Question 1 of 40Cloud Concepts
A film studio renders animation frames overnight using 500 VMs, then shuts them all down at dawn. On-premises, this would require owning 500 servers used 8 hours daily. Which cloud principle delivers the saving?
A ✓Pay only for the compute hours actually consumed
BCloud hardware renders faster than physical hardware
CRendering is free at night
DVMs cannot be shut down
Explanation: Consumption pricing: 500 VMs × 8 hours costs one-third of 24/7 ownership, with zero capital outlay. Burst-compute workloads like rendering are canonical cloud economics wins.
Question 2 of 40Cloud Concepts
Which BEST defines 'serverless' computing?
A ✓Code runs on servers fully abstracted away — you deploy functions, the platform manages all infrastructure and scales to zero
BComputing without any servers existing anywhere
COnly client-side browser code
DA VM with no operating system
Explanation: Serverless means servers exist but are invisible to you — the platform provisions, scales, and bills per execution. Azure Functions and Logic Apps are serverless; the name describes the developer experience, not physics.
Question 3 of 40Cloud Concepts
A company evaluates moving its CRM from a self-hosted application to Dynamics 365 (SaaS). Which responsibilities DISAPPEAR from their IT team's workload?
A ✓Infrastructure, OS patching, application updates, and platform availability
BUser training and data quality
CDeciding who can access customer records
DCompliance with privacy law
Explanation: SaaS transfers the entire stack below the data/identity layer to the provider. The customer still owns user access decisions, data quality, training, and legal compliance — those never transfer.
Question 4 of 40Cloud Concepts
An SLA of 99.99% permits approximately how much downtime per year?
A ✓About 52 minutes
BAbout 8.7 hours
CAbout 3.65 days
DZero downtime
Explanation: 99.99% ('four nines') allows ~52.6 minutes of downtime annually. 99.9% allows ~8.8 hours; 99% allows ~3.65 days. Each added nine cuts allowed downtime tenfold — and typically raises architecture cost significantly.
Question 5 of 40Cloud Concepts
A grocery chain wants store systems to keep operating during internet outages while syncing to Azure when connected. Devices must run cloud-managed workloads locally. Which computing pattern is this?
A ✓Edge computing (e.g. Azure IoT Edge / Azure Stack family)
BPure public cloud
CMainframe computing
DClient-only computing
Explanation: Edge computing runs cloud-managed workloads on local hardware — surviving connectivity loss, reducing latency, and syncing to Azure when online. Azure IoT Edge and the Azure Stack portfolio serve exactly this pattern.
Question 6 of 40Azure Architecture & Services
Which pairing of concept and purpose is CORRECT?
A ✓Availability Zone = datacentre-failure protection within a region; Region pair = regional-disaster protection
BAvailability Zone = regional-disaster protection; Region pair = rack-failure protection
CBoth protect only against single-server failure
DNeither relates to resilience
Explanation: Zones are separated datacentres within a region (datacentre-level protection); region pairs are distance-separated regions (regional-disaster protection). Layering both delivers maximum resilience.
Question 7 of 40Azure Architecture & Services
A dev asks why their deleted storage blob was recoverable for 14 days. Which data protection feature enabled the recovery?
A ✓Soft delete — retaining deleted data for a configurable period
BThe blob was never actually deleted
CAzure prohibits deleting blobs
DCDN caching
Explanation: Soft delete keeps deleted blobs (and containers/file shares) recoverable for a configured retention window — protection against accidental or malicious deletion before permanent purge.
Question 8 of 40Azure Architecture & Services
Which service provides desktop and application virtualisation, delivering Windows 11 multi-session to users?
A ✓Azure Virtual Desktop
BAzure Container Instances
CAzure DNS
DAzure Queue Storage
Explanation: Azure Virtual Desktop delivers virtualised Windows desktops and apps — including Windows 11 multi-session, unique to Azure — for remote workforces on any device.
