Free Microsoft Certified: Azure Fundamentals (AZ-900) Sample Questions

Correct answers: A, B, C — Code execution is triggered by events, such as a file upload or an incoming HTTP request; Billing is generally based on actual execution time rather than pre-allocated, always-on capacity; The cloud provider handles the underlying server management, so the developer does not provision virtual machines

• A. Correct: serverless functions are event-driven, executing in response to triggers like file uploads, queue messages, or HTTP requests rather than running continuously.
• B. Correct: serverless billing is typically pay-per-execution, charging for actual compute time consumed rather than for reserved, always-on capacity.
• C. Correct: the defining feature of serverless is that the provider manages the underlying infrastructure, so the developer never provisions or maintains a virtual machine.
• D. Manually configuring and patching the operating system is an IaaS responsibility; serverless computing specifically removes this burden from the developer entirely.
• E. Keeping a dedicated virtual machine running at all times describes traditional or IaaS hosting, which contradicts the on-demand, event-triggered nature of serverless execution.
• F. Forecasting peak load and pre-purchasing capacity is exactly the traditional capacity-planning burden that serverless computing's automatic scaling is designed to eliminate.

Correct answer: B — False

• A. This would be incorrect: hybrid cloud is defined by interconnecting private and public environments together, not by abandoning on-premises infrastructure entirely.
• B. Correct: a hybrid deployment keeps some workloads on private, on-premises infrastructure while interconnecting them with public cloud resources, so requiring a full move to public cloud contradicts the hybrid model.

Correct answer: B — False

• A. This statement describes horizontal scaling, not vertical scaling, so True is not the correct assessment of the statement as written.
• B. Correct — vertical scaling means resizing a resource to a larger or smaller SKU; adding more instances to share the load is horizontal scaling instead.

Correct answer: B — False

• A. In IaaS, the customer controls the operating system running inside the VM, so it is the customer, not Microsoft, who is responsible for patching it.
• B. Correct — in IaaS, guest OS patching is the customer's responsibility, since Microsoft only manages the underlying virtualization infrastructure, not what the customer installs on the VM.

Correct answer: A — PaaS is a middle ground where the provider manages the OS and middleware while the customer manages application code and data

• A. This is correct because PaaS sits between IaaS and SaaS: the provider maintains the operating system, middleware, and development tools, while the customer focuses on building and running application code.
• B. This is incorrect because IaaS, not PaaS, leaves OS patching and network configuration to the customer; PaaS removes that burden.
• C. This is incorrect because SaaS goes further than PaaS by also managing the finished application itself, which PaaS customers still build and deploy.
• D. This is incorrect because the cloud provider still maintains physical infrastructure and connectivity under PaaS, just as it does under IaaS and SaaS.

Correct answer: A — Infrastructure as a Service, since virtual machines let the team control OS versions and network settings for each environment

• A. Infrastructure as a Service is correct because renting virtual machines gives the team direct control over OS versions and network configuration for each environment, and they can be started and stopped quickly.
• B. This is incorrect because Platform as a Service abstracts away OS and network management, which removes the fine-grained control the team needs to mirror their on-premises setup.
• C. This is incorrect because a fixed hosted application offers no ability to configure OS versions or networking per environment.
• D. This is incorrect because physical server rooms take far longer to provision and reconfigure than cloud virtual machines, which defeats the team's need for rapid spin-up and teardown.

Correct answer: A — Platform as a Service supplies a managed runtime and middleware so developers deploy code without maintaining the OS.

• A. Platform as a Service matches because the provider maintains the operating system, middleware, and runtime, leaving developers free to focus only on their application code.
• B. This is incorrect because virtual machines under Infrastructure as a Service still require the team to install and patch the OS themselves, which is exactly the burden they want to avoid.
• C. This is incorrect because a fully packaged application does not provide a place to deploy custom-built code at all.
• D. This is incorrect because a colocation facility still requires the team to own and manage physical hardware and the middleware stack running on it.

Correct answer: A — Consumption-based, because charges scale directly with the amount of compute, storage, or other resources actually used.

• A. Consumption-based pricing charges for what is actually used, which is exactly the pay-as-you-go model described, with no large upfront hardware purchase.
• B. Fixed-capacity pricing requires committing to and paying for a set amount of capacity regardless of actual usage, which contradicts paying only for what is consumed.
• C. A perpetual license is a one-time upfront purchase for indefinite use, which is the opposite of a usage-based, no-upfront-cost model.
• D. A flat rate charges the same amount no matter how much is used, which does not match a model where cost scales with actual consumption.

