AZ-900 Practice Test

1. A startup wants to avoid buying servers and instead pay only for the compute it actually consumes each month, scaling up during traffic spikes and down overnight. Which cloud characteristic does this describe?

• A. A capital expenditure (CapEx) purchasing model
• B. The consumption-based (pay-as-you-go) model
• C. The shared responsibility model
• D. High availability

2. In the cloud shared responsibility model, which task always remains the customer's responsibility regardless of whether they use IaaS, PaaS, or SaaS?

• A. Maintaining the physical network cabling
• B. Managing and classifying their own data and controlling user access to it
• C. Securing the physical datacenter, hardware, and facility access controls that host every customer's workloads
• D. Patching the underlying host hypervisor

3. A company deploys virtual machines in the cloud and installs, patches, and configures the operating system and applications themselves, while the provider manages the physical hosts. Which cloud service type are they using?

• A. Platform as a Service (PaaS)
• B. Software as a Service (SaaS), where the provider manages the entire application stack for the customer
• C. Function as a Service (FaaS)
• D. Infrastructure as a Service (IaaS)

4. Microsoft 365 lets users send email and edit documents in a browser with no operating system or runtime to maintain on the user side. Which cloud service model does this represent?

• A. Platform as a Service (PaaS)
• B. Serverless compute
• C. Software as a Service (SaaS)
• D. Infrastructure as a Service (IaaS)

5. An organization keeps some workloads in its on-premises datacenter for regulatory reasons but bursts to the public cloud during peak demand, connecting the two environments. Which cloud deployment model is this?

• A. Public cloud
• B. Hybrid cloud
• C. Private cloud
• D. Community cloud

6. A retailer's website automatically adds more web server instances as shopper traffic climbs and removes them as traffic falls, without human intervention. Which two related cloud benefits does this best demonstrate?

• A. Disaster recovery and backup
• B. Data sovereignty and residency
• C. Scalability and elasticity
• D. Manual capacity planning

7. A finance team wants to stop making large upfront hardware purchases and instead treat their IT spend as a predictable monthly operating cost. Moving to the cloud primarily shifts their spending from what to what?

• A. From operational expenditure (OpEx) to capital expenditure (CapEx)
• B. From fixed cost to a one-time licensing fee
• C. From variable cost to fixed hardware depreciation
• D. From capital expenditure (CapEx) to operational expenditure (OpEx)

8. Which statement most accurately distinguishes high availability from disaster recovery as cloud benefits?

• A. High availability keeps a system running through component failures, while disaster recovery restores service after a major outage or region loss
• B. High availability and disaster recovery are identical terms with no practical difference
• C. High availability applies only to storage, and disaster recovery applies only to compute
• D. Disaster recovery is designed to prevent outages entirely before they happen, while high availability is a recovery mechanism used only after data has already been lost

9. An organization shifts from purchasing servers upfront to paying monthly for cloud capacity. How does this change the expenditure classification?

• A. It becomes a fixed cost independent of usage
• B. From capital expenditure on owned assets to operational expenditure consumed as a service
• C. From operational expenditure to capital expenditure, the reverse of the shift that actually happens when adopting cloud services
• D. It remains capital expenditure because the resources are still dedicated

10. A workload's demand triples during a two-week seasonal peak and returns to baseline afterward. Which cloud characteristic addresses this?

• A. Durability, the assurance that stored data is not lost
• B. Fault tolerance, the ability to continue operating correctly despite the failure of an individual hardware or software component
• C. Governance, the enforcement of organizational policy
• D. Elasticity, the ability to add and remove capacity in response to demand and pay only for what is used

11. A team compares infrastructure, platform and software as a service. Which responsibility boundary characterizes platform as a service?

• A. The provider manages the operating system and runtime while the customer manages the application and its data
• B. The customer manages the operating system, runtime, and application entirely, receiving only virtualized hardware from the provider
• C. The provider manages everything including the application
• D. The customer manages only the physical hardware

12. An organization keeps some workloads on-premises and runs others in the cloud with connectivity between them. What deployment model is this?

• A. Hybrid cloud, which combines private and public infrastructure with connectivity between them
• B. Multi-cloud, meaning workloads are deliberately spread across more than one public cloud provider, with no on-premises component
• C. Public cloud only
• D. Private cloud only

13. An organization must reduce its carbon footprint and cites cloud migration as part of the plan. What is the sustainability argument?

• A. Large providers achieve higher utilization and efficiency per workload than typical on-premises data centres, and publish tooling to measure the resulting emissions
• B. Cloud providers do not use electricity from any grid at all, powering every datacenter entirely off privately generated renewable sources with zero connection whatsoever to any public utility grid
• C. Migration eliminates the need to measure emissions
• D. Cloud workloads consume no energy

14. A workload is migrated unchanged from on-premises virtual machines to cloud virtual machines. What is this approach called and what is its main limitation?

