Azure Fundamentals (AZ-900) — All Questions

Which feature most directly enables recovery of data after a regional disaster?

• a.Disabling geo-replication to reduce complexity
• b.Storing exactly one single copy of the data in the local datacenter only
• c.Cross-region replication of data✓
• d.Turning off all scheduled backups permanently

Replicating data across regions ensures a copy survives a whole-region failure. This underpins disaster recovery. Keeping only a single local copy leaves data vulnerable.

In a public cloud IaaS scenario, which task does the provider handle?

• a.Maintaining the physical host servers✓
• b.Configuring your virtual firewall and network security rules
• c.Managing your users' passwords and sign-in
• d.Applying patches and updates to your own custom application code

In IaaS the provider maintains the physical hosts, hypervisor, and facility. The customer handles the OS, applications, network config, and identities. Knowing the split clarifies who does what.

Which capability is essential to make a hybrid cloud function as one environment?

• a.Avoiding the internet entirely at all times
• b.Permanently deleting all of the organization's existing on-premises systems first
• c.Using only paper-based records for data
• d.Secure network connectivity between on-premises and cloud✓

A hybrid cloud needs secure, reliable connectivity linking on-premises and cloud resources. This lets workloads and data move between them. Without it, the two environments cannot act as one.

Which pricing behavior best reflects 'pay for what you use'?

• a.Paying the full three-year cost upfront in advance
• b.A fixed flat fee that applies no matter how much or how little you actually use
• c.A flat one-time perpetual license bought outright
• d.Being charged for the gigabytes of storage actually consumed each month✓

Paying for the gigabytes actually consumed is consumption-based pricing. Cost tracks real usage rather than a fixed fee. This is a defining trait of cloud economics.

If a service promises 99.9% availability, roughly how much downtime does that allow per year?

• a.Zero downtime is guaranteed
• b.About 8.76 hours per year✓
• c.About 3.65 days per year
• d.About 87 days per year

99.9% (three nines) allows roughly 8.76 hours of downtime per year. Each added nine reduces allowed downtime by about tenfold. Higher SLAs mean tighter downtime limits.

Which pairing correctly matches a service model to an example?

• a.PaaS is a managed app-hosting platform for your code✓
• b.IaaS is a ready-to-use webmail application accessed in a browser
• c.SaaS is a raw virtual machine with no operating system installed
• d.PaaS is a bare-metal server you rack and cable yourself

PaaS provides a managed platform where you deploy your code. Webmail is SaaS, and a raw VM is IaaS. Matching examples to models is a common exam skill.

Who is responsible for classifying data as sensitive or public in any cloud model?

• a.No data classification is ever needed in the cloud
• b.The internet service provider classifies it
• c.The provider always classifies it for you
• d.The customer✓

Data classification and protection always remain the customer's responsibility. The provider secures infrastructure but does not know your data's sensitivity. This holds true across IaaS, PaaS, and SaaS.

By offloading infrastructure management to a cloud provider, an IT team can focus more on what?

• a.Cooling and powering the datacenter facility
• b.Rewiring the server racks in the datacenter
• c.Replacing failed hard drives and other spare parts inside the servers
• d.Delivering business value and applications✓

When the provider handles hardware and facilities, IT teams spend less time on maintenance. They can focus on applications and business outcomes. This shift in focus is a major cloud benefit.

Why should disaster recovery plans be tested periodically?

• a.To intentionally increase the organization's monthly electricity and cooling bills
• b.To confirm systems can actually be restored within the expected time✓
• c.To reduce the amount of available storage on purpose
• d.To deliberately slow down the corporate network

Testing verifies that recovery procedures work and meet the RTO. Untested plans often fail during real incidents. Regular drills build confidence and reveal gaps.

A purchased physical server is treated in accounting as what?

• a.A recurring monthly usage charge that appears on every cloud invoice
• b.A consumable expense billed each hour of use
• c.A per-second billing line item
• d.A capital asset that depreciates over time✓

A bought server is a capital asset that is depreciated across its useful life. That is CapEx. Cloud usage, by contrast, is expensed as OpEx as it is consumed.

