AZ-900 Practice Test.

Answer: A
The consumption-based model means you pay only for the resources you use, converting large upfront CapEx into variable operating expense (OpEx) and enabling elastic scaling. A CapEx model involves large upfront purchases of hardware, the opposite of what is described. The shared responsibility model defines who secures what, not billing. High availability describes uptime resilience, not payment.

Answer: A
Data, the identities/accounts that access it, and how that data is classified are always the customer's responsibility across every service model. Physical datacenter security, the host hypervisor, and physical networking are always the cloud provider's responsibility in every model. The customer never manages the physical layer in the public cloud.

Answer: A
IaaS gives the customer control over the OS and everything above it (runtime, apps, data) while the provider handles the physical infrastructure and virtualization, which matches managing your own VM OS and patches. PaaS abstracts away the OS so the customer only manages the app and data. SaaS delivers finished applications (e.g., email) with nothing to patch. FaaS runs event-driven code without managing servers at all.

Answer: C
SaaS delivers a complete, ready-to-use application over the internet where the provider manages everything and the customer just uses the software, exactly like hosted email. IaaS would require the customer to manage the OS. PaaS provides a development/hosting platform for the customer's own apps. Serverless is a compute deployment model for running code, not a finished end-user application.

Answer: A
A hybrid cloud combines on-premises/private infrastructure with public cloud, letting workloads and data move between them, which matches keeping some systems local while bursting to public cloud. A pure public cloud has no on-premises component. A private cloud is dedicated to a single organization with no public element. A community cloud is shared among organizations with common concerns, not described here.

Answer: A
Scalability is the ability to add capacity, and elasticity is automatically adding or removing that capacity to match demand, which is exactly what auto-adjusting server counts describes. Disaster recovery concerns recovering after an outage, not scaling to load. Data sovereignty concerns legal jurisdiction over data location. Manual capacity planning is the opposite of the automatic behavior described.

Answer: A
The cloud converts CapEx (large upfront purchases of servers you own and depreciate) into OpEx (ongoing, pay-as-you-go operating expense), which is precisely the finance goal described. The reverse (OpEx to CapEx) is the opposite of the cloud value proposition. A one-time licensing fee and fixed hardware depreciation are CapEx-style concepts, not what the cloud moves you toward.

Answer: A
High availability is about minimizing downtime by tolerating individual component failures, whereas disaster recovery is about recovering after a large-scale failure such as the loss of an entire region. They are complementary but not identical, so the 'no difference' option is wrong. Neither is limited to only storage or only compute. Disaster recovery does not prevent outages; it responds to them, making the last option's roles reversed.

Answer: A
A resource group is a logical container that holds related resources; deleting the group deletes everything in it, matching a shared project lifecycle. An availability zone is a physically separate location within a region for resilience, not a container you manage resources in. A subscription is a billing and access boundary that contains resource groups. A management group organizes multiple subscriptions, a level above what is needed here.

Answer: D
Availability zones are physically separate datacenters within a region, each with independent power, cooling, and networking, so spreading across them protects against a single datacenter failure. Resource groups are logical containers and provide no physical fault isolation. Subscriptions are billing/access boundaries, not fault-isolation constructs. Tags are metadata labels and offer no resilience.

Answer: A
Azure Functions is a serverless compute service that runs small pieces of code triggered by events, billing only for execution time with no server management, matching the requirement exactly. Azure Virtual Machines require you to manage and pay for the server continuously. Blob Storage stores objects and does not run code. A Virtual Network provides networking, not compute.

Answer: A
Azure Kubernetes Service provides managed Kubernetes for orchestrating, scaling, and self-healing containerized workloads across a cluster, which is exactly what container orchestration requires. Blob Storage stores unstructured objects and does not orchestrate containers. A Virtual Network provides connectivity, not container management. Azure Policy enforces governance rules and has no role in running containers.

Answer: A
A network security group contains allow/deny rules that filter inbound and outbound traffic to Azure resources by source, destination, port, and protocol, which is the described requirement. An availability set improves VM resilience but does not filter traffic. A storage account holds data objects, not network rules. A resource lock prevents accidental deletion or modification, unrelated to traffic filtering.

Answer: A
ExpressRoute creates a private connection between on-premises and Azure through a connectivity provider, bypassing the public internet for more reliable throughput and lower latency. A site-to-site VPN does connect networks but travels over the public internet, which the requirement explicitly excludes. A CDN caches content at edge locations for end users. Azure DNS resolves domain names and provides no private WAN link.