• A. Refactoring, which redesigns the application for cloud-native services
• B. Retirement, which decommissions the workload
• C. Replatforming, which changes the hosting model, such as moving to managed databases, while leaving the application's source code entirely unchanged throughout the whole migration
• D. Lift and shift, which is fast but carries forward the existing architecture and therefore captures little of the platform's cost and scaling benefit

15. A cloud service is described as multi-tenant. What does this mean for the customer?

• A. Each customer receives dedicated physical hardware by default, which is the single-tenant model multi-tenancy is specifically defined against
• B. Customers can see one another's data
• C. Infrastructure is shared among customers with logical isolation between them, which is what enables the economics of the service
• D. The service can only be used by one organization

16. A company must choose between a public and a private cloud for a workload subject to strict regulatory control over infrastructure. What favours private?

• A. Lower cost than public cloud in all scenarios
• B. Unlimited elastic capacity beyond what was purchased, a public-cloud characteristic that a dedicated private environment specifically does not offer to a single tenant
• C. Elimination of the need for internal operations staff
• D. Direct control over the infrastructure and its physical location, where regulation requires it, accepting higher cost and the loss of elastic scaling

17. A retailer's IT team currently orders physical servers, waits weeks for delivery, and racks them before a new order-processing feature can go live. Leadership wants resources that can be provisioned in minutes over the internet, with no hardware to own or rack. Which model delivers this?

• A. Cloud computing, the on-demand delivery of IT resources over the internet, provisioned in minutes without owning hardware
• B. Colocation, renting rack space in a third-party facility for servers the retailer still purchases and maintains
• C. Managed hosting, where a vendor racks and maintains hardware the retailer purchased and shipped to the vendor
• D. On-premises virtualization, running many virtual machines on servers the retailer owns, racks, and patches inside its own datacenter

18. Under the shared responsibility model, a company runs its ordering application on Azure App Service. According to Microsoft's division-of-responsibility table, who patches the operating system underneath the running app?

• A. The company's IT staff, because every Azure service leaves OS patching with the customer regardless of service model
• B. Microsoft, because App Service is a platform as a service offering where the OS and runtime are Microsoft's responsibility
• C. Neither party, because App Service runs on unpatched, immutable images that are replaced only when redeployed
• D. A third-party contractor, because Microsoft explicitly requires every customer to hire an approved outside vendor for PaaS operating system maintenance

19. A company subscribes to a SaaS helpdesk application. Per the Microsoft shared-responsibility matrix, which two areas remain the customer's responsibility even in a pure SaaS deployment?

• A. The application code and the runtime platform it executes on, both fully managed and updated by the SaaS provider
• B. The physical datacenter and the physical network hardware
• C. Customer data and the identities and user accounts that access the application
• D. The operating system and the hypervisor hosting the service

20. A hospital system must keep patient records on infrastructure it fully controls for regulatory reasons, accepting the cost of owning and operating that infrastructure itself. Which cloud deployment model matches this requirement?

• A. Public cloud, infrastructure owned by a provider and shared across many unrelated customers
• B. Multi-cloud, spreading workloads across more than one public cloud provider for redundancy
• C. Community cloud, infrastructure shared among several organizations with a common regulatory concern
• D. Private cloud, dedicated infrastructure operated for a single organization with no shared tenancy

21. A three-person startup building a public-facing app wants to avoid ever buying a server, needs to scale from zero users to a spike overnight, and has no interest in operating a datacenter. Which cloud deployment model fits best?

• A. Public cloud, where a provider owns and operates shared infrastructure that the startup rents on demand
• B. Private cloud, where infrastructure is dedicated to and operated by the startup alone
• C. Hybrid cloud, where the startup keeps some systems in its own datacenter and connects them to the cloud
• D. On-premises deployment, where the startup installs and runs its own servers in a rented office

22. To avoid depending on a single vendor's outage or pricing changes, a company deliberately runs part of its workload on Azure and another part on a different public cloud provider, with no on-premises component at all. What is this strategy called?

• A. Hybrid cloud, combining private, on-premises infrastructure with a public cloud provider
• B. Cloud bursting, temporarily overflowing from a private datacenter into the public cloud at peak load
• C. Multi-cloud, deliberately using more than one public cloud provider for the same organization
• D. Community cloud, infrastructure shared among organizations with a common concern

23. A developer spins up a virtual machine for a 20-minute load test and deletes it immediately afterward. Under the consumption-based model, how is this billed?

• A. For a full calendar month, because Azure bills virtual machines in fixed monthly increments regardless of runtime
• B. Nothing at all, because resources deleted within an hour of creation are always billed at zero under Azure policy
• C. Only for the roughly 20 minutes the virtual machine actually ran, metered at a per-second or per-minute rate
• D. For a full year, because compute charges are billed against the annual commitment tied to the subscription

24. A seasonal retailer's traffic is completely unpredictable week to week, so committing to a fixed level of capacity for a year would waste money in slow weeks and fall short in busy ones. Which pricing approach best matches this workload?

• A. A one-year reserved instance, prepaying for a fixed amount of capacity for twelve months
• B. A three-year reserved instance, prepaying for a fixed amount of capacity for thirty-six months
• C. An annual enterprise agreement with a fixed minimum spend commitment regardless of usage
• D. Pay-as-you-go, paying only for the compute actually consumed with no upfront term commitment

25. A student wants to experiment with a handful of Azure services for a class project without entering a credit card commitment beyond initial verification, and expects to spend nothing if usage stays within the free offer. What should they sign up for?