Question 9 of 40Azure Architecture & Services
A company's application requires 99.99% uptime. A single VM offers a 99.9% SLA. What architectural change reaches the higher SLA target for compute?
A ✓Deploy multiple VM instances across Availability Zones behind a load balancer
BRestart the single VM weekly
CAdd more disk space
DRename the VM
Explanation: Multi-instance, zone-distributed deployments carry higher composite SLAs (99.99% for zone-redundant VM sets) because no single datacentre failure takes the service down. Single instances cap at lower SLA tiers.
Question 10 of 40Azure Architecture & Services
Azure Logic Apps is BEST described as:
A ✓A low-code service for automating workflows and integrating apps, data, and services with prebuilt connectors
BA virtual machine type
CA physical network appliance
DA database engine
Explanation: Logic Apps orchestrates workflows visually — hundreds of connectors (Office 365, SQL, Salesforce, custom APIs) chained with triggers and actions, minimal code. It's the integration/automation counterpart to Functions.
Question 11 of 40Azure Architecture & Services
An online store wants product searches answered in milliseconds without hammering the SQL database on every request. Which service pattern reduces database load for frequently read data?
A ✓In-memory caching with Azure Cache for Redis
BA second identical SQL database
CStoring products in email
DLarger network cables
Explanation: Redis caches hot data in memory — sub-millisecond reads, dramatic database offload. Cache-aside is the standard pattern: check cache first, fall back to database, populate cache.
Question 12 of 40Azure Architecture & Services
Encryption in transit protects data:
A ✓While moving across networks, typically via TLS/HTTPS
BOnly while stored on disks
COnly inside CPU registers
DIt is the same as encryption at rest
Explanation: In-transit encryption (TLS/HTTPS, VPN tunnels) protects data crossing networks from interception. At-rest encryption protects stored data. Complete protection requires both — they address different attack surfaces.
Question 13 of 40Azure Architecture & Services
A user reports that MFA prompts stopped appearing when signing in from the office but still appear from home. IT confirms this is intentional. Which feature creates this behaviour?
A ✓Conditional Access with trusted/named locations
BMFA is broken in the office
CPasswords disabled at home
DThe office has no internet
Explanation: Conditional Access policies can treat office IP ranges as trusted named locations — skipping MFA there while enforcing it elsewhere. Context-aware policy, not malfunction.
Question 14 of 40Azure Architecture & Services
Which service continuously assesses VMs, containers, databases, and storage for vulnerabilities and misconfigurations across clouds?
A ✓Microsoft Defender for Cloud
BAzure DNS
CAzure Load Balancer
DCost Management
Explanation: Defender for Cloud is the CSPM/CWPP platform — vulnerability assessment, misconfiguration detection, secure score, and active threat protection across Azure, hybrid, and multi-cloud workloads.
Question 15 of 40Management & Governance
A global admin left the company. Audit reveals their account had permanent Owner rights on every subscription. Which Entra capability would have limited standing privileged access?
A ✓Privileged Identity Management (PIM) — just-in-time, time-bound, approval-based role activation
BMore permanent admin accounts
CLonger passwords
DRemoving all admins entirely
Explanation: PIM converts standing privilege into just-in-time activation — roles activate for limited windows with approval and full audit. Departed employees hold no永standing access; the attack surface of permanent admin rights disappears.
Question 16 of 40Management & Governance
Azure Policy's 'deny' effect does what?
A ✓Blocks resource requests that violate the policy at deployment/update time
BDeletes existing resources immediately
CSends an email only
DSlows down deployments
Explanation: Deny rejects non-compliant create/update operations before they happen — governance as a gate. Audit effects log violations without blocking; deployIfNotExists remediates. Deny never deletes existing resources.
Question 17 of 40Management & Governance
A team lead needs to grant a new hire permission to restart VMs in one resource group — nothing else, nowhere else. Which TWO decisions implement least privilege?
