Azure Fundamentals (AZ-900) — All Questions
The figures these questions turn on, laid out by section on dense colour pages you can print: Microsoft Azure Fundamentals cheat sheet PDF — $9.99 →
193 questions
What threat does multifactor authentication most directly protect against?
- a.Accidental overspending against a defined subscription cost budget
- b.High network latency between regions
- c.Physical damage to the datacenter
- d.Unauthorized access when a password has been compromised✓
Even if an attacker steals a password, MFA blocks them because they lack the second factor. This makes MFA one of the most effective single controls against account takeover.
What does Conditional Access in Microsoft Entra ID let an organization do?
- a.Estimate the cost of future deployments
- b.Provision virtual machines automatically
- c.Store and serve large amounts of unstructured object and blob data across many regions
- d.Enforce access controls based on signals such as user, location, device, and risk✓
Conditional Access evaluates signals at sign-in and then applies controls, like requiring MFA or a compliant device. It brings access decisions in line with real-world risk.
Which is a realistic example of a Conditional Access policy?
- a.Changing the portal theme based on the time of day
- b.Automatically deleting a user's files after each login
- c.Requiring MFA when a user signs in from an unfamiliar or untrusted location✓
- d.Automatically doubling the storage redundancy tier each time a user signs into the app
A typical Conditional Access rule strengthens verification for risky conditions, such as sign-ins from unexpected locations. This lets low-risk access stay frictionless while high-risk access is challenged.
How do Azure RBAC roles and Microsoft Entra ID roles differ in what they control?
- a.They are completely identical, fully interchangeable features that control exactly the same scope of access across Azure
- b.Azure RBAC roles control access to Azure resources, while Entra ID roles control identity and directory tasks✓
- c.Entra ID roles control network bandwidth while RBAC controls encryption
- d.RBAC controls billing while Entra roles control storage tiers
Azure RBAC governs actions on resources like VMs and storage, whereas Entra ID (directory) roles govern tasks like managing users and groups. Understanding the split prevents over- or under-granting access.
Which of the following is an example of passwordless authentication?
- a.Signing in with Windows Hello, a FIDO2 security key, or the Microsoft Authenticator app✓
- b.Emailing your current account password to yourself so you can retrieve it later for safekeeping
- c.Writing the password on a sticky note
- d.Typing a long password followed by a PIN
Passwordless methods verify identity without a typed password, using biometrics, a security key, or an app approval. They improve both security and user experience by removing the weakest link.
What is a core guiding principle of the Zero Trust security model?
- a.Grant every user administrator access by default
- b.Never trust, always verify each request explicitly✓
- c.Disable authentication for internal applications
- d.Trust any request that originates inside the corporate network
Zero Trust assumes no implicit trust based on network location and verifies every request. It combines explicit verification, least-privilege access, and an assume-breach mindset.
Which set of ideas represents the guiding principles of Zero Trust?
- a.Granting broad standing access, disabling MFA, and hiding all of the alerts
- b.Encrypt nothing, allow legacy protocols, and trust every device
- c.Trust the network, share all credentials, and skip logging
- d.Verify explicitly, use least-privilege access, and assume breach✓
Zero Trust rests on verifying every request, granting only the minimum access needed, and designing as though a breach has already happened. These principles reduce both the likelihood and impact of compromise.
What does a defense-in-depth security strategy rely on?
- a.Trusting all internal traffic without inspection
- b.Removing all authentication requirements in order to simplify user access
- c.A single strong firewall as the only protection
- d.Multiple layers of controls so no single failure exposes everything✓
Defense in depth stacks independent controls, so if one layer is bypassed, others still protect the asset. Each layer slows or stops an attacker, buying time to detect and respond.
Which of the following represents a layer in the defense-in-depth model?
- a.The identity and access layer✓
- b.The portal color-theme layer
- c.The invoice generation layer
- d.The resource naming and tagging layer
Defense in depth includes layers such as physical, identity/access, perimeter, network, compute, application, and data. Identity is a critical layer, often called the modern security perimeter.
