Microsoft AZ-900 Practice Test 45

100% Latest & Updated Microsoft AZ-900 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!

Question 440

A private VNet workload needs internal name resolution not exposed to public DNS. The team observes: Private names resolve only outside the target VNet or not at all. Which underlying mistake most directly explains the reported symptom?

The deployment included a VM object without required supporting resources.
The private DNS zone was not linked or populated correctly.
VNet peering was not configured for the intended private path.
It confused VM-level scaling with managed web application scaling.

Explanation

Correct Answer

The private DNS zone was not linked or populated correctly. That explains the symptom: Private names resolve only outside the target VNet or not at all. The targeted corrective action is: Link the private DNS zone to the appropriate VNet and add records.

Incorrect Answers

This cause is consistent with a different issue: A VM declaration fails because essential network/disk prerequisites are absent. It does not account for the reported symptom here: Private names resolve only outside the target VNet or not at all.

That explanation belongs to a different fault pattern: Users route all traffic through the public internet unnecessarily. It does not explain why private names resolve only outside the target VNet or not at all.

This cause is consistent with a different issue: The team tries to administer guest operating systems on an App Service web app. It does not account for the reported symptom here: Private names resolve only outside the target VNet or not at all.

Question 441

A security administrator wants to allow HTTPS but block unsolicited remote management to a VM. What is the most appropriate cloud concept or service for this need?

Select a site-to-site VPN rather than granting the private service a public IP.
Recognize VM Scale Sets manage groups of VMs while App Service manages application hosting.
Use network security group rules to filter allowed inbound network traffic.
Use an Azure Function timer trigger where the workload fits.

Explanation

Correct Answer

Use network security group rules to filter allowed inbound network traffic. The governing requirement is: A security administrator wants to allow HTTPS but block unsolicited remote management to a VM. This solution specifically supports the outcome that authorized HTTPS requests work while prohibited management attempts fail.

Incorrect Answers

This design is appropriate for a different requirement: A branch office needs to connect an isolated internal Azure service across an encrypted internet path. Here the decisive outcome must instead be: Authorized HTTPS requests work while prohibited management attempts fail.

That concept addresses this separate situation: A batch team must distinguish a VM scale set from Azure App Service autoscale. It does not by itself establish the result required here: Authorized HTTPS requests work while prohibited management attempts fail.

This design is appropriate for a different requirement: An app must respond to scheduled timers without keeping a VM on all day. Here the decisive outcome must instead be: Authorized HTTPS requests work while prohibited management attempts fail.

Question 442

A security administrator wants to allow HTTPS but block unsolicited remote management to a VM. What should the team configure or perform to implement the correct approach?

Apply an NSG rule permitting required HTTPS and restricting management ports.
Create the private endpoint and align private DNS resolution as required.
Create Kubernetes deployment and service resources on the AKS cluster.
Configure an eligible host pool and identity-aware user access.

Explanation

Correct Answer

Apply an NSG rule permitting required HTTPS and restricting management ports. The implementation operationalizes this design choice: Use network security group rules to filter allowed inbound network traffic. Acceptance should demonstrate: Authorized HTTPS requests work while prohibited management attempts fail.

Incorrect Answers

That action implements a different requirement: An internal application must reach an Azure PaaS database by private IP without public service exposure. It does not establish the required result in this case: Authorized HTTPS requests work while prohibited management attempts fail.

This change would be appropriate under a different condition: An enterprise has many container replicas and needs automated rollouts and service discovery. Here it would not validate: Authorized HTTPS requests work while prohibited management attempts fail.

This setup is relevant to another workload: A company wants hosted Windows desktops accessed by employees from different locations. The current configuration must instead achieve: Authorized HTTPS requests work while prohibited management attempts fail.

Question 443

A security administrator wants to allow HTTPS but block unsolicited remote management to a VM. Which evidence best confirms the requirement is being met?

Name lookup returns the intended private IP for supported clients.
The VM boots with its expected disk and private network attachment.
Client requests move to healthy instances when one backend fails.
Authorized HTTPS requests work while prohibited management attempts fail.

Explanation

Correct Answer

Authorized HTTPS requests work while prohibited management attempts fail. That directly tests the stated requirement: A security administrator wants to allow HTTPS but block unsolicited remote management to a VM. It contrasts with the observed failure: A VM has a public IP and every management port accepts traffic.

Incorrect Answers

This observation is evidence for a separate scenario: A company wants to resolve private endpoint hostnames to their private addresses. It does not test the necessary outcome here: Authorized HTTPS requests work while prohibited management attempts fail.

