Microsoft AZ-900 Exam Dumps, Practice Test Questions

100% Latest & Updated Microsoft AZ-900 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!

Microsoft AZ-900 Premium Bundle
$79.97
$59.98

AZ-900 Premium Bundle

  • Premium File: 482 Questions & Answers. Last update: Nov 5, 2026
  • Training Course: 85 Video Lectures
  • Study Guide: 425 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates

AZ-900 Premium Bundle

Microsoft AZ-900 Premium Bundle
  • Premium File: 482 Questions & Answers. Last update: Nov 5, 2026
  • Training Course: 85 Video Lectures
  • Study Guide: 425 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
$79.97
$59.98

Microsoft AZ-900 Practice Test 42

Question 410

A three-tier app must isolate database traffic from front-end workload traffic. What should the team configure or perform to implement the correct approach?

  1. Deploy the runtime on an eligible chosen compute platform.
  2. Provision a compatible Windows VM with needed disk and network settings.
  3. Place tiers in defined subnets and apply required NSG rules.
  4. Build and deploy an approved container image to an eligible host.

Explanation

Correct Answer

C:

Place tiers in defined subnets and apply required NSG rules. The implementation operationalizes this design choice: Use subnets and appropriate network controls within the VNet. Acceptance should demonstrate: Only permitted tier-to-tier connections succeed.

Incorrect Answers

A:

This setup is relevant to another workload: A developer wants to host a Linux application with a custom runtime not supported by a managed web tier. The current configuration must instead achieve: Only permitted tier-to-tier connections succeed.

B:

That action implements a different requirement: A legacy finance application requires a full Windows Server guest with installed proprietary software. It does not establish the required result in this case: Only permitted tier-to-tier connections succeed.

D:

This setup is relevant to another workload: A team must package a microservice and its libraries consistently across environments. The current configuration must instead achieve: Only permitted tier-to-tier connections succeed.

Question 411

A three-tier app must isolate database traffic from front-end workload traffic. Which evidence best confirms the requirement is being met?

  1. On-premises private clients reach the service through the encrypted tunnel.
  2. Only permitted tier-to-tier connections succeed.
  3. The website runs without customers managing its VM guest OS.
  4. Requests to two URL paths reach their respective backend pools.

Explanation

Correct Answer

B:

Only permitted tier-to-tier connections succeed. That directly tests the stated requirement: A three-tier app must isolate database traffic from front-end workload traffic. It contrasts with the observed failure: The database receives connections from every VM in the network.

Incorrect Answers

A:

This observation is evidence for a separate scenario: A branch office needs to connect an isolated internal Azure service across an encrypted internet path. It does not test the necessary outcome here: Only permitted tier-to-tier connections succeed.

C:

The test is relevant when an e-commerce team has a simple website and does not want to patch guest OS hosts. It cannot establish the specified acceptance result: Only permitted tier-to-tier connections succeed.

D:

This observation is evidence for a separate scenario: A web application needs HTTP routing based on hostnames and URL paths. It does not test the necessary outcome here: Only permitted tier-to-tier connections succeed.

Question 412

A three-tier app must isolate database traffic from front-end workload traffic. The team observes: The database receives connections from every VM in the network. What is the most likely cause of the observed failure?

  1. The private endpoint or its DNS integration was missing.
  2. The application lacked a consistent containerized dependency package.
  3. The private DNS zone was not linked or populated correctly.
  4. The design omitted subnet-level filtering and security boundaries.

Explanation

Correct Answer

D:

The design omitted subnet-level filtering and security boundaries. That explains the symptom: The database receives connections from every VM in the network. The targeted corrective action is: Place tiers in defined subnets and apply required NSG rules.

Incorrect Answers

A:

This cause is consistent with a different issue: The database is reachable only through a public service endpoint. It does not account for the reported symptom here: The database receives connections from every VM in the network.

B:

The alternate mechanism would more directly produce this other failure: A program works on one machine but fails because libraries differ. The current incident instead involves: The database receives connections from every VM in the network.

C:

That explanation belongs to a different fault pattern: Private names resolve only outside the target VNet or not at all. It does not explain why the database receives connections from every VM in the network.

Question 413

Two business units operate separate VNets in one region and require private connectivity. Which architectural decision meets the described priority?

  1. Plan virtual networking, storage and compute resources alongside the VM.
  2. Use Kubernetes orchestration through AKS when those features are needed.
  3. Recognize VM Scale Sets manage groups of VMs while App Service manages application hosting.
  4. Use Azure virtual network peering when the supported network designs permit it.

Explanation

Correct Answer

D:

Use Azure virtual network peering when the supported network designs permit it. The governing requirement is: Two business units operate separate VNets in one region and require private connectivity. This solution specifically supports the outcome that authorized private addresses communicate between peered VNets.