Answer: A
Azure Blob Storage is optimized for massive amounts of unstructured object data accessed over HTTP/HTTPS, making it ideal for images, logs, and archives. Azure SQL Database is a relational database for structured, queryable data, not bulk objects. Azure Files provides fully managed SMB/NFS file shares, better for lift-and-shift file shares than internet-scale object storage. A Virtual Network is networking, not storage.

Answer: A
The Archive tier offers the lowest storage cost for rarely accessed, long-retention data in exchange for the highest retrieval latency and cost, matching compliance archives. The Hot tier is optimized for frequently accessed data at higher storage cost. The Cool tier suits infrequently accessed data but is pricier to store than Archive. Premium is for high-throughput, low-latency access, the opposite of the requirement.

Answer: A
Geo-redundant storage replicates data to a secondary region hundreds of miles away, protecting against a full regional outage. Locally redundant storage keeps copies only within a single datacenter, so a regional disaster could lose all copies. Zone-redundant storage spreads copies across zones within one region but does not survive the loss of that whole region. A network security group is a traffic filter, not a storage-redundancy option.

Answer: A
Single sign-on lets a user authenticate once and gain access to multiple applications without repeatedly entering credentials, which is the described experience. A resource lock protects a resource from deletion or change and has nothing to do with authentication. A network security group filters network traffic. Blob Storage stores objects and is unrelated to identity.

Answer: C
Multifactor authentication requires two or more verification factors (something you know plus something you have or are), directly mitigating stolen-password risk. Role-based access control governs what an authenticated user may do, not how they prove identity. Availability zones concern datacenter resilience. Azure Monitor is a telemetry/observability service, unrelated to sign-in verification.

Answer: A
Azure RBAC assigns roles at a chosen scope (management group, subscription, resource group, or resource), so granting a role at one resource group limits the person's permissions to that group. A network security group filters traffic, not user permissions. A tag is metadata and grants no access. MFA verifies identity but does not define what actions a user is authorized to perform.

Answer: A
Azure SQL Database is a fully managed PaaS relational database supporting structured schemas, transactions, and SQL, which matches the requirement. Blob Storage handles unstructured objects, not relational queries. Azure Files provides file shares, not a query engine. Azure Functions is serverless compute for running code, not a database.

Answer: A
A Content Delivery Network caches content at edge locations distributed worldwide so users are served from a nearby point of presence, lowering latency. ExpressRoute is a private WAN link between on-premises and Azure, not a global content cache. Azure Policy enforces governance rules. A resource group is a logical container with no performance role.

Answer: D
The Azure Pricing Calculator lets you model and estimate the cost of a proposed set of services and configurations before deploying anything. Azure Advisor gives recommendations (including cost savings) on resources you already run, not pre-purchase estimates. Azure Monitor collects telemetry from running resources. Azure Policy enforces governance rules, not cost estimation.

Answer: A
Microsoft Cost Management lets you create budgets on scopes such as subscriptions and trigger alerts when spending approaches or exceeds them, matching ongoing cost control. The Pricing Calculator only estimates costs before purchase and cannot alert on live spending. A network security group filters traffic. Availability zones provide resilience, unrelated to budgeting.

Answer: A
Azure Policy evaluates resources against defined rules and can deny non-compliant deployments, such as blocking resources in unapproved regions, enforcing governance automatically. Azure Advisor only recommends improvements; it does not enforce rules. Azure Monitor collects telemetry and does not block deployments. A resource group is a container and enforces no policy by itself.

Answer: A
A resource lock (CanNotDelete or ReadOnly) overrides user permissions to protect a resource from accidental deletion or modification, exactly the safeguard needed. A tag is only descriptive metadata and provides no protection. Azure Advisor gives recommendations, not deletion protection. A management group organizes subscriptions and does not lock individual resources against deletion.

Answer: A
Management groups sit above subscriptions and let you apply policies and access controls to many subscriptions at once through inheritance, matching enterprise-wide governance. Resource groups organize resources within a single subscription, not across subscriptions. Availability zones are physical resilience constructs. Tags are metadata labels and cannot apply governance across subscriptions.

Answer: A
Azure Monitor collects, analyzes, and acts on telemetry (metrics and logs) from Azure resources and can raise alerts on conditions like sustained high CPU. Azure Policy enforces governance rules rather than collecting telemetry. Blob Storage stores objects and provides no monitoring. A resource lock only protects resources from change or deletion.

