AZ-900 Describe Azure Architecture and Services Practice Questions

Free AZ-900 Describe Azure Architecture and Services practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main AZ-900 page. Sign up free to practice the full set.

1. Question 1Describe Azure Architecture and Services

   A company is considering moving to the cloud and is concerned about data sovereignty. Which cloud concept addresses the requirement to keep data within a specific geographic boundary?

   • AManagement groups
   • BResource groups
   • CAzure regions and data residencyCorrect
   • DAvailability zones
   ✓ Correct answer: C

   Azure regions are geographic areas that contain one or more datacenters, and data residency policies associated with these regions ensure that customer data stays within specified geographic boundaries. When a company is concerned about data sovereignty, they can select an Azure region that aligns with local regulations and compliance requirements, ensuring that their data is stored and processed within the required jurisdiction.

   Why the other options are wrong

   • AManagement groups are organizational containers used to manage access, policies, and compliance across multiple Azure subscriptions, and do not control where data is physically stored.
   • BResource groups are logical containers for grouping and managing related Azure resources, but they do not enforce geographic data residency.
   • DAvailability zones are physically separate locations within a single Azure region designed for high availability, but they do not address the requirement to keep data within a specific country or geographic boundary.
2. Question 2Describe Azure Architecture and Services

   Tailwind Traders needs to provide secure, seamless Remote Desktop Protocol (RDP) connectivity to Azure virtual machines directly through the Azure portal without exposing the VMs to the public internet. Which service should they use?

   • AAzure VPN Gateway
   • BAzure Application Gateway
   • CAzure Load Balancer
   • DAzure BastionCorrect
   ✓ Correct answer: D

   Azure Bastion is a fully managed Platform as a Service that provides secure and seamless RDP and SSH connectivity to Azure virtual machines directly through the Azure portal over TLS. It eliminates the need to assign public IP addresses to VMs or configure inbound NSG rules for RDP and SSH, significantly reducing the attack surface. Azure Bastion is deployed per virtual network and provides connectivity to all VMs within that network.

   Why the other options are wrong

   • AAzure VPN Gateway creates encrypted site-to-site or point-to-site connections between on-premises networks and Azure, but it does not provide direct browser-based RDP access through the Azure portal.
   • BAzure Application Gateway is a Layer 7 web traffic load balancer that provides features like SSL termination and URL-based routing, not a service for secure RDP connectivity to virtual machines.
   • CAzure Load Balancer distributes inbound network traffic across backend resources at Layer 4, but it does not provide secure, portal-based RDP or SSH access to individual virtual machines.
3. Question 3Describe Azure Architecture and Services

   Which Azure service acts as a centralized directory for managing user identities, authentication, and authorization for cloud applications?

   • AAzure Monitor
   • BAzure Key Vault
   • CMicrosoft Entra IDCorrect
   • DAzure Policy
   ✓ Correct answer: C

   Microsoft Entra ID is Microsoft's cloud-based identity and access management service that serves as a centralized directory for managing user identities, authentication, and authorization. It supports single sign-on (SSO), multi-factor authentication (MFA), and conditional access policies for securing access to cloud applications, and it integrates with thousands of SaaS applications, Azure resources, and Microsoft 365 services.

   Why the other options are wrong

   • AAzure Monitor collects telemetry, logs, and metrics for observability; it does not act as a directory for user identities or authentication.
   • BAzure Key Vault safeguards secrets and certificates; it secures credentials but is not the centralized identity directory for applications.
   • DAzure Policy governs resource configuration compliance; it does not store user identities or handle authentication and authorization.
4. Question 4Describe Azure Architecture and ServicesSelect all that apply

   Which two Azure services provide identity and access management capabilities? (Choose two.)

   • AAzure Key Vault for storing secrets and keys
   • BAzure Firewall for network traffic filtering
   • CMicrosoft Entra IDCorrect
   • DAzure Multi-Factor AuthenticationCorrect
   ✓ Correct answer: C, D

   Microsoft Entra ID is Azure's cloud-based identity and access management service that provides authentication and authorization for users, applications, and services. It supports single sign-on, conditional access policies, and integration with thousands of SaaS applications. Azure Multi-Factor Authentication adds an additional layer of security by requiring users to verify their identity using two or more verification methods, such as a password plus a phone notification or biometric. Together, these services form the foundation of identity and access management in Azure.

   Why the other options are wrong

   • AAzure Key Vault is a service for securely storing secrets, keys, and certificates, not for managing user identities or controlling access to resources.
   • BAzure Firewall is a network security service that filters and controls inbound and outbound traffic based on rules, and it does not provide identity or access management capabilities.
5. Question 5Describe Azure Architecture and ServicesSelect all that apply

   A company is designing a highly available architecture in Azure. Which TWO of the following strategies would improve the availability of their application? (Choose two.)

