Describe cloud concepts: 5 AZ-900 Questions with Full Explanations
Practice Describe cloud concepts for the Azure Fundamentals (AZ-900) exam with the 5 questions below. About 27.5% of the exam comes from this domain. Every option is explained, so a wrong pick still teaches something.
Azure Fundamentals (AZ-900) · Describe cloud concepts · 5 questions with answers and explanations
🧠What these questions look for
Cloud concept questions describe a company situation in plain business terms (an outage below the SLA, seasonal demand, a mix of services, attacks a small team cannot stop) and ask which model, benefit or category it shows. No configuration is involved. The challenge is choosing the most exact term among several that sound partly right.
Keep in mind
• An SLA defines what the customer can claim when a target is missed. Be careful with options that promise more than that.
• Sort services into IaaS, PaaS and SaaS by how much the customer still manages. A single solution can use all three.
• Cloud benefits such as security and governance have specific meanings, for example standard templates and continuous auditing for drift.
Question 1 of 5
An Azure service a company relies on had an outage, and its measured uptime for the month fell below the percentage in the service's SLA. What does the SLA give the company in this situation?
Show answer
✅ Answer: C
Difficulty: applied
What an SLA is
A service-level agreement (SLA) is a contractual commitment between a service provider and a customer about a service's level of service, most often its uptime or availability, with defined consequences when the target is not met. Azure states the availability commitment of each service in its SLA.
What happens when the target is missed
Microsoft's guidance on how to read an SLA (written for any provider, not only Azure) describes the usual pattern:
• The usual compensation is service credits, typically a percentage of the monthly fee for the affected service.
• Credits are generally not applied automatically: the customer detects the breach, documents it and files a claim within the deadline in the SLA.
• Credits do not cover lost revenue, lost customers or reputational damage.
What an SLA is not
An SLA does not promise zero downtime and is not the same as your own reliability target. Uptime is usually measured over a billing period, so a short outage can still fall within the SLA.
Example
A web app's database service misses its monthly uptime commitment. The company gathers timestamps and error logs, files a claim, and receives a credit on a later bill.
Why each option works or fails
• ✗ A. No consequence: an SLA is a contract with defined consequences; an internal reliability goal is what Microsoft calls a service-level objective (SLO).
• ✗ B. Full refund plus lost revenue: credits are a percentage of the service fee, they do not cover lost revenue, and they usually must be claimed.
• ✓ C. Service credits on claim (correct): when a service misses its SLA, the customer can receive service credits, typically a percentage of the monthly fee, by filing a claim with evidence within the deadline.
• ✗ D. Zero-downtime guarantee: an SLA is a commitment to a stated uptime level over a period, not a promise that downtime never happens.
🎯 Key idea: Missing an SLA target entitles the customer to claim service credits, not to a full refund or compensation for business losses.
Question 2 of 5
A retailer runs a private cloud in its own datacenter, and company policy says customer payment records must stay there. Each holiday season its web storefront needs far more servers than the datacenter has for a few weeks. Which cloud model fits best?
Show answer
✅ Answer: C
Difficulty: applied
The cloud models
• Private cloud: cloud resources used by a single organization, hosted on-site or in a dedicated offsite datacenter. Greatest control, but the organization buys and maintains the hardware.
• Public cloud: built and run by a third-party provider such as Microsoft; anyone can buy services. No capital expenditure to scale up and you pay only for what you use.
• Hybrid cloud: public and private clouds used together in an interconnected environment. You decide where each application runs.
• Multicloud: using two or more public cloud providers, for example to use features from each or during a migration.
Classic hybrid use cases
• Cloud bursting: let a private cloud surge into the public cloud for temporary, increased demand.
• Data placement: keep sensitive or regulated data in the private cloud while other services run in the public cloud.
Example
The storefront's extra web servers run in Azure from late November to early January and are removed afterwards; the payment database never leaves the company's datacenter.
Why each option works or fails
• ✗ A. Private cloud only: buying servers for a few peak weeks means paying up front for hardware that sits idle most of the year, which the public cloud part of a hybrid avoids.
• ✗ B. Public cloud only: moving the payment records to Azure breaks the policy that they must stay in the company's own datacenter.
• ✓ C. Hybrid cloud (correct): it lets the private cloud surge into public cloud capacity for the temporary holiday demand while the payment records stay in the private cloud, as the policy requires.
• ✗ D. Multicloud: using two public providers does not address where the payment records live, and the need here is temporary extra capacity next to an existing private cloud.
🎯 Key idea: Private cloud plus temporary public capacity (cloud bursting) or data kept on-premises by policy = hybrid cloud.
Question 3 of 5
A company's solution uses Azure Functions to run code when orders arrive, Azure virtual networks to connect its virtual machines, and Dynamics 365 for its customer service staff. Which classification matches Microsoft's shared responsibility guidance?
Show answer
✅ Answer: C
Difficulty: applied
Classifying services by what you manage
Microsoft's shared responsibility guidance gives examples for each service type:
• IaaS: you manage virtual machines, operating systems and applications. Examples: Azure Virtual Machines, Azure Disk Storage and virtual networks.
• PaaS: you deploy applications without managing VMs or operating systems. Examples: Azure App Service, Azure Functions, Azure SQL Database and Azure Storage.
• SaaS: you use ready-made applications. Examples: Microsoft 365 and Dynamics 365.
Many Azure solutions use a combination of service models, as this company does.
