Free AZ-900 practice test: 60 explained questions across all three skill areas
AZ-900 practice test · 60 questions
Keys: 1–4 or A–D to answer, left and right arrows to move
45 minutes over 60 questions is 45 seconds a question. A pacing drill over this set — it says nothing about how Microsoft scores the exam.
Question 1 of 60
untimed
Cloud conceptsDescribe cloud computing
A team wants code to run only when a file is uploaded, with no servers to manage and billing only while the code runs. Which approach fits best?
Serverless compute runs code in response to events, scales automatically and bills per execution, so nothing is paid while the code is idle. The provider manages the servers that still exist underneath.
Why each answer is in or out
AAn App Service plan bills for its instances around the clock, even when no file arrives.
BDedicated hardware is the opposite of serverless: you pay for the whole host whether code runs or not.
CCorrect: a serverless function such as Azure Functions fires on the upload event and is billed only for execution time.
DA reservation commits you to one or three years of a VM that you still have to manage.
Architecture and servicesDescribe the core architectural components of Azure
Which Azure feature provides protection against datacenter failures by distributing resources across separate physical locations within a region?
Availability zones are physically separate locations within an Azure region that protect applications and data from datacenter failures.
Why each answer is in or out
AVirtual networks isolate traffic; they do not spread resources across datacenters.
BResource groups are logical containers with no physical placement.
CCorrect: availability zones are physically separate datacenter groups within a region, each with its own power, cooling and networking.
DRegion pairs protect against a whole-region outage, not a single datacenter within a region.
Management and governanceDescribe cost management in Azure
Which tool helps you calculate estimated costs before deploying Azure resources?
The Azure Pricing Calculator helps estimate costs for Azure services before deployment based on expected usage.
Why each answer is in or out
AService Health reports Azure outages and maintenance.
BCost analysis shows spending that has already happened.
CCorrect: the Pricing Calculator estimates the cost of services before you deploy them.
DAdvisor recommends improvements to resources you have already deployed.
Cloud conceptsDescribe cloud computing
Which cloud deployment model is characterized by services being hosted and managed by a third-party provider and shared among multiple organizations?
Public cloud is a deployment model where services are hosted by a third-party provider and shared among multiple organizations, offering broad accessibility and cost efficiency.
Why each answer is in or out
AA private cloud serves a single organization, not many organizations at once.
BHybrid combines on-premises or private infrastructure with public cloud; it is not defined by multi-tenant sharing.
CCorrect: in a public cloud a third-party provider owns and runs the infrastructure and shares it among many customers.
DCommunity cloud is shared by a specific group with common needs; it is not one of the AZ-900 core models.
Architecture and servicesDescribe the core architectural components of Azure
Which Azure feature ensures that data remains available even if a datacenter fails by replicating resources across paired geographical locations?
Region pairs in Azure provide automatic replication for certain services and prioritized recovery in the event of outages, ensuring business continuity.
Why each answer is in or out
AResource groups are logical containers and replicate nothing.
BAvailability zones stay within one region, while the stem describes paired geographic locations.
CCorrect: region pairs couple two regions in the same geography for cross-region replication and prioritized recovery.
DManagement groups organize subscriptions for governance.
Management and governanceDescribe cost management in Azure
You need to track costs across multiple Azure subscriptions in your organization. Which tool should you use?
Azure Cost Management and Billing provides tools to monitor, allocate, and optimize Azure spending across multiple subscriptions.
Why each answer is in or out
AService Health reports Azure platform incidents and maintenance, not spending.
BCorrect: Cost Management and Billing analyzes, budgets and allocates actual spending across subscriptions.
CAdvisor cost recommendations suggest savings on existing resources; they do not track spending across subscriptions.
DThe Pricing Calculator estimates future costs; it does not track actual spend.
Cloud conceptsDescribe cloud computing
Which cloud deployment model combines both public and private cloud infrastructures?
Hybrid cloud combines public and private cloud infrastructures, allowing organizations to use both environments while maintaining data and applications between them.
Why each answer is in or out
AMulti-cloud means using several public cloud providers, not mixing public and private.
BPublic cloud alone has no private component.
CCorrect: hybrid cloud connects public cloud with private or on-premises infrastructure so workloads can run in both.
DPrivate cloud alone has no public component.
Architecture and servicesDescribe the core architectural components of Azure
Which Azure architectural component allows you to host resources in countries with specific regulatory requirements?
Sovereign regions are specialized Azure regions that meet specific country or regulatory compliance requirements for data residency.
Why each answer is in or out
AAvailability zones provide resiliency within a region, not regulatory isolation.
BRegion pairs are for disaster recovery.
CCorrect: sovereign regions, such as Azure Government or Azure operated by 21Vianet, are isolated instances for specific legal and compliance needs.
