Azure Fundamentals (AZ-900) — All Questions

What do Azure Monitor 'insights' (such as VM insights or Container insights) provide?

• a.A convenient built-in way to bypass user authentication for administrators
• b.Automatic price reductions for those resources
• c.Physical relocation of the resources
• d.Curated, ready-made monitoring experiences for specific resource types✓

Insights are pre-built monitoring solutions tuned to particular services, offering relevant dashboards and health views out of the box. They save you from assembling common monitoring from scratch.

What does Metrics Explorer in Azure Monitor let you do?

• a.Chart and analyze metric data over time interactively✓
• b.The ability to assign RBAC roles directly to application users
• c.Create blob storage containers
• d.Deploy new virtual machines

Metrics Explorer is the tool for plotting and slicing metric time-series, applying filters and splitting by dimensions. It is the go-to place to investigate performance trends.

What can Application Insights availability tests do?

• a.Regularly send requests to your web app from multiple locations to check its uptime and responsiveness✓
• b.Reduce the app's licensing cost
• c.Automatically encrypting the application's entire source code repository while it is stored at rest in the cloud
• d.Assign roles to application users

Availability tests probe your endpoint from various global points and alert you if it becomes slow or unreachable. This provides early warning of outages before users report them.

What does the Azure Activity Log record?

• a.The current hourly list price of each individual Azure service being used across the region today
• b.The contents of files stored in blob storage
• c.Subscription-level control-plane events, such as who created, modified, or deleted a resource✓
• d.The keystrokes typed inside a virtual machine

The Activity Log captures management operations against resources, providing an audit trail of what changed, when, and by whom. It is distinct from resource-level diagnostic logs that capture data-plane activity.

What is an important reason to assign a severity level to an Azure Monitor alert?

• a.To change how much the alert costs to store
• b.To decide which region the alert runs in
• c.To indicate the importance and urgency of the alert so teams can prioritize✓
• d.To encrypt the alert's notification message contents before they are delivered

Alert severity (from critical down to informational) helps operations teams triage and respond to the most urgent issues first. Consistent severities make on-call response more effective.

What is the Azure portal?

• a.A physical device shipped to your datacenter
• b.A command-line tool installed on a local computer
• c.A fully managed relational database engine and query service for hosting applications at scale
• d.A web-based graphical interface, accessed in a browser, for managing Azure resources✓

The Azure portal is the browser-based console where you can create, configure, and monitor resources visually. It suits interactive management and learning, complementing scripting tools.

What is the Azure CLI?

• a.A graphical dashboard for viewing metrics
• b.A global content delivery network for caching static files at edge locations
• c.A managed relational database
• d.A cross-platform command-line tool that uses commands beginning with 'az'✓

The Azure CLI lets you manage Azure from a terminal on Windows, macOS, or Linux using 'az' commands. It is well suited to automation and scripting of repeatable tasks.

How does Azure PowerShell manage Azure resources?

• a.By editing the physical server BIOS
• b.Through cmdlets provided by the Az module✓
• c.By sending emails to Microsoft support
• d.Through a graphical drag-and-drop designer only

Azure PowerShell uses cmdlets in the Az module to script and automate resource management. It appeals to teams already comfortable with PowerShell on Windows and beyond.

What is Azure Cloud Shell?

• a.A physical terminal located in an Azure datacenter
• b.A browser-based shell, offering Bash or PowerShell, that is authenticated and ready inside the portal✓
• c.A tool that only runs on Windows desktops
• d.A fully managed relational database service that automatically stores and queries structured data for you

Cloud Shell gives you a preconfigured command-line environment in the browser with the Azure tools already installed and signed in. It removes the need to install and update tooling locally.

What is a key benefit of using Azure Cloud Shell?

• a.No local installation is needed because the tools are preinstalled and kept up to date✓
• b.It permanently stores files without any storage account
• c.It only works while you are completely offline and disconnected from the internet entirely
• d.It runs without any Azure authentication

Cloud Shell comes with the CLI, PowerShell, and common tools ready to use, so you avoid local setup and maintenance. You can manage Azure from virtually any device with a browser.

ARM templates are authored in which format?

• a.Declarative JSON files✓
• b.Compiled binary executables
• c.Spreadsheet workbooks
• d.Plain-text email messages

ARM templates use JSON to declaratively describe the resources to deploy and their configuration. Storing infrastructure as these files enables repeatable, version-controlled deployments.

