Microsoft AZ-900 · Azure Fundamentals · Updated 2026
Free AZ-900 Azure Fundamentals Practice Exam (2026)
Full-length AZ-900 mock exams with a realistic number of questions and the real exam time. Cloud concepts, Azure services and management and governance questions, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
50 questions · 45 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 5
🏆
Question 1Azure Architecture & Services
Contoso runs two VMs for an app in one datacenter. It wants them placed on separate hardware racks so that a hardware failure or planned maintenance does not affect both, at no extra cost. What should it use?
Correct answer: A. An availability set
An availability set spreads VMs across fault domains, which use separate power and network hardware, and across update domains for planned maintenance. A resource group only organizes resources and does not affect where VMs are physically placed.
An availability set spreads VMs across fault domains, which use separate power and network hardware, and across update domains for planned maintenance. A resource group only organizes resources and does not affect where VMs are physically placed.
Question 2Management & Governance
Bellows College wants to compare the cost of running its current on-premises servers with the cost of running the same workloads in Azure. Which tool should it use?
Correct answer: C. TCO calculator
The Total Cost of Ownership (TCO) calculator compares the cost of on-premises infrastructure with the estimated cost of running the same workloads in Azure. The Pricing calculator estimates Azure costs only and does not include on-premises costs.
The Total Cost of Ownership (TCO) calculator compares the cost of on-premises infrastructure with the estimated cost of running the same workloads in Azure. The Pricing calculator estimates Azure costs only and does not include on-premises costs.
Question 3Cloud Concepts
Trey Research wants to rent computing resources from a provider that offers them to many customers over the internet. It does not want to buy any hardware. Which cloud model is this?
Correct answer: D. Public cloud
In a public cloud, a provider such as Microsoft owns the hardware and offers services to many organizations over the internet, so there is no capital expense for hardware. A private cloud is dedicated to a single organization, which typically owns or leases the hardware.
In a public cloud, a provider such as Microsoft owns the hardware and offers services to many organizations over the internet, so there is no capital expense for hardware. A private cloud is dedicated to a single organization, which typically owns or leases the hardware.
Question 4Azure Architecture & Services
Fabrikam's research and sales departments need separate Azure invoices and separate access boundaries. What should Fabrikam create for each department?
Correct answer: D. A separate subscription
A subscription is both a billing boundary and an access control boundary, so separate subscriptions produce separate invoices. Resource groups help organize resources, but they share the subscription's bill.
A subscription is both a billing boundary and an access control boundary, so separate subscriptions produce separate invoices. Resource groups help organize resources, but they share the subscription's bill.
Question 5Management & Governance
Woodgrove Bank owns Windows Server licenses with active Software Assurance. It wants to use those licenses to lower the cost of its Azure VMs. What should it use?
Correct answer: B. Azure Hybrid Benefit
Azure Hybrid Benefit lets you apply existing Windows Server and SQL Server licenses with Software Assurance to Azure, so you do not pay for the license again. Reservations lower compute prices through a term commitment but do not reuse existing licenses.
Azure Hybrid Benefit lets you apply existing Windows Server and SQL Server licenses with Software Assurance to Azure, so you do not pay for the license again. Reservations lower compute prices through a term commitment but do not reuse existing licenses.
Question 6Cloud Concepts
Trey Research runs a batch rendering job that can be stopped and restarted at any time. It wants the lowest possible VM price and accepts that Azure may reclaim the capacity. Which pricing option fits?
Correct answer: B. Azure Spot Virtual Machines
Spot Virtual Machines use unused Azure capacity at a deep discount, but Azure can evict them when it needs the capacity back, so they suit interruptible jobs. Pay-as-you-go pricing has no eviction risk but costs more for the same VM.
Spot Virtual Machines use unused Azure capacity at a deep discount, but Azure can evict them when it needs the capacity back, so they suit interruptible jobs. Pay-as-you-go pricing has no eviction risk but costs more for the same VM.
Question 7Azure Architecture & Services
An administrator at Litware wants to place a single storage account in two resource groups at the same time. What should you tell the administrator?
