100% Latest & Updated Microsoft AZ-900 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 430
A public website needs clients worldwide to connect to its internet-accessible service. Which configuration or operating action most directly puts that decision into practice?
- Place the appropriate VMs in one availability set with separate fault/update domains.
- Attach the VMs to subnets in the approved VNet.
- Place tiers in defined subnets and apply required NSG rules.
- Configure public ingress and relevant network/access restrictions.
Explanation
Correct Answer
D:Configure public ingress and relevant network/access restrictions. The implementation operationalizes this design choice: Use an authorized public endpoint for the web application's external entry point. Acceptance should demonstrate: Approved internet clients reach the web service through its public address.
Incorrect Answers
A:This setup is relevant to another workload: Two critical VMs in one region need separation from common host hardware maintenance faults. The current configuration must instead achieve: Approved internet clients reach the web service through its public address.
B:That action implements a different requirement: A security team needs to place two front-end VMs on the same isolated Azure network. It does not establish the required result in this case: Approved internet clients reach the web service through its public address.
C:This change would be appropriate under a different condition: A three-tier app must isolate database traffic from front-end workload traffic. Here it would not validate: Approved internet clients reach the web service through its public address.
Question 431
A public website needs clients worldwide to connect to its internet-accessible service. Which observation is the strongest acceptance test for this scenario?
- Rolling updates replace pods while service discovery remains stable.
- Worker count rises when qualifying demand increases.
- Approved internet clients reach the web service through its public address.
- The private connectivity service uses its dedicated provider path.
Explanation
Correct Answer
C:Approved internet clients reach the web service through its public address. That directly tests the stated requirement: A public website needs clients worldwide to connect to its internet-accessible service. It contrasts with the observed failure: External customers cannot reach the site because only a private endpoint exists.
Incorrect Answers
A:This observation is evidence for a separate scenario: An enterprise has many container replicas and needs automated rollouts and service discovery. It does not test the necessary outcome here: Approved internet clients reach the web service through its public address.
B:That check tests another control: A retail API must automatically add identical VM workers during holiday traffic. The decisive result for this workload is: Approved internet clients reach the web service through its public address.
D:This observation is evidence for a separate scenario: A manufacturer requires private dedicated connectivity between its WAN provider and Azure. It does not test the necessary outcome here: Approved internet clients reach the web service through its public address.
Question 432
A public website needs clients worldwide to connect to its internet-accessible service. The team observes: External customers cannot reach the site because only a private endpoint exists. Which planning or configuration error best accounts for this result?
- The deployment included a VM object without required supporting resources.
- The VM was assigned a public IP despite private-only requirements.
- The subnet IP prefixes were planned with overlapping address ranges.
- The service had no appropriate internet-facing entry point.
Explanation
Correct Answer
D:The service had no appropriate internet-facing entry point. That explains the symptom: External customers cannot reach the site because only a private endpoint exists. The targeted corrective action is: Configure public ingress and relevant network/access restrictions.
Incorrect Answers
A:This cause is consistent with a different issue: A VM declaration fails because essential network/disk prerequisites are absent. It does not account for the reported symptom here: External customers cannot reach the site because only a private endpoint exists.
B:The alternate mechanism would more directly produce this other failure: A security review finds an unnecessary internet-reachable address. The current incident instead involves: External customers cannot reach the site because only a private endpoint exists.
C:That explanation belongs to a different fault pattern: Subnet creation fails because the proposed CIDR blocks overlap. It does not explain why external customers cannot reach the site because only a private endpoint exists.
Question 433
An administrator wants hostnames in a company's own domain to resolve to Azure services. Which Azure or cloud concept most directly matches the requirement?
- Recognize Azure VMs may operate using private addresses only.
- Use an authorized public endpoint for the web application's external entry point.
- Use Azure DNS or approved DNS hosting for public domain records.
- Use an Azure Function timer trigger where the workload fits.
Explanation
Correct Answer
C:Use Azure DNS or approved DNS hosting for public domain records. The governing requirement is: An administrator wants hostnames in a company's own domain to resolve to Azure services. This solution specifically supports the outcome that the application hostname resolves to the intended public destination.
Incorrect Answers
A:This design is appropriate for a different requirement: A service owner uses a VM and assumes a public IP is always required. Here the decisive outcome must instead be: The application hostname resolves to the intended public destination.
