Azure AZ-900 Fundamentals practice questions and exam guide

Which responsibility moves from the customer to Microsoft when a workload is migrated from an Azure virtual machine to an equivalent platform as a service offering?

1. Patching and maintaining the operating system that hosts the workload
2. Defining who may access the workload and with which specific permissions
3. Deciding which region the workload should be deployed into
4. Classifying and protecting the data the workload processes

Answer: A — Patching and maintaining the operating system that hosts the workload

A) Correct — moving up to platform as a service hands operating system maintenance to Microsoft. B) Access control remains a customer responsibility in every service model. C) Region selection is always a customer decision. D) Data classification and protection never transfers to the provider.

A finance team compares running workloads in its own server room against running them in Azure. Which characteristic BEST defines cloud computing as distinct from that server room?

1. Computing services are delivered on demand over the internet and billed for what is used
2. Computing hardware is purchased outright and depreciated over a fixed asset schedule
3. Computing capacity is sized once at project start to cover the highest expected peak
4. Computing workloads always cost less than any equivalent deployment hosted in a local facility

Answer: A — Computing services are delivered on demand over the internet and billed for what is used

A) Correct — cloud computing is the on-demand delivery of compute, storage and networking over the internet, paid for as consumed. B) Tempting because it describes a real funding model, but outright purchase and depreciation is the capital-expenditure pattern of on-premises hardware. C) This is capacity planning for peak, the very practice cloud elasticity removes. D) A common misconception: cloud shifts cost structure and can be cheaper, but stable predictable workloads are sometimes cheaper on owned hardware.

An Availability Zone is:

1. The same as a region
2. A physically separate data center within a region
3. A virtual network
4. A backup tier

Answer: B — A physically separate data center within a region

A) A region contains one or more zones. B) Correct — AZs are physically distinct data centers (separate power, cooling, network) within a region. Supported regions have at least 3 AZs for high availability. C) Networking is separate. D) Not a backup concept.

What is a 'sovereign region' (e.g., Azure Government, Azure China)?

1. A standard public region open to commercial customers
2. A region shared between two competing cloud providers
3. A physically isolated cloud built for sovereignty rules
4. A region operated entirely without internet connectivity

Answer: C — A physically isolated cloud built for sovereignty rules

C) Sovereign clouds are physically and logically isolated deployments that satisfy a jurisdiction's regulatory and data residency rules. A) Commercial public regions are the general-purpose offering. B) Regions are not shared across providers. D) Connectivity exists, but access boundaries are far stricter.

An Azure VM Scale Set is BEST used for:

1. Running one large virtual machine with maximum vCPU count
2. Running identical VMs that scale out behind a load balancer
3. Storing unstructured files that many clients read and write
4. Running event-driven code without provisioning any servers

Answer: B — Running identical VMs that scale out behind a load balancer

B) A scale set deploys and manages a group of identical VMs as one resource, adding or removing instances automatically behind a load balancer. A) A single large machine is just a VM. C) Shared file storage is Azure Files or Blob storage. D) Event-driven code with no servers is Azure Functions.

A team runs a stateless image-thumbnailing routine that fires only when a file lands in storage, roughly 400 times a day, and takes two seconds per run. Which hosting choice BEST matches the workload's shape?

1. A pair of virtual machines behind a load balancer, sized for the peak hour
2. Azure Functions, invoked by an event trigger and billed on executions
3. A container group that stays resident so images are always warmed up
4. A virtual machine scale set that adds instances when CPU rises

Answer: B — Azure Functions, invoked by an event trigger and billed on executions

B) Correct — event-driven, short-lived, bursty code with no state between runs is the textbook serverless profile; you pay per execution and the platform handles all scaling. A) Two always-on VMs are the opposite tradeoff: you carry cost for idle capacity and patch the OS for two seconds of work per invocation. C) Containers are right when you need custom runtimes or long-lived processes, but a resident container group is still paying for idle time here. D) A scale set solves elastic scaling for VM fleets and reacts to CPU metrics, not to a file-created event, so it is the answer to a different question.

Which Azure storage tier is CHEAPEST but takes the longest to retrieve data from?