Correct answer: D. A resource can belong to only one resource group
Each Azure resource can exist in only one resource group at a time, although it can be moved to a different one. Resource groups cannot be nested, and a resource does not need to be copied to be used by apps in other groups.
Each Azure resource can exist in only one resource group at a time, although it can be moved to a different one. Resource groups cannot be nested, and a resource does not need to be copied to be used by apps in other groups.
Question 8Management & Governance
Contoso plans to deploy a third-party firewall appliance from Azure Marketplace. Which statement about its cost is true?
Correct answer: C. Third-party vendor fees can be billed through the Azure subscription
Azure Marketplace solutions can include fees set by the third-party vendor, and these are billed through your Azure subscription along with the Azure resources they use. Assuming Marketplace solutions add no extra charges can lead to unexpected costs.
Azure Marketplace solutions can include fees set by the third-party vendor, and these are billed through your Azure subscription along with the Azure resources they use. Assuming Marketplace solutions add no extra charges can lead to unexpected costs.
Question 9Cloud Concepts
Blue Yonder Airlines uses IaaS, PaaS and SaaS services in Azure. Which responsibility always belongs to Microsoft in all three models?
Correct answer: B. Physical security of datacenters
Microsoft is always responsible for the physical datacenter, physical network and physical hosts. Data classification, devices and accounts always remain the customer's responsibility.
Microsoft is always responsible for the physical datacenter, physical network and physical hosts. Data classification, devices and accounts always remain the customer's responsibility.
Question 10Azure Architecture & Services
Adatum is designing its Azure governance structure. Which list shows the organizing levels from the broadest scope to the narrowest?
Correct answer: C. Management groups, subscriptions, resource groups, resources
Management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources. Settings such as policies applied at a higher level are inherited by the levels below.
Management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources. Settings such as policies applied at a higher level are inherited by the levels below.
Question 11Management & Governance
Lamna Healthcare wants to discover and classify sensitive data stored in Azure, on-premises databases and other clouds, and track how that data moves. Which service should it use?
Correct answer: A. Microsoft Purview
Microsoft Purview is a family of data governance, risk and compliance solutions that can map, classify and track data across on-premises, multicloud and SaaS sources. Azure Policy enforces rules on resource configuration, not on the data inside resources.
Microsoft Purview is a family of data governance, risk and compliance solutions that can map, classify and track data across on-premises, multicloud and SaaS sources. Azure Policy enforces rules on resource configuration, not on the data inside resources.
Question 12Azure Architecture & Services
Tailwind Traders runs hundreds of containers for a microservices app. It needs automated deployment, scaling and management of the containers across a cluster. What should it use?
Correct answer: B. Azure Kubernetes Service
Azure Kubernetes Service is a managed Kubernetes service that orchestrates many containers, including deployment, scaling and updates. Azure Container Instances runs individual containers and does not provide cluster orchestration.
Azure Kubernetes Service is a managed Kubernetes service that orchestrates many containers, including deployment, scaling and updates. Azure Container Instances runs individual containers and does not provide cluster orchestration.
Question 13Cloud Concepts
Munson's Pickles runs some workloads in Azure and others with a second public cloud provider. It has no on-premises servers. Which term describes this setup?
Correct answer: A. Multicloud
Multicloud means using two or more public cloud providers at the same time. Hybrid cloud combines public cloud with on-premises or private cloud resources, and Munson's Pickles has none.
Multicloud means using two or more public cloud providers at the same time. Hybrid cloud combines public cloud with on-premises or private cloud resources, and Munson's Pickles has none.
Question 14Management & Governance
Fabrikam's compliance officer needs Microsoft's independent audit reports, such as ISO 27001 and SOC reports, for Azure. Where should she get them?
Correct answer: C. Service Trust Portal
The Service Trust Portal provides Microsoft's audit reports, compliance guides and other trust documents for its cloud services. Azure Service Health reports platform incidents and maintenance, not compliance audit results.
The Service Trust Portal provides Microsoft's audit reports, compliance guides and other trust documents for its cloud services. Azure Service Health reports platform incidents and maintenance, not compliance audit results.