Elasticity works best for workloads that have what characteristic?

• a.No users and no activity of any kind
• b.A demand level that never varies even slightly
• c.Variable or unpredictable demand✓
• d.Perfectly constant, completely unchanging demand at all hours

Elasticity shines when demand fluctuates, adding capacity for spikes and removing it during lulls. Perfectly steady workloads gain less from it. Variable demand is where elasticity saves the most.

The main reason an organization chooses a private cloud is usually greater…

• a.control and isolation✓
• b.electricity usage in the datacenter
• c.vendor lock-in to a single supplier
• d.font selection in applications

Private clouds provide dedicated resources with greater control and isolation. This helps meet strict security and compliance needs. The trade-off is typically higher cost and effort.

Because cloud environments can be created and deleted quickly, failed experiments cost less. This reflects which benefit?

• a.Encryption of stored data
• b.Data residency compliance
• c.Multi-tenancy of shared hardware
• d.Agility✓

Fast, disposable environments make experimentation cheap and low-risk. This is a direct expression of cloud agility. Teams can try, learn, and discard quickly.

Which is the core principle behind high availability?

• a.Using exactly one single server to handle every workload in the environment
• b.Removing all backups to save storage space
• c.Eliminating single points of failure through redundancy✓
• d.Disabling automatic failover mechanisms

High availability removes single points of failure by adding redundancy. If one component fails, another takes over. This keeps services accessible with minimal downtime.

A major advantage of aligning cost with actual usage is that you…

• a.only pay for resources while they are running✓
• b.always pay a single fixed maximum amount regardless of real consumption levels
• c.pay continuously for idle servers running overnight
• d.must buy all hardware upfront before use

Paying only for running resources ties cost to real demand. Idle resources can be stopped to save money. This usage alignment is central to cloud cost efficiency.

Which deployment model description is correct?

• a.Community cloud: dedicated to a single company only
• b.Private cloud: infrastructure shared freely and openly with the general public
• c.Hybrid cloud: environments that have no connection between them
• d.Public cloud: shared, provider-owned infrastructure over the internet✓

Public cloud is provider-owned, shared, and delivered over the internet. Private is dedicated to one organization, hybrid connects both, and community is shared by a group. Only the public cloud description here is accurate.

For a SaaS email product, which layer does the provider manage?

• a.The application, runtime, OS, and infrastructure✓
• b.Only the customer's data and none of the underlying application components
• c.Nothing at all in the stack
• d.Only the list of end users

In SaaS the provider manages nearly the whole stack: application, runtime, OS, and infrastructure. The customer manages data, users, and access. This makes SaaS the most hands-off model.

Cloud providers publish SLAs primarily so customers can…

• a.plan around guaranteed levels of uptime and support✓
• b.learn the provider's corporate home mailing address
• c.review the confidential architectural blueprints of the physical datacenter
• d.choose the color of the physical servers

An SLA communicates the provider's uptime and support commitments. Customers use it to plan for reliability and set expectations. Composite SLAs help estimate an overall solution's availability.

How does elasticity reduce the need for traditional capacity planning?

• a.You must still purchase enough hardware for the highest peak every single year
• b.Resources adjust automatically, so you need not provision for peak in advance✓
• c.It forces manual resizing of every server daily
• d.It requires large fixed hardware orders each quarter

Elasticity adds capacity on demand, so you do not have to size for peak ahead of time. This lessens the guesswork of capacity planning. You avoid both shortages and costly over-provisioning.

Which best summarizes why many organizations adopt the cloud economically?

• a.To increase their upfront capital spending significantly
• b.To convert large upfront costs into flexible, usage-based spending✓
• c.To deliberately lengthen the hardware procurement and approval cycles across teams
• d.To buy and operate more physical datacenters of their own

A core economic driver is turning big CapEx into flexible OpEx. Spending then tracks actual usage instead of upfront bets. This improves cash flow and agility.

What is an Azure region pair?

