Microsoft Azure Fundamentals (AZ-900) Exam — Questions and Answers

Question 1: Adding more virtual machine instances to handle increased load is an example of what?

Horizontal scaling (Correct answer)
Scaling down
Vertical scaling
Caching

Correct answer: Horizontal scaling

Horizontal scaling (scaling out) adds more instances to share the load.

Question 2: Which Azure service provides a fully managed relational database that automatically handles patching, backups, and high availability?

Azure Virtual Machines
Azure Cosmos DB
Azure SQL Database (Correct answer)
Azure Blob Storage

Correct answer: Azure SQL Database

Azure SQL Database is a fully managed PaaS relational database service that automates maintenance tasks like patching, backups, and high availability, removing the burden of database administration from users.

Question 3: Which principle assumes that a breach has already occurred and limits its impact through segmentation?

Single firewall reliance
Assume breach (Correct answer)
Trust internal traffic
No monitoring needed

Correct answer: Assume breach

'Assume breach' is a Zero Trust principle that minimizes blast radius through segmentation and verification.

Question 4: Which of the following is the primary purpose of Azure Role-Based Access Control (RBAC)?

To enforce organizational standards and assess compliance for resources.
To manage who has access to Azure resources, what they can do with them, and what areas they can access. (Correct answer)
To filter network traffic to and from Azure resources in a virtual network.
To encrypt secrets, keys, and certificates used by applications.

Correct answer: To manage who has access to Azure resources, what they can do with them, and what areas they can access.

Azure RBAC is an authorization system used to manage access to Azure resources. It allows you to grant specific permissions to users, groups, and services at a defined scope, ensuring they have only the access needed to perform their jobs.

Question 5: What type of authentication uses a fingerprint or facial recognition instead of a password?

Certificate authentication
Biometric authentication (Correct answer)
Token-based authentication
Shared key authentication

Correct answer: Biometric authentication

Biometric authentication, such as Windows Hello, verifies identity using physical characteristics like fingerprints or face.

Question 6: Which characteristic of cloud computing ensures applications remain available even if a single datacenter fails?

Manageability
Mobility
Agility
High availability (Correct answer)

Correct answer: High availability

High availability keeps applications running despite individual component or datacenter failures.

Question 7: Which component of Azure Service Health shows the current status of all Azure services globally?

Azure Resource Health
Azure Advisor
Azure Monitor
Azure Status Page (status.azure.com) (Correct answer)

Correct answer: Azure Status Page (status.azure.com)

The Azure Status page at status.azure.com provides a global view of the health of all Azure services and regions in real time.

Question 8: Which Azure networking feature filters inbound and outbound traffic to resources using rules based on IP, port, and protocol?

Azure Key Vault
Azure Policy
Network Security Group (NSG) (Correct answer)
Managed identity

Correct answer: Network Security Group (NSG)

NSGs contain security rules that allow or deny network traffic based on source, destination, port, and protocol.

Question 9: What uptime percentage does an SLA of 99.9% allow per month in downtime?

About 1.5 hours
About 8.7 hours
About 4.4 hours
About 43 minutes (Correct answer)

Correct answer: About 43 minutes

A 99.9% SLA means 0.1% downtime per month, which equals approximately 43.8 minutes of allowable downtime per 30-day month.

Question 10: Which statement about the public cloud is correct?

Hardware is owned by your organization
Resources are shared among multiple customers (multi-tenant) (Correct answer)
It cannot scale automatically
It requires you to build a datacenter

Correct answer: Resources are shared among multiple customers (multi-tenant)

The public cloud is multi-tenant, with resources shared across many customers.

Question 11: Which factor is a benefit of the cloud's global reach for end users?

Higher upfront costs
Mandatory long-term contracts
Reduced latency by deploying closer to users (Correct answer)
Slower deployments

Correct answer: Reduced latency by deploying closer to users

Deploying in regions near users reduces latency and improves performance.

Question 12: Which security concept involves implementing a series of mechanisms that are layered to protect data and resources, so that if one layer is breached, subsequent layers are already in place to prevent further exposure?

