AZ-900 sample questions, answered and explained

Cloud concepts is 25–30% of AZ-900 in the skills measured as of 20 July 2026, and these 12 questions cover its three sub-objectives: cloud computing (deployment models, shared responsibility, CapEx and OpEx), the benefits of cloud services, and the service types IaaS, PaaS and SaaS. This section is where that skill area is practiced on this site.

Expect a lot of label-picking. All four options are real cloud terms, which means knowing that a word belongs to cloud computing strikes nothing. What strikes options here is the stem’s qualifier: a superlative (most, least), a scope (always, in every model), a timing (before you buy, as you go) or an owner (you or the provider). Each qualifier fits exactly one of the four labels. Read the options, find the qualifier, and ask which label owns it.

1. Q1Cloud conceptsDescribe cloud computing

   Which type of cloud deployment would be most appropriate for a healthcare organization that needs to maintain strict control over patient data while utilizing some public cloud services?

   1. APrivate cloud only
   2. BPublic cloud only
   3. CMulti-cloud
   4. DHybrid cloud
   Show answer

   DHybrid cloud

   A hybrid cloud deployment allows healthcare organizations to keep sensitive patient data in a private cloud while using public cloud services for non-sensitive operations.

   • APrivate cloud only would not use public cloud services.
   • BPublic cloud only gives up the stricter on-premises control over patient data.
   • CMulti-cloud uses several public providers; it is not designed to keep data private.
   • DCorrect: hybrid cloud keeps sensitive patient data on private infrastructure and still uses public cloud services.

2. Q2Cloud conceptsDescribe cloud computing

   In the shared responsibility model, which statement best describes the customer's responsibility when using Infrastructure as a Service (IaaS)?

   1. AManaging OS and applications
   2. BHardware maintenance and repair
   3. CNetwork infrastructure
   4. DPhysical security of servers
   Show answer

   AManaging OS and applications

   In IaaS, customers are responsible for managing operating systems, data, applications, and configurations while the provider manages the physical infrastructure.

   • ACorrect: in IaaS the customer manages the OS, middleware, applications and data on the VMs it rents.
   • BHardware maintenance is the provider's job in every cloud model.
   • CThe physical network is managed by the provider.
   • DPhysical security is always the provider's job.

3. Q3Cloud conceptsDescribe cloud computing

   What is a key difference between operational expenditure (OpEx) and capital expenditure (CapEx) in cloud computing?

   1. AFixed versus variable costs
   2. BPay-as-you-go versus upfront purchase
   3. CHardware versus software costs
   4. DMonthly versus annual payments
   Show answer

   BPay-as-you-go versus upfront purchase

   OpEx involves paying for services as they are used, while CapEx requires significant upfront investment in infrastructure.

   • AEither type can be fixed or variable; that is not the defining difference.
   • BCorrect: OpEx pays for services as they are consumed; CapEx is an upfront purchase of assets.
   • CBoth can include hardware and software.
   • DPayment frequency does not decide whether spending is OpEx or CapEx.

4. Q4Cloud conceptsDescribe cloud computing

   Which deployment model provides the highest level of control over resources and security?

   1. ACommunity cloud
   2. BPublic cloud
   3. CPrivate cloud
   4. DHybrid cloud
   Show answer

   CPrivate cloud

   Private cloud provides the highest level of control over resources and security as it is dedicated to a single organization and can be hosted on-premises.

   • ACommunity cloud shares infrastructure with other organizations.
   • BPublic cloud gives the least control, because the provider runs the infrastructure.
   • CCorrect: private cloud is used by a single organization, which controls the resources and security itself.
   • DHybrid cloud gives partial control only on its private side.

5. Q5Cloud conceptsDescribe cloud computing

   What aspect of the shared responsibility model remains consistent across all cloud service types?

   1. AResponsibility for your data
   2. BOperating system management
   3. CInfrastructure security
   4. DNetwork controls and firewalls
   Show answer

   AResponsibility for your data

   Data classification and accountability always remain the customer's responsibility regardless of the cloud service type used.

   • ACorrect: information and data, devices, and accounts and identities stay the customer's responsibility in IaaS, PaaS and SaaS.
   • BOS management moves to the provider in PaaS and SaaS.
   • CInfrastructure security is mostly the provider's job.
   • DNetwork controls shift to the provider in PaaS and SaaS.

6. Q6Cloud conceptsDescribe the benefits of using cloud services

   What cloud computing benefit allows organizations to monitor and optimize resource usage effectively?

   1. ASecurity
   2. BManageability
   3. CScalability
   4. DReliability
   Show answer

   BManageability

   Manageability in cloud computing provides tools and features to effectively monitor, manage, and optimize resource usage.

