Azure Fundamentals (AZ-900) — All Questions

Azure Functions code typically runs in response to what?

• a.Events or triggers such as an HTTP request or new queue message✓
• b.The physical replacement of a failed disk
• c.A single fixed daily reboot of the underlying host operating system only
• d.Manual patching of servers by an administrator

Azure Functions is event-driven: code runs when a trigger fires, such as an HTTP request, timer, or queue message. You do not manage servers. Billing in the Consumption plan is based on executions and resources used.

Which scenario best fits Azure Container Instances?

• a.Orchestrating hundreds of interdependent microservices with complex scaling and self-healing
• b.Providing global DNS resolution for domains
• c.Hosting a full multi-node relational database cluster
• d.Running a short-lived container quickly without managing servers✓

Azure Container Instances runs containers on demand without provisioning VMs or orchestrators. It suits simple, short-lived, or bursty tasks. For complex orchestration, AKS is more appropriate.

What does Azure Kubernetes Service (AKS) primarily provide?

• a.A fully managed relational database engine based on SQL Server technology
• b.A managed secrets and certificate vault
• c.Managed orchestration of containerized workloads✓
• d.A global content delivery network for cached media

AKS is a managed Kubernetes service for orchestrating containers at scale. It automates cluster operations like scaling, upgrades, and self-healing. It is ideal for microservices architectures.

When you create a VNet, what must you define?

• a.A virtual machine operating system image
• b.A domain registrar account for the network
• c.A blob storage access tier such as hot, cool, or archive for objects
• d.A private IP address space (address range)✓

A virtual network requires a private IP address space, which you divide into subnets. Resources placed in the VNet receive addresses from these ranges. The VNet is the foundation for private networking in Azure.

Which Azure service provides secure RDP/SSH access to VMs in the portal without exposing public IP addresses?

• a.Azure Advisor
• b.Azure Bastion✓
• c.Azure DNS
• d.Azure Blob Storage

Azure Bastion gives secure browser-based RDP and SSH to VMs without assigning them public IPs. Connectivity happens over TLS within the portal. This reduces exposure to the public internet.

At what levels can a Network Security Group be associated?

• a.To a subnet or a network interface✓
• b.Only to an entire subscription and never to anything smaller than that
• c.To a single blob container
• d.Only to a management group at the top of the hierarchy

An NSG can be associated with a subnet or with a VM's network interface. Its rules allow or deny traffic by source, destination, port, and protocol. This controls network access at those levels.

A remote employee connects their laptop securely to Azure resources. Which VPN Gateway configuration fits?

• a.Site-to-site VPN between two fixed networks
• b.Point-to-site VPN✓
• c.A dedicated ExpressRoute private circuit provided through a connectivity partner
• d.Blob storage geo-replication

A point-to-site VPN connects an individual device to an Azure VNet over an encrypted tunnel. Site-to-site instead links whole networks. Point-to-site suits remote or mobile users.

Which is a defining characteristic of Azure ExpressRoute?

• a.It stores large amounts of unstructured object data
• b.It is a serverless event-driven compute option
• c.It always routes all of its traffic across the shared public internet backbone
• d.It provides a private connection that bypasses the public internet✓

ExpressRoute creates a private, dedicated connection between on-premises and Azure via a connectivity provider. Traffic does not traverse the public internet. This offers more consistent latency and higher reliability.

Azure DNS is used to host what?

• a.DNS records for your domain names✓
• b.Virtual machine operating-system disks and their attached data volumes
• c.Relational database tables
• d.Container images for deployment

Azure DNS hosts your domain's DNS records on Microsoft's global name-server network. It provides fast, reliable name resolution. You manage records with the same tools as other Azure resources.

At which network layer does Azure Load Balancer operate?

• a.Layer 1 (physical)
• b.Layer 2 (data link)
• c.Layer 4 (transport)✓
• d.Layer 7 (application)

Azure Load Balancer works at Layer 4, distributing TCP/UDP traffic across backend resources. For Layer 7 HTTP features like URL routing, Application Gateway is used. Layer 4 balancing is fast and protocol-agnostic.