A ✓Choose the narrowest sufficient role (e.g. VM Contributor or a custom role) and assign at the resource-group scope only
BAssign Owner at subscription scope
CShare the team lead's credentials
DGrant Global Administrator in Entra ID
Explanation: Least privilege = minimal role × minimal scope. A VM-focused role at just that resource group grants restart capability without broader powers. Owner/Global Admin at wide scopes is the exact anti-pattern.
Question 18 of 40Management & Governance
Which is a benefit of using Azure Resource Manager (ARM) as the deployment and management layer?
A ✓Consistent management across portal, CLI, PowerShell, and templates — with RBAC, tags, and policy applied uniformly
BIt only works from the portal
CIt bypasses all security
DIt requires special hardware
Explanation: ARM is the unified control plane: every tool speaks to the same API, so access control, locks, tags, and policy behave identically whether you click, script, or template. Declarative templates enable repeatable deployments.
Question 19 of 40Management & Governance
During month-end, Cost Management shows 'Forecasted cost' exceeding budget. What does the forecast represent?
A ✓A projection of end-of-period spend based on usage patterns so far
BA guaranteed final invoice amount
CLast year's costs
DCompetitor spending data
Explanation: Forecasting extrapolates current usage trends to predict period-end spend — early warning to act (scale down, investigate anomalies) before the budget actually breaches. It's a projection, not a guarantee.
Question 20 of 40Cloud Concepts
Moving from on-premises to Azure, which cost typically DISAPPEARS entirely?
A ✓Datacentre facility costs — power, cooling, physical space, and hardware refresh cycles
BAll IT staff salaries
CSoftware development costs
DNetwork bandwidth usage
Explanation: Facility costs (power, cooling, real estate, hardware refresh) transfer to Microsoft and are absorbed in service pricing. Staff refocus rather than vanish; development and bandwidth costs continue.
Question 21 of 40Azure Architecture & Services
A fintech startup must prove to auditors that production secrets were never exposed to developers. Their pipeline retrieves secrets at deploy time via managed identity from a vault with full access logging. Which TWO services form this pattern?
A ✓Azure Key Vault and managed identities, with Key Vault logging to Azure Monitor
BBlob Storage and CDN
CCost Management and Advisor
DDNS and Front Door
Explanation: Key Vault centralises secrets with complete access audit logs; managed identities authenticate workloads without human-visible credentials. Together they produce the audit trail proving humans never touched production secrets.
Question 22 of 40Azure Architecture & Services
Which tool would you use to browse, upload, and manage files in Azure Storage from a Windows desktop application?
A ✓Azure Storage Explorer
BMicrosoft Word
CAzure Advisor
DWindows Media Player
Explanation: Storage Explorer is the free desktop app for managing storage accounts — blobs, files, queues, tables — with drag-and-drop uploads, downloads, and permission management across subscriptions.
Question 23 of 40Azure Architecture & Services
An e-commerce site experiences checkout failures whenever the recommendation engine crashes, though checkout doesn't need recommendations. What architectural principle would prevent this coupling?
A ✓Decoupling components (e.g. asynchronous messaging) so non-critical service failure doesn't cascade to critical paths
BCombining everything into one process
CRemoving checkout functionality
DDoubling the recommendation engine's VM size
Explanation: Loose coupling isolates failures: checkout should complete without waiting on recommendations. Async patterns (queues, events) let non-critical components fail independently — resilience through architecture rather than bigger hardware.
Question 24 of 40Management & Governance
Tags applied to a resource group are:
A ✓NOT automatically inherited by resources within it (unless a policy enforces inheritance)
BAlways inherited by all resources automatically
CProhibited in Azure
DLimited to one tag per group
Explanation: Tag inheritance is NOT automatic — a common exam trap. Resources need their own tags unless an Azure Policy with a modify effect copies tags from the group. Cost reports rely on resource-level tags.
Question 25 of 40Management & Governance
An engineer accidentally deployed resources into the wrong subscription. The manager asks: 'Can we move them instead of rebuilding?' What is generally true?
