100% Latest & Updated Microsoft AZ-900 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 400
A business needs a managed Kubernetes control plane for many containerized services. The team observes: Container teams are forced to script every host and scheduler task manually. Which planning or configuration error best accounts for this result?
- They were not placed in the intended availability-set fault/update separation.
- Private zone records or VNet links were not configured correctly.
- An unmanaged container runtime was chosen instead of orchestration.
- A managed app service was chosen despite the need for VM-level control.
Explanation
Correct Answer
C:An unmanaged container runtime was chosen instead of orchestration. That explains the symptom: Container teams are forced to script every host and scheduler task manually. The targeted corrective action is: Create an AKS cluster and configure supported node and network settings.
Incorrect Answers
A:This cause is consistent with a different issue: Both critical VMs are interrupted by a shared maintenance event. It does not account for the reported symptom here: Container teams are forced to script every host and scheduler task manually.
B:The alternate mechanism would more directly produce this other failure: DNS returns the public address despite an existing private endpoint. The current incident instead involves: Container teams are forced to script every host and scheduler task manually.
D:This cause is consistent with a different issue: The application host does not permit required guest OS changes. It does not account for the reported symptom here: Container teams are forced to script every host and scheduler task manually.
Question 401
A developer wants a simple containerized web API without managing a Kubernetes cluster. Which Azure or cloud concept most directly matches the requirement?
- Consider Azure Container Apps for eligible managed application containers.
- Choose Azure Kubernetes Service when Kubernetes orchestration is required.
- Keep the VM on private VNet addressing without unnecessary public IP.
- Recognize VM Scale Sets manage groups of VMs while App Service manages application hosting.
Explanation
Correct Answer
A:Consider Azure Container Apps for eligible managed application containers. The governing requirement is: A developer wants a simple containerized web API without managing a Kubernetes cluster. This solution specifically supports the outcome that the container responds to requests without customer cluster administration.
Incorrect Answers
B:That concept addresses this separate situation: A business needs a managed Kubernetes control plane for many containerized services. It does not by itself establish the result required here: The container responds to requests without customer cluster administration.
C:This option solves a different planning problem: A development team wants its VM to be reachable only from its private corporate VPN. The current acceptance criterion is specific: The container responds to requests without customer cluster administration.
D:This design is appropriate for a different requirement: A batch team must distinguish a VM scale set from Azure App Service autoscale. Here the decisive outcome must instead be: The container responds to requests without customer cluster administration.
Question 402
A developer wants a simple containerized web API without managing a Kubernetes cluster. Which implementation step would best fulfill the stated requirement?
- Deploy the container app with ingress and scaling appropriate to the API.
- Configure an eligible host pool and identity-aware user access.
- Link the private DNS zone to the appropriate VNet and add records.
- Create the required public DNS zone and supported record set.
Explanation
Correct Answer
A:Deploy the container app with ingress and scaling appropriate to the API. The implementation operationalizes this design choice: Consider Azure Container Apps for eligible managed application containers. Acceptance should demonstrate: The container responds to requests without customer cluster administration.
Incorrect Answers
B:That action implements a different requirement: A company wants hosted Windows desktops accessed by employees from different locations. It does not establish the required result in this case: The container responds to requests without customer cluster administration.
C:This change would be appropriate under a different condition: A private VNet workload needs internal name resolution not exposed to public DNS. Here it would not validate: The container responds to requests without customer cluster administration.
D:This setup is relevant to another workload: An administrator wants hostnames in a company's own domain to resolve to Azure services. The current configuration must instead achieve: The container responds to requests without customer cluster administration.
Question 403
A developer wants a simple containerized web API without managing a Kubernetes cluster. Which result would best demonstrate successful implementation?
- The workload detects its GPU and completes encoding as designed.
- The runtime executes with the needed dependencies and access boundary.
- VNet clients resolve internal hostnames to private addresses.
- The container responds to requests without customer cluster administration.
Explanation
Correct Answer
D:The container responds to requests without customer cluster administration. That directly tests the stated requirement: A developer wants a simple containerized web API without managing a Kubernetes cluster. It contrasts with the observed failure: Engineers must manage Kubernetes masters for a simple container app.
