Microsoft
Microsoft Azure Fundamentals (AZ-900)
Question 1 of 280For the highest SLA/availability for Azure virtual machines, which deployment strategy is best?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Deploying two or more virtual machines across different availability zones within the same region.
Deploying two or more virtual machines across different availability zones provides the highest SLA because zones are physically separated locations with independent power and cooling. Availability sets only protect against local hardware failures within a single datacenter.
Question 2 of 280Which three stages are commonly used in the Azure service lifecycle?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Private Preview, Public Preview, and General Availability
The standard Azure product lifecycle progresses from private preview to public preview and finally general availability. During preview phases, services lack formal support and service level agreements until they reach general availability.
Question 3 of 280Which Azure service provides personalized recommendations to help you reduce costs on your subscription?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Azure Advisor
Azure Advisor evaluates your deployed resources and offers personalized recommendations across cost, security, and reliability. Service Health tracks outages, whereas Defender focuses entirely on security threats.
Question 4 of 280Which cloud service model is a virtual machine (VM) most directly an example of?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Infrastructure as a Service (IaaS)
Virtual machines are the classic example of infrastructure as a service because you manage the operating system and applications. Platform as a service abstracts the operating system layer entirely away from you.
Question 5 of 280Which Azure feature lets you organize multiple subscriptions into a hierarchy for centralized governance, policy enforcement, and access management?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Management Groups
Management groups provide a level of scope above subscriptions, allowing you to efficiently manage access, policies, and compliance across multiple subscriptions. Resource groups are used to group resources within a single subscription, rather than managing multiple subscriptions.
Question 6 of 280Which Microsoft service provides 'Pipelines' to automate building, running tests, and deploying code from a repository to Azure?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Azure DevOps
Azure DevOps is a Microsoft service that provides pipelines for continuous integration and continuous deployment to automate building, testing, and deploying code. While GitHub offers similar actions, Azure Pipelines is the specific feature highlighted here.
Question 7 of 280Which Microsoft Entra ID feature provides an additional sign-in factor - often using a mobile phone (for example, the Microsoft Authenticator app) - to verify a user's identity when they sign in?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Multi-Factor Authentication
Multi-Factor Authentication adds a crucial layer of security by requiring users to provide two or more verification methods during sign-in. Microsoft Defender for Cloud focuses on infrastructure security rather than individual identity verification.
Question 8 of 280A company is migrating its workloads to Azure to reduce the risk of downtime caused by hardware failures. Which benefit of cloud computing does this scenario demonstrate?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. High availability and fault tolerance
The correct answer works because migrating to cloud services provides high availability and fault tolerance through redundant architectures. Elasticity involves scaling resources up or down to meet demand, which does not directly address hardware failure resiliency.
Question 9 of 280Which type of container does Azure Monitor use to collect and store log (telemetry) data from multiple Azure resources?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Log Analytics Workspace
Azure Monitor uses a Log Analytics workspace as the primary container to ingest and store log data from various resources. Append Blob Storage is typically used for append operations like logging, but it is not the integrated container for Azure Monitor telemetry.
Question 10 of 280Which cloud service model best describes Microsoft Outlook as delivered through Microsoft 365 (web and desktop clients)?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Software as a Service (SaaS)
Microsoft Outlook via Microsoft 365 is a fully managed application hosted by a provider and accessed over the internet, defining Software as a Service. Infrastructure and Platform as a Service require the customer to manage the operating system or application development.
Question 11 of 280Which of the following best describes a Distributed Denial of Service (DDoS) attack? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. A denial of service attack that sends so much traffic to a network that it cannot respond fast enough; legitimate users become unable to use the service
A Distributed Denial of Service attack floods a network with malicious traffic, exhausting resources so legitimate users cannot access the service. Exam questions about overwhelming traffic point to DDoS, unlike brute force password guessing.
Question 12 of 280Which cloud deployment model describes using Azure as an extension of your on-premises data center to provide additional storage or services while most resources remain on-premises?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Hybrid cloud
A hybrid cloud seamlessly integrates on-premises private infrastructure with public cloud resources. This model allows organizations to retain sensitive data locally while leveraging public cloud scalability. Public or private models alone do not provide this combined flexibility.
