Microsoft AZ-900 Exam Dumps, Practice Test Questions

100% Latest & Updated Microsoft AZ-900 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!

Microsoft AZ-900 Premium Bundle
$79.97
$59.98

AZ-900 Premium Bundle

  • Premium File: 482 Questions & Answers. Last update: Nov 5, 2026
  • Training Course: 85 Video Lectures
  • Study Guide: 425 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates

AZ-900 Premium Bundle

Microsoft AZ-900 Premium Bundle
  • Premium File: 482 Questions & Answers. Last update: Nov 5, 2026
  • Training Course: 85 Video Lectures
  • Study Guide: 425 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
$79.97
$59.98

Microsoft AZ-900 Practice Test 43

Question 420

A company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. The team observes: Office traffic reaches only public-facing application endpoints. What should the team identify as the primary mechanism behind the problem?

  1. The hybrid VPN gateway connection was not established.
  2. The service model was more operationally complex than necessary.
  3. The size selected did not offer the required accelerator capability.
  4. An unmanaged container runtime was chosen instead of orchestration.

Explanation

Correct Answer

A:

The hybrid VPN gateway connection was not established. That explains the symptom: Office traffic reaches only public-facing application endpoints. The targeted corrective action is: Configure the VPN gateway, local network gateway and tunnel settings.

Incorrect Answers

B:

The alternate mechanism would more directly produce this other failure: Engineers must manage Kubernetes masters for a simple container app. The current incident instead involves: Office traffic reaches only public-facing application endpoints.

C:

That explanation belongs to a different fault pattern: Encoding fails because the provisioned VM lacks GPU hardware. It does not explain why office traffic reaches only public-facing application endpoints.

D:

This cause is consistent with a different issue: Container teams are forced to script every host and scheduler task manually. It does not account for the reported symptom here: Office traffic reaches only public-facing application endpoints.

Question 421

A manufacturer requires private dedicated connectivity between its WAN provider and Azure. Which design choice best fits the stated business constraint?

  1. Choose an appropriate load balancing service for supported traffic distribution.
  2. Use Azure ExpressRoute instead of assuming it is an ordinary internet VPN.
  3. Select Azure VPN Gateway for supported internet-based encrypted VPN connectivity.
  4. Use Azure Virtual Machine Scale Sets for repeatable VM instance scaling.

Explanation

Correct Answer

B:

Use Azure ExpressRoute instead of assuming it is an ordinary internet VPN. The governing requirement is: A manufacturer requires private dedicated connectivity between its WAN provider and Azure. This solution specifically supports the outcome that the private connectivity service uses its dedicated provider path.

Incorrect Answers

A:

This design is appropriate for a different requirement: A front-end workload must tolerate updates across multiple VM instances. Here the decisive outcome must instead be: The private connectivity service uses its dedicated provider path.

C:

This option solves a different planning problem: A company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. The current acceptance criterion is specific: The private connectivity service uses its dedicated provider path.

D:

This design is appropriate for a different requirement: A retail API must automatically add identical VM workers during holiday traffic. Here the decisive outcome must instead be: The private connectivity service uses its dedicated provider path.

Question 422

A manufacturer requires private dedicated connectivity between its WAN provider and Azure. Which Azure setup action best follows from this scenario?

  1. Configure the VPN gateway, local network gateway and tunnel settings.
  2. Select VMSS for guest-managed worker images and App Service for eligible web apps.
  3. Provision a compatible Windows VM with needed disk and network settings.
  4. Arrange an eligible ExpressRoute circuit and configure associated connectivity.

Explanation

Correct Answer

D:

Arrange an eligible ExpressRoute circuit and configure associated connectivity. The implementation operationalizes this design choice: Use Azure ExpressRoute instead of assuming it is an ordinary internet VPN. Acceptance should demonstrate: The private connectivity service uses its dedicated provider path.

Incorrect Answers

A:

This setup is relevant to another workload: A company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. The current configuration must instead achieve: The private connectivity service uses its dedicated provider path.

B:

That action implements a different requirement: A batch team must distinguish a VM scale set from Azure App Service autoscale. It does not establish the required result in this case: The private connectivity service uses its dedicated provider path.

C:

This change would be appropriate under a different condition: A legacy finance application requires a full Windows Server guest with installed proprietary software. Here it would not validate: The private connectivity service uses its dedicated provider path.

Question 423

A manufacturer requires private dedicated connectivity between its WAN provider and Azure. Which verification outcome should the team expect from the right design?

  1. The private connectivity service uses its dedicated provider path.
  2. Approved internet clients reach the web service through its public address.
  3. VNet clients resolve internal hostnames to private addresses.
  4. Name lookup returns the intended private IP for supported clients.

Explanation

Correct Answer

A:

The private connectivity service uses its dedicated provider path. That directly tests the stated requirement: A manufacturer requires private dedicated connectivity between its WAN provider and Azure. It contrasts with the observed failure: The connection is built only as an internet IPsec tunnel.