Question 15Azure Architecture & Services
Northwind Traders wants to host a .NET web app and a REST API on a fully managed platform with built-in autoscaling and deployment slots. What should it use?
Correct answer: D. Azure App Service
Azure App Service is a fully managed platform for hosting web apps and APIs, with features such as autoscaling and deployment slots. Azure Virtual Machines would require Northwind Traders to manage the operating system and web server itself.
Azure App Service is a fully managed platform for hosting web apps and APIs, with features such as autoscaling and deployment slots. Azure Virtual Machines would require Northwind Traders to manage the operating system and web server itself.
Question 16Cloud Concepts
VanArsdel's web app normally runs on two VMs. During busy periods it adds four more VMs of the same size to share the load. What type of scaling is this?
Correct answer: D. Scaling out
Scaling out, also called horizontal scaling, adds more instances that share the work. Making one existing VM larger would be vertical scaling, which is not what VanArsdel does here.
Scaling out, also called horizontal scaling, adds more instances that share the work. Making one existing VM larger would be vertical scaling, which is not what VanArsdel does here.
Question 17Management & Governance
A Windows administrator at Northwind Traders wants to automate Azure tasks by using cmdlets such as New-AzVM in scripts. Which tool is designed for this?
Correct answer: A. Azure PowerShell
Azure PowerShell is a module of cmdlets, such as New-AzVM, for managing Azure resources from scripts. The Azure portal is a graphical console and cannot run cmdlet-based scripts on a schedule.
Azure PowerShell is a module of cmdlets, such as New-AzVM, for managing Azure resources from scripts. The Azure portal is a graphical console and cannot run cmdlet-based scripts on a schedule.
Question 18Azure Architecture & Services
Wingtip Toys already owns the domain wingtiptoys.com. It wants to host the domain's DNS records on Microsoft's global name servers and manage them with Azure tools. What should it use?
Correct answer: B. Azure DNS
Azure DNS hosts DNS zones on Microsoft's global network of name servers, and you manage records with the same credentials and tools as other Azure resources. ExpressRoute is a private connectivity service and does not host name records.
Azure DNS hosts DNS zones on Microsoft's global network of name servers, and you manage records with the same credentials and tools as other Azure resources. ExpressRoute is a private connectivity service and does not host name records.
Question 19Management & Governance
Adatum's admins manage resources through the Azure portal, Azure CLI and REST APIs. Which service receives and processes all of these requests in a consistent way?
Correct answer: D. Azure Resource Manager
Azure Resource Manager is the deployment and management service for Azure, and every request from the portal, CLI, PowerShell or REST API goes through it. This gives consistent results and applies features such as RBAC, locks and tags.
Azure Resource Manager is the deployment and management service for Azure, and every request from the portal, CLI, PowerShell or REST API goes through it. This gives consistent results and applies features such as RBAC, locks and tags.
Question 20Cloud Concepts
First Up Consultants wants its application to recover from failures and keep working, even if an entire Azure region has a problem. Which cloud benefit is it relying on?
Correct answer: C. Reliability
Reliability is a system's ability to recover from failures and continue to function, and the cloud's global footprint lets you design apps that keep running across regions. Elasticity adjusts capacity to demand but does not address recovery from failures.
Reliability is a system's ability to recover from failures and continue to function, and the cloud's global footprint lets you design apps that keep running across regions. Elasticity adjusts capacity to demand but does not address recovery from failures.
Question 21Azure Architecture & Services
Contoso wants to separate its web servers and database servers into different IP address ranges within one virtual network, so it can apply different network rules to each. What should it create?
Correct answer: A. Subnets
Subnets divide a virtual network's address space into smaller ranges, and you can apply different network security rules to each subnet. Separate resource groups organize resources for management but do not split the network address space.
Subnets divide a virtual network's address space into smaller ranges, and you can apply different network security rules to each subnet. Separate resource groups organize resources for management but do not split the network address space.
Question 22Management & Governance
Contoso wants one platform that collects metrics and logs from Azure resources, on-premises servers and apps so it can analyze and act on them. Which service should it use?