DResource groups are logical containers.
Management and governanceDescribe cost management in Azure
Which pricing model should you choose if you commit to using specific Azure services for one or three years?
Reserved instances provide discounted pricing when you commit to using specific Azure services for one or three year terms.
Why each answer is in or out
ASpot instances use spare capacity at a discount but can be evicted, and have no term commitment.
BThe free tier offers limited free usage with no commitment.
CPay-as-you-go has no commitment, which is why it costs more per hour.
DCorrect: reservations (reserved instances) give a discount for a one- or three-year commitment.
Cloud conceptsDescribe cloud computing
In the shared responsibility model, which component is always the responsibility of the cloud provider?
Physical security of data centers is always the responsibility of the cloud provider in the shared responsibility model, regardless of the service type.
Why each answer is in or out
AManaging who can access applications and data stays with the customer in every service type.
BCorrect: physical datacenter security, from buildings to hardware, is always the provider's job in IaaS, PaaS and SaaS.
CEncryption choices and key management often stay partly with the customer.
DApplication passwords belong to the customer's accounts and identities, which the customer always manages.
Architecture and servicesDescribe the core architectural components of Azure
What Azure feature enables you to group multiple related resources for easier management?
Resource groups allow you to manage related Azure resources as a single unit, making it easier to organize and administer resources.
Why each answer is in or out
AContainer groups are an Azure Container Instances concept for co-scheduled containers.
BSubscriptions are billing and access boundaries that hold resource groups.
CManagement groups organize subscriptions, not individual resources.
DCorrect: resource groups hold related resources that share a lifecycle so they can be managed together.
Management and governanceDescribe cost management in Azure
What should you use to receive notifications when your Azure costs exceed a specified amount?
Budget alerts in Azure Cost Management notify you when costs exceed predefined thresholds.
Why each answer is in or out
AService Health alerts cover Azure platform incidents, not spending.
BCorrect: Cost Management budgets fire alerts when actual or forecast spending crosses a threshold.
CActivity log alerts react to management operations.
DMetric alerts watch resource performance values.
Cloud conceptsDescribe cloud computing
In the shared responsibility model, what is typically the customer's responsibility when using SaaS?
Data and user access management remain the customer's responsibility in SaaS applications while the provider manages everything else.
Why each answer is in or out
AIn SaaS the provider maintains the application itself.
BIn SaaS the provider patches the operating system; the customer never sees it.
CIn SaaS the provider secures the infrastructure.
DCorrect: even in SaaS, the customer always owns its data, devices, accounts and who gets access.
Architecture and servicesDescribe the core architectural components of Azure
What is the hierarchical structure used to organize subscriptions in Azure?
Management groups provide a way to hierarchically organize subscriptions for governance and management purposes.
Why each answer is in or out
AContainer groups belong to Azure Container Instances.
BCorrect: management groups sit above subscriptions and can nest to form a governance hierarchy.
CVirtual networks are networking constructs.
DResource groups sit below subscriptions, not above them.
Management and governanceDescribe cost management in Azure
What should you use to track costs by department across multiple subscriptions?
Tags can be used to allocate costs to specific departments when applied consistently across subscriptions.
Why each answer is in or out
ACorrect: tags such as 'department' can be applied across subscriptions and filtered in cost analysis.
BManagement groups group subscriptions, and departments rarely map neatly to them.
CResource groups are tied to one subscription and to a lifecycle, not a department.
DService principals are app identities and do not categorize costs.
Cloud conceptsDescribe cloud computing
When comparing cloud pricing models, what is a key advantage of the consumption-based model over traditional IT spending?
Reduced upfront costs is a key advantage of consumption-based pricing as it eliminates the need for large initial infrastructure investments.
Why each answer is in or out
ACorrect: paying per use removes the large upfront hardware purchase that traditional IT requires.
BPay-as-you-go does not reserve or guarantee capacity; reservations do that.
CConsumption pricing varies with usage; it is not a fixed monthly amount.
DWith consumption pricing the provider owns the hardware, not the customer.
Architecture and servicesDescribe the core architectural components of Azure
What is the primary purpose of an Azure subscription?
An Azure subscription provides authenticated and authorized access to Azure products and services and is a unit of billing.
Why each answer is in or out
ASubscriptions can help organize workloads, but their defining role is billing and access; day-to-day grouping of resources is done with resource groups and tags.
BStorage is allocated through storage accounts.
CNetwork configuration is done in virtual networks.
DCorrect: a subscription is a billing unit and an access-control boundary for the resources it contains.
Management and governanceDescribe features and tools in Azure for governance and compliance
Which feature allows you to prevent accidental deletion of Azure resources?
