Microsoft Azure Fundamentals (AZ-900) Exam — Questions and Answers

Question 1: When you delete a resource group, what happens to the resources inside it?

Only the largest resource is deleted
Resources are moved to a default group
All resources in the group are deleted (Correct answer)
Nothing happens to the resources

Correct answer: All resources in the group are deleted

Deleting a resource group deletes all resources contained within it.

Question 2: Which expenditure type best describes paying monthly for Azure virtual machines based on usage?

CapEx
Fixed asset cost
OpEx (Correct answer)
Depreciation

Correct answer: OpEx

Pay-as-you-go cloud billing is an operating expense (OpEx).

Question 3: What does geo-redundant storage (GRS) provide?

Replication of data to a secondary region (Correct answer)
Faster local read speeds only
Lower storage costs than all options
Automatic code compilation

Correct answer: Replication of data to a secondary region

GRS replicates data to a secondary region for durability against regional outages.

Question 4: What does a ReadOnly resource lock allow?

Deleting but not modifying the resource
Full control over the resource
Reading the resource but not modifying or deleting it (Correct answer)
Modifying but not reading the resource

Correct answer: Reading the resource but not modifying or deleting it

A ReadOnly lock permits viewing a resource while blocking both changes and deletion.

Question 5: Which statement about the public cloud is correct?

It cannot scale automatically
Resources are shared among multiple customers (multi-tenant) (Correct answer)
It requires you to build a datacenter
Hardware is owned by your organization

Correct answer: Resources are shared among multiple customers (multi-tenant)

The public cloud is multi-tenant, with resources shared across many customers.

Question 6: Which governance feature packages policies, role assignments, and ARM templates into a repeatable, deployable definition?

Azure Blueprints (Correct answer)
Management groups
Resource locks
Azure Policy

Correct answer: Azure Blueprints

Azure Blueprints bundle policies, RBAC, and templates so environments can be deployed in a compliant, repeatable way.

Question 7: What is the purpose of Azure Availability Zones?

To provide dedicated physical servers for compliance requirements
To distribute traffic globally using DNS-based routing
To replicate data between Azure regions for disaster recovery
To protect applications and data from datacenter failures by providing physically separate locations within a region (Correct answer)

Correct answer: To protect applications and data from datacenter failures by providing physically separate locations within a region

Availability Zones are physically separate datacenter locations within a single Azure region, each with independent power, cooling, and networking. Deploying across zones protects against datacenter-level failures.

Question 8: Indicate the true or false nature of the following statement. "An example of a capex project is a corporation building its own data center."

Yes, the statement is correct (Correct answer)
No, the statement is not correct

Correct answer: Yes, the statement is correct

The statement is correct. Building a data center involves substantial upfront investments in physical assets such as land, buildings, servers, networking equipment, and cooling systems. These large, one-time expenses for acquiring and improving fixed assets are characteristic of a capital expenditure (CapEx) project, as they are expected to provide benefits over many years.

Question 9: Adding more CPU and RAM to an existing virtual machine is an example of what?

Load balancing
Horizontal scaling
Sharding
Vertical scaling (Correct answer)

Correct answer: Vertical scaling

Vertical scaling (scaling up) adds more power to an existing instance.

Question 10: Which statement about Azure resource tags is true?

Tags encrypt the resource
Tags are not inherited from resource groups by default (Correct answer)
Each resource can have only one tag
Tags are automatically inherited by all child resources

Correct answer: Tags are not inherited from resource groups by default

Tags applied to a resource group are not automatically inherited by resources within it.

Question 11: What are Azure Blueprints used for?

Creating network diagrams of Azure infrastructure
Packaging governance artifacts (policies, RBAC, ARM templates) to deploy compliant environments at scale (Correct answer)
Monitoring VM health and performance
Generating cost reports for management

Correct answer: Packaging governance artifacts (policies, RBAC, ARM templates) to deploy compliant environments at scale

Azure Blueprints enable cloud architects to define a repeatable set of Azure resources, policies, and role assignments that implement organizational standards.

Question 12: Which scenario best fits Azure Dedicated Host?

Distributing DNS traffic globally
Hosting static websites cheaply
Running VMs on physical servers dedicated to a single organization for compliance (Correct answer)
Running serverless functions at scale

Correct answer: Running VMs on physical servers dedicated to a single organization for compliance

Azure Dedicated Host provides physical servers dedicated to one organization, often used to meet compliance or licensing needs.

Question 13: Which characteristic of cloud computing ensures applications remain available even if a single datacenter fails?

Manageability
Agility
High availability (Correct answer)
Mobility

Correct answer: High availability

High availability keeps applications running despite individual component or datacenter failures.

Question 14: What managed service provides stateful firewall protection for Azure virtual networks?

Azure Advisor
Azure Bastion
Azure Monitor
Azure Firewall (Correct answer)

Correct answer: Azure Firewall

Azure Firewall is a managed, cloud-based, stateful firewall that protects virtual network resources.