What is Bicep?

• a.A managed network load balancer that distributes incoming traffic across many backend resources automatically
• b.A managed NoSQL database
• c.A monitoring agent installed on virtual machines
• d.A domain-specific language that simplifies authoring infrastructure as code, transpiling to ARM JSON✓

Bicep offers a cleaner, more readable syntax than raw ARM JSON and compiles down to the same ARM templates. It makes infrastructure-as-code easier to write and maintain on Azure.

What does 'infrastructure as code' (IaC) mean?

• a.Writing application business logic in a database
• b.Manually clicking through the portal for each deployment
• c.Defining infrastructure in declarative files so deployments are repeatable and consistent✓
• d.Storing plaintext passwords and secrets directly inside the application's source code files

IaC captures the desired infrastructure in code (such as ARM or Bicep) that can be versioned, reviewed, and redeployed reliably. This reduces configuration drift and manual error.

ARM and Bicep templates are 'declarative,' meaning you specify what?

• a.The marketing copy for the application
• b.Each individual command in the exact order to run
• c.The desired end state of the infrastructure, not the step-by-step commands to build it✓
• d.The exact physical wiring and network cabling installed inside the datacenter facility racks

Declarative templates describe the target configuration, and Azure figures out how to reach it. This differs from imperative scripting, where you list each action explicitly.

What is true about both the Azure CLI and Azure PowerShell?

• a.They can perform the same management tasks, so the choice is largely preference and platform✓
• b.They can only be used inside the portal
• c.Neither can be used in automation scripts
• d.Only one of the two tools is actually able to create and manage resources across Azure services

Both tools expose the full breadth of Azure management, so teams pick based on familiarity and existing scripts. Each can be scripted for automation across platforms.

What does the Azure mobile app let you do?

• a.Running large-scale data-warehouse analytical queries across regions
• b.Replace the need for Azure Resource Manager
• c.Monitor and manage your Azure resources from a phone or tablet✓
• d.Physically install hardware in the datacenter

The Azure mobile app provides on-the-go access to check resource health, view alerts, and perform basic management. It is handy for responding to issues away from a desk.

What can you customize in the Azure portal to speed up your work?

• a.The global pricing of Azure services
• b.The underlying hardware of virtual machines
• c.Dashboards and a list of favorite services✓
• d.The physical location of Azure datacenters

You can build custom dashboards and mark frequently used services as favorites for quick navigation. Personalizing the portal makes routine management faster.

What does Azure Cloud Shell require in order to persist your files between sessions?

• a.An associated Azure Files share (backed by a storage account)✓
• b.A dedicated physical hard drive at your desk
• c.A public IP address assigned to your laptop
• d.A separate, paid Azure support plan and premium subscription add-on

Cloud Shell mounts an Azure Files share so your scripts and files survive across sessions. Without it, the environment would be ephemeral each time you connect.

You want to run the command 'az group create'. Which tool are you using?

• a.The Azure CLI✓
• b.Azure PowerShell
• c.Azure Monitor
• d.The Azure portal

Commands that start with 'az' belong to the Azure CLI. Azure PowerShell instead uses verb-noun cmdlets such as New-AzResourceGroup.

Redeploying the same ARM or Bicep template is described as idempotent. What does that mean?

• a.It produces the same end result without creating duplicate resources✓
• b.It can only ever be run a single time before it must be fully recreated
• c.It doubles the resources with each deployment
• d.It deletes everything and starts over each time

Idempotent deployments converge to the declared state, so running the template again does not create duplicates or unexpected changes. This makes redeployment safe and predictable.

Besides the portal, CLI, and PowerShell, how else can Azure be managed programmatically?

• a.Only by editing the datacenter hardware directly
• b.There is no other way to manage Azure
• c.Through REST APIs and language-specific SDKs✓
• d.Only by mailing a request form to Microsoft

Developers can call Azure's REST APIs directly or use SDKs for languages like Python, .NET, and Java. All of these ultimately route through Azure Resource Manager.

What is a benefit of using ARM or Bicep templates instead of clicking through the portal for deployments?

• a.Consistent, repeatable, and version-controlled deployments✓
• b.A firm guarantee that the resources will always cost nothing
• c.The inability to review changes before applying them
• d.Slower deployments that require more manual steps

Templates let you standardize environments, track changes in source control, and redeploy reliably. This is far more consistent than manual portal configuration for anything beyond a one-off.

