100% Latest & Updated Microsoft AZ-900 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 470
A company wants to resolve private endpoint hostnames to their private addresses. Which Azure setup action best follows from this scenario?
- Place healthy backend instances behind the relevant Azure load balancer.
- Place the appropriate VMs in one availability set with separate fault/update domains.
- Create Kubernetes deployment and service resources on the AKS cluster.
- Associate the appropriate Private DNS zone with the client VNet.
Explanation
Correct Answer
D:Associate the appropriate Private DNS zone with the client VNet. The implementation operationalizes this design choice: Use correct private DNS integration for private endpoint name resolution. Acceptance should demonstrate: Name lookup returns the intended private IP for supported clients.
Incorrect Answers
A:This setup is relevant to another workload: A front-end workload must tolerate updates across multiple VM instances. The current configuration must instead achieve: Name lookup returns the intended private IP for supported clients.
B:That action implements a different requirement: Two critical VMs in one region need separation from common host hardware maintenance faults. It does not establish the required result in this case: Name lookup returns the intended private IP for supported clients.
C:This change would be appropriate under a different condition: An enterprise has many container replicas and needs automated rollouts and service discovery. Here it would not validate: Name lookup returns the intended private IP for supported clients.
Question 471
A company wants to resolve private endpoint hostnames to their private addresses. Which verification outcome should the team expect from the right design?
- Only permitted tier-to-tier connections succeed.
- The runtime executes with the needed dependencies and access boundary.
- Name lookup returns the intended private IP for supported clients.
- Company VPN users connect while direct unsolicited internet connection fails.
Explanation
Correct Answer
C:Name lookup returns the intended private IP for supported clients. That directly tests the stated requirement: A company wants to resolve private endpoint hostnames to their private addresses. It contrasts with the observed failure: DNS returns the public address despite an existing private endpoint.
Incorrect Answers
A:This observation is evidence for a separate scenario: A three-tier app must isolate database traffic from front-end workload traffic. It does not test the necessary outcome here: Name lookup returns the intended private IP for supported clients.
B:That check tests another control: A developer wants to host a Linux application with a custom runtime not supported by a managed web tier. The decisive result for this workload is: Name lookup returns the intended private IP for supported clients.
D:This observation is evidence for a separate scenario: A development team wants its VM to be reachable only from its private corporate VPN. It does not test the necessary outcome here: Name lookup returns the intended private IP for supported clients.
Question 472
A company wants to resolve private endpoint hostnames to their private addresses. The team observes: DNS returns the public address despite an existing private endpoint. Which underlying mistake most directly explains the reported symptom?
- It conflated endpoint resource types and their accessibility semantics.
- An individual unmanaged VM was used instead of a scalable instance group.
- Private zone records or VNet links were not configured correctly.
- They were not placed on the intended shared VNet.
Explanation
Correct Answer
C:Private zone records or VNet links were not configured correctly. That explains the symptom: DNS returns the public address despite an existing private endpoint. The targeted corrective action is: Associate the appropriate Private DNS zone with the client VNet.
Incorrect Answers
A:This cause is consistent with a different issue: The design treats a private endpoint as an internet-accessible public IP. It does not account for the reported symptom here: DNS returns the public address despite an existing private endpoint.
B:The alternate mechanism would more directly produce this other failure: Operators manually create each VM during every traffic spike. The current incident instead involves: DNS returns the public address despite an existing private endpoint.
D:This cause is consistent with a different issue: Both VMs have public addresses but no defined private network path. It does not account for the reported symptom here: DNS returns the public address despite an existing private endpoint.
Question 473
A branch office needs to connect an isolated internal Azure service across an encrypted internet path. What is the most appropriate cloud concept or service for this need?
- Select a site-to-site VPN rather than granting the private service a public IP.
- Select a supported GPU-enabled VM size rather than a generic small VM.
- Use an authorized public endpoint for the web application's external entry point.
- Use Azure virtual network peering when the supported network designs permit it.
Explanation
Correct Answer
A:Select a site-to-site VPN rather than granting the private service a public IP. The governing requirement is: A branch office needs to connect an isolated internal Azure service across an encrypted internet path. This solution specifically supports the outcome that on-premises private clients reach the service through the encrypted tunnel.
Incorrect Answers
B:That concept addresses this separate situation: A video encoder needs GPU-accelerated processing inside a customer-controlled guest. It does not by itself establish the result required here: On-premises private clients reach the service through the encrypted tunnel.