• A. An Azure free account, which includes a time-limited credit plus a set of services that remain free within monthly limits
• B. An Enterprise Agreement, which requires a negotiated minimum annual commitment across an organization
• C. A Cloud Solution Provider subscription, which is sold and billed through a Microsoft partner reseller
• D. A reserved capacity plan, which requires prepaying for a fixed amount of a specific resource over a one- or three-year term

26. A company wants to run a small script that resizes an image the moment it is uploaded, then wants that code to consume zero compute and cost nothing the rest of the time it is idle. Which cloud computing concept describes hosting that fits this need?

• A. A dedicated virtual machine, which keeps a server running and billable continuously whether or not the script is currently executing
• B. Serverless computing, where code runs only in response to an event and the platform scales it to zero when idle
• C. Availability sets, which distribute virtual machine instances across fault domains for resilience
• D. A reserved instance, which commits to paying for a fixed amount of compute for one to three years

27. A trading platform cannot tolerate the outage of a single server component, but a brief, planned interruption once a quarter for maintenance is acceptable. Which cloud benefit specifically addresses tolerating component failures during normal operation?

• A. Elastic scaling, automatically adding or removing compute capacity to match changing demand in real time as load rises and falls
• B. Cost predictability, the ability to forecast monthly cloud spend in advance
• C. High availability, keeping a system running and accessible with minimal downtime despite component failures
• D. Data residency, keeping data stored within a specific geographic or legal boundary

28. A video encoding service currently runs on one large server that is upgraded with more CPU and memory whenever load grows. Migrating to the cloud, the team instead adds more identical server instances behind a load balancer as load grows. What is this second approach called?

• A. Scaling up (vertical scaling), increasing the size or power of a single existing resource
• B. Failover clustering, switching traffic to a passive standby resource only after a failure
• C. Autoscaling down, reducing the number of running instances when demand falls
• D. Scaling out (horizontal scaling), adding more instances of a resource to share the load

29. A single virtual machine hosting a reporting tool starts running slowly as more employees use it. Rather than adding more instances, an administrator increases the VM's CPU and memory by moving it to a larger size. What is this called?

• A. Scaling up (vertical scaling), increasing the resources of a single existing instance
• B. Scaling out (horizontal scaling), adding more instances of a resource to share the load
• C. Elastic bursting, temporarily overflowing work to a separate cloud region
• D. Load balancing, distributing requests evenly across multiple existing instances

30. After a component fails, a system automatically detects the fault, routes traffic around it, and continues serving requests correctly without manual intervention. Which cloud benefit does this best illustrate?

• A. Manageability, the ability to configure and monitor resources consistently
• B. Data sovereignty, the legal requirement that data remain subject to the laws of a specific country
• C. Reliability, the ability of a system to recover from failures and continue functioning correctly
• D. Agility, the ability to rapidly develop, test, and launch new software

31. A checkout service must consistently respond within 200 milliseconds even as traffic grows tenfold during a sale, because customers must be able to count on that response time in advance. Which benefit of cloud services is being described?

• A. Cost predictability, the ability to estimate and forecast spend before deploying resources
• B. Elasticity, automatically adding and removing compute capacity as demand changes, independent of whether response time stays consistent
• C. Performance predictability, consistent, expected performance for the resources deployed as demand changes
• D. Governance, applying organizational rules and policies consistently across resources

32. Before committing to a new cloud project, a finance director wants to know approximately what next month's bill will be based on the resources planned, so the expense can be forecast in the annual budget. Which cloud benefit does this rely on?

• A. Security, protecting resources and data from unauthorized access
• B. Cost predictability, the ability to estimate and forecast cloud spending in advance of consuming resources
• C. High availability, minimizing downtime through resilient, redundant infrastructure design across multiple components
• D. Scalability, the ability to increase or decrease capacity to meet demand

33. A regulated bank chooses a major cloud provider partly because the provider maintains third-party compliance certifications and invests heavily in physical and network security that the bank could not replicate alone. Which cloud benefit is this?

• A. The security and governance benefit of the cloud, where the provider's scale and compliance investment strengthen the customer's own posture
• B. The cost predictability benefit of the cloud, where consumption-based billing makes monthly spending easier to forecast and budget for in advance
• C. The agility benefit of the cloud, where new environments can be provisioned quickly
• D. The manageability benefit of the cloud, where resources can be configured through a single portal

34. An operations team wants to apply the same configuration, monitoring, and automatic deployment approach to every resource, whether it runs in Azure or still on-premises, and wants to do so from a browser, a command line, or an API equally well. Which cloud benefit are they relying on?

• A. Fault tolerance, continuing to operate correctly despite the failure of an individual underlying hardware or software component, unrelated to configuration tooling
• B. Elasticity, automatically matching capacity to demand as it rises and falls
• C. Data residency, guaranteeing that data remains within a specific geographic boundary
• D. Manageability, consistent configuration and the ability to manage resources through multiple interfaces such as the portal, CLI, or APIs

35. A product team can now spin up a full test environment in minutes, try an idea, and tear it down the same afternoon, instead of waiting weeks for hardware to be requisitioned. Which cloud benefit does this speed of experimentation represent?

