AZ-900 practice questions and answers
All 15 questions from Practice Test 1 for Microsoft Azure Fundamentals, with the correct answer and a full explanation for each — including why the other options are wrong. Free to read, no signup.
What this set covers
Questions are weighted to match the official AZ-900 exam guide. The real exam is 40–60 questions in 45 minutes with a pass mark of 700 / 1000.
- Cloud Concepts3 q · 28%
- Azure Architecture and Services7 q · 38%
- Azure Management and Governance5 q · 34%
A company wants to add capacity automatically when traffic rises and remove it when traffic drops. Which cloud characteristic is this?
- AElasticity✓
- BHigh availability
- CDisaster recovery
- DGovernance
Correct answer: A — Elasticity
Elasticity means resources scale out and in to match demand. High availability keeps a service running during failures, disaster recovery is about recovering after a major outage, and governance is about rules and control.
Benefits of cloud computingIn which cloud service model does the provider manage the operating system and runtime while you deploy only your application code?
- AIaaS
- BPaaS✓
- CSaaS
- DOn-premises
Correct answer: B — PaaS
Platform as a Service — for example Azure App Service — gives you a managed platform where you deploy code. With IaaS you still manage the operating system on a virtual machine. With SaaS you only use the finished application, such as Microsoft 365.
Cloud service typesWhich statement best describes capital expenditure (CapEx) compared with operational expenditure (OpEx) in the cloud?
- ACapEx is a monthly pay-as-you-go charge; OpEx is an up-front hardware purchase.
- BCapEx is an up-front purchase of infrastructure; OpEx is ongoing consumption-based spending.✓
- CBoth mean the same thing in cloud billing.
- DOpEx only applies to on-premises data centres.
Correct answer: B — CapEx is an up-front purchase of infrastructure; OpEx is ongoing consumption-based spending.
CapEx is money spent up front on assets such as servers. Cloud spending is normally OpEx: you pay for what you consume, month by month, with no large purchase at the start.
CapEx vs OpExWhat is an Azure Availability Zone?
- AA physically separate data centre location inside an Azure region, with its own power, cooling and networking.✓
- BA pair of regions used together for replication.
- CA logical container for grouping resources.
- DA global edge cache for static content.
Correct answer: A — A physically separate data centre location inside an Azure region, with its own power, cooling and networking.
Availability Zones are separate physical locations within one region, so a zone-redundant deployment survives the loss of a single data centre. A region pair is two regions used for replication, a resource group is the logical container, and Azure CDN caches content at the edge.
Regions and Availability ZonesWhich Azure service should you use to run a container-based application with Kubernetes orchestration, without managing the control plane yourself?
- AAzure Container Instances
- BAzure Kubernetes Service (AKS)✓
- CAzure Virtual Machines
- DAzure Functions
Correct answer: B — Azure Kubernetes Service (AKS)
AKS is managed Kubernetes: Azure runs the control plane for you. Container Instances runs single containers with no orchestration, VMs mean you install everything yourself, and Functions is event-driven serverless code.
Azure compute servicesWhich storage service is designed for storing large amounts of unstructured data such as images, video and backups?
- AAzure Blob Storage✓
- BAzure Files
- CAzure Table Storage
- DAzure Disk Storage
Correct answer: A — Azure Blob Storage
Blob Storage is Azure's object store for unstructured data. Azure Files gives SMB/NFS file shares, Table Storage holds NoSQL key-value data, and Disk Storage provides virtual disks for VMs.
Azure Blob Storage introductionA company needs a fully managed relational database with automatic patching and backups, running the PostgreSQL engine. Which service should it choose?
- AAzure SQL Managed Instance
- BAzure Database for PostgreSQL✓
- CAzure Cosmos DB
- DPostgreSQL installed on an Azure VM
Correct answer: B — Azure Database for PostgreSQL
Azure Database for PostgreSQL is the managed PostgreSQL offering. SQL Managed Instance runs the Microsoft SQL Server engine, Cosmos DB is a NoSQL database, and installing PostgreSQL on a VM makes patching and backups your job.
Azure Database for PostgreSQLWhich service enforces organizational rules such as 'only deploy resources in West Europe' and reports on resources that break them?