What does the Secure Score in Microsoft Defender for Cloud help you do?
- a.Encrypt data automatically without configuration
- b.Calculate the exact monthly bill for compute
- c.Automatically choosing whichever Azure region has the lowest network latency
- d.Measure your current security posture and track improvements over time✓
Secure Score summarizes how well your environment follows security best practices and rises as you remediate recommendations. It gives teams a clear, trackable target for hardening.
Want these explained in order? Microsoft Azure Fundamentals (AZ-900) — Complete Study Guide (2026) — PDF + EPUB, $14.99 · 14-day refund →
Conditional Access is a capability of which Microsoft Entra ID licensing level?
- a.A tier that is exclusive to on-premises Active Directory
- b.The free tier available to everyone
- c.A premium tier (Entra ID P1 or P2)✓
- d.A tier included only with virtual machines
Conditional Access requires an Entra ID premium license rather than the free tier. Organizations that need risk-based access controls plan for the appropriate licensing.
What does Microsoft Entra B2B collaboration enable?
- a.Migrating virtual machines between regions
- b.Automatically encrypting all blob storage data while it is at rest in every region
- c.Automatically lowering your Azure bill
- d.Inviting external guest users to securely access your organization's resources✓
Entra B2B lets you invite partners and vendors as guest identities so they can access shared apps and resources without a separate account in your systems. You control what those guests can reach.
What is Microsoft Entra External ID (formerly Azure AD B2C) primarily used for?
- a.Managing identity and sign-in for customer-facing (consumer) applications✓
- b.Provisioning Azure virtual networks
- c.Managing internal employee payroll
- d.Storing and serving very large media, image, and video files for applications
External ID / B2C provides customizable sign-up and sign-in experiences for the customers of an app. It keeps consumer identities separate from an organization's internal workforce directory.
In Microsoft Entra ID, what does a 'tenant' represent?
- a.A single virtual machine running the directory
- b.A monthly billing invoice generated for identity and directory services
- c.A physical rack of servers in one datacenter
- d.A dedicated, isolated instance of the directory for an organization✓
A tenant is an organization's own isolated directory instance, containing its users, groups, and app registrations. Each tenant is logically separated from every other organization's directory.
What does Privileged Identity Management (PIM) in Microsoft Entra ID provide?
- a.Free virtual machines for administrators
- b.The automatic scheduled deletion of all inactive guest user accounts each month
- c.Just-in-time, time-bound privileged access that can require approval✓
- d.Permanent administrator rights for all users
PIM reduces standing privilege by granting elevated roles only when needed, for a limited time, often with approval and auditing. This shrinks the window in which powerful permissions can be misused.
What do Microsoft Entra ID security defaults primarily do?
- a.Move all of the organization's data into one single centralized region
- b.Enforce baseline protections, such as requiring MFA for users✓
- c.Disable all sign-in requirements for convenience
- d.Automatically buy reservations to save money
Security defaults turn on a set of preconfigured, sensible protections like MFA and blocking legacy authentication. They give organizations a strong baseline without building custom policies.
In cloud security, identity is frequently described as the new what?
- a.Billing boundary
- b.The archived cool storage tier layer
- c.Security perimeter✓
- d.Physical firewall
Because users and services connect from anywhere, controlling identity has become the primary boundary rather than the network edge. This shift underpins Zero Trust thinking.
What is an advantage of assigning an Azure role to a group rather than to individual users?
- a.It completely removes the need for any form of user authentication entirely
- b.It automatically encrypts all resources
- c.It makes each user's access completely invisible
- d.It simplifies access management and scales better as membership changes✓
Assigning roles to groups means you manage access by adding or removing members rather than editing many individual assignments. This reduces errors and administrative effort at scale.
The lifecycle of a system-assigned managed identity is tied to what?
- a.A password stored in the application code
- b.The Azure resource on which it is enabled✓
- c.The region's availability zones
- d.The billing account's payment method
A system-assigned managed identity is created with its resource and deleted when that resource is deleted. This tight lifecycle removes the burden of managing credentials separately.
Which signal can a Conditional Access policy evaluate when deciding whether to allow access?