Answer: A
Azure Advisor analyzes your deployed resources and offers actionable recommendations across reliability, security, performance, operational excellence, and cost, matching the request. The Pricing Calculator only estimates costs of hypothetical deployments. A Virtual Network provides connectivity, not recommendations. A network security group filters traffic and gives no guidance.

Answer: D
Azure Cloud Shell is a browser-based, pre-authenticated shell offering both Bash (Azure CLI) and PowerShell with tools already installed, so no local setup is needed. Azure Policy enforces governance rules, not an interactive shell. Azure Monitor handles telemetry. Blob Storage stores data and is not a management shell.

Answer: A
ARM templates and Bicep are infrastructure-as-code approaches that declaratively define resources so identical environments can be deployed repeatedly and consistently. Manual portal clicks are error-prone and not repeatable, the opposite of the goal. A network security group filters traffic, not deployments. Azure Advisor only offers recommendations and does not deploy infrastructure.

Answer: A
There is no penalty for guessing on the exam, so no points are deducted for incorrect answers, meaning you should answer every question to maximize your chance of points. Leaving questions blank guarantees zero for those items. Answering only certain questions wastes potential points. The claim that guessing lowers your score contradicts the no-penalty rule.

Answer: A
A 30-day month contains 43,200 minutes, and 0.1 percent of that is roughly 43 minutes. Each additional nine divides the allowance by ten, so 99.99 percent permits about four minutes and 99 percent permits about seven hours, which is why the number of nines matters far more than it appears.

Answer: C
Capital expenditure buys an asset upfront and depreciates it, while operational expenditure is consumed and expensed as incurred, which is the accounting shift cloud adoption produces. The practical consequence is that cost tracks usage rather than being committed years in advance, which changes both the financial risk profile and who can approve spending.

Answer: A
Elasticity is specifically about capacity following demand in both directions, which is what makes seasonal peaks affordable rather than requiring year-round provisioning for the peak. Scalability describes the ability to grow, while elasticity adds the automatic contraction that produces the cost benefit.

Answer: A
The boundary rises through the models: infrastructure leaves the guest operating system with the customer, platform lifts the operating system and runtime to the provider, and software leaves only data and access configuration with the customer. Data and identity remain customer responsibilities in every model, which is the part most often assumed to have transferred.

Answer: B
Hybrid describes the combination of private and public infrastructure operating together, commonly adopted where regulation, latency or existing investment keeps some workloads local. Multi-cloud is the distinct arrangement of using more than one public provider, and an organization can be both hybrid and multi-cloud simultaneously.

Answer: A
Pairing provides geographic separation within a data residency boundary and ensures platform maintenance does not affect both regions at once, which protects against an update causing correlated failure. Replication still requires explicit configuration per service, since pairing describes platform behaviour rather than automatically copying customer resources.

Answer: A
The hierarchy runs management group, subscription, resource group, resource, with each level providing a scope for policy and access assignment. Resource groups are the working unit for lifecycle management, and deleting one removes everything inside it, which is why grouping resources by shared lifecycle rather than by type is the usual practice.

Answer: A
Assignments inherit down the hierarchy, so targeting a management group applies the policy to every subscription beneath it and to subscriptions added later. Assigning individually at each resource group means new scopes are missed until someone remembers, which is precisely the drift the hierarchy exists to prevent.

Answer: A
Policy evaluates resource properties and can deny non-compliant creation or flag existing resources for remediation, which is a different question from who is permitted to act. Role-based access control answers who, policy answers what configuration is acceptable, and both are needed since an authorized user can still create a misconfigured resource.

Answer: A
Locks operate independently of permissions and must be explicitly removed before the protected operation succeeds, which introduces the deliberate step that prevents accidents. Tags are metadata carrying no enforcement, and stripping delete permissions from all roles would also prevent legitimate lifecycle management.

Answer: A
Tags carry the business metadata that the platform has no other way to know, such as which cost centre owns a resource, and cost analysis groups by them. Their value depends entirely on consistency, which is why policy is commonly used to require specific tags at creation rather than relying on convention.

Answer: A
Budgets are a monitoring and notification construct, so treating one as a hard spending cap is a common and expensive misunderstanding. Automated action groups can be attached to stop or scale resources on a threshold, but that behaviour must be built deliberately rather than being implied by setting a budget.

Answer: A
Reservations reward predictable long-running usage with a term commitment, which fits a workload known to run continuously. Spot pricing is deeper but the capacity can be reclaimed, making it unsuitable for a workload that must stay running, and licence benefits can stack on top of a reservation for further savings.