C:This option solves a different planning problem: A public website needs clients worldwide to connect to its internet-accessible service. The current acceptance criterion is specific: On-premises private clients reach the service through the encrypted tunnel.
D:This design is appropriate for a different requirement: Two business units operate separate VNets in one region and require private connectivity. Here the decisive outcome must instead be: On-premises private clients reach the service through the encrypted tunnel.
Question 474
A branch office needs to connect an isolated internal Azure service across an encrypted internet path. What should the team configure or perform to implement the correct approach?
- Place the appropriate VMs in one availability set with separate fault/update domains.
- Create approved VPN tunnels and route private subnets.
- Deploy the runtime on an eligible chosen compute platform.
- Place tiers in defined subnets and apply required NSG rules.
Explanation
Correct Answer
B:Create approved VPN tunnels and route private subnets. The implementation operationalizes this design choice: Select a site-to-site VPN rather than granting the private service a public IP. Acceptance should demonstrate: On-premises private clients reach the service through the encrypted tunnel.
Incorrect Answers
A:This setup is relevant to another workload: Two critical VMs in one region need separation from common host hardware maintenance faults. The current configuration must instead achieve: On-premises private clients reach the service through the encrypted tunnel.
C:This change would be appropriate under a different condition: A developer wants to host a Linux application with a custom runtime not supported by a managed web tier. Here it would not validate: On-premises private clients reach the service through the encrypted tunnel.
D:This setup is relevant to another workload: A three-tier app must isolate database traffic from front-end workload traffic. The current configuration must instead achieve: On-premises private clients reach the service through the encrypted tunnel.
Question 475
A branch office needs to connect an isolated internal Azure service across an encrypted internet path. Which evidence best confirms the requirement is being met?
- Pods are scheduled and controlled through Kubernetes APIs.
- On-premises private clients reach the service through the encrypted tunnel.
- Approved internet clients reach the web service through its public address.
- The workload detects its GPU and completes encoding as designed.
Explanation
Correct Answer
B:On-premises private clients reach the service through the encrypted tunnel. That directly tests the stated requirement: A branch office needs to connect an isolated internal Azure service across an encrypted internet path. It contrasts with the observed failure: Administrators publish the internal service on a public endpoint for office access.
Incorrect Answers
A:This observation is evidence for a separate scenario: A business needs a managed Kubernetes control plane for many containerized services. It does not test the necessary outcome here: On-premises private clients reach the service through the encrypted tunnel.
C:The test is relevant when a public website needs clients worldwide to connect to its internet-accessible service. It cannot establish the specified acceptance result: On-premises private clients reach the service through the encrypted tunnel.
D:This observation is evidence for a separate scenario: A video encoder needs GPU-accelerated processing inside a customer-controlled guest. It does not test the necessary outcome here: On-premises private clients reach the service through the encrypted tunnel.
Question 476
A branch office needs to connect an isolated internal Azure service across an encrypted internet path. The team observes: Administrators publish the internal service on a public endpoint for office access. What is the most likely cause of the observed failure?
- Private zone records or VNet links were not configured correctly.
- They used public exposure instead of private hybrid network connectivity.
- They were not placed in the intended availability-set fault/update separation.
- An unmanaged container runtime was chosen instead of orchestration.
Explanation
Correct Answer
B:They used public exposure instead of private hybrid network connectivity. That explains the symptom: Administrators publish the internal service on a public endpoint for office access. The targeted corrective action is: Create approved VPN tunnels and route private subnets.
Incorrect Answers
A:This cause is consistent with a different issue: DNS returns the public address despite an existing private endpoint. It does not account for the reported symptom here: Administrators publish the internal service on a public endpoint for office access.
C:That explanation belongs to a different fault pattern: Both critical VMs are interrupted by a shared maintenance event. It does not explain why administrators publish the internal service on a public endpoint for office access.
D:This cause is consistent with a different issue: Container teams are forced to script every host and scheduler task manually. It does not account for the reported symptom here: Administrators publish the internal service on a public endpoint for office access.
Question 477
An app must respond to scheduled timers without keeping a VM on all day. Which architectural decision meets the described priority?
- Consider Azure Container Apps for eligible managed application containers.
- Use an Azure Function timer trigger where the workload fits.