Least Privilege Principle
Defense in Depth (Correct answer)
Shared Responsibility Model
Role-Based Access Control (RBAC)

Correct answer: Defense in Depth

Defense in Depth is a security strategy that uses multiple layers of security controls to protect resources. The idea is that if one security control fails, another layer of defense will be in place to stop an attack.

Question 13: What does Azure Advisor provide?

Personalized best-practice recommendations to optimize Azure resources (Correct answer)
A billing forecast tool
A ticketing system for Azure support cases
A real-time threat intelligence feed

Correct answer: Personalized best-practice recommendations to optimize Azure resources

Azure Advisor analyzes your configurations and usage telemetry and offers personalized recommendations across reliability, security, performance, cost, and operational excellence.

Question 14: What is Azure Service Health?

A compliance report for Azure certifications
A tool to measure application response time
A dashboard showing the health of your virtual machines
A service that provides personalized alerts and guidance when Azure service issues affect your resources (Correct answer)

Correct answer: A service that provides personalized alerts and guidance when Azure service issues affect your resources

Azure Service Health notifies you about Azure service incidents, planned maintenance, and health advisories that may impact your specific resources.

Question 15: What are Azure Blueprints used for?

Generating cost reports for management
Packaging governance artifacts (policies, RBAC, ARM templates) to deploy compliant environments at scale (Correct answer)
Monitoring VM health and performance
Creating network diagrams of Azure infrastructure

Correct answer: Packaging governance artifacts (policies, RBAC, ARM templates) to deploy compliant environments at scale

Azure Blueprints enable cloud architects to define a repeatable set of Azure resources, policies, and role assignments that implement organizational standards.

Question 16: Which of the following is a primary factor that directly influences the cost of an Azure Virtual Machine?

The Azure AD tenant the VM is associated with
The number of resource locks applied
The number of resource tags applied
The virtual machine size (CPU, RAM) (Correct answer)

Correct answer: The virtual machine size (CPU, RAM)

The size of the virtual machine, which includes the number of CPUs and the amount of RAM, is a primary driver of its cost. Other key factors include the region, operating system, and storage disks. Resource tags and locks are free governance features, and the Azure AD tenant does not directly impact the VM's price.

Question 17: You have a virtual machine on Azure that is only used from 9:00 to 17:00 every day. <br> What should you do to keep expenses down while protecting the data and accompanying hard disks?

Resize the virtual machine.
Delete the virtual machine.
Implement Privileged Identity Management.
Deallocate the virtual machine. (Correct answer)

Correct answer: Deallocate the virtual machine.

Deallocating a virtual machine stops it and releases the compute resources (CPU, memory) that it was using, meaning you are no longer billed for those compute costs. However, the associated disks and data remain intact, ensuring your data is protected. This is an effective way to save money when a VM is not in use.

Question 18: Virtual networks fall under what category of cloud service?

infrastructure as a service (IaaS) (Correct answer)
software as a service (SaaS)
platform as a service (PaaS)
none of the above

Correct answer: infrastructure as a service (IaaS)

Virtual networks are a fundamental component of Infrastructure as a Service (IaaS). They provide the networking infrastructure that allows virtual machines and other resources to communicate with each other securely within the cloud and connect to on-premises networks. As part of IaaS, the cloud provider manages the underlying physical network hardware, while customers configure and manage the virtual network components.

Question 19: A large financial institution needs to keep its sensitive customer data in a private, on-premises datacenter to meet strict regulatory requirements. However, they also want to leverage the scalability and services of the public cloud for their new, less sensitive marketing applications. Which cloud deployment model would best suit their needs?

Private Cloud only
Public Cloud only
Community Cloud
Hybrid Cloud (Correct answer)

Correct answer: Hybrid Cloud

A hybrid cloud combines a private cloud (or on-premises infrastructure) with a public cloud, allowing data and applications to be shared between them. [9] This model offers organizations greater flexibility and more deployment options, enabling them to keep sensitive data on a private network while using the public cloud for other workloads. [26, 31]

Question 20: Which characteristic describes the cloud's ability to recover from disruptive events?

Tagging
Multitenancy
Throttling
Disaster recovery (Correct answer)

Correct answer: Disaster recovery

Disaster recovery is the ability to restore service after a disruptive event.

Question 21: In a SaaS model, who is responsible for managing the application software?

