AZ-900 Practice Test

1. A development team wants to run event-driven code in response to an HTTP request or a queue message without provisioning or managing any servers, paying only while the code executes. Which Azure service best fits?

• A. Azure Virtual Machines
• B. Azure Blob Storage
• C. Azure Virtual Network
• D. Azure Functions

2. A service must authenticate to another service without any stored credential. What mechanism provides this?

• A. A managed identity, where the platform issues and rotates the identity's credentials automatically
• B. A shared access key stored in the application's configuration, which the application owner must rotate and protect manually
• C. A user account with a strong password
• D. An anonymous access setting on the target service

3. A company has files that are rarely accessed and only kept for long-term compliance, and wants to minimize storage cost while accepting higher retrieval latency. Which Azure Blob Storage access tier fits best?

• A. Archive tier
• B. Hot tier
• C. Cool tier
• D. Premium block blob tier

4. A region pair is used for a workload. What characterizes a paired region?

• A. Two data centres within the same physical campus
• B. A backup region that automatically replicates every resource without any configuration required, unlike real region pairing, which requires each service to be configured for replication
• C. A second region in the same geography prioritized for recovery, with platform updates staged across the pair rather than applied simultaneously
• D. A region reserved exclusively for development workloads

5. A subscription reaches a service limit for a resource type. What is the general nature of such limits?

• A. Some are soft limits that can be raised on request while others are hard limits inherent to the platform, so the distinction must be checked during design
• B. All limits are fixed and cannot be changed
• C. All limits can be raised automatically without any request, removing the need for a subscription owner to ever contact Azure support or plan capacity ahead of a launch
• D. Limits apply only to trial subscriptions

6. An architect wants an application to survive the failure of an entire datacenter within a single Azure region. Which architectural feature should the resources be spread across?

• A. Resource groups
• B. Availability zones
• C. Tags, which label resources with metadata and provide no physical fault isolation
• D. Subscriptions

7. An organization must demonstrate where its data is physically stored to satisfy a regulator. Which concept applies?

• A. Tags, which label resources with metadata
• B. Data residency, determined by the region chosen for each service, since region selection controls physical location
• C. Resource groups, which organize resources logically
• D. Availability zones, which describe physical separation of datacenters within a single region, not the region's geographic location itself

8. A team lead should be able to manage all resources within one resource group but have no access to other resource groups. Which Azure mechanism grants exactly this scoped permission?

• A. Azure role-based access control (RBAC) assigned at the resource group scope
• B. A network security group rule, which filters network traffic by port and protocol but grants no resource permissions at all
• C. A resource tag
• D. Multifactor authentication

9. A virtual machine's availability must be protected against both hardware failure and a data centre outage. What configuration addresses both?

• A. A single instance with premium managed disks
• B. Multiple instances distributed across availability zones, since zones provide separate facilities within the region
• C. Multiple instances kept in the same rack for the lowest possible latency, which shares the same power and network failure domain
• D. A single instance with automated daily backups

10. An administrator needs a storage redundancy option that keeps copies of data in a second, geographically distant Azure region to protect against a complete regional outage. Which redundancy option meets this need?

• A. Locally redundant storage (LRS)
• B. Geo-redundant storage (GRS)
• C. Zone-redundant storage (ZRS)
• D. A network security group

11. Two virtual networks in the same region must communicate privately. What connects them?

• A. A public IP address assigned to each network, which routes traffic over the public internet rather than the provider's private backbone
• B. A content delivery network endpoint
• C. Virtual network peering, which routes traffic between them over the provider's backbone without going through the public internet
• D. A load balancer placed between them

12. A relational database with predictable structured schema, transactions, and SQL querying is needed for an application, delivered as a managed PaaS offering. Which Azure service fits best?

• A. Azure Blob Storage
• B. Azure SQL Database
• C. Azure Files
• D. Azure Functions

13. An organization wants to establish a private, dedicated connection from its on-premises datacenter to Azure that does not traverse the public internet, for predictable throughput and lower latency. Which service should they use?

• A. A site-to-site VPN over the public internet
• B. Azure Content Delivery Network (CDN)
• C. Azure ExpressRoute
• D. Azure DNS

14. A global web application wants to reduce latency by serving static images and scripts from servers physically close to each user around the world. Which Azure service is designed for this?

• A. Azure ExpressRoute, a private dedicated circuit linking on-premises networks to Azure that does not cache content
• B. Azure Policy
• C. Azure Content Delivery Network (CDN)
• D. A resource group

15. A workload requires storage that is highly durable, accessed over HTTP and organized without a folder hierarchy. Which storage type fits?

• A. Blob storage, which stores unstructured objects in containers accessed over HTTP with configurable access tiers
• B. File storage, which provides fully managed SMB and NFS file shares organized in a traditional directory and folder structure
• C. Disk storage, which attaches to a single virtual machine
• D. Queue storage, which holds messages for asynchronous processing

16. To reduce the risk of compromised passwords, an organization wants users to confirm sign-in with a second factor such as a phone approval or authenticator code. Which security feature should they enable?