- a.Sign-in risk, device state, location, or the application being accessed✓
- b.The individual user's personally preferred favorite color and portal theme
- c.The number of tags on a resource group
- d.The current price of a virtual machine
Conditional Access weighs signals like user and sign-in risk, device compliance, location, and the target app. Based on those, it can allow, block, or require additional controls such as MFA.
How do single sign-on (SSO) and multifactor authentication (MFA) complement each other?
- a.SSO encrypts data while MFA provisions servers
- b.They are exactly the same feature simply offered under two different marketing names with no real difference
- c.SSO reduces the number of logins for convenience, while MFA adds verification factors for security✓
- d.MFA removes the need to ever authenticate again
SSO improves usability by letting one authentication grant access to many apps, and MFA strengthens that single authentication with extra factors. Used together, they balance convenience and strong security.
What does cloud security posture management (CSPM) in Microsoft Defender for Cloud focus on?
- a.Provisioning and configuring brand-new virtual networks and their subnets automatically
- b.Translating documentation into other languages
- c.Reducing the price of storage accounts
- d.Finding misconfigurations and continuously improving your security posture✓
CSPM continuously assesses resources for weaknesses and misconfigurations and recommends fixes, feeding the Secure Score. It helps prevent breaches by closing gaps before they are exploited.
How does the Zero Trust model differ from the traditional 'castle-and-moat' network approach?
- a.It only applies to physical building security
- b.It trusts all internal and external traffic equally without checks
- c.It does not automatically trust a request just because it originates inside the network✓
- d.It completely removes the need for any user accounts or sign-in credentials across the organization
The old model trusted anything inside the perimeter; Zero Trust verifies every request regardless of origin. This reflects modern reality where users and threats can be anywhere.
How does just-in-time (JIT) VM access in Microsoft Defender for Cloud reduce risk?
- a.It automatically doubles the virtual machine's compute and memory capacity each time a session opens
- b.It permanently opens all ports for convenience
- c.It opens management ports only when needed, for a limited time, instead of leaving them always open✓
- d.It deletes the virtual machine after each session
JIT access keeps management ports closed until a user requests time-limited access, shrinking the attack surface. Leaving RDP or SSH always open is a common source of compromise that JIT mitigates.
Which of the following is a valid Microsoft Entra ID authentication method?
- a.A blob storage tier
- b.An availability zone
- c.A resource lock applied to a resource group
- d.The Microsoft Authenticator app✓
Entra ID supports methods like passwords, the Authenticator app, FIDO2 keys, and Windows Hello. Offering multiple methods enables MFA and passwordless sign-in.
A Conditional Access policy can be set to grant access only if which condition is met?
- a.The resource group has fewer than ten resources
- b.The device is compliant or marked as managed✓
- c.The subscription has a budget configured
- d.The user has been active for over a year
Grant controls in Conditional Access can require conditions such as a compliant device, MFA, or an approved client app. This ties access to the security state of the device and user.
What does self-service password reset (SSPR) in Microsoft Entra ID allow users to do?
- a.Reset their own passwords securely without contacting the help desk✓
- b.The ability to delete other users' accounts and reset their passwords
- c.Change the region of a subscription
- d.Grant themselves administrator roles
SSPR lets users recover access on their own after verifying identity, reducing help-desk load and downtime. It is typically paired with registered authentication methods for security.
What does identity federation allow?
- a.The purchase of reservations on the user's behalf
- b.The encryption of all network traffic by default
- c.A trust relationship so users authenticated by one identity provider can access another system✓
- d.The automatic scheduled deletion of unused and orphaned resources across the whole environment
Federation establishes trust between identity providers so a user can sign in once with their home provider and access federated apps. It underpins many single sign-on scenarios across organizations.
Encrypting data at rest is a control that operates at which defense-in-depth layer?
- a.The identity layer
- b.The perimeter layer
- c.The data layer✓
- d.The physical layer
Protecting stored data with encryption is a control at the innermost data layer. If outer layers are breached, encryption still helps keep the underlying data unreadable.
