Azure Fundamentals (AZ-900) — All Questions

Which of the following is a valid Microsoft Entra ID authentication method?

• a.A blob storage tier
• b.An availability zone
• c.A resource lock applied to a resource group
• d.The Microsoft Authenticator app✓

Entra ID supports methods like passwords, the Authenticator app, FIDO2 keys, and Windows Hello. Offering multiple methods enables MFA and passwordless sign-in.

A Conditional Access policy can be set to grant access only if which condition is met?

• a.The resource group has fewer than ten resources
• b.The device is compliant or marked as managed✓
• c.The subscription has a budget configured
• d.The user has been active for over a year

Grant controls in Conditional Access can require conditions such as a compliant device, MFA, or an approved client app. This ties access to the security state of the device and user.

What does self-service password reset (SSPR) in Microsoft Entra ID allow users to do?

• a.Reset their own passwords securely without contacting the help desk✓
• b.The ability to delete other users' accounts and reset their passwords
• c.Change the region of a subscription
• d.Grant themselves administrator roles

SSPR lets users recover access on their own after verifying identity, reducing help-desk load and downtime. It is typically paired with registered authentication methods for security.

What does identity federation allow?

• a.The purchase of reservations on the user's behalf
• b.The encryption of all network traffic by default
• c.A trust relationship so users authenticated by one identity provider can access another system✓
• d.The automatic scheduled deletion of unused and orphaned resources across the whole environment

Federation establishes trust between identity providers so a user can sign in once with their home provider and access federated apps. It underpins many single sign-on scenarios across organizations.

Encrypting data at rest is a control that operates at which defense-in-depth layer?

• a.The identity layer
• b.The perimeter layer
• c.The data layer✓
• d.The physical layer

Protecting stored data with encryption is a control at the innermost data layer. If outer layers are breached, encryption still helps keep the underlying data unreadable.

A distributed denial-of-service (DDoS) protection service operates primarily at which defense-in-depth layer?

• a.The data layer
• b.The application code layer
• c.The identity layer
• d.The perimeter layer✓

DDoS protection defends the network edge where traffic first enters, making it a perimeter-layer control. It absorbs or filters volumetric attacks before they reach internal resources.

Restricting communication between resources using Network Security Groups is a control at which defense-in-depth layer?

• a.The network layer✓
• b.The data layer
• c.The physical layer
• d.The application layer

NSGs filter traffic between subnets and resources, placing them at the network layer of defense in depth. Segmenting the network limits how far an attacker can move if they get in.

How does Microsoft Entra ID differ from traditional Windows Server Active Directory?

• a.It is a legacy service that is completely unable to authenticate any users or applications at all in the cloud
• b.It only manages printers and file shares
• c.It is a cloud identity service that uses modern web protocols rather than domains, OUs, and group policy✓
• d.It is simply Active Directory installed on a local server

Entra ID is a cloud-native identity provider built around protocols like OAuth, OpenID Connect, and SAML, not the on-premises constructs of Windows Server AD. The two can be integrated but are not the same product.

An external user invited to your directory through Entra B2B appears as which type of account?

• a.A service principal owner
• b.A guest user✓
• c.A billing account holder
• d.A global administrator

B2B invitations create guest identities in your tenant, which you can then authorize for specific resources. Guests remain distinct from your internal member users.

A common Conditional Access baseline recommendation is to do what?

• a.Require users to share passwords with the help desk
• b.Allow all sign-ins without any verification
• c.Disabling the logging of all user sign-in and directory audit events
• d.Block legacy authentication protocols that do not support MFA✓

Legacy authentication protocols cannot enforce MFA and are frequently abused in attacks, so blocking them is a standard hardening step. Conditional Access can enforce this across the organization.

What happens when you act on the recommendations behind your Secure Score in Defender for Cloud?