• A. Data sovereignty, ensuring data remains under a specific jurisdiction's legal control
• B. Redundancy, duplicating components so a failure in one does not take down the whole system
• C. Agility, the ability to rapidly develop, test, and deploy applications and infrastructure
• D. Right-sizing, matching resource allocation to actual workload requirements to control cost

36. A company launching in a new country wants its application to run close to customers there within days, without building a new datacenter, by simply deploying into an existing cloud region in that geography. Which benefit of cloud services does this rely on?

• A. Disaster recovery, the ability to restore operations and data after a major regional outage or catastrophic failure, which is unrelated to expanding into a brand-new geographic market
• B. Cost predictability, the ability to forecast spend based on planned resource usage
• C. Governance, applying consistent organizational policy across resources and regions
• D. Global reach, the ability to deploy applications to users around the world through a provider's existing worldwide datacenter footprint

37. A development team wants to write and deploy application code without provisioning virtual machines, patching an operating system, or installing a runtime themselves, letting the platform handle scaling automatically. Which cloud service type fits?

• A. Platform as a service (PaaS), where the provider manages the OS and runtime and the customer manages the application and data
• B. Infrastructure as a service (IaaS), where the customer manages the OS, runtime, and application on provisioned virtual machines
• C. Software as a service (SaaS), where the provider delivers a complete, ready-to-use application to end users
• D. On-premises hosting, where the organization owns and operates all hardware and software layers itself

38. A company is choosing between infrastructure as a service, platform as a service, and software as a service for a new internal tool. It wants less operational burden than managing its own virtual machines, but still needs to deploy and update custom application code itself. Which service type is the best fit?

• A. Infrastructure as a service, which requires the company to manage the operating system and runtime directly on provisioned virtual machines
• B. Platform as a service, which removes OS and runtime management while still letting the company deploy its own code
• C. Software as a service, which provides a finished application with no ability to deploy custom code
• D. Colocation, which requires the company to own and rack its own physical hardware

39. A small accounting firm wants browser-based bookkeeping software that requires no installation, receives updates automatically from the vendor, and needs no server of any kind on the firm's side. Which cloud service type are they looking for?

• A. Infrastructure as a service (IaaS), virtual machines the firm would need to configure and maintain itself
• B. Platform as a service (PaaS), a hosting platform on which the firm would still need to deploy its own accounting code
• C. Software as a service (SaaS), a complete, ready-to-use application delivered and maintained entirely by the provider
• D. Function as a service (FaaS), individual pieces of code triggered by specific events

40. A team is migrating a legacy Windows application that depends on a specific, unsupported kernel-level driver, so it needs full administrative access to the operating system itself. Which cloud service type must they use?

• A. Platform as a service (PaaS), which abstracts the operating system away from the customer
• B. Software as a service (SaaS), which offers no access to any underlying operating system
• C. Serverless functions, which run short, stateless code snippets without any persistent operating system access at all
• D. Infrastructure as a service (IaaS), which grants the customer full control over the guest operating system

41. A two-person startup has no dedicated operations staff and wants a backend for its mobile app that scales automatically without anyone ever having to size or patch a server. Which cloud service type minimizes their operational burden the most?

• A. A fully managed platform as a service or software as a service backend, so there is no server to size, patch, or operate
• B. Infrastructure as a service virtual machines, which the startup would still need to size, patch, and operate entirely on its own
• C. A self-managed container cluster the startup installs and operates on its own virtual machines
• D. Colocated hardware in a third-party datacenter that the startup still owns and configures

42. A mobile game's backend traffic can jump from a few hundred to hundreds of thousands of players within an hour whenever the game trends, and the small studio behind it has no staff dedicated to capacity planning. Which service type handles this best?

• A. Infrastructure as a service, which requires the studio to manually provision additional virtual machines as traffic spikes
• B. Platform as a service, whose managed autoscaling absorbs sudden spikes without the studio manually adding capacity
• C. A single fixed-size virtual machine sized for the studio's average, non-trending traffic level
• D. On-premises servers purchased in advance to cover the highest traffic the studio has ever seen

43. An enterprise is migrating a compliance-sensitive, customized ERP system that must run a specific OS build and cannot be adapted to a managed platform's constraints. Which service type gives them the control this migration requires?

• A. Software as a service, since a finished vendor application would replace the need for the custom ERP entirely
• B. Platform as a service, since its managed runtime is assumed to already meet the enterprise's specific compliance-mandated OS build requirement
• C. Function as a service, since triggered functions can host a full ERP system without a persistent server
• D. Infrastructure as a service, since it is the only model granting full control over the OS build and configuration

44. A nonprofit needs a shared calendar and email system for 15 staff, wants zero server maintenance, and is comfortable using a vendor's application exactly as it is offered, with no customization of the underlying code. Which cloud service type matches?

