Microsoft AZ-900 Exam Dumps, Practice Test Questions

100% Latest & Updated Microsoft AZ-900 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!

Microsoft AZ-900 Premium Bundle
$79.97
$59.98

AZ-900 Premium Bundle

  • Premium File: 482 Questions & Answers. Last update: Nov 5, 2026
  • Training Course: 85 Video Lectures
  • Study Guide: 425 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates

AZ-900 Premium Bundle

Microsoft AZ-900 Premium Bundle
  • Premium File: 482 Questions & Answers. Last update: Nov 5, 2026
  • Training Course: 85 Video Lectures
  • Study Guide: 425 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
$79.97
$59.98

Microsoft AZ-900 Practice Test 41

Question 400

A business needs a managed Kubernetes control plane for many containerized services. The team observes: Container teams are forced to script every host and scheduler task manually. Which planning or configuration error best accounts for this result?

  1. They were not placed in the intended availability-set fault/update separation.
  2. Private zone records or VNet links were not configured correctly.
  3. An unmanaged container runtime was chosen instead of orchestration.
  4. A managed app service was chosen despite the need for VM-level control.

Explanation

Correct Answer

C:

An unmanaged container runtime was chosen instead of orchestration. That explains the symptom: Container teams are forced to script every host and scheduler task manually. The targeted corrective action is: Create an AKS cluster and configure supported node and network settings.

Incorrect Answers

A:

This cause is consistent with a different issue: Both critical VMs are interrupted by a shared maintenance event. It does not account for the reported symptom here: Container teams are forced to script every host and scheduler task manually.

B:

The alternate mechanism would more directly produce this other failure: DNS returns the public address despite an existing private endpoint. The current incident instead involves: Container teams are forced to script every host and scheduler task manually.

D:

This cause is consistent with a different issue: The application host does not permit required guest OS changes. It does not account for the reported symptom here: Container teams are forced to script every host and scheduler task manually.

Question 401

A developer wants a simple containerized web API without managing a Kubernetes cluster. Which Azure or cloud concept most directly matches the requirement?

  1. Consider Azure Container Apps for eligible managed application containers.
  2. Choose Azure Kubernetes Service when Kubernetes orchestration is required.
  3. Keep the VM on private VNet addressing without unnecessary public IP.
  4. Recognize VM Scale Sets manage groups of VMs while App Service manages application hosting.

Explanation

Correct Answer

A:

Consider Azure Container Apps for eligible managed application containers. The governing requirement is: A developer wants a simple containerized web API without managing a Kubernetes cluster. This solution specifically supports the outcome that the container responds to requests without customer cluster administration.

Incorrect Answers

B:

That concept addresses this separate situation: A business needs a managed Kubernetes control plane for many containerized services. It does not by itself establish the result required here: The container responds to requests without customer cluster administration.

C:

This option solves a different planning problem: A development team wants its VM to be reachable only from its private corporate VPN. The current acceptance criterion is specific: The container responds to requests without customer cluster administration.

D:

This design is appropriate for a different requirement: A batch team must distinguish a VM scale set from Azure App Service autoscale. Here the decisive outcome must instead be: The container responds to requests without customer cluster administration.

Question 402

A developer wants a simple containerized web API without managing a Kubernetes cluster. Which implementation step would best fulfill the stated requirement?

  1. Deploy the container app with ingress and scaling appropriate to the API.
  2. Configure an eligible host pool and identity-aware user access.
  3. Link the private DNS zone to the appropriate VNet and add records.
  4. Create the required public DNS zone and supported record set.

Explanation

Correct Answer

A:

Deploy the container app with ingress and scaling appropriate to the API. The implementation operationalizes this design choice: Consider Azure Container Apps for eligible managed application containers. Acceptance should demonstrate: The container responds to requests without customer cluster administration.

Incorrect Answers

B:

That action implements a different requirement: A company wants hosted Windows desktops accessed by employees from different locations. It does not establish the required result in this case: The container responds to requests without customer cluster administration.

C:

This change would be appropriate under a different condition: A private VNet workload needs internal name resolution not exposed to public DNS. Here it would not validate: The container responds to requests without customer cluster administration.

D:

This setup is relevant to another workload: An administrator wants hostnames in a company's own domain to resolve to Azure services. The current configuration must instead achieve: The container responds to requests without customer cluster administration.

Question 403

A developer wants a simple containerized web API without managing a Kubernetes cluster. Which result would best demonstrate successful implementation?

  1. The workload detects its GPU and completes encoding as designed.
  2. The runtime executes with the needed dependencies and access boundary.
  3. VNet clients resolve internal hostnames to private addresses.
  4. The container responds to requests without customer cluster administration.

