Practice for the Microsoft Azure Fundamentals (AZ-900) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: What is the goal of a DDoS attack?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Microsoft Azure Fundamentals (AZ-900) practice test →
What you will practice
- What is the goal of a DDoS attack?
- What is the primary purpose of Azure Sovereign Regions?
- What is the recommended way within Azure to store secrets such as private cryptographic keys?
- Which style of computing is easiest when migrating an existing hosted application from your own data center i…
- Which of the following services would NOT be considered Infrastructure as a Service?
- Which Azure networking service allows you to securely connect your on-premises network to Azure over the inte…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. What is the goal of a DDoS attack?
Answer: C. To overwhelm and exhaust application resources
A distributed denial of service attack attempts to overwhelm and exhaust application resources, disrupting availability for legitimate users. Tricking users relates to phishing, while extracting data is associated with vulnerabilities like SQL injection.
Q2. What is the primary purpose of Azure Sovereign Regions?
Answer: C. To offer Azure services that comply with specific government regulations and data residency requirements.
Azure Sovereign Regions, such as Azure Government, exist to provide strict compliance with specific government regulations and data residency requirements. They isolate sensitive workloads, unlike standard global regions designed primarily for performance.
Q3. What is the recommended way within Azure to store secrets such as private cryptographic keys?
Answer: A. Azure Key Vault
Azure Key Vault provides secure, centralized storage for cryptographic keys, certificates, and secrets. Hardcoding secrets inside application code creates a massive security risk and violates core cloud security principles.
Q4. Which style of computing is easiest when migrating an existing hosted application from your own data center into the cloud?
Answer: C. IaaS
Infrastructure as a Service is the easiest cloud model for migrating existing applications using a lift-and-shift strategy. Serverless or Platform as a Service models require code changes to fit their specific architectural designs.
Q5. Which of the following services would NOT be considered Infrastructure as a Service?
Answer: B. Azure Functions App
Azure Functions is a serverless Platform as a Service offering, meaning you do not manage underlying servers. Virtual machines, network interfaces, and virtual networks are categorized as Infrastructure as a Service.
Q6. Which Azure networking service allows you to securely connect your on-premises network to Azure over the internet?
Answer: D. Azure VPN Gateway
Azure VPN Gateway provides encrypted connections over the public internet. ExpressRoute is the main distractor, but it uses private, dedicated connections rather than the public internet to establish connectivity.
Q7. Which Azure service, when enabled, will automatically block traffic to or from known malicious IP addresses and domains?
Answer: B. Azure Firewall
Azure Firewall includes threat intelligence-based filtering that automatically blocks traffic to and from known malicious IP addresses and domains. Network Security Groups require manual rule creation and lack built-in threat intelligence.
Q8. Which Azure service can be enabled to enable Multi-Factor Authentication for administrators but not require it for regular users?
Answer: B. Privileged Identity Management
Privileged Identity Management allows administrators to enforce additional security requirements, like multi-factor authentication, specifically for elevated roles. Standard policies apply broadly to all users, rather than targeting role-based privileges.
Q9. What is a key benefit of using Azure Cloud Shell?
Answer: D. It provides a pre-configured, browser-based shell for managing Azure resources without requiring local installations.
Azure Cloud Shell provides an accessible, browser-based shell for managing resources without requiring local software installations. The Azure portal provides the graphical interface, whereas Cloud Shell offers command-line access.
Q10. Why should you divide your application into multiple subnets as opposed to having all your web, application and database servers running on the same subnet?
Answer: C. Separating your application into multiple subnets allows you to have different NSG security rules for each subnet, which can make it harder for a hacker to get from one compromised server onto another.
Segmenting resources into separate subnets allows you to apply distinct Network Security Group rules to each one, limiting lateral movement during an attack. Option B is a distractor; while subnets do have IP limits, security isolation is the primary architectural driver for deploying multi-tier applications.
Q11. What are groups of subscriptions called?
Answer: A. Management Groups
Management groups are organizational containers used to manage access, policy, and compliance across multiple Azure subscriptions. Remember the Azure hierarchy: resources sit inside resource groups, which sit inside subscriptions, which are then nested inside management groups.
Q12. What is the primary benefit of using Azure Virtual Desktop (AVD)?
Answer: D. It enables users to access virtualized desktops and applications from anywhere, on any device.
Azure Virtual Desktop provides remote access to virtualized desktops and applications from almost any device. While other options describe valid Azure services, only this choice directly matches the core functionality of AVD.
Q13. Which tool within the Azure Portal will make specific recommendations based on your actual usage for how you can improve your use of Azure?
Answer: A. Azure Advisor
Azure Advisor evaluates your Azure resources and provides personalized recommendations for cost, security, performance, and reliability. Azure Monitor tracks health and alerts, but it does not generate optimization recommendations.
Q14. Which of the following scenarios is best addressed by using Microsoft Entra ID?
Answer: D. Providing a centralized identity management solution for hybrid cloud environments.
Microsoft Entra ID is an enterprise identity and access management service that centralizes user sign-in for cloud and hybrid environments. The other options describe data, compute, and monitoring services that do not manage identities.
Q15. What is the significance of the Azure region? Why is it important?
Answer: C. You must select a region when creating most resources, and the region is the area of the world where those resources will be physically located.
A region represents a specific physical geographic location where your Azure resources are deployed. While you can use multiple regions, they are not just organizational folders like resource groups.
Q16. Which two features does Virtual Machine Scale Sets provide as part of the core product? Pick two.
Answer: D,E. Autoscaling of virtual machines || Load balancing between virtual machines
Virtual Machine Scale Sets natively provide automatic scaling and load balancing across identical virtual machines. You must still manually configure the operating system and deploy custom code to these underlying machines.
More Microsoft Azure Fundamentals (AZ-900) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.