• A. Infrastructure as a service, virtual machines the nonprofit would provision and maintain itself
• B. Platform as a service, a hosting platform on which the nonprofit would still need to build its own application
• C. A private cloud deployment, dedicated infrastructure the nonprofit would need to fund and operate
• D. Software as a service, a finished application used as-is with the vendor handling all hosting and maintenance

45. You need to deploy several Azure resources so they share the same lifecycle and can be deleted together when the project ends. Which Azure construct is designed to be a logical container for resources like this?

• A. An availability zone
• B. A resource group
• C. A subscription
• D. A management group

46. An architect wants an application to survive the failure of an entire datacenter within a single Azure region. Which architectural feature should the resources be spread across?

• A. Resource groups
• B. Availability zones
• C. Tags, which label resources with metadata and provide no physical fault isolation
• D. Subscriptions

47. A development team wants to run event-driven code in response to an HTTP request or a queue message without provisioning or managing any servers, paying only while the code executes. Which Azure service best fits?

• A. Azure Virtual Machines
• B. Azure Blob Storage
• C. Azure Virtual Network
• D. Azure Functions

48. A company wants to package a microservices application in containers and needs an Azure service that automatically handles orchestration, scaling, and health of those containers across a cluster. Which service should they choose?

• A. Azure Kubernetes Service (AKS)
• B. Azure Blob Storage
• C. Azure Virtual Network
• D. Azure Policy, which enforces governance rules and has no role in running or orchestrating containers

49. Two virtual machines in the same Azure virtual network need to communicate privately, and you also want to control inbound and outbound traffic to them by port and protocol. Which component filters that traffic?

• A. An availability set
• B. A network security group (NSG)
• C. A storage account
• D. A resource lock, which prevents accidental deletion or modification but does not filter any network traffic

50. An organization wants to establish a private, dedicated connection from its on-premises datacenter to Azure that does not traverse the public internet, for predictable throughput and lower latency. Which service should they use?

• A. A site-to-site VPN over the public internet
• B. Azure Content Delivery Network (CDN)
• C. Azure ExpressRoute
• D. Azure DNS

51. A backup application needs to store large numbers of unstructured files (images, logs, and archives) that will be accessed over HTTP and can grow massively over time. Which Azure storage service is the best fit?

• A. Azure SQL Database
• B. Azure Files
• C. Azure Virtual Network
• D. Azure Blob Storage

52. A company has files that are rarely accessed and only kept for long-term compliance, and wants to minimize storage cost while accepting higher retrieval latency. Which Azure Blob Storage access tier fits best?

• A. Archive tier
• B. Hot tier
• C. Cool tier
• D. Premium block blob tier

53. An administrator needs a storage redundancy option that keeps copies of data in a second, geographically distant Azure region to protect against a complete regional outage. Which redundancy option meets this need?

• A. Locally redundant storage (LRS)
• B. Geo-redundant storage (GRS)
• C. Zone-redundant storage (ZRS)
• D. A network security group

54. Employees should sign in once and then access many cloud applications without re-entering credentials for each one. Which Microsoft Entra ID (Azure AD) capability provides this?

• A. A resource lock
• B. A network security group
• C. Single sign-on (SSO)
• D. Azure Blob Storage

55. A federal contractor must run workloads that satisfy specific US government compliance requirements not offered in Azure's normal commercial regions. Which category of Azure region is designed for this?

• A. A sovereign region, such as Azure Government, operated separately from commercial Azure for a restricted set of customers
• B. A paired region, selected automatically for disaster recovery from the primary region
• C. An edge zone, a small-footprint extension of Azure located inside a telecommunications provider's datacenter for low-latency edge workloads
• D. A local zone, a low-latency extension of a region placed near a specific metropolitan area

56. To reduce the risk of compromised passwords, an organization wants users to confirm sign-in with a second factor such as a phone approval or authenticator code. Which security feature should they enable?

• A. Role-based access control (RBAC)
• B. Availability zones
• C. Multifactor authentication (MFA)
• D. Azure Monitor

57. A team lead should be able to manage all resources within one resource group but have no access to other resource groups. Which Azure mechanism grants exactly this scoped permission?

• A. Azure role-based access control (RBAC) assigned at the resource group scope
• B. A network security group rule, which filters network traffic by port and protocol but grants no resource permissions at all
• C. A resource tag
• D. Multifactor authentication

58. A relational database with predictable structured schema, transactions, and SQL querying is needed for an application, delivered as a managed PaaS offering. Which Azure service fits best?

• A. Azure Blob Storage
• B. Azure SQL Database
• C. Azure Files
• D. Azure Functions

59. A global web application wants to reduce latency by serving static images and scripts from servers physically close to each user around the world. Which Azure service is designed for this?