Correct answer: C. Azure Monitor
Azure Monitor collects, analyzes and acts on metrics and logs from Azure, on-premises and other cloud environments. Azure Advisor gives recommendations, but it does not collect and store your telemetry.
Azure Monitor collects, analyzes and acts on metrics and logs from Azure, on-premises and other cloud environments. Azure Advisor gives recommendations, but it does not collect and store your telemetry.
Question 23Azure Architecture & Services
Relecloud wants VMs in its virtual network to reach an Azure SQL database by using a private IP address, so that traffic does not go through a public endpoint. What should it configure?
Correct answer: A. A private endpoint
A private endpoint gives an Azure PaaS service a private IP address from your virtual network, so traffic stays on the Microsoft network. A public endpoint, even with firewall rules, is still reached through a public IP address.
A private endpoint gives an Azure PaaS service a private IP address from your virtual network, so traffic stays on the Microsoft network. A public endpoint, even with firewall rules, is still reached through a public IP address.
Question 24Cloud Concepts
Wide World Importers wants Azure to monitor the health of its resources, replace failing resources and send real-time alerts. Which cloud benefit does this describe?
Correct answer: B. Manageability
Manageability covers management of the cloud, such as monitoring resource health, replacing failing resources and sending alerts automatically. Scalability is about adding capacity, not about how resources are monitored and maintained.
Manageability covers management of the cloud, such as monitoring resource health, replacing failing resources and sending alerts automatically. Scalability is about adding capacity, not about how resources are monitored and maintained.
Question 25Management & Governance
Tailwind Traders' app depends on a web app and a database. Each service has its own SLA, and both must be running for the app to work. What is true about the combined SLA?
Correct answer: A. It is lower than either individual SLA
When an app depends on several services, the composite SLA is found by multiplying the individual SLAs, so it is lower than either one. For example, 99.95 percent times 99.99 percent is about 99.94 percent.
When an app depends on several services, the composite SLA is found by multiplying the individual SLAs, so it is lower than either one. For example, 99.95 percent times 99.99 percent is about 99.94 percent.
Question 26Azure Architecture & Services
Fabrikam wants users to sign in without typing a password, by using Windows Hello for Business or a FIDO2 security key. Which Microsoft Entra ID capability should it use?
Correct answer: C. Passwordless authentication
Passwordless authentication replaces the password with methods such as Windows Hello for Business, the Microsoft Authenticator app or FIDO2 security keys. Self-service password reset helps users recover passwords but still relies on them.
Passwordless authentication replaces the password with methods such as Windows Hello for Business, the Microsoft Authenticator app or FIDO2 security keys. Self-service password reset helps users recover passwords but still relies on them.
Question 27Cloud Concepts
Developers at Tailwind Traders want to deploy their own web app code without managing VMs or operating systems. Which service model fits?
Correct answer: B. PaaS
PaaS provides a managed platform where developers deploy their own code while the provider manages the servers and operating systems. SaaS delivers a finished application, so the developers would not be deploying their own code.
PaaS provides a managed platform where developers deploy their own code while the provider manages the servers and operating systems. SaaS delivers a finished application, so the developers would not be deploying their own code.
Question 28Azure Architecture & Services
An administrator at Lucerne Publishing wants a free graphical desktop app for Windows, macOS and Linux to upload, download and manage blobs and file shares. What should she use?
Correct answer: D. Azure Storage Explorer
Azure Storage Explorer is a standalone graphical app for Windows, macOS and Linux that lets you manage blobs, files, queues and tables. AzCopy moves data with command-line commands, which does not meet the need for a graphical tool.
Azure Storage Explorer is a standalone graphical app for Windows, macOS and Linux that lets you manage blobs, files, queues and tables. AzCopy moves data with command-line commands, which does not meet the need for a graphical tool.
Question 29Management & Governance
Wingtip Toys' Azure service did not meet the uptime promised in its SLA last month. What does Microsoft typically provide?
Correct answer: A. A service credit on a future bill
If Microsoft does not meet an SLA, eligible customers can claim a service credit, which is a percentage of the monthly fee for that service. SLAs do not promise a full refund of all Azure charges.