• a.Your subscription's billing currency is silently changed
• b.Your data is moved to a random region
• c.Your subscription is automatically deleted
• d.Your score rises and your overall risk is reduced✓

Each remediated recommendation improves your posture and increases the Secure Score. The score is a practical, trackable way to prioritize security work.

What is a break-glass (emergency access) account and why is it used?

• a.A temporary guest account for external vendors
• b.A standard, closely monitored read-only account that is used only for routine daily status reporting to management teams
• c.A shared account whose password is posted publicly
• d.A highly privileged account, safeguarded and usually excluded from normal Conditional Access, kept for emergencies✓

Break-glass accounts ensure administrators can still sign in if MFA or Conditional Access services fail or lock everyone out. They are tightly controlled, closely monitored, and used only in emergencies.

Risk-based Conditional Access and Privileged Identity Management require which Microsoft Entra ID license?

• a.The free tier
• b.A Windows Server license
• c.Entra ID P2✓
• d.No license at all

Advanced identity protection features like PIM and risk-based Conditional Access are part of the Entra ID P2 tier. Organizations needing these plan their licensing accordingly.

From where can Azure Monitor collect telemetry?

• a.From Azure resources, applications, and even on-premises or other-cloud sources✓
• b.Only from resources located in one region
• c.Only from a single virtual machine at a time
• d.Only from storage accounts that are located within a single Azure region at a time

Azure Monitor is a broad observability platform that ingests metrics and logs from Azure, apps, and hybrid or multi-cloud environments. This unified view helps detect and diagnose issues anywhere.

What are Azure Monitor metrics?

• a.Numeric values collected at regular intervals as time-series data✓
• b.Encryption keys used to secure resources
• c.Static images and other files that are stored in blob storage containers
• d.Free-form text notes written by administrators

Metrics are lightweight, time-stamped numeric measurements (like CPU percentage) sampled at intervals. Their time-series nature makes them ideal for near-real-time charts and threshold alerts.

What are Azure Monitor Logs (Log Analytics) best described as?

• a.A place to store virtual machine disks
• b.A billing report for network egress
• c.Records of varied data queried with the Kusto Query Language (KQL)✓
• d.A network firewall service that inspects and blocks inbound traffic

Logs hold richer, structured, and text data that you analyze using KQL in a Log Analytics workspace. They support deep investigation, correlation, and reporting across many sources.

What is Application Insights used for?

• a.Monitoring the performance, usage, and failures of applications (application performance management)✓
• b.Provisioning virtual networks
• c.Automatically encrypting all sensitive data while it is at rest across every storage service in the environment
• d.Managing user passwords

Application Insights is the APM feature of Azure Monitor, tracking request rates, response times, exceptions, and dependencies. Developers use it to find and fix performance and reliability problems.

Which of the following does Application Insights track for a web application?

• a.The physical temperature of the server room
• b.Request rates, response times, failure rates, and dependency calls✓
• c.The billing currency that is configured for the entire subscription
• d.The number of resource groups in a subscription

Application Insights instruments an app to capture telemetry such as request timing, failures, and external dependency behavior. This visibility helps pinpoint bottlenecks and errors in code.

What does Azure Service Health notify you about?

• a.The single most optimal virtual machine size and pricing tier recommended for your specific workload
• b.Azure service issues, planned maintenance, and health advisories that may affect your resources✓
• c.The number of tags applied to each resource
• d.The remaining balance on your credit card

Service Health provides a personalized view of Azure incidents, maintenance, and advisories relevant to the services and regions you use. It helps you understand whether a problem is on Azure's side.

What does Azure Resource Health report?

• a.The current health status of a specific resource instance✓
• b.The overall compliance state of every assigned policy definition
• c.The overall price of the subscription
• d.The list of users with access to a resource

Resource Health drills down to whether an individual resource is available and, if not, whether the cause is platform- or user-related. It complements the broader Service Health view.

How does the personalized Azure Service Health differ from the public Azure status page?