   • ASecurity protects resources from threats.
   • BCorrect: manageability covers management of the cloud (autoscale, monitoring, templates) and management in the cloud (portal, CLI, APIs).
   • CScalability adjusts capacity.
   • DReliability concerns recovery from failures.

7. Q7Cloud conceptsDescribe the benefits of using cloud services

   Which cloud computing benefit helps organizations protect their data and applications from threats?

   1. AScalability
   2. BReliability
   3. CSecurity
   4. DManageability
   Show answer

   CSecurity

   Security in cloud computing provides built-in protection mechanisms and tools to help organizations protect their data and applications from various threats.

   • AScalability adjusts capacity.
   • BReliability concerns recovering from failures.
   • CCorrect: the security benefit means the provider supplies tools and controls that protect data and applications from threats.
   • DManageability concerns administering and monitoring resources.

8. Q8Cloud conceptsDescribe the benefits of using cloud services

   In the context of cloud computing, what does elasticity refer to?

   1. ANetwork isolation
   2. BData encryption at rest
   3. CAutomatic resource scaling
   4. DPhysical security
   Show answer

   CAutomatic resource scaling

   Elasticity refers to the ability to automatically scale resources up or down based on demand, ensuring efficient resource utilization.

   • ANetwork isolation is a networking control.
   • BEncryption is a security measure.
   • CCorrect: elasticity means resources automatically grow and shrink with demand.
   • DPhysical security is the provider's datacenter responsibility.

9. Q9Cloud conceptsDescribe the benefits of using cloud services

   Which cloud computing benefit combination would be most important for a business running critical financial applications?

   1. AHigh availability and security
   2. BScalability and manageability
   3. CGovernance and predictability
   4. DGlobal reach and elasticity
   Show answer

   AHigh availability and security

   High availability and security are crucial for financial applications to ensure continuous operation and protection of sensitive financial data.

   • ACorrect: critical financial systems need to be continuously available and to protect sensitive financial data.
   • BScalability and manageability help, but outages and breaches are the bigger risks for critical financial systems.
   • CGovernance matters for compliance, but uptime and protection come first here.
   • DGlobal reach and elasticity serve distribution and variable load, not critical-system needs.

10. Q10Cloud conceptsDescribe cloud service types

    Which cloud computing model requires the most customer management of infrastructure?

    1. ASoftware as a Service (SaaS)
    2. BPlatform as a Service (PaaS)
    3. CFunction as a Service (FaaS)
    4. DInfrastructure as a Service (IaaS)
    Show answer

    DInfrastructure as a Service (IaaS)

    Infrastructure as a Service (IaaS) requires customers to manage the most components, including operating systems, applications, and data.

    • ASaaS needs the least customer management.
    • BPaaS hides the OS and runtime.
    • CFaaS hides even more than PaaS.
    • DCorrect: IaaS leaves the OS, middleware, runtime and applications to the customer, which is the most management of the cloud models.

11. Q11Cloud conceptsDescribe cloud service types

    What is a key advantage of using PaaS for application development?

    1. AHands-on physical security
    2. BComplete infrastructure control
    3. CHardware selection options
    4. DBuilt-in development tools
    Show answer

    DBuilt-in development tools

    Built-in development tools and platforms reduce the time and effort needed for application development and deployment.

    • APhysical security is handled by the provider in every model, so it is not a PaaS-specific benefit.
    • BFull infrastructure control is IaaS, not PaaS.
    • CChoosing hardware is not possible in PaaS.
    • DCorrect: PaaS provides managed runtimes, databases and dev tooling, so teams can ship code faster.

12. Q12Cloud conceptsDescribe cloud service types

    What is a primary advantage of using Software as a Service (SaaS) applications?

    1. ACustom hardware selection
    2. BProvider-handled updates
    3. CDirect database access
    4. DComplete infrastructure control
    Show answer

    BProvider-handled updates

    Automatic updates and maintenance are handled by the provider in SaaS applications, reducing the management burden on customers.

    • ASaaS gives no hardware choice.
    • BCorrect: the SaaS provider patches, updates and maintains the application.
    • CSaaS rarely gives direct database access.
    • DInfrastructure control is the IaaS trade-off, not SaaS.

After the panel: the benefit words side by side

Most misses in this section come from benefit words that sound alike. The table pairs each one with the stem phrase that points to it, so you can check which twin you confused.

Azure architecture and services is the heaviest skill area at 35–40%, with four sub-objectives: core architectural components, compute and networking, storage, and identity, access and security. Six questions sit here, at least one per sub-objective; the architecture and services guide carries twelve more with the same option notes.

