Text preview & study summary

Microsoft AZ-900 and AZ-104 - Azure Fundamentals and Administrator - Compute Storage Network Identity

A free sample of 5 questions from this quiz, shown in full with answer choices and explanations. No interactivity — everything is visible on this page for study and review.

Want to test your knowledge? Launch the Interactive Exam Simulator

Question 1

A developer needs a platform to host a web application without managing servers. The platform should handle OS updates, scaling, and deployment slots for zero-downtime deployments. Which Azure service provides this?

Answer choices

  • A. Azure Virtual Machines

  • B. Azure App Service (Correct)

  • C. Azure Container Instances

  • D. Azure Kubernetes Service

Explanation

Azure App Service is a fully managed PaaS for web apps, REST APIs, and mobile backends. Features: automatic OS/runtime patching, auto-scaling (up and out), deployment slots (staging/production swap for zero-downtime releases), built-in CI/CD integration (GitHub Actions, Azure DevOps), SSL management, custom domains. Azure VMs require OS management. ACI is for single container instances without PaaS management features. AKS is for complex containerized microservices with Kubernetes (more infrastructure management).

Question 2

An organization uses Azure Key Vault to store secrets and certificates. An application running in Azure App Service needs to read secrets from Key Vault without storing credentials. Which authentication approach eliminates static credentials?

Answer choices

  • A. Store the Key Vault access key in App Service Application Settings

  • B. Enable Managed Identity on App Service; grant Key Vault access policy or RBAC role to the managed identity (Correct)

  • C. Embed the service principal client secret in the application code

  • D. Use shared access signatures (SAS) for Key Vault

Explanation

Managed Identity (formerly Managed Service Identity) provides Azure services with an automatically managed identity in Azure AD. Azure handles credential rotation and storage — no secrets required in the application. Enable System-assigned Managed Identity on App Service → grant it "Key Vault Secrets User" role (or Key Vault access policy) → application uses `DefaultAzureCredential` to authenticate to Key Vault without any stored credentials. Storing access keys/client secrets creates security risks (rotation challenges, exposure in config). SAS tokens are for Azure Storage, not Key Vault.

Question 3

An administrator needs to capture all logs from Azure resources including Activity Logs, Diagnostic Logs, and VM performance metrics in a central repository for querying with KQL. Which Azure service provides this?

Answer choices

  • A. Azure Storage Account

  • B. Azure Log Analytics Workspace (Correct)

  • C. Azure Event Hub

  • D. Azure Application Insights

Explanation

Azure Log Analytics Workspace is the central repository for Azure Monitor log data. It collects: Azure Activity Logs (control plane operations), Resource Diagnostic Logs (service-specific logs), VM performance metrics (via Log Analytics agent or Azure Monitor Agent), security logs, and custom application logs. Data is queried using Kusto Query Language (KQL). Storage Accounts can archive logs but aren't optimized for querying. Event Hubs is a streaming ingestion service. Application Insights is for application performance monitoring (APM) and sends data to a Log Analytics Workspace.

Question 4

A company wants to deploy a containerized microservices application on Azure with zero-downtime rolling updates, horizontal pod autoscaling, and built-in service discovery. Which Azure service is most appropriate?

Answer choices

  • A. Azure Container Instances (ACI)

  • B. Azure App Service with Docker containers

  • C. Azure Kubernetes Service (AKS) (Correct)

  • D. Azure Service Fabric

Explanation

Azure Kubernetes Service (AKS) provides enterprise Kubernetes with: rolling update deployments (zero-downtime), Horizontal Pod Autoscaler (HPA) for pod scaling, cluster autoscaler for node scaling, built-in CoreDNS service discovery, ingress controller for routing, and Azure integration (Azure CNI, managed identity, Azure Monitor). ACI is for single containers without orchestration. App Service with Docker is for simpler containerized apps without full K8s orchestration. Service Fabric is Microsoft's own microservices platform (less popular than AKS, mainly for legacy lift-and-shift).

Question 5

A company deploys resources across multiple Azure subscriptions and needs to track the cost of a specific project that spans multiple subscriptions. Which cost management approach is most appropriate?

Answer choices

  • A. Create separate resource groups per subscription and sum costs manually

  • B. Use Azure Cost Management + Billing with resource tags and filter by project tag (Correct)

  • C. Use Azure Advisor cost recommendations

  • D. Create Management Groups per project

Explanation

Azure Cost Management + Billing allows filtering and grouping costs by resource tags across all subscriptions. Apply a "Project: ProjectName" tag to all related resources. In Cost Management, filter costs by this tag to see total project costs regardless of which subscription resources are in. Alternatively, use Budgets with tag filters to alert when project costs exceed thresholds. Manual summation across resource groups is time-consuming and error-prone. Azure Advisor makes recommendations but doesn't aggregate project-based costs. Management Group hierarchy is for governance, not project-level cost tracking.