Resource locks prevent accidental modification or deletion of Azure resources by applying either ReadOnly or Delete restrictions.
Why each answer is in or out
AAzure Policy enforces standards when resources are created; locks are the tool for preventing deletion.
BAdvisor gives recommendations and blocks nothing.
CCorrect: a Delete (CanNotDelete) or ReadOnly lock blocks deletion even for users with Owner rights.
DTags are metadata and do not protect resources.
Cloud conceptsDescribe cloud computing
Which cloud model best suits an organization that needs to maintain legacy applications on-premises while moving new applications to the cloud?
Hybrid cloud allows organizations to keep legacy systems on-premises while leveraging cloud resources for new applications.
Why each answer is in or out
ACorrect: hybrid cloud lets legacy systems stay on-premises while new applications run in the public cloud, connected as one environment.
BPrivate cloud only would not move the new applications to a public cloud.
CPure public cloud would require moving the legacy applications too.
DCommunity cloud is shared infrastructure for a specific group, not a mix of on-premises and cloud.
Architecture and servicesDescribe Azure compute and networking services
Which Azure compute service is best suited for event-driven, serverless code execution?
Azure Functions provides serverless compute that runs code in response to events, without managing the underlying infrastructure.
Why each answer is in or out
AApp Service hosts always-on web apps rather than per-event code.
BCorrect: Azure Functions runs code in response to events and bills per execution, which makes it serverless.
CVMs require you to manage the OS and pay while they run.
DContainer Instances run containers you build; they are not event-driven functions.
Management and governanceDescribe features and tools in Azure for governance and compliance
Which Microsoft service helps an organization discover, classify and govern its data across Azure, on-premises and other clouds?
Microsoft Purview is a family of data governance, risk and compliance solutions. It maps and classifies data wherever it lives and gives a unified view for compliance.
Why each answer is in or out
ADefender for Cloud protects workloads from threats; it does not catalog and classify data.
BCorrect: Microsoft Purview discovers, classifies and governs data across Azure, on-premises, SaaS and other clouds.
CAzure Arc extends Azure management to non-Azure servers and clusters.
DAzure Policy governs resource configuration, not the data inside resources.
Cloud conceptsDescribe the benefits of using cloud services
What cloud computing benefit allows organizations to quickly increase or decrease resources based on demand?
Scalability is the cloud computing benefit that enables organizations to adjust their resource usage up or down based on demand.
Why each answer is in or out
APredictability is about forecasting cost and performance, not resizing resources.
BCorrect: scalability means adding or removing resources (vertically or horizontally) to match demand.
CGovernance is about enforcing standards and policies.
DSecurity protects resources; it does not change their capacity.
Architecture and servicesDescribe Azure compute and networking services
Which Azure service enables you to run applications in containers without orchestration?
Azure Container Instances allows you to run containers without the complexity of container orchestration.
Why each answer is in or out
AApp Service hosts web apps; it is not the simplest way to run a single container.
BCorrect: Azure Container Instances runs containers on demand with no orchestrator to set up.
CService Fabric is a distributed-systems and orchestration platform.
DAKS is a managed Kubernetes orchestrator, the opposite of 'without orchestration'.
Management and governanceDescribe features and tools in Azure for governance and compliance
How can you ensure Azure resources are deployed to approved regions only?
Azure Policy can restrict resource deployment to specific approved regions for compliance or cost purposes.
Why each answer is in or out
ACorrect: a policy such as 'Allowed locations' denies deployments outside the approved regions.
BLocks prevent deletion or changes to existing resources; they do not control where resources are created.
CAlerts notify after the fact and block nothing.
DTags are labels and enforce nothing.
Cloud conceptsDescribe the benefits of using cloud services
What cloud computing benefit refers to the ability to recover quickly from failures and continue operating?
Reliability in cloud computing refers to the ability of a system to recover from failures and continue operating without significant downtime.
Why each answer is in or out
AScalability adjusts capacity to load; it does not handle failure recovery.
BGovernance enforces policies and standards.
CManageability concerns how easily resources are managed and monitored.
DCorrect: reliability is the ability to recover from failures and keep functioning, helped by the cloud's distributed design.
Architecture and servicesDescribe Azure compute and networking services
Which Azure service enables hybrid connectivity between on-premises networks and Azure through a private connection?
Azure ExpressRoute provides a private, dedicated connection between on-premises networks and Azure, bypassing the public internet.
Why each answer is in or out
AAzure DNS resolves names; it does not create connections.
BAzure Firewall filters traffic but provides no private link to on-premises.
CNSGs filter subnet or NIC traffic.
DCorrect: ExpressRoute is a private, dedicated connection from on-premises to Azure that does not cross the public internet.
Management and governanceDescribe features and tools in Azure for governance and compliance
Which feature should you use to ensure all resources are created with required tags?