Two stem shapes dominate this six. The first is the sibling list: four features from one family, such as four networking features, where each does a different job. Strike by verb. In compute, a virtual machine gives you the operating system, App Service hosts a web app, Azure Functions runs code on an event, and Container Instances runs one container without orchestration; the stem’s verb leaves one standing. The second is the number stem, four counts or durations side by side. Elimination is weak there, so if you don’t know it on the first pass, mark it and come back.

13. Q13Architecture and servicesDescribe the core architectural components of Azure

    How many levels of depth can a management group hierarchy have, not counting the root level or the subscription level?

    1. A6 levels
    2. B4 levels
    3. C10 levels
    4. D8 levels
    Show answer

    A6 levels

    A management group hierarchy supports up to six levels of depth, not counting the root level or the subscription level. A directory can hold up to 10,000 management groups.

    • ACorrect: a management group tree can be up to six levels deep, not counting the root level or the subscription level.
    • BFour levels is below the actual limit of six.
    • CTen levels exceeds the supported depth.
    • DEight levels exceeds the supported depth.

14. Q14Architecture and servicesDescribe the core architectural components of Azure

    What is the relationship between an Azure subscription and resources?

    1. AResources control subscriptions
    2. BSubscriptions are optional for resources
    3. CResources can exist without subscriptions
    4. DResources must belong to a subscription
    Show answer

    DResources must belong to a subscription

    Resources must belong to a subscription, which provides the billing boundary and access control container for Azure resources.

    • AThe control runs the other way: a subscription contains and bills its resources.
    • BA subscription is not optional, because every resource is billed through one.
    • CNo Azure resource can exist outside a subscription.
    • DCorrect: every resource lives in exactly one resource group inside one subscription, which is its billing and access boundary.

15. Q15Architecture and servicesDescribe Azure compute and networking services

    Which Azure networking feature enables you to filter network traffic between subnets?

    1. AService Endpoints
    2. BUser-defined route tables
    3. CLoad Balancer
    4. DNetwork Security Groups
    Show answer

    DNetwork Security Groups

    Network Security Groups filter network traffic between Azure resources in virtual network subnets.

    • AService endpoints extend a VNet's identity to PaaS services; they do not filter traffic between subnets.
    • BUser-defined routes steer where traffic goes but do not allow or deny it.
    • CLoad Balancer distributes traffic; it does not filter it.
    • DCorrect: an NSG attached to a subnet or NIC allows or denies traffic by source, destination, port and protocol.

16. Q16Architecture and servicesDescribe Azure compute and networking services

    What is the minimum number of instances recommended for production workloads in an availability set?

    1. AOne instance
    2. BTwo instances
    3. CFour instances
    4. DThree instances
    Show answer

    BTwo instances

    Two or more instances are recommended in an availability set to ensure high availability and meet the SLA requirements.

    • AA single VM in an availability set gains nothing, because there is nothing to fail over to.
    • BCorrect: at least two VMs in an availability set are needed for the 99.95% VM SLA, so one can run while the other is under maintenance or a fault.
    • CFour VMs work, but two is the minimum.
    • DThree VMs work, but two is the minimum.

17. Q17Architecture and servicesDescribe Azure storage services

    Which Azure storage service is optimized for storing structured, non-relational (NoSQL) data?

    1. AFile Storage
    2. BTable Storage
    3. CQueue Storage
    4. DBlob Storage
    Show answer

    BTable Storage

    Azure Table Storage is optimized for storing structured NoSQL data with a schema-less design.

    • AAzure Files provides SMB or NFS file shares, not a structured data store.
    • BCorrect: Table Storage is a schemaless key-attribute NoSQL store for structured, non-relational data.
    • CQueue Storage holds messages, not records.
    • DBlob Storage holds unstructured objects such as images and backups.

18. Q18Architecture and servicesDescribe Azure identity, access, and security

    What is the main benefit of using Azure managed identities?

    1. AFaster application performance
    2. BEncrypted storage for app data
    3. CLower Key Vault transaction costs
    4. DAutomatic credential management
    Show answer

    DAutomatic credential management

    Managed identities give Azure resources an automatically managed identity in Microsoft Entra ID. Code can then get tokens for other services, such as Key Vault or Storage, without any credentials stored in code or configuration.

    • AManaged identities do not change how fast an application runs.
    • BEncryption at rest is a storage feature, not what a managed identity provides.
    • CManaged identities are free, but cost is not their purpose.
    • DCorrect: Azure creates and rotates the credential in Microsoft Entra ID, so the app authenticates without storing secrets in code.

Networking and storage siblings fall to the same verb test once you have opened the panels. A network security group filters traffic, a route table steers it, a load balancer spreads it. In storage, Azure Files serves shares, Queue Storage holds messages, Table Storage keeps key-and-attribute entities and Blob Storage holds unstructured objects.