If Microsoft does not meet an SLA, eligible customers can claim a service credit, which is a percentage of the monthly fee for that service. SLAs do not promise a full refund of all Azure charges.
Question 30Cloud Concepts
Fabrikam's accountant asks which type of IT expense is usually deducted in the same year it is incurred, such as a monthly cloud subscription. Which type should you name?
Correct answer: B. Operational expenditure (OpEx)
OpEx is spending on services as you consume them, and it is usually deducted in the same year it is incurred. CapEx is an up-front purchase of physical assets that is depreciated over several years.
OpEx is spending on services as you consume them, and it is usually deducted in the same year it is incurred. CapEx is an up-front purchase of physical assets that is depreciated over several years.
Question 31Azure Architecture & Services
A media startup named Fabrikam Studios needs to store millions of images and video files and serve them directly to web browsers over HTTPS. Which Azure Storage service is designed for this?
Correct answer: A. Azure Blob Storage
Azure Blob Storage is object storage optimized for large amounts of unstructured data, such as images and video, and it can serve files directly to browsers. Table Storage holds structured NoSQL entities, not large media files.
Azure Blob Storage is object storage optimized for large amounts of unstructured data, such as images and video, and it can serve files directly to browsers. Table Storage holds structured NoSQL entities, not large media files.
Question 32Management & Governance
An engineer at Fourth Coffee works on Linux and macOS. She wants to manage Azure in Bash scripts by using commands such as az vm create. Which tool should she use?
Correct answer: D. Azure CLI
Azure CLI is a cross-platform command-line tool that uses az commands and works well in Bash scripts. Bicep files declare the desired state of resources and do not provide imperative commands like az vm create.
Azure CLI is a cross-platform command-line tool that uses az commands and works well in Bash scripts. Bicep files declare the desired state of resources and do not provide imperative commands like az vm create.
Question 33Azure Architecture & Services
Alpine Ski House's web front end must hand off order requests to a back-end processing component so that orders are not lost during traffic spikes. Which storage service should it use?
Correct answer: A. Azure Queue Storage
Azure Queue Storage stores large numbers of messages that one component adds and another processes later, which decouples the parts of an app. Table Storage stores structured NoSQL data, not messages waiting to be processed.
Azure Queue Storage stores large numbers of messages that one component adds and another processes later, which decouples the parts of an app. Table Storage stores structured NoSQL data, not messages waiting to be processed.
Question 34Management & Governance
An administrator at Relecloud sees that one specific VM is unreachable. She wants to know whether an Azure platform problem is affecting that individual VM. What should she check?
Correct answer: C. Azure Resource Health
Resource Health, part of Azure Service Health, shows the current and past health of your individual resources and whether a platform issue affects them. The Azure status page shows broad service health for all regions, not the health of one specific VM.
Resource Health, part of Azure Service Health, shows the current and past health of your individual resources and whether a platform issue affects them. The Azure status page shows broad service health for all regions, not the health of one specific VM.
Question 35Cloud Concepts
Contoso runs a small code function that executes only a few hundred times a day. With a serverless consumption plan, how is Contoso billed?
Correct answer: A. Only for the executions and compute time used
Serverless compute on a consumption plan bills only for the executions and resources your code uses while it runs. You do not pay for idle servers, unlike a VM that is billed for as long as it is running.
Serverless compute on a consumption plan bills only for the executions and resources your code uses while it runs. You do not pay for idle servers, unlike a VM that is billed for as long as it is running.
Question 36Azure Architecture & Services
Contoso wants to discover its on-premises servers, assess them for Azure readiness and estimate costs before moving them. Which service should it use?
Correct answer: D. Azure Migrate
Azure Migrate provides a central hub to discover, assess and migrate on-premises servers, databases and web apps to Azure. Azure Data Box moves large amounts of data offline, but it does not assess servers for migration.
Azure Migrate provides a central hub to discover, assess and migrate on-premises servers, databases and web apps to Azure. Azure Data Box moves large amounts of data offline, but it does not assess servers for migration.
Question 37Management & Governance
A new administrator at Bellows College prefers a graphical, web-based console to create resources and build custom dashboards without writing commands. What should he use?