Incorrect Answers

A:

This design is appropriate for a different requirement: A firm deploys a Linux Azure VM and asks what supporting Azure resources it requires. Here the decisive outcome must instead be: Authorized private addresses communicate between peered VNets.

B:

That concept addresses this separate situation: An enterprise has many container replicas and needs automated rollouts and service discovery. It does not by itself establish the result required here: Authorized private addresses communicate between peered VNets.

C:

This option solves a different planning problem: A batch team must distinguish a VM scale set from Azure App Service autoscale. The current acceptance criterion is specific: Authorized private addresses communicate between peered VNets.

Question 414

Two business units operate separate VNets in one region and require private connectivity. Which configuration or operating action most directly puts that decision into practice?

  1. Deploy a private NIC and configure authorized VPN network routes.
  2. Configure an eligible host pool and identity-aware user access.
  3. Configure peering on both VNets with the desired access settings.
  4. Apply an NSG rule permitting required HTTPS and restricting management ports.

Explanation

Correct Answer

C:

Configure peering on both VNets with the desired access settings. The implementation operationalizes this design choice: Use Azure virtual network peering when the supported network designs permit it. Acceptance should demonstrate: Authorized private addresses communicate between peered VNets.

Incorrect Answers

A:

This setup is relevant to another workload: A development team wants its VM to be reachable only from its private corporate VPN. The current configuration must instead achieve: Authorized private addresses communicate between peered VNets.

B:

That action implements a different requirement: A company wants hosted Windows desktops accessed by employees from different locations. It does not establish the required result in this case: Authorized private addresses communicate between peered VNets.

D:

This setup is relevant to another workload: A security administrator wants to allow HTTPS but block unsolicited remote management to a VM. The current configuration must instead achieve: Authorized private addresses communicate between peered VNets.

Question 415

Two business units operate separate VNets in one region and require private connectivity. Which observation is the strongest acceptance test for this scenario?

  1. The VM boots with its expected disk and private network attachment.
  2. Requests to two URL paths reach their respective backend pools.
  3. Public callers reach the app route but cannot reach the admin endpoint.
  4. Authorized private addresses communicate between peered VNets.

Explanation

Correct Answer

D:

Authorized private addresses communicate between peered VNets. That directly tests the stated requirement: Two business units operate separate VNets in one region and require private connectivity. It contrasts with the observed failure: Users route all traffic through the public internet unnecessarily.

Incorrect Answers

A:

This observation is evidence for a separate scenario: A firm deploys a Linux Azure VM and asks what supporting Azure resources it requires. It does not test the necessary outcome here: Authorized private addresses communicate between peered VNets.

B:

That check tests another control: A web application needs HTTP routing based on hostnames and URL paths. The decisive result for this workload is: Authorized private addresses communicate between peered VNets.

C:

The test is relevant when a container app should accept HTTP traffic but not expose an internal administrative interface. It cannot establish the specified acceptance result: Authorized private addresses communicate between peered VNets.

Question 416

Two business units operate separate VNets in one region and require private connectivity. The team observes: Users route all traffic through the public internet unnecessarily. Which planning or configuration error best accounts for this result?

  1. An unmanaged container runtime was chosen instead of orchestration.
  2. No event/schedule-triggered managed execution was configured.
  3. VNet peering was not configured for the intended private path.
  4. The design omitted subnet-level filtering and security boundaries.

Explanation

Correct Answer

C:

VNet peering was not configured for the intended private path. That explains the symptom: Users route all traffic through the public internet unnecessarily. The targeted corrective action is: Configure peering on both VNets with the desired access settings.

Incorrect Answers

A:

This cause is consistent with a different issue: Container teams are forced to script every host and scheduler task manually. It does not account for the reported symptom here: Users route all traffic through the public internet unnecessarily.

B:

The alternate mechanism would more directly produce this other failure: The program runs only if an operator manually logs into a server. The current incident instead involves: Users route all traffic through the public internet unnecessarily.

D:

This cause is consistent with a different issue: The database receives connections from every VM in the network. It does not account for the reported symptom here: Users route all traffic through the public internet unnecessarily.

Question 417

A company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. Which Azure or cloud concept most directly matches the requirement?

  1. Use an authorized public endpoint for the web application's external entry point.
  2. Recognize Azure VMs may operate using private addresses only.
  3. Use Azure Private DNS zones for supported internal naming scenarios.
  4. Select Azure VPN Gateway for supported internet-based encrypted VPN connectivity.

Explanation

Correct Answer

D:

Select Azure VPN Gateway for supported internet-based encrypted VPN connectivity. The governing requirement is: A company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. This solution specifically supports the outcome that office hosts reach approved Azure subnet addresses over the VPN.