A distributed denial-of-service (DDoS) protection service operates primarily at which defense-in-depth layer?
- a.The data layer
- b.The application code layer
- c.The identity layer
- d.The perimeter layer✓
DDoS protection defends the network edge where traffic first enters, making it a perimeter-layer control. It absorbs or filters volumetric attacks before they reach internal resources.
Restricting communication between resources using Network Security Groups is a control at which defense-in-depth layer?
- a.The network layer✓
- b.The data layer
- c.The physical layer
- d.The application layer
NSGs filter traffic between subnets and resources, placing them at the network layer of defense in depth. Segmenting the network limits how far an attacker can move if they get in.
How does Microsoft Entra ID differ from traditional Windows Server Active Directory?
- a.It is a legacy service that is completely unable to authenticate any users or applications at all in the cloud
- b.It only manages printers and file shares
- c.It is a cloud identity service that uses modern web protocols rather than domains, OUs, and group policy✓
- d.It is simply Active Directory installed on a local server
Entra ID is a cloud-native identity provider built around protocols like OAuth, OpenID Connect, and SAML, not the on-premises constructs of Windows Server AD. The two can be integrated but are not the same product.
An external user invited to your directory through Entra B2B appears as which type of account?
- a.A service principal owner
- b.A guest user✓
- c.A billing account holder
- d.A global administrator
B2B invitations create guest identities in your tenant, which you can then authorize for specific resources. Guests remain distinct from your internal member users.
A common Conditional Access baseline recommendation is to do what?
- a.Require users to share passwords with the help desk
- b.Allow all sign-ins without any verification
- c.Disabling the logging of all user sign-in and directory audit events
- d.Block legacy authentication protocols that do not support MFA✓
Legacy authentication protocols cannot enforce MFA and are frequently abused in attacks, so blocking them is a standard hardening step. Conditional Access can enforce this across the organization.
What happens when you act on the recommendations behind your Secure Score in Defender for Cloud?
- a.Your subscription's billing currency is silently changed
- b.Your data is moved to a random region
- c.Your subscription is automatically deleted
- d.Your score rises and your overall risk is reduced✓
Each remediated recommendation improves your posture and increases the Secure Score. The score is a practical, trackable way to prioritize security work.
What is a break-glass (emergency access) account and why is it used?
- a.A temporary guest account for external vendors
- b.A standard, closely monitored read-only account that is used only for routine daily status reporting to management teams
- c.A shared account whose password is posted publicly
- d.A highly privileged account, safeguarded and usually excluded from normal Conditional Access, kept for emergencies✓
Break-glass accounts ensure administrators can still sign in if MFA or Conditional Access services fail or lock everyone out. They are tightly controlled, closely monitored, and used only in emergencies.
Risk-based Conditional Access and Privileged Identity Management require which Microsoft Entra ID license?
- a.The free tier
- b.A Windows Server license
- c.Entra ID P2✓
- d.No license at all
Advanced identity protection features like PIM and risk-based Conditional Access are part of the Entra ID P2 tier. Organizations needing these plan their licensing accordingly.
From where can Azure Monitor collect telemetry?
- a.From Azure resources, applications, and even on-premises or other-cloud sources✓
- b.Only from resources located in one region
- c.Only from a single virtual machine at a time
- d.Only from storage accounts that are located within a single Azure region at a time
Azure Monitor is a broad observability platform that ingests metrics and logs from Azure, apps, and hybrid or multi-cloud environments. This unified view helps detect and diagnose issues anywhere.
What are Azure Monitor metrics?
- a.Numeric values collected at regular intervals as time-series data✓
- b.Encryption keys used to secure resources
- c.Static images and other files that are stored in blob storage containers
- d.Free-form text notes written by administrators
Metrics are lightweight, time-stamped numeric measurements (like CPU percentage) sampled at intervals. Their time-series nature makes them ideal for near-real-time charts and threshold alerts.
What are Azure Monitor Logs (Log Analytics) best described as?
