Microsoft AZ-900 Exam Dumps, Practice Test Questions

100% Latest & Updated Microsoft AZ-900 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!

Microsoft AZ-900 Premium Bundle
$79.97
$59.98

AZ-900 Premium Bundle

  • Premium File: 482 Questions & Answers. Last update: Nov 5, 2026
  • Training Course: 85 Video Lectures
  • Study Guide: 425 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates

AZ-900 Premium Bundle

Microsoft AZ-900 Premium Bundle
  • Premium File: 482 Questions & Answers. Last update: Nov 5, 2026
  • Training Course: 85 Video Lectures
  • Study Guide: 425 Pages
  • Latest Questions
  • 100% Accurate Answers
  • Fast Exam Updates
$79.97
$59.98

Microsoft AZ-900 Practice Test 48

Question 470

A company wants to resolve private endpoint hostnames to their private addresses. Which Azure setup action best follows from this scenario?

  1. Place healthy backend instances behind the relevant Azure load balancer.
  2. Place the appropriate VMs in one availability set with separate fault/update domains.
  3. Create Kubernetes deployment and service resources on the AKS cluster.
  4. Associate the appropriate Private DNS zone with the client VNet.

Explanation

Correct Answer

D:

Associate the appropriate Private DNS zone with the client VNet. The implementation operationalizes this design choice: Use correct private DNS integration for private endpoint name resolution. Acceptance should demonstrate: Name lookup returns the intended private IP for supported clients.

Incorrect Answers

A:

This setup is relevant to another workload: A front-end workload must tolerate updates across multiple VM instances. The current configuration must instead achieve: Name lookup returns the intended private IP for supported clients.

B:

That action implements a different requirement: Two critical VMs in one region need separation from common host hardware maintenance faults. It does not establish the required result in this case: Name lookup returns the intended private IP for supported clients.

C:

This change would be appropriate under a different condition: An enterprise has many container replicas and needs automated rollouts and service discovery. Here it would not validate: Name lookup returns the intended private IP for supported clients.

Question 471

A company wants to resolve private endpoint hostnames to their private addresses. Which verification outcome should the team expect from the right design?

  1. Only permitted tier-to-tier connections succeed.
  2. The runtime executes with the needed dependencies and access boundary.
  3. Name lookup returns the intended private IP for supported clients.
  4. Company VPN users connect while direct unsolicited internet connection fails.

Explanation

Correct Answer

C:

Name lookup returns the intended private IP for supported clients. That directly tests the stated requirement: A company wants to resolve private endpoint hostnames to their private addresses. It contrasts with the observed failure: DNS returns the public address despite an existing private endpoint.

Incorrect Answers

A:

This observation is evidence for a separate scenario: A three-tier app must isolate database traffic from front-end workload traffic. It does not test the necessary outcome here: Name lookup returns the intended private IP for supported clients.

B:

That check tests another control: A developer wants to host a Linux application with a custom runtime not supported by a managed web tier. The decisive result for this workload is: Name lookup returns the intended private IP for supported clients.

D:

This observation is evidence for a separate scenario: A development team wants its VM to be reachable only from its private corporate VPN. It does not test the necessary outcome here: Name lookup returns the intended private IP for supported clients.

Question 472

A company wants to resolve private endpoint hostnames to their private addresses. The team observes: DNS returns the public address despite an existing private endpoint. Which underlying mistake most directly explains the reported symptom?

  1. It conflated endpoint resource types and their accessibility semantics.
  2. An individual unmanaged VM was used instead of a scalable instance group.
  3. Private zone records or VNet links were not configured correctly.
  4. They were not placed on the intended shared VNet.

Explanation

Correct Answer

C:

Private zone records or VNet links were not configured correctly. That explains the symptom: DNS returns the public address despite an existing private endpoint. The targeted corrective action is: Associate the appropriate Private DNS zone with the client VNet.

Incorrect Answers

A:

This cause is consistent with a different issue: The design treats a private endpoint as an internet-accessible public IP. It does not account for the reported symptom here: DNS returns the public address despite an existing private endpoint.

B:

The alternate mechanism would more directly produce this other failure: Operators manually create each VM during every traffic spike. The current incident instead involves: DNS returns the public address despite an existing private endpoint.

D:

This cause is consistent with a different issue: Both VMs have public addresses but no defined private network path. It does not account for the reported symptom here: DNS returns the public address despite an existing private endpoint.

Question 473

A branch office needs to connect an isolated internal Azure service across an encrypted internet path. What is the most appropriate cloud concept or service for this need?

  1. Select a site-to-site VPN rather than granting the private service a public IP.
  2. Select a supported GPU-enabled VM size rather than a generic small VM.
  3. Use an authorized public endpoint for the web application's external entry point.
  4. Use Azure virtual network peering when the supported network designs permit it.