That check tests another control: A firm deploys a Linux Azure VM and asks what supporting Azure resources it requires. The decisive result for this workload is: Authorized HTTPS requests work while prohibited management attempts fail.

The test is relevant when a front-end workload must tolerate updates across multiple VM instances. It cannot establish the specified acceptance result: Authorized HTTPS requests work while prohibited management attempts fail.

Question 444

A security administrator wants to allow HTTPS but block unsolicited remote management to a VM. The team observes: A VM has a public IP and every management port accepts traffic. What is the most likely cause of the observed failure?

VNet peering was not configured for the intended private path.
An Azure VPN Gateway design was substituted for the requested ExpressRoute connection.
The network filtering rules were missing or excessively permissive.
The team confused basic VMs with Azure Virtual Desktop services.

Explanation

Correct Answer

The network filtering rules were missing or excessively permissive. That explains the symptom: A VM has a public IP and every management port accepts traffic. The targeted corrective action is: Apply an NSG rule permitting required HTTPS and restricting management ports.

Incorrect Answers

This cause is consistent with a different issue: Users route all traffic through the public internet unnecessarily. It does not account for the reported symptom here: A VM has a public IP and every management port accepts traffic.

The alternate mechanism would more directly produce this other failure: The connection is built only as an internet IPsec tunnel. The current incident instead involves: A VM has a public IP and every management port accepts traffic.

This cause is consistent with a different issue: The chosen solution provisions server VMs but no managed desktop session delivery. It does not account for the reported symptom here: A VM has a public IP and every management port accepts traffic.

Question 445

A remote office wants two VNets connected even though they sit in different Azure regions. Which architectural decision meets the described priority?

Separate application ingress from management functions and apply supported controls.
Choose Azure Kubernetes Service when Kubernetes orchestration is required.
Recognize VM Scale Sets manage groups of VMs while App Service manages application hosting.
Use global VNet peering when region and routing prerequisites permit it.

Explanation

Correct Answer

Use global VNet peering when region and routing prerequisites permit it. The governing requirement is: A remote office wants two VNets connected even though they sit in different Azure regions. This solution specifically supports the outcome that the approved VNets exchange private traffic over supported peering.

Incorrect Answers

This design is appropriate for a different requirement: A container app should accept HTTP traffic but not expose an internal administrative interface. Here the decisive outcome must instead be: The approved VNets exchange private traffic over supported peering.

That concept addresses this separate situation: A business needs a managed Kubernetes control plane for many containerized services. It does not by itself establish the result required here: The approved VNets exchange private traffic over supported peering.

This option solves a different planning problem: A batch team must distinguish a VM scale set from Azure App Service autoscale. The current acceptance criterion is specific: The approved VNets exchange private traffic over supported peering.

Question 446

A remote office wants two VNets connected even though they sit in different Azure regions. Which configuration or operating action most directly puts that decision into practice?

Choose the appropriate VM SKU and compatible driver stack.
Create approved VPN tunnels and route private subnets.
Configure cross-region VNet peering and required routes.
Provision a compatible Windows VM with needed disk and network settings.

Explanation

Correct Answer

Configure cross-region VNet peering and required routes. The implementation operationalizes this design choice: Use global VNet peering when region and routing prerequisites permit it. Acceptance should demonstrate: The approved VNets exchange private traffic over supported peering.

Incorrect Answers

This setup is relevant to another workload: A video encoder needs GPU-accelerated processing inside a customer-controlled guest. The current configuration must instead achieve: The approved VNets exchange private traffic over supported peering.

That action implements a different requirement: A branch office needs to connect an isolated internal Azure service across an encrypted internet path. It does not establish the required result in this case: The approved VNets exchange private traffic over supported peering.

This setup is relevant to another workload: A legacy finance application requires a full Windows Server guest with installed proprietary software. The current configuration must instead achieve: The approved VNets exchange private traffic over supported peering.

Question 447

A remote office wants two VNets connected even though they sit in different Azure regions. Which observation is the strongest acceptance test for this scenario?

The approved VNets exchange private traffic over supported peering.
The function executes on schedule without an always-running custom VM.
The private connectivity service uses its dedicated provider path.
On-premises private clients reach the service through the encrypted tunnel.

Explanation

Correct Answer

The approved VNets exchange private traffic over supported peering. That directly tests the stated requirement: A remote office wants two VNets connected even though they sit in different Azure regions. It contrasts with the observed failure: The engineer assumes peering can connect only within one Azure region.

Incorrect Answers

That check tests another control: An app must respond to scheduled timers without keeping a VM on all day. The decisive result for this workload is: The approved VNets exchange private traffic over supported peering.