Incorrect Answers

B:

That check tests another control: A public website needs clients worldwide to connect to its internet-accessible service. The decisive result for this workload is: The private connectivity service uses its dedicated provider path.

C:

The test is relevant when a private VNet workload needs internal name resolution not exposed to public DNS. It cannot establish the specified acceptance result: The private connectivity service uses its dedicated provider path.

D:

This observation is evidence for a separate scenario: A company wants to resolve private endpoint hostnames to their private addresses. It does not test the necessary outcome here: The private connectivity service uses its dedicated provider path.

Question 424

A manufacturer requires private dedicated connectivity between its WAN provider and Azure. The team observes: The connection is built only as an internet IPsec tunnel. Which underlying mistake most directly explains the reported symptom?

  1. The service had no appropriate internet-facing entry point.
  2. The team confused basic VMs with Azure Virtual Desktop services.
  3. An Azure VPN Gateway design was substituted for the requested ExpressRoute connection.
  4. The VM was assigned a public IP despite private-only requirements.

Explanation

Correct Answer

C:

An Azure VPN Gateway design was substituted for the requested ExpressRoute connection. That explains the symptom: The connection is built only as an internet IPsec tunnel. The targeted corrective action is: Arrange an eligible ExpressRoute circuit and configure associated connectivity.

Incorrect Answers

A:

This cause is consistent with a different issue: External customers cannot reach the site because only a private endpoint exists. It does not account for the reported symptom here: The connection is built only as an internet IPsec tunnel.

B:

The alternate mechanism would more directly produce this other failure: The chosen solution provisions server VMs but no managed desktop session delivery. The current incident instead involves: The connection is built only as an internet IPsec tunnel.

D:

This cause is consistent with a different issue: A security review finds an unnecessary internet-reachable address. It does not account for the reported symptom here: The connection is built only as an internet IPsec tunnel.

Question 425

An internal application must reach an Azure PaaS database by private IP without public service exposure. What is the most appropriate cloud concept or service for this need?

  1. Choose an appropriate load balancing service for supported traffic distribution.
  2. Choose Azure Virtual Desktop for centrally hosted desktop and app sessions.
  3. Use Azure ExpressRoute instead of assuming it is an ordinary internet VPN.
  4. Use an Azure Private Endpoint for private connectivity to the supported PaaS service.

Explanation

Correct Answer

D:

Use an Azure Private Endpoint for private connectivity to the supported PaaS service. The governing requirement is: An internal application must reach an Azure PaaS database by private IP without public service exposure. This solution specifically supports the outcome that the client resolves and reaches the database via private address.

Incorrect Answers

A:

This design is appropriate for a different requirement: A front-end workload must tolerate updates across multiple VM instances. Here the decisive outcome must instead be: The client resolves and reaches the database via private address.

B:

That concept addresses this separate situation: A company wants hosted Windows desktops accessed by employees from different locations. It does not by itself establish the result required here: The client resolves and reaches the database via private address.

C:

This option solves a different planning problem: A manufacturer requires private dedicated connectivity between its WAN provider and Azure. The current acceptance criterion is specific: The client resolves and reaches the database via private address.

Question 426

An internal application must reach an Azure PaaS database by private IP without public service exposure. What should the team configure or perform to implement the correct approach?

  1. Build and deploy an approved container image to an eligible host.
  2. Apply an NSG rule permitting required HTTPS and restricting management ports.
  3. Create the private endpoint and align private DNS resolution as required.
  4. Provision a compatible Windows VM with needed disk and network settings.

Explanation

Correct Answer

C:

Create the private endpoint and align private DNS resolution as required. The implementation operationalizes this design choice: Use an Azure Private Endpoint for private connectivity to the supported PaaS service. Acceptance should demonstrate: The client resolves and reaches the database via private address.

Incorrect Answers

A:

This setup is relevant to another workload: A team must package a microservice and its libraries consistently across environments. The current configuration must instead achieve: The client resolves and reaches the database via private address.

B:

That action implements a different requirement: A security administrator wants to allow HTTPS but block unsolicited remote management to a VM. It does not establish the required result in this case: The client resolves and reaches the database via private address.

D:

This setup is relevant to another workload: A legacy finance application requires a full Windows Server guest with installed proprietary software. The current configuration must instead achieve: The client resolves and reaches the database via private address.

Question 427

An internal application must reach an Azure PaaS database by private IP without public service exposure. Which evidence best confirms the requirement is being met?

  1. The handler runs when events arrive without permanent application servers.
  2. The client resolves and reaches the database via private address.
  3. Office hosts reach approved Azure subnet addresses over the VPN.
  4. A private endpoint resolves to an authorized private IP from the VNet.