Question 13 of 280Which Azure service should an IT administrator use to enforce multi-factor authentication (MFA) and control access to an application?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Microsoft Entra ID
Microsoft Entra ID is the core identity and access management service used to secure applications and enforce multi-factor authentication. The other listed options are either distractors or compute services that lack native enterprise identity management features.
Question 14 of 280When creating a Site-to-Site VPN between Azure and your on-premises network, what type of device must be present in your on-premises infrastructure to terminate the VPN connection?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. A compatible VPN Gateway device
A site-to-site VPN requires a compatible VPN device on-premises to establish the encrypted IPsec tunnel. The other choices are either purely Azure-based resources or do not handle routing and encrypted traffic termination.
Question 15 of 280Which Azure service centralizes telemetry and log data from multiple resources so you can run queries, visualize results, and create alerts on events?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Azure Monitor
Azure Monitor acts as the central pipeline for collecting logs and metrics across your subscriptions. Defender for Cloud is strictly for security posture management, while the portal dashboard just displays visual widgets.
Question 16 of 280Which of the following is the primary graphical user interface for managing Azure resources?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Azure Portal
The Azure Portal serves as the primary web-based graphical interface for deploying and managing resources. PowerShell and the CLI are text-based alternatives, while Storage Explorer handles only storage data.
Question 17 of 280Which Microsoft tool helps you assess and track your organization's compliance with international standards and government regulations (for example, GDPR or ISO/IEC 27001)?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Purview Compliance Manager
Microsoft Purview Compliance Manager helps track compliance progress and complete corrective actions. The Service Trust Portal only provides compliance documentation, rather than interactive assessment and tracking capabilities.
Question 18 of 280Your organization has specific compliance requirements that are not covered by Azure's built-in policy definitions. What should you do to enforce your organization's own rules?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Create and assign a custom policy definition in Azure Policy.
Creating a custom Azure Policy definition lets you enforce specific organizational rules that built-in policies do not cover. Resource locks prevent accidental deletion but cannot evaluate resource properties for compliance.
Question 19 of 280When you sign up for a new Azure Free account, how much initial credit (USD) does Microsoft provide for use during the trial period?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. The default is US$200
New Azure free accounts receive a two hundred USD credit to spend during the first thirty days. Microsoft also provides a year of popular free services, but the initial spending limit is specifically this credit amount.
Question 20 of 280Your company wants employees to sign in once and then access multiple Microsoft 365 and Azure applications without re-entering their credentials. Which Azure feature should the company implement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Microsoft Entra ID Single Sign-On (SSO)
Microsoft Entra ID Single Sign On allows users to authenticate once and access multiple applications seamlessly. Policy enforces compliance rules, Key Vault manages secrets, and Defender for Cloud handles security postures.
Question 21 of 280Your company uses Microsoft Entra ID (tenant) to manage access to Azure resources. The IT department wants to separate billing, permissions, and resource limits for different business units within the same organization. What should they do?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Create multiple subscriptions under the same tenant.
Creating multiple subscriptions under the same tenant perfectly separates billing and access limits. Resource groups only organize resources logically within a subscription and do not provide separate billing boundaries.
Question 22 of 280In the context of Azure cloud services, which statement best defines 'compute resources'?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. They are resources that execute tasks requiring CPU cycles.
Compute resources provide the processing power required to run applications and handle computational workloads, executing code and performing calculations. Virtual machines are one example, but the term compute also includes other services that provide CPU cycles.
Question 23 of 280Which Azure service provides a managed Apache Hadoop-based platform for big data analytics?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. HDInsight
Azure HDInsight is the managed cloud service that provides open-source big data frameworks like Apache Hadoop, Spark, and Storm. Azure Data Factory is primarily a data integration service used for orchestration rather than hosting the analytics clusters.
Question 24 of 280Azure Logic Apps and Azure Functions are examples of which compute model in Azure? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Serverless model
Azure Logic Apps and Azure Functions are both core examples of the serverless compute model in Azure. For the exam, associate serverless with automatic scaling and paying only for execution time rather than provisioning virtual machines.
Question 25 of 280An administrator prefers to manage Azure resources through a web-based graphical interface rather than using command-line tools. Which tool should they use? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Azure Portal
The Azure Portal provides a graphical web interface for managing resources visually. If an exam scenario specifically asks for a web-based graphical interface, always choose the Portal over command-line tools like Azure CLI or Azure PowerShell.