Incorrect Answers

A:

This design is appropriate for a different requirement: A public website needs clients worldwide to connect to its internet-accessible service. Here the decisive outcome must instead be: Office hosts reach approved Azure subnet addresses over the VPN.

B:

That concept addresses this separate situation: A service owner uses a VM and assumes a public IP is always required. It does not by itself establish the result required here: Office hosts reach approved Azure subnet addresses over the VPN.

C:

This option solves a different planning problem: A private VNet workload needs internal name resolution not exposed to public DNS. The current acceptance criterion is specific: Office hosts reach approved Azure subnet addresses over the VPN.

Question 418

A company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. Which implementation step would best fulfill the stated requirement?

  1. Create the private endpoint and align private DNS resolution as required.
  2. Build and deploy an approved container image to an eligible host.
  3. Deploy a private NIC and configure authorized VPN network routes.
  4. Configure the VPN gateway, local network gateway and tunnel settings.

Explanation

Correct Answer

D:

Configure the VPN gateway, local network gateway and tunnel settings. The implementation operationalizes this design choice: Select Azure VPN Gateway for supported internet-based encrypted VPN connectivity. Acceptance should demonstrate: Office hosts reach approved Azure subnet addresses over the VPN.

Incorrect Answers

A:

This setup is relevant to another workload: An internal application must reach an Azure PaaS database by private IP without public service exposure. The current configuration must instead achieve: Office hosts reach approved Azure subnet addresses over the VPN.

B:

That action implements a different requirement: A team must package a microservice and its libraries consistently across environments. It does not establish the required result in this case: Office hosts reach approved Azure subnet addresses over the VPN.

C:

This change would be appropriate under a different condition: A development team wants its VM to be reachable only from its private corporate VPN. Here it would not validate: Office hosts reach approved Azure subnet addresses over the VPN.

Question 419

A company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. Which result would best demonstrate successful implementation?

  1. Office hosts reach approved Azure subnet addresses over the VPN.
  2. Planned maintenance does not remove both members at once in the validated model.
  3. The website runs without customers managing its VM guest OS.
  4. The workload detects its GPU and completes encoding as designed.

Explanation

Correct Answer

A:

Office hosts reach approved Azure subnet addresses over the VPN. That directly tests the stated requirement: A company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. It contrasts with the observed failure: Office traffic reaches only public-facing application endpoints.

Incorrect Answers

B:

That check tests another control: Two critical VMs in one region need separation from common host hardware maintenance faults. The decisive result for this workload is: Office hosts reach approved Azure subnet addresses over the VPN.

C:

The test is relevant when an e-commerce team has a simple website and does not want to patch guest OS hosts. It cannot establish the specified acceptance result: Office hosts reach approved Azure subnet addresses over the VPN.

D:

This observation is evidence for a separate scenario: A video encoder needs GPU-accelerated processing inside a customer-controlled guest. It does not test the necessary outcome here: Office hosts reach approved Azure subnet addresses over the VPN.

Question 420

A company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. The team observes: Office traffic reaches only public-facing application endpoints. What should the team identify as the primary mechanism behind the problem?

  1. The hybrid VPN gateway connection was not established.
  2. The service model was more operationally complex than necessary.
  3. The size selected did not offer the required accelerator capability.
  4. An unmanaged container runtime was chosen instead of orchestration.

Explanation

Correct Answer

A:

The hybrid VPN gateway connection was not established. That explains the symptom: Office traffic reaches only public-facing application endpoints. The targeted corrective action is: Configure the VPN gateway, local network gateway and tunnel settings.

Incorrect Answers

B:

The alternate mechanism would more directly produce this other failure: Engineers must manage Kubernetes masters for a simple container app. The current incident instead involves: Office traffic reaches only public-facing application endpoints.

C:

That explanation belongs to a different fault pattern: Encoding fails because the provisioned VM lacks GPU hardware. It does not explain why office traffic reaches only public-facing application endpoints.

D:

This cause is consistent with a different issue: Container teams are forced to script every host and scheduler task manually. It does not account for the reported symptom here: Office traffic reaches only public-facing application endpoints.

Microsoft Azure Fundamentals (AZ-900) Practice Tests

UP

SPECIAL OFFER: GET 10% OFF

This is ONE TIME OFFER

ExamSnap Discount Offer
Enter Your Email Address to Receive Your 10% Off Discount Code

A confirmation link will be sent to this email address to verify your login. *We value your privacy. We will not rent or sell your email address.

Download Free Demo of VCE Exam Simulator

Experience Avanset VCE Exam Simulator for yourself.

Simply submit your e-mail address below to get started with our interactive software demo of your free trial.

Free Demo Limits: In the demo version you will be able to access only first 5 questions from exam.