AZ-900 Practice Exam.
Free practice test — 34 verified questions, instant feedback.

Answer: A
The consumption-based model means you pay only for the resources you use, converting large upfront CapEx into variable operating expense (OpEx) and enabling elastic scaling. A CapEx model involves large upfront purchases of hardware, the opposite of what is described. The shared responsibility model defines who secures what, not billing. High availability describes uptime resilience, not payment.

Answer: A
Data, the identities/accounts that access it, and how that data is classified are always the customer's responsibility across every service model. Physical datacenter security, the host hypervisor, and physical networking are always the cloud provider's responsibility in every model. The customer never manages the physical layer in the public cloud.

Answer: A
IaaS gives the customer control over the OS and everything above it (runtime, apps, data) while the provider handles the physical infrastructure and virtualization, which matches managing your own VM OS and patches. PaaS abstracts away the OS so the customer only manages the app and data. SaaS delivers finished applications (e.g., email) with nothing to patch. FaaS runs event-driven code without managing servers at all.

Answer: A
SaaS delivers a complete, ready-to-use application over the internet where the provider manages everything and the customer just uses the software, exactly like hosted email. IaaS would require the customer to manage the OS. PaaS provides a development/hosting platform for the customer's own apps. Serverless is a compute deployment model for running code, not a finished end-user application.

Answer: A
A hybrid cloud combines on-premises/private infrastructure with public cloud, letting workloads and data move between them, which matches keeping some systems local while bursting to public cloud. A pure public cloud has no on-premises component. A private cloud is dedicated to a single organization with no public element. A community cloud is shared among organizations with common concerns, not described here.

Answer: A
Scalability is the ability to add capacity, and elasticity is automatically adding or removing that capacity to match demand, which is exactly what auto-adjusting server counts describes. Disaster recovery concerns recovering after an outage, not scaling to load. Data sovereignty concerns legal jurisdiction over data location. Manual capacity planning is the opposite of the automatic behavior described.

Answer: A
The cloud converts CapEx (large upfront purchases of servers you own and depreciate) into OpEx (ongoing, pay-as-you-go operating expense), which is precisely the finance goal described. The reverse (OpEx to CapEx) is the opposite of the cloud value proposition. A one-time licensing fee and fixed hardware depreciation are CapEx-style concepts, not what the cloud moves you toward.

Answer: A
High availability is about minimizing downtime by tolerating individual component failures, whereas disaster recovery is about recovering after a large-scale failure such as the loss of an entire region. They are complementary but not identical, so the 'no difference' option is wrong. Neither is limited to only storage or only compute. Disaster recovery does not prevent outages; it responds to them, making the last option's roles reversed.

Answer: A
A resource group is a logical container that holds related resources; deleting the group deletes everything in it, matching a shared project lifecycle. An availability zone is a physically separate location within a region for resilience, not a container you manage resources in. A subscription is a billing and access boundary that contains resource groups. A management group organizes multiple subscriptions, a level above what is needed here.

Answer: A
Availability zones are physically separate datacenters within a region, each with independent power, cooling, and networking, so spreading across them protects against a single datacenter failure. Resource groups are logical containers and provide no physical fault isolation. Subscriptions are billing/access boundaries, not fault-isolation constructs. Tags are metadata labels and offer no resilience.

Answer: A
Azure Functions is a serverless compute service that runs small pieces of code triggered by events, billing only for execution time with no server management, matching the requirement exactly. Azure Virtual Machines require you to manage and pay for the server continuously. Blob Storage stores objects and does not run code. A Virtual Network provides networking, not compute.

Answer: A
Azure Kubernetes Service provides managed Kubernetes for orchestrating, scaling, and self-healing containerized workloads across a cluster, which is exactly what container orchestration requires. Blob Storage stores unstructured objects and does not orchestrate containers. A Virtual Network provides connectivity, not container management. Azure Policy enforces governance rules and has no role in running containers.

Answer: A
A network security group contains allow/deny rules that filter inbound and outbound traffic to Azure resources by source, destination, port, and protocol, which is the described requirement. An availability set improves VM resilience but does not filter traffic. A storage account holds data objects, not network rules. A resource lock prevents accidental deletion or modification, unrelated to traffic filtering.

Answer: A
ExpressRoute creates a private connection between on-premises and Azure through a connectivity provider, bypassing the public internet for more reliable throughput and lower latency. A site-to-site VPN does connect networks but travels over the public internet, which the requirement explicitly excludes. A CDN caches content at edge locations for end users. Azure DNS resolves domain names and provides no private WAN link.

Answer: A
Azure Blob Storage is optimized for massive amounts of unstructured object data accessed over HTTP/HTTPS, making it ideal for images, logs, and archives. Azure SQL Database is a relational database for structured, queryable data, not bulk objects. Azure Files provides fully managed SMB/NFS file shares, better for lift-and-shift file shares than internet-scale object storage. A Virtual Network is networking, not storage.

Answer: A
The Archive tier offers the lowest storage cost for rarely accessed, long-retention data in exchange for the highest retrieval latency and cost, matching compliance archives. The Hot tier is optimized for frequently accessed data at higher storage cost. The Cool tier suits infrequently accessed data but is pricier to store than Archive. Premium is for high-throughput, low-latency access, the opposite of the requirement.