• A. Role-based access control (RBAC)
• B. Availability zones
• C. Multifactor authentication (MFA)
• D. Azure Monitor

17. A company wants to package a microservices application in containers and needs an Azure service that automatically handles orchestration, scaling, and health of those containers across a cluster. Which service should they choose?

• A. Azure Kubernetes Service (AKS)
• B. Azure Blob Storage
• C. Azure Virtual Network
• D. Azure Policy, which enforces governance rules and has no role in running or orchestrating containers

18. A backup application needs to store large numbers of unstructured files (images, logs, and archives) that will be accessed over HTTP and can grow massively over time. Which Azure storage service is the best fit?

• A. Azure SQL Database
• B. Azure Files
• C. Azure Virtual Network
• D. Azure Blob Storage

19. Employees should sign in once and then access many cloud applications without re-entering credentials for each one. Which Microsoft Entra ID (Azure AD) capability provides this?

• A. A resource lock
• B. A network security group
• C. Single sign-on (SSO)
• D. Azure Blob Storage

20. Two virtual machines in the same Azure virtual network need to communicate privately, and you also want to control inbound and outbound traffic to them by port and protocol. Which component filters that traffic?

• A. An availability set
• B. A network security group (NSG)
• C. A storage account
• D. A resource lock, which prevents accidental deletion or modification but does not filter any network traffic

21. An identity service provides single sign-on and multi-factor authentication for cloud applications. Which capability specifically evaluates conditions such as location and device state before granting access?

• A. Network security groups, which filter traffic
• B. Conditional access, which applies policy based on signals evaluated at sign-in
• C. Resource tagging, which labels resources for organization
• D. Role-based access control, which grants permissions to resources once a user is already signed in, not conditions evaluated during sign-in itself

22. Resources must be grouped so they can be deployed, managed and deleted together. Which construct provides this?

• A. A subscription, which is a billing and access-management boundary that contains many resource groups, not a single deletable unit
• B. A management group, which organizes subscriptions
• C. An availability zone, which is a physical location
• D. A resource group, a logical container whose lifecycle can be managed as a unit

23. A team wants to run containerized workloads without managing the underlying virtual machines or orchestration control plane. Which option fits best?

• A. Virtual machines with a container runtime installed and patched manually, leaving the team responsible for the orchestration control plane
• B. A serverless container service where the platform manages the hosting infrastructure and scaling
• C. A self-managed orchestration cluster on virtual machines
• D. A physical server in a colocation facility

24. You need to deploy several Azure resources so they share the same lifecycle and can be deleted together when the project ends. Which Azure construct is designed to be a logical container for resources like this?

• A. An availability zone
• B. A resource group
• C. A subscription
• D. A management group

25. An organization wants to eliminate typed passwords for its Windows-joined laptops while still requiring a device and a biometric or PIN as the sign-in factors. Which Microsoft Entra passwordless method is designed specifically for that device-bound scenario?

• A. Certificate-based authentication, which relies on an X.509 certificate rather than a bound device and biometric
• B. Passwordless sign-in through Microsoft Authenticator, which is designed to work across any platform, not specifically Windows-joined devices
• C. A Temporary Access Pass, a time-limited passcode meant for initial setup or recovery rather than everyday sign-in
• D. Windows Hello for Business, which replaces the password with strong two-factor authentication tied to the device using a biometric or PIN

26. A company wants Azure to resolve its custom domain name to the correct IP address for resources running in a virtual network, without needing to encrypt or tunnel traffic to reach them. Which service performs this specific role?

• A. Azure VPN Gateway, which encrypts traffic between an on-premises network and Azure over the public internet
• B. Azure ExpressRoute, which provides a private connectivity circuit that does not traverse the public internet or resolve any domain names
• C. A network security group, which filters inbound and outbound traffic by port and protocol
• D. Azure DNS, which hosts domain names and resolves them to the correct IP addresses using public or private zones

27. Within one virtual network, an architect wants to place web servers and database servers in separate segments so that access between them can be controlled and organized independently, without creating a second virtual network. What should be created inside the existing VNet?

• A. A second availability zone dedicated to the database servers
• B. A new resource group to logically separate the two tiers
• C. A peering connection to a brand-new virtual network for the database tier, standing up an entirely separate network just to segment two tiers
• D. Subnets, which divide a virtual network's address space into smaller segments that can be controlled and organized independently

28. A team wants to deploy a web application's code and have Azure handle the underlying servers, operating system patching, and built-in autoscaling, with minimal infrastructure configuration. Which application hosting option fits best?

• A. Virtual machines configured manually with a web server installed by the team
• B. Azure App Service, a managed web-hosting platform that handles the servers, OS patching, and autoscaling for the deployed code
• C. A self-managed Kubernetes cluster the team installs, patches, and operates entirely on its own virtual machines, adding cluster administration rather than removing it
• D. Azure Data Box, a physical device for transferring large volumes of data into Azure

29. A team needs to run one isolated container for a short batch job with no orchestration, scaling rules, or cluster to manage, and wants to avoid the operational overhead of a full container orchestrator. Which service fits best?