B:That concept addresses this separate situation: A public website needs clients worldwide to connect to its internet-accessible service. It does not by itself establish the result required here: The application hostname resolves to the intended public destination.
D:This design is appropriate for a different requirement: An app must respond to scheduled timers without keeping a VM on all day. Here the decisive outcome must instead be: The application hostname resolves to the intended public destination.
Question 434
An administrator wants hostnames in a company's own domain to resolve to Azure services. Which implementation step would best fulfill the stated requirement?
- Create the required public DNS zone and supported record set.
- Create approved VPN tunnels and route private subnets.
- Associate the appropriate Private DNS zone with the client VNet.
- Configure ingress for the public route while restricting admin access.
Explanation
Correct Answer
A:Create the required public DNS zone and supported record set. The implementation operationalizes this design choice: Use Azure DNS or approved DNS hosting for public domain records. Acceptance should demonstrate: The application hostname resolves to the intended public destination.
Incorrect Answers
B:That action implements a different requirement: A branch office needs to connect an isolated internal Azure service across an encrypted internet path. It does not establish the required result in this case: The application hostname resolves to the intended public destination.
C:This change would be appropriate under a different condition: A company wants to resolve private endpoint hostnames to their private addresses. Here it would not validate: The application hostname resolves to the intended public destination.
D:This setup is relevant to another workload: A container app should accept HTTP traffic but not expose an internal administrative interface. The current configuration must instead achieve: The application hostname resolves to the intended public destination.
Question 435
An administrator wants hostnames in a company's own domain to resolve to Azure services. Which result would best demonstrate successful implementation?
- Authorized users open their virtual desktop sessions remotely.
- The website runs without customers managing its VM guest OS.
- The application hostname resolves to the intended public destination.
- Network boundaries and permitted inter-subnet flows match the approved design.
Explanation
Correct Answer
C:The application hostname resolves to the intended public destination. That directly tests the stated requirement: An administrator wants hostnames in a company's own domain to resolve to Azure services. It contrasts with the observed failure: The public hostname cannot be resolved from internet clients.
Incorrect Answers
A:This observation is evidence for a separate scenario: A company wants hosted Windows desktops accessed by employees from different locations. It does not test the necessary outcome here: The application hostname resolves to the intended public destination.
B:That check tests another control: An e-commerce team has a simple website and does not want to patch guest OS hosts. The decisive result for this workload is: The application hostname resolves to the intended public destination.
D:This observation is evidence for a separate scenario: A company needs to isolate customer workloads at the network level using multiple subnets. It does not test the necessary outcome here: The application hostname resolves to the intended public destination.
Question 436
An administrator wants hostnames in a company's own domain to resolve to Azure services. The team observes: The public hostname cannot be resolved from internet clients. What should the team identify as the primary mechanism behind the problem?
- The size selected did not offer the required accelerator capability.
- The public DNS record was absent or misconfigured.
- The solution used raw virtual machines rather than managed app hosting.
- The deployment included a VM object without required supporting resources.
Explanation
Correct Answer
B:The public DNS record was absent or misconfigured. That explains the symptom: The public hostname cannot be resolved from internet clients. The targeted corrective action is: Create the required public DNS zone and supported record set.
Incorrect Answers
A:This cause is consistent with a different issue: Encoding fails because the provisioned VM lacks GPU hardware. It does not account for the reported symptom here: The public hostname cannot be resolved from internet clients.
C:That explanation belongs to a different fault pattern: Developers manually patch a VM hosting the simple web app. It does not explain why the public hostname cannot be resolved from internet clients.
D:This cause is consistent with a different issue: A VM declaration fails because essential network/disk prerequisites are absent. It does not account for the reported symptom here: The public hostname cannot be resolved from internet clients.
Question 437
A private VNet workload needs internal name resolution not exposed to public DNS. Which design choice best fits the stated business constraint?
- Use Azure Private DNS zones for supported internal naming scenarios.
- Use network security group rules to filter allowed inbound network traffic.
- Recognize Azure VMs may operate using private addresses only.
- Choose Azure Virtual Machines for guest OS and application control.
Explanation
Correct Answer
A:Use Azure Private DNS zones for supported internal naming scenarios. The governing requirement is: A private VNet workload needs internal name resolution not exposed to public DNS. This solution specifically supports the outcome that vNet clients resolve internal hostnames to private addresses.