Question 26 of 280Which Azure feature provides a basic, per-subnet method to protect an Azure Virtual Network subnet by controlling inbound and outbound network traffic?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. Network Security Group
Network Security Groups provide basic traffic filtering by allowing or denying rules to a subnet. Azure Firewall offers advanced features, but NSG is the correct answer when the question specifies basic per-subnet traffic control.
Question 27 of 280Which Azure service is the primary identity and authentication platform?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Microsoft Entra ID (formerly Azure Active Directory)
Microsoft Entra ID, formerly known as Azure Active Directory, is the primary identity and authentication platform. A Network Security Group handles traffic filtering, not authentication, making it a distractor when evaluating identity questions.
Question 28 of 280Which statement best describes the primary benefit of a Content Delivery Network (CDN) in cloud computing? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. It mitigates server load for static, unchanging files like images, videos, and PDFs by distributing them across a network of servers.
A Content Delivery Network mitigates server load and improves performance by caching static files like images across globally distributed servers. Do not confuse this with caching session data, which describes Redis Cache instead.
Question 29 of 280A developer wants to deploy a custom web application without managing the underlying operating system or web server. Which Azure service model best meets this requirement?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Platform as a Service (PaaS)
Platform as a Service provides a managed hosting environment where the cloud provider maintains the underlying operating system and infrastructure. Software as a Service refers to using finished applications, not deploying custom code to a managed platform.
Question 30 of 280You plan to deploy a critical application on Azure and must design for high availability and reliability. Which of the following statements about Azure Service Level Agreements (SLAs) is correct and should be considered when designing your solution?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. SLAs vary by service and can include guarantees for uptime, performance, and connectivity.
Azure Service Level Agreements define specific uptime and performance guarantees that vary across different Azure services. Architects must combine multiple services strategically to achieve their required composite availability. No single universal uptime percentage applies to every service.
Question 31 of 280Which of the following is a characteristic of the Azure Blob Storage cool access tier?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Much cheaper to store your files than the hot access tier
The cool access tier offers a lower storage price compared to the hot tier, making it ideal for infrequently accessed data. However, it incurs higher access and retrieval fees. The archive tier provides the longest retrieval delays, not the cool tier.
Question 32 of 280A company is moving from on-premises servers to Azure. They want to avoid large upfront hardware purchases and only pay for the resources they actually use. Which benefit of cloud computing does this describe?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Capital expenditure reduction (CapEx to OpEx)
Shifting from upfront capital expenses to ongoing operational expenses allows businesses to pay only for consumed resources over time. Elasticity refers to automatically scaling resources dynamically based on current demand, rather than changing financial models.
Question 33 of 280What is a primary benefit of choosing a consumption-based (pay-per-use) pricing model instead of a time-based (hourly or always-on) pricing model for cloud services?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Significant cost savings when the resources aren't needed for constant use.
A consumption-based model eliminates ongoing charges during idle periods, providing significant cost savings for workloads with unpredictable usage. However, time-based reserved instances often remain cheaper for continuous, steady-state workloads running constantly throughout the year.
Question 34 of 280Which statement correctly describes the difference between the public cloud and the private cloud deployment models?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. A public cloud is available to the general public or a large industry group and is owned by a cloud service provider, while a private cloud is owned and operated by a single organization for exclusive use.
A public cloud delivers computing services over the internet for shared use, whereas a private cloud dedicates infrastructure exclusively to one organization. This exclusivity provides greater internal control for security compliance compared to multi-tenant public environments.
Question 35 of 280You discover an Azure service labeled 'private preview'. Which of the following statements about services in private preview is true?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. Access to services in private preview mode is limited and usually requires approval from Microsoft or an invitation.
Private previews restrict access to invited testers who agree to specific terms before evaluating unreleased features. Services in preview lack formal guarantees and should never be deployed within critical production environments due to potential instability.
Question 36 of 280In the Azure shared responsibility model, who is responsible for securing the access keys (account keys) for your Azure Storage account?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: B. I am responsible for securing the access keys
The customer is always responsible for managing and securing their own service credentials, including storage account access keys. Microsoft secures the underlying physical infrastructure, but you must rotate and protect your keys.
