AZ-900 sample exam questions

With SaaS you consume finished software (for example Microsoft 365) and never manage virtual machines. Deploying and managing Azure VMs is Infrastructure as a Service.

Azure API Management publishes, secures and monitors APIs; it does not provision Azure resources. Repeatable deployment of identical resources is done with Azure Resource Manager templates (or Bicep).

An Azure virtual machine is IaaS because you manage the operating system and everything on it. Azure web apps (App Service), Logic Apps and Azure SQL Database are platform services where Microsoft manages the OS and runtime.

Azure Monitor collects metrics and logs from many Azure resources into a central Log Analytics workspace for analysis and alerting. Event Hubs is a streaming ingestion pipeline, not a repository, while Analysis Services and Stream Analytics are analytics engines.

Azure Sentinel, now named Microsoft Sentinel, is Azure's cloud-native SIEM and SOAR solution that collects security data, detects threats and automates responses. Analysis Services is a BI engine, Information Protection classifies data, and Cognitive Services provides AI APIs.

Responses in Microsoft Sentinel (formerly Azure Sentinel) are automated with playbooks, built on Azure Logic Apps and run by automation rules. Of these options the intended answer is Azure Monitor workbooks, but workbooks only visualize data; adaptive hardening and application controls are Defender for Cloud features and Service Health reports Azure outages.

Microsoft Sentinel can ingest Microsoft Entra ID (formerly Azure AD) sign-in and audit logs through a data connector and automatically analyze them with analytics rules to detect threats. Synapse is data analytics, Entra Connect syncs identities, and Key Vault stores secrets.

The Basic support plan covers only billing and subscription management support plus documentation and community forums; it gives no access to technical support engineers. Developer and higher paid plans provide technical support by email, and Standard and higher add phone.

Tags are name/value pairs (such as Office: Paris) applied to resources, and Cost Management can group and filter billing data by tag, producing per-office usage reports. Templates deploy resources, locks prevent changes, and policies enforce rules.

With SaaS the provider manages the application, runtime, OS and infrastructure, leaving the customer responsible only for their data, users and devices. PaaS and IaaS leave progressively more for the customer to manage.

Policy assignment scope ranges from a management group down to an individual resource such as a VM. Existing noncompliant resources are only flagged in compliance reports, never deleted, while a deny policy blocks noncompliant new deployments so only compliant resources can be created.

ExpressRoute exchanges routes using BGP over a private connection through a connectivity provider, never over the public internet. You can connect a site with multiple circuits, for example in different peering locations, for redundancy.

Azure Arc projects on-premises and other-cloud resources into Azure Resource Manager, so Azure Policy compliance, Azure Monitor and RBAC can be applied to them. Azure Policy alone governs Azure resources, Azure AD Connect syncs identities, and Front Door is a global load balancer.

In PaaS Microsoft patches the operating system. In IaaS the customer configures network controls such as NSGs and firewalls. In SaaS, identity and directory infrastructure is shared: Microsoft runs the service while the customer manages accounts and settings.

Service Health, which reports the health of Azure services, is surfaced in the Azure Monitor blade. Azure Advisor gives recommendations across cost, security, reliability, operational excellence and performance; its security recommendations come from Microsoft Defender for Cloud.