Practice Test #3

Virtual machine scale sets are designed to deploy and automatically scale a set of identical VMs for high availability and elasticity. They do not automate provisioning of a broader collection of different Azure resources (for example VNets, storage accounts, Key Vault, databases) as a single standardized environment. Scale sets address compute scaling, not full environment creation for multiple business units.

Azure API Management is a service for publishing, securing, transforming, and monitoring APIs. It helps manage API gateways and developer access, but it is not an infrastructure provisioning tool. While APIM can be deployed via IaC, the service itself does not automate creating a standardized set of 20 Azure resources for each business unit.

Management groups provide a hierarchy above subscriptions to organize them and apply governance controls (Azure Policy, RBAC) across many subscriptions. They are excellent for consistent governance at scale, but they do not deploy resources. You would commonly use management groups alongside ARM templates: management groups for governance, templates for automated resource creation.

Azure Information Protection (AIP) is designed for classifying, labeling, and protecting documents and emails (for example, applying sensitivity labels and enforcing rights management). It is not intended for storing deployment credentials or providing secure secret retrieval for infrastructure automation. While it helps protect data, it does not solve the problem of securely injecting admin credentials into an automated server deployment.

Azure Security Center (now part of Microsoft Defender for Cloud) focuses on security posture management, recommendations, and threat protection for Azure and hybrid workloads. It can alert on misconfigurations and vulnerabilities, but it does not provide a mechanism to store and encrypt administrative credentials for use during deployments. It complements Key Vault but does not replace secret management.

Azure Multi-Factor Authentication (MFA) strengthens user sign-in by requiring additional verification factors. It is valuable for interactive access to the Azure portal and administrative accounts, but it does not encrypt or store deployment credentials, nor does it help non-interactive automation securely retrieve secrets. Automated deployments typically use service principals or managed identities rather than MFA-based interactive authentication.

Azure Cosmos DB is a globally distributed NoSQL database optimized for low-latency, high-throughput operational workloads. While it can store large amounts of data, it is generally not the most cost-effective choice for 20 TB of infrequently accessed data intended primarily for BI visualization. Power BI scenarios typically use analytical stores/warehouses instead.

Azure SQL Database is a managed relational database primarily suited for OLTP and smaller-to-moderate analytical workloads. For 20 TB and BI-style querying, it can be less optimal and potentially more expensive or harder to scale than a dedicated data warehouse solution. Power BI can connect, but it’s not the typical TB-scale warehouse choice.

Azure Database for PostgreSQL is a managed open-source relational database service typically used for transactional applications and general-purpose relational workloads. While it can support reporting, it is not purpose-built for large-scale data warehousing at 20 TB for Power BI. A lake/warehouse pattern is usually more appropriate for this scenario.

Azure Service Bus is a managed messaging service (queues, topics/subscriptions) used for decoupling applications and integrating systems asynchronously. It does not control or filter network connections between VMs/subnets. While it can reduce the need for direct connections by using messaging patterns, it is not a network security control and would not be the correct solution for limiting connection types at the network layer.

A local network gateway represents your on-premises VPN device and its address space in Azure, typically used with a VPN gateway to create site-to-site or point-to-site connectivity. It is not used to filter traffic between Azure web and database servers. Even in hybrid scenarios, you would still use NSGs (or Azure Firewall) to control allowed ports and protocols within Azure.

A route filter is used with Azure ExpressRoute to control which BGP routes are advertised/received for specific Microsoft peering services (e.g., limiting access to certain Azure public services). It affects route propagation, not port/protocol-level access between subnets/VMs. It cannot enforce “only allow TCP 1433 from web tier to database tier,” so it is not appropriate for limiting connection types.

Incorrect. Encrypting network traffic is typically handled by transport/security services such as TLS/SSL, VPN Gateway (IPsec/IKE), Azure ExpressRoute with encryption options, or application-level HTTPS. Azure Information Protection does not provide network-layer encryption; it focuses on protecting the data content (files/emails) with persistent encryption and usage rights.

Incorrect. An Azure Storage account is encrypted using Storage Service Encryption (SSE) with Microsoft-managed keys by default, or customer-managed keys in Azure Key Vault for additional control. While AIP-protected files can be stored in a storage account, AIP does not encrypt the storage account resource itself.

Incorrect. Azure SQL Database encryption is provided by features like Transparent Data Encryption (TDE) for data at rest and Always Encrypted for protecting sensitive columns end-to-end. AIP is not used to encrypt an Azure SQL database; it is designed for information protection of documents and emails.

No change is needed is incorrect because the original statement says that you can create an Azure support request from support.microsoft.com, which is not the standard Azure support request location tested in AZ-900. Azure support requests are created through the Azure portal so they can be linked to the proper subscription and permissions. While Microsoft has general support websites, they are not the expected answer for Azure support ticket creation in this exam context. Therefore, the statement needs to be changed.

The Knowledge Center is not used to create Azure support requests. It is a self-service resource for articles, troubleshooting guidance, and documentation rather than a ticketing interface tied to Azure subscriptions. It does not provide the normal Azure support request workflow with service selection, severity, and subscription scoping. Therefore, this option would make the statement incorrect.

The Security & Compliance admin center is related to Microsoft 365 compliance and security administration, not Azure subscription support. It is designed for managing compliance policies, security settings, and related Microsoft 365 workloads rather than opening Azure service requests. Azure support cases require Azure-specific subscription context and are handled in the Azure portal. Therefore, this option is incorrect.

Incorrect. Integrating on-premises Active Directory with Azure AD (Microsoft Entra ID) is done using identity services and tools such as Azure AD Connect (or cloud sync), federation (AD FS), and related identity configuration. Azure Advisor does not perform directory integration; it only analyzes existing Azure resources and provides optimization recommendations.

Incorrect. Estimating the costs of an Azure solution is typically done with the Azure Pricing Calculator (pre-deployment estimates) and the Total Cost of Ownership (TCO) Calculator (compare on-prem vs Azure). Azure Advisor focuses on optimizing costs for resources you already run in Azure by recommending actions like resizing or shutting down underutilized resources.

Incorrect. Evaluating which on-premises resources can be migrated to Azure is the purpose of Azure Migrate, which discovers, assesses, and helps plan migrations (servers, databases, apps). Azure Advisor does not inventory on-premises environments or perform migration readiness assessments; it targets optimization of existing Azure deployments.