Microsoft Azure Fundamentals (AZ-900) Exam — Questions and Answers

Question 1: A company plans to move all of its resources and data to Azure. Only Platform as a Service (PaaS) solutions must be used in Azure, according to the migration plan specified. John has been asked to set up an Azure environment that complies with the migration plan's requirements. John proposes setting up Azure SQL databases and an Azure App Service. Does the proposed remedy satisfy the demand?

High latency
Load balancing
High availability
Elasticity (Correct answer)

Correct answer: Elasticity

Azure SQL databases and Azure App Service are both examples of Platform as a Service (PaaS) solutions. A key characteristic and benefit of PaaS offerings is elasticity, which means they can automatically scale resources up or down based on demand. This inherent ability to adapt to varying workloads without manual intervention directly satisfies the requirement for using PaaS solutions in the migration plan.

Question 2: Which Azure service provides cloud-based identity and access management, enabling single sign-on to Microsoft cloud applications and other third-party services?

Azure Security Center
Azure Active Directory (Correct answer)
Azure Policy
Azure Key Vault

Correct answer: Azure Active Directory

Azure Active Directory (Azure AD) is Microsoft's cloud-based identity and access management service that lets employees sign in and access resources, supporting single sign-on, multi-factor authentication, and conditional access.

Question 3: What does the Azure Service Level Agreement (SLA) describe?

The number of regions a service supports
The guaranteed uptime and connectivity commitments for a service (Correct answer)
The maximum number of users allowed
The total monthly cost of a service

Correct answer: The guaranteed uptime and connectivity commitments for a service

An SLA defines Microsoft's commitments for uptime and availability of a service.

Question 4: An organization wants a unified security management system that provides security posture recommendations and threat protection for their workloads running in Azure, on-premises, and in other clouds. Which Azure service provides these capabilities?

Azure Monitor
Azure Firewall
Microsoft Sentinel
Microsoft Defender for Cloud (Correct answer)

Correct answer: Microsoft Defender for Cloud

Microsoft Defender for Cloud is a solution for cloud security posture management (CSPM) and cloud workload protection (CWPP). It identifies weaknesses across cloud configurations, helps strengthen the security posture, and protects workloads in multi-cloud and hybrid environments from threats.

Question 5: Which Azure service provides protection against distributed denial-of-service attacks?

Managed identities
Azure DDoS Protection (Correct answer)
Azure Policy
Azure Key Vault

Correct answer: Azure DDoS Protection

Azure DDoS Protection defends resources against distributed denial-of-service attacks targeting availability.

Question 6: Which of the following is the primary purpose of Azure Role-Based Access Control (RBAC)?

To enforce organizational standards and assess compliance for resources.
To manage who has access to Azure resources, what they can do with them, and what areas they can access. (Correct answer)
To filter network traffic to and from Azure resources in a virtual network.
To encrypt secrets, keys, and certificates used by applications.

Correct answer: To manage who has access to Azure resources, what they can do with them, and what areas they can access.

Azure RBAC is an authorization system used to manage access to Azure resources. It allows you to grant specific permissions to users, groups, and services at a defined scope, ensuring they have only the access needed to perform their jobs.

Question 7: What is the benefit of using Azure Availability Zones for VM deployments from an SLA perspective?

It reduces the cost of the VM
It increases the SLA to 99.99% by distributing VMs across physically separate datacenters within a region (Correct answer)
It automatically backs up the VM to another region
It enables auto-scaling based on demand

Correct answer: It increases the SLA to 99.99% by distributing VMs across physically separate datacenters within a region

Deploying VMs across two or more Availability Zones within a region provides a 99.99% SLA because each zone has independent power, cooling, and networking.

Question 8: What does the Azure Free Account provide to new Azure users?

A permanently free tier giving unlimited access to all Azure services at no cost
A free account offering 12 months of popular services, always-free services, and a $200 credit for the first 30 days (Correct answer)
A complimentary enterprise agreement for small businesses with fewer than 50 employees
A free developer license for building and testing Azure applications in a sandbox environment

Correct answer: A free account offering 12 months of popular services, always-free services, and a $200 credit for the first 30 days

Azure Free Account provides new users with a $200 credit for the first 30 days, 12 months of popular services for free, and over 55 always-free services with usage limits.