Explanation

Correct Answer

A:

Select a site-to-site VPN rather than granting the private service a public IP. The governing requirement is: A branch office needs to connect an isolated internal Azure service across an encrypted internet path. This solution specifically supports the outcome that on-premises private clients reach the service through the encrypted tunnel.

Incorrect Answers

B:

That concept addresses this separate situation: A video encoder needs GPU-accelerated processing inside a customer-controlled guest. It does not by itself establish the result required here: On-premises private clients reach the service through the encrypted tunnel.

C:

This option solves a different planning problem: A public website needs clients worldwide to connect to its internet-accessible service. The current acceptance criterion is specific: On-premises private clients reach the service through the encrypted tunnel.

D:

This design is appropriate for a different requirement: Two business units operate separate VNets in one region and require private connectivity. Here the decisive outcome must instead be: On-premises private clients reach the service through the encrypted tunnel.

Question 474

A branch office needs to connect an isolated internal Azure service across an encrypted internet path. What should the team configure or perform to implement the correct approach?

  1. Place the appropriate VMs in one availability set with separate fault/update domains.
  2. Create approved VPN tunnels and route private subnets.
  3. Deploy the runtime on an eligible chosen compute platform.
  4. Place tiers in defined subnets and apply required NSG rules.

Explanation

Correct Answer

B:

Create approved VPN tunnels and route private subnets. The implementation operationalizes this design choice: Select a site-to-site VPN rather than granting the private service a public IP. Acceptance should demonstrate: On-premises private clients reach the service through the encrypted tunnel.

Incorrect Answers

A:

This setup is relevant to another workload: Two critical VMs in one region need separation from common host hardware maintenance faults. The current configuration must instead achieve: On-premises private clients reach the service through the encrypted tunnel.

C:

This change would be appropriate under a different condition: A developer wants to host a Linux application with a custom runtime not supported by a managed web tier. Here it would not validate: On-premises private clients reach the service through the encrypted tunnel.

D:

This setup is relevant to another workload: A three-tier app must isolate database traffic from front-end workload traffic. The current configuration must instead achieve: On-premises private clients reach the service through the encrypted tunnel.

Question 475

A branch office needs to connect an isolated internal Azure service across an encrypted internet path. Which evidence best confirms the requirement is being met?

  1. Pods are scheduled and controlled through Kubernetes APIs.
  2. On-premises private clients reach the service through the encrypted tunnel.
  3. Approved internet clients reach the web service through its public address.
  4. The workload detects its GPU and completes encoding as designed.

Explanation

Correct Answer

B:

On-premises private clients reach the service through the encrypted tunnel. That directly tests the stated requirement: A branch office needs to connect an isolated internal Azure service across an encrypted internet path. It contrasts with the observed failure: Administrators publish the internal service on a public endpoint for office access.

Incorrect Answers

A:

This observation is evidence for a separate scenario: A business needs a managed Kubernetes control plane for many containerized services. It does not test the necessary outcome here: On-premises private clients reach the service through the encrypted tunnel.

C:

The test is relevant when a public website needs clients worldwide to connect to its internet-accessible service. It cannot establish the specified acceptance result: On-premises private clients reach the service through the encrypted tunnel.

D:

This observation is evidence for a separate scenario: A video encoder needs GPU-accelerated processing inside a customer-controlled guest. It does not test the necessary outcome here: On-premises private clients reach the service through the encrypted tunnel.

Question 476

A branch office needs to connect an isolated internal Azure service across an encrypted internet path. The team observes: Administrators publish the internal service on a public endpoint for office access. What is the most likely cause of the observed failure?

  1. Private zone records or VNet links were not configured correctly.
  2. They used public exposure instead of private hybrid network connectivity.
  3. They were not placed in the intended availability-set fault/update separation.
  4. An unmanaged container runtime was chosen instead of orchestration.

Explanation

Correct Answer

B:

They used public exposure instead of private hybrid network connectivity. That explains the symptom: Administrators publish the internal service on a public endpoint for office access. The targeted corrective action is: Create approved VPN tunnels and route private subnets.

Incorrect Answers

A:

This cause is consistent with a different issue: DNS returns the public address despite an existing private endpoint. It does not account for the reported symptom here: Administrators publish the internal service on a public endpoint for office access.

C:

That explanation belongs to a different fault pattern: Both critical VMs are interrupted by a shared maintenance event. It does not explain why administrators publish the internal service on a public endpoint for office access.

D:

This cause is consistent with a different issue: Container teams are forced to script every host and scheduler task manually. It does not account for the reported symptom here: Administrators publish the internal service on a public endpoint for office access.

Question 477

An app must respond to scheduled timers without keeping a VM on all day. Which architectural decision meets the described priority?

  1. Consider Azure Container Apps for eligible managed application containers.
  2. Use an Azure Function timer trigger where the workload fits.
  3. Select Azure VPN Gateway for supported internet-based encrypted VPN connectivity.
  4. Plan virtual networking, storage and compute resources alongside the VM.

