Back to Microsoft Certified: Azure Fundamentals (AZ-900)

Describe Azure architecture and services

Explore Azure architectural components, compute, networking, storage, and identity services.

Covering regions, availability zones, resources, subscriptions, compute types (VMs, containers), networking (VNet, VPN), storage services, and identity services like Entra ID.
5 minutes 5 Questions

Azure architecture is built upon a foundation of datacenters distributed globally, organized into regions. These regions provide a variety of services, each built for different purposes. Core architectural components include: * **Regions:** Geographically distinct locations containing one or mo…

Concepts covered: Azure Regions and Region Pairs, Availability Zones, Azure Datacenters, Availability Sets, Azure Storage Accounts, Azure Storage Tiers, Azure Storage Redundancy, File Movement Options (AzCopy, Storage Explorer, File Sync), Migration Options (Azure Migrate, Data Box), Microsoft Entra ID, Microsoft Entra Domain Services, Authentication Methods (SSO, MFA, Passwordless), External Identities (B2B, B2C), Conditional Access, Role-Based Access Control (RBAC), Azure Resources and Resource Groups, Azure Subscriptions, Management Groups, Resource Hierarchy, Azure Virtual Machines (VMs), Azure Virtual Machine Scale Sets, Azure Virtual Desktop, Azure Containers, Azure Functions, Azure Web Apps, Azure Virtual Networks (VNet), Azure Subnets and Peering, Azure DNS, Azure VPN Gateway, Azure ExpressRoute, Public and Private Endpoints, Zero Trust Model, Defense-in-Depth, Microsoft Defender for Cloud

Test mode:
Start practice test
AZ-900 - Describe Azure architecture and services Example Questions

Test your knowledge of Describe Azure architecture and services

Question 1

You manage two Azure virtual networks, 'Net-A' and 'Net-B', located in the same region. You need to ensure that virtual machines in the subnets of 'Net-A' can access services in 'Net-B' with the same performance and latency as if they were in the same network. What connectivity solution should you choose?

Correct Answer: Virtual network peering

Virtual network peering is the correct solution because it connects two Azure virtual networks in the same region, allowing traffic to flow between them using the Microsoft backbone infrastructure. This method provides the lowest latency and highest bandwidth, mimicking the performance of a single network.

Site-to-site VPN connections require a VPN gateway, which introduces bandwidth limits and higher latency compared to peering. Azure ExpressRoute is primarily designed for connecting on-premises networks to Azure and would be an unnecessary and more complex solution for connecting two VNets in the same region. An Internal Load Balancer distributes traffic within a network but does not provide the routing capabilities required to connect two separate virtual networks.

Question 2

An IT Director mandates the use of Availability Zones for a new virtual machine deployment to ensure protection against data center failures. When selecting the target Azure location for these resources, which limiting factor must the administrator consider regarding the chosen Region?

Correct Answer: Only specific regions include the necessary infrastructure support.

The correct answer is that only specific regions include the necessary infrastructure support.

Availability Zones are physically separate datacenters within an Azure region, designed to protect against datacenter failures. However, they are not available in every Azure region. Each Availability Zone consists of one or more datacenters with independent power, cooling, and networking. Because this requires a specific architectural setup involving a minimum of three separate zones, an administrator must verify that the chosen region is one of the specific Azure regions that supports Availability Zones before deployment.

The other answers are incorrect:
- A region supporting Availability Zones consists of a minimum of three separate zones, not four.
- The feature is not exclusive to Enterprise Agreement subscriptions and is available across various subscription types.
- While specific storage redundancy options like Zone-redundant storage (ZRS) exist, the requirement for premium storage is not the primary factor dictating whether a region supports Availability Zones.

Question 3

Which statement accurately describes the function of Single Sign-On (SSO) within Microsoft Entra ID?

Correct Answer: Allows a user to sign in one time to access multiple applications

The correct statement is that Single Sign-On (SSO) allows a user to sign in one time to access multiple applications.

Single Sign-On provides the ability for a user to log in with a single set of credentials (username and password) and gain access to multiple designated applications and resources without being prompted to sign in again for each specific application. This improves the user experience by reducing password fatigue and streamlining access management.

The other answers describe different security features found in Microsoft Entra ID:

  1. Requiring multiple forms of verification refers to Multi-Factor Authentication (MFA), which requires a user to provide more than just a password to access a resource.

  2. Restricting access based on the user's location is a function of Conditional Access policies, which use signals like location, device, or application to make access decisions.

  3. Forcing a password reset when high-risk activity is detected is a capability of Microsoft Entra ID Protection (formerly Azure AD Identity Protection), specifically related to user risk or sign-in risk policies.

More Describe Azure architecture and services questions
1028 questions (total)
Start 100 question test