Question 9: What is Azure Cloud Shell?

A virtual machine service for running shell scripts
A browser-accessible command-line experience for managing Azure resources (Correct answer)
An on-premises shell tool for Azure management
A mobile app for running Azure CLI commands

Correct answer: A browser-accessible command-line experience for managing Azure resources

Azure Cloud Shell is an authenticated, browser-based shell that provides access to both Azure CLI and Azure PowerShell from any browser.

Question 10: Which cloud model lets you rent virtual machines, storage, and networking while you manage the OS and applications?

SaaS
PaaS
IaaS (Correct answer)
FaaS

Correct answer: IaaS

Infrastructure as a Service provides compute, storage, and networking, leaving OS and app management to you.

Question 11: Which cloud computing model provides the highest level of control and responsibility for the consumer?

Platform as a Service (PaaS)
Infrastructure as a Service (IaaS) (Correct answer)
Software as a Service (SaaS)
Function as a Service (FaaS)

Correct answer: Infrastructure as a Service (IaaS)

Infrastructure as a Service (IaaS) provides the most control because the consumer is responsible for managing the operating systems, data, and applications, while the cloud provider manages the physical infrastructure. [11, 27] In PaaS and SaaS models, more responsibility is shifted to the cloud provider. [29]

Question 12: Which component of Azure Service Health shows the current status of all Azure services globally?

Azure Status Page (status.azure.com) (Correct answer)
Azure Resource Health
Azure Monitor
Azure Advisor

Correct answer: Azure Status Page (status.azure.com)

The Azure Status page at status.azure.com provides a global view of the health of all Azure services and regions in real time.

Question 13: In order to write to an Azure subscription, you must make sure that multi-factor authentication (MFA) is configured on the accounts that have write access. What actions should you take?

resource locks
Azure Policy (Correct answer)
resource tags
Cloud Adoption Framework

Correct answer: Azure Policy

Azure Policy allows you to enforce organizational standards and assess compliance at scale across your Azure environment. To ensure multi-factor authentication (MFA) is configured for accounts with write access, you would create a policy definition that audits or enforces this security requirement across your subscription.

Question 14: Which Azure tool lets you set spending thresholds that trigger alerts when costs approach a defined limit?

Azure Advisor
Azure Budgets (Correct answer)
Azure Monitor
Azure Policy

Correct answer: Azure Budgets

Azure Budgets in Cost Management lets you define spending thresholds that trigger alerts or automated actions.

Question 15: What does Azure Advisor provide?

A ticketing system for Azure support cases
Personalized best-practice recommendations to optimize Azure resources (Correct answer)
A billing forecast tool
A real-time threat intelligence feed

Correct answer: Personalized best-practice recommendations to optimize Azure resources

Azure Advisor analyzes your configurations and usage telemetry and offers personalized recommendations across reliability, security, performance, cost, and operational excellence.

Question 16: Which Azure service helps protect privileged accounts by providing just-in-time access?

Azure Firewall
Azure Bastion
Privileged Identity Management (PIM) (Correct answer)
Network Security Groups

Correct answer: Privileged Identity Management (PIM)

PIM provides just-in-time, time-limited activation of privileged roles to reduce standing access.

Question 17: Operational expenditure (OpEx) costs include things like building a data center infrastructure. Is the statement correct?

No (Correct answer)
Yes

Correct answer: No

No, building a data center infrastructure is considered a Capital Expenditure (CapEx), not an Operational Expenditure (OpEx). CapEx involves significant upfront investments in physical assets that provide long-term value, such as buildings, servers, and cooling systems. OpEx refers to ongoing, day-to-day costs of running a business, like utility bills, salaries, or cloud service subscriptions.

Question 18: What qualifies as a characteristic of the public cloud? (A) Dedicated hardware (B) Unsecured connections (C) Limited storage (D) Metered pricing (E) Self-service management

Only (C) and (D)
Only (B) and (C)
Only (D) and (E) (Correct answer)
Only (A) and (B)

Correct answer: Only (D) and (E)

Characteristics of the public cloud include metered pricing, where users pay only for the resources they consume, and self-service management, allowing users to provision and manage resources on demand without human intervention from the provider. Dedicated hardware is typically associated with private cloud, and public clouds offer vast, not limited, storage with secure connections.