- Select Azure VPN Gateway for supported internet-based encrypted VPN connectivity.
- Plan virtual networking, storage and compute resources alongside the VM.
Explanation
Correct Answer
B:Use an Azure Function timer trigger where the workload fits. The governing requirement is: An app must respond to scheduled timers without keeping a VM on all day. This solution specifically supports the outcome that the function executes on schedule without an always-running custom VM.
Incorrect Answers
A:This design is appropriate for a different requirement: A developer wants a simple containerized web API without managing a Kubernetes cluster. Here the decisive outcome must instead be: The function executes on schedule without an always-running custom VM.
C:This option solves a different planning problem: A company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. The current acceptance criterion is specific: The function executes on schedule without an always-running custom VM.
D:This design is appropriate for a different requirement: A firm deploys a Linux Azure VM and asks what supporting Azure resources it requires. Here the decisive outcome must instead be: The function executes on schedule without an always-running custom VM.
Question 478
An app must respond to scheduled timers without keeping a VM on all day. Which configuration or operating action most directly puts that decision into practice?
- Configure a timer-triggered function with authorized resource access.
- Identify whether clients must traverse a public or private network path.
- Attach the VMs to subnets in the approved VNet.
- Select VMSS for guest-managed worker images and App Service for eligible web apps.
Explanation
Correct Answer
A:Configure a timer-triggered function with authorized resource access. The implementation operationalizes this design choice: Use an Azure Function timer trigger where the workload fits. Acceptance should demonstrate: The function executes on schedule without an always-running custom VM.
Incorrect Answers
B:That action implements a different requirement: A new cloud student asks whether public and private endpoints both mean publicly reachable Azure services. It does not establish the required result in this case: The function executes on schedule without an always-running custom VM.
C:This change would be appropriate under a different condition: A security team needs to place two front-end VMs on the same isolated Azure network. Here it would not validate: The function executes on schedule without an always-running custom VM.
D:This setup is relevant to another workload: A batch team must distinguish a VM scale set from Azure App Service autoscale. The current configuration must instead achieve: The function executes on schedule without an always-running custom VM.
Question 479
An app must respond to scheduled timers without keeping a VM on all day. Which observation is the strongest acceptance test for this scenario?
- Office hosts reach approved Azure subnet addresses over the VPN.
- Rolling updates replace pods while service discovery remains stable.
- The container responds to requests without customer cluster administration.
- The function executes on schedule without an always-running custom VM.
Explanation
Correct Answer
D:The function executes on schedule without an always-running custom VM. That directly tests the stated requirement: An app must respond to scheduled timers without keeping a VM on all day. It contrasts with the observed failure: The program runs only if an operator manually logs into a server.
Incorrect Answers
A:This observation is evidence for a separate scenario: A company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. It does not test the necessary outcome here: The function executes on schedule without an always-running custom VM.
B:That check tests another control: An enterprise has many container replicas and needs automated rollouts and service discovery. The decisive result for this workload is: The function executes on schedule without an always-running custom VM.
C:The test is relevant when a developer wants a simple containerized web API without managing a Kubernetes cluster. It cannot establish the specified acceptance result: The function executes on schedule without an always-running custom VM.
Question 480
An app must respond to scheduled timers without keeping a VM on all day. The team observes: The program runs only if an operator manually logs into a server. Which planning or configuration error best accounts for this result?
- No event/schedule-triggered managed execution was configured.
- Only layer-four load balancing was used for a layer-seven routing need.
- The subnet IP prefixes were planned with overlapping address ranges.
- The design ignored available cross-region VNet peering capability.
Explanation
Correct Answer
A:No event/schedule-triggered managed execution was configured. That explains the symptom: The program runs only if an operator manually logs into a server. The targeted corrective action is: Configure a timer-triggered function with authorized resource access.
Incorrect Answers
B:The alternate mechanism would more directly produce this other failure: All URLs route to one backend despite distinct application paths. The current incident instead involves: The program runs only if an operator manually logs into a server.
C:That explanation belongs to a different fault pattern: Subnet creation fails because the proposed CIDR blocks overlap. It does not explain why the program runs only if an operator manually logs into a server.
D:This cause is consistent with a different issue: The engineer assumes peering can connect only within one Azure region. It does not account for the reported symptom here: The program runs only if an operator manually logs into a server.
Microsoft Azure Fundamentals (AZ-900) Practice Tests