A ✓Many resource types support moving between resource groups and subscriptions, though some services and configurations have restrictions
BNothing can ever be moved
CEverything moves with zero restrictions
DMoves require physically relocating servers
Explanation: Azure supports move operations for many resource types across groups/subscriptions — with documented exceptions (some networking, certain configurations). Always validate move support before promising migrations.
Question 26 of 40Cloud Concepts
'Governance' in cloud computing refers to:
A ✓The rules, policies, and processes that keep cloud usage compliant, secure, and cost-controlled
BGovernment ownership of datacentres
CElecting cloud administrators
DThe physical security of buildings
Explanation: Cloud governance is organisational control: policies (what's allowed), access management (who can act), cost controls, and compliance auditing — implemented in Azure through Policy, RBAC, management groups, and Cost Management.
Question 27 of 40Azure Architecture & Services
A developer's Function App needs to react within seconds whenever ANY resource in the subscription is created or modified, for a custom audit system. Which service delivers resource event notifications?
A ✓Azure Event Grid subscribing to resource events
BManually polling the portal
CAzure Files
DA bigger VM
Explanation: Event Grid publishes near-real-time events (resource writes, deletes, custom events) to subscribers like Functions — push-based, serverless event routing versus wasteful polling.
Question 28 of 40Management & Governance
The Azure mobile app allows administrators to:
A ✓Monitor resource health, view alerts, and run Cloud Shell commands from a phone
BOnly view marketing content
CReplace all other management tools
DNothing — Azure has no mobile app
Explanation: The Azure mobile app provides on-the-go monitoring, alert notifications, resource actions (restart VMs), and full Cloud Shell — handy for incident response away from a desk.
Question 29 of 40Cloud Concepts
Management fears 'vendor lock-in' with Azure. Which practices reduce lock-in risk while still using cloud?
A ✓Favouring open-source technologies, containers, and portable architectures (e.g. Kubernetes, PostgreSQL) that run anywhere
BUsing only proprietary services with no alternatives
CAvoiding documentation
DSigning longer exclusive contracts
Explanation: Portability comes from open standards: containers, Kubernetes, open-source databases, and IaC abstractions run on any cloud. Lock-in is an architectural choice to manage, not an inevitability.
Question 30 of 40Azure Architecture & Services
Which service pair correctly matches 'protect data' and 'recover workloads' in business continuity?
A ✓Azure Backup (data protection) and Azure Site Recovery (workload failover)
BAzure DNS and Azure CDN
CCost Management and Advisor
DKey Vault and Bastion
Explanation: Backup protects and restores DATA (files, VMs, databases); Site Recovery replicates and fails over WORKLOADS to another region. Together they form Azure's business continuity/disaster recovery pairing.
Question 31 of 40Management & Governance
The security team mandates: 'No storage account may allow public blob access, ever, in any subscription — and violations must be impossible, not just detected.' Which enforcement satisfies 'impossible'?
A ✓Azure Policy with deny effect at the top management group
BA quarterly manual audit
CAn email reminder to teams
DAzure Advisor recommendations
Explanation: Deny at the root management group gates every subscription: non-compliant deployments fail at request time. Audits and advisories detect after the fact; deny prevents — matching the 'impossible' requirement.
Question 32 of 40Azure Architecture & Services
Which statement about Azure regions and service availability is TRUE?
A ✓Not every Azure service is available in every region — service availability varies by region
BAll services exist identically in all regions
CNew services launch in all regions simultaneously
DRegion choice never matters
Explanation: Service availability differs by region — newer services roll out gradually, some specialised hardware exists only in select regions. Always verify service availability in the products-by-region documentation before committing to a region.
Question 33 of 40Cloud Concepts
A data-sovereignty law requires citizen data remain within national borders. How does Azure architecture accommodate this?
A ✓Deploying resources to regions within that country and using policy to restrict allowed locations
BData location cannot be controlled in the cloud
CAll Azure data is stored in one global location
DOnly on-premises can satisfy sovereignty
Explanation: Customers choose deployment regions; data residency follows region selection (with documented exceptions for some services). Azure Policy's allowed-locations rules enforce the boundary organisation-wide.