Which capability is unique to Azure Application Gateway compared with a basic Layer 4 load balancer?

• a.It only forwards raw TCP packets blindly without any awareness of content
• b.It stores blob objects for websites
• c.URL-based routing and an optional Web Application Firewall✓
• d.It cannot inspect HTTP traffic at all

Application Gateway is a Layer 7 load balancer offering URL-based routing, SSL termination, and an optional WAF. These application-aware features go beyond Layer 4 balancing. It suits advanced HTTP/HTTPS scenarios.

Which blob access tier is optimized for data that is accessed frequently?

• a.Cold tier
• b.Archive tier
• c.Cool tier
• d.Hot tier✓

The hot tier is optimized for data accessed often, with the lowest access costs and higher storage cost. Cool and cold suit infrequently accessed data. Archive is the cheapest to store but slowest to retrieve.

Which access tier suits data that is infrequently accessed and stored for at least 30 days?

• a.Hot tier for active data
• b.Premium block blob tier
• c.Archive tier for rarely read data
• d.Cool tier✓

The cool tier targets infrequently accessed data kept for at least 30 days. It has lower storage cost but higher access cost than hot. Archive is for rarely accessed, long-retention data.

Which Azure managed disk type generally offers the highest performance for I/O-intensive workloads?

• a.Standard HDD for infrequent access
• b.Premium SSD✓
• c.Archive blob tier
• d.Cool blob tier

Premium SSD (and Ultra Disk) deliver high IOPS and low latency for demanding workloads. Standard HDD is cheaper but slower. Blob tiers are for object storage, not VM disks.

What problem does Azure Queue Storage help solve in an application architecture?

• a.Resolving domain names for the network
• b.Encrypting virtual machine operating-system disks and data disks at rest
• c.Decoupling components so they process work asynchronously✓
• d.Serving a public marketing website directly to users

Queue Storage holds messages that components add and retrieve asynchronously. This decouples producers from consumers so each can scale independently. It improves resilience and smooths load spikes.

Azure Table Storage is best described as what?

• a.A fully relational SQL database that supports complex joins and transactions
• b.A global content delivery network for caching media
• c.A NoSQL key-value store for structured, non-relational data✓
• d.A registry for storing container images

Azure Table Storage is a NoSQL key-value store for large amounts of structured, non-relational data. It scales cheaply for simple lookups. It does not support relational joins like a SQL database.

Which redundancy option combines zone redundancy in the primary region with replication to a secondary region?

• a.LRS, which stays within one datacenter
• b.ZRS, which stays within one region
• c.Premium solid-state disks provisioned for high-throughput database workloads
• d.GZRS (geo-zone-redundant storage)✓

GZRS writes data across availability zones in the primary region and also replicates to a secondary region. It combines zone and geo resilience. This provides very high durability and availability.

What does read-access geo-redundant storage (RA-GRS) add over standard GRS?

• a.Read access to the data in the secondary region✓
• b.Nothing at all, because the two options are completely identical in every way
• c.It automatically deletes older data to save space
• d.It removes the secondary copy of the data entirely

RA-GRS adds the ability to read from the secondary region even when the primary is available. Standard GRS keeps a secondary copy but normally does not allow reads from it unless a failover occurs. RA-GRS improves read availability.

Which is TRUE of Azure SQL Database as a PaaS offering?

• a.You must patch the guest operating system yourself
• b.It is only ever available as an on-premises installation inside your datacenter
• c.You manage the underlying physical servers directly
• d.Microsoft manages patching, backups, and high availability✓

Azure SQL Database is a fully managed PaaS relational database. Microsoft handles patching, backups, and high availability. You focus on the database schema, data, and queries.

Which capability is a hallmark of Azure Cosmos DB?

• a.It cannot scale its throughput up or down
• b.It exclusively supports the traditional Microsoft SQL Server relational engine
• c.Turnkey global distribution with low-latency reads and writes✓
• d.It runs only in a single region at a time

Cosmos DB offers turnkey global distribution with low-latency access and elastic scale. It supports multiple data models and APIs. This makes it ideal for globally responsive applications.