When you use the portal, CLI, or PowerShell to make a change, the request ultimately goes through what?

• a.A single virtual machine you own
• b.Azure Resource Manager✓
• c.The Azure Pricing Calculator
• d.A Network Security Group

All management tools funnel their requests through Azure Resource Manager, which enforces authentication, authorization, and consistent handling. This is why behavior is uniform regardless of the tool you choose.

What does Azure Arc allow you to do?

• a.Physically ship Azure servers to your office
• b.Extend Azure management and governance to on-premises and other clouds' resources✓
• c.A firm guarantee that every workload you deploy will always run completely for free
• d.Replace the need for identity management

Azure Arc projects Azure's management plane onto servers, Kubernetes clusters, and services running outside Azure. This lets you apply policy, tagging, and monitoring consistently across hybrid and multi-cloud estates.

An Azure service-level agreement of 99.9% uptime permits roughly how much downtime per month?

• a.About 43 minutes✓
• b.About 3 days
• c.About 4 hours
• d.Zero minutes, since 99.9% means no downtime

A 99.9% monthly SLA allows roughly 43 minutes of downtime, while 99.99% allows only about 4 minutes. Understanding these figures helps set realistic availability expectations.

When you combine several Azure services in a single application, what typically happens to the overall (composite) SLA?

• a.It increases with each additional service
• b.It always stays fixed at exactly 100% no matter how many services are added
• c.It generally decreases as more services are chained together✓
• d.It becomes irrelevant once services are combined

Because each dependent service can independently fail, chaining them multiplies their individual SLAs, lowering the composite figure. Architects add redundancy to offset this effect.

If Azure fails to meet a service's SLA, what may a customer be entitled to receive?

• a.A full refund of all past invoices automatically
• b.Service credits applied to their bill✓
• c.Guaranteed prevention of all future outages
• d.Free physical servers

SLAs are financially backed by service credits, which compensate customers when uptime commitments are missed. Credits typically must be requested and scale with the shortfall.

What is generally true about Azure services that are still in preview?

• a.They always carry a stronger SLA than released services
• b.They are typically not covered by a service-level agreement✓
• c.They are only available to Microsoft employees
• d.They are firmly guaranteed to never change at all before their release

Preview features are provided for evaluation and usually lack SLA guarantees and full support. They may change or be removed before reaching general availability.

What does 'general availability' (GA) mean for an Azure service?

• a.It is a signal that the service will very soon be deprecated and retired from Azure entirely
• b.The service is available only to a small invited group
• c.The service is fully released, supported for production use, and backed by an SLA✓
• d.The service is free of charge forever

GA marks a service as production-ready with full support and SLA coverage. Organizations generally wait for GA before running critical workloads on a feature.

What characterizes an Azure feature that is in private preview?

• a.It carries the very highest availability SLA of any released Azure service
• b.It is available to a limited, invited set of customers for early testing✓
• c.It is open to every Azure customer without restriction
• d.It is fully supported for production workloads

Private preview limits access to selected customers who provide feedback before wider release. Such features are experimental and not intended for production.

What characterizes an Azure feature that is in public preview?

• a.It can never be changed or updated in any way before it finally reaches its release date
• b.It is open for any customer to try but is not recommended for production workloads✓
• c.It carries the same SLA as a GA service
• d.It is restricted to a handful of invited testers

Public preview lets all customers evaluate a feature, but without full SLA or support, so it is unsuitable for production. Feedback during this stage shapes the final release.

To increase the effective availability of a virtual machine workload, what can you do?

• a.Deleting all of the workload's backups in order to save on storage costs
• b.Remove all monitoring to lower overhead
• c.Deploy it across availability zones or run multiple instances✓
• d.Reduce it to a single instance in one datacenter

Spreading instances across availability zones or using multiple VMs raises the composite availability above a single instance's SLA. Redundancy is the primary way to exceed a single component's guarantee.

An Azure SLA provides a financially backed uptime commitment, but what does it NOT guarantee?

• a.That outages will never occur✓
• b.That credits are available if targets are missed
• c.That the commitment is measured over time
• d.That a defined uptime percentage is targeted

An SLA promises a target and compensation if it is missed, not that failures will never happen. Designing for resilience remains the customer's responsibility.