Correct answer: A — Microsoft, because physical datacenter security always stays with the cloud provider no matter which service model is chosen.

• A. Correct: the physical datacenter, physical network, and physical hosts always stay with the cloud provider no matter which service model (IaaS, PaaS, or SaaS) the customer chooses.
• B. Deploying a virtual machine shifts operating-system and workload responsibilities to the customer, but it never moves physical datacenter security, which always belongs to the provider.
• C. Responsibility does shift toward the customer under IaaS for things like the OS and applications, but physical security specifically is never split fifty-fifty — it stays entirely with the provider.
• D. There is no third-party auditor taking over physical security in the shared responsibility model; that duty is retained directly by the cloud provider itself.

Correct answer: A — Deploy geo-redundant storage using the storage account's region pair, since Azure pairs almost all regions within the same geography to satisfy data-residency requirements.

• A. Correct — Azure pairs almost all regions with another region in the same geography specifically so that geo-redundant replication keeps data within the same broad jurisdiction while still protecting against a regional outage.
• B. Incorrect — Azure does not automatically restrict replication targets by jurisdiction; the customer must deliberately choose a paired or otherwise appropriate region, since geo-redundant storage can technically replicate to any enabled secondary region the service allows.
• C. Incorrect — availability zones are physically separate datacenters within the same region, not a different region, so replicating only across zones does not provide the cross-region disaster recovery that geo-redundant storage requires.
• D. Incorrect — sovereign clouds like Azure Government are separate, isolated Azure environments for specific regulatory audiences; they are not a general mechanism for keeping backups within a chosen geography, and ordinary EU workloads run in global Azure regions instead.

Correct answers: A, B, C — Planned system updates are staggered across the paired regions so both aren't updated at the same time.; One region in the pair is prioritized for recovery first if a geography-wide outage occurs.; Almost all region pairs are located within the same geography to help meet data-residency needs.

• A. Correct — Azure documentation states it strives to stagger planned updates across paired regions specifically to reduce the chance that a faulty update affects both regions at once.
• B. Correct — Microsoft designates one region in each pair as the priority for recovery during a large-scale geography-wide outage, so components spread across the pair have a defined recovery order.
• C. Correct — almost all paired regions share the same geography as their pair, which is called out specifically as supporting data-residency requirements for customers who must keep data within a jurisdiction.
• D. Incorrect — Microsoft explicitly states that deploying to a region in a pair does not automatically make workloads more resilient or provide automatic high availability; customers must still design their own redundancy.
• E. Incorrect — no documented guarantee promises zero data loss on failover; Microsoft-managed failover between paired regions is described as a last resort used only in catastrophic situations, not a lossless guarantee.
• F. Incorrect — many newer regions are nonpaired and rely on availability zones instead of a paired region for resiliency, so pairing is not guaranteed for every region.

Correct answer: B — False

• A. This is incorrect — resources can be located in a different region than their resource group, even though Microsoft recommends keeping them together to reduce the impact of a regional outage.
• B. This is correct — Azure does not require resources to be deployed in the same region as their resource group; the recommendation to co-locate them is a best practice, not a hard requirement.

Correct answer: A — Azure Virtual Machine Scale Sets, which manage a group of identical, load-balanced VMs and automatically scale the instance count based on demand

• A. Virtual Machine Scale Sets are purpose-built to run a group of identical, load-balanced VMs and automatically increase or decrease the instance count in response to demand, matching the flash-sale scenario.
• B. Availability sets improve fault and update resiliency for a fixed set of VMs but do not automatically add or remove instances, so they cannot handle sudden traffic spikes on their own.
• C. Azure Virtual Desktop delivers remote desktop and app sessions to end users, which is an unrelated use case to scaling a backend application tier.
• D. This service provides a private connection between an on-premises datacenter and Azure and does not supply any application compute capacity.

Correct answers: A, B — ExpressRoute connections reach Azure through a private connection that does not travel over the public internet; ExpressRoute uses Border Gateway Protocol (BGP) to dynamically exchange routes between the on-premises network and Azure

• A. ExpressRoute connections are established through a connectivity provider over a private circuit that bypasses the public internet, which is one of its defining characteristics.
• B. ExpressRoute uses BGP to dynamically exchange routes between the on-premises network, the Azure private addresses, and Microsoft public addresses.
• C. ExpressRoute is a network-level connection established by a connectivity provider circuit, not a client VPN, so individual devices do not need VPN client software to use it.
• D. ExpressRoute is a dedicated circuit-based service aimed at continuous site connectivity; point-to-site connections for individual users are a VPN Gateway feature, not ExpressRoute.
• E. This is the opposite of how ExpressRoute works; its defining feature is that traffic does not travel over the public internet.