A team wants a managed open-source relational database. Which Azure option fits?

• a.Azure Database for PostgreSQL✓
• b.Azure DNS for domain name resolution
• c.Azure Blob Storage for large unstructured object and media data sets
• d.Azure Bastion for secure VM access

Azure Database for PostgreSQL (and MySQL/MariaDB) are managed open-source relational databases. Microsoft handles maintenance, backups, and scaling. They suit teams standardizing on open-source engines.

Why might an organization use multiple Azure subscriptions?

• a.To physically separate the server racks inside each of the provider's datacenters
• b.To completely disable Azure across the company
• c.To change the fundamental laws of physics for their workloads
• d.To separate environments, billing, or teams and manage limits✓

Multiple subscriptions help separate environments (dev/test/prod), teams, or billing. They also help work around per-subscription service limits. Management groups can then govern them together.

What happens to the resources inside a resource group when the group is deleted?

• a.They are all deleted along with the group✓
• b.They are automatically moved to another subscription for safekeeping
• c.They are converted into blob objects
• d.They become permanently read-only forever

Deleting a resource group deletes all resources it contains. This makes groups useful for managing the lifecycle of related resources together. Resource locks can prevent accidental deletion.

Which factor is LEAST relevant when choosing an Azure region for a deployment?

• a.The favorite color of the IT manager✓
• b.Data residency and compliance requirements
• c.Whether the needed services and features are available there
• d.Proximity to your users to reduce latency

Region choice should consider compliance, latency, cost, and service availability. Personal preferences like a favorite color are irrelevant. Sound region selection balances the meaningful technical and legal factors.

How do Availability Zones differ from availability sets?

• a.Availability zones are primarily designed to protect against application-level software bugs
• b.Availability sets replicate data to entirely different regions
• c.Zones use separate datacenters; sets spread VMs within a single datacenter✓
• d.They are identical and interchangeable concepts

Availability Zones are separate datacenters within a region, protecting against a datacenter failure. Availability sets spread VMs across fault and update domains inside one datacenter. Zones offer stronger, cross-datacenter resilience.

A workload runs briefly only when a file is uploaded, a few times a day. Which compute option is most cost-effective?

• a.A 24/7 AKS cluster with many always-running nodes
• b.A dedicated bare-metal server
• c.A large always-on virtual machine
• d.Azure Functions✓

Azure Functions on the Consumption plan bills only while code runs. For sporadic, event-driven tasks this is very cost-effective. Always-on VMs or clusters would cost far more for the same rare workload.

What is the benefit of deployment slots in Azure App Service?

• a.They store archived blob objects at the lowest possible long-term storage cost
• b.They let you stage and swap app versions with minimal downtime✓
• c.They resolve DNS records faster for the app
• d.They encrypt the connected database automatically

Deployment slots host different versions of an app, such as staging and production. You can validate in staging and then swap with production nearly instantly. This enables safe releases with minimal downtime.

Which statement about a single Azure Virtual Network is correct?

• a.A VNet is a physical hardware device
• b.A VNet can exist without belonging to any subscription
• c.A VNet is scoped to a single region✓
• d.A VNet spans multiple regions automatically by default

A VNet is scoped to one region and one subscription. To connect VNets across regions, you use peering or gateways. Understanding this scope is important for network design.

To connect two VNets over Microsoft's private backbone with low latency, you would use…

• a.the shared public internet with an encrypted tunnel between the two networks
• b.VNet peering✓
• c.the Azure DNS resolution service
• d.a single blob storage container

VNet peering links two virtual networks over Microsoft's backbone with low latency. Traffic stays on the private network, not the public internet. It is commonly used to connect workloads across VNets or regions.

Which feature lets you access a PaaS service like a storage account over a private IP inside your VNet?

• a.Azure Private Link / private endpoint✓
• b.An availability set for the VMs
• c.A ReadOnly resource lock on the account
• d.A publicly routable IP address exposed directly to the open internet at large

Azure Private Link exposes a PaaS service through a private endpoint with a private IP in your VNet. Traffic avoids the public internet. This improves security and simplifies network design.