• A. Azure Kubernetes Service, which manages a full multi-node cluster with orchestration, scaling, and self-healing
• B. Azure Virtual Machine Scale Sets, which manage groups of identical virtual machines
• C. Azure Container Instances, which runs a single container without requiring cluster management or orchestration
• D. Azure Virtual Desktop, which delivers virtualized desktops and applications to users

30. A company needs one storage account that can hold blobs, queues, tables, and file shares, at standard performance and the lowest cost per gigabyte, suitable for most general workloads. Which storage account type should they choose?

• A. Standard general-purpose v2 (StorageV2), Microsoft's recommended account type for most scenarios supporting Blob, Queue, Table, and Azure Files
• B. Premium block blob storage, which uses solid-state drives for low latency and high throughput but only supports LRS or ZRS redundancy at a higher cost
• C. Premium file share storage, optimized for high-throughput file workloads on solid-state drives
• D. Premium page blob storage, optimized for random read/write access patterns such as virtual machine disks

31. A file is moved to the Archive access tier and then a request comes in to read it three hours later. What should the requester expect?

• A. Instant access, since Archive still guarantees millisecond read latency like the online tiers
• B. The file has been permanently deleted, since Archive tier data is documented as unable to be read again once it has been written to that tier
• C. The file must first be rehydrated to an online tier, a process that can take up to about 15 hours before the read completes
• D. The read will succeed instantly but at Hot-tier pricing for that single access

32. An administrator provisions a new Azure virtual machine and accepts the defaults. Beyond the VM itself, which supporting resources does Azure create in the same resource group by default?

• A. A virtual network and network interface, a private IP address, a network security group, and an OS disk
• B. A paired region, a management group, and a separate billing subscription, none of which a single VM deployment creates automatically
• C. An Azure Migrate project and a Data Box order
• D. A Log Analytics workspace and an Application Insights instance

33. A company wants remote employees to access a full Windows desktop and a specific set of line-of-business apps from any personal device, without the company managing the connection broker or gateway infrastructure itself. Which Azure service fits?

• A. Azure Virtual Machine Scale Sets, which scale identical generic server instances behind a load balancer but deliver no desktop experience
• B. Azure Migrate, which assesses on-premises servers for migration readiness
• C. Azure Files, which provides SMB and NFS file shares in the cloud
• D. Azure Virtual Desktop, a desktop and app virtualization service that manages the gateway and broker infrastructure for you

34. A company deploying a new application must choose an Azure region. Which factor should influence that choice, according to Azure's own guidance on selecting a region?

• A. The alphabetical order of the region's display name as it happens to appear in the Azure portal's region picker, which has no bearing on latency, availability, or compliance
• B. Latency to end users, the specific services available in that region, and applicable compliance or data-residency requirements
• C. Whichever region a competitor's application currently uses
• D. The number of resource groups already created in the subscription

35. A virtual machine will run continuously for three years with a stable configuration. Which pricing approach reduces cost most?

• A. Pay-as-you-go pricing for maximum flexibility
• B. A reservation committing to the capacity for a term in exchange for a substantial discount over pay-as-you-go
• C. Spot pricing, which offers the deepest discount
• D. Increasing the virtual machine size to improve efficiency, which raises pay-as-you-go cost further rather than discounting a stable three-year workload

36. A company wants to prevent a critical production resource from being accidentally deleted, even by users who otherwise have permission to delete it. Which feature should they apply?

• A. A resource tag
• B. Azure Advisor
• C. A resource lock (CanNotDelete or ReadOnly)
• D. A management group, which organizes subscriptions for governance but does not itself block deletion

37. A test-taker is unsure whether to leave a hard question blank on the AZ-900 exam. Based on the exam's scoring rules, what is the best strategy?

• A. Always answer every question, because there is no penalty for guessing
• B. Leave hard questions blank to avoid losing points
• C. Answer only questions you are fully certain about
• D. Guessing lowers your score, so it is safer to leave a difficult question completely unanswered instead

38. A governance requirement states that no storage account may be created without encryption enabled. Which tool enforces this at creation time?

• A. Role-based access control, which governs who may perform actions but does not itself inspect or block a specific resource configuration
• B. Policy, which can audit or deny resource configurations that do not comply
• C. A resource lock, which prevents deletion or modification
• D. A cost budget alert, which notifies on spending

39. An organization needs to apply a policy consistently across many subscriptions. Which scope should the assignment target?

• A. A management group containing those subscriptions, so the assignment inherits downward
• B. Each resource group individually, which must be reassigned every time a new resource group or subscription is created
• C. Each individual resource
• D. The tenant's user accounts

40. A service level agreement specifies 99.9 percent monthly availability. Approximately how much downtime does this permit per month?

• A. About 4 hours, a downtime figure that would only be consistent with a much lower availability commitment than 99.9 percent
• B. About 43 minutes
• C. About 7 hours
• D. About 5 minutes

41. An enterprise has dozens of subscriptions and wants to apply the same governance policies and access controls across all of them from a single point. Which construct should they use?