Azure Policy can enforce tagging rules by requiring specific tags during resource creation.
Why each answer is in or out
ACorrect: Azure Policy can require a tag (Deny) or add it automatically (Modify) when resources are created.
BManagement groups are a scope where policy can be assigned, but they enforce nothing themselves.
CAdvisor recommends; it does not enforce tags.
DLocks prevent deletion or changes, not missing tags.
Cloud conceptsDescribe the benefits of using cloud services
What cloud computing benefit ensures that services remain accessible with minimal downtime?
High availability ensures that cloud services remain accessible and operational with minimal downtime through redundant resources.
Why each answer is in or out
AScalability handles changing demand, not uptime.
BManageability concerns administering resources.
CSecurity protects against threats, not downtime.
DCorrect: high availability keeps a service accessible with minimal downtime, often backed by an SLA.
Architecture and servicesDescribe Azure compute and networking services
What Azure service enables secure access to resources through an encrypted tunnel over the internet?
VPN Gateway provides secure encrypted connections between Azure virtual networks and on-premises locations over the internet.
Why each answer is in or out
AAzure Firewall inspects and filters traffic; it is not a tunnel.
BCorrect: VPN Gateway sends encrypted IPsec tunnels over the public internet (site-to-site or point-to-site).
CNSGs are allow/deny rule sets.
DExpressRoute is private connectivity that does not go over the internet.
Management and governanceDescribe features and tools in Azure for governance and compliance
Which Azure policy effect prevents non-compliant resources from being created?
The 'Deny' effect in Azure Policy prevents the creation of resources that don't meet policy requirements.
Why each answer is in or out
AAppend adds fields to a request; it does not block it.
BCorrect: Deny rejects a create or update request that does not comply.
CAudit lets the resource be created and only flags it as non-compliant.
DDeployIfNotExists deploys a related resource after creation; it does not block anything.
Cloud conceptsDescribe the benefits of using cloud services
What cloud computing benefit enables organizations to implement consistent controls and policies across their resources?
Governance is the cloud computing benefit that allows organizations to implement and maintain consistent controls and policies across their cloud resources.
Why each answer is in or out
ACorrect: governance means applying consistent standards, policies and compliance controls across resources.
BReliability concerns recovering from failures.
CScalability concerns adjusting capacity.
DHigh availability concerns uptime.
Architecture and servicesDescribe Azure compute and networking services
Which networking feature allows Azure resources to communicate with services privately without crossing the internet?
Private endpoints enable Azure resources to communicate with supported Azure services privately using a private IP address.
Why each answer is in or out
AA public endpoint is reached over the internet, the opposite of the requirement.
BVPN Gateway connects networks, not Azure resources to a specific PaaS service.
CCorrect: a private endpoint gives a service a private IP in your VNet, so traffic stays on the Microsoft network.
DExpressRoute links on-premises networks to Azure; it does not give a service a private address.
Management and governanceDescribe features and tools for managing and deploying Azure resources
Which tool provides a browser-based shell environment for managing Azure resources?
Azure Cloud Shell is a browser-based shell experience that provides command-line tools for managing Azure resources.
Why each answer is in or out
AAzure PowerShell is a module you can run anywhere, including inside Cloud Shell; it is not itself a browser shell.
BThe Azure CLI is a tool, not a hosted environment.
CCorrect: Cloud Shell is a browser-based, authenticated shell with Bash or PowerShell and Azure tools preinstalled.
DThe portal is a graphical interface, not a shell.
Cloud conceptsDescribe the benefits of using cloud services
In the context of cloud computing, what best describes agility?
Agility refers to the ability to rapidly deploy and modify resources in response to changing business needs.
Why each answer is in or out
AData protection is a security concern, not agility.
BSecurity is a separate cloud benefit.
CLower cost can follow from agility, but it is not what agility means.
DCorrect: agility is how quickly you can deploy, change and remove resources as business needs shift.
Architecture and servicesDescribe Azure compute and networking services
Which Azure service provides the ability to host web applications without managing the underlying infrastructure?
Azure App Service enables you to build and host web applications without managing the underlying infrastructure.
Why each answer is in or out
ACorrect: Azure App Service is a managed PaaS for hosting web apps and APIs without managing servers.
BAzure Functions is for event-driven code, not general web hosting.
CVirtual machines make you manage the OS.
DContainer Instances runs single containers and lacks web-hosting features like deployment slots.
Management and governanceDescribe features and tools for managing and deploying Azure resources
What is the main purpose of Azure Resource Manager templates?
ARM templates enable infrastructure as code by allowing you to define and deploy Azure resources in a consistent, repeatable way.