Azure Blob, File, Queue, and Table services are all offered through what?

• a.An availability set of servers
• b.An Azure storage account✓
• c.A DNS zone resource
• d.A single dedicated virtual machine

These four data services are provided within an Azure storage account. The account defines settings like performance tier and redundancy. It is the top-level container for Azure Storage.

What is a snapshot of an Azure managed disk used for?

• a.Distributing incoming requests across many servers
• b.Resolving domain names for the network
• c.Directly serving high-volume public web traffic to end users worldwide
• d.A point-in-time copy for backup or creating new disks✓

A snapshot captures a disk at a point in time. It can be used for backup or to create new identical disks. Snapshots support recovery and duplication scenarios.

Azure File Sync is primarily used to…

• a.cache Azure file shares on local Windows servers✓
• b.encrypt individual blob objects using customer-managed encryption keys
• c.orchestrate large fleets of containers
• d.route and balance network traffic across regions

Azure File Sync caches Azure file shares on on-premises Windows servers. This gives fast local access while centralizing data in Azure. It supports hybrid file-sharing scenarios.

Azure Cosmos DB supports multiple APIs. Which is one of them?

• a.NoSQL (Core) and MongoDB API✓
• b.An SMB file-sharing protocol API
• c.An RDP remote desktop protocol API
• d.A dedicated SMTP email-sending API for outbound mail delivery

Cosmos DB offers several APIs, including NoSQL (Core), MongoDB, Cassandra, Gremlin, and Table. This lets teams use familiar tools and models. It is a multi-model, globally distributed database.

What does an Azure SQL Database elastic pool allow?

• a.Hosting and orchestrating containers at scale
• b.Performing faster DNS lookups for applications
• c.Storing large unstructured blob objects at the lowest available archive cost
• d.Multiple databases to share a set of resources cost-effectively✓

An elastic pool lets several databases share a common set of resources. Databases with varying, unpredictable usage benefit as capacity is pooled. This can lower cost compared with provisioning each database separately.

Every Microsoft Entra (Azure AD) tenant has a single top-level management group called what?

• a.The root management group✓
• b.The primary billing subscription
• c.The default resource group that is created automatically in each region
• d.The tenant blob container

Each tenant has one root management group at the top of the hierarchy. All other management groups and subscriptions descend from it. Policies applied there can affect the entire tenant.

A benefit of deploying with ARM/Bicep templates is that they are declarative and idempotent, meaning…

• a.they can only ever be run one single time
• b.each separate run randomly changes the resulting configuration in unpredictable ways
• c.they delete all existing resources on every run
• d.applying the same template repeatedly yields the same end state✓

Declarative templates describe the desired end state, not step-by-step commands. Idempotency means running them repeatedly converges to that same state. This makes deployments predictable and repeatable.

To achieve the highest single-region VM availability SLA, you should deploy VMs across what?

• a.One subnet only, without redundancy
• b.One single server placed inside one rack in one datacenter room
• c.Multiple Availability Zones✓
• d.One managed disk shared by all instances

Spreading VMs across multiple Availability Zones protects against a datacenter failure and earns the highest single-region VM SLA. A single server offers no redundancy. Zones provide independent power, cooling, and networking.

Under the Azure Functions Consumption plan, you are billed based on…

• a.the number of executions and resources used while running✓
• b.the color theme selected in the portal
• c.a single flat monthly fee that applies regardless of how much you actually use
• d.the number of DNS records you host

The Consumption plan bills on the number of executions and the resources consumed during each run. When nothing runs, you pay nothing (aside from minor storage). This aligns cost with actual activity.

Which Azure service stores and manages container images?

• a.Azure DNS, which hosts your public domain name records globally
• b.Azure Container Registry✓
• c.Azure Bastion for secure VM access
• d.Azure Key Vault for secrets and certificates

Azure Container Registry stores and manages container images and related artifacts. Services like AKS and ACI pull images from it. It supports private, secure image distribution.

Which Azure service uses DNS to route users to the best endpoint across multiple regions?