• A. Resource groups
• B. Availability zones
• C. Tags
• D. Management groups

42. A budget is configured on a subscription. What does it do when the threshold is reached?

• A. It triggers alerts and can invoke automated actions, but does not by itself stop resources from running
• B. It immediately shuts down all resources in the subscription the moment the configured threshold is crossed, with no separate automation required
• C. It prevents any further resource creation permanently
• D. It refunds the amount spent above the threshold

43. A critical resource must be protected from accidental deletion even by administrators. What provides this?

• A. Removing delete permissions from every user role, which also blocks legitimate administrators from ever deleting the resource later
• B. Tagging the resource as critical
• C. A resource lock set to prevent deletion, which applies regardless of the principal's permissions until the lock is removed
• D. Enabling diagnostic logging on the resource

44. A finance team wants to set spending thresholds on a subscription and receive alerts when actual or forecasted costs approach a limit. Which Azure capability should they use?

• A. Cost Management budgets and alerts
• B. The Azure Pricing Calculator
• C. A network security group
• D. Availability zones, which provide datacenter-level resilience and have no budgeting or alerting function

45. A preview feature is offered for a service. What should govern its use?

• A. The assumption that preview features carry the exact same service level commitments and long-term support guarantees as generally available features
• B. The expectation that preview features are always free permanently
• C. A requirement to use preview features to receive support
• D. Awareness that preview features are typically excluded from service level agreements and may change or be withdrawn before general availability

46. A composite application depends on three services with individual availability commitments. What is the effective commitment for the application?

• A. Equal to the highest individual commitment, as if the weakest dependency were simply ignored when calculating the combined figure
• B. Equal to the average of the three
• C. Lower than any individual service, since dependent commitments multiply rather than being inherited
• D. Equal to the lowest individual commitment

47. An organization must ensure that no one can create storage accounts outside of approved Azure regions, enforcing this rule automatically at deployment time. Which service enforces such compliance rules?

• A. Azure Advisor
• B. Azure Policy
• C. Azure Monitor
• D. A resource group

48. An administrator wants to manage Azure resources from a browser using a shell that already has Azure CLI and PowerShell tools authenticated and available, without installing anything locally. Which tool provides this?

• A. Azure Monitor
• B. Azure Cloud Shell
• C. Azure Blob Storage
• D. Azure Policy

49. Before committing to spending, a customer wants to compare the monthly cost of running a specific set of Azure services with different regions and configurations. Which free Azure tool should they use?

• A. The Azure Pricing Calculator
• B. Azure Policy
• C. Azure Monitor
• D. Azure Advisor, which gives recommendations on resources you already deployed, not pre-purchase estimates

50. A team wants to define their Azure infrastructure declaratively in a repeatable template so the same environment can be deployed consistently many times. Which Azure-native approach supports this?

• A. Manually clicking through the Azure portal each time
• B. A network security group
• C. Azure Advisor recommendations
• D. Azure Resource Manager (ARM) templates or Bicep

51. An operations team needs to collect metrics and logs from Azure resources and set up alerts when a virtual machine's CPU stays high. Which service is purpose-built for this monitoring?

• A. Azure Monitor
• B. Azure Policy
• C. Azure Blob Storage
• D. A resource lock

52. An administrator needs to know whether a current outage affecting their application is a platform-wide incident or a fault in their own resource. Which two views answer this?

• A. Service health for platform incidents and planned maintenance, and resource health for the status of the specific deployed resource
• B. The pricing calculator for both questions
• C. Cost analysis for platform incidents and budgets for resource status, mixing up two spending tools that report neither incidents nor resource health
• D. Resource tags for platform incidents and locks for resource status

53. A finance team must attribute cloud spending to individual departments. What mechanism supports this?

• A. Resource locks preventing changes to expensive resources, which protects them from deletion but reports nothing about which department incurred the cost
• B. Availability zones separating departmental workloads
• C. Role assignments granting finance read access
• D. Tags applied consistently to resources, surfaced in cost analysis to break spending down by the tagged dimension

54. A cloud admin wants personalized recommendations that improve the reliability, security, performance, and cost-efficiency of their existing Azure resources. Which service provides these recommendations?

• A. Azure Pricing Calculator
• B. Azure Advisor
• C. Azure Virtual Network
• D. A network security group

55. A support plan must include technical support with a response time commitment for production issues. What generally determines the response commitment?

• A. The total monthly spend on the subscription alone, regardless of which support plan was purchased or how severe the case is
• B. The support plan tier purchased together with the severity assigned to the case
• C. The number of resources deployed
• D. The region in which the resources are deployed

56. A monitoring solution must collect metrics and logs and raise alerts. What distinguishes metrics from logs?

• A. Logs are numeric and metrics are textual
• B. Metrics are retained indefinitely while logs are always discarded immediately after collection, regardless of workspace retention settings
• C. The two are the same data presented differently
• D. Metrics are numeric time-series values sampled at intervals, while logs are records of discrete events with richer detail

57. A cloud adoption plan must estimate the cost of a proposed architecture before anything is deployed. Which tool applies?

• A. A pricing calculator where services and configurations are specified to produce an estimate
• B. Cost analysis, which reports on spending already incurred
• C. A budget alert, which notifies when spending on already-deployed resources reaches a threshold, rather than estimating a future architecture
• D. A resource lock, which prevents changes

58. A company already owns Windows Server licenses with active Software Assurance and wants to apply that existing investment toward a discount on Windows virtual machines it plans to run in Azure. Which Azure offering lets them do this?