After the panel: identity or security posture?

The identity sub-objective likes to pair an identity service with a security service, because both sound like protection. The split is between who signs in and how well defended the resources are.

Azure management and governance is 30–35% of the exam, split into cost management, governance and compliance tools, tools for managing and deploying resources, and monitoring. The six here touch each of the four; the management and governance guide carries twelve more.

This is the area of tool names that differ by one word, and the word that separates them is usually time. A tool that works before deployment, one that works on money already spent, one that watches a value as it changes and one that looks back at past events are four different tools, even when their names share a word. Find the tense in the stem first: the table after the questions maps each tense to its tool. Then, for governance stems, ask the second question: is it about who may act (role-based access control) or what may exist (Azure Policy)?

19. Q19Management and governanceDescribe cost management in Azure

    What is the minimum time period for an Azure reserved instance purchase?

    1. ASix months
    2. BThree months
    3. COne year
    4. DTwo years
    Show answer

    COne year

    Azure reserved instances can be purchased for a minimum term of one year.

    • ASix months is not an available term; reservations are sold in one- or three-year terms.
    • BThree months is not an available term.
    • CCorrect: the shortest reservation term is one year, and three years gives a deeper discount.
    • DTwo years is not an available term; the options are one or three years.

20. Q20Management and governanceDescribe cost management in Azure

    Which cost management feature helps you split shared resources costs across departments?

    1. ACost allocation rules
    2. BBudget alerts
    3. CPrice sheets
    4. DCost Management usage reports
    Show answer

    ACost allocation rules

    Cost allocation rules in Azure Cost Management help distribute shared resource costs across different departments or units.

    • ACorrect: cost allocation rules in Cost Management move shared costs from one subscription, resource group or tag to others, such as departments.
    • BBudget alerts warn about spending; they do not split it.
    • CPrice sheets list negotiated rates.
    • DUsage reports show raw consumption but do not reassign shared costs.

21. Q21Management and governanceDescribe features and tools in Azure for governance and compliance

    What should you use to automatically remediate non-compliant resources?

    1. AResource locks
    2. BOn-demand compliance scans
    3. CRemediation tasks
    4. DSecurity rules
    Show answer

    CRemediation tasks

    Remediation tasks in Azure Policy can automatically fix non-compliant resources to meet policy requirements.

    • ALocks prevent deletion or changes; they fix nothing.
    • BA compliance scan only re-evaluates and reports state.
    • CCorrect: a remediation task runs a policy's DeployIfNotExists or Modify effect against existing non-compliant resources to bring them into compliance.
    • D'Security rules' is not an Azure feature for remediating non-compliant resources.

22. Q22Management and governanceDescribe features and tools for managing and deploying Azure resources

    What is the primary benefit of using ARM templates for resource deployment?

    1. AFaster deployment speed
    2. BConsistency in deployments
    3. CBetter security
    4. DLower cost for each deployment
    Show answer

    BConsistency in deployments

    ARM templates ensure consistent deployments by using the same template repeatedly, reducing manual configuration errors.

    • ASpeed is not the main point, because a template deploys at the same speed as the portal.
    • BCorrect: a template deploys the same resources the same way every time, which avoids configuration drift and manual mistakes.
    • CSecurity comes from policies and RBAC, not from the template format.
    • DTemplates are free, but cost is not their main benefit.

23. Q23Management and governanceDescribe monitoring tools in Azure

    Which type of alert should you create to monitor CPU usage across multiple VMs?

    1. AMetric alert
    2. BService health alert
    3. CResource health alert
    4. DActivity log alert
    Show answer

    AMetric alert

    Metric alerts in Azure Monitor can track CPU usage across multiple VMs and trigger when thresholds are exceeded.

    • ACorrect: a metric alert watches a numeric metric such as Percentage CPU and can cover many VMs in one rule.
    • BService Health alerts cover Azure platform incidents, not VM CPU.
    • CResource Health alerts report whether a resource is available, not how heavily it is used.
    • DActivity log alerts react to management operations such as create, delete or restart.

24. Q24Management and governanceDescribe monitoring tools in Azure

    Which feature helps track changes to Azure resources over time?

    1. ADiagnostic settings
    2. BMetrics
    3. CActivity log
    4. DAlerts
    Show answer

    CActivity log

    Activity log records operations performed on resources within your subscription.

    • ADiagnostic settings route logs elsewhere; they are not the change record itself.
    • BMetrics are numeric performance values, not configuration changes.
    • CCorrect: the activity log records every management operation (who did what, when) at subscription level for 90 days.
    • DAlerts notify about conditions; they do not keep a change history.

After the panel: read the clock in the stem