Explanation

Correct Answer

D:

The container responds to requests without customer cluster administration. That directly tests the stated requirement: A developer wants a simple containerized web API without managing a Kubernetes cluster. It contrasts with the observed failure: Engineers must manage Kubernetes masters for a simple container app.

Incorrect Answers

A:

This observation is evidence for a separate scenario: A video encoder needs GPU-accelerated processing inside a customer-controlled guest. It does not test the necessary outcome here: The container responds to requests without customer cluster administration.

B:

That check tests another control: A developer wants to host a Linux application with a custom runtime not supported by a managed web tier. The decisive result for this workload is: The container responds to requests without customer cluster administration.

C:

The test is relevant when a private VNet workload needs internal name resolution not exposed to public DNS. It cannot establish the specified acceptance result: The container responds to requests without customer cluster administration.

Question 404

A developer wants a simple containerized web API without managing a Kubernetes cluster. The team observes: Engineers must manage Kubernetes masters for a simple container app. What should the team identify as the primary mechanism behind the problem?

  1. VNet peering was not configured for the intended private path.
  2. They used public exposure instead of private hybrid network connectivity.
  3. The service model was more operationally complex than necessary.
  4. The private endpoint or its DNS integration was missing.

Explanation

Correct Answer

C:

The service model was more operationally complex than necessary. That explains the symptom: Engineers must manage Kubernetes masters for a simple container app. The targeted corrective action is: Deploy the container app with ingress and scaling appropriate to the API.

Incorrect Answers

A:

This cause is consistent with a different issue: Users route all traffic through the public internet unnecessarily. It does not account for the reported symptom here: Engineers must manage Kubernetes masters for a simple container app.

B:

The alternate mechanism would more directly produce this other failure: Administrators publish the internal service on a public endpoint for office access. The current incident instead involves: Engineers must manage Kubernetes masters for a simple container app.

D:

This cause is consistent with a different issue: The database is reachable only through a public service endpoint. It does not account for the reported symptom here: Engineers must manage Kubernetes masters for a simple container app.

Question 405

A security team needs to place two front-end VMs on the same isolated Azure network. Which design choice best fits the stated business constraint?

  1. Use subnets and appropriate network controls within the VNet.
  2. Choose a VM or supported container host that can run the required runtime.
  3. Use an Azure Virtual Network as the logical private networking boundary.
  4. Select Azure VPN Gateway for supported internet-based encrypted VPN connectivity.

Explanation

Correct Answer

C:

Use an Azure Virtual Network as the logical private networking boundary. The governing requirement is: A security team needs to place two front-end VMs on the same isolated Azure network. This solution specifically supports the outcome that the VMs communicate over their approved private network.

Incorrect Answers

A:

This design is appropriate for a different requirement: A three-tier app must isolate database traffic from front-end workload traffic. Here the decisive outcome must instead be: The VMs communicate over their approved private network.

B:

That concept addresses this separate situation: A developer wants to host a Linux application with a custom runtime not supported by a managed web tier. It does not by itself establish the result required here: The VMs communicate over their approved private network.

D:

This design is appropriate for a different requirement: A company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. Here the decisive outcome must instead be: The VMs communicate over their approved private network.

Question 406

A security team needs to place two front-end VMs on the same isolated Azure network. Which Azure setup action best follows from this scenario?

  1. Attach the VMs to subnets in the approved VNet.
  2. Deploy the VM without a public IP when private connectivity suffices.
  3. Deploy a scale set with autoscale and a suitable image configuration.
  4. Place the appropriate VMs in one availability set with separate fault/update domains.

Explanation

Correct Answer

A:

Attach the VMs to subnets in the approved VNet. The implementation operationalizes this design choice: Use an Azure Virtual Network as the logical private networking boundary. Acceptance should demonstrate: The VMs communicate over their approved private network.

Incorrect Answers

B:

That action implements a different requirement: A service owner uses a VM and assumes a public IP is always required. It does not establish the required result in this case: The VMs communicate over their approved private network.

C:

This change would be appropriate under a different condition: A retail API must automatically add identical VM workers during holiday traffic. Here it would not validate: The VMs communicate over their approved private network.

D:

This setup is relevant to another workload: Two critical VMs in one region need separation from common host hardware maintenance faults. The current configuration must instead achieve: The VMs communicate over their approved private network.

Question 407

A security team needs to place two front-end VMs on the same isolated Azure network. Which verification outcome should the team expect from the right design?

  1. The private connectivity service uses its dedicated provider path.
  2. VNet clients resolve internal hostnames to private addresses.
  3. The VMs communicate over their approved private network.
  4. Authorized private addresses communicate between peered VNets.

Explanation

Correct Answer

C:

The VMs communicate over their approved private network. That directly tests the stated requirement: A security team needs to place two front-end VMs on the same isolated Azure network. It contrasts with the observed failure: Both VMs have public addresses but no defined private network path.

