Virtual Machines and Azure Kubernetes Service violate the key requirement of using fully serverless services and are the options that should be avoided.

Question 16

Topic: Domain 1: Describe cloud concepts

You manage a small Azure subscription where administrators manually configure security settings on new resources, and auditors review a sample of resources every quarter. Leadership wants to automatically enforce required configurations on all new resources and have a central view of noncompliant resources for reporting. Which approach is the most appropriate way to improve this using Azure governance features?

Options:

• A. Apply resource locks (Read-only or Delete) on critical resources to prevent changes and rely on quarterly manual audits for compliance reporting.
• B. Enable Azure Advisor recommendations and ask administrators to periodically apply suggested changes to improve security and compliance.
• C. Create and assign an Azure Policy initiative at the subscription or management group scope to enforce required configurations and use the policy compliance dashboard for reporting.
• D. Use tags on all resources to indicate their owner and environment, then export a list of tagged resources each quarter for auditors to review manually.

Best answer: C

Explanation: The choice to create and assign an Azure Policy initiative at the subscription or management group scope directly addresses both requirements: automatic enforcement of required configurations on all new resources and centralized visibility of noncompliant resources. Azure Policy evaluates resources continuously, can deny noncompliant deployments, and presents compliance status in a dedicated dashboard suitable for reporting to auditors and leadership.

Question 17

Topic: Domain 1: Describe cloud concepts

Your team wants to try several Azure services for a new product idea but must keep financial risk low. You use pay-as-you-go pricing and plan to delete test resources quickly. Which TWO actions should you AVOID if you want to minimize cost risk? (Select TWO.)

Options:

• A. Set up cost alerts and budgets to monitor spending during experiments.
• B. Use free or trial tiers of services where available for initial experiments.
• C. Deploy small test resources using pay-as-you-go pricing and delete them when testing is finished.
• D. Leave large test virtual machines running continuously after the experiment has ended.
• E. Commit to a 3-year reserved capacity purchase for a new service before running any small-scale tests.

Correct answers: D and E

Explanation: Committing to a 3-year reserved capacity purchase for a new service before running any tests undermines low-risk experimentation. Reservations are designed for predictable, long-term workloads, not for trying out services. Doing this creates financial lock-in before you know whether the service fits your needs.

Leaving large test virtual machines running continuously after the experiment has ended also conflicts with the benefits of consumption-based pricing. In Azure, running compute resources incur cost over time. If test VMs remain running when they are no longer needed, you keep paying for them, turning a low-risk experiment into unnecessary ongoing spend.

Both of these actions limit the flexibility and cost control that make consumption-based experimentation attractive, so they are the actions you should avoid.

Question 18

Topic: Domain 3: Describe Azure management and governance

Your company has many Azure storage accounts created by different teams. Some do not use secure transfer. You currently review configurations manually. You must 1) automatically block creation of noncompliant storage accounts and 2) see which existing accounts are noncompliant. Which approach is the most appropriate?

Options:

• A. Use Azure role-based access control (RBAC) to remove the permission to create storage accounts from all users except the central IT team, and have that team check secure transfer manually.
• B. Tag all storage accounts with an “Owner” tag and use Azure Cost Management + Billing reports to identify any storage accounts that do not have secure transfer enabled.
• C. Create and assign an Azure Policy that requires secure transfer on storage accounts, using policy effects to deny noncompliant new resources and audit existing ones at the subscription scope.
• D. Apply a ReadOnly resource lock to each storage account so that noncompliant settings cannot be changed without first removing the lock.

Best answer: C

Explanation: The choice to create and assign an Azure Policy that enforces secure transfer on storage accounts is correct because it directly uses Azure Policy’s deny and audit outcomes.

By assigning the policy at the subscription scope, all current and future storage accounts in that subscription are evaluated. Noncompliant new deployments are blocked by the deny effect, while existing noncompliant accounts are reported as noncompliant (audit) in the Azure Policy compliance dashboard. This exactly matches the goals of automatic enforcement and visibility into current compliance.

Question 19

Topic: Domain 2: Describe Azure architecture and services

Which Azure service is specifically designed to deliver virtualized Windows desktops and applications from Azure to users over the internet?

Options:

• A. Azure Virtual Desktop
• B. Azure Virtual Machines
• C. Azure Kubernetes Service (AKS)
• D. Azure App Service

Best answer: A

Explanation: Azure Virtual Desktop is correct because it is the dedicated Azure service for desktop and app virtualization. It is designed to deliver full Windows desktops and remote applications from Azure to users, aligning exactly with the description in the question.

Question 20

Topic: Domain 1: Describe cloud concepts

Which TWO statements about Software as a Service (SaaS) in the Microsoft cloud are correct? (Select TWO.)