• A. Azure Hybrid Benefit, which lets eligible on-premises Windows Server licenses with active Software Assurance reduce the cost of Windows VMs in Azure
• B. Azure Spot Virtual Machines, which offer a discount in exchange for the VM being evictable with short notice whenever Azure needs the capacity back for another paying workload
• C. A Reservation, which discounts compute by prepaying for a one- or three-year term regardless of existing licenses
• D. Azure Advisor, which only recommends cost-saving actions without applying any license-based discount itself

59. A governance team wants a policy that automatically deploys a required diagnostic setting onto any resource that is missing one, rather than merely flagging the gap for someone to fix manually. Which Azure Policy effect accomplishes that automatic remediation?

• A. deployIfNotExists, which deploys a related, compliant resource or configuration automatically when the condition is not already met
• B. audit, which only logs a compliance entry without changing or deploying anything
• C. deny, which blocks the noncompliant request outright rather than deploying any missing configuration on the customer's behalf automatically
• D. disabled, which turns off evaluation of the policy entirely

60. An administrator has been enforcing resource configuration rules with Azure Policy and is asked to also build a catalog that shows exactly which datasets contain personal information across the company's databases. Is Azure Policy the right tool for that second task?

• A. No, because no Azure or Microsoft service can catalog personal data across databases
• B. Yes, because Azure Policy's deny effect automatically classifies any data it blocks
• C. No, Azure Policy enforces configuration compliance on resources; cataloging and classifying data inside those resources is Microsoft Purview's role
• D. Yes, because Azure Policy is assumed to already scan the contents of every database for sensitive data as part of its standard built-in effects automatically

61. An administrator opens Azure Resource Health for one specific virtual machine and sees a status of Degraded. What does this status value specifically indicate about that resource, according to Azure's documented Resource Health status values?

• A. The virtual machine has been billed at a discounted rate for the current month
• B. A platform-wide incident is affecting every subscription that uses this region
• C. The virtual machine has been automatically moved to a different availability zone as a side effect of the health check itself, with no change ever requested by the administrator running it
• D. The specific virtual machine is experiencing a known performance or health issue, one of Resource Health's documented status values alongside Available, Unavailable, and Unknown

62. A company commits to a one-year Azure Reservation for a specific VM size instead of paying pay-as-you-go rates. According to Microsoft's documentation, approximately how much could this reduce that VM's compute cost, and what does the reservation NOT cover?

• A. A reduction of about 10 percent, and it also covers the Windows Server software license cost with no separate Hybrid Benefit ever required at any point during the reservation term
• B. No reduction at all, since reservations only affect support plan pricing
• C. A reduction of about 25%, and it fully covers SQL Server licensing as well
• D. A reduction of up to about 72% from pay-as-you-go pricing, but it does not cover Windows Server or SQL Server software license costs, which require Azure Hybrid Benefit separately

63. A manager wants a single, personalized view in the Azure portal that pins the specific resources, charts, and metrics they check every morning, without changing anyone else's view of the portal. What portal feature supports this?

• A. Dashboards, which can be customized and pinned with specific tiles for resources, charts, and metrics, personalized per user
• B. Resource groups, which organize resources for lifecycle management but do not provide a personalized visual layout
• C. Management groups, which organize subscriptions in a governance hierarchy, not a personalized visual dashboard for one specific user
• D. Azure Policy assignments, which enforce configuration rules rather than display personalized information

64. A resource has a ReadOnly lock instead of a CanNotDelete lock. An authorized administrator with Contributor access tries to update one of its settings. What happens?

• A. The update succeeds, since ReadOnly locks only block deletion, not configuration changes
• B. The update succeeds only if the administrator temporarily disables and re-enables their own Contributor role assignment, which is not how locks actually work
• C. The update is blocked, because a ReadOnly lock prevents both deletion and modification, restricting the resource to read access similar to the Reader role
• D. The update succeeds, but a support ticket is automatically opened to review the change

65. A company runs some servers on-premises, some virtual machines in another public cloud, and some in Azure, and wants to apply the same Azure Policy rules, tags, and monitoring to all of them from one place, as if they were all native Azure resources. Which service enables this?

• A. Azure Migrate, which assesses and migrates workloads into Azure but does not manage resources that remain outside Azure
• B. Azure Advisor, which only issues recommendations for resources already running natively in Azure, not resources hosted on-premises or in another cloud provider's own environment
• C. Azure Arc, which projects non-Azure and on-premises resources into Azure Resource Manager so they can be managed with familiar Azure tools like Policy and Monitor
• D. Azure Resource Manager templates, which deploy new Azure resources but do not extend management to resources outside Azure

66. Two identical virtual machines are deployed in different Azure regions and their monthly bills differ even though usage is identical. Which documented cost factor explains this difference?

• A. Consumption, since both VMs consumed the exact same amount of compute
• B. Geography, since pricing varies by region and by billing zone, a grouping of regions used specifically for data-transfer pricing
• C. Azure Marketplace, since the VM images came from the built-in gallery rather than a paid third-party Marketplace listing with its own charge
• D. Maintenance, since Azure charges extra for VMs during a scheduled maintenance window

67. A DevOps engineer already scripts extensively in PowerShell for Windows administration and wants to manage Azure resources using cmdlet-style syntax consistent with that experience, rather than the bash-style syntax of another Azure command-line tool. Which tool should they use?