Incorrect Answers
A:This observation is evidence for a separate scenario: A video encoder needs GPU-accelerated processing inside a customer-controlled guest. It does not test the necessary outcome here: The container responds to requests without customer cluster administration.
B:That check tests another control: A developer wants to host a Linux application with a custom runtime not supported by a managed web tier. The decisive result for this workload is: The container responds to requests without customer cluster administration.
C:The test is relevant when a private VNet workload needs internal name resolution not exposed to public DNS. It cannot establish the specified acceptance result: The container responds to requests without customer cluster administration.
Question 404
A developer wants a simple containerized web API without managing a Kubernetes cluster. The team observes: Engineers must manage Kubernetes masters for a simple container app. What should the team identify as the primary mechanism behind the problem?
- VNet peering was not configured for the intended private path.
- They used public exposure instead of private hybrid network connectivity.
- The service model was more operationally complex than necessary.
- The private endpoint or its DNS integration was missing.
Explanation
Correct Answer
C:The service model was more operationally complex than necessary. That explains the symptom: Engineers must manage Kubernetes masters for a simple container app. The targeted corrective action is: Deploy the container app with ingress and scaling appropriate to the API.
Incorrect Answers
A:This cause is consistent with a different issue: Users route all traffic through the public internet unnecessarily. It does not account for the reported symptom here: Engineers must manage Kubernetes masters for a simple container app.
B:The alternate mechanism would more directly produce this other failure: Administrators publish the internal service on a public endpoint for office access. The current incident instead involves: Engineers must manage Kubernetes masters for a simple container app.
D:This cause is consistent with a different issue: The database is reachable only through a public service endpoint. It does not account for the reported symptom here: Engineers must manage Kubernetes masters for a simple container app.
Question 405
A security team needs to place two front-end VMs on the same isolated Azure network. Which design choice best fits the stated business constraint?
- Use subnets and appropriate network controls within the VNet.
- Choose a VM or supported container host that can run the required runtime.
- Use an Azure Virtual Network as the logical private networking boundary.
- Select Azure VPN Gateway for supported internet-based encrypted VPN connectivity.
Explanation
Correct Answer
C:Use an Azure Virtual Network as the logical private networking boundary. The governing requirement is: A security team needs to place two front-end VMs on the same isolated Azure network. This solution specifically supports the outcome that the VMs communicate over their approved private network.
Incorrect Answers
A:This design is appropriate for a different requirement: A three-tier app must isolate database traffic from front-end workload traffic. Here the decisive outcome must instead be: The VMs communicate over their approved private network.
B:That concept addresses this separate situation: A developer wants to host a Linux application with a custom runtime not supported by a managed web tier. It does not by itself establish the result required here: The VMs communicate over their approved private network.
D:This design is appropriate for a different requirement: A company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. Here the decisive outcome must instead be: The VMs communicate over their approved private network.
Question 406
A security team needs to place two front-end VMs on the same isolated Azure network. Which Azure setup action best follows from this scenario?
- Attach the VMs to subnets in the approved VNet.
- Deploy the VM without a public IP when private connectivity suffices.
- Deploy a scale set with autoscale and a suitable image configuration.
- Place the appropriate VMs in one availability set with separate fault/update domains.
Explanation
Correct Answer
A:Attach the VMs to subnets in the approved VNet. The implementation operationalizes this design choice: Use an Azure Virtual Network as the logical private networking boundary. Acceptance should demonstrate: The VMs communicate over their approved private network.
Incorrect Answers
B:That action implements a different requirement: A service owner uses a VM and assumes a public IP is always required. It does not establish the required result in this case: The VMs communicate over their approved private network.
C:This change would be appropriate under a different condition: A retail API must automatically add identical VM workers during holiday traffic. Here it would not validate: The VMs communicate over their approved private network.
D:This setup is relevant to another workload: Two critical VMs in one region need separation from common host hardware maintenance faults. The current configuration must instead achieve: The VMs communicate over their approved private network.
Question 407
A security team needs to place two front-end VMs on the same isolated Azure network. Which verification outcome should the team expect from the right design?
- The private connectivity service uses its dedicated provider path.
- VNet clients resolve internal hostnames to private addresses.
- The VMs communicate over their approved private network.
- Authorized private addresses communicate between peered VNets.