• a.Service Health only ever shows subscription billing and payment information to the customer
• b.The public status page updates only once per year
• c.The public status page is only visible to Microsoft employees
• d.Service Health is tailored to the specific resources and subscriptions you use✓

The public status page shows broad, global service status, while Service Health filters and personalizes information to your environment. That focus makes Service Health more actionable for your workloads.

An Azure Monitor metric alert fires under what condition?

• a.When any resource within the resource group is renamed by a user
• b.When a new user signs into the portal
• c.When a tag is added to a resource
• d.When a monitored metric crosses a threshold you have defined✓

Metric alerts continuously evaluate a metric against your threshold and trigger when the condition is met, such as CPU above 80 percent. They enable fast, automated response to performance problems.

What is a log (search) alert in Azure Monitor based on?

• a.The color of the portal dashboard
• b.The chosen display name of the parent resource group container
• c.The number of availability zones in a region
• d.The results of a log query run against collected log data✓

Log alerts run a KQL query on a schedule and fire when the results meet a condition, like a certain number of errors appearing. They catch patterns that simple metric thresholds cannot express.

What do Azure dashboards let you do?

• a.It can completely replace the need for any user authentication across services
• b.Automatically write application code
• c.Pin and visualize metrics and resources together in one customizable view✓
• d.Physically rewire the datacenter network

Dashboards provide a personalized canvas where you can pin charts, resource tiles, and query results for at-a-glance monitoring. Teams tailor them to the signals they care about most.

What do Azure Monitor Workbooks provide?

• a.A managed network firewall service for inbound and outbound traffic
• b.Interactive reports that combine data, text, and visualizations✓
• c.A storage tier for archived blobs
• d.A way to buy reserved instances

Workbooks let you build rich, interactive reports mixing queries, parameters, charts, and narrative text. They are ideal for shareable investigations and operational dashboards.

Which query language is used to analyze data in Azure Monitor Log Analytics?

• a.Kusto Query Language (KQL)✓
• b.Structured Query Language for relational tables only
• c.The Bicep domain-specific language
• d.HyperText Markup Language

KQL is the read-only query language for exploring logs and other data in Log Analytics. Its expressive filtering and aggregation make it central to Azure observability.

What do Azure Monitor 'insights' (such as VM insights or Container insights) provide?

• a.A convenient built-in way to bypass user authentication for administrators
• b.Automatic price reductions for those resources
• c.Physical relocation of the resources
• d.Curated, ready-made monitoring experiences for specific resource types✓

Insights are pre-built monitoring solutions tuned to particular services, offering relevant dashboards and health views out of the box. They save you from assembling common monitoring from scratch.

What does Metrics Explorer in Azure Monitor let you do?

• a.Chart and analyze metric data over time interactively✓
• b.The ability to assign RBAC roles directly to application users
• c.Create blob storage containers
• d.Deploy new virtual machines

Metrics Explorer is the tool for plotting and slicing metric time-series, applying filters and splitting by dimensions. It is the go-to place to investigate performance trends.

What can Application Insights availability tests do?

• a.Regularly send requests to your web app from multiple locations to check its uptime and responsiveness✓
• b.Reduce the app's licensing cost
• c.Automatically encrypting the application's entire source code repository while it is stored at rest in the cloud
• d.Assign roles to application users

Availability tests probe your endpoint from various global points and alert you if it becomes slow or unreachable. This provides early warning of outages before users report them.

What does the Azure Activity Log record?

• a.The current hourly list price of each individual Azure service being used across the region today
• b.The contents of files stored in blob storage
• c.Subscription-level control-plane events, such as who created, modified, or deleted a resource✓
• d.The keystrokes typed inside a virtual machine

The Activity Log captures management operations against resources, providing an audit trail of what changed, when, and by whom. It is distinct from resource-level diagnostic logs that capture data-plane activity.

What is an important reason to assign a severity level to an Azure Monitor alert?

• a.To change how much the alert costs to store
• b.To decide which region the alert runs in
• c.To indicate the importance and urgency of the alert so teams can prioritize✓
• d.To encrypt the alert's notification message contents before they are delivered

Alert severity (from critical down to informational) helps operations teams triage and respond to the most urgent issues first. Consistent severities make on-call response more effective.

What is the Azure portal?

• a.A physical device shipped to your datacenter
• b.A command-line tool installed on a local computer
• c.A fully managed relational database engine and query service for hosting applications at scale
• d.A web-based graphical interface, accessed in a browser, for managing Azure resources✓

The Azure portal is the browser-based console where you can create, configure, and monitor resources visually. It suits interactive management and learning, complementing scripting tools.

What is the Azure CLI?

• a.A graphical dashboard for viewing metrics
• b.A global content delivery network for caching static files at edge locations
• c.A managed relational database
• d.A cross-platform command-line tool that uses commands beginning with 'az'✓

The Azure CLI lets you manage Azure from a terminal on Windows, macOS, or Linux using 'az' commands. It is well suited to automation and scripting of repeatable tasks.

How does Azure PowerShell manage Azure resources?

• a.By editing the physical server BIOS
• b.Through cmdlets provided by the Az module✓
• c.By sending emails to Microsoft support
• d.Through a graphical drag-and-drop designer only

Azure PowerShell uses cmdlets in the Az module to script and automate resource management. It appeals to teams already comfortable with PowerShell on Windows and beyond.

What is Azure Cloud Shell?

• a.A physical terminal located in an Azure datacenter
• b.A browser-based shell, offering Bash or PowerShell, that is authenticated and ready inside the portal✓
• c.A tool that only runs on Windows desktops
• d.A fully managed relational database service that automatically stores and queries structured data for you

Cloud Shell gives you a preconfigured command-line environment in the browser with the Azure tools already installed and signed in. It removes the need to install and update tooling locally.

What is a key benefit of using Azure Cloud Shell?

• a.No local installation is needed because the tools are preinstalled and kept up to date✓
• b.It permanently stores files without any storage account
• c.It only works while you are completely offline and disconnected from the internet entirely
• d.It runs without any Azure authentication

Cloud Shell comes with the CLI, PowerShell, and common tools ready to use, so you avoid local setup and maintenance. You can manage Azure from virtually any device with a browser.

ARM templates are authored in which format?

• a.Declarative JSON files✓
• b.Compiled binary executables
• c.Spreadsheet workbooks
• d.Plain-text email messages

ARM templates use JSON to declaratively describe the resources to deploy and their configuration. Storing infrastructure as these files enables repeatable, version-controlled deployments.

What is Bicep?

• a.A managed network load balancer that distributes incoming traffic across many backend resources automatically
• b.A managed NoSQL database
• c.A monitoring agent installed on virtual machines
• d.A domain-specific language that simplifies authoring infrastructure as code, transpiling to ARM JSON✓

Bicep offers a cleaner, more readable syntax than raw ARM JSON and compiles down to the same ARM templates. It makes infrastructure-as-code easier to write and maintain on Azure.

What does 'infrastructure as code' (IaC) mean?

• a.Writing application business logic in a database
• b.Manually clicking through the portal for each deployment
• c.Defining infrastructure in declarative files so deployments are repeatable and consistent✓
• d.Storing plaintext passwords and secrets directly inside the application's source code files

IaC captures the desired infrastructure in code (such as ARM or Bicep) that can be versioned, reviewed, and redeployed reliably. This reduces configuration drift and manual error.

ARM and Bicep templates are 'declarative,' meaning you specify what?

• a.The marketing copy for the application
• b.Each individual command in the exact order to run
• c.The desired end state of the infrastructure, not the step-by-step commands to build it✓
• d.The exact physical wiring and network cabling installed inside the datacenter facility racks

Declarative templates describe the target configuration, and Azure figures out how to reach it. This differs from imperative scripting, where you list each action explicitly.

What is true about both the Azure CLI and Azure PowerShell?

• a.They can perform the same management tasks, so the choice is largely preference and platform✓
• b.They can only be used inside the portal
• c.Neither can be used in automation scripts
• d.Only one of the two tools is actually able to create and manage resources across Azure services

Both tools expose the full breadth of Azure management, so teams pick based on familiarity and existing scripts. Each can be scripted for automation across platforms.

What does the Azure mobile app let you do?

• a.Running large-scale data-warehouse analytical queries across regions
• b.Replace the need for Azure Resource Manager
• c.Monitor and manage your Azure resources from a phone or tablet✓
• d.Physically install hardware in the datacenter

The Azure mobile app provides on-the-go access to check resource health, view alerts, and perform basic management. It is handy for responding to issues away from a desk.

What can you customize in the Azure portal to speed up your work?

• a.The global pricing of Azure services
• b.The underlying hardware of virtual machines
• c.Dashboards and a list of favorite services✓
• d.The physical location of Azure datacenters

You can build custom dashboards and mark frequently used services as favorites for quick navigation. Personalizing the portal makes routine management faster.

What does Azure Cloud Shell require in order to persist your files between sessions?

• a.An associated Azure Files share (backed by a storage account)✓
• b.A dedicated physical hard drive at your desk
• c.A public IP address assigned to your laptop
• d.A separate, paid Azure support plan and premium subscription add-on

Cloud Shell mounts an Azure Files share so your scripts and files survive across sessions. Without it, the environment would be ephemeral each time you connect.

You want to run the command 'az group create'. Which tool are you using?

• a.The Azure CLI✓
• b.Azure PowerShell
• c.Azure Monitor
• d.The Azure portal

Commands that start with 'az' belong to the Azure CLI. Azure PowerShell instead uses verb-noun cmdlets such as New-AzResourceGroup.

Redeploying the same ARM or Bicep template is described as idempotent. What does that mean?

• a.It produces the same end result without creating duplicate resources✓
• b.It can only ever be run a single time before it must be fully recreated
• c.It doubles the resources with each deployment
• d.It deletes everything and starts over each time

Idempotent deployments converge to the declared state, so running the template again does not create duplicates or unexpected changes. This makes redeployment safe and predictable.

Besides the portal, CLI, and PowerShell, how else can Azure be managed programmatically?

• a.Only by editing the datacenter hardware directly
• b.There is no other way to manage Azure
• c.Through REST APIs and language-specific SDKs✓
• d.Only by mailing a request form to Microsoft

Developers can call Azure's REST APIs directly or use SDKs for languages like Python, .NET, and Java. All of these ultimately route through Azure Resource Manager.

What is a benefit of using ARM or Bicep templates instead of clicking through the portal for deployments?

• a.Consistent, repeatable, and version-controlled deployments✓
• b.A firm guarantee that the resources will always cost nothing
• c.The inability to review changes before applying them
• d.Slower deployments that require more manual steps

Templates let you standardize environments, track changes in source control, and redeploy reliably. This is far more consistent than manual portal configuration for anything beyond a one-off.

When you use the portal, CLI, or PowerShell to make a change, the request ultimately goes through what?

• a.A single virtual machine you own
• b.Azure Resource Manager✓
• c.The Azure Pricing Calculator
• d.A Network Security Group

All management tools funnel their requests through Azure Resource Manager, which enforces authentication, authorization, and consistent handling. This is why behavior is uniform regardless of the tool you choose.

What does Azure Arc allow you to do?

• a.Physically ship Azure servers to your office
• b.Extend Azure management and governance to on-premises and other clouds' resources✓
• c.A firm guarantee that every workload you deploy will always run completely for free
• d.Replace the need for identity management

Azure Arc projects Azure's management plane onto servers, Kubernetes clusters, and services running outside Azure. This lets you apply policy, tagging, and monitoring consistently across hybrid and multi-cloud estates.