   • AUsing a single, larger VM with more CPU and memory
   • BStoring all data in a single storage account without replication
   • CDeploying VMs across multiple Availability Zones within a regionCorrect
   • DDeploying the application in multiple Azure regions with Traffic ManagerCorrect
   • EUsing only spot instances for production workloads
   ✓ Correct answer: C, D

   Deploying virtual machines across multiple Availability Zones protects against datacenter-level failures because each zone consists of one or more physically separate data centers with independent power, cooling, and networking. Deploying the application across multiple Azure regions with Traffic Manager provides protection against entire region-level outages and ensures users can be routed to a healthy region if one becomes unavailable. Together, these strategies provide defense against both datacenter and regional failures.

   Why the other options are wrong

   • AUsing a single, larger VM with more CPU and memory creates a single point of failure and does not improve availability regardless of how powerful the machine is.
   • BStoring all data in a single storage account without replication creates a data durability risk and does not improve availability since the data has no redundancy.
   • EUsing only spot instances for production workloads is unsuitable for availability because spot instances can be evicted at any time when Azure needs the capacity back.
6. Question 6Describe Azure Architecture and Services

   Azure ExpressRoute provides a private connection between on-premises networks and Azure that does not travel over the public internet.

   • ATrueCorrect
   • BFalse
   ✓ Correct answer: A

   Azure ExpressRoute is a fully supported Azure networking service that provides private, dedicated, high-bandwidth connections between on-premises infrastructure and Azure datacenters. It bypasses the public internet to deliver more reliable, faster, and lower-latency connectivity. For organizations like Alpine Ski House, ExpressRoute is a valuable feature for implementing hybrid solutions that require consistent network performance and enhanced security for data transfers between on-premises environments and Azure cloud services. It is available across many Azure regions and supports various connectivity models including co-location, point-to-point Ethernet, and any-to-any IPVPN networks.

   Why the other options are wrong

   • BFalse is incorrect. The statement is true: Azure ExpressRoute is a fully supported Azure networking service that provides private, dedicated, high-bandwidth connections between on-premises infrastructure and Azure datacenters.
7. Question 7Describe Azure Architecture and Services

   Which Azure Storage service is optimized for storing massive amounts of unstructured data such as text files, images, and video?

   • AAzure Table Storage
   • BAzure Blob StorageCorrect
   • CAzure Queue Storage
   • DAzure Files
   ✓ Correct answer: B

   Azure Blob Storage is specifically optimized for storing massive amounts of unstructured data, including text and binary data such as documents, images, video, audio, and log files. Blob stands for Binary Large Object, and the service is designed to handle scenarios ranging from serving images directly to a browser to storing files for distributed access. Blob Storage offers multiple access tiers (Hot, Cool, Cold, and Archive) to optimize costs based on how frequently data is accessed.

   Why the other options are wrong

   • AAzure Table Storage is a NoSQL key-value store designed for structured, non-relational data with a schemaless design, not optimized for storing large unstructured files like images and video.
   • CAzure Queue Storage provides cloud messaging between application components for building asynchronous workflows, not for storing unstructured data files.
   • DAzure Files provides fully managed file shares accessible via the SMB protocol, designed for lift-and-shift scenarios and shared file access rather than storing massive volumes of unstructured data like media files.
8. Question 8Describe Azure Architecture and Services

   Azure role-based access control (RBAC) can be applied at the management group, subscription, resource group, and individual resource levels.

   • ATrueCorrect
   • BFalse
   ✓ Correct answer: A

   Azure role-based access control (RBAC) can be applied at multiple levels of the Azure resource hierarchy. These levels include management groups, subscriptions, resource groups, and individual resources. When a role is assigned at a higher scope, such as a management group, the permissions are inherited by all child scopes beneath it. This flexible scoping model allows administrators to grant broad access at higher levels or fine-grained access at the individual resource level, following the principle of least privilege. No is incorrect because Azure RBAC is specifically designed to operate across all four levels of the resource hierarchy. The ability to assign roles at management group, subscription, resource group, and resource scopes is a core feature of the Azure RBAC model.

   Why the other options are wrong

   • BFalse is incorrect. The statement is true: Azure role-based access control (RBAC) can be applied at multiple levels of the Azure resource hierarchy. These levels include management groups, subscriptions, resource groups, and individual resources.

How Describe Azure Architecture and Services is tested

This domain holds 340 of the 972 questions in the AZ-900 bank, about 35%. The mix is 227 single-answer multiple choice, 45 true/false, 36 multiple-response, 12 yes/no scenario, 11 hotspot and 9 ordering, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Describe Azure Architecture and Services on its own rather than re-running full-length mocks.

Other AZ-900 exam domains

• Describe Cloud Concepts292 questions
• Describe Azure Management and Governance340 questions
• All AZ-900 practice questions972 total
• Describe Azure Architecture and Services study notesKey concepts
• Microsoft practice examsAll Microsoft

AZ-900 Describe Azure Architecture and Services FAQ