An external auditor
The customer
The cloud provider (Correct answer)
The end user's IT team

Correct answer: The cloud provider

In SaaS, the cloud provider manages the application and underlying stack.

Question 22: Indicate the true or false nature of the following statement. "An example of a capex project is a corporation building its own data center."

No, the statement is not correct
Yes, the statement is correct (Correct answer)

Correct answer: Yes, the statement is correct

The statement is correct. Building a data center involves substantial upfront investments in physical assets such as land, buildings, servers, networking equipment, and cooling systems. These large, one-time expenses for acquiring and improving fixed assets are characteristic of a capital expenditure (CapEx) project, as they are expected to provide benefits over many years.

Question 23: What allows an Azure resource like a VM to authenticate to other services without storing credentials in code?

Access keys
SAS tokens
Managed identities (Correct answer)
Connection strings

Correct answer: Managed identities

Managed identities let Azure resources authenticate to services automatically without managing credentials.

Question 24: Which factor does NOT affect the cost of an Azure virtual machine?

The color of the Azure portal theme (Correct answer)
Region where it is deployed
VM size (SKU)
Operating system licensing

Correct answer: The color of the Azure portal theme

Portal theme is purely cosmetic and has no effect on VM pricing.

Question 25: In the shared responsibility model for cloud computing, which of the following is ALWAYS the customer's responsibility, regardless of the service model (IaaS, PaaS, or SaaS)?

Patching the host operating system
Information and data (Correct answer)
Physical datacenter security
Network controls

Correct answer: Information and data

Across all cloud service models (IaaS, PaaS, SaaS), the customer is always responsible for securing their own information and data, as well as managing user accounts and identities. [8, 10, 27] The cloud provider is responsible for the physical security of the datacenter, and responsibility for OS patching and network controls varies depending on the service model. [3, 10]

Question 26: What characteristic best describes Azure Spot Instances?

Fixed monthly pricing with guaranteed availability
Standard pay-as-you-go pricing with priority scheduling
Reserved pricing requiring a 1-year commitment
Deeply discounted pricing using unused Azure capacity that can be evicted when demand rises (Correct answer)

Correct answer: Deeply discounted pricing using unused Azure capacity that can be evicted when demand rises

Spot Instances use unused Azure compute capacity at significant discounts but can be interrupted when Azure needs the capacity back.

Question 27: Which storage redundancy option synchronously replicates data across three availability zones in the primary region?

ZRS (Correct answer)
GZRS
GRS
LRS

Correct answer: ZRS

Zone-redundant storage (ZRS) copies data across three availability zones within the primary region.

Question 28: Choose the response that fully completes the statement. <br> The Azure deployment and management service is _____________ .

Azure Monitor
Azure API Management
Azure AD
Azure Resource Manager (ARM) (Correct answer)

Correct answer: Azure Resource Manager (ARM)

Azure Resource Manager (ARM) is the deployment and management service for Azure. It provides a management layer that enables you to create, update, and delete resources in your Azure subscription. ARM allows you to organize resources into logical groups, apply access control, and deploy resources declaratively using templates, streamlining infrastructure management.

Question 29: Which Azure service uses declarative JSON or Bicep templates to deploy and configure Azure resources consistently?

Azure Policy
Azure Advisor
Azure Blueprints
Azure ARM Templates (Correct answer)

Correct answer: Azure ARM Templates

Azure Resource Manager (ARM) templates are JSON files that define the infrastructure and configuration for your Azure solution using infrastructure-as-code.

Question 30: Which Azure scope is used to organize multiple subscriptions together?

Management group (Correct answer)
Region pair
Resource group
Tag

Correct answer: Management group

Management groups let you organize and govern multiple subscriptions together.

Question 31: What is the AZ-900 exam primarily designed to test?

Foundational knowledge of cloud concepts and Azure services without requiring technical experience (Correct answer)
Expertise in implementing Azure security and compliance solutions
Proficiency in developing cloud-native applications on Azure
Advanced skills in designing Azure solutions and architectures

Correct answer: Foundational knowledge of cloud concepts and Azure services without requiring technical experience

AZ-900 (Microsoft Azure Fundamentals) is an entry-level exam that validates foundational knowledge of cloud concepts and Azure services. It is intended for non-technical business roles and those beginning their Azure journey.