• A. Azure CLI, which uses a cross-platform, bash-style command syntax rather than the PowerShell cmdlets the engineer already knows well from years of prior Windows scripting
• B. Azure PowerShell, a module of cmdlets that lets you manage Azure resources using PowerShell syntax consistent with existing Windows scripts
• C. AzCopy, a specialized command-line tool only for copying data between storage accounts
• D. The Azure portal, a graphical interface with no scripting syntax at all

68. A startup wants to avoid buying servers and instead pay only for the compute it actually consumes each month, scaling up during traffic spikes and down overnight. Which cloud characteristic does this describe?

• A. A capital expenditure (CapEx) purchasing model
• B. The consumption-based (pay-as-you-go) model
• C. The shared responsibility model
• D. High availability

69. A cloud service is described as multi-tenant. What does this mean for the customer?

• A. Each customer receives dedicated physical hardware by default, which is the single-tenant model multi-tenancy is specifically defined against
• B. Customers can see one another's data
• C. Infrastructure is shared among customers with logical isolation between them, which is what enables the economics of the service
• D. The service can only be used by one organization

70. A workload is migrated unchanged from on-premises virtual machines to cloud virtual machines. What is this approach called and what is its main limitation?

• A. Refactoring, which redesigns the application for cloud-native services
• B. Retirement, which decommissions the workload
• C. Replatforming, which changes the hosting model, such as moving to managed databases, while leaving the application's source code entirely unchanged throughout the whole migration
• D. Lift and shift, which is fast but carries forward the existing architecture and therefore captures little of the platform's cost and scaling benefit

71. An organization must reduce its carbon footprint and cites cloud migration as part of the plan. What is the sustainability argument?

• A. Large providers achieve higher utilization and efficiency per workload than typical on-premises data centres, and publish tooling to measure the resulting emissions
• B. Cloud providers do not use electricity from any grid at all, powering every datacenter entirely off privately generated renewable sources with zero connection whatsoever to any public utility grid
• C. Migration eliminates the need to measure emissions
• D. Cloud workloads consume no energy

72. A finance team wants to stop making large upfront hardware purchases and instead treat their IT spend as a predictable monthly operating cost. Moving to the cloud primarily shifts their spending from what to what?

• A. From operational expenditure (OpEx) to capital expenditure (CapEx)
• B. From fixed cost to a one-time licensing fee
• C. From variable cost to fixed hardware depreciation
• D. From capital expenditure (CapEx) to operational expenditure (OpEx)

73. A team compares infrastructure, platform and software as a service. Which responsibility boundary characterizes platform as a service?

• A. The provider manages the operating system and runtime while the customer manages the application and its data
• B. The customer manages the operating system, runtime, and application entirely, receiving only virtualized hardware from the provider
• C. The provider manages everything including the application
• D. The customer manages only the physical hardware

74. Which statement most accurately distinguishes high availability from disaster recovery as cloud benefits?

• A. High availability keeps a system running through component failures, while disaster recovery restores service after a major outage or region loss
• B. High availability and disaster recovery are identical terms with no practical difference
• C. High availability applies only to storage, and disaster recovery applies only to compute
• D. Disaster recovery is designed to prevent outages entirely before they happen, while high availability is a recovery mechanism used only after data has already been lost

75. An organization shifts from purchasing servers upfront to paying monthly for cloud capacity. How does this change the expenditure classification?

• A. It becomes a fixed cost independent of usage
• B. From capital expenditure on owned assets to operational expenditure consumed as a service
• C. From operational expenditure to capital expenditure, the reverse of the shift that actually happens when adopting cloud services
• D. It remains capital expenditure because the resources are still dedicated

76. A retailer's website automatically adds more web server instances as shopper traffic climbs and removes them as traffic falls, without human intervention. Which two related cloud benefits does this best demonstrate?

• A. Disaster recovery and backup
• B. Data sovereignty and residency
• C. Scalability and elasticity
• D. Manual capacity planning

77. An organization keeps some workloads in its on-premises datacenter for regulatory reasons but bursts to the public cloud during peak demand, connecting the two environments. Which cloud deployment model is this?

• A. Public cloud
• B. Hybrid cloud
• C. Private cloud
• D. Community cloud

78. In the cloud shared responsibility model, which task always remains the customer's responsibility regardless of whether they use IaaS, PaaS, or SaaS?

• A. Maintaining the physical network cabling
• B. Managing and classifying their own data and controlling user access to it
• C. Securing the physical datacenter, hardware, and facility access controls that host every customer's workloads
• D. Patching the underlying host hypervisor

79. Microsoft 365 lets users send email and edit documents in a browser with no operating system or runtime to maintain on the user side. Which cloud service model does this represent?

• A. Platform as a Service (PaaS)
• B. Serverless compute
• C. Software as a Service (SaaS)
• D. Infrastructure as a Service (IaaS)

80. An organization keeps some workloads on-premises and runs others in the cloud with connectivity between them. What deployment model is this?