Correct answer: A — custom domain names to private IP addresses within the virtual network, without publishing those records on the public internet

• A. An Azure DNS private zone lets resources in a virtual network resolve custom domain names to private IP addresses, and those records are not exposed on the public internet.
• B. A private zone resolves names to private records scoped to the virtual network; it is not a caching layer for speeding up public internet name resolution.
• C. DNS resolution returns name-to-IP-address mappings, not connection health status, so this does not describe what a private zone provides.
• D. DNS records map names to IP addresses; they do not report which Availability Zone a VM is placed in.

Correct answers: A, D, F — Windows Hello for Business; FIDO2 security key; Microsoft Authenticator phone sign-in

• A. This is correct: it is a passwordless method that uses a device-bound PIN or biometric gesture instead of a typed password.
• B. This still relies on a typed password as the primary credential, so it is not a passwordless method.
• C. This lets a user reset a forgotten password, but it assumes a password still exists, so it is not itself a passwordless sign-in method.
• D. This is correct: a physical security key that proves possession is a supported passwordless authentication method.
• E. A username and password is the traditional password-based method, which is exactly what passwordless authentication is meant to replace.
• F. This is correct: approving a sign-in through the phone app instead of typing a password is a supported passwordless method.

Correct answer: A — True

• A. This statement is correct: Azure RBAC is an additive model, so a user's effective permissions in that resource group combine into the sum of the Reader assignment and the Contributor assignment.
• B. This option would be correct only if roles subtracted from each other or the most restrictive one always won, but Azure RBAC does not work that way, so this does not apply here.

Correct answer: A — Upgrade the account in place to general-purpose v2, which adds access tiers without downtime or copying data

• A. Microsoft provides an in-place upgrade from general-purpose v1 to general-purpose v2 that requires no downtime and no data copying, and it unlocks access tiers and lifecycle management once completed.
• B. A destructive recreate-from-backup approach is unnecessary because Microsoft explicitly supports an in-place upgrade path from v1 to v2 without needing to delete and rebuild the account.
• C. Changing the redundancy setting only affects how many copies of data are kept and where; it does not change the account type or add access tier and lifecycle management capabilities.
• D. Access tiers, including archive, are a general-purpose v2 (or Blob Storage account) capability; a v1 account does not gain tiering just by attempting to set a tier without upgrading first.

Correct answer: A — AzCopy, a command-line utility built for high-performance, scriptable bulk data transfers to and from Azure Storage

• A. AzCopy is a command-line tool purpose-built for high-performance bulk data transfers to and from Azure Storage, and its scriptable nature makes it well suited to run unattended inside a nightly automation job.
• B. Storage Explorer is a graphical desktop application meant for manually browsing and transferring files by hand, which does not fit an unattended, scripted automation job.
• C. Azure File Sync is designed for an ongoing, continuously active synchronization relationship between a server and an Azure file share, not for a one-off scripted bulk copy job.
• D. Azure Migrate is focused on assessing and orchestrating the migration of servers, databases, and virtual desktops, not on scripting file transfers into Azure Files.

Correct answer: A — Premium, because it uses solid-state drives to deliver consistent low-latency, high-throughput performance

• A. Premium performance storage accounts are backed by solid-state drives and are recommended for scenarios needing consistent low latency and high throughput, such as I/O-intensive VM disks and databases.
• B. Standard performance accounts are backed by traditional hard disk drives, not solid-state drives, and Premium is the tier built for higher performance, not Standard.
• C. Performance tier and redundancy setting are independent choices; selecting Premium does not by itself force geo-replication to a secondary region.
• D. Both Standard and Premium performance tiers can store block blobs, so block blob support alone is not a reason to prefer Standard over Premium for this workload.

Correct answer: A — Zero Trust, which requires explicit verification of every request no matter its source.

• A. This is correct because verifying every request explicitly regardless of where it originates matches the architect's decision to stop trusting requests just because they come from inside the network.
• B. This describes layering multiple independent security controls so that a failure in one layer does not compromise the whole environment, which is a related but different concept from removing implicit network trust.
• C. This governs what an already-authenticated identity can do on a resource, but it does not itself define whether network location should be trusted during authentication.
• D. This strengthens the proof of identity during sign-in, but on its own it does not describe the broader principle of never trusting a request based on network location.