Why each one lands where it does
• Azure Functions runs your code on demand; you never manage the servers or operating system beneath it (it is often called serverless), so it is listed as PaaS.
• Virtual networks are infrastructure that the customer designs and configures for its own VMs: address ranges, subnets and network rules.
• Dynamics 365 is a finished business application that staff sign in to and use.
Why each option works or fails
• ✗ A. Functions as SaaS: Functions runs the company's own code, which a ready-made SaaS application does not, and Dynamics 365 is a finished application, not a development platform.
• ✗ B. Functions as IaaS: the customer manages no VM or operating system for Functions, so it is not IaaS, and virtual networks are infrastructure rather than a platform.
• ✓ C. Functions PaaS, virtual networks IaaS, Dynamics 365 SaaS (correct): Microsoft's guidance lists Azure Functions as a PaaS example, virtual networks with Azure Virtual Machines as IaaS examples, and Dynamics 365 as a SaaS example.
• ✗ D. Dynamics 365 as IaaS: a finished business application is SaaS, and virtual networks are infrastructure the customer configures, not ready-made software.
🎯 Key idea: Virtual networks are IaaS, Azure Functions is PaaS and Dynamics 365 is SaaS; one solution often mixes all three.
Question 4 of 5
A small online shop hosts its website on two servers in a rented rack. Floods of traffic from thousands of compromised machines keep knocking the site offline, and its two-person IT team cannot build defenses at that scale. Which cloud benefit addresses this most directly?
Show answer
✅ Answer: C
Difficulty: applied
Distributed denial of service (DDoS)
A DDoS attack tries to exhaust an application's resources, making it unavailable to legitimate users. It can target any endpoint that is publicly reachable through the internet, and the traffic usually comes from many machines at once, so a small team with a few servers cannot absorb it.
The security benefit of the cloud
Microsoft lists DDoS among the security benefits of the cloud: cloud providers are typically well suited to handle things like DDoS attacks, making your network more robust and secure. A provider operates at a scale and with expertise that a small company cannot match.
The Azure service
Azure DDoS Protection, combined with application design best practices, provides enhanced DDoS mitigation for resources in a virtual network. It protects at network layers 3 and 4; web applications add layer 7 protection with a web application firewall (WAF).
Example
The shop moves its site to Azure, enables DDoS protection on the virtual network and adds a WAF in front of the web tier; attack traffic is absorbed before it reaches the site.
Why each option works or fails
• ✗ A. Cost predictability: tracking usage forecasts the bill; it does nothing to stop attack traffic from taking the site offline.
• ✗ B. High availability and SLAs: an SLA states the uptime Microsoft commits to for a service; it is not a defense, and nothing guarantees that a site can never be taken offline.
• ✓ C. Security (correct): Microsoft says cloud providers are typically well suited to handle distributed denial of service attacks, making the customer's network more robust and secure, which is exactly the problem the small team cannot solve alone.
• ✗ D. Management in the cloud: the portal, CLI, APIs and PowerShell are ways to manage resources, not defenses against attack traffic.
🎯 Key idea: Handling DDoS attacks at a scale a small company cannot match is part of the security benefit of the cloud.
Question 5 of 5
A bank must prove that every resource it deploys in Azure meets its technical standards and regulatory rules, and it wants to find any resource that drifts out of compliance. Which cloud capabilities describe the security and governance benefit it relies on?
Show answer
✅ Answer: B
Difficulty: applied
Security and governance benefits of the cloud
Cloud features support governance and compliance whatever the service type:
• Templates make sure deployed resources meet your technical standards and regulatory requirements. When standards change, you can update resources at scale.
• Cloud-based auditing flags resources that are out of compliance with your baseline and suggests how to fix them.
• Depending on the service type, patches and updates may be applied automatically, which helps both governance and security.
Choosing the security level
• Want maximum control of security? IaaS lets you manage the operating system and installed software, including patches.
• Want patches handled for you? PaaS or SaaS.
Cloud providers are also well placed to handle attacks such as distributed denial of service (DDoS).
Example
A bank deploys every storage account from an approved template and reviews a daily compliance report that lists any account whose settings were changed by hand.
Why each option works or fails
• ✗ A. Multicloud and cloud bursting: copying resources to another provider or adding capacity on demand does not prove or check compliance; it adds more resources to govern.
• ✓ B. Templates and cloud-based auditing (correct): templates deploy resources to the required standard, and auditing flags any resource that drifts from that baseline, which is the governance benefit Microsoft describes.
• ✗ C. Vertical and horizontal scaling: scaling adjusts capacity to demand. It says nothing about whether resources meet the bank's standards.
• ✗ D. Spot pricing and reservations: these are pricing options that change what the bank pays, not whether a resource is compliant.
🎯 Key idea: Governance benefit = deploy from templates to a standard, audit continuously for drift, and let PaaS/SaaS apply patches automatically.
📊 This set at a glance
Exam: AZ-900 · 45 questions · 45 minutes · passing score 700
This set: 5 applied · 3 scenario, 1 comparison, 1 concept check
🔗 More from this exam
• All AZ-900 practice sets
• Every exam on this blog
📚 More AZ-900 practice
More AZ-900 questions: https://hyunhp.github.io/cert-bank/#exam=AZ-900
Study guide: https://hyunhp.github.io/cert-bank/study.html#exam=AZ-900
These are original practice questions, not real exam questions, and cert-bank is not affiliated with any certification vendor.
Original practice questions written for this blog, not exam dumps.
Comments
Post a Comment