Question 32: Which two tasks can be completed through the Azure portal's graphical user interface (GUI)? <br> Each accurate response offers an entire resolution.

Create new resources. (Correct answer)
Review a graphical view of all the services you are using. (Correct answer)
Change the availability zone of a virtual machine.
Repeatedly set up one or more resources and ensure that all the dependencies are created in the proper order.

Correct answer: Create new resources.

The Azure portal is a web-based graphical user interface (GUI) that provides a centralized console for managing Azure resources. Through the portal, users can easily create, configure, and manage new resources, as well as review a graphical view of all their existing services and their current status.

Question 33: What is the Azure Total Cost of Ownership (TCO) Calculator designed for?

Forecasting future Azure usage growth
Estimating Azure service costs for new deployments
Comparing the cost of running workloads on-premises versus in Azure (Correct answer)
Calculating Azure Reserved Instance savings

Correct answer: Comparing the cost of running workloads on-premises versus in Azure

The TCO Calculator helps organizations estimate the savings they can achieve by migrating on-premises workloads to Azure by modeling on-premises infrastructure costs.

Question 34: Which Azure service provides protection against distributed denial-of-service attacks?

Azure DDoS Protection (Correct answer)
Azure Key Vault
Managed identities
Azure Policy

Correct answer: Azure DDoS Protection

Azure DDoS Protection defends resources against distributed denial-of-service attacks targeting availability.

Question 35: Which cloud computing model provides the highest level of control and responsibility for the consumer?

Infrastructure as a Service (IaaS) (Correct answer)
Function as a Service (FaaS)
Platform as a Service (PaaS)
Software as a Service (SaaS)

Correct answer: Infrastructure as a Service (IaaS)

Infrastructure as a Service (IaaS) provides the most control because the consumer is responsible for managing the operating systems, data, and applications, while the cloud provider manages the physical infrastructure. [11, 27] In PaaS and SaaS models, more responsibility is shifted to the cloud provider. [29]

Question 36: A startup is developing a new web application and wants to focus solely on writing code and managing their application, without worrying about the underlying operating systems, patches, or server maintenance. Which cloud service model should they choose?

On-premises datacenter
Infrastructure as a Service (IaaS)
Platform as a Service (PaaS) (Correct answer)
Software as a Service (SaaS)

Correct answer: Platform as a Service (PaaS)

Platform as a Service (PaaS) provides a complete development and deployment environment in the cloud. [4] It allows developers to focus on building and managing their applications without the complexity of maintaining the underlying infrastructure, as the cloud provider manages the servers, storage, and networking, as well as the operating system and development tools. [29]

Question 37: Which concept describes one of the three pillars of Zero Trust regarding limiting user access?

Trust by default
Use least privilege access (Correct answer)
Disable authentication
Grant broad permissions

Correct answer: Use least privilege access

Least privilege access grants users only the permissions they need to perform their tasks.

Question 38: Which Azure cost management feature allows you to set spending limits and receive alerts when costs approach or exceed a defined threshold?

Azure Reservations
Azure Spending Caps
Azure Cost Policies
Azure Budgets (Correct answer)

Correct answer: Azure Budgets

Azure Budgets allow you to set cost or usage thresholds and configure alert notifications when spending reaches defined percentages of the budget.

Question 39: What do Availability Zones protect against?

Software bugs
Datacenter-level failures within a region (Correct answer)
User password loss
API rate limits

Correct answer: Datacenter-level failures within a region

Availability Zones are physically separate datacenters within a region that protect against datacenter failures.

Question 40: What is the SLA for a single Azure VM using Premium SSD storage?

99.5%
99.95% (Correct answer)
99.99%
99.9%

Correct answer: 99.95%

A single Azure VM using Premium SSD managed disks is backed by a 99.95% SLA for virtual machine connectivity.

Microsoft Azure Fundamentals (AZ-900) Exam

The AZ-900 exam validates foundational knowledge of cloud services and how those services are provided with Microsoft Azure.

Questions

60 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learn.microsoft.com — Eligibility, renewal, score validity, registration, retake fee, passing score, time limit, test delivery, exam information · verified Nov 2026