Explanation
Correct Answer
C:The VMs communicate over their approved private network. That directly tests the stated requirement: A security team needs to place two front-end VMs on the same isolated Azure network. It contrasts with the observed failure: Both VMs have public addresses but no defined private network path.
Incorrect Answers
A:This observation is evidence for a separate scenario: A manufacturer requires private dedicated connectivity between its WAN provider and Azure. It does not test the necessary outcome here: The VMs communicate over their approved private network.
B:That check tests another control: A private VNet workload needs internal name resolution not exposed to public DNS. The decisive result for this workload is: The VMs communicate over their approved private network.
D:This observation is evidence for a separate scenario: Two business units operate separate VNets in one region and require private connectivity. It does not test the necessary outcome here: The VMs communicate over their approved private network.
Question 408
A security team needs to place two front-end VMs on the same isolated Azure network. The team observes: Both VMs have public addresses but no defined private network path. Which underlying mistake most directly explains the reported symptom?
- The hybrid VPN gateway connection was not established.
- They were not placed on the intended shared VNet.
- Only layer-four load balancing was used for a layer-seven routing need.
- The subnet IP prefixes were planned with overlapping address ranges.
Explanation
Correct Answer
B:They were not placed on the intended shared VNet. That explains the symptom: Both VMs have public addresses but no defined private network path. The targeted corrective action is: Attach the VMs to subnets in the approved VNet.
Incorrect Answers
A:This cause is consistent with a different issue: Office traffic reaches only public-facing application endpoints. It does not account for the reported symptom here: Both VMs have public addresses but no defined private network path.
C:That explanation belongs to a different fault pattern: All URLs route to one backend despite distinct application paths. It does not explain why both VMs have public addresses but no defined private network path.
D:This cause is consistent with a different issue: Subnet creation fails because the proposed CIDR blocks overlap. It does not account for the reported symptom here: Both VMs have public addresses but no defined private network path.
Question 409
A three-tier app must isolate database traffic from front-end workload traffic. What is the most appropriate cloud concept or service for this need?
- Use network security group rules to filter allowed inbound network traffic.
- Use Azure virtual network peering when the supported network designs permit it.
- Use subnets and appropriate network controls within the VNet.
- Choose Azure App Service for eligible managed web-app hosting.
Explanation
Correct Answer
C:Use subnets and appropriate network controls within the VNet. The governing requirement is: A three-tier app must isolate database traffic from front-end workload traffic. This solution specifically supports the outcome that only permitted tier-to-tier connections succeed.
Incorrect Answers
A:This design is appropriate for a different requirement: A security administrator wants to allow HTTPS but block unsolicited remote management to a VM. Here the decisive outcome must instead be: Only permitted tier-to-tier connections succeed.
B:That concept addresses this separate situation: Two business units operate separate VNets in one region and require private connectivity. It does not by itself establish the result required here: Only permitted tier-to-tier connections succeed.
D:This design is appropriate for a different requirement: An e-commerce team has a simple website and does not want to patch guest OS hosts. Here the decisive outcome must instead be: Only permitted tier-to-tier connections succeed.
Question 410
A three-tier app must isolate database traffic from front-end workload traffic. What should the team configure or perform to implement the correct approach?
- Deploy the runtime on an eligible chosen compute platform.
- Provision a compatible Windows VM with needed disk and network settings.
- Place tiers in defined subnets and apply required NSG rules.
- Build and deploy an approved container image to an eligible host.
Explanation
Correct Answer
C:Place tiers in defined subnets and apply required NSG rules. The implementation operationalizes this design choice: Use subnets and appropriate network controls within the VNet. Acceptance should demonstrate: Only permitted tier-to-tier connections succeed.
Incorrect Answers
A:This setup is relevant to another workload: A developer wants to host a Linux application with a custom runtime not supported by a managed web tier. The current configuration must instead achieve: Only permitted tier-to-tier connections succeed.
B:That action implements a different requirement: A legacy finance application requires a full Windows Server guest with installed proprietary software. It does not establish the required result in this case: Only permitted tier-to-tier connections succeed.
D:This setup is relevant to another workload: A team must package a microservice and its libraries consistently across environments. The current configuration must instead achieve: Only permitted tier-to-tier connections succeed.
Microsoft Azure Fundamentals (AZ-900) Practice Tests