• A. Hybrid cloud, which combines private and public infrastructure with connectivity between them
• B. Multi-cloud, meaning workloads are deliberately spread across more than one public cloud provider, with no on-premises component
• C. Public cloud only
• D. Private cloud only

81. A company must choose between a public and a private cloud for a workload subject to strict regulatory control over infrastructure. What favours private?

• A. Lower cost than public cloud in all scenarios
• B. Unlimited elastic capacity beyond what was purchased, a public-cloud characteristic that a dedicated private environment specifically does not offer to a single tenant
• C. Elimination of the need for internal operations staff
• D. Direct control over the infrastructure and its physical location, where regulation requires it, accepting higher cost and the loss of elastic scaling

82. A company deploys virtual machines in the cloud and installs, patches, and configures the operating system and applications themselves, while the provider manages the physical hosts. Which cloud service type are they using?

• A. Platform as a Service (PaaS)
• B. Software as a Service (SaaS), where the provider manages the entire application stack for the customer
• C. Function as a Service (FaaS)
• D. Infrastructure as a Service (IaaS)

83. A workload's demand triples during a two-week seasonal peak and returns to baseline afterward. Which cloud characteristic addresses this?

• A. Durability, the assurance that stored data is not lost
• B. Fault tolerance, the ability to continue operating correctly despite the failure of an individual hardware or software component
• C. Governance, the enforcement of organizational policy
• D. Elasticity, the ability to add and remove capacity in response to demand and pay only for what is used

84. A nonprofit needs a shared calendar and email system for 15 staff, wants zero server maintenance, and is comfortable using a vendor's application exactly as it is offered, with no customization of the underlying code. Which cloud service type matches?

• A. Infrastructure as a service, virtual machines the nonprofit would provision and maintain itself
• B. Platform as a service, a hosting platform on which the nonprofit would still need to build its own application
• C. A private cloud deployment, dedicated infrastructure the nonprofit would need to fund and operate
• D. Software as a service, a finished application used as-is with the vendor handling all hosting and maintenance

85. A mobile game's backend traffic can jump from a few hundred to hundreds of thousands of players within an hour whenever the game trends, and the small studio behind it has no staff dedicated to capacity planning. Which service type handles this best?

• A. Infrastructure as a service, which requires the studio to manually provision additional virtual machines as traffic spikes
• B. Platform as a service, whose managed autoscaling absorbs sudden spikes without the studio manually adding capacity
• C. A single fixed-size virtual machine sized for the studio's average, non-trending traffic level
• D. On-premises servers purchased in advance to cover the highest traffic the studio has ever seen

86. A two-person startup has no dedicated operations staff and wants a backend for its mobile app that scales automatically without anyone ever having to size or patch a server. Which cloud service type minimizes their operational burden the most?

• A. A fully managed platform as a service or software as a service backend, so there is no server to size, patch, or operate
• B. Infrastructure as a service virtual machines, which the startup would still need to size, patch, and operate entirely on its own
• C. A self-managed container cluster the startup installs and operates on its own virtual machines
• D. Colocated hardware in a third-party datacenter that the startup still owns and configures

87. A company wants to run a small script that resizes an image the moment it is uploaded, then wants that code to consume zero compute and cost nothing the rest of the time it is idle. Which cloud computing concept describes hosting that fits this need?

• A. A dedicated virtual machine, which keeps a server running and billable continuously whether or not the script is currently executing
• B. Serverless computing, where code runs only in response to an event and the platform scales it to zero when idle
• C. Availability sets, which distribute virtual machine instances across fault domains for resilience
• D. A reserved instance, which commits to paying for a fixed amount of compute for one to three years

88. A team is migrating a legacy Windows application that depends on a specific, unsupported kernel-level driver, so it needs full administrative access to the operating system itself. Which cloud service type must they use?

• A. Platform as a service (PaaS), which abstracts the operating system away from the customer
• B. Software as a service (SaaS), which offers no access to any underlying operating system
• C. Serverless functions, which run short, stateless code snippets without any persistent operating system access at all
• D. Infrastructure as a service (IaaS), which grants the customer full control over the guest operating system

89. An operations team wants to apply the same configuration, monitoring, and automatic deployment approach to every resource, whether it runs in Azure or still on-premises, and wants to do so from a browser, a command line, or an API equally well. Which cloud benefit are they relying on?

• A. Fault tolerance, continuing to operate correctly despite the failure of an individual underlying hardware or software component, unrelated to configuration tooling
• B. Elasticity, automatically matching capacity to demand as it rises and falls
• C. Data residency, guaranteeing that data remains within a specific geographic boundary
• D. Manageability, consistent configuration and the ability to manage resources through multiple interfaces such as the portal, CLI, or APIs

90. A company subscribes to a SaaS helpdesk application. Per the Microsoft shared-responsibility matrix, which two areas remain the customer's responsibility even in a pure SaaS deployment?

• A. The application code and the runtime platform it executes on, both fully managed and updated by the SaaS provider
• B. The physical datacenter and the physical network hardware
• C. Customer data and the identities and user accounts that access the application
• D. The operating system and the hypervisor hosting the service

91. A trading platform cannot tolerate the outage of a single server component, but a brief, planned interruption once a quarter for maintenance is acceptable. Which cloud benefit specifically addresses tolerating component failures during normal operation?