• a.Two regions in the same geography paired for replication and recovery✓
• b.Two subscriptions that are billed together on one invoice
• c.Two identical storage accounts inside one datacenter
• d.Two virtual machines placed within the very same server rack for performance

A region pair links two regions within the same geography for platform resilience. Azure staggers updates and prioritizes recovery across the pair. Some services replicate data to the paired region automatically.

In a region that supports Availability Zones, at minimum how many physically separate zones are provided?

• a.Three zones✓
• b.Ten zones
• c.One zone
• d.Twenty zones

Availability Zone-enabled regions provide at least three physically separate zones. Each zone has independent power, cooling, and networking. Spreading resources across zones protects against a datacenter-level failure.

Which statement about Azure resource groups is TRUE?

• a.Resource groups are physical server racks in a datacenter
• b.Each resource belongs to exactly one resource group✓
• c.Resource groups are not allowed to contain any resources
• d.A single resource can belong to many different resource groups simultaneously

Every Azure resource lives in exactly one resource group. The group is a logical container for related resources. It also serves as a scope for permissions and policies.

What is an Azure subscription primarily used for?

• a.A billing and management boundary for Azure resources✓
• b.A single DNS record entry
• c.A single physical fiber-optic cable running between two datacenters
• d.A single virtual machine instance

A subscription is a logical container that acts as a billing and management boundary. Resources are deployed into subscriptions, which link to an Entra tenant. Organizations often use several subscriptions to separate workloads.

Where do management groups sit in the Azure hierarchy?

• a.Inside a single resource group as a child object
• b.Directly below subscriptions in every case
• c.Below individual resources, nested inside each deployed resource itself
• d.Above subscriptions, to organize and govern them✓

Management groups sit above subscriptions and can be nested. Policies and access assigned to a management group flow down to all contained subscriptions. This enables governance at scale.

What is Azure Resource Manager (ARM)?

• a.The deployment and management layer for creating and managing Azure resources✓
• b.A specialized storage tier designed for infrequently accessed archival data sets
• c.A low-level physical networking protocol
• d.A particular family of virtual machine sizes

Azure Resource Manager is the control plane that handles requests to create, update, and delete resources. All portal, CLI, and API calls go through ARM. It provides consistent management, access control, and tagging.

What is the main purpose of an ARM template (or Bicep file)?

• a.To store large volumes of unstructured blob data cheaply
• b.To assign user roles and permissions only
• c.To define infrastructure as code for repeatable deployments✓
• d.To continuously monitor the CPU and memory usage of running virtual machines

ARM templates and Bicep files declare infrastructure as code. They enable consistent, repeatable, and automated deployments. Because they are declarative, applying the same file yields the same result.

Choosing a larger VM size with more vCPUs and memory is an example of what?

• a.Reducing overall redundancy in the system
• b.Scaling out horizontally to more instances
• c.Geo-replication of stored data
• d.Scaling up vertically✓

Increasing a single machine's CPU and memory is vertical scaling, or scaling up. Adding more instances instead is scaling out. Both approaches are supported in Azure.

Which Azure feature automatically maintains and scales a group of identical load-balanced VMs?

• a.Azure Key Vault for secrets and certificates
• b.Virtual Machine Scale Sets✓
• c.Azure DNS name resolution service for hosting your public domains
• d.Azure Blob Storage for object data

Virtual Machine Scale Sets manage a group of identical VMs behind a load balancer. They can automatically scale the instance count based on demand. This supports large, elastic, highly available workloads.

In Azure App Service, what does the App Service plan define?

• a.The compute resources and pricing tier that host your app✓
• b.The redundancy level of your blob storage
• c.The operating system patch schedule for your VMs
• d.The DNS records and name-server settings for your organization's public domain

The App Service plan defines the underlying compute (size, tier, and instance count) that runs your apps. Multiple apps can share a plan. The chosen tier affects features, scale, and cost.

Azure Functions code typically runs in response to what?

