AZ-900 Free Practice Questions — Page 10 (2026)

Question 93

You need to collect and automatically analyze security events from Azure Active Directory (Azure AD). What should you use?

A. Microsoft Sentinel

B. Azure Synapse Analytics

C. Azure AD Connect

D. Azure Key Vault

Show Answer

Correct Answer: A

Explanation:
Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR solution. It can collect security events from Azure Active Directory (Microsoft Entra ID), analyze them automatically, detect threats, and support incident response. Azure Synapse Analytics is for analytics/data warehousing, Azure AD Connect synchronizes identities, and Azure Key Vault stores secrets and keys.

Question 94

You need to start Azure Cloud Shell. What should you use?

A. the Azure portal

B. Azure Command-Line Interface (CLI)

C. Azure PowerShell

D. an Azure Resource Manager (ARM) template

Show Answer

Correct Answer: A

Explanation:
Azure Cloud Shell is launched from the Azure portal by selecting the Cloud Shell icon. While Cloud Shell provides Azure CLI and Azure PowerShell environments once started, neither the standalone Azure CLI nor Azure PowerShell starts the Cloud Shell service itself. An ARM template is unrelated to launching Cloud Shell.

Question 95

HOTSPOT - For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

Show Answer

Correct Answer: Yes Yes No

Explanation:
A private cloud gives the organization control over its dedicated resources and security. A hybrid cloud allows workloads to run either on-premises or in the cloud. Scaling a VM in a public cloud is an operational (pay-as-you-go) expense, not a capital expenditure.

Question 96

HOTSPOT - Select the answer that correctly completes the sentence. Hot Area:

Show Answer

Correct Answer: excluded from the Service Level Agreements.

Explanation:
Azure public preview services are offered for evaluation and typically do not include an SLA until they reach general availability.

Question 97

HOTSPOT - Select the answer that correctly completes the sentence. Hot Area:

Show Answer

Correct Answer: multi-factor authentication (MFA)

Explanation:
Among the given options, the intended exam answer is MFA because it requires multiple authentication prompts. Although a password and a security question are both 'something you know' and therefore not distinct authentication factors under the strict definition of MFA, the other options clearly do not fit the authentication scenario.

Question 98

What should you use to evaluate whether your company's Azure environment meets regulatory requirements?

A. Azure Service Health

B. Azure Knowledge Center

C. Microsoft Defender for Cloud

D. Azure Advisor

Show Answer

Correct Answer: C

Explanation:
Microsoft Defender for Cloud includes a regulatory compliance dashboard that assesses Azure resources against built-in standards and regulatory frameworks, helping evaluate whether an Azure environment meets compliance requirements. Azure Service Health reports service issues, Azure Advisor provides optimization recommendations, and the Azure Knowledge Center is an information resource rather than a compliance assessment tool.

Question 99

You have an Azure subscription. You need to review your secure score. What should you use?

A. Azure Monitor

B. Azure Advisor

C. Help + support

D. Microsoft Defender for Cloud

Show Answer

Correct Answer: D

Explanation:
Microsoft Defender for Cloud provides the Secure Score feature, which assesses the security posture of Azure resources and offers recommendations to improve it. Azure Advisor provides optimization recommendations but not Secure Score, Azure Monitor is for monitoring and telemetry, and Help + support is for support requests.

Question 100

How many copies of data are maintained by an Azure Storage account that uses locally-redundant storage (LRS)?

A. 3

B. 4

C. 6

D. 9

Show Answer

Correct Answer: A

Explanation:
Locally redundant storage (LRS) maintains three synchronous copies of data within a single datacenter in the primary region, providing durability against local hardware failures but not against zone or regional outages. Sources: https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create

Question 101

HOTSPOT - Select the answer that correctly completes the sentence. Hot Area:

Show Answer

Correct Answer: network security group (NSG)

Explanation:
Inbound TCP access to a VM is controlled by NSG rules. Add or modify an inbound security rule to allow TCP port 8080.

Question 102

Your company plans to automate the deployment of servers to Azure. Your manager is concerned that you may expose administrative credentials during the deployment. You need to recommend an Azure solution that encrypts the administrative credentials during the deployment. What should you include in the recommendation?

A. Azure Key Vault

B. Azure Information Protection

C. Microsoft Defender for Cloud

D. Azure Multi-Factor Authentication (MFA)

Show Answer

Correct Answer: A

Explanation:
Azure Key Vault is designed to securely store and manage secrets, keys, and certificates. During automated Azure deployments (such as ARM/Bicep deployments), administrative credentials can be stored as secrets in Key Vault and referenced securely, avoiding exposure in templates or scripts. Azure Information Protection classifies and protects documents, Microsoft Defender for Cloud provides security posture and threat protection, and Azure MFA strengthens authentication but does not encrypt deployment credentials.