Question 19: Which tool gives you a personalized view of best practices for cost, security, reliability, and performance?

Azure Blueprints
Azure Advisor (Correct answer)
Azure Monitor
Azure Policy

Correct answer: Azure Advisor

Azure Advisor analyzes resource usage and provides personalized optimization recommendations.

Question 20: Which Azure AD (Microsoft Entra ID) feature requires users to provide two or more verification methods to sign in?

Conditional Access
Privileged Identity Management
Multi-factor authentication (Correct answer)
Single sign-on

Correct answer: Multi-factor authentication

Multi-factor authentication (MFA) requires two or more verification methods such as a password plus a phone approval.

Question 21: Which feature in Microsoft Defender for Cloud gives a measurement of your current security posture?

Resource health
Secure Score (Correct answer)
Service map
Cost analysis

Correct answer: Secure Score

Secure Score measures your security posture and recommends actions to improve it.

Question 22: What is Azure Application Insights primarily used for?

Storing application log files in blob storage
Monitoring Azure infrastructure like VMs and networks
Application performance monitoring and detecting anomalies in live web applications (Correct answer)
Managing application deployments with CI/CD pipelines

Correct answer: Application performance monitoring and detecting anomalies in live web applications

Application Insights is an APM (Application Performance Management) feature of Azure Monitor that detects performance anomalies, tracks requests, dependencies, and exceptions in live apps.

Question 23: Which service protects web applications from common exploits like SQL injection and cross-site scripting?

Azure Key Vault
Network Security Group
Web Application Firewall (WAF) (Correct answer)
Azure Bastion

Correct answer: Web Application Firewall (WAF)

WAF, available on Application Gateway and Front Door, protects web apps from common exploits like SQL injection.

Question 24: What are Azure Availability Zones designed to protect against?

Datacenter-level failures within a region (Correct answer)
Internet outages worldwide
User password theft
Software bugs in your code

Correct answer: Datacenter-level failures within a region

Availability Zones are physically separate datacenters within a region to protect against datacenter failures.

Question 25: Which Azure feature provides a unified view of alerts, health events, and diagnostics across your Azure resources?

Azure Advisor
Azure Security Center
Azure Sentinel
Azure Monitor (Correct answer)

Correct answer: Azure Monitor

Azure Monitor collects, analyzes, and acts on telemetry data from your cloud and on-premises environments, providing dashboards, alerts, and log analytics.

Question 26: Which concept describes one of the three pillars of Zero Trust regarding limiting user access?

Disable authentication
Use least privilege access (Correct answer)
Trust by default
Grant broad permissions

Correct answer: Use least privilege access

Least privilege access grants users only the permissions they need to perform their tasks.

Question 27: Which expenditure type best describes paying monthly for Azure virtual machines based on usage?

OpEx (Correct answer)
Fixed asset cost
CapEx
Depreciation

Correct answer: OpEx

Pay-as-you-go cloud billing is an operating expense (OpEx).

Question 28: Which factor is a benefit of the cloud's global reach for end users?

Slower deployments
Mandatory long-term contracts
Higher upfront costs
Reduced latency by deploying closer to users (Correct answer)

Correct answer: Reduced latency by deploying closer to users

Deploying in regions near users reduces latency and improves performance.

Question 29: Which factor does NOT affect the cost of an Azure virtual machine?

Region where it is deployed
The color of the Azure portal theme (Correct answer)
VM size (SKU)
Operating system licensing

Correct answer: The color of the Azure portal theme

Portal theme is purely cosmetic and has no effect on VM pricing.

Question 30: An IT administrator needs to enforce a rule that prevents the creation of any new virtual machines outside of the 'West US 3' and 'East US' regions to comply with company policy. Which Azure service should be used to implement this requirement?