Correct answer: B. Azure portal
The Azure portal is a web-based graphical console for building, managing and monitoring resources, including customizable dashboards. Azure CLI and Azure PowerShell are command-line tools, which the administrator wants to avoid.
The Azure portal is a web-based graphical console for building, managing and monitoring resources, including customizable dashboards. Azure CLI and Azure PowerShell are command-line tools, which the administrator wants to avoid.
Question 38Cloud Concepts
Northwind Traders wants built-in protection against distributed denial-of-service (DDoS) attacks. It also wants a choice between managing its own patches or having them applied automatically. Which cloud benefit does this describe?
Correct answer: C. Security
The security benefit of the cloud includes platform protections such as DDoS defense and a choice of models, from full control in IaaS to automatic patching in PaaS and SaaS. Governance focuses on standards and compliance, not on protection from attacks.
The security benefit of the cloud includes platform protections such as DDoS defense and a choice of models, from full control in IaaS to automatic patching in PaaS and SaaS. Governance focuses on standards and compliance, not on protection from attacks.
Question 39Azure Architecture & Services
Fabrikam's branch offices use Windows file servers. It wants frequently used files cached on those local servers while the full data set is stored in Azure Files. What should it use?
Correct answer: B. Azure File Sync
Azure File Sync caches Azure file shares on Windows Servers, and cloud tiering keeps frequently used files local while the rest stays in Azure. AzCopy copies files on demand but does not keep a synchronized local cache.
Azure File Sync caches Azure file shares on Windows Servers, and cloud tiering keeps frequently used files local while the rest stays in Azure. AzCopy copies files on demand but does not keep a synchronized local cache.
Question 40Management & Governance
Fabrikam's finance team wants to see last month's accumulated Azure costs broken down by service and resource group. Which feature should it use?
Correct answer: D. Cost analysis in Microsoft Cost Management
Cost analysis in Microsoft Cost Management shows actual accumulated costs and lets you group them by service, resource group, tag and more. The Pricing calculator only estimates future costs and does not show what you actually spent.
Cost analysis in Microsoft Cost Management shows actual accumulated costs and lets you group them by service, resource group, tag and more. The Pricing calculator only estimates future costs and does not show what you actually spent.
Question 41Azure Architecture & Services
Litware is moving a legacy app that requires domain join and Kerberos authentication to Azure VMs. It does not want to deploy or manage domain controllers. What should it use?
Correct answer: B. Microsoft Entra Domain Services
Microsoft Entra Domain Services provides managed domain services, such as domain join, Group Policy, LDAP and Kerberos authentication, without you running domain controllers. Microsoft Entra B2B collaboration is for inviting external users, not for supporting legacy authentication.
Microsoft Entra Domain Services provides managed domain services, such as domain join, Group Policy, LDAP and Kerberos authentication, without you running domain controllers. Microsoft Entra B2B collaboration is for inviting external users, not for supporting legacy authentication.
Question 42Cloud Concepts
An administrator at Litware stops and deallocates an Azure VM over the weekend. Which charge continues during that time?
Correct answer: C. Storage for the VM's managed disks
When a VM is stopped and deallocated, compute charges stop, but you still pay for the managed disks that store its data. Licenses billed with the VM's running hours also stop, because the VM is no longer running.
When a VM is stopped and deallocated, compute charges stop, but you still pay for the managed disks that store its data. Licenses billed with the VM's running hours also stop, because the VM is no longer running.
Question 43Management & Governance
Adatum's admins build environments by clicking through the Azure portal, and the results are often inconsistent. Adatum wants environments defined in code that can be versioned and reused. Which practice should it adopt?
Correct answer: A. Infrastructure as code
Infrastructure as code manages and provisions resources from definition files that can be kept in version control and run again with the same result. Checklists for manual portal work still leave room for human error and drift between environments.
Infrastructure as code manages and provisions resources from definition files that can be kept in version control and run again with the same result. Checklists for manual portal work still leave room for human error and drift between environments.
Question 44Azure Architecture & Services
Adatum wants consultants from a partner company to access its SharePoint site by signing in with their own work accounts. What should Adatum use?