• a.Events or triggers such as an HTTP request or new queue message✓
• b.The physical replacement of a failed disk
• c.A single fixed daily reboot of the underlying host operating system only
• d.Manual patching of servers by an administrator

Azure Functions is event-driven: code runs when a trigger fires, such as an HTTP request, timer, or queue message. You do not manage servers. Billing in the Consumption plan is based on executions and resources used.

Which scenario best fits Azure Container Instances?

• a.Orchestrating hundreds of interdependent microservices with complex scaling and self-healing
• b.Providing global DNS resolution for domains
• c.Hosting a full multi-node relational database cluster
• d.Running a short-lived container quickly without managing servers✓

Azure Container Instances runs containers on demand without provisioning VMs or orchestrators. It suits simple, short-lived, or bursty tasks. For complex orchestration, AKS is more appropriate.

What does Azure Kubernetes Service (AKS) primarily provide?

• a.A fully managed relational database engine based on SQL Server technology
• b.A managed secrets and certificate vault
• c.Managed orchestration of containerized workloads✓
• d.A global content delivery network for cached media

AKS is a managed Kubernetes service for orchestrating containers at scale. It automates cluster operations like scaling, upgrades, and self-healing. It is ideal for microservices architectures.

When you create a VNet, what must you define?

• a.A virtual machine operating system image
• b.A domain registrar account for the network
• c.A blob storage access tier such as hot, cool, or archive for objects
• d.A private IP address space (address range)✓

A virtual network requires a private IP address space, which you divide into subnets. Resources placed in the VNet receive addresses from these ranges. The VNet is the foundation for private networking in Azure.

Which Azure service provides secure RDP/SSH access to VMs in the portal without exposing public IP addresses?

• a.Azure Advisor
• b.Azure Bastion✓
• c.Azure DNS
• d.Azure Blob Storage

Azure Bastion gives secure browser-based RDP and SSH to VMs without assigning them public IPs. Connectivity happens over TLS within the portal. This reduces exposure to the public internet.

At what levels can a Network Security Group be associated?

• a.To a subnet or a network interface✓
• b.Only to an entire subscription and never to anything smaller than that
• c.To a single blob container
• d.Only to a management group at the top of the hierarchy

An NSG can be associated with a subnet or with a VM's network interface. Its rules allow or deny traffic by source, destination, port, and protocol. This controls network access at those levels.

A remote employee connects their laptop securely to Azure resources. Which VPN Gateway configuration fits?

• a.Site-to-site VPN between two fixed networks
• b.Point-to-site VPN✓
• c.A dedicated ExpressRoute private circuit provided through a connectivity partner
• d.Blob storage geo-replication

A point-to-site VPN connects an individual device to an Azure VNet over an encrypted tunnel. Site-to-site instead links whole networks. Point-to-site suits remote or mobile users.

Which is a defining characteristic of Azure ExpressRoute?

• a.It stores large amounts of unstructured object data
• b.It is a serverless event-driven compute option
• c.It always routes all of its traffic across the shared public internet backbone
• d.It provides a private connection that bypasses the public internet✓

ExpressRoute creates a private, dedicated connection between on-premises and Azure via a connectivity provider. Traffic does not traverse the public internet. This offers more consistent latency and higher reliability.

Azure DNS is used to host what?

• a.DNS records for your domain names✓
• b.Virtual machine operating-system disks and their attached data volumes
• c.Relational database tables
• d.Container images for deployment

Azure DNS hosts your domain's DNS records on Microsoft's global name-server network. It provides fast, reliable name resolution. You manage records with the same tools as other Azure resources.

At which network layer does Azure Load Balancer operate?

• a.Layer 1 (physical)
• b.Layer 2 (data link)
• c.Layer 4 (transport)✓
• d.Layer 7 (application)

Azure Load Balancer works at Layer 4, distributing TCP/UDP traffic across backend resources. For Layer 7 HTTP features like URL routing, Application Gateway is used. Layer 4 balancing is fast and protocol-agnostic.

Which capability is unique to Azure Application Gateway compared with a basic Layer 4 load balancer?