Incorrect Answers
B:That concept addresses this separate situation: A security administrator wants to allow HTTPS but block unsolicited remote management to a VM. It does not by itself establish the result required here: VNet clients resolve internal hostnames to private addresses.
C:This option solves a different planning problem: A service owner uses a VM and assumes a public IP is always required. The current acceptance criterion is specific: VNet clients resolve internal hostnames to private addresses.
D:This design is appropriate for a different requirement: A legacy finance application requires a full Windows Server guest with installed proprietary software. Here the decisive outcome must instead be: VNet clients resolve internal hostnames to private addresses.
Question 438
A private VNet workload needs internal name resolution not exposed to public DNS. Which Azure setup action best follows from this scenario?
- Identify whether clients must traverse a public or private network path.
- Link the private DNS zone to the appropriate VNet and add records.
- Deploy the runtime on an eligible chosen compute platform.
- Connect the function to a compatible trigger with appropriate rights.
Explanation
Correct Answer
B:Link the private DNS zone to the appropriate VNet and add records. The implementation operationalizes this design choice: Use Azure Private DNS zones for supported internal naming scenarios. Acceptance should demonstrate: VNet clients resolve internal hostnames to private addresses.
Incorrect Answers
A:This setup is relevant to another workload: A new cloud student asks whether public and private endpoints both mean publicly reachable Azure services. The current configuration must instead achieve: VNet clients resolve internal hostnames to private addresses.
C:This change would be appropriate under a different condition: A developer wants to host a Linux application with a custom runtime not supported by a managed web tier. Here it would not validate: VNet clients resolve internal hostnames to private addresses.
D:This setup is relevant to another workload: A data collector runs short tasks when messages arrive, and demand varies sharply. The current configuration must instead achieve: VNet clients resolve internal hostnames to private addresses.
Question 439
A private VNet workload needs internal name resolution not exposed to public DNS. Which verification outcome should the team expect from the right design?
- VNet clients resolve internal hostnames to private addresses.
- Authorized users open their virtual desktop sessions remotely.
- On-premises private clients reach the service through the encrypted tunnel.
- The workload detects its GPU and completes encoding as designed.
Explanation
Correct Answer
A:VNet clients resolve internal hostnames to private addresses. That directly tests the stated requirement: A private VNet workload needs internal name resolution not exposed to public DNS. It contrasts with the observed failure: Private names resolve only outside the target VNet or not at all.
Incorrect Answers
B:That check tests another control: A company wants hosted Windows desktops accessed by employees from different locations. The decisive result for this workload is: VNet clients resolve internal hostnames to private addresses.
C:The test is relevant when a branch office needs to connect an isolated internal Azure service across an encrypted internet path. It cannot establish the specified acceptance result: VNet clients resolve internal hostnames to private addresses.
D:This observation is evidence for a separate scenario: A video encoder needs GPU-accelerated processing inside a customer-controlled guest. It does not test the necessary outcome here: VNet clients resolve internal hostnames to private addresses.
Question 440
A private VNet workload needs internal name resolution not exposed to public DNS. The team observes: Private names resolve only outside the target VNet or not at all. Which underlying mistake most directly explains the reported symptom?
- The deployment included a VM object without required supporting resources.
- The private DNS zone was not linked or populated correctly.
- VNet peering was not configured for the intended private path.
- It confused VM-level scaling with managed web application scaling.
Explanation
Correct Answer
B:The private DNS zone was not linked or populated correctly. That explains the symptom: Private names resolve only outside the target VNet or not at all. The targeted corrective action is: Link the private DNS zone to the appropriate VNet and add records.
Incorrect Answers
A:This cause is consistent with a different issue: A VM declaration fails because essential network/disk prerequisites are absent. It does not account for the reported symptom here: Private names resolve only outside the target VNet or not at all.
C:That explanation belongs to a different fault pattern: Users route all traffic through the public internet unnecessarily. It does not explain why private names resolve only outside the target VNet or not at all.
D:This cause is consistent with a different issue: The team tries to administer guest operating systems on an App Service web app. It does not account for the reported symptom here: Private names resolve only outside the target VNet or not at all.
Microsoft Azure Fundamentals (AZ-900) Practice Tests