3.3 - Deployment tools and monitoring (ARM/Bicep, Azure Monitor, Advisor)
AZ-900 objective 3.3 covers the tools that deploy and watch Azure workloads. Bicep offers the same capabilities as verbose ARM JSON templates with a cleaner syntax that compiles down to ARM, and a template that creates a brand-new resource group and then places resources inside it must run at the subscription scope. Azure Monitor stores near real-time numeric performance values such as CPU percentage as Metrics, and a metric-based autoscale rule adds instances only while average CPU stays high. A diagnostic setting can send raw platform logs to an Azure Storage account for cheap, rarely accessed seven-year archival. Availability rises when you deploy VMs across multiple availability zones and add redundant instances, and a higher SLA percentage such as 99.99 over 99.9 guarantees less downtime. Azure Advisor groups recommendations into cost, security, reliability, operational excellence and performance, and Resource Health isolates a problem to a specific resource once Status and Service Health show no outage. Expect scenarios that ask which deployment or monitoring tool fits.
Cleaner concise syntax that compiles to ARM = Bicep. Near real-time numeric values like CPU = Metrics; scale only while CPU stays high = metric-based autoscale. Cheap seven-year log archive = a Storage account. Higher SLA percent = less downtime.
Practice questions
1. A company wants to manage its on-premises servers and Kubernetes clusters alongside Azure resources, applying Azure Policy and RBAC to all of them from a single control plane. Which service enables this?
- Azure Arc (correct answer)
- Azure Migrate with continuous assessment of the local servers
- Azure VPN Gateway connecting the datacenter to a hub network
- Azure Automation runbooks scheduled against the local machines
Azure Arc projects non-Azure resources (on-premises or other-cloud servers, Kubernetes clusters, databases) into Azure Resource Manager, so Policy, RBAC, and tags apply to them like native resources. Migrate assesses and moves workloads, VPN Gateway only connects networks, and Automation runs scripts without extending governance.
2. A team wants to deploy the same infrastructure repeatedly in a declarative way, describing WHAT to deploy rather than scripting each step. Which approach fits?
- An ARM template or a Bicep file (correct answer)
- A sequence of manual portal operations documented in a wiki
- An imperative bash script calling the CLI for every resource
- A screenshot-based runbook followed by each administrator
ARM templates and Bicep are declarative infrastructure as code: you describe the desired end state and Resource Manager figures out the steps, giving repeatable, idempotent deployments. Portal clicks and screenshot guides are manual and error-prone, and an imperative script encodes each step instead of the desired state.
3. Which TWO tools let an administrator manage Azure resources from a command line, including directly in the browser through Azure Cloud Shell? (Choose TWO.)
- Azure CLI (correct answer)
- Azure PowerShell (correct answer)
- Azure Advisor and its dashboards
- The Microsoft Purview governance portal
- Azure Service Health and its alerts
Azure CLI (az commands) and Azure PowerShell (Az cmdlets) both manage resources from a command line and are preinstalled in Cloud Shell, which runs in the browser. Advisor gives recommendations, Purview governs data, and Service Health reports incidents - none is a command-line management tool.
4. Whether a request comes from the portal, the CLI, or PowerShell, which Azure component receives it, authenticates it, and actually creates or changes the resources?
- Azure Resource Manager (ARM) (correct answer)
- Azure Monitor, which collects telemetry from every deployed resource
- Microsoft Entra ID, which stores the users and groups of the tenant
- Azure Advisor, which reviews resources and recommends improvements later
Every management request goes through Azure Resource Manager: it authenticates the call, applies RBAC and policies, then creates or changes the resources, whatever tool sent it. Azure Monitor collects telemetry, Entra ID manages identities, and Advisor gives recommendations - none of them is the control plane that carries out the operations.
5. A new administrator prefers a visual, web-based interface with dashboards and forms to create and manage Azure resources without typing commands. Which tool fits best?
- The Azure portal (correct answer)
- Azure CLI, a cross-platform command-line tool using az commands
- Azure PowerShell, a set of Az cmdlets scripted from a console window
- An ARM template written in JSON and deployed as code from a repository
The Azure portal is the browser-based graphical interface with dashboards, wizards, and forms for managing resources without any command line. Azure CLI and PowerShell are command-line tools, and an ARM template is code you author and deploy, not a visual interface.
6. An administrator wants to automate resource management with scripts run from a command line, on Windows, macOS, or Linux. Which TWO tools are command-line interfaces for Azure? (Choose TWO.)
- Azure CLI (correct answer)
- Azure PowerShell (correct answer)
- The Azure portal accessed through a web browser dashboard interface
- The Azure mobile app installed on a phone or a tablet for on-call use
- Azure Advisor and its personalized recommendation dashboards for resources
Azure CLI (az commands) and Azure PowerShell (Az cmdlets) are both cross-platform command-line tools for scripting resource management. The portal is a graphical interface, the mobile app is for phones, and Advisor only produces recommendations.