Why each answer is in or out
ACorrect: ARM templates are declarative JSON files for repeatable infrastructure as code deployments.
BSecurity monitoring is Defender for Cloud's job.
CCost tracking is Cost Management's job.
DPerformance analysis belongs to Azure Monitor.
Cloud conceptsDescribe the benefits of using cloud services
What is a key benefit of vertical scaling in cloud computing?
Vertical scaling allows for increased performance of existing resources by adding more power to current instances without architectural changes.
Why each answer is in or out
AReplication is about redundancy, not scaling up.
BCorrect: vertical scaling (scaling up) adds CPU or memory to an existing instance so it performs better.
CNetwork isolation is a networking control.
DSpreading resources across regions relates to horizontal scale and global reach.
Architecture and servicesDescribe Azure storage services
Backup data is rarely read but must be readable within milliseconds when needed, and it will be kept for at least 90 days. Which blob access tier is most cost-effective?
The Cold tier is an online tier with lower storage cost than Cool and a 90-day minimum retention. Archive is cheaper still, but it is offline: blobs must be rehydrated, which takes hours.
Why each answer is in or out
ACorrect: Cold is an online tier with millisecond access, cheaper storage than Cool and a 90-day minimum, which fits the requirement.
BArchive is cheapest, but it is offline: reading requires hours of rehydration.
CCool is online too, but it costs more to store than Cold for data kept 90+ days and rarely read.
DHot has the highest storage cost and is meant for frequently accessed data.
Management and governanceDescribe features and tools for managing and deploying Azure resources
Which feature helps you manage hybrid and multi-cloud environments from Azure?
Azure Arc extends Azure management to hybrid and multi-cloud environments, enabling resource management across different locations.
Why each answer is in or out
AAzure Policy can be extended to Arc-enabled resources, but Arc is what brings those resources under Azure management.
BService Health reports Azure platform incidents.
CCorrect: Azure Arc projects on-premises and other-cloud servers, Kubernetes clusters and data services into Azure Resource Manager.
DAzure Monitor collects telemetry; it does not make external resources manageable as Azure resources.
Cloud conceptsDescribe cloud service types
Which cloud service type provides complete applications that are ready to use and requires minimal management from the customer?
Software as a Service (SaaS) provides fully functional applications that are ready to use, with the provider managing all aspects of the service.
Why each answer is in or out
AIaaS gives you raw infrastructure to manage, not a finished application.
BCorrect: SaaS delivers a complete, ready-to-use application, and the provider runs everything underneath.
CFaaS runs your own code on events; you still build the application.
DPaaS gives a platform for building your own applications.
Architecture and servicesDescribe Azure storage services
Which storage redundancy option keeps three copies of your data within a single physical location?
Locally redundant storage (LRS) maintains three copies of data within a single physical location in the primary region.
Why each answer is in or out
AGRS also copies data to a secondary region.
BZRS spreads copies across three availability zones.
CCorrect: LRS keeps three synchronous copies within one datacenter in the primary region.
DRA-GRS is GRS plus read access to the secondary region.
Management and governanceDescribe features and tools for managing and deploying Azure resources
What is the primary interface for managing Azure resources through a graphical user interface?
The Azure portal is the primary web-based interface for managing Azure resources with a graphical user interface.
Why each answer is in or out
AThe Azure CLI is a command-line tool.
BCloud Shell is a browser-based command line.
CAzure PowerShell is a command-line module.
DCorrect: the Azure portal is the web-based graphical console for creating and managing resources.
Cloud conceptsDescribe cloud service types
Which cloud service model provides virtual machines, storage, and networking resources directly to customers?
Infrastructure as a Service (IaaS) provides basic computing infrastructure including virtual machines, storage, and networking resources that customers can manage directly.
Why each answer is in or out
ACorrect: IaaS provides virtual machines, storage and networking that the customer configures and manages.
BPaaS hides the VMs and provides a managed platform.
CDBaaS provides a managed database only.
DSaaS delivers finished applications, not infrastructure.
Architecture and servicesDescribe Azure storage services
Which Azure storage service is best suited for storing unstructured data like images, videos, and documents?
Azure Blob Storage is designed for storing large amounts of unstructured data, such as documents, media files, and backups.
Why each answer is in or out
ACorrect: Blob Storage is object storage for unstructured data such as images, video and documents.
BQueue Storage holds messages between application components.
DAzure Files provides SMB/NFS file shares; it is not the default choice for massive unstructured objects.
Management and governanceDescribe features and tools for managing and deploying Azure resources
Which tool provides an interactive command-line interface for managing Azure resources?
Azure CLI provides a command-line interface for managing Azure resources through simple, human-readable commands.
Why each answer is in or out
AThe REST API is called by programs; it is not an interactive shell.