- AAzure Policy✓
- BAzure RBAC
- CMicrosoft Defender for Cloud
- DResource locks
Correct answer: A — Azure Policy
Azure Policy checks resources against rules and can deny or audit non-compliant deployments. RBAC controls who may perform actions, Defender for Cloud focuses on security posture and threats, and resource locks prevent deletion or changes.
What is Azure Policy?You must stop anyone from accidentally deleting a production resource group, while still allowing changes inside it. What should you apply?
- AA CanNotDelete resource lock✓
- BA ReadOnly resource lock
- CAn Azure Policy deny assignment on writes
- DRemove Contributor access from everyone
Correct answer: A — A CanNotDelete resource lock
A CanNotDelete lock blocks deletion but still allows reading and modifying resources. A ReadOnly lock would also block changes. Denying writes with policy or removing Contributor stops legitimate work.
Lock resources to prevent changesWhich tool estimates the monthly cost of a planned Azure solution before you deploy anything?
- AAzure Pricing Calculator✓
- BMicrosoft Cost Management
- CTotal Cost of Ownership (TCO) Calculator
- DAzure Advisor
Correct answer: A — Azure Pricing Calculator
The Pricing Calculator prices a proposed set of Azure services. Cost Management analyses spend that has already happened. The TCO Calculator compares on-premises costs with Azure. Advisor recommends improvements to existing resources.
Azure Pricing CalculatorIn the Azure resource hierarchy, what is the correct order from broadest to narrowest?
- AManagement group → Subscription → Resource group → Resource✓
- BSubscription → Management group → Resource group → Resource
- CResource group → Subscription → Management group → Resource
- DTenant → Resource → Resource group → Subscription
Correct answer: A — Management group → Subscription → Resource group → Resource
Management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources. Policies and role assignments applied higher up are inherited downward.
Azure management groupsWhich service collects metrics and logs from Azure resources and can raise alerts when a threshold is crossed?
- AAzure Monitor✓
- BAzure Service Health
- CAzure Advisor
- DAzure Arc
Correct answer: A — Azure Monitor
Azure Monitor gathers metrics and logs and drives alerts and dashboards. Service Health reports Azure platform incidents that affect you. Advisor gives best-practice recommendations. Azure Arc extends Azure management to servers outside Azure.
Azure Monitor overviewWhich identity service provides sign-in and access management for Azure and Microsoft 365, including multi-factor authentication and conditional access?
- AMicrosoft Entra ID✓
- BAzure Key Vault
- CAzure Bastion
- DAzure Firewall
Correct answer: A — Microsoft Entra ID
Microsoft Entra ID (formerly Azure Active Directory) is the cloud identity provider. Key Vault stores secrets and keys, Bastion gives secure RDP/SSH access to VMs through the portal, and Azure Firewall filters network traffic.
What is Microsoft Entra ID?Which two options can reduce the cost of Azure virtual machines for long-running, predictable workloads? (Select TWO.)
- AReserved Instances (1-year or 3-year reservations)✓
- BAzure Hybrid Benefit for existing Windows Server licences✓
- CMoving the VMs to a different resource group
- DAdding a CanNotDelete lock
- EEnabling Azure Monitor alerts
Correct answer: A, B — Reserved Instances (1-year or 3-year reservations) · Azure Hybrid Benefit for existing Windows Server licences
Reservations commit to one or three years for a large discount, and Azure Hybrid Benefit lets you reuse licences you already own. Resource groups, locks and alerts change management and safety, not price.
Save on Azure VMsA team needs to connect an on-premises network to an Azure virtual network over a private connection that does not travel across the public internet. What should they use?
- ASite-to-Site VPN
- BAzure ExpressRoute✓
- CVNet peering
- DAzure Front Door
Correct answer: B — Azure ExpressRoute
ExpressRoute is a private circuit from a connectivity provider into Azure, bypassing the public internet. A Site-to-Site VPN is encrypted but still crosses the internet. VNet peering connects two Azure virtual networks, and Front Door is a global entry point for web applications.
ExpressRoute overviewReady to try it under exam conditions?
Reading answers is not the same as recalling them with a clock running. Take the same 15 questions as a timed mock exam — 25 minutes, no feedback until you submit, then a score broken down by exam domain so you know what to study.
Start the timed AZ-900 test →