Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Single-Tenant Compute with Azure Dedicated Host
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
A financial services organization is planning to migrate its core transactional databases and mission-critical applications to the cloud. Due to strict regulatory and compliance mandates, the organization requires physical compute isolation, ensuring that its virtual machines run on server hardware dedicated exclusively to a single customer rather than sharing physical servers in a multitenant environment.
Which Azure capability should the organization implement to fulfill this requirement?
Explanations
Azure Dedicated Host
Azure Dedicated Host
What Azure Dedicated Host Is
Azure Dedicated Host is an Azure compute service that provides physical servers dedicated to a single customer's organization. Instead of running virtual machines on shared physical infrastructure managed through multi-tenant virtualization, Dedicated Host gives you dedicated hardware capable of hosting one or more Azure virtual machines.
How It Meets the Compliance and Isolation Requirements
- Physical Compute Isolation: It provisions an entire physical server exclusively for your organization, preventing workloads from sharing underlying hardware with other cloud tenants.
- Regulatory Alignment: Many strict industry regulations and compliance frameworks require organizations to maintain single-tenant hardware boundaries, which Dedicated Host satisfies directly.
- Control and Visibility: It gives visibility into and control over the underlying physical host infrastructure, maintenance event schedules, and core allocations.
Key Advantages and Capabilities
- Hardware Isolation: Ensures zero resource contention or risk from neighboring multi-tenant workloads on the physical processor and memory.
- Maintenance Control: Allows administrators to pause or control maintenance windows for host-level updates within defined timeframes.
- Hybrid Benefit Licensing: Maximizes cost savings by applying existing Windows Server and SQL Server software licenses with Software Assurance to the entire physical host.
- Scalable Placement: Enables grouping multiple virtual machines across dedicated hosts while mapping them to specific fault and update domains.
Why This Is Optimal
While Azure offers comprehensive logical separation across standard multitenant services, certain compliance mandates strictly forbid running workloads on shared physical hardware. Azure Dedicated Host provides the precise physical boundary and dedicated resource model characteristic of a private cloud, while retaining the agility and scalability of public cloud infrastructure.
Azure Private Link
Azure Private Link
What Azure Private Link Is
Azure Private Link is a networking capability that allows users to access Azure PaaS services (such as Azure SQL Database and Azure Storage) as well as hosted customer or partner services over a private endpoint within a virtual network.
Why It Doesn't Meet the Requirement
Azure Private Link addresses network layer isolation, not physical compute hardware isolation. While Private Link ensures that data traffic travels across the Microsoft private backbone network rather than traversing the public internet, it runs within standard multi-tenant PaaS and network virtualization environments and does not provide dedicated physical compute servers for virtual machines.
Key Characteristics and Limitations
- Private IP Connectivity: Maps a private IP address within your virtual network directly to a specific Azure PaaS instance.
- Data Leakage Mitigation: Restricts outbound connections exclusively to the mapped resource rather than opening access to an entire public service endpoint.
- Network Boundary Only: Does not alter how compute hardware, processors, or hypervisors are allocated across multiple tenants.
This Answer Would Be Correct If
The organization required private, secured network connectivity from their internal subnets to PaaS services without exposing application endpoints to the public internet.
Logical Compute Isolation
Logical Compute Isolation
What Logical Compute Isolation Is
Logical Compute Isolation is a multitenant security model where multiple customers share the same physical server hardware, while software mechanisms such as hypervisors, drawbridge isolation, and user-context boundaries logically segregate each customer's data and workloads.
Why It Doesn't Meet the Requirement
Logical isolation intentionally relies on shared, multi-tenant hardware infrastructure to maximize scale and cost efficiency. Because the organization in the scenario is subject to regulatory mandates that explicitly demand single-tenant physical hardware separation, logical isolation on standard multitenant servers fails to fulfill the compliance constraint.
Key Characteristics and Limitations
- Multi-Tenant Foundation: Multiple customer virtual machines execute concurrently on the same underlying physical motherboard, processor, and memory.
- Hypervisor Boundaries: Relies on software-defined isolation enforcement rather than hardware boundary separation.
- Economic Efficiency: Delivers the primary economic scale of public cloud computing, but does not provide hardware exclusivity.
This Answer Would Be Correct If
The organization wanted to leverage standard public cloud pricing and multi-tenant scale while trusting software hypervisors and encryption to separate their workloads logically from other tenants.
Azure Key Vault
Azure Key Vault
What Azure Key Vault Is
Azure Key Vault is a centralized cloud service used to securely store and manage cryptographic keys, secrets, certificates, and passwords. It safeguards sensitive data using hardware security modules (HSMs) validated to government cryptographic standards like FIPS 140.
Why It Doesn't Meet the Requirement
Azure Key Vault addresses encryption and secret management, not virtual machine hosting or physical compute infrastructure. While using customer-managed keys (CMK) within Key Vault provides cryptographic isolation and ensures data at rest is protected, it cannot allocate dedicated physical server hardware to run virtual machines.
Key Characteristics and Limitations
- Cryptographic Security: Supports customer-managed key lifecycles and hardware-backed keys that never leave physical HSM boundaries.
- Secret and Certificate Management: Centralizes application secret storage and automates TLS/SSL certificate renewals.
- No Compute Hosting: Key Vault does not execute general application compute workloads or host virtual machines.
This Answer Would Be Correct If
The organization needed to manage cryptographic encryption keys in FIPS 140 validated hardware modules to control data-at-rest encryption across Azure storage and services.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Public Cloud
Define cloud models, including public, private, and hybrid
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Hybrid Cloud
Define cloud models, including public, private, and hybrid
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Hybrid Cloud CapEx vs OpEx
Define cloud models, including public, private, and hybrid
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Hybrid Cloud Model
Define cloud models, including public, private, and hybrid
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure ExpressRoute
Define cloud models, including public, private, and hybrid
IntermediateAZ-204 Developing Solutions for Microsoft Azure Exam
Azure Blob System Properties vs User-Defined Metadata
Set and retrieve properties and metadata
Last updated Validated