AZ-900 sample questions with answers

AZ-900 sample questions

Microsoft Certified: Azure Fundamentals, Microsoft.

1. Question 1

   Domain: Describe cloud concepts

   A small company with no developers needs email, calendaring and a customer relationship management tool. They want to pay a monthly subscription and never patch or upgrade the software themselves.

   Which cloud service type is the most appropriate choice?

   1. Serverless functions
   2. Infrastructure as a service (IaaS)
   3. Platform as a service (PaaS)
   4. Software as a service (SaaS)
   Show the answer

   Answer: D. Software as a service (SaaS)

   When an off-the-shelf application already exists and the organisation only needs to use it, SaaS is the most appropriate model: the provider runs and updates the application and the organisation manages only its data, users and devices. IaaS and PaaS would require the company to build or host the application itself.

   Checked against: https://learn.microsoft.com/en-us/training/modules/describe-cloud-service-types/4-describe-software-service

2. Question 2

   Domain: Describe cloud concepts

   Which statement about a multi-cloud environment is correct?

   1. It is only possible when the organisation owns its own datacenter
   2. It means an organisation uses services from more than one public cloud provider
   3. It is another name for a hybrid cloud
   4. It requires all workloads to run in a single provider's sovereign region
   Show the answer

   Answer: B. It means an organisation uses services from more than one public cloud provider

   Multi-cloud means an organisation uses multiple public cloud providers, for example to use particular services from each or to avoid dependence on one vendor. Hybrid cloud, by contrast, combines a public cloud with private or on-premises infrastructure.

   Checked against: https://learn.microsoft.com/en-us/training/modules/describe-cloud-compute/4-describe-cloud-models

3. Question 3

   Domain: Describe cloud concepts

   A start-up needs to resize images whenever a user uploads a photo. Uploads are sporadic, each job lasts a few seconds, and the team does not want to pay for idle servers or manage operating systems.

   Which compute approach best matches the requirement?

   1. A dedicated physical server in a colocation facility
   2. A Virtual Machine Scale Set with a minimum of two instances
   3. Azure Functions triggered by the upload event
   4. A virtual machine that runs continuously waiting for uploads
   Show the answer

   Answer: C. Azure Functions triggered by the upload event

   An event-driven serverless function runs only when an image is uploaded, scales automatically with the number of uploads and bills only for executions, which is ideal for sporadic, short-lived work. A VM that waits for uploads is billed for every hour it is running, even when idle.

   Checked against: https://learn.microsoft.com/en-us/azure/azure-functions/functions-overview

4. Question 4

   Domain: Describe Azure architecture and services

   What is Microsoft Defender for Cloud?

   1. A VPN client that remote workers install to connect securely from their home devices to Azure virtual networks
   2. A service that encrypts outgoing email messages and attachments so that only the intended recipients can read them
   3. A service that backs up virtual machines and files to a Recovery Services vault on a schedule with long-term retention
   4. A CNAPP providing security posture management and threat protection for Azure, on-premises and multicloud workloads
   Show the answer

   Answer: D. A CNAPP providing security posture management and threat protection for Azure, on-premises and multicloud workloads

   Microsoft Defender for Cloud is a cloud-native application protection platform (CNAPP) that continuously assesses the security posture of your Azure, hybrid and multicloud resources, gives a secure score and recommendations, and provides threat protection for workloads such as servers, storage and databases.

   Checked against: https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction

5. Question 5

   Domain: Describe Azure architecture and services

   A user has been assigned the Owner role on an Azure subscription but cannot create new users in Microsoft Entra ID. The helpdesk is confused because Owner is the most privileged Azure role.

   Which explanation is correct?