The test is relevant when a manufacturer requires private dedicated connectivity between its WAN provider and Azure. It cannot establish the specified acceptance result: The approved VNets exchange private traffic over supported peering.

This observation is evidence for a separate scenario: A branch office needs to connect an isolated internal Azure service across an encrypted internet path. It does not test the necessary outcome here: The approved VNets exchange private traffic over supported peering.

Question 448

A remote office wants two VNets connected even though they sit in different Azure regions. The team observes: The engineer assumes peering can connect only within one Azure region. Which planning or configuration error best accounts for this result?

The design ignored available cross-region VNet peering capability.
The hybrid VPN gateway connection was not established.
The private endpoint or its DNS integration was missing.
The design ignored a suitable event-driven managed service.

Explanation

Correct Answer

The design ignored available cross-region VNet peering capability. That explains the symptom: The engineer assumes peering can connect only within one Azure region. The targeted corrective action is: Configure cross-region VNet peering and required routes.

Incorrect Answers

The alternate mechanism would more directly produce this other failure: Office traffic reaches only public-facing application endpoints. The current incident instead involves: The engineer assumes peering can connect only within one Azure region.

That explanation belongs to a different fault pattern: The database is reachable only through a public service endpoint. It does not explain why the engineer assumes peering can connect only within one Azure region.

This cause is consistent with a different issue: A full-time VM waits idle for rare messages. It does not account for the reported symptom here: The engineer assumes peering can connect only within one Azure region.

Question 449

A front-end workload must tolerate updates across multiple VM instances. Which Azure or cloud concept most directly matches the requirement?

Choose Azure Virtual Machines for guest OS and application control.
Use an Azure Function timer trigger where the workload fits.
Use an Azure Virtual Network as the logical private networking boundary.
Choose an appropriate load balancing service for supported traffic distribution.

Explanation

Correct Answer

Choose an appropriate load balancing service for supported traffic distribution. The governing requirement is: A front-end workload must tolerate updates across multiple VM instances. This solution specifically supports the outcome that client requests move to healthy instances when one backend fails.

Incorrect Answers

This design is appropriate for a different requirement: A legacy finance application requires a full Windows Server guest with installed proprietary software. Here the decisive outcome must instead be: Client requests move to healthy instances when one backend fails.

That concept addresses this separate situation: An app must respond to scheduled timers without keeping a VM on all day. It does not by itself establish the result required here: Client requests move to healthy instances when one backend fails.

This option solves a different planning problem: A security team needs to place two front-end VMs on the same isolated Azure network. The current acceptance criterion is specific: Client requests move to healthy instances when one backend fails.

Question 450

A front-end workload must tolerate updates across multiple VM instances. Which implementation step would best fulfill the stated requirement?

Configure ingress for the public route while restricting admin access.
Place healthy backend instances behind the relevant Azure load balancer.
Provide a supported subnet, NIC and managed OS disk to the VM.
Deploy the supported web runtime and set application configuration.

Explanation

Correct Answer

Place healthy backend instances behind the relevant Azure load balancer. The implementation operationalizes this design choice: Choose an appropriate load balancing service for supported traffic distribution. Acceptance should demonstrate: Client requests move to healthy instances when one backend fails.

Incorrect Answers

This setup is relevant to another workload: A container app should accept HTTP traffic but not expose an internal administrative interface. The current configuration must instead achieve: Client requests move to healthy instances when one backend fails.

This change would be appropriate under a different condition: A firm deploys a Linux Azure VM and asks what supporting Azure resources it requires. Here it would not validate: Client requests move to healthy instances when one backend fails.

This setup is relevant to another workload: An e-commerce team has a simple website and does not want to patch guest OS hosts. The current configuration must instead achieve: Client requests move to healthy instances when one backend fails.

Microsoft AZ-900 Exam Dumps, Practice Test Questions

Question 440

Explanation

Correct Answer

Incorrect Answers

Question 441

Explanation

Correct Answer

Incorrect Answers

Question 442

Explanation

Correct Answer

Incorrect Answers

Question 443

Explanation

Correct Answer

Incorrect Answers

Question 444

Explanation

Correct Answer

Incorrect Answers

Question 445

Explanation

Correct Answer

Incorrect Answers

Question 446

Explanation

Correct Answer

Incorrect Answers

Question 447

Explanation

Correct Answer

Incorrect Answers

Question 448

Explanation

Correct Answer

Incorrect Answers

Question 449

Explanation

Correct Answer

Incorrect Answers

Question 450

Explanation

Correct Answer

Incorrect Answers