• a.It only forwards raw TCP packets blindly without any awareness of content
• b.It stores blob objects for websites
• c.URL-based routing and an optional Web Application Firewall✓
• d.It cannot inspect HTTP traffic at all

Application Gateway is a Layer 7 load balancer offering URL-based routing, SSL termination, and an optional WAF. These application-aware features go beyond Layer 4 balancing. It suits advanced HTTP/HTTPS scenarios.

Which blob access tier is optimized for data that is accessed frequently?

• a.Cold tier
• b.Archive tier
• c.Cool tier
• d.Hot tier✓

The hot tier is optimized for data accessed often, with the lowest access costs and higher storage cost. Cool and cold suit infrequently accessed data. Archive is the cheapest to store but slowest to retrieve.

Which access tier suits data that is infrequently accessed and stored for at least 30 days?

• a.Hot tier for active data
• b.Premium block blob tier
• c.Archive tier for rarely read data
• d.Cool tier✓

The cool tier targets infrequently accessed data kept for at least 30 days. It has lower storage cost but higher access cost than hot. Archive is for rarely accessed, long-retention data.

Which Azure managed disk type generally offers the highest performance for I/O-intensive workloads?

• a.Standard HDD for infrequent access
• b.Premium SSD✓
• c.Archive blob tier
• d.Cool blob tier

Premium SSD (and Ultra Disk) deliver high IOPS and low latency for demanding workloads. Standard HDD is cheaper but slower. Blob tiers are for object storage, not VM disks.

What problem does Azure Queue Storage help solve in an application architecture?

• a.Resolving domain names for the network
• b.Encrypting virtual machine operating-system disks and data disks at rest
• c.Decoupling components so they process work asynchronously✓
• d.Serving a public marketing website directly to users

Queue Storage holds messages that components add and retrieve asynchronously. This decouples producers from consumers so each can scale independently. It improves resilience and smooths load spikes.

Azure Table Storage is best described as what?

• a.A fully relational SQL database that supports complex joins and transactions
• b.A global content delivery network for caching media
• c.A NoSQL key-value store for structured, non-relational data✓
• d.A registry for storing container images

Azure Table Storage is a NoSQL key-value store for large amounts of structured, non-relational data. It scales cheaply for simple lookups. It does not support relational joins like a SQL database.

Which redundancy option combines zone redundancy in the primary region with replication to a secondary region?

• a.LRS, which stays within one datacenter
• b.ZRS, which stays within one region
• c.Premium solid-state disks provisioned for high-throughput database workloads
• d.GZRS (geo-zone-redundant storage)✓

GZRS writes data across availability zones in the primary region and also replicates to a secondary region. It combines zone and geo resilience. This provides very high durability and availability.

What does read-access geo-redundant storage (RA-GRS) add over standard GRS?

• a.Read access to the data in the secondary region✓
• b.Nothing at all, because the two options are completely identical in every way
• c.It automatically deletes older data to save space
• d.It removes the secondary copy of the data entirely

RA-GRS adds the ability to read from the secondary region even when the primary is available. Standard GRS keeps a secondary copy but normally does not allow reads from it unless a failover occurs. RA-GRS improves read availability.

Which is TRUE of Azure SQL Database as a PaaS offering?

• a.You must patch the guest operating system yourself
• b.It is only ever available as an on-premises installation inside your datacenter
• c.You manage the underlying physical servers directly
• d.Microsoft manages patching, backups, and high availability✓

Azure SQL Database is a fully managed PaaS relational database. Microsoft handles patching, backups, and high availability. You focus on the database schema, data, and queries.

Which capability is a hallmark of Azure Cosmos DB?

• a.It cannot scale its throughput up or down
• b.It exclusively supports the traditional Microsoft SQL Server relational engine
• c.Turnkey global distribution with low-latency reads and writes✓
• d.It runs only in a single region at a time

Cosmos DB offers turnkey global distribution with low-latency access and elastic scale. It supports multiple data models and APIs. This makes it ideal for globally responsive applications.