Question 15: __________ refers to a system's ability to run continuously for long periods of time without any interruption.

Disaster Recovery
Fault Tolerance
High Availability (Correct answer)
Agility

Correct answer: High Availability

High Availability (HA) refers to a system's ability to remain operational and accessible for extended periods, minimizing downtime. It involves designing systems with redundancy and failover mechanisms to ensure that services continue to function even if individual components fail. This characteristic is crucial for applications that require continuous operation without interruption.

Question 16: Which characteristic describes the cloud's ability to recover from disruptive events?

Throttling
Tagging
Multitenancy
Disaster recovery (Correct answer)

Correct answer: Disaster recovery

Disaster recovery is the ability to restore service after a disruptive event.

Question 17: Which cloud computing model provides the highest level of control and responsibility for the consumer?

Platform as a Service (PaaS)
Infrastructure as a Service (IaaS) (Correct answer)
Software as a Service (SaaS)
Function as a Service (FaaS)

Correct answer: Infrastructure as a Service (IaaS)

Infrastructure as a Service (IaaS) provides the most control because the consumer is responsible for managing the operating systems, data, and applications, while the cloud provider manages the physical infrastructure. [11, 27] In PaaS and SaaS models, more responsibility is shifted to the cloud provider. [29]

Question 18: Which Azure AD (Microsoft Entra ID) feature requires users to provide two or more verification methods to sign in?

Multi-factor authentication (Correct answer)
Privileged Identity Management
Single sign-on
Conditional Access

Correct answer: Multi-factor authentication

Multi-factor authentication (MFA) requires two or more verification methods such as a password plus a phone approval.

Question 19: Which of the following benefits of cloud computing is its main advantage?

Increased data center footprint
Reduced costs (Correct answer)
Increased physical security
Increased hardware maintenance

Correct answer: Reduced costs

One of the main advantages of cloud computing is significant cost reduction. Businesses can avoid large upfront capital expenditures on hardware, infrastructure, and data centers, instead paying for resources on a consumption-based, pay-as-you-go model. This approach, combined with reduced maintenance and operational costs, makes cloud services a highly cost-effective solution.

Question 20: A business does not need its own data center if it hosts its infrastructure in ________.

Private Cloud
Public Cloud (Correct answer)
Hybrid Cloud
Hyper-V Cost

Correct answer: Public Cloud

The public cloud model involves cloud services delivered over the public internet and shared among multiple customers. By hosting infrastructure in the public cloud, businesses leverage the provider's data centers and resources, eliminating the need to own, operate, and maintain their own on-premises data center infrastructure, thus reducing capital expenditure and operational overhead.

Question 21: What is the primary purpose of Azure Resource Manager (ARM)?

To provide virtual machine hosting
To serve as the deployment and management layer for all Azure resources (Correct answer)
To monitor application performance
To store blobs and files

Correct answer: To serve as the deployment and management layer for all Azure resources

ARM is the management layer that enables you to create, update, and delete resources in your Azure account, providing consistent management through the Portal, CLI, PowerShell, and APIs.

Question 22: Which principle assumes that a breach has already occurred and limits its impact through segmentation?

Assume breach (Correct answer)
Single firewall reliance
No monitoring needed
Trust internal traffic

Correct answer: Assume breach

'Assume breach' is a Zero Trust principle that minimizes blast radius through segmentation and verification.

Question 23: Which Azure tool provides centralized monitoring and telemetry for resources?

Azure Blueprints
Azure Key Vault
Azure DNS
Azure Monitor (Correct answer)

Correct answer: Azure Monitor

Azure Monitor collects and analyzes telemetry data to track resource health and performance.

Question 24: What is the primary purpose of resource tags in Azure?

Organize resources and enable cost reporting by category (Correct answer)
Automatically scale resources
Restrict network access to resources
Encrypt resource data at rest

Correct answer: Organize resources and enable cost reporting by category

Tags are name-value pairs that organize resources and allow cost grouping in reports.

Question 25: Which of the following is an example of a Platform as a Service (PaaS) offering in Azure?

Azure App Service (Correct answer)
Azure Virtual Machines
Azure Dedicated Host
Microsoft 365

Correct answer: Azure App Service

Azure App Service is a PaaS offering — you deploy and run web applications without managing the underlying infrastructure (OS, runtime patching). Microsoft handles the platform.

Question 26: What is the primary function of Azure Key Vault?

To provide a second layer of authentication for user sign-ins.
To distribute network traffic across multiple servers to improve availability.
To provide a private, isolated section of the Azure cloud for networking.
To securely store and manage access to secrets, keys, and certificates. (Correct answer)

Correct answer: To securely store and manage access to secrets, keys, and certificates.

Azure Key Vault is a cloud service for securely storing and accessing secrets, such as API keys, passwords, certificates, or cryptographic keys. It centralizes the management of this sensitive information, enhancing security and control.