Correct answer: D. Microsoft Entra B2B collaboration
Microsoft Entra B2B collaboration lets you invite external users as guests, and they sign in with their own credentials. Creating new member accounts would force the consultants to manage a second set of credentials.
Microsoft Entra B2B collaboration lets you invite external users as guests, and they sign in with their own credentials. Creating new member accounts would force the consultants to manage a second set of credentials.
Question 45Cloud Concepts
Proseware's database VM is running out of memory. The team resizes it to a VM size with more CPU and memory. What is this called?
Correct answer: A. Scaling up
Scaling up, or vertical scaling, increases the capacity of an existing resource, such as moving a VM to a larger size. Adding more VMs would instead spread the load across extra instances.
Scaling up, or vertical scaling, increases the capacity of an existing resource, such as moving a VM to a larger size. Adding more VMs would instead spread the load across extra instances.
Question 46Management & Governance
Before contacting support, a consultant at Margie's Travel wants a public view of the health of all Azure services across every region, without signing in. What should he check?
Correct answer: C. The Azure status page
The Azure status page is a public page that shows the global health of Azure services in all regions and does not require signing in. Resource Health requires signing in and focuses on your own individual resources.
The Azure status page is a public page that shows the global health of Azure services in all regions and does not require signing in. Resource Health requires signing in and focuses on your own individual resources.
Question 47Azure Architecture & Services
Proseware's security team adopts a model that verifies every access request explicitly, grants least privilege access and assumes a breach has already happened. What is this model called?
Correct answer: D. Zero Trust
Zero Trust is a security model based on three principles: verify explicitly, use least privilege access, and assume breach. Defense in depth is a layered strategy and does not by itself treat every request as untrusted.
Zero Trust is a security model based on three principles: verify explicitly, use least privilege access, and assume breach. Defense in depth is a layered strategy and does not by itself treat every request as untrusted.
Question 48Cloud Concepts
Margie's Travel runs a VM workload at a steady load around the clock and plans to keep it for three years. Which pricing option lowers its compute cost the most?
Correct answer: D. Azure Reservations
Azure Reservations give a significant discount in exchange for a one-year or three-year commitment, which suits workloads that run steadily. Pay-as-you-go needs no commitment but charges the full rate for every hour the VMs run.
Azure Reservations give a significant discount in exchange for a one-year or three-year commitment, which suits workloads that run steadily. Pay-as-you-go needs no commitment but charges the full rate for every hour the VMs run.
Question 49Management & Governance
Wingtip Toys wants Azure Policy to fix existing resources that are missing a required tag, not just report them as noncompliant. What should the administrator use?
Correct answer: B. A policy remediation task
Remediation tasks bring existing noncompliant resources into compliance for policies with modify or deployIfNotExists effects. A lock prevents deletion but does not add missing tags.
Remediation tasks bring existing noncompliant resources into compliance for policies with modify or deployIfNotExists effects. A lock prevents deletion but does not add missing tags.
Question 50Azure Architecture & Services
Humongous Insurance protects its workloads with separate controls for physical security, identity, network, compute, application and data. If one layer fails, another still protects the data. Which approach is this?
Correct answer: C. Defense in depth
Defense in depth uses multiple layers of security so that an attacker who gets through one layer still faces others. Zero Trust focuses on verifying every request rather than on stacking separate protection layers.
Defense in depth uses multiple layers of security so that an attacker who gets through one layer still faces others. Zero Trust focuses on verifying every request rather than on stacking separate protection layers.
The real AZ-900 exam at a glance
50questions
45mtime limit
MCQmultiple choice
80%+aim for here
Score 80% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free Microsoft Azure & Power BI practice tests
AZ-104 Practice Test50 questions · Azure AdministratorAZ-305 Practice Test50 questions · Azure Solutions ArchitectAZ-400 Practice Test50 questions · Azure DevOps EngineerPL-300 Practice Test50 questions · Power BI Data Analyst
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the AZ-900 exam. They are not real exam questions. AZ-900 and Microsoft are trademarks of their owners. Real exam format: usually 40-60 questions · 45 minutes · passing score 700 on a 1-1000 scale.