1. Hot
2. Cool
3. Archive
4. Premium

Answer: C — Archive

A) Hot = most expensive, instant access. B) Cool = lower cost, instant access; 30-day minimum. C) Correct — Archive: lowest cost, retrieval takes HOURS, 180-day minimum. Best for compliance/long-term backup. D) Premium = highest cost, lowest latency.

Azure Files provides:

1. Object storage addressed over an HTTP REST endpoint
2. A low-cost tier intended for long-term backup retention
3. SMB and NFS file shares that clients can mount as drives
4. Block-level disks attached directly to a virtual machine

Answer: C — SMB and NFS file shares that clients can mount as drives

C) Azure Files exposes managed shares over SMB and NFS, which servers and clients mount like a traditional network drive. A) Object storage over REST is Blob storage. B) Long-term retention is the cool and archive blob tiers. D) Block devices for VMs are managed disks.

RBAC (Role-Based Access Control) follows the principle of:

1. Grant all users Owner role
2. Least privilege — assign only the minimum permissions needed
3. Equal access for all users
4. No access control

Answer: B — Least privilege — assign only the minimum permissions needed

A) Violates security best practice. B) Correct — least privilege: users get the minimum permissions to do their job. RBAC roles: Owner, Contributor, Reader, custom. C) Not how RBAC works. D) Opposite of RBAC.

Microsoft Entra External ID is BEST used to:

1. Let partner and customer identities sign in to your apps as guests
2. Replicate on-premises Active Directory objects to domain controllers
3. Assign Azure RBAC roles to resources within a single subscription scope
4. Issue physical access badges to contractors visiting company offices

Answer: A — Let partner and customer identities sign in to your apps as guests

A) Correct — External ID covers identities outside your organisation, letting partners and customers use their own credentials to reach your resources. B) Microsoft Entra Connect and Cloud Sync handle directory synchronisation. C) That is Azure RBAC, an authorisation feature. D) Badges are physical security, not identity management.

Cost analysis in Azure's cost management capabilities lets a customer:

1. Track actual spend and forecast future cost across selected scopes
2. Store application secrets and certificates in a hardened key store
3. Filter inbound and outbound traffic with network security group rules
4. Create user accounts and reset the passwords that they sign in with

Answer: A — Track actual spend and forecast future cost across selected scopes

A) Correct — cost analysis breaks down charges by scope, service and tag, and projects the trend forward. B) That is Azure Key Vault. C) That is a networking control. D) That is identity administration.

A retailer has servers in its own datacenter and in another public cloud, and wants them all visible in the Azure portal so policy and monitoring can be applied consistently. Which service enables this?

1. Azure Migrate server assessment
2. Azure Arc-enabled servers
3. ExpressRoute private peering
4. Azure Resource Manager templates

Answer: B — Azure Arc-enabled servers

B) Correct — Arc projects non-Azure machines, Kubernetes clusters and data services into Azure Resource Manager so they can be governed and monitored like native resources. A) Migrate assesses and moves workloads into Azure; the requirement here is to manage them where they are. C) ExpressRoute provides connectivity, which may be present but does not make external servers manageable resources. D) Templates deploy Azure resources and cannot enroll an outside server on their own.

Availability Zone?

Physically separate data center within a region. Min 3 per supported region for fault tolerance.

Azure Functions?

Serverless compute. Pay per execution. Triggered by HTTP, queue, timer, etc.

Multi-Factor Authentication (MFA)?

Requires 2+ verification methods: something you know (password) + have (phone) + are (biometric).

Azure Load Balancer?

Layer 4 (TCP/UDP). Distributes traffic within a region. Public or internal.

What does Azure Policy do, and how does it differ from Azure RBAC?

Azure Policy evaluates resources against rules and enforces the result — auditing, denying non-compliant deployments, or modifying resources so they conform. RBAC controls who may perform an action; Policy controls what the resulting resource is allowed to look like. They are complementary, not alternatives.

Name the four core Azure Storage data services and the shape of data each holds.

Blob Storage — unstructured objects such as images, backups and logs. Azure Files — fully managed SMB and NFS file shares that can be mounted like a network drive. Queue Storage — messages for decoupling application components. Table Storage — schemaless structured NoSQL rows.