Question 27: Which security concept ensures that data cannot be read by unauthorized parties while stored?

Encryption at rest (Correct answer)
Encryption in transit
Network segmentation
Tokenization in flight

Correct answer: Encryption at rest

Encryption at rest protects stored data so it cannot be read without the proper decryption key.

Question 28: What happens to the composite SLA when you combine two services each with a 99.9% SLA?

It stays at 99.9%
It becomes 100% due to redundancy
It decreases to approximately 99.8% (Correct answer)
It increases to 99.99%

Correct answer: It decreases to approximately 99.8%

The composite SLA of dependent services is calculated by multiplying their individual SLAs: 0.999 × 0.999 = 0.998001, approximately 99.8%.

Question 29: What is Azure Application Insights primarily used for?

Managing application deployments with CI/CD pipelines
Application performance monitoring and detecting anomalies in live web applications (Correct answer)
Storing application log files in blob storage
Monitoring Azure infrastructure like VMs and networks

Correct answer: Application performance monitoring and detecting anomalies in live web applications

Application Insights is an APM (Application Performance Management) feature of Azure Monitor that detects performance anomalies, tracks requests, dependencies, and exceptions in live apps.

Question 30: Which Azure support plan is included free with all Azure subscriptions?

Basic (Correct answer)
Professional Direct
Standard
Developer

Correct answer: Basic

The Basic support plan is included at no charge with every Azure subscription and provides access to documentation, community forums, and billing support.

Question 31: What does Azure use to ensure that updates and maintenance are not applied to both regions in a pair simultaneously?

Sequential planned maintenance across the pair (Correct answer)
No coordination at all
Manual customer scheduling only
Random simultaneous updates

Correct answer: Sequential planned maintenance across the pair

Planned Azure updates are rolled out sequentially across paired regions to avoid downtime in both at once.

Question 32: What is the main financial benefit of the consumption-based cloud model?

You pay nothing until the project ends
You pay a fixed monthly fee regardless of use
You pay upfront for hardware you own
You only pay for the resources you actually consume (Correct answer)

Correct answer: You only pay for the resources you actually consume

Consumption-based pricing means you pay only for the resources you use.

Question 33: Which security concept involves implementing a series of mechanisms that are layered to protect data and resources, so that if one layer is breached, subsequent layers are already in place to prevent further exposure?

Role-Based Access Control (RBAC)
Least Privilege Principle
Shared Responsibility Model
Defense in Depth (Correct answer)

Correct answer: Defense in Depth

Defense in Depth is a security strategy that uses multiple layers of security controls to protect resources. The idea is that if one security control fails, another layer of defense will be in place to stop an attack.

Question 34: What does an SLA of 99.9% uptime roughly translate to in allowable downtime per month?

About 8 hours
Zero downtime
About 3 days
About 43 minutes (Correct answer)

Correct answer: About 43 minutes

A 99.9% monthly SLA permits roughly 43 minutes of downtime.

Question 35: Which pricing model lets you reserve VM capacity for one or three years to reduce cost?

Pay-as-you-go
Reserved Instances (Correct answer)
Spot pricing
Free tier

Correct answer: Reserved Instances

Reserved Instances offer discounts in exchange for a one- or three-year commitment.

Question 36: What allows an Azure resource like a VM to authenticate to other services without storing credentials in code?

Connection strings
Managed identities (Correct answer)
Access keys
SAS tokens

Correct answer: Managed identities

Managed identities let Azure resources authenticate to services automatically without managing credentials.

Question 37: In the shared responsibility model for IaaS, who is responsible for patching the guest operating system?

Microsoft only
A third-party vendor
No one is responsible
The customer (Correct answer)

Correct answer: The customer

For IaaS, the customer manages and patches the guest operating system.

Question 38: Which tool allows you to manage Azure resources using scripting commands in a Windows PowerShell environment?

Azure PowerShell (Correct answer)
Azure Portal
Azure Resource Manager
Azure CLI

Correct answer: Azure PowerShell

Azure PowerShell is a module that adds Azure-specific cmdlets to PowerShell, enabling automation of Azure resource management through scripts.

Question 39: Which feature in Microsoft Defender for Cloud gives a measurement of your current security posture?

Resource health
Secure Score (Correct answer)
Service map
Cost analysis

Correct answer: Secure Score

Secure Score measures your security posture and recommends actions to improve it.

Question 40: Which deployment model is owned and used exclusively by a single organization?

Public cloud
Multi-tenant cloud
Hybrid cloud
Private cloud (Correct answer)

Correct answer: Private cloud

A private cloud is dedicated to and used by a single organization.

Microsoft Azure Fundamentals (AZ-900) Exam

The AZ-900 exam validates foundational knowledge of cloud services and how those services are provided with Microsoft Azure.

Questions

60 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds