Azure Fundamentals (AZ-900) — All Questions

Why might an enterprise choose ExpressRoute over a site-to-site VPN?

• a.It runs entirely over the shared public internet
• b.It offers more predictable latency and higher reliability over a private link✓
• c.It requires no connectivity provider at all
• d.It is always the cheapest possible connectivity option in every single scenario

ExpressRoute uses a private connection with more predictable latency and higher reliability than an internet VPN. It suits mission-critical or high-bandwidth hybrid workloads. It does require a connectivity provider and typically costs more.

Azure Storage accounts come in performance tiers named…

• a.Fast and Slow
• b.Bronze and Gold
• c.Hot and Cold
• d.Standard and Premium✓

Storage account performance comes in Standard and Premium tiers. Premium uses SSDs for low latency and high throughput. Standard is cost-effective for general-purpose data.

Which Cosmos DB option automatically scales throughput within a range based on usage?

• a.Autoscale (autoscale throughput)✓
• b.Only fixed, manually provisioned throughput that never changes automatically at all
• c.No scaling of any kind is possible
• d.DNS-based scaling of the database

Cosmos DB autoscale adjusts provisioned throughput automatically within a set maximum range. It handles variable workloads without manual tuning. You pay for the throughput actually used within that range.

Do Azure resources automatically inherit tags from their resource group?

• a.Tags cannot exist on individual resources
• b.No, tags are not inherited by default, though policy can add them✓
• c.Only blob objects inherit tags automatically
• d.Yes, every resource always automatically inherits every tag from its resource group

Resources do not inherit resource group tags by default. Azure Policy can enforce or append tags to achieve consistency. Tags support cost tracking and organization.

By default, resources in a VNet use which DNS unless you configure custom servers?

• a.No DNS resolution at all
• b.Only their own local host file with statically defined name-to-address mappings
• c.A random public resolver chosen each time
• d.Azure-provided DNS✓

By default, VNet resources use Azure-provided DNS for name resolution. You can configure custom DNS servers or Private DNS zones if needed. This default handles basic resolution automatically.

Azure App Service lets you add a custom domain and secure it with…

• a.a blob storage container
• b.no security controls at all
• c.only manually generated self-signed certificates that browsers do not trust
• d.a TLS/SSL certificate✓

App Service supports custom domains secured with TLS/SSL certificates, including managed certificates. This enables HTTPS on your own domain name. It protects traffic between users and the app.

Which storage service would you use to store large media files served to a website?

• a.Azure Blob Storage✓
• b.Azure Table Storage for key-value data
• c.Azure Queue Storage for messages
• d.Azure SQL Database for relational data

Blob Storage is designed for large unstructured objects like images and video. It integrates with CDN for fast delivery. It is the natural choice for website media assets.

Virtual Machine Scale Sets can automatically add or remove VM instances based on…

• a.nothing at all, because the number of instances always remains completely fixed
• b.only the current time zone name of the region
• c.the color assigned to the virtual machine
• d.metrics such as CPU usage or a defined schedule✓

Scale sets autoscale by adding or removing instances based on metrics like CPU or on a schedule. This matches capacity to demand automatically. It supports elastic, highly available workloads.

Virtual Network service endpoints allow…

• a.faster DNS resolution only
• b.the automatic deletion of a virtual network
• c.a subnet to reach specific Azure services over the backbone✓
• d.the full public internet exposure of every single resource in the subscription

Service endpoints extend a subnet's identity to selected Azure services over the Microsoft backbone. This keeps traffic off the public internet and can restrict service access to the VNet. It improves security for PaaS connectivity.

Which pairing correctly matches the database to its type?

• a.Azure SQL Database is a NoSQL store while Azure Cosmos DB is a relational engine
• b.Both Azure SQL Database and Cosmos DB are container registries
• c.Azure SQL Database is relational; Azure Cosmos DB is NoSQL✓
• d.Both Azure SQL Database and Cosmos DB are file shares

Azure SQL Database is a relational (SQL) database, while Cosmos DB is a globally distributed NoSQL database. Choosing between them depends on data model and scale needs. Matching workloads to the right type is a key skill.

Which factor most directly increases the monthly cost of an Azure virtual machine?

• a.The number of tags applied to the resource
• b.The VM size (its number of vCPUs and amount of memory)✓
• c.The number of descriptive metadata tags and key-value labels attached to the resource
• d.The color theme selected in the Azure portal

Compute cost scales with the VM size you select, because larger SKUs allocate more vCPUs and memory. Tags, names, and portal themes are metadata or cosmetic and have no effect on price.

How is network bandwidth generally billed in Azure?

• a.Outbound data transfer leaving Azure is typically charged, while most inbound data is free✓
• b.All inbound and outbound data transfer is billed at the same flat rate
• c.Network bandwidth is always included at no cost in every service
• d.Only the inbound data transferred into the Azure datacenter is metered and billed to the customer

Azure generally charges for egress (data flowing out of its datacenters) while ingress is usually free. This is why moving large volumes of data out of a region is a common, sometimes overlooked, cost driver.

Why might the exact same virtual machine size cost a different amount in two different Azure regions?

• a.Regions located farther from the equator always charge a premium because of higher cooling demands
• b.Pricing varies by region because the cost to operate each datacenter differs✓
• c.Region has no effect on price; all regions charge identical rates
• d.Only the primary region can host virtual machines at full price

Azure prices services per region, reflecting differences in local energy, land, labor, and taxes. Choosing a lower-cost region for latency-tolerant workloads is a legitimate optimization technique.

Azure Reservations require the customer to make what kind of commitment in exchange for a discount?

• a.A commitment to never resize the reserved resource
• b.A month-to-month commitment that can be canceled anytime for free
• c.A one-year or three-year commitment to a specific resource✓
• d.A commitment to keep the resource in a single availability zone

Reservations trade a 1-year or 3-year usage commitment for pricing well below pay-as-you-go. They fit steady, predictable workloads because you are effectively pre-paying for capacity you know you will use.

What does the Azure Hybrid Benefit allow an organization to do?

• a.Run Azure services for free for the first three years of a subscription
• b.Combine two separate Azure regions into a single shared billing zone with one blended rate
• c.Reuse existing on-premises Windows Server or SQL Server licenses with Software Assurance to lower Azure costs✓
• d.Automatically move on-premises servers into Azure without any migration tools

Azure Hybrid Benefit lets you apply eligible licenses you already own to Azure workloads, avoiding paying again for the software portion. It can be combined with Reservations for even deeper savings.

What can happen to an Azure Spot Virtual Machine when Azure needs the underlying capacity back?

• a.It is automatically upgraded to a reserved instance at no charge
• b.It continues running with a guaranteed service-level agreement
• c.It is migrated live to another region with guaranteed uptime
• d.It can be evicted (deallocated) with little notice✓

Spot VMs use Azure's surplus capacity at steep discounts, but Azure can reclaim that capacity at any time by evicting the VM. They are therefore appropriate only for interruptible, fault-tolerant work.

Azure Dev/Test pricing offers what advantage to eligible subscriptions?

• a.The automatic promotion and conversion of finished dev/test environments straight into production
• b.Guaranteed higher performance than standard subscriptions
• c.Reduced rates on certain services for non-production development and testing workloads✓
• d.A permanently free production environment for any workload

Dev/Test offers discounted rates on select services for teams building and testing, provided the resources are not used in production. It helps lower the cost of non-critical environments.

A budget alert in Microsoft Cost Management notifies stakeholders based on what?

• a.The number of resources deployed regardless of their cost
• b.Whether a resource has been assigned the correct tags
• c.The ambient physical temperature reported by sensors inside the datacenter facility
• d.Actual or forecasted spending crossing a defined threshold✓

Budgets track spend for a chosen scope and fire alerts when actual or forecasted costs approach the limit you set. This gives teams advance warning before overspending occurs.

Which action is an example of 'right-sizing' to reduce Azure costs?

• a.Moving every workload to the most expensive region
• b.Permanently deleting all diagnostic and activity logs in order to free up storage space
• c.Adding more tags to each resource to trigger discounts
• d.Resizing a consistently underutilized virtual machine to a smaller SKU✓

Right-sizing matches a resource's capacity to its real demand, so an over-provisioned VM is scaled down to a cheaper SKU. Azure Advisor frequently surfaces right-sizing opportunities.

What is the billing effect of stopping (deallocating) an Azure virtual machine?

• a.All storage and networking charges are eliminated immediately
• b.You are charged the same as when the VM is running
• c.The virtual machine is permanently deleted along with all of its attached data disks
• d.You stop paying for its compute while deallocated, though you still pay for attached disks✓

Deallocating releases the compute resources so you no longer pay for vCPU/memory time, but persistent disks and reserved IPs still incur charges. Fully stopped-deallocated is different from merely shutting down the guest OS.

How does autoscaling help control cost?

• a.It removes capacity when demand falls, so you avoid paying for idle resources✓
• b.It disables resource monitoring so that fewer metrics are collected and billed each month
• c.It applies a flat discount to every resource in the subscription
• d.It permanently locks capacity at the maximum size to avoid outages

Autoscaling adds instances during spikes and removes them when load drops, aligning spend with real demand. Paying only for what you actively use is a core cloud cost principle.

Moving rarely accessed blob data to the cool or archive access tier has what effect?

• a.It increases the redundancy to geo-redundant automatically
• b.It speeds up frequent read operations on that data
• c.It lowers storage cost for infrequently accessed data✓
• d.It converts the data into a relational database

Cooler tiers charge less for storage in exchange for higher access costs and, for archive, retrieval latency. Placing seldom-read data in the right tier is a simple, effective saving.

You want to estimate the monthly price of a new architecture before you deploy anything. Which tool should you use?

• a.Microsoft Defender for Cloud
• b.The Total Cost of Ownership (TCO) Calculator
• c.The Azure Pricing Calculator✓
• d.Azure Service Health

The Pricing Calculator models the cost of a configuration you plan to build in Azure. The TCO Calculator, by contrast, compares existing on-premises costs against Azure.

Your finance team wants to compare the cost of your current on-premises datacenter against running the same workloads in Azure. Which tool fits best?

• a.The Total Cost of Ownership (TCO) Calculator tool for migrations
• b.The Total Cost of Ownership (TCO) Calculator✓
• c.The Azure Pricing Calculator
• d.Azure Monitor

The TCO Calculator estimates the savings of migrating existing infrastructure to Azure, factoring in hardware, power, and staffing. It is aimed at building the business case for migration.

Which of the following is a genuine factor that affects the cost of an Azure service?

• a.The type of resource and the settings you choose for it✓
• b.The web browser used to access the portal
• c.How many users are viewing the Azure portal
• d.The number of characters in the resource's display name

Cost depends on the resource type, its configuration (size, tier, redundancy), and its region. Cosmetic factors like names or the browser used have no bearing on billing.

At which scopes can you analyze spending in Microsoft Cost Management?

• a.Management group, subscription, and resource group✓
• b.Only at the scope of one individual resource at a time
• c.Only for resources tagged as production
• d.Only across the entire Azure global cloud

Cost Management lets you view and filter costs at management group, subscription, and resource-group scopes. This flexibility supports both organization-wide and team-level financial visibility.

What does a 'free tier' offered by some Azure services provide?

• a.Unlimited use of the service forever at no charge
• b.A discount that applies to every other Azure service
• c.A limited amount of the service that you can use at no charge✓
• d.Brand-new physical server hardware shipped directly to your office

Many services include a free tier or free monthly allotment up to a defined limit, after which normal charges apply. It lets you evaluate or run small workloads without cost.

What does consumption-based (metered) billing mean in Azure?

• a.You are billed only once per year with no usage tracking
• b.You pay a single fixed fee regardless of how much you use
• c.You must purchase and rack physical server hardware before using any of the service
• d.You are charged per unit of usage, such as per GB stored or per compute hour✓

Metered billing charges for the actual quantity of a resource consumed, like gigabytes or vCPU-hours. This pay-for-what-you-use model is central to cloud economics.

Azure Reservations deliver the best value for which kind of workload?

• a.Workloads that can tolerate being evicted from their capacity at any moment
• b.Experimental workloads whose usage is completely unknown
• c.Short-lived batch jobs that run for only a few minutes
• d.Steady-state, predictable workloads that run consistently✓

Because a reservation is a 1- or 3-year commitment, it pays off when a resource runs consistently over that period. Unpredictable or interruptible workloads are better served by pay-as-you-go or Spot.

A cost alert in Microsoft Cost Management is primarily used to do what?

• a.Encrypt all of the subscription's billing data for regulatory compliance
• b.Notify the right people when spending reaches a defined threshold✓
• c.Increase the resource limits of the subscription
• d.Automatically shut down every resource in the subscription

Cost alerts watch spend against budgets or thresholds and send notifications so teams can react before overspending. They are informational triggers, not automatic resource controls.

To attribute cloud spend to a specific project for internal chargeback, what is the recommended approach?

• a.Assign each project its own physical datacenter
• b.Apply a consistent tag to the project's resources and filter cost analysis by that tag✓
• c.Provision a separate, dedicated Azure region exclusively for each individual project
• d.Rename every resource to include the project name in the resource ID

Consistent tagging lets Cost Management group and report spend by project, department, or environment. Filtering cost analysis on the tag produces accurate chargeback or showback figures.

An Azure savings plan for compute provides a discount in exchange for what commitment?

• a.Committing to never scale the workload up or down
• b.Committing to a fixed hourly spend on compute for a one- or three-year term✓
• c.Committing to use only a single availability zone
• d.Committing to delete all existing pay-as-you-go resources before the discount applies

A savings plan discounts compute usage up to a chosen hourly dollar commitment over 1 or 3 years, offering more flexibility than a reservation tied to a specific SKU. Usage above the commitment is billed at pay-as-you-go rates.

How is data transfer between two different Azure regions generally treated for billing?

• a.It is always free regardless of volume
• b.It is billed only if the regions are in different continents at a premium rate only
• c.It is charged the same as data written to local disk
• d.It is typically charged as inter-region (egress) bandwidth✓

Moving data across regions incurs egress bandwidth charges, unlike much traffic that stays within a region. Architects weigh this when deciding where to replicate or process data.

Which products can benefit from Azure Hybrid Benefit licensing savings?

• a.Only open-source database engines running inside Linux containers
• b.Only services that have no on-premises equivalent
• c.Windows Server and SQL Server (and certain Linux subscriptions)✓
• d.Any third-party software installed on a virtual machine

Azure Hybrid Benefit applies to eligible Windows Server and SQL Server licenses with Software Assurance, plus some Linux subscriptions. It reduces the software portion of the cost for those specific products.

Why are Azure Spot Virtual Machines offered at a large discount?

• a.They run on Azure's spare, unused capacity that can be reclaimed when needed✓
• b.They come with a stronger uptime guarantee than standard VMs
• c.They store data on slower disks that never change price
• d.They are permanently limited to only the very smallest available virtual machine sizes

Spot pricing monetizes idle capacity, so the discount reflects the risk that Azure may evict the VM to serve paying, on-demand customers. That trade-off makes Spot ideal for interruptible workloads.

A common, often-overlooked source of unnecessary Azure spend is which of the following?

• a.Applying additional descriptive tags and labels to every resource in the subscription
• b.Following Azure Advisor cost recommendations
• c.Over-provisioned or idle resources that continue to run without being used✓
• d.Reviewing the cost analysis dashboard regularly

Idle VMs, oversized SKUs, and orphaned disks keep billing while delivering no value. Regularly identifying and removing or resizing them is a primary optimization activity.

Azure Advisor's cost recommendations might suggest which of the following?

• a.Turning off all security monitoring to save money
• b.Buying reservations or resizing and shutting down underused virtual machines✓
• c.Moving all data to the most expensive storage tier
• d.Deleting your entire production subscription and all of the resources it contains

Advisor analyzes usage and recommends actions such as purchasing reservations or right-sizing idle VMs to cut cost. Its guidance is tailored to your actual resource utilization.

What is the role of an Azure billing account?

• a.It securely stores the encryption keys and certificates for all resources
• b.It defines which regions a subscription may deploy to
• c.It hosts the virtual machines used for billing calculations
• d.It manages invoices and payment for one or more subscriptions✓

A billing account is the top-level construct for managing invoices, payment methods, and the subscriptions grouped under it. It separates financial administration from technical resource management.

What does the cost forecast feature in Microsoft Cost Management help you do?

• a.Automatically purchase reservations on your behalf
• b.Guarantee that costs will never exceed a set amount
• c.Predict likely future spending based on historical usage patterns✓
• d.Encrypt and archive historical billing records for long-term retention

Forecasting projects future costs from past trends so teams can plan budgets and spot looming overruns. It is a planning aid, not an automatic spending control.

What is the scope flexibility of an Azure Reservation?

• a.It is limited to resources created after the reservation is purchased
• b.It can only ever be applied to one individual virtual machine at a time within the subscription
• c.It must be applied to every region simultaneously
• d.It can apply to a single subscription or be shared across all subscriptions in the billing account✓

Reservation scope can be set to a specific subscription or shared, letting the discount apply wherever matching usage occurs. Shared scope maximizes utilization of the commitment across an organization.

What is an Azure Policy initiative (also called a policy set)?

• a.A tool that encrypts resources that violate policy
• b.A group of related policy definitions managed and assigned together as a single unit✓
• c.A billing report that itemizes the monthly cost of every policy assignment you have made
• d.A single policy that can only ever contain one rule

An initiative bundles multiple policy definitions so you can assign and track them as one, with a unified compliance view. This simplifies enforcing a whole standard, such as a security baseline.

Which Azure Policy effect blocks a non-compliant resource from being created or updated?

• a.Append
• b.Deny✓
• c.Disabled
• d.Audit

The Deny effect stops a deployment that would violate the policy from ever succeeding. Audit only records non-compliance, while Append and Modify adjust the resource instead of blocking it.

Which Azure Policy effect records non-compliant resources without preventing their deployment?

• a.Audit✓
• b.Encrypt
• c.Delete
• d.Deny

The Audit effect logs a compliance warning but still allows the resource to be created. It is useful for measuring compliance before you enforce a stricter Deny.

What is the purpose of an Azure Policy exemption?

• a.To increase the compliance score artificially for all resources
• b.To exclude a specific resource or scope from evaluation of a policy or initiative✓
• c.To automatically and permanently delete any resource that is found to be non-compliant
• d.To grant a user administrative access to a subscription

An exemption formally excuses a resource or scope from a policy assignment, often for a documented business reason. It keeps compliance reporting honest by marking the exclusion rather than hiding it.

If you apply a CanNotDelete lock at the resource group level, what happens to the resources inside that group?

• a.The lock applies only to the resource group's name, not its contents
• b.They are immediately deleted to enforce the lock
• c.Only resources created after the lock are affected
• d.They inherit the lock and cannot be deleted until it is removed✓

Locks applied at a parent scope are inherited by child resources, so a CanNotDelete lock on a group protects every resource within it. The lock must be removed before those resources can be deleted.

A ReadOnly resource lock permits which operations on the locked resource?

• a.Deleting the resource, but without being able to read any of its properties
• b.All operations, with a warning message
• c.Reading the resource only; no create, update, or delete actions✓
• d.Reading and updating, but not deleting

A ReadOnly lock is the stricter of the two lock types, blocking any modification or deletion while still allowing the resource to be viewed. CanNotDelete is the less restrictive option that allows updates.

How do Azure Blueprints differ from a plain ARM template?

• a.Blueprints package templates together with policies and role assignments and keep a relationship to what was deployed✓
• b.Blueprints are used solely to estimate the projected monthly cost of a planned deployment before any resources are actually created
• c.Blueprints replace the need for subscriptions entirely
• d.Blueprints can only deploy a single virtual machine at a time

A blueprint orchestrates multiple artifacts (ARM templates, policy assignments, and RBAC) as a repeatable package and maintains a connection to the deployed environment. A standalone template only defines resources without that governance bundle.

What is Microsoft Purview primarily used for?

• a.Delivering content from edge locations
• b.Provisioning virtual machines at scale
• c.Hosting and serving relational databases for transactional applications across many regions worldwide
• d.Unified data governance: discovering, classifying, and managing data across an organization's estate✓

Microsoft Purview helps organizations map, classify, and govern data wherever it lives, on-premises and in the cloud. It supports compliance by making sensitive data discoverable and manageable.

What does the Microsoft Service Trust Portal provide?

• a.Live performance metrics for your own resources
• b.A tool whose sole purpose is to author and validate custom Azure Policy definitions written in JSON format
• c.Audit reports, compliance certifications, and security documentation about Microsoft's cloud services✓
• d.A place to deploy and manage your virtual machines

The Service Trust Portal is where you access Microsoft's independent audit reports (such as ISO and SOC) and compliance materials. Auditors and compliance teams use it to verify Microsoft's controls.

Azure Advisor groups its recommendations into which set of categories?

• a.Public, private, hybrid, and community
• b.Bronze, silver, gold, and platinum support tiers for each resource
• c.Compute, storage, networking, and databases
• d.Cost, security, reliability, operational excellence, and performance✓

Advisor aligns its guidance to five pillars: cost, security, reliability, operational excellence, and performance. This mirrors the well-architected approach to running healthy workloads.