Answer: A
Geo-redundant storage replicates data to a secondary region hundreds of miles away, protecting against a full regional outage. Locally redundant storage keeps copies only within a single datacenter, so a regional disaster could lose all copies. Zone-redundant storage spreads copies across zones within one region but does not survive the loss of that whole region. A network security group is a traffic filter, not a storage-redundancy option.

Answer: A
Single sign-on lets a user authenticate once and gain access to multiple applications without repeatedly entering credentials, which is the described experience. A resource lock protects a resource from deletion or change and has nothing to do with authentication. A network security group filters network traffic. Blob Storage stores objects and is unrelated to identity.

Answer: A
Multifactor authentication requires two or more verification factors (something you know plus something you have or are), directly mitigating stolen-password risk. Role-based access control governs what an authenticated user may do, not how they prove identity. Availability zones concern datacenter resilience. Azure Monitor is a telemetry/observability service, unrelated to sign-in verification.

Answer: A
Azure RBAC assigns roles at a chosen scope (management group, subscription, resource group, or resource), so granting a role at one resource group limits the person's permissions to that group. A network security group filters traffic, not user permissions. A tag is metadata and grants no access. MFA verifies identity but does not define what actions a user is authorized to perform.

Answer: A
Azure SQL Database is a fully managed PaaS relational database supporting structured schemas, transactions, and SQL, which matches the requirement. Blob Storage handles unstructured objects, not relational queries. Azure Files provides file shares, not a query engine. Azure Functions is serverless compute for running code, not a database.

Answer: A
A Content Delivery Network caches content at edge locations distributed worldwide so users are served from a nearby point of presence, lowering latency. ExpressRoute is a private WAN link between on-premises and Azure, not a global content cache. Azure Policy enforces governance rules. A resource group is a logical container with no performance role.

Answer: A
The Azure Pricing Calculator lets you model and estimate the cost of a proposed set of services and configurations before deploying anything. Azure Advisor gives recommendations (including cost savings) on resources you already run, not pre-purchase estimates. Azure Monitor collects telemetry from running resources. Azure Policy enforces governance rules, not cost estimation.

Answer: A
Microsoft Cost Management lets you create budgets on scopes such as subscriptions and trigger alerts when spending approaches or exceeds them, matching ongoing cost control. The Pricing Calculator only estimates costs before purchase and cannot alert on live spending. A network security group filters traffic. Availability zones provide resilience, unrelated to budgeting.

Answer: A
Azure Policy evaluates resources against defined rules and can deny non-compliant deployments, such as blocking resources in unapproved regions, enforcing governance automatically. Azure Advisor only recommends improvements; it does not enforce rules. Azure Monitor collects telemetry and does not block deployments. A resource group is a container and enforces no policy by itself.

Answer: A
A resource lock (CanNotDelete or ReadOnly) overrides user permissions to protect a resource from accidental deletion or modification, exactly the safeguard needed. A tag is only descriptive metadata and provides no protection. Azure Advisor gives recommendations, not deletion protection. A management group organizes subscriptions and does not lock individual resources against deletion.

Answer: A
Management groups sit above subscriptions and let you apply policies and access controls to many subscriptions at once through inheritance, matching enterprise-wide governance. Resource groups organize resources within a single subscription, not across subscriptions. Availability zones are physical resilience constructs. Tags are metadata labels and cannot apply governance across subscriptions.

Answer: A
Azure Monitor collects, analyzes, and acts on telemetry (metrics and logs) from Azure resources and can raise alerts on conditions like sustained high CPU. Azure Policy enforces governance rules rather than collecting telemetry. Blob Storage stores objects and provides no monitoring. A resource lock only protects resources from change or deletion.

Answer: A
Azure Advisor analyzes your deployed resources and offers actionable recommendations across reliability, security, performance, operational excellence, and cost, matching the request. The Pricing Calculator only estimates costs of hypothetical deployments. A Virtual Network provides connectivity, not recommendations. A network security group filters traffic and gives no guidance.

Answer: A
Azure Cloud Shell is a browser-based, pre-authenticated shell offering both Bash (Azure CLI) and PowerShell with tools already installed, so no local setup is needed. Azure Policy enforces governance rules, not an interactive shell. Azure Monitor handles telemetry. Blob Storage stores data and is not a management shell.

Answer: A
ARM templates and Bicep are infrastructure-as-code approaches that declaratively define resources so identical environments can be deployed repeatedly and consistently. Manual portal clicks are error-prone and not repeatable, the opposite of the goal. A network security group filters traffic, not deployments. Azure Advisor only offers recommendations and does not deploy infrastructure.

Answer: A
For Fundamentals exams such as AZ-900, the exam duration is 45 minutes, which is the time to answer questions. The 65-minute figure is the total seat duration including administrative time, not the exam duration itself. 90 and 120 minutes are longer than either published value and are incorrect.

Answer: A
There is no penalty for guessing on the exam, so no points are deducted for incorrect answers, meaning you should answer every question to maximize your chance of points. Leaving questions blank guarantees zero for those items. Answering only certain questions wastes potential points. The claim that guessing lowers your score contradicts the no-penalty rule.

Answer: A
Microsoft reports technical exam scores on a scale of 1 to 1,000, and a score of 700 or greater is required to pass. The 700 figure is a scaled score, not a raw percentage of questions answered correctly, so '70% out of 100' is a common misconception. A '1 to 700' scale and a '1 to 100' scale both misstate the reporting range.