• A. Azure ExpressRoute, a private dedicated circuit linking on-premises networks to Azure that does not cache content
• B. Azure Policy
• C. Azure Content Delivery Network (CDN)
• D. A resource group

60. A region pair is used for a workload. What characterizes a paired region?

• A. Two data centres within the same physical campus
• B. A backup region that automatically replicates every resource without any configuration required, unlike real region pairing, which requires each service to be configured for replication
• C. A second region in the same geography prioritized for recovery, with platform updates staged across the pair rather than applied simultaneously
• D. A region reserved exclusively for development workloads

61. Resources must be grouped so they can be deployed, managed and deleted together. Which construct provides this?

• A. A subscription, which is a billing and access-management boundary that contains many resource groups, not a single deletable unit
• B. A management group, which organizes subscriptions
• C. An availability zone, which is a physical location
• D. A resource group, a logical container whose lifecycle can be managed as a unit

62. A security team wants to require that any sign-in from outside the corporate network also complete multifactor authentication. They configure this in Microsoft Entra Conditional Access. At what point in the sign-in process is this policy actually enforced?

• A. Before the user supplies any credentials at all, blocking the connection outright at the network layer before any authentication attempt occurs anywhere in the sign-in flow
• B. As a replacement for a web application firewall, filtering all inbound HTTP requests
• C. After the user completes first-factor authentication, when Conditional Access evaluates signals like location and then requires the additional MFA step
• D. Only during the initial account creation, and never again for that user afterward

63. An organization wants to eliminate typed passwords for its Windows-joined laptops while still requiring a device and a biometric or PIN as the sign-in factors. Which Microsoft Entra passwordless method is designed specifically for that device-bound scenario?

• A. Certificate-based authentication, which relies on an X.509 certificate rather than a bound device and biometric
• B. Passwordless sign-in through Microsoft Authenticator, which is designed to work across any platform, not specifically Windows-joined devices
• C. A Temporary Access Pass, a time-limited passcode meant for initial setup or recovery rather than everyday sign-in
• D. Windows Hello for Business, which replaces the password with strong two-factor authentication tied to the device using a biometric or PIN

64. A workload requires storage that is highly durable, accessed over HTTP and organized without a folder hierarchy. Which storage type fits?

• A. Blob storage, which stores unstructured objects in containers accessed over HTTP with configurable access tiers
• B. File storage, which provides fully managed SMB and NFS file shares organized in a traditional directory and folder structure
• C. Disk storage, which attaches to a single virtual machine
• D. Queue storage, which holds messages for asynchronous processing

65. A team wants to run containerized workloads without managing the underlying virtual machines or orchestration control plane. Which option fits best?

• A. Virtual machines with a container runtime installed and patched manually, leaving the team responsible for the orchestration control plane
• B. A serverless container service where the platform manages the hosting infrastructure and scaling
• C. A self-managed orchestration cluster on virtual machines
• D. A physical server in a colocation facility

66. Two virtual networks in the same region must communicate privately. What connects them?

• A. A public IP address assigned to each network, which routes traffic over the public internet rather than the provider's private backbone
• B. A content delivery network endpoint
• C. Virtual network peering, which routes traffic between them over the provider's backbone without going through the public internet
• D. A load balancer placed between them

67. An identity service provides single sign-on and multi-factor authentication for cloud applications. Which capability specifically evaluates conditions such as location and device state before granting access?

• A. Network security groups, which filter traffic
• B. Conditional access, which applies policy based on signals evaluated at sign-in
• C. Resource tagging, which labels resources for organization
• D. Role-based access control, which grants permissions to resources once a user is already signed in, not conditions evaluated during sign-in itself

68. A service must authenticate to another service without any stored credential. What mechanism provides this?

• A. A managed identity, where the platform issues and rotates the identity's credentials automatically
• B. A shared access key stored in the application's configuration, which the application owner must rotate and protect manually
• C. A user account with a strong password
• D. An anonymous access setting on the target service

69. An organization must demonstrate where its data is physically stored to satisfy a regulator. Which concept applies?

• A. Tags, which label resources with metadata
• B. Data residency, determined by the region chosen for each service, since region selection controls physical location
• C. Resource groups, which organize resources logically
• D. Availability zones, which describe physical separation of datacenters within a single region, not the region's geographic location itself

70. A virtual machine's availability must be protected against both hardware failure and a data centre outage. What configuration addresses both?

• A. A single instance with premium managed disks
• B. Multiple instances distributed across availability zones, since zones provide separate facilities within the region
• C. Multiple instances kept in the same rack for the lowest possible latency, which shares the same power and network failure domain
• D. A single instance with automated daily backups

71. A subscription reaches a service limit for a resource type. What is the general nature of such limits?

• A. Some are soft limits that can be raised on request while others are hard limits inherent to the platform, so the distinction must be checked during design
• B. All limits are fixed and cannot be changed
• C. All limits can be raised automatically without any request, removing the need for a subscription owner to ever contact Azure support or plan capacity ahead of a launch
• D. Limits apply only to trial subscriptions

72. An architect is asked to explain Azure's physical hierarchy to a new team member: which level sits directly beneath an availability zone?

• A. A resource group, a logical grouping of resources for lifecycle management with no physical location or datacenter of its own
• B. One or more datacenters, each with independent power, cooling, and networking, that together make up a zone
• C. A subscription, a billing and access boundary unrelated to physical placement
• D. A region pair, a pairing relationship between two entire regions

73. Two departments within one company want completely separate billing statements and the ability to set different access permissions for each department's resources, while still belonging to the same organization. What should each department be given?