Correct answer: A — A sovereign cloud such as Azure Government, which is operated as a separate, isolated environment for customers with specific regulatory or national-security requirements.

• A. Correct — sovereign clouds like Azure Government run in physically and logically separate environments built for customers who must meet specific regulatory, national-security, or jurisdictional requirements that the public cloud doesn't satisfy on its own.
• B. Incorrect — a management group is a logical container for organizing subscriptions under shared policy or access settings within the same Azure cloud; it does not move workloads into a physically separate environment.
• C. Incorrect — a resource lock only prevents accidental deletion or modification of resources by authorized users within the same subscription; it has no effect on which physical cloud environment or datacenters the resources run in.
• D. Incorrect — subscriptions are billing and management boundaries within a shared pool of Azure infrastructure, not physically isolated environments, so a standard subscription in the public cloud does not meet a requirement for separation from that same public cloud.

Correct answers: A, B, D — Restrict new resource deployments to a specific set of approved Azure regions.; Require every deployed resource to send diagnostic logs to a designated Log Analytics workspace.; Block resource-deletion actions initiated by users who have not enabled multifactor authentication.

• A. Restricting allowed deployment regions is a documented common use case for Azure Policy, enforced through built-in definitions such as Allowed Locations.
• B. Requiring diagnostic logs to flow to a Log Analytics workspace is a standard governance action that Azure Policy can enforce on resource configuration.
• C. Granting temporary read access to billing data is an identity and access management task handled through RBAC, not something Azure Policy enforces.
• D. Azure Policy can inspect the identity context of a request and block resource-delete actions when the requester has not enabled multifactor authentication.
• E. Encrypting data at rest with a customer-managed key is a feature configured within the data service itself, not a control that Azure Policy implements.
• F. Estimating total cost of ownership for a migration is performed with cost-management tools such as the TCO calculator, not with Azure Policy.

Correct answers: A, C, F — A ReadOnly lock on a resource group blocks moving existing resources into or out of that group.; Locks override individual user role assignments, applying the same restriction to every user at that scope.; The most restrictive lock in an inheritance chain from parent to child scope takes precedence.

• A. A ReadOnly lock at a resource group scope does prevent moving resources in or out of that group, since a move is treated as a write operation.
• B. Locks are independent objects; removing one lock has no effect on any other lock applied at the same scope, so it would not remove a separate ReadOnly lock.
• C. Resource locks apply their restriction to every user and role at the locked scope, overriding whatever RBAC permissions those users otherwise hold.
• D. Locks only protect control-plane operations; they do not restrict data-plane operations, so blob data inside a locked storage account is not protected by the lock.
• E. Management groups cannot have locks applied to them directly; locks are supported at the subscription, resource group, and resource levels.
• F. When locks exist at multiple levels in the hierarchy, the most restrictive one in that inheritance chain is the one that takes effect.

Correct answer: A — Spot Virtual Machines

• A. This option offers unused Azure compute capacity at a steep discount, in exchange for accepting that the virtual machine can be reclaimed with little notice, which matches an interruption-tolerant batch job.
• B. This option requires a one- or three-year commitment to a fixed VM size for a lower rate; it does not offer the deepest discount available for interruptible workloads.
• C. This benefit reduces cost by reusing an existing on-premises license; it does not offer the steep, capacity-based discount that an interruptible workload can take advantage of.
• D. This option charges the standard hourly rate with no commitment and no interruption risk, which costs more than accepting reclaimable capacity for a tolerant workload.

Correct answer: A — Tag

• A. A tag is exactly this kind of metadata key-value pair, applied to a resource so it can be identified, filtered, and grouped in cost and billing reports.
• B. A resource lock controls whether a resource can be deleted or modified; it carries no key-value data and plays no role in billing reports.
• C. A policy assignment enforces a rule or compliance requirement on resources; it is not a key-value label used for cost grouping.
• D. A management group is a container used to organize subscriptions for governance; it is not a per-resource key-value label.

Correct answer: B — False

• A. This would be incorrect: management groups are explicitly excluded from the scopes that support tags.
• B. This is accurate: tags can be applied to resources, resource groups, and subscriptions, but management groups do not support tags at all.

