Microsoft Azure Fundamentals (AZ-900) — All Questions

A company wants compute capacity to automatically increase during busy periods and decrease when demand falls, without manual intervention. Which cloud characteristic is this?

• a.High availability
• b.Elasticity✓
• c.Disaster recovery
• d.Data residency

Elasticity is the automatic adding and removing of resources to match demand in real time. High availability keeps services running despite failures, disaster recovery restores service after an outage, and data residency concerns where data is stored geographically.

Moving from buying on-premises servers to paying monthly for cloud resources based on usage represents which shift?

• a.From OpEx to CapEx
• b.From SaaS to IaaS
• c.From capital expenditure (CapEx) to operating expenditure (OpEx)✓
• d.From private to public data residency

Buying hardware upfront is a capital expenditure, while pay-as-you-go cloud consumption is an operating expenditure, so the move is CapEx to OpEx. The other options reverse the direction or describe unrelated concepts.

Under the shared responsibility model, which task is always the customer's responsibility regardless of the service model?

• a.Managing its own data and user access✓
• b.Securing the physical datacenter
• c.Maintaining the host hypervisor
• d.Replacing failed disks

The customer is always responsible for its data, identities, and access management no matter the model. Physical security, the hypervisor, and hardware maintenance are always Microsoft's responsibility.

A team wants to run applications without managing the underlying operating system, servers, or patching, but still deploy custom code. Which service model fits best?

• a.On-premises
• b.Software as a Service (SaaS)
• c.Infrastructure as a Service (IaaS)
• d.Platform as a Service (PaaS)✓

PaaS provides a managed platform where you deploy your own application code while Microsoft handles the OS, servers, and patching. IaaS still requires you to manage the OS, SaaS delivers finished applications with no custom code, and on-premises means you manage everything.

An organization keeps sensitive records in its own datacenter but bursts to Azure for extra capacity at peak times, connecting the two. Which deployment model is this?

• a.Public cloud
• b.Hybrid cloud✓
• c.Private cloud
• d.Community cloud

A hybrid cloud connects a private environment with the public cloud so workloads and data can move between them. A pure public or private cloud uses only one environment, and community cloud is shared among organizations with common concerns.

Which pair correctly distinguishes scalability from elasticity?

• a.Scalability adds capacity as planned; elasticity adds and removes it automatically with demand✓
• b.They are identical terms
• c.Scalability is automatic; elasticity is manual
• d.Elasticity only applies to storage

Scalability is the ability to increase capacity (often planned or manual), whereas elasticity automatically scales resources up and down in response to real-time demand. They are not identical, the roles are not reversed, and elasticity is not limited to storage.

A developer wants to run small pieces of code in response to events and be billed only when the code executes. Which Azure service is designed for this?

• a.Azure Virtual Machines
• b.Azure App Service
• c.Azure Functions✓
• d.Azure Kubernetes Service

Azure Functions is a serverless, event-driven compute service billed per execution. Virtual Machines and App Service run continuously, and AKS orchestrates containers rather than billing per individual function execution.

What is an Azure Availability Zone?

• a.A physically separate datacenter within a region that protects against datacenter-level failures✓
• b.A backup copy of data in another country
• c.A billing boundary for subscriptions
• d.A virtual network subnet

Availability Zones are physically separate datacenters inside a region, each with independent power and networking, so a workload spread across zones survives a single datacenter failure. They are not a cross-country backup, a billing boundary, or a subnet.

Which Azure storage service is best suited to store large amounts of unstructured data such as images, video, and backups?

• a.Azure Table storage
• b.Azure Queue storage
• c.Azure Files
• d.Azure Blob storage✓

Azure Blob storage is optimized for unstructured object data like media and backups. Table storage holds NoSQL key-value data, Queue storage passes messages, and Files provides SMB file shares.

An organization needs a globally distributed NoSQL database with low-latency reads and writes in multiple regions. Which service fits?

• a.Azure SQL Database
• b.Azure Cosmos DB✓
• c.Azure Blob storage
• d.Azure Files

Azure Cosmos DB is a globally distributed, multi-model NoSQL database offering low latency and multi-region writes. Azure SQL Database is relational and regionally focused, and Blob and Files are storage services, not databases.

A company needs a dedicated, private connection from its on-premises datacenter to Azure that does not traverse the public internet. Which service provides this?

• a.Azure VPN Gateway
• b.Azure Load Balancer
• c.Azure ExpressRoute✓
• d.Azure DNS

ExpressRoute establishes a private, dedicated connection to Azure that bypasses the public internet, offering more reliable throughput. A VPN Gateway connects over the encrypted public internet, Load Balancer distributes traffic, and DNS resolves names.