Explanation

Correct Answer

B:

Use an Azure Function timer trigger where the workload fits. The governing requirement is: An app must respond to scheduled timers without keeping a VM on all day. This solution specifically supports the outcome that the function executes on schedule without an always-running custom VM.

Incorrect Answers

A:

This design is appropriate for a different requirement: A developer wants a simple containerized web API without managing a Kubernetes cluster. Here the decisive outcome must instead be: The function executes on schedule without an always-running custom VM.

C:

This option solves a different planning problem: A company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. The current acceptance criterion is specific: The function executes on schedule without an always-running custom VM.

D:

This design is appropriate for a different requirement: A firm deploys a Linux Azure VM and asks what supporting Azure resources it requires. Here the decisive outcome must instead be: The function executes on schedule without an always-running custom VM.

Question 478

An app must respond to scheduled timers without keeping a VM on all day. Which configuration or operating action most directly puts that decision into practice?

  1. Configure a timer-triggered function with authorized resource access.
  2. Identify whether clients must traverse a public or private network path.
  3. Attach the VMs to subnets in the approved VNet.
  4. Select VMSS for guest-managed worker images and App Service for eligible web apps.

Explanation

Correct Answer

A:

Configure a timer-triggered function with authorized resource access. The implementation operationalizes this design choice: Use an Azure Function timer trigger where the workload fits. Acceptance should demonstrate: The function executes on schedule without an always-running custom VM.

Incorrect Answers

B:

That action implements a different requirement: A new cloud student asks whether public and private endpoints both mean publicly reachable Azure services. It does not establish the required result in this case: The function executes on schedule without an always-running custom VM.

C:

This change would be appropriate under a different condition: A security team needs to place two front-end VMs on the same isolated Azure network. Here it would not validate: The function executes on schedule without an always-running custom VM.

D:

This setup is relevant to another workload: A batch team must distinguish a VM scale set from Azure App Service autoscale. The current configuration must instead achieve: The function executes on schedule without an always-running custom VM.

Question 479

An app must respond to scheduled timers without keeping a VM on all day. Which observation is the strongest acceptance test for this scenario?

  1. Office hosts reach approved Azure subnet addresses over the VPN.
  2. Rolling updates replace pods while service discovery remains stable.
  3. The container responds to requests without customer cluster administration.
  4. The function executes on schedule without an always-running custom VM.

Explanation

Correct Answer

D:

The function executes on schedule without an always-running custom VM. That directly tests the stated requirement: An app must respond to scheduled timers without keeping a VM on all day. It contrasts with the observed failure: The program runs only if an operator manually logs into a server.

Incorrect Answers

A:

This observation is evidence for a separate scenario: A company needs encrypted site-to-site connectivity from its existing office to an Azure VNet. It does not test the necessary outcome here: The function executes on schedule without an always-running custom VM.

B:

That check tests another control: An enterprise has many container replicas and needs automated rollouts and service discovery. The decisive result for this workload is: The function executes on schedule without an always-running custom VM.

C:

The test is relevant when a developer wants a simple containerized web API without managing a Kubernetes cluster. It cannot establish the specified acceptance result: The function executes on schedule without an always-running custom VM.

Question 480

An app must respond to scheduled timers without keeping a VM on all day. The team observes: The program runs only if an operator manually logs into a server. Which planning or configuration error best accounts for this result?

  1. No event/schedule-triggered managed execution was configured.
  2. Only layer-four load balancing was used for a layer-seven routing need.
  3. The subnet IP prefixes were planned with overlapping address ranges.
  4. The design ignored available cross-region VNet peering capability.

Explanation

Correct Answer

A:

No event/schedule-triggered managed execution was configured. That explains the symptom: The program runs only if an operator manually logs into a server. The targeted corrective action is: Configure a timer-triggered function with authorized resource access.

Incorrect Answers

B:

The alternate mechanism would more directly produce this other failure: All URLs route to one backend despite distinct application paths. The current incident instead involves: The program runs only if an operator manually logs into a server.

C:

That explanation belongs to a different fault pattern: Subnet creation fails because the proposed CIDR blocks overlap. It does not explain why the program runs only if an operator manually logs into a server.

D:

This cause is consistent with a different issue: The engineer assumes peering can connect only within one Azure region. It does not account for the reported symptom here: The program runs only if an operator manually logs into a server.

Microsoft Azure Fundamentals (AZ-900) Practice Tests

UP

SPECIAL OFFER: GET 10% OFF

This is ONE TIME OFFER

ExamSnap Discount Offer
Enter Your Email Address to Receive Your 10% Off Discount Code

A confirmation link will be sent to this email address to verify your login. *We value your privacy. We will not rent or sell your email address.

Download Free Demo of VCE Exam Simulator

Experience Avanset VCE Exam Simulator for yourself.

Simply submit your e-mail address below to get started with our interactive software demo of your free trial.

Free Demo Limits: In the demo version you will be able to access only first 5 questions from exam.