BThe portal is graphical.
CSDKs are code libraries for applications.
DCorrect: the Azure CLI is a cross-platform command-line tool (az ...) for managing resources.
Cloud conceptsDescribe cloud service types
Which cloud service type is most suitable for developers who want to focus on code without managing infrastructure?
Platform as a Service (PaaS) is ideal for developers who want to focus on application development without managing the underlying infrastructure.
Why each answer is in or out
AStorage as a Service only provides storage.
BCorrect: with PaaS the provider manages the OS and runtime, so developers focus on code.
CSaaS is a finished application, so there is nothing to code.
DIaaS leaves OS and runtime management to the developer.
Architecture and servicesDescribe Azure storage services
Which command-line utility copies blobs or files to and from an Azure storage account?
AzCopy is a command-line tool for copying data to and from Azure Storage. Azure Storage Explorer offers the same kind of transfers through a graphical interface.
Why each answer is in or out
AAzure File Sync syncs Windows file servers with Azure Files; it is not a copy command.
BStorage Explorer is a graphical app, not a command-line utility.
CData Box is a physical appliance for offline transfer.
DCorrect: AzCopy is the command-line utility for copying blobs and files to and from storage accounts.
Management and governanceDescribe monitoring tools in Azure
Which Azure service should you use to get personalized recommendations for optimizing your Azure resources?
Azure Advisor provides personalized recommendations to optimize Azure resources for high availability, security, performance, and cost.
Why each answer is in or out
AAzure Policy enforces rules; it does not tailor recommendations.
BCorrect: Azure Advisor analyzes your configuration and usage and recommends improvements for cost, security, reliability, performance and operations.
CAzure Monitor collects and analyzes telemetry.
DService Health reports Azure incidents and maintenance.
Cloud conceptsDescribe cloud service types
What is the primary difference between Platform as a Service (PaaS) and Software as a Service (SaaS) in terms of management responsibilities?
PaaS requires customers to manage applications and data, while SaaS providers manage everything including the application itself.
Why each answer is in or out
ABoth models include provider-managed security features.
BBoth are typically billed on subscription or consumption.
CBoth are reached over the network.
DCorrect: in PaaS the customer builds and manages its own application; in SaaS the provider also manages the application.
Architecture and servicesDescribe Azure storage services
Which service keeps an on-premises Windows file server in sync with an Azure file share while caching frequently used files locally?
Azure File Sync turns a Windows Server into a cache of an Azure file share. Frequently used files stay local and the full data set lives in Azure Files.
Why each answer is in or out
ACorrect: Azure File Sync caches an Azure file share on a Windows Server and keeps both in sync.
BAzCopy copies data once; it does not maintain an ongoing sync.
CAzure Migrate assesses and moves servers and workloads.
DData Box is an offline, one-time transfer device.
Management and governanceDescribe monitoring tools in Azure
Which service helps you monitor the health and status of your Azure services and regions?
Azure Service Health provides personalized alerts and guidance about Azure service and region availability issues.
Why each answer is in or out
AAdvisor gives best-practice recommendations.
BAzure Monitor watches your own resources' telemetry.
CCorrect: Azure Service Health reports Azure service incidents, planned maintenance and health advisories that affect your regions and services.
DApplication Insights monitors your applications.
Architecture and servicesDescribe Azure identity, access, and security
Which Azure service provides cloud-based identity and access management services?
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. It signs users in and controls their access to Azure, Microsoft 365 and thousands of other applications.
Why each answer is in or out
ACorrect: Microsoft Entra ID (formerly Azure Active Directory) is Azure's cloud identity and access management service.
BKey Vault stores secrets, keys and certificates; it does not authenticate users.
CNSGs filter network traffic.
DResource Manager is the deployment and management layer, not an identity service.
Management and governanceDescribe monitoring tools in Azure
Which service provides detailed performance monitoring of applications?
Application Insights monitors live applications and can automatically detect performance anomalies in web applications.
Why each answer is in or out
ACorrect: Application Insights, part of Azure Monitor, tracks application requests, dependencies, failures and response times.
BLog Analytics is the query tool for log data, not the application performance feature.
CAzure Monitor is the umbrella platform; the specific feature for application performance is Application Insights.
DService Health covers the Azure platform, not your applications.
Architecture and servicesDescribe Azure identity, access, and security
What Azure feature allows you to control resource access based on user identity and policy rules?
Microsoft Entra Conditional Access evaluates signals such as user, group, device, location and sign-in risk. It then allows access, blocks it, or requires extra steps such as MFA, based on policies you define.
Why each answer is in or out
ALocks stop deletion or changes regardless of who the user is.
BNSGs filter by IP and port, not user identity.
CAzure Firewall filters network traffic.
