Practice for the Microsoft Azure Fundamentals (AZ-900) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your organization has several teams deploying resources in Azure. You need a way to apply consistent naming conventions . Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Microsoft Azure Fundamentals (AZ-900) practice test →
What you will practice
- Your organization has several teams deploying resources in Azure. You need a way to apply consistent naming c…
- Your company hosts a global web application that serves large media files and static website assets. Users in…
- Which cloud service model places the greatest responsibility on the customer for managing the operating syste…
- Which Microsoft cloud service provides Identity-as-a-Service (IDaaS) for authentication, single sign-on, and…
- Which of the following is NOT a typical characteristic of Azure Functions?
- What is the Azure Service Level Agreement (SLA) uptime guarantee for two or more Virtual Machines deployed in…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your organization has several teams deploying resources in Azure. You need a way to apply consistent naming conventions and restrict which regions resources can be created in. Which Azure feature should you use?
Answer: D. Azure Policy
Azure Policy evaluates resources during creation to enforce rules like region limits and naming conventions. Azure Advisor recommends cost and performance improvements, while Resource Locks prevent accidental deletion.
Q2. Your company hosts a global web application that serves large media files and static website assets. Users in different regions report slow loading times. How can Azure Content Delivery Network (CDN) improve performance for these users?
Answer: C. By caching static content such as images, videos, and scripts at edge locations closer to users
Azure Content Delivery Network caches static content at edge locations closer to users to reduce latency. It handles media files efficiently, whereas resizing compute resources does not address the physical distance.
Q3. Which cloud service model places the greatest responsibility on the customer for managing the operating system and underlying infrastructure?
Answer: A. IaaS
Infrastructure as a Service places the greatest management burden on the customer because you control everything above the physical hardware. Software as a Service shifts almost all responsibility to the cloud provider.
Q4. Which Microsoft cloud service provides Identity-as-a-Service (IDaaS) for authentication, single sign-on, and identity management in Azure?
Answer: B. Microsoft Entra ID
Microsoft Entra ID provides identity and access management capabilities like single sign-on in Azure. Azure Front Door handles web traffic routing rather than authentication or identity management.
Q5. Which of the following is NOT a typical characteristic of Azure Functions?
Answer: C. They are designed for long-running backend batch applications that run continuously
Azure Functions are serverless and event-driven, making them unsuitable for long-running batch applications. They scale automatically based on triggers, such as a new file arriving in Azure Storage.
Q6. What is the Azure Service Level Agreement (SLA) uptime guarantee for two or more Virtual Machines deployed in the same Availability Set?
Answer: B. 99.95%
Deploying two or more virtual machines in an availability set provides a 99.95% SLA. Availability zones offer a higher 99.99% SLA, so memorize the distinct uptime guarantees for both architectures.
Q7. Which of the following is an example of a perimeter (network-boundary) security control?
Answer: D. Use a firewall
A firewall is a perimeter security control because it filters traffic crossing the boundary between trusted internal networks and untrusted external networks. Door locks represent physical security, while subnet separation is internal network segmentation.
Q8. A development team runs test environments in Azure that are used only eight hours per day, Monday through Friday. They want to minimize cost while keeping the environments available during working hours. Which combination of pricing and re…
Answer: B. Pay-as-you-go pricing with automation to stop VMs after hours
Pay-as-you-go pricing allows billing to stop automatically when virtual machines are deallocated outside working hours. Reserved instances require long-term commitments, while spot virtual machines risk eviction, making both poor choices for reliable testing.
Q9. Which Azure service lets you automatically scale a group of identical virtual machines (auto-scale from a single instance to many instances) and provides built-in load balancing for those VMs?
Answer: C. Virtual Machine Scale Sets
Virtual machine scale sets automatically manage and scale identical virtual machines while providing built-in load balancing. Standard virtual machines lack native autoscaling, and application gateway handles web traffic routing rather than compute provisioning.
Q10. An IT administrator wants to ensure that only users in the HR department can access a payroll app registered in Microsoft Entra ID. Which feature should the administrator use?
Answer: D. Conditional Access
Conditional Access policies evaluate group membership and other signals to grant or block application access. While role-based access control manages Azure resource permissions, conditional access specifically secures Microsoft Entra ID application sign-ins.
Q11. Which free Azure network security feature evaluates traffic entering or leaving a subnet against rule-based filters and allows or denies it?
Answer: B. Network Security Group
Network security groups provide free basic traffic filtering by evaluating custom rules against subnets or network interfaces. Azure firewall is a paid centralized service offering enterprise-scale filtering rather than basic subnet protection.
Q12. A company wants to forecast its future Azure spending based on planned usage before actually deploying any resources. Which Azure tool should they use?
Answer: B. Azure Pricing Calculator
The Azure Pricing Calculator estimates expected costs for planned deployments before provisioning actual resources. Cost Management tracks ongoing spending for existing resources rather than forecasting future deployment expenses.
Q13. An organization wants to strengthen sign-in security. They decide that users can log in from managed corporate devices without extra verification, but all other sign-ins must require Multi-Factor Authentication. Which Microsoft Entra ID fe…
Answer: A. Conditional Access policies based on device state
Conditional Access policies evaluate signals like device state to enforce rules, such as bypassing multi-factor authentication on trusted corporate devices. Identity Protection focuses on real-time risk detection rather than device compliance, making it the wrong tool here.
Q14. A company needs secure, private communication between its virtual machines in different subnets within the same Azure region. Which Azure component enables this?
Answer: C. Virtual Network (VNet)
An Azure Virtual Network enables secure private communication between resources across different subnets within the same region. A VPN Gateway or ExpressRoute is used for cross-premises connectivity rather than linking subnets locally.
Q15. A company needs to deploy Azure resources in a specific country to meet local data residency laws while maintaining low latency for users in that area. Which Azure concept allows them to choose the best location for deployment?
Answer: B. Azure Regions
Azure Regions are geographic locations where resources are deployed, allowing companies to meet local data residency laws and reduce latency. Availability Zones protect against datacenter failures but do not dictate geographic data boundaries.
Q16. Which optional security feature does Azure Application Gateway provide that the Azure Load Balancer does not?
Answer: A. Web Application Firewall (or WAF)
Azure Application Gateway optionally integrates a Web Application Firewall to inspect traffic and protect against common web vulnerabilities. Standard Azure Load Balancer operates at layer four, handling network traffic without application-level threat inspection.
More Microsoft Azure Fundamentals (AZ-900) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.