Explanation

Correct Answer

B:

The client resolves and reaches the database via private address. That directly tests the stated requirement: An internal application must reach an Azure PaaS database by private IP without public service exposure. It contrasts with the observed failure: The database is reachable only through a public service endpoint.

Incorrect Answers

A:

This observation is evidence for a separate scenario: A data collector runs short tasks when messages arrive, and demand varies sharply. It does not test the necessary outcome here: The client resolves and reaches the database via private address.

C:

The test is relevant when a company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. It cannot establish the specified acceptance result: The client resolves and reaches the database via private address.

D:

This observation is evidence for a separate scenario: A new cloud student asks whether public and private endpoints both mean publicly reachable Azure services. It does not test the necessary outcome here: The client resolves and reaches the database via private address.

Question 428

An internal application must reach an Azure PaaS database by private IP without public service exposure. The team observes: The database is reachable only through a public service endpoint. What is the most likely cause of the observed failure?

  1. The service had no appropriate internet-facing entry point.
  2. The private endpoint or its DNS integration was missing.
  3. They were not placed on the intended shared VNet.
  4. No event/schedule-triggered managed execution was configured.

Explanation

Correct Answer

B:

The private endpoint or its DNS integration was missing. That explains the symptom: The database is reachable only through a public service endpoint. The targeted corrective action is: Create the private endpoint and align private DNS resolution as required.

Incorrect Answers

A:

This cause is consistent with a different issue: External customers cannot reach the site because only a private endpoint exists. It does not account for the reported symptom here: The database is reachable only through a public service endpoint.

C:

That explanation belongs to a different fault pattern: Both VMs have public addresses but no defined private network path. It does not explain why the database is reachable only through a public service endpoint.

D:

This cause is consistent with a different issue: The program runs only if an operator manually logs into a server. It does not account for the reported symptom here: The database is reachable only through a public service endpoint.

Question 429

A public website needs clients worldwide to connect to its internet-accessible service. Which architectural decision meets the described priority?

  1. Consider Azure Container Apps for eligible managed application containers.
  2. Design subnet segmentation and network rules within one or more VNets.
  3. Use an authorized public endpoint for the web application's external entry point.
  4. Select a supported GPU-enabled VM size rather than a generic small VM.

Explanation

Correct Answer

C:

Use an authorized public endpoint for the web application's external entry point. The governing requirement is: A public website needs clients worldwide to connect to its internet-accessible service. This solution specifically supports the outcome that approved internet clients reach the web service through its public address.

Incorrect Answers

A:

This design is appropriate for a different requirement: A developer wants a simple containerized web API without managing a Kubernetes cluster. Here the decisive outcome must instead be: Approved internet clients reach the web service through its public address.

B:

That concept addresses this separate situation: A company needs to isolate customer workloads at the network level using multiple subnets. It does not by itself establish the result required here: Approved internet clients reach the web service through its public address.

D:

This design is appropriate for a different requirement: A video encoder needs GPU-accelerated processing inside a customer-controlled guest. Here the decisive outcome must instead be: Approved internet clients reach the web service through its public address.

Question 430

A public website needs clients worldwide to connect to its internet-accessible service. Which configuration or operating action most directly puts that decision into practice?

  1. Place the appropriate VMs in one availability set with separate fault/update domains.
  2. Attach the VMs to subnets in the approved VNet.
  3. Place tiers in defined subnets and apply required NSG rules.
  4. Configure public ingress and relevant network/access restrictions.

Explanation

Correct Answer

D:

Configure public ingress and relevant network/access restrictions. The implementation operationalizes this design choice: Use an authorized public endpoint for the web application's external entry point. Acceptance should demonstrate: Approved internet clients reach the web service through its public address.

Incorrect Answers

A:

This setup is relevant to another workload: Two critical VMs in one region need separation from common host hardware maintenance faults. The current configuration must instead achieve: Approved internet clients reach the web service through its public address.

B:

That action implements a different requirement: A security team needs to place two front-end VMs on the same isolated Azure network. It does not establish the required result in this case: Approved internet clients reach the web service through its public address.

C:

This change would be appropriate under a different condition: A three-tier app must isolate database traffic from front-end workload traffic. Here it would not validate: Approved internet clients reach the web service through its public address.

Microsoft Azure Fundamentals (AZ-900) Practice Tests

UP

SPECIAL OFFER: GET 10% OFF

This is ONE TIME OFFER

ExamSnap Discount Offer
Enter Your Email Address to Receive Your 10% Off Discount Code

A confirmation link will be sent to this email address to verify your login. *We value your privacy. We will not rent or sell your email address.

Download Free Demo of VCE Exam Simulator

Experience Avanset VCE Exam Simulator for yourself.

Simply submit your e-mail address below to get started with our interactive software demo of your free trial.

Free Demo Limits: In the demo version you will be able to access only first 5 questions from exam.