DCorrect: Microsoft Entra Conditional Access applies if-then policies to identity signals such as user, device and location.
Management and governanceDescribe monitoring tools in Azure
What tool provides a unified dashboard for viewing metrics and logs across Azure resources?
Azure Monitor provides a comprehensive solution for collecting, analyzing, and acting on telemetry from Azure resources.
Why each answer is in or out
AService Health shows platform incidents only.
BApplication Insights focuses on applications.
CAdvisor gives recommendations.
DCorrect: Azure Monitor collects metrics and logs from all resources and shows them in one place.
Architecture and servicesDescribe Azure identity, access, and security
What security approach assumes breach and verifies each request as though it originates from an uncontrolled network?
Zero trust is a security model that assumes breach and verifies each request as though it originates from an uncontrolled network.
Why each answer is in or out
AConditional Access is a tool that can enforce Zero Trust, not the model itself.
BNetwork security alone is the old perimeter model that trusts the internal network.
CRBAC limits permissions, but the model in question is broader.
DCorrect: Zero Trust assumes breach and verifies every request explicitly, whatever network it comes from.
Management and governanceDescribe monitoring tools in Azure
What feature allows you to set up automated alerts based on metric values?
Azure Monitor alerts automatically notify you when metrics or events reach specified thresholds.
Why each answer is in or out
AService Health alerts cover platform incidents, not your metric values.
BAdvisor does not raise threshold alerts.
CCorrect: Azure Monitor metric alerts fire when a metric crosses a threshold and trigger action groups.
DLog Analytics queries logs; alert rules live in Azure Monitor.
Architecture and servicesDescribe Azure identity, access, and security
Which Azure service provides security recommendations and threat protection across hybrid cloud workloads?
Microsoft Defender for Cloud provides unified security management and threat protection across hybrid cloud workloads.
Why each answer is in or out
ACorrect: Microsoft Defender for Cloud gives security posture recommendations (secure score) and threat protection across Azure, on-premises and other clouds.
BAzure Monitor collects telemetry; it is not a threat protection service.
CNSGs are basic traffic filters.
DAzure Firewall protects network traffic, without workload posture recommendations.
Architecture and servicesDescribe Azure identity, access, and security
Which sign-in approach replaces the password with something the user has plus a biometric or PIN, as Windows Hello for Business does?
Passwordless methods such as Windows Hello for Business, FIDO2 security keys and the Microsoft Authenticator app remove the password from sign-in. They combine a device the user holds with a biometric or PIN.
Why each answer is in or out
AConditional Access decides when to require stronger sign-in; it does not replace the password.
BCorrect: passwordless sign-in, such as Windows Hello for Business, FIDO2 keys or Authenticator, uses a held device plus a biometric or PIN.
CSSO reuses one sign-in across apps, but that sign-in can still be a password.
DSSPR helps users reset passwords and keeps passwords in use.
Architecture and servicesDescribe Azure identity, access, and security
Which security concept in Azure implements the principle of providing just enough access?
Role-based access control (RBAC) implements the principle of least privilege by giving users only the permissions they need to perform their jobs.
Why each answer is in or out
AConditional Access decides whether sign-in is allowed, not how much users can do.
BNSGs filter network traffic.
CCorrect: Azure RBAC grants only the role a user needs at a given scope, which enforces least privilege.
DAzure Firewall controls network flows, not user permissions.
This free AZ-900 (Microsoft Azure Fundamentals) practice test is the 60-question run above: 17 cloud concepts, 23 architecture and services and 20 management and governance questions, each with a note on every option. Filter by skill area or sub-objective, or start the 45-minute timed run; there is no sign-up, and your answers are not saved.
Pick a skill-area chip and answer that line alone. Start with Architecture and services, the heaviest area at 35–40%.
2
Narrow to one sub-objective
The select under the chips cuts the run to one of 11 sub-objectives, such as storage or monitoring tools. Use it where your misses cluster.
3
Read every option note
The panel under the card says why each option is in or out. Read the notes on the options you struck too: a right answer for the wrong reason is a miss you haven’t found yet.
4
Then all 60 on the clock
Start a timed run resets the filters and counts down from 45:00, the exam time Microsoft lists for Fundamentals exams (65 minutes in the seat). It is a pacing drill, not a score forecast.
Looking for a full AZ-900 practice exam or mock test? The timed run is that mode, not a replica: Microsoft says its exams typically have 40–60 questions and publishes no fixed number for AZ-900 (exam duration and experience), so 60 is simply the size of this set.
Work the run in three passes
Stations stay tappable while the clock runs, so nothing forces you to answer in order. Use that.
1
First pass: you know it
Read the four options before the stem, then the stem once. If one option is the obvious fit, pick it and move on; reading the options first means you meet the scenario already knowing which family of services it is choosing from.