Incorrect Answers

A:

This observation is evidence for a separate scenario: A manufacturer requires private dedicated connectivity between its WAN provider and Azure. It does not test the necessary outcome here: The VMs communicate over their approved private network.

B:

That check tests another control: A private VNet workload needs internal name resolution not exposed to public DNS. The decisive result for this workload is: The VMs communicate over their approved private network.

D:

This observation is evidence for a separate scenario: Two business units operate separate VNets in one region and require private connectivity. It does not test the necessary outcome here: The VMs communicate over their approved private network.

Question 408

A security team needs to place two front-end VMs on the same isolated Azure network. The team observes: Both VMs have public addresses but no defined private network path. Which underlying mistake most directly explains the reported symptom?

  1. The hybrid VPN gateway connection was not established.
  2. They were not placed on the intended shared VNet.
  3. Only layer-four load balancing was used for a layer-seven routing need.
  4. The subnet IP prefixes were planned with overlapping address ranges.

Explanation

Correct Answer

B:

They were not placed on the intended shared VNet. That explains the symptom: Both VMs have public addresses but no defined private network path. The targeted corrective action is: Attach the VMs to subnets in the approved VNet.

Incorrect Answers

A:

This cause is consistent with a different issue: Office traffic reaches only public-facing application endpoints. It does not account for the reported symptom here: Both VMs have public addresses but no defined private network path.

C:

That explanation belongs to a different fault pattern: All URLs route to one backend despite distinct application paths. It does not explain why both VMs have public addresses but no defined private network path.

D:

This cause is consistent with a different issue: Subnet creation fails because the proposed CIDR blocks overlap. It does not account for the reported symptom here: Both VMs have public addresses but no defined private network path.

Question 409

A three-tier app must isolate database traffic from front-end workload traffic. What is the most appropriate cloud concept or service for this need?

  1. Use network security group rules to filter allowed inbound network traffic.
  2. Use Azure virtual network peering when the supported network designs permit it.
  3. Use subnets and appropriate network controls within the VNet.
  4. Choose Azure App Service for eligible managed web-app hosting.

Explanation

Correct Answer

C:

Use subnets and appropriate network controls within the VNet. The governing requirement is: A three-tier app must isolate database traffic from front-end workload traffic. This solution specifically supports the outcome that only permitted tier-to-tier connections succeed.

Incorrect Answers

A:

This design is appropriate for a different requirement: A security administrator wants to allow HTTPS but block unsolicited remote management to a VM. Here the decisive outcome must instead be: Only permitted tier-to-tier connections succeed.

B:

That concept addresses this separate situation: Two business units operate separate VNets in one region and require private connectivity. It does not by itself establish the result required here: Only permitted tier-to-tier connections succeed.

D:

This design is appropriate for a different requirement: An e-commerce team has a simple website and does not want to patch guest OS hosts. Here the decisive outcome must instead be: Only permitted tier-to-tier connections succeed.

Question 410

A three-tier app must isolate database traffic from front-end workload traffic. What should the team configure or perform to implement the correct approach?

  1. Deploy the runtime on an eligible chosen compute platform.
  2. Provision a compatible Windows VM with needed disk and network settings.
  3. Place tiers in defined subnets and apply required NSG rules.
  4. Build and deploy an approved container image to an eligible host.

Explanation

Correct Answer

C:

Place tiers in defined subnets and apply required NSG rules. The implementation operationalizes this design choice: Use subnets and appropriate network controls within the VNet. Acceptance should demonstrate: Only permitted tier-to-tier connections succeed.

Incorrect Answers

A:

This setup is relevant to another workload: A developer wants to host a Linux application with a custom runtime not supported by a managed web tier. The current configuration must instead achieve: Only permitted tier-to-tier connections succeed.

B:

That action implements a different requirement: A legacy finance application requires a full Windows Server guest with installed proprietary software. It does not establish the required result in this case: Only permitted tier-to-tier connections succeed.

D:

This setup is relevant to another workload: A team must package a microservice and its libraries consistently across environments. The current configuration must instead achieve: Only permitted tier-to-tier connections succeed.

Microsoft Azure Fundamentals (AZ-900) Practice Tests

UP

SPECIAL OFFER: GET 10% OFF

This is ONE TIME OFFER

ExamSnap Discount Offer
Enter Your Email Address to Receive Your 10% Off Discount Code

A confirmation link will be sent to this email address to verify your login. *We value your privacy. We will not rent or sell your email address.

Download Free Demo of VCE Exam Simulator

Experience Avanset VCE Exam Simulator for yourself.

Simply submit your e-mail address below to get started with our interactive software demo of your free trial.

Free Demo Limits: In the demo version you will be able to access only first 5 questions from exam.