Azure Resource Locks
Azure Cost Management
Azure Policy (Correct answer)
Azure Blueprints

Correct answer: Azure Policy

Azure Policy is the service used to create, assign, and manage policies that enforce rules and effects over your resources to ensure they stay compliant with corporate standards and service-level agreements. A policy can be created to restrict the allowed locations for resource deployment. Resource Locks prevent deletion or modification, Blueprints deploy a set of resources, and Cost Management is for monitoring spending.

Question 31: Adding more CPU and RAM to an existing virtual machine is an example of what?

Horizontal scaling
Vertical scaling (Correct answer)
Sharding
Load balancing

Correct answer: Vertical scaling

Vertical scaling (scaling up) adds more power to an existing instance.

Question 32: What is a key advantage of cloud elasticity during a sudden traffic spike?

It automatically provisions extra resources to handle the load (Correct answer)
It permanently lowers your bill
It deletes excess data automatically
It disables the application

Correct answer: It automatically provisions extra resources to handle the load

Elasticity automatically adds resources to handle spikes, then releases them after.

Question 33: For full authentication, which of the following might require both a password and a security question?

Application Gateway
Multi-Factor Authentication (Correct answer)
Azure Firewall

Correct answer: Multi-Factor Authentication

Multi-Factor Authentication (MFA) is a security system that requires more than one method of verification to grant access. It typically combines something the user knows (like a password), something the user has (like a phone for a code), or something the user is (like a fingerprint). Requiring both a password and a security question adds an extra layer of security, making it a form of MFA.

Question 34: What is the term for distributing resources across multiple separated geographic locations for resilience?

Disaster recovery
Vertical scaling
Geo-redundancy (Correct answer)
Throttling

Correct answer: Geo-redundancy

Geo-redundancy replicates resources across separate regions to protect against regional failures.

Question 35: A startup is developing a new web application and wants to focus solely on writing code and managing their application, without worrying about the underlying operating systems, patches, or server maintenance. Which cloud service model should they choose?

Infrastructure as a Service (IaaS)
Software as a Service (SaaS)
On-premises datacenter
Platform as a Service (PaaS) (Correct answer)

Correct answer: Platform as a Service (PaaS)

Platform as a Service (PaaS) provides a complete development and deployment environment in the cloud. [4] It allows developers to focus on building and managing their applications without the complexity of maintaining the underlying infrastructure, as the cloud provider manages the servers, storage, and networking, as well as the operating system and development tools. [29]

Question 36: Which statement about the public cloud is correct?

Resources are shared among multiple customers (multi-tenant) (Correct answer)
It requires you to build a datacenter
Hardware is owned by your organization
It cannot scale automatically

Correct answer: Resources are shared among multiple customers (multi-tenant)

The public cloud is multi-tenant, with resources shared across many customers.

Question 37: Which scope can a single Azure Policy be assigned to?

Only individual resources
Management group, subscription, or resource group (Correct answer)
Only virtual networks
Only the tenant root

Correct answer: Management group, subscription, or resource group

Azure Policy can be assigned at the management group, subscription, or resource group scope and inherits downward.

Question 38: Which characteristic of cloud computing ensures applications remain available even if a single datacenter fails?

Manageability
Agility
High availability (Correct answer)
Mobility

Correct answer: High availability

High availability keeps applications running despite individual component or datacenter failures.

Question 39: Which OpEx advantage is gained by moving from on-premises to the cloud?

Larger upfront hardware purchases
Owning the physical servers
Treating computing as an ongoing operating expense (Correct answer)
Eliminating all costs

Correct answer: Treating computing as an ongoing operating expense

The cloud converts IT spending into ongoing operating expenses (OpEx) rather than capital purchases.

Question 40: A company must keep all data within the United States for compliance. Which Azure concept directly addresses this?

Availability zone
Resource group
Geography (Correct answer)
Management group

Correct answer: Geography

Azure geographies preserve data residency, ensuring data stays within the required boundary.

Microsoft Azure Fundamentals (AZ-900) Exam

The AZ-900 exam validates foundational knowledge of cloud services and how those services are provided with Microsoft Azure.

Questions

60 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learn.microsoft.com — Registration, retake fee, retake policy, exam format, score validity, eligibility, renewal, test delivery, passing score, score release · verified Oct 2026