Answer: A
Hard dependencies multiply, so three services at 99.9 percent yield roughly 99.7 percent combined, which is worse than the weakest link alone. Adding redundancy within a tier or designing the application to degrade gracefully when a dependency fails are the ways to raise the composite figure.

Answer: A
Preview features exist for evaluation and feedback, so building a production dependency on one accepts the risk of breaking changes and no availability commitment. The distinction between public and private preview affects who may access the feature, but neither carries the guarantees of general availability.

Answer: A
Blob storage suits unstructured data such as images, backups and logs, with hot, cool and archive tiers trading retrieval cost and latency against storage price. File storage provides a mountable share, disks attach to virtual machines and queues carry messages, so each of the four addresses a distinct access pattern.

Answer: A
The trade across container hosting options is control versus operational burden, with self-managed clusters offering the most control and the most work. Serverless container hosting removes node management and patching entirely, which suits teams whose requirements fit its constraints and who do not need cluster-level customization.

Answer: A
Peering creates private connectivity between virtual networks with low latency, and address spaces must not overlap for it to work. It is not transitive by default, so peering A to B and B to C does not connect A to C without a hub arrangement using a gateway or firewall to route between spokes.

Answer: B
Conditional access sits at the authentication decision point and can require additional verification, restrict access or block outright based on signals such as risk, location and device compliance. Role-based access control governs what an authenticated identity may do afterward, so the two apply at different stages of the same request.

Answer: A
Managed identities remove credential handling from the application entirely, since the platform provisions the identity and rotates its secrets without exposing them. Every stored key is a rotation obligation and a leak risk, which is why eliminating the credential is preferable to protecting it.

Answer: C
Region selection is what determines where data physically resides, and services differ in whether they are regional, geography-bound or global. Verifying the residency behaviour of every service in an architecture matters because one global service can move data outside the intended boundary while every other component is compliant.

Answer: D
Service health reports incidents, planned maintenance and health advisories affecting the platform in the regions and services a subscription uses, while resource health reports whether an individual resource is degraded and why. Separating the two prevents a team from investigating their own configuration during a platform incident, and health alerts can be configured so the notification arrives before users report the problem.

Answer: A
Metrics suit alerting and trend analysis because they are lightweight and uniformly structured, while logs carry the detail needed to explain why a metric moved. Effective investigation typically starts from a metric anomaly and moves to logs for the explanation, which is why both are collected rather than choosing between them.

Answer: A
The pricing calculator models a hypothetical deployment while cost analysis reports on actual consumption, so the two are used at different points. A total cost of ownership calculator additionally compares against the fully loaded cost of running on-premises, which includes facilities, power and staff that a like-for-like resource comparison omits.

Answer: A
Availability sets protect against rack-level and update-domain failures within one data centre, whereas zones extend the protection to a facility outage by using physically separate locations. Backups enable recovery rather than continuity, so they address a different objective measured in restore time rather than uptime.

Answer: B
The argument rests on utilization and facility efficiency rather than on energy disappearing, since consolidating many underutilized servers onto shared infrastructure raises the useful work per unit of energy. Measurement remains necessary, and right-sizing and shutting down idle resources contribute more than migration alone.

Answer: A
Lift and shift minimizes migration risk and time while leaving the workload provisioned as it was, so a system sized for peak on-premises stays sized for peak in the cloud. Replatforming and refactoring capture more benefit at higher effort, and choosing between them per workload rather than uniformly is what makes a migration programme efficient.

Answer: A
Designing an architecture that depends on exceeding a hard limit fails regardless of budget, so the limit type is a design-time constraint rather than an operational nuisance. Quota increases for soft limits take time to process, which means discovering the need during a launch rather than during design causes avoidable delay.

Answer: A
Response commitments are a function of the purchased tier and the case severity, so a production-down issue on a higher tier receives faster commitments than a general question on a basic plan. Assigning severity accurately matters, since understating it delays the response and overstating it on non-critical issues undermines the process.

Answer: A
Sharing infrastructure across customers with enforced logical isolation is what produces the utilization economics that make cloud pricing possible. Dedicated hosting is available where regulation or licensing requires physical isolation, and it costs more precisely because it forgoes that sharing.

Answer: A
Private cloud trades the economics and elasticity of shared infrastructure for control, which is a legitimate choice where regulation demands it. Capacity remains bounded by what was purchased, and the operational burden stays with the organization rather than moving to a provider.