Question 34 of 40Management & Governance
Which support resource provides community answers, documentation, and learning paths at no cost?
A ✓Microsoft Learn, Azure documentation, and Microsoft Q&A community
BOnly paid support plans
CPhysical Microsoft stores
DNo free resources exist
Explanation: Microsoft Learn (free training paths), extensive documentation, and community Q&A cost nothing. Paid support plans add technical support SLAs — but self-serve learning and community help are free.
Question 35 of 40Azure Architecture & Services
During a compliance review, an auditor asks how data on a decommissioned Azure disk is protected from the next customer using that hardware. What is Microsoft's practice?
A ✓Storage is encrypted, and Microsoft follows strict data-destruction/sanitisation standards for retired hardware
BOld disks are resold with data intact
CCustomers must fly in to destroy disks
DData protection ends at deletion
Explanation: Platform encryption at rest plus NIST-aligned media sanitisation and destruction for retired hardware protect residual data. Microsoft's compliance documentation (Service Trust Portal) evidences these controls for auditors.
Question 36 of 40Cloud Concepts
Horizontal scaling (scaling out) is generally preferred in cloud design because:
A ✓It has no single-machine ceiling and improves resilience — losing one instance of many is survivable
BIt always costs less than any alternative
CVertical scaling is impossible in Azure
DIt requires no load balancing
Explanation: Scale-out grows without hardware limits and removes single points of failure — one instance dying leaves others serving. Vertical scaling hits machine ceilings and retains a single point of failure. Load balancing is required, not avoided.
Question 37 of 40Management & Governance
A new compliance officer asks for a single view showing: current policy compliance, secure score, cost trends, and service incidents. What honest answer describes Azure's tooling?
A ✓Each area has a dedicated tool (Policy compliance, Defender secure score, Cost Management, Service Health) — combinable into custom dashboards
BOne magic screen shows everything with no setup
CNone of this is visible in Azure
DOnly Microsoft staff can view compliance
Explanation: Azure separates concerns into purpose-built tools, then lets you compose Azure dashboards/workbooks aggregating them. Understanding WHICH tool answers WHICH question is core AZ-900 knowledge.
Question 38 of 40Azure Architecture & Services
Application Gateway differs from Azure Load Balancer in that Application Gateway:
A ✓Operates at layer 7 (HTTP), enabling URL-based routing, SSL termination, and WAF integration
BOnly works with UDP traffic
CCannot distribute traffic
DIs a physical device shipped to you
Explanation: Application Gateway is an HTTP(S)-aware layer-7 load balancer: route by URL path/host, terminate TLS, attach WAF. Azure Load Balancer works at layer 4 (TCP/UDP) without HTTP awareness. Choose by protocol needs.
Question 39 of 40Management & Governance
Six months post-migration, leadership asks: 'Are we actually optimised, or just lifted-and-shifted waste?' Which combination provides an evidence-based answer?
A ✓Azure Advisor cost recommendations + Cost Management analysis + Well-Architected Review
BGut feeling from the loudest engineer
CComparing to a competitor's press release
DWaiting another year
Explanation: Advisor surfaces concrete optimisations (right-sizing, reservations, idle resources), Cost Management quantifies trends, and Well-Architected reviews assess workloads against the five pillars — objective evidence replacing opinions.
Question 40 of 40Cloud Concepts
Which summary BEST captures why organisations adopt cloud computing?
A ✓Trading capital expense and infrastructure management for agility, elasticity, global scale, and consumption-based cost
BCloud is legally mandatory
CIt eliminates all IT costs and staff
DIt guarantees applications never fail
Explanation: The cloud value proposition: CapEx→OpEx economics, minutes-not-months agility, elastic capacity, global reach, and managed infrastructure — letting organisations focus on differentiating work. It doesn't eliminate cost, staff, or failure.