- a.A place to store virtual machine disks
- b.A billing report for network egress
- c.Records of varied data queried with the Kusto Query Language (KQL)✓
- d.A network firewall service that inspects and blocks inbound traffic
Logs hold richer, structured, and text data that you analyze using KQL in a Log Analytics workspace. They support deep investigation, correlation, and reporting across many sources.
What is Application Insights used for?
- a.Monitoring the performance, usage, and failures of applications (application performance management)✓
- b.Provisioning virtual networks
- c.Automatically encrypting all sensitive data while it is at rest across every storage service in the environment
- d.Managing user passwords
Application Insights is the APM feature of Azure Monitor, tracking request rates, response times, exceptions, and dependencies. Developers use it to find and fix performance and reliability problems.
Which of the following does Application Insights track for a web application?
- a.The physical temperature of the server room
- b.Request rates, response times, failure rates, and dependency calls✓
- c.The billing currency that is configured for the entire subscription
- d.The number of resource groups in a subscription
Application Insights instruments an app to capture telemetry such as request timing, failures, and external dependency behavior. This visibility helps pinpoint bottlenecks and errors in code.
What does Azure Service Health notify you about?
- a.The single most optimal virtual machine size and pricing tier recommended for your specific workload
- b.Azure service issues, planned maintenance, and health advisories that may affect your resources✓
- c.The number of tags applied to each resource
- d.The remaining balance on your credit card
Service Health provides a personalized view of Azure incidents, maintenance, and advisories relevant to the services and regions you use. It helps you understand whether a problem is on Azure's side.
What does Azure Resource Health report?
- a.The current health status of a specific resource instance✓
- b.The overall compliance state of every assigned policy definition
- c.The overall price of the subscription
- d.The list of users with access to a resource
Resource Health drills down to whether an individual resource is available and, if not, whether the cause is platform- or user-related. It complements the broader Service Health view.
How does the personalized Azure Service Health differ from the public Azure status page?
- a.Service Health only ever shows subscription billing and payment information to the customer
- b.The public status page updates only once per year
- c.The public status page is only visible to Microsoft employees
- d.Service Health is tailored to the specific resources and subscriptions you use✓
The public status page shows broad, global service status, while Service Health filters and personalizes information to your environment. That focus makes Service Health more actionable for your workloads.
An Azure Monitor metric alert fires under what condition?
- a.When any resource within the resource group is renamed by a user
- b.When a new user signs into the portal
- c.When a tag is added to a resource
- d.When a monitored metric crosses a threshold you have defined✓
Metric alerts continuously evaluate a metric against your threshold and trigger when the condition is met, such as CPU above 80 percent. They enable fast, automated response to performance problems.
What is a log (search) alert in Azure Monitor based on?
- a.The color of the portal dashboard
- b.The chosen display name of the parent resource group container
- c.The number of availability zones in a region
- d.The results of a log query run against collected log data✓
Log alerts run a KQL query on a schedule and fire when the results meet a condition, like a certain number of errors appearing. They catch patterns that simple metric thresholds cannot express.
What do Azure dashboards let you do?
- a.It can completely replace the need for any user authentication across services
- b.Automatically write application code
- c.Pin and visualize metrics and resources together in one customizable view✓
- d.Physically rewire the datacenter network
Dashboards provide a personalized canvas where you can pin charts, resource tiles, and query results for at-a-glance monitoring. Teams tailor them to the signals they care about most.
What do Azure Monitor Workbooks provide?
- a.A managed network firewall service for inbound and outbound traffic
- b.Interactive reports that combine data, text, and visualizations✓
- c.A storage tier for archived blobs
- d.A way to buy reserved instances
Workbooks let you build rich, interactive reports mixing queries, parameters, charts, and narrative text. They are ideal for shareable investigations and operational dashboards.
Which query language is used to analyze data in Azure Monitor Log Analytics?
- a.Kusto Query Language (KQL)✓
- b.Structured Query Language for relational tables only
- c.The Bicep domain-specific language
- d.HyperText Markup Language
KQL is the read-only query language for exploring logs and other data in Log Analytics. Its expressive filtering and aggregation make it central to Azure observability.