• A. A separate resource group within one shared subscription
• B. A separate management group with no subscription of its own, since management groups only organize subscriptions that already exist
• C. Its own subscription, since subscriptions are the boundary for billing and access management
• D. A separate Azure region for its resources

74. A new Azure tenant is created with several subscriptions already in it. Without any manual configuration, where do those subscriptions sit in the management group hierarchy?

• A. Nowhere, since subscriptions exist outside the management group hierarchy until explicitly added
• B. Directly under a management group named after the subscription's billing offer type
• C. Under whichever management group was created first, chosen at random
• D. Under the tenant's root management group, which every subscription belongs to by default

75. Before committing to spending, a customer wants to compare the monthly cost of running a specific set of Azure services with different regions and configurations. Which free Azure tool should they use?

• A. The Azure Pricing Calculator
• B. Azure Policy
• C. Azure Monitor
• D. Azure Advisor, which gives recommendations on resources you already deployed, not pre-purchase estimates

76. A finance team wants to set spending thresholds on a subscription and receive alerts when actual or forecasted costs approach a limit. Which Azure capability should they use?

• A. Cost Management budgets and alerts
• B. The Azure Pricing Calculator
• C. A network security group
• D. Availability zones, which provide datacenter-level resilience and have no budgeting or alerting function

77. An organization must ensure that no one can create storage accounts outside of approved Azure regions, enforcing this rule automatically at deployment time. Which service enforces such compliance rules?

• A. Azure Advisor
• B. Azure Policy
• C. Azure Monitor
• D. A resource group

78. A company wants to prevent a critical production resource from being accidentally deleted, even by users who otherwise have permission to delete it. Which feature should they apply?

• A. A resource tag
• B. Azure Advisor
• C. A resource lock (CanNotDelete or ReadOnly)
• D. A management group, which organizes subscriptions for governance but does not itself block deletion

79. An enterprise has dozens of subscriptions and wants to apply the same governance policies and access controls across all of them from a single point. Which construct should they use?

• A. Resource groups
• B. Availability zones
• C. Tags
• D. Management groups

80. An operations team needs to collect metrics and logs from Azure resources and set up alerts when a virtual machine's CPU stays high. Which service is purpose-built for this monitoring?

• A. Azure Monitor
• B. Azure Policy
• C. Azure Blob Storage
• D. A resource lock

81. A cloud admin wants personalized recommendations that improve the reliability, security, performance, and cost-efficiency of their existing Azure resources. Which service provides these recommendations?

• A. Azure Pricing Calculator
• B. Azure Advisor
• C. Azure Virtual Network
• D. A network security group

82. An administrator wants to manage Azure resources from a browser using a shell that already has Azure CLI and PowerShell tools authenticated and available, without installing anything locally. Which tool provides this?

• A. Azure Monitor
• B. Azure Cloud Shell
• C. Azure Blob Storage
• D. Azure Policy

83. A team wants to define their Azure infrastructure declaratively in a repeatable template so the same environment can be deployed consistently many times. Which Azure-native approach supports this?

• A. Manually clicking through the Azure portal each time
• B. A network security group
• C. Azure Advisor recommendations
• D. Azure Resource Manager (ARM) templates or Bicep

84. A test-taker is unsure whether to leave a hard question blank on the AZ-900 exam. Based on the exam's scoring rules, what is the best strategy?

• A. Always answer every question, because there is no penalty for guessing
• B. Leave hard questions blank to avoid losing points
• C. Answer only questions you are fully certain about
• D. Guessing lowers your score, so it is safer to leave a difficult question completely unanswered instead

85. A service level agreement specifies 99.9 percent monthly availability. Approximately how much downtime does this permit per month?

• A. About 4 hours, a downtime figure that would only be consistent with a much lower availability commitment than 99.9 percent
• B. About 43 minutes
• C. About 7 hours
• D. About 5 minutes

86. An organization needs to apply a policy consistently across many subscriptions. Which scope should the assignment target?

• A. A management group containing those subscriptions, so the assignment inherits downward
• B. Each resource group individually, which must be reassigned every time a new resource group or subscription is created
• C. Each individual resource
• D. The tenant's user accounts

87. A governance requirement states that no storage account may be created without encryption enabled. Which tool enforces this at creation time?