Options:

• A. With SaaS, you must build and deploy the application code yourself, but you do not manage the underlying servers.
• B. Azure Virtual Machines is a typical example of a SaaS product.
• C. In SaaS, you are responsible for installing security updates on the virtual machines that run the application.
• D. Microsoft 365, where users access email and productivity apps through a browser, is an example of a SaaS offering.
• E. With SaaS, Microsoft manages the application, runtime, and operating system, and you mainly configure the app for your users.

Correct answers: D and E

Explanation: The statement that, with SaaS, Microsoft manages the application, runtime, and operating system is correct because in SaaS the provider is responsible for the full stack and customers focus on configuration and usage. The statement that Microsoft 365 is an example of a SaaS offering is also correct, as Microsoft 365 delivers hosted email and productivity apps that users access over the internet without managing servers or application installation.

Question 21

Topic: Domain 2: Describe Azure architecture and services

Your company runs a web application on a single Azure virtual machine. You need to improve resiliency to host failures and automatically add or remove VM instances as traffic changes, while continuing to use Azure VMs. Which option is the most appropriate?

Options:

• A. Move the workload to an Azure virtual machine scale set and configure autoscale rules based on CPU usage.
• B. Enable Azure Backup on the VM and configure daily backups to protect the application data.
• C. Resize the existing VM to a larger size with more CPU and memory to handle peak traffic.
• D. Create an availability set with two identically configured VMs behind a load balancer, keeping the VM count fixed.

Best answer: A

Explanation: Moving the workload to a virtual machine scale set and configuring autoscale rules based on CPU usage is correct because a scale set:

• Improves resiliency by distributing VM instances across fault and update domains.
• Enables elastic scaling by automatically adding or removing instances in response to demand.
• Continues to use Azure VMs, matching the scenario constraint to stay on virtual machines.

This option is the only one that satisfies both high availability and automatic scaling requirements together.

Question 22

Topic: Domain 2: Describe Azure architecture and services

An Azure virtual machine (VM) in a virtual network must read and write data to an Azure Storage account. To avoid any exposure to the internet, an admin disabled public network access on the storage account. Now, applications on the VM time out when connecting to Blob storage. You need to restore connectivity while keeping traffic on private IP addresses only. What should you do?

Options:

• A. Create a private endpoint for the storage account in the VM’s virtual network.
• B. Create a VPN gateway for the virtual network and reconnect the VM.
• C. Assign a public IP address to the VM and access the storage account over the internet.
• D. Enable public network access on the storage account and allow access from all networks.

Best answer: A

Explanation: Creating a private endpoint for the storage account in the VM’s virtual network gives the storage account a private IP inside that VNet. The VM can then reach Blob storage over the virtual network without using the internet, and the storage account can keep public network access disabled. This directly addresses the symptom and meets the requirement to use only private IP addresses.

Question 23

Topic: Domain 3: Describe Azure management and governance

An Azure subscription’s monthly cost increased from $1,000 in April to $1,300 in May. The finance team exports this summary from Azure Cost Management + Billing:

Based on this data, which factor most likely explains the majority of the cost increase? (Assume the table includes all relevant resource costs and use simple dollar differences.)

Options:

• A. Enabling Azure Backup on one additional virtual machine
• B. Much more data being transferred out of Azure to the internet
• C. Storing slightly more data in the same storage accounts
• D. Running virtual machines for a few extra hours each month

Best answer: B

Explanation: The choice stating that there is much more data transferred out of Azure to the internet matches the $270 networking cost increase, which is by far the largest change. Since networking costs are largely driven by outbound data egress, this factor best explains the majority of the $300 total cost increase.

Question 24

Topic: Domain 2: Describe Azure architecture and services

Which of the following statements about Azure Files is NOT correct?

Options:

• A. Azure Files provides fully managed file shares in Azure storage that can replace or extend traditional on-premises file servers.
• B. Azure Files supports access over standard network file protocols such as SMB and, for supported scenarios, NFS.
• C. Azure Files requires you to deploy and manage your own Windows or Linux file server virtual machines for hosting the shares.
• D. Multiple Azure virtual machines and on-premises clients can mount and access the same Azure file share concurrently.

Best answer: C

Explanation: The statement that claims Azure Files requires you to deploy and manage your own Windows or Linux file server virtual machines for hosting the shares is not correct. Azure Files is a managed file share service built into Azure Storage. Microsoft operates the underlying file server infrastructure, so you do not create or maintain separate file server VMs for the shares themselves. This is a key benefit compared to running your own file server on IaaS virtual machines.

Need deeper concept review first?

If you want concept-first reading before heavier simulator work, use the companion guide at TechExamLexicon.com .

Continue with the full AZ-900 simulator