Question 37 of 280Which Azure service provides a centralized security dashboard that consolidates cloud security posture, recommendations, and threat protection for Azure resources?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Microsoft Defender for Cloud
Microsoft Defender for Cloud is the unified security management system that provides a centralized dashboard for security posture and threat protection. Azure Monitor tracks operational health, while Key Vault secures secrets rather than scanning for threats.
Question 38 of 280Which of the following is an essential design principle for achieving high availability in a cloud computing environment?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. The system must be designed for resilience, with no single points of failure.
Designing for resilience and eliminating single points of failure is the fundamental principle of high availability. Option A is too specific, while demanding one hundred percent uptime is impossible due to planned maintenance.
Question 39 of 280Can you grant someone access to your Azure subscription without sharing your username and password (for example, by assigning them a role through Microsoft Entra ID and role-based access control)?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. YES
You can grant access by assigning users or groups to specific roles using role-based access control. This principle ensures users receive only the permissions necessary for their tasks without sharing credentials.
Question 40 of 280Your organization has an Azure Policy that restricts which virtual machine SKUs/sizes can be deployed. Which of the following actions would allow you to create a VM that the policy currently blocks? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. The only way is to remove the policy, create the resource and add the policy back
Azure Policy evaluates resources during creation, meaning even an Owner cannot bypass a deny assignment. To deploy the blocked virtual machine, you must remove or exclude the policy. Owners do not override policy enforcement, making that choice a trap.
Question 41 of 280Which of the following Azure actions is most likely to produce the most immediate reduction in your Azure costs? Correct answer
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Using Azure Reserved Instances for most of your virtual machines
Using Azure Reserved Instances provides a significant discount compared to pay-as-you-go pricing, generating the largest immediate cost reduction for steady virtual machine workloads. Auto-shutdown helps dev environments but saves less than reservations.
Question 42 of 280In Azure high-availability design, what is the primary purpose of Availability Zones?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. They allow manual selection of data centers for virtual machine placement to achieve superior availability compared to other options.
Availability Zones are distinct physical datacenters within a single Azure region, protecting applications from localized facility failures. Resource groups act as logical containers for organizing resources, while regions define entirely separate geographic areas.
Question 43 of 280You subscribe to Azure DDoS Protection at the IP protection tier (DDoS Protection Standard), which provides advanced protection for public IPs. Which type of DDoS attack is NOT mitigated by this service?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. Application (L7) level attacks
Azure DDoS Protection at the network layer mitigates layer three and four volumetric attacks. It does not stop application layer attacks, which require a Web Application Firewall to inspect HTTP traffic and block exploits like SQL injection.
Question 44 of 280Which Azure service provides a fully managed, hosted relational SQL database (Platform as a Service)?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Azure SQL Database
Azure SQL Database is a fully managed Platform as a Service relational database. SQL Server in a virtual machine is Infrastructure as a Service, while Cosmos DB and Table Storage are non relational database services.
Question 45 of 280Under typical/default Azure service limits, what is the maximum number of virtual machines that can be included in a single Azure Virtual Machine Scale Set (VMSS)?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: D. 1000
A virtual machine scale set can support up to one thousand instances when using Azure Marketplace images. If an exam asks about scale set limits, remember that custom images reduce this maximum limit to six hundred instances.
Question 46 of 280Your company stores data in Azure Blob Storage and wants to ensure that this data is automatically encrypted when saved and decrypted only when accessed by authorized users. Which Azure feature provides this capability by default?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Azure Storage Service Encryption (SSE)
Azure Storage Service Encryption automatically encrypts data at rest by default. While Key Vault secures secrets and Disk Encryption handles virtual machine disks, standard blob storage handles its own built in encryption transparently.
Question 47 of 280Which Azure website tool lets you estimate future costs by adding Azure products and services to a shopping cart and calculating the pricing?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: A. Azure Pricing Calculator
The Azure Pricing Calculator allows you to estimate future costs by configuring products in a virtual shopping cart. Remember that Azure Advisor recommends cost optimizations for existing resources, rather than forecasting new bills.
Question 48 of 280Which of the following is something that Azure AI Services can currently do?
Tap an answer — you get instant feedback and the reasoning.
Show answer & explanation
Correct answer: C. All of these! Azure can do it all!
Azure AI Services provide capabilities like realistic speech, audio transcription, translation, and image recognition. Since the platform supports all these individual features, the comprehensive option is the correct choice.
Study on mobile
Get CertPunch for iOS or Android.