• A. Role-based access control, which governs who may perform actions but does not itself inspect or block a specific resource configuration
• B. Policy, which can audit or deny resource configurations that do not comply
• C. A resource lock, which prevents deletion or modification
• D. A cost budget alert, which notifies on spending

88. A critical resource must be protected from accidental deletion even by administrators. What provides this?

• A. Removing delete permissions from every user role, which also blocks legitimate administrators from ever deleting the resource later
• B. Tagging the resource as critical
• C. A resource lock set to prevent deletion, which applies regardless of the principal's permissions until the lock is removed
• D. Enabling diagnostic logging on the resource

89. A finance team must attribute cloud spending to individual departments. What mechanism supports this?

• A. Resource locks preventing changes to expensive resources, which protects them from deletion but reports nothing about which department incurred the cost
• B. Availability zones separating departmental workloads
• C. Role assignments granting finance read access
• D. Tags applied consistently to resources, surfaced in cost analysis to break spending down by the tagged dimension

90. A budget is configured on a subscription. What does it do when the threshold is reached?

• A. It triggers alerts and can invoke automated actions, but does not by itself stop resources from running
• B. It immediately shuts down all resources in the subscription the moment the configured threshold is crossed, with no separate automation required
• C. It prevents any further resource creation permanently
• D. It refunds the amount spent above the threshold

91. A virtual machine will run continuously for three years with a stable configuration. Which pricing approach reduces cost most?

• A. Pay-as-you-go pricing for maximum flexibility
• B. A reservation committing to the capacity for a term in exchange for a substantial discount over pay-as-you-go
• C. Spot pricing, which offers the deepest discount
• D. Increasing the virtual machine size to improve efficiency, which raises pay-as-you-go cost further rather than discounting a stable three-year workload

92. A composite application depends on three services with individual availability commitments. What is the effective commitment for the application?

• A. Equal to the highest individual commitment, as if the weakest dependency were simply ignored when calculating the combined figure
• B. Equal to the average of the three
• C. Lower than any individual service, since dependent commitments multiply rather than being inherited
• D. Equal to the lowest individual commitment

93. A preview feature is offered for a service. What should govern its use?

• A. The assumption that preview features carry the exact same service level commitments and long-term support guarantees as generally available features
• B. The expectation that preview features are always free permanently
• C. A requirement to use preview features to receive support
• D. Awareness that preview features are typically excluded from service level agreements and may change or be withdrawn before general availability

94. A company already owns Windows Server licenses with active Software Assurance and wants to apply that existing investment toward a discount on Windows virtual machines it plans to run in Azure. Which Azure offering lets them do this?

• A. Azure Hybrid Benefit, which lets eligible on-premises Windows Server licenses with active Software Assurance reduce the cost of Windows VMs in Azure
• B. Azure Spot Virtual Machines, which offer a discount in exchange for the VM being evictable with short notice whenever Azure needs the capacity back for another paying workload
• C. A Reservation, which discounts compute by prepaying for a one- or three-year term regardless of existing licenses
• D. Azure Advisor, which only recommends cost-saving actions without applying any license-based discount itself

95. A batch-processing job can tolerate being interrupted and restarted, and the team wants the deepest possible discount on Azure compute for it, accepting that the VM could be reclaimed by Azure with only about 30 seconds of notice and carries no high-availability guarantee. Which option matches?

• A. A Reservation, which commits to paying for guaranteed, uninterruptible capacity for one or three years
• B. Azure Spot Virtual Machines, which use Azure's unused capacity at a steep discount but can be evicted with about 30 seconds of notice
• C. An availability set, which improves resiliency but does not change the compute discount at all
• D. Azure Hybrid Benefit, which discounts a VM using an existing on-premises Windows Server license rather than Azure's unused compute capacity that could be reclaimed at any time

96. An administrator needs to know whether a current outage affecting their application is a platform-wide incident or a fault in their own resource. Which two views answer this?

• A. Service health for platform incidents and planned maintenance, and resource health for the status of the specific deployed resource
• B. The pricing calculator for both questions
• C. Cost analysis for platform incidents and budgets for resource status, mixing up two spending tools that report neither incidents nor resource health
• D. Resource tags for platform incidents and locks for resource status

97. A monitoring solution must collect metrics and logs and raise alerts. What distinguishes metrics from logs?

• A. Logs are numeric and metrics are textual
• B. Metrics are retained indefinitely while logs are always discarded immediately after collection, regardless of workspace retention settings
• C. The two are the same data presented differently
• D. Metrics are numeric time-series values sampled at intervals, while logs are records of discrete events with richer detail

98. A cloud adoption plan must estimate the cost of a proposed architecture before anything is deployed. Which tool applies?

• A. A pricing calculator where services and configurations are specified to produce an estimate
• B. Cost analysis, which reports on spending already incurred
• C. A budget alert, which notifies when spending on already-deployed resources reaches a threshold, rather than estimating a future architecture
• D. A resource lock, which prevents changes

99. A support plan must include technical support with a response time commitment for production issues. What generally determines the response commitment?

• A. The total monthly spend on the subscription alone, regardless of which support plan was purchased or how severe the case is
• B. The support plan tier purchased together with the severity assigned to the case
• C. The number of resources deployed
• D. The region in which the resources are deployed

100. Beyond cataloging data, a compliance officer also needs tools for eDiscovery, records management, and audit within the same governance platform. Where do these compliance capabilities live?

• A. In Microsoft Purview, whose data compliance pillar includes solutions such as eDiscovery, records management, and audit
• B. In Azure Advisor's operational excellence recommendation category, alongside its other four cost, security, and reliability scoring categories
• C. In Azure Monitor's Application Insights feature, alongside application performance data
• D. In Azure Policy's initiative definitions, grouped alongside configuration rules