Which compute service lets you fully control and manage the guest operating system, giving the most configuration flexibility?

• a.Azure Virtual Machines✓
• b.Azure Functions
• c.Azure App Service
• d.Azure Container Instances

Azure Virtual Machines are IaaS, giving you full control over the guest OS and installed software. Functions, App Service, and Container Instances are more managed and abstract away OS management.

Which Azure service provides cloud-based identity and access management, including authentication and single sign-on?

• a.Azure Policy
• b.Microsoft Entra ID✓
• c.Azure Monitor
• d.Azure Blob storage

Microsoft Entra ID (formerly Azure Active Directory) manages identities and provides authentication, single sign-on, and access control. Azure Policy governs resource configuration, Azure Monitor observes resources, and Blob storage stores data.

A security team wants to require a second verification factor and enforce sign-in rules based on user location and device state. Which capabilities provide this?

• a.Resource locks and tags
• b.Blob storage tiers
• c.VNet peering
• d.Multifactor authentication and Conditional Access✓

Multifactor authentication adds a second factor, and Conditional Access enforces policies based on signals such as location and device. Resource locks, storage tiers, and VNet peering are unrelated to sign-in security.

The security principle of layering protections across identity, network, compute, and data so no single failure is catastrophic is called what?

• a.Defense in depth✓
• b.Data residency
• c.Vertical scaling
• d.Consumption-based pricing

Defense in depth uses multiple layers of security controls so a breach of one layer does not compromise the whole system. The other terms describe geography, scaling, and billing, not layered security.

An administrator must ensure resources can only be deployed to approved Azure regions across the organization. Which tool enforces this rule?

• a.Azure Monitor
• b.Resource locks
• c.Azure Policy✓
• d.Azure Advisor

Azure Policy enforces organizational rules such as allowed regions and reports on compliance. Azure Monitor observes telemetry, resource locks prevent deletion or modification, and Advisor gives recommendations but does not enforce policy.

In Azure's resource hierarchy, which order is correct from broadest to narrowest scope?

• a.Management group, subscription, resource group, resource✓
• b.Resource, resource group, subscription, management group
• c.Subscription, management group, resource, resource group
• d.Resource group, subscription, management group, resource

Management groups contain subscriptions, which contain resource groups, which contain resources; settings and access inherit downward. The other orderings misplace one or more levels of the hierarchy.

To prevent a critical resource from being accidentally deleted, which feature should an administrator apply?

• a.A tag
• b.A resource lock (CanNotDelete)✓
• c.A network security group
• d.An availability zone

A resource lock set to CanNotDelete prevents accidental deletion while still allowing use. Tags label resources, network security groups filter traffic, and availability zones concern resiliency, not deletion protection.

Which tool provides personalized recommendations to optimize Azure resources across cost, security, reliability, and performance?

• a.Azure Policy
• b.Azure Cloud Shell
• c.Resource groups
• d.Azure Advisor✓

Azure Advisor analyzes your resource usage and configuration and recommends improvements across cost, security, reliability, operational excellence, and performance. Policy enforces rules, Cloud Shell is a command environment, and resource groups organize resources.

A company wants to estimate the monthly cost of a proposed set of Azure services before deploying them. Which tool should it use?

• a.The Total Cost of Ownership (TCO) Calculator
• b.The Azure Pricing Calculator✓
• c.Azure Advisor
• d.Microsoft Cost Management

The Pricing Calculator estimates the cost of a proposed configuration of Azure services before deployment. The TCO Calculator compares on-premises versus Azure, Advisor recommends optimizations, and Cost Management analyzes actual spend after deployment.

Which action typically reduces the cost of a predictable, steady-state workload running continuously for one to three years?

• a.Using pay-as-you-go pricing
• b.Adding more outbound data transfer
• c.Purchasing a reservation (reserved capacity)✓
• d.Deleting all tags

Reservations discount steady, predictable workloads in exchange for a one- or three-year commitment. Pay-as-you-go is the most expensive for steady use, extra egress increases cost, and tags do not affect price.

Regarding Azure data transfer charges, which statement is generally true?

• a.Inbound data transfer is typically free, while outbound (egress) is often billed✓
• b.Both inbound and outbound are always free
• c.Inbound is billed and outbound is free
• d.Data transfer is never billed

Azure generally does not charge for inbound data but bills for outbound (egress) data transfer beyond free allowances. The other statements misstate how ingress and egress are typically billed.