   1. Only a Global Administrator can be assigned an Azure RBAC role, so the Owner assignment on the subscription never took effect
   2. The user must wait 24 hours for the Owner role assignment to propagate before any user-creation permissions become active
   3. Azure RBAC roles govern Azure resources, while Entra roles govern directory objects such as users, so Owner cannot create users
   4. Azure RBAC roles apply to both Azure resources and Microsoft Entra directory objects, so the Owner role assignment must have failed
   Show the answer

   Answer: C. Azure RBAC roles govern Azure resources, while Entra roles govern directory objects such as users, so Owner cannot create users

   Azure RBAC and Microsoft Entra roles are separate systems: Azure roles such as Owner govern Azure resources (VMs, storage, networks) at management group, subscription, resource group or resource scope, while Entra roles such as User Administrator govern directory objects. Subscription Owner gives no directory permissions, so the user needs an appropriate Entra role to create users.

   Checked against: https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles

6. Question 6

   Domain: Describe Azure architecture and services

   A company stores nightly backups in Azure Blob Storage. The backups must survive the loss of the entire primary region. Zone-level resilience within the region is not required and cost should be kept moderate.

   Which redundancy option should the company choose?

   1. GZRS
   2. GRS
   3. ZRS
   4. LRS
   Show the answer

   Answer: B. GRS

   Geo-redundant storage (GRS) keeps three copies in the primary region and replicates asynchronously to the paired secondary region, protecting the backups from a regional disaster at lower cost than GZRS. LRS and ZRS keep all copies within the primary region and would be lost in a regional outage.

   Checked against: https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy

7. Question 7

   Domain: Describe Azure architecture and services

   A company has Windows file servers in five branch offices with limited local disk. Users complain that the servers are full, and the IT team wants all shares consolidated in Azure while keeping frequently used files fast to open locally.

   Which service solves the problem?

   1. Azure File Sync
   2. Azure Data Box
   3. Azure Migrate
   4. AzCopy
   Show the answer

   Answer: A. Azure File Sync

   Azure File Sync centralises the file shares in Azure Files while each branch's Windows Server keeps a local cache of frequently used files through cloud tiering, so users get fast local access and the company gets one master copy in the cloud. AzCopy would only copy files once rather than keep servers continuously in sync.

   Checked against: https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-introduction

8. Question 8

   Domain: Describe Azure management and governance

   A CTO wants a single number that summarizes how well the organization's Azure deployments follow Microsoft's best practices, and wants to track it over time.

   What should the team use?

   1. The compliance percentage in Azure Service Health
   2. The Log Analytics workspace retention setting
   3. Advisor score in Azure Advisor
   4. The Azure status page
   Show the answer

   Answer: C. Advisor score in Azure Advisor

   Advisor score aggregates Advisor recommendations into a score that shows how closely your deployments follow best practices, overall and per category, and you can track it over time. Service Health has no best-practice score; it reports platform incidents and planned maintenance.

   Checked against: https://learn.microsoft.com/en-us/azure/advisor/azure-advisor-score

9. Question 9

   Domain: Describe Azure management and governance

   Before blocking anything, the governance team wants to find out how many storage accounts currently allow public blob access, without interrupting deployments during a transition period.

   Which policy effect should they assign first?

   1. Audit
   2. Disabled
   3. DeployIfNotExists
   4. Deny
   Show the answer

   Answer: A. Audit

   The audit effect evaluates resources and flags non-compliant ones in the compliance view without blocking any request, which is ideal for measuring impact first. Deny would immediately reject non-compliant deployments, which is exactly what the team wants to avoid during the transition.

   Checked against: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effect-basics

10. Question 10

    Domain: Describe Azure management and governance

    A security analyst wants to count failed sign-in events across 50 servers over the past 24 hours and join the results with performance data collected from the same machines.

    Which tool should the analyst use?

    1. Metrics explorer, charting a single metric per server
    2. Log Analytics, running KQL queries against a Log Analytics workspace
    3. Azure Service Health, filtered by region
    4. Azure Advisor, filtered to the security category
    Show the answer

    Answer: B. Log Analytics, running KQL queries against a Log Analytics workspace

    Log Analytics is the Azure Monitor tool for writing Kusto Query Language (KQL) queries over log data stored in a Log Analytics workspace, including filtering, aggregating and joining different data sets. Metrics explorer charts numeric time-series metrics and cannot query or join detailed event records like sign-in failures.

    Checked against: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-overview