2.2 - Compute and management services (VMs, containers, App Service)
AZ-900 objective 2.2 covers Azure compute services and how resources are organized. The management hierarchy runs top down from management groups to subscriptions to resource groups to resources, and moving a resource between groups never changes the region it runs in. Azure Virtual Desktop streams a full corporate Windows desktop to personal devices over the internet. For containers you know Azure Container Instances and Azure Kubernetes Service run Docker containers, Azure Container Apps runs microservices that scale to zero without operating a cluster, and Azure Container Registry stores and versions private images. App Service deployment slots let you validate a release in staging then swap it into production with no downtime. Azure Site Recovery replicates to a paired region for near-zero data loss failover, Power Automate builds low-code approval flows, and both Azure Load Balancer at the transport layer and Application Gateway at the application layer distribute traffic. Expect scenarios that describe a workload and ask which compute or management service fits.
Purpose-built to run containers = Container Instances and Kubernetes Service; scale to zero with no cluster = Container Apps. Validate then swap with no downtime = App Service deployment slots. Full Windows desktop from any device = Azure Virtual Desktop.
Practice questions
1. A team wants to run Docker containers in Azure. Which TWO services are designed to run containers? (Choose TWO.)
- Azure Kubernetes Service (AKS) (correct answer)
- Azure Container Instances (ACI) (correct answer)
- Azure DNS with alias records
- Azure Key Vault with container secrets enabled
- Azure ExpressRoute with private peering
AKS runs containers at scale with Kubernetes orchestration, and Container Instances runs individual containers on demand without managing servers. Azure DNS resolves names, Key Vault stores secrets, and ExpressRoute is a private network connection - none of them execute containers.
2. A developer needs to run a small piece of code triggered by each new message in a queue, paying only while the code runs and with no servers to manage. Which service fits?
- Azure Virtual Machines running in an autoscaling scale set
- Azure Functions (correct answer)
- Azure Virtual Desktop session hosts sized for the workload
- A dedicated AKS cluster with a queue-polling deployment
Azure Functions is serverless: code runs in response to triggers such as queue messages, bills only for execution time, and needs no server management. VMs and AKS keep infrastructure running (and billed) between messages, and Azure Virtual Desktop delivers desktops, not event-driven code.
3. A bank must connect its on-premises network to Azure with a private connection that does not travel over the public internet. Which service should it use?
- A site-to-site VPN encrypted over the public internet
- Azure ExpressRoute (correct answer)
- Azure Front Door with private link origins enabled
- A point-to-site VPN installed on every user workstation
ExpressRoute is a dedicated private circuit between on-premises and Azure that never touches the public internet, offering consistent bandwidth and latency. Site-to-site and point-to-site VPNs are encrypted but still travel over the internet, and Front Door is a global entry point for web traffic, not a datacenter link.
4. A team must host a web application and REST API on a managed platform where Microsoft handles the OS, patching, and load balancing so the team only deploys code. Which Azure service fits BEST?
- Azure App Service (correct answer)
- Azure Virtual Machines running a self-managed web server that the team patches itself
- Azure Container Instances used for a single short-lived container run
- Azure Batch designed for large-scale parallel compute jobs
Azure App Service is the managed PaaS for web apps and APIs: Microsoft runs the OS, patching, and scaling while the team just deploys code. Virtual Machines leave OS patching to the team, Container Instances host a single container rather than a full web platform, and Batch runs parallel compute jobs, not web apps.
5. A company must move a legacy application quickly to Azure without rewriting it, keeping full control of the operating system and installed software. Which service is the BEST fit?
- Azure Functions, which requires refactoring the app into small event-driven functions
- An Azure Virtual Machine (correct answer)
- Azure Static Web Apps, intended only for front-end static content
- Azure Logic Apps built for no-code workflow automation between services
A Virtual Machine (IaaS) is the fastest lift-and-shift path: you keep the same OS and software and move the app as-is without rewriting. Functions and Static Web Apps require rearchitecting, and Logic Apps automates workflows rather than hosting a legacy application.
6. Which sequence orders the Azure management hierarchy from the TOP level down to individual resources?
- Management groups > subscriptions > resource groups > resources (correct answer)
- Subscriptions > management groups > resource groups > individual resources
- Resource groups > subscriptions > management groups > resources
- Management groups > resource groups > subscriptions > resources
The hierarchy from top to bottom is: management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources. Management groups never sit below subscriptions, and resource groups cannot contain subscriptions - each level only nests inside the one above it.