Correct answer: A — Complete

• A. Complete mode tells Resource Manager to treat the template as the full desired state of the resource group, deleting any existing resource that is not declared in the template.
• B. Incremental mode, the default, adds or updates the resources in the template and leaves existing resources not listed in the template untouched rather than deleting them.
• C. Partial is not a deployment mode that Azure Resource Manager offers for ARM template deployments.
• D. Preview is not a deployment mode; Resource Manager supports only Incremental and Complete modes for deployments.

Correct answers: A, B, C, D — From the Bash environment inside Azure Cloud Shell, where the CLI is already preinstalled; From a locally installed copy of the CLI on a Windows, macOS, or Linux workstation; From within a CI/CD pipeline step that invokes CLI commands as part of an automated build or release; From a Docker container that has the official Microsoft Azure CLI image installed

• A. Cloud Shell's Bash environment comes with the Azure CLI preinstalled and authenticated, making it one of the most common ways to run CLI commands without any local setup.
• B. The Azure CLI can be installed locally on Windows, macOS, or Linux, letting engineers run the same commands directly from their own machine.
• C. CLI commands are commonly invoked from CI/CD pipeline steps to automate resource provisioning as part of build and release workflows.
• D. Microsoft publishes an official Azure CLI Docker image, so the CLI can be run inside a container as part of containerized tooling or pipelines.
• E. The dashboard tile editor is a portal customization feature, not a place to run command-line commands, and it is not the only entry point for the CLI.
• F. Customers never access a physical Azure datacenter console directly; the Azure CLI runs on user-accessible tools like Cloud Shell, local installs, and containers, not datacenter hardware.

Correct answer: A — True

• A. This is correct — Azure Resource Manager receives, authenticates, and authorizes every request from any Azure API, tool, or SDK before forwarding it, which is exactly what keeps behavior consistent across the portal, CLI, and PowerShell.
• B. This is incorrect — Resource Manager genuinely is the shared layer behind the portal, CLI, PowerShell, and REST API, so labeling this statement false does not match how Azure request handling works.

Correct answers: A, B — Azure Advisor recommendations; The public Azure Status page

• A. Azure Advisor recommendations are provided at no additional cost to any Azure subscription, since Advisor simply analyzes configuration and usage data that already exists.
• B. The Azure Status page is a public webpage available to anyone without an Azure subscription or any charge, showing the health of Azure services globally.
• C. Extending log data retention beyond the free allotment in a Log Analytics workspace incurs additional cost based on data volume and retention period, so it is not free.
• D. There is no premium third-party SIEM integration automatically bundled free with every Azure subscription; such integrations are separate products with their own licensing.

Correct answer: A — True

• A. This is true; Advisor analyzes real resource configuration and usage telemetry to produce recommendations personalized to the actual deployment, not a generic static checklist.
• B. This is not the correct answer, since Advisor genuinely bases its recommendations on live configuration and telemetry analysis rather than a fixed, usage-independent checklist.

Correct answer: A — Azure Service Health, which shows whether a platform outage hit the deployment's region.

• A. Service Health is the right second check because it reports whether a concurrent Azure platform outage or incident in that region could be contributing to the error spike, which matters before deciding to roll back application code.
• B. Advisor's cost recommendations are unrelated to diagnosing a sudden application error spike and would not help determine whether a platform issue is involved.
• C. Reviewing spending trends has no bearing on diagnosing an application error spike or ruling out a concurrent platform incident.
• D. Resource lock configuration governs whether resources can be deleted or modified and has no diagnostic value for an application error spike.

Correct answer: C — The deployment request is blocked because Azure Policy evaluates resource properties regardless of the requester's role assignment.

• A. Contributor access does not override a policy assignment; Azure Policy evaluates resource state independently of who is making the request.
• B. A deny effect is enforced at the moment of the request, not only on the periodic compliance cycle, so the deployment does not complete.
• C. This is correct because Azure Policy checks resource properties against the assigned rule regardless of the requester's permissions, and the deny effect stops the non-compliant deployment immediately.
• D. deployIfNotExists deploys a related compliant resource after the fact; it does not silently substitute a different SKU for a denied request.

Correct answer: D — Owner or User Access Administrator, since lock management requires Microsoft.Authorization permissions.

• A. Locks being independent of RBAC for their enforcement does not mean any role can manage them; creating or removing a lock still requires specific permissions.
• B. Reader access only allows viewing resources and their settings; it does not grant the write permissions needed to create or remove a lock.
• C. Contributor access does not include the Microsoft.Authorization permissions needed for lock management, so it cannot create or delete locks.
• D. This is correct because managing locks requires Microsoft.Authorization/locks actions, which the Owner and User Access Administrator roles grant.