2
Second pass: strike two
Return to the stations you skipped. Find the stem’s one condition (no servers to manage, survive a datacenter failure, stop the deployment instead of logging it), cross out the two options that break it, and look for the word that splits the last pair.
3
Third pass: no idea
The few where nothing rang a bell. Answer those too: Microsoft’s scoring page says wrong answers carry no penalty, so a blank is the only guaranteed miss. Pick between the survivors if you got that far.
Elimination on “which service fits” questions
Most AZ-900 items describe a need and offer four Azure products. Read the options before the stem: if two are Microsoft Entra names and two are access controls, the question is about identity, and you read the scenario for the one requirement that separates them.
Elimination run
An app moved to Azure virtual machines still needs domain join, Group Policy and Kerberos, and the team doesn’t want to run its own domain controllers. Which service fits?
AMicrosoft Entra IDOut · round 2
BMicrosoft Entra Domain ServicesSurvivor
CMicrosoft Entra Conditional AccessOut · round 1
DAzure role-based access controlOut · round 1
Round one strikes the two controls: Conditional Access gates sign-ins and RBAC grants permissions; neither is a domain. Round two takes the near-twin: Microsoft Entra ID (formerly Azure Active Directory) handles cloud sign-in and SSO, with no Group Policy or classic domain join on its own. Domain Services is the managed domain.
The pattern repeats: two products that differ by a word, and that word sits in the stem.
Availability zone or region pair: a datacenter failure means zones; a whole-region outage means the pair.
Pricing calculator or Cost Management: “before deploying” is the calculator; actual spend and budgets are Cost Management.
Azure Policy or a resource lock: Policy decides which settings are allowed; a lock blocks deletion or change, even for an Owner.
Finish opens the end-of-line summary: right answers out of 17, 23 and 20, each row linked to that line’s guide. Read the rows against each other, not as a total. Strong cloud concepts with patchy architecture and services is weaker than it looks, because that area carries 35–40% of the outline against 25–30%.
Microsoft’s score report works at the same grain, with a bar per skill area. Where a row comes up short:
Then press Review misses before you ride that line again. The full outline is on the AZ-900 study guide.
Free practice from Microsoft, and how this test differs
Microsoft also offers a free Practice Assessment for AZ-900, linked from the Azure Fundamentals certification page on Microsoft Learn; it needs a Microsoft account. The same page points to the exam sandbox, a demo of the exam interface.
Use both. This run needs no account, cuts to any sub-objective, explains all four options and scores you per skill area. Microsoft’s set is a good outside check late in your prep; this one drills whatever that check exposes. For the exam at a glance, see the AZ-900 overview.
Why there are no “real exam questions” here
Every question here is an original practice item written to the skills outline in force since 20 July 2026. None of it is exam content; an offer of “actual” AZ-900 questions is an option to strike on sight.
Remembered collections also age badly, because the outline moves (study guide change log). It has used Microsoft Entra ID since January 2024; in January 2026 it dropped the TCO Calculator, retired by Microsoft in 2025, and stopped naming B2B and B2C. A dump still drilling the TCO Calculator trains an answer the outline no longer asks for.
So each question explains its wrong options as well as its key: the reasoning transfers to a new stem, a memorized letter does not.
FAQ
Q1Where can I find AZ-900 practice questions?
Here: 60 original questions across all three skill areas, with a note on every option. Worked examples to read are on AZ-900 sample questions, and Microsoft’s free Practice Assessment on Microsoft Learn is a good outside check.
Q2How many questions should be correct to pass AZ-900?
No number answers that. The pass mark is 700 on a 1–1000 scale, which Microsoft says may not equal 70% (scoring). Microsoft publishes no fixed question count for AZ-900, and some items may be unscored. Format details: AZ-900 exam details.
Q3Is the AZ-900 exam easy to pass?
It is beginner level with no prerequisites, and Microsoft publishes no pass rate. What catches people is vocabulary: products that differ by a word, such as Microsoft Entra ID and Entra Domain Services, or GRS and RA-GRS.
Q4Is there a free AZ-900 practice test?
Yes. This one is free with no sign-up, and your answers stay in the open page. Microsoft’s free Practice Assessment needs a Microsoft account sign-in.
Q5Is the AZ-900 multiple choice?
Microsoft doesn’t list question types in advance; it says exams may include interactive item types, and its exam experience page points to a sandbox for trying the interface. This test uses four-option questions.
Q6Are AZ-900 practice tests similar to the real exam?
This one follows the three skill areas and their weights, 25–30 / 35–40 / 30–35%, with a 17 / 23 / 20 split. The questions are original and the length is ours. Use it to drill reasoning on look-alike services, not to preview content.