• a.Azure Bastion, which provides secure browser-based access to virtual machines
• b.Azure Files for managed file shares
• c.Azure Key Vault for storing secrets
• d.Azure Traffic Manager✓

Azure Traffic Manager is a DNS-based traffic router. It directs users to the most appropriate regional endpoint using routing methods like performance or priority. It improves availability and responsiveness across regions.

Which service provides global HTTP load balancing, acceleration, and a WAF at the network edge?

• a.Azure Queue Storage for asynchronous messaging between application components
• b.Azure DNS for name resolution
• c.Azure Table Storage for NoSQL key-value data
• d.Azure Front Door✓

Azure Front Door provides global HTTP/HTTPS load balancing, acceleration, SSL offload, and an optional WAF at the edge. It routes users to the fastest healthy backend. It is used for global, high-performance web delivery.

How are Network Security Group rules evaluated?

• a.By priority number, with the lowest number processed first✓
• b.In a completely random order that changes on every network connection attempt
• c.Strictly alphabetically by the rule name
• d.Only inbound rules are ever considered

NSG rules are processed in priority order, lowest number first, and the first match applies. Both inbound and outbound rule sets exist. Careful priority ordering ensures the intended allow/deny behavior.

In every Azure subnet, a small number of IP addresses are…

• a.permanently unusable for the life of the subscription
• b.always assigned as publicly routable addresses reachable from the internet
• c.reserved by Azure for internal use✓
• d.assigned exclusively to DNS servers

Azure reserves a few addresses in each subnet (for the network address, gateway, DNS mapping, and broadcast). These cannot be assigned to your resources. You must account for them when sizing subnets.

What does a shared access signature (SAS) provide for Azure Storage?

• a.Completely free storage with no charges
• b.Permanent and unrestricted access to every resource in the storage account forever
• c.A convenient way to delete the entire storage account
• d.Delegated, time-limited access to specific resources✓

A SAS grants delegated, time-bound access to specific storage resources with defined permissions. It avoids sharing the account keys directly. This supports secure, scoped access for clients.

Blob lifecycle management policies help you…

• a.automatically move or delete blobs based on their age✓
• b.encrypt the whole virtual network and all of its attached subnets automatically
• c.resolve domain names more quickly for applications
• d.assign RBAC roles to users at scale

Lifecycle management policies automatically transition blobs to cooler tiers or delete them based on rules like age. This optimizes storage cost over time. It reduces manual data-management work.

Compared with Standard HDD, Premium SSD managed disks offer…

• a.higher performance at a higher cost✓
• b.noticeably lower cost together with noticeably lower input/output performance
• c.no meaningful difference of any kind
• d.the exact same performance for a lower monthly price

Premium SSD delivers higher IOPS and throughput than Standard HDD, at a higher price. You choose disk type based on performance needs and budget. High-performance workloads justify the premium tier.

Azure SQL Managed Instance is best suited for customers who want…

• a.near-full SQL Server compatibility with managed infrastructure✓
• b.a globally distributed NoSQL database with turnkey multi-region replication
• c.a managed container orchestration platform
• d.a global DNS hosting service

SQL Managed Instance offers high compatibility with on-premises SQL Server while Microsoft manages the infrastructure. It eases lift-and-shift migrations that need instance-level features. It bridges IaaS control and PaaS convenience.

Azure Cosmos DB lets you choose among several…

• a.DNS record types for name resolution
• b.consistency levels ranging from strong to eventual✓
• c.virtual machine size families
• d.blob storage access tiers only, such as hot, cool, cold, and archive

Cosmos DB provides tunable consistency levels from strong to eventual. This lets you balance latency, availability, and data freshness. Choosing the right level suits your application's needs.

Before using a service type in a subscription, ARM may require you to register the corresponding…

• a.resource provider✓
• b.DNS zone that hosts the public name records for the organization's domain
• c.blob storage container for objects
• d.availability set for virtual machines

Resource providers supply Azure services (for example, Microsoft.Compute). A provider may need to be registered in a subscription before its resources can be created. ARM manages this registration.