• A. Elastic scaling, automatically adding or removing compute capacity to match changing demand in real time as load rises and falls
• B. Cost predictability, the ability to forecast monthly cloud spend in advance
• C. High availability, keeping a system running and accessible with minimal downtime despite component failures
• D. Data residency, keeping data stored within a specific geographic or legal boundary

92. Under the shared responsibility model, a company runs its ordering application on Azure App Service. According to Microsoft's division-of-responsibility table, who patches the operating system underneath the running app?

• A. The company's IT staff, because every Azure service leaves OS patching with the customer regardless of service model
• B. Microsoft, because App Service is a platform as a service offering where the OS and runtime are Microsoft's responsibility
• C. Neither party, because App Service runs on unpatched, immutable images that are replaced only when redeployed
• D. A third-party contractor, because Microsoft explicitly requires every customer to hire an approved outside vendor for PaaS operating system maintenance

93. A video encoding service currently runs on one large server that is upgraded with more CPU and memory whenever load grows. Migrating to the cloud, the team instead adds more identical server instances behind a load balancer as load grows. What is this second approach called?

• A. Scaling up (vertical scaling), increasing the size or power of a single existing resource
• B. Failover clustering, switching traffic to a passive standby resource only after a failure
• C. Autoscaling down, reducing the number of running instances when demand falls
• D. Scaling out (horizontal scaling), adding more instances of a resource to share the load

94. A hospital system must keep patient records on infrastructure it fully controls for regulatory reasons, accepting the cost of owning and operating that infrastructure itself. Which cloud deployment model matches this requirement?

• A. Public cloud, infrastructure owned by a provider and shared across many unrelated customers
• B. Multi-cloud, spreading workloads across more than one public cloud provider for redundancy
• C. Community cloud, infrastructure shared among several organizations with a common regulatory concern
• D. Private cloud, dedicated infrastructure operated for a single organization with no shared tenancy

95. A development team wants to write and deploy application code without provisioning virtual machines, patching an operating system, or installing a runtime themselves, letting the platform handle scaling automatically. Which cloud service type fits?

• A. Platform as a service (PaaS), where the provider manages the OS and runtime and the customer manages the application and data
• B. Infrastructure as a service (IaaS), where the customer manages the OS, runtime, and application on provisioned virtual machines
• C. Software as a service (SaaS), where the provider delivers a complete, ready-to-use application to end users
• D. On-premises hosting, where the organization owns and operates all hardware and software layers itself

96. An enterprise is migrating a compliance-sensitive, customized ERP system that must run a specific OS build and cannot be adapted to a managed platform's constraints. Which service type gives them the control this migration requires?

• A. Software as a service, since a finished vendor application would replace the need for the custom ERP entirely
• B. Platform as a service, since its managed runtime is assumed to already meet the enterprise's specific compliance-mandated OS build requirement
• C. Function as a service, since triggered functions can host a full ERP system without a persistent server
• D. Infrastructure as a service, since it is the only model granting full control over the OS build and configuration

97. A three-person startup building a public-facing app wants to avoid ever buying a server, needs to scale from zero users to a spike overnight, and has no interest in operating a datacenter. Which cloud deployment model fits best?

• A. Public cloud, where a provider owns and operates shared infrastructure that the startup rents on demand
• B. Private cloud, where infrastructure is dedicated to and operated by the startup alone
• C. Hybrid cloud, where the startup keeps some systems in its own datacenter and connects them to the cloud
• D. On-premises deployment, where the startup installs and runs its own servers in a rented office

98. A student wants to experiment with a handful of Azure services for a class project without entering a credit card commitment beyond initial verification, and expects to spend nothing if usage stays within the free offer. What should they sign up for?

• A. An Azure free account, which includes a time-limited credit plus a set of services that remain free within monthly limits
• B. An Enterprise Agreement, which requires a negotiated minimum annual commitment across an organization
• C. A Cloud Solution Provider subscription, which is sold and billed through a Microsoft partner reseller
• D. A reserved capacity plan, which requires prepaying for a fixed amount of a specific resource over a one- or three-year term

99. To avoid depending on a single vendor's outage or pricing changes, a company deliberately runs part of its workload on Azure and another part on a different public cloud provider, with no on-premises component at all. What is this strategy called?

• A. Hybrid cloud, combining private, on-premises infrastructure with a public cloud provider
• B. Cloud bursting, temporarily overflowing from a private datacenter into the public cloud at peak load
• C. Multi-cloud, deliberately using more than one public cloud provider for the same organization
• D. Community cloud, infrastructure shared among organizations with a common concern

100. A small accounting firm wants browser-based bookkeeping software that requires no installation, receives updates automatically from the vendor, and needs no server of any kind on the firm's side. Which cloud service type are they looking for?

• A. Infrastructure as a service (IaaS), virtual machines the firm would need to configure and maintain itself
• B. Platform as a service (PaaS), a hosting platform on which the firm would still need to deploy its own accounting code
• C. Software as a service (SaaS), a complete, ready-to-use application delivered and maintained entirely by the provider
• D. Function as a service (FaaS), individual pieces of code triggered by specific events