Achieving a higher overall availability than a single Azure service's SLA usually requires what?

• a.Applying more tags to the resource
• b.Turning off all diagnostic and activity logging on the resource
• c.Using a smaller virtual machine size
• d.Building redundancy across availability zones or regions✓

You raise availability by removing single points of failure through redundancy across zones or regions. This architectural effort, not configuration tweaks, drives higher composite SLAs.

How does Microsoft typically communicate that an Azure service or feature will be retired?

• a.By deleting it without any warning
• b.By changing the portal's color scheme
• c.Through advance notifications and published announcements✓
• d.Only quietly through the customer's regular monthly invoice

Microsoft provides advance notice of deprecations and retirements so customers can plan migrations. Staying aware of these announcements is part of managing the service lifecycle.

What should you expect from features that are in preview?

• a.They may change or be removed before reaching general availability✓
• b.They are permanently locked and can never be altered or updated again
• c.They are supported for mission-critical production use
• d.They always have a higher SLA than GA features

Preview features are still evolving, so their behavior, APIs, or availability can change before GA. This is why they are not recommended for production workloads.

What does a higher SLA percentage, such as 99.99% compared with 99.9%, indicate?

• a.More allowed downtime and lower availability
• b.That the service is still in private preview
• c.Less allowed downtime and therefore higher availability✓
• d.An automatically lower monthly subscription cost overall

Each additional nine reduces the permitted downtime substantially, so 99.99% is stricter than 99.9%. Higher targets usually demand more redundant, and costlier, designs.

Designing an architecture to achieve very high availability usually comes with what trade-off?

• a.Guaranteed lower cost than a single instance
• b.A reduction in the number of nines in the SLA
• c.Higher cost and greater complexity✓
• d.Complete elimination of all monitoring needs

Redundancy across zones or regions increases resource count and design complexity, which raises cost. Teams balance the value of extra availability against this added expense.

A single-instance Azure virtual machine using premium SSD disks is offered with an SLA of approximately what?

• a.About 99.9% availability✓
• b.About 50% availability
• c.Exactly 100% availability with no downtime
• d.No SLA at all under any configuration

A single VM with premium storage carries roughly a 99.9% SLA, whereas spreading VMs across availability zones raises the guarantee. The storage type and deployment topology both influence the committed figure.

You need daily Azure cost data delivered automatically to a storage account for external analysis. What should you configure?

• a.A ReadOnly role assignment placed on the subscription's monthly invoice records
• b.A scheduled export in Microsoft Cost Management✓
• c.A resource lock that freezes all further charges on the billing account permanently
• d.A Network Security Group rule that forwards the billing data outward to storage

Cost Management supports scheduled exports that push cost and usage data to a storage account on a recurring basis. This enables downstream reporting and integration with external analytics tools.

Which Microsoft Entra ID feature governs the ways users can prove their identity, such as the Authenticator app or a FIDO2 key?

• a.Authentication methods✓
• b.A network firewall that inspects all sign-in traffic before it reaches the directory
• c.A collection of resource locks that stop users from changing their own passwords
• d.A billing feature that charges the tenant a small fee per successful sign-in event

Authentication methods define how users verify identity, including passwords, the Authenticator app, FIDO2 keys, and Windows Hello. Administrators enable and manage these methods to support MFA and passwordless sign-in.

You want an alert to automatically trigger a webhook or Logic App when it fires. What must the alert reference?

• a.A Log Analytics workspace that permanently stores the notification templates used
• b.A resource lock configured to prevent the alert from ever being modified again
• c.A budget threshold defined in Microsoft Cost Management for the whole subscription
• d.An action group✓

An action group is the reusable set of notifications and automated actions (email, SMS, webhook, Logic App, function) that an alert invokes when it fires. Referencing one lets alerts drive automated responses.

Your organization must ensure new storage accounts are always created with a required 'CostCenter' tag. Which tool enforces this at creation time?

• a.An Azure Advisor recommendation that periodically suggests adding the missing tag
• b.Azure Policy✓
• c.A CanNotDelete resource lock applied automatically to each new storage account created
• d.A custom RBAC role that grants tagging permissions to every user across the tenant

Azure Policy can require a specific tag at deployment, denying non-compliant creations or appending the tag automatically. RBAC controls who can act, and Advisor only recommends, so neither enforces configuration standards.