Azure Fundamentals (AZ-900) Practice Test

Sample practice questions

A few real questions from this free bank, with full explanations. Use the practice tool above for the whole set.

1. 1. Cloud Concepts

   Which cloud service model gives you the most control over the operating system, networking, and installed software, while the provider manages only the physical hardware?

   • a.Function as a Service (FaaS)
   • b.Software as a Service (SaaS)
   • c.Infrastructure as a Service (IaaS)
   • d.Platform as a Service (PaaS)

   Answer: c

   Explanation: IaaS provides virtualized compute, storage, and networking, leaving the customer responsible for the operating system and everything above it. The provider only manages the underlying physical infrastructure. This gives the greatest flexibility but also the most administrative overhead.

2. 2. Azure Architecture & Services

   What is the purpose of a subnet within an Azure Virtual Network?

   • a.It segments the VNet's IP address space to organize and isolate groups of resources
   • b.It manages user passwords
   • c.It stores backup files
   • d.It provides serverless compute

   Answer: a

   Explanation: A subnet divides a VNet's address range into smaller segments, letting you group and isolate resources. Segmentation improves security and organization, for example separating web and database tiers. Network security rules can be applied at the subnet level.

3. 3. Management & Governance

   Which built-in RBAC role lets a user manage resources but NOT grant access to other users?

   • a.Contributor
   • b.Guest
   • c.Owner
   • d.Reader

   Answer: a

   Explanation: The Contributor role allows creating and managing all types of resources but does not permit assigning roles to others. That role-assignment capability is reserved for Owner and User Access Administrator. This separation supports controlled delegation.

4. 4. Cloud Concepts

   How does deploying to multiple global regions improve the user experience?

   • a.It increases the distance data must travel to users
   • b.It removes the need for any redundancy in the design
   • c.It forces all traffic through one single country
   • d.It places resources closer to users, lowering latency

   Answer: d

   Explanation: Running resources in regions near users reduces network latency. It also supports resilience and data-residency compliance. Global reach is a core advantage of large cloud platforms.

5. 5. Cloud Concepts

   Cloud providers publish SLAs primarily so customers can…

   • a.plan around guaranteed levels of uptime and support
   • b.learn the provider's corporate home mailing address
   • c.review the confidential architectural blueprints of the physical datacenter
   • d.choose the color of the physical servers

   Answer: a

   Explanation: An SLA communicates the provider's uptime and support commitments. Customers use it to plan for reliability and set expectations. Composite SLAs help estimate an overall solution's availability.

6. 6. Azure Architecture & Services

   Which feature lets you access a PaaS service like a storage account over a private IP inside your VNet?

   • a.Azure Private Link / private endpoint
   • b.An availability set for the VMs
   • c.A ReadOnly resource lock on the account
   • d.A publicly routable IP address exposed directly to the open internet at large

   Answer: a

   Explanation: Azure Private Link exposes a PaaS service through a private endpoint with a private IP in your VNet. Traffic avoids the public internet. This improves security and simplifies network design.

7. 7. Azure Architecture & Services

   Azure Storage accounts come in performance tiers named…

   • a.Fast and Slow
   • b.Bronze and Gold
   • c.Hot and Cold
   • d.Standard and Premium

   Answer: d

   Explanation: Storage account performance comes in Standard and Premium tiers. Premium uses SSDs for low latency and high throughput. Standard is cost-effective for general-purpose data.

8. 8. Management & Governance

   What is the purpose of an Azure Policy exemption?

   • a.To increase the compliance score artificially for all resources
   • b.To exclude a specific resource or scope from evaluation of a policy or initiative
   • c.To automatically and permanently delete any resource that is found to be non-compliant
   • d.To grant a user administrative access to a subscription

   Answer: b

   Explanation: An exemption formally excuses a resource or scope from a policy assignment, often for a documented business reason. It keeps compliance reporting honest by marking the exclusion rather than hiding it.

9. 9. Management & Governance

   What does the Secure Score in Microsoft Defender for Cloud help you do?

   • a.Encrypt data automatically without configuration
   • b.Calculate the exact monthly bill for compute
   • c.Automatically choosing whichever Azure region has the lowest network latency
   • d.Measure your current security posture and track improvements over time

   Answer: d

   Explanation: Secure Score summarizes how well your environment follows security best practices and rises as you remediate recommendations. It gives teams a clear, trackable target for hardening.

10. 10. Management & Governance

    What does Metrics Explorer in Azure Monitor let you do?

    • a.Chart and analyze metric data over time interactively
    • b.The ability to assign RBAC roles directly to application users
    • c.Create blob storage containers
    • d.Deploy new virtual machines

    Answer: a

    Explanation: Metrics Explorer is the tool for plotting and slicing metric time-series, applying filters and splitting by dimensions. It is the go-to place to investigate performance trends.