Azure Fundamentals (AZ-900) — All Questions

What is the primary purpose of Microsoft Cost Management in Azure?

• a.To store unstructured data
• b.To monitor, analyze, and optimize spending across Azure resources✓
• c.To host web applications
• d.To deploy virtual machines

Microsoft Cost Management provides tools to track, analyze, and control Azure spending. It offers cost analysis, budgets, and recommendations to optimize usage. This helps organizations stay within budget and identify savings opportunities.

What is the main use of tags applied to Azure resources?

• a.To increase the resource's performance
• b.To attach metadata (key-value pairs) for organizing, tracking costs, and managing resources✓
• c.To physically label servers in the datacenter
• d.To encrypt the resource's data

Tags are key-value pairs you assign to resources to add descriptive metadata. They enable grouping and filtering for cost reporting, ownership, and environment tracking. For example, tagging by department lets you break down spending accurately.

What does Azure Policy help an organization enforce?

• a.Rules and standards that keep resources compliant, such as allowed regions or required tags✓
• b.The pricing of virtual machines
• c.The physical location of datacenters
• d.The color scheme of the portal

Azure Policy lets you define and enforce organizational rules for resources at scale. Policies can require certain configurations, restrict resource types or regions, and flag non-compliant resources. This drives consistent governance and regulatory compliance.

What does role-based access control (RBAC) in Azure allow you to do?

• a.Deploy virtual machines faster
• b.Reduce storage costs
• c.Grant users only the specific permissions they need, scoped to particular resources✓
• d.Encrypt all network traffic automatically

Role-based access control (RBAC) assigns permissions through roles at a chosen scope such as a subscription, resource group, or resource. This follows the principle of least privilege, granting only the access users need. It centralizes and simplifies permission management.

What is the purpose of a resource lock in Azure?

• a.To encrypt data at rest
• b.To lower the monthly bill
• c.To speed up resource deployment
• d.To prevent accidental deletion or modification of critical resources✓

Resource locks protect important resources from accidental changes or deletion. A 'CanNotDelete' lock allows edits but blocks deletion, while a 'ReadOnly' lock blocks both changes and deletion. Locks apply regardless of a user's RBAC permissions.

Which Azure service collects telemetry such as metrics and logs to help you observe the health and performance of resources?

• a.Azure Key Vault
• b.Azure Monitor✓
• c.Azure Blob Storage
• d.Azure DNS

Azure Monitor gathers metrics, logs, and other telemetry from Azure resources and applications. It enables visualization, alerting, and analysis of performance and availability. This visibility is essential for detecting and diagnosing issues.

Which two lock types are available for Azure resource locks?

• a.Encrypt and Decrypt
• b.CanNotDelete and ReadOnly✓
• c.Public and Private
• d.Hot and Cool

Azure supports two lock types: CanNotDelete, which permits reads and updates but prevents deletion, and ReadOnly, which prevents any modification or deletion. These locks override RBAC permissions to safeguard resources. They are applied at the resource, group, or subscription scope.

What is the benefit of setting a budget in Microsoft Cost Management?

• a.It tracks spending against a defined threshold and can trigger alerts when limits are approached✓
• b.It provisions new subscriptions
• c.It automatically doubles your resource capacity
• d.It encrypts all your resources

A budget in Cost Management sets a spending threshold for a scope such as a subscription or resource group. When actual or forecasted costs approach the limit, alerts notify stakeholders. This proactive control helps prevent unexpected overspending.

Which tool provides personalized recommendations to improve the cost, security, reliability, performance, and operational excellence of your Azure resources?

• a.Azure Functions
• b.Azure Blob Storage
• c.Azure Advisor✓
• d.Azure DNS

Azure Advisor analyzes your resource configuration and usage, then provides tailored recommendations. Its guidance spans cost optimization, security, reliability, performance, and operational excellence. Following its suggestions improves your environment's efficiency and posture.

How can Azure Policy remediate a resource that is created without a required tag?

• a.It increases the resource's size
• b.It encrypts the resource
• c.It can be configured to deny the deployment or automatically add the missing tag✓
• d.It deletes the entire subscription

Azure Policy supports effects such as 'deny,' which blocks non-compliant deployments, and 'modify' or 'append,' which can add a required tag. This ensures resources meet standards either by prevention or automatic correction. Remediation tasks can also fix existing non-compliant resources.

In RBAC, what does the 'scope' of a role assignment determine?

• a.The billing currency
• b.The physical datacenter used
• c.The set of resources to which the granted permissions apply✓
• d.The color of the resource icon

The scope defines where a role's permissions take effect, such as a management group, subscription, resource group, or individual resource. Assigning at a broad scope grants access to everything beneath it. Choosing the narrowest appropriate scope supports least-privilege access.

What is a primary advantage of using management groups for governance?

• a.They store application secrets
• b.Policies and access assigned at a management group are inherited by all subscriptions within it✓
• c.They provide serverless compute
• d.They cache web content

Management groups let you apply governance such as Azure Policy and RBAC across many subscriptions at once. Assignments made at the management group level are inherited by all contained subscriptions and resources. This ensures consistent policy across a large organization.

Which feature helps you understand where your Azure money is going by breaking down spending by resource, tag, or service?

• a.Cost analysis in Microsoft Cost Management✓
• b.Azure DNS
• c.Availability zones
• d.Network peering

Cost analysis provides interactive breakdowns of your Azure spending across dimensions such as service, resource group, and tag. It helps identify cost drivers and trends over time. These insights support budgeting and optimization decisions.

What is the purpose of an Azure alert in Azure Monitor?

• a.To encrypt stored data
• b.To create new subscriptions
• c.To provision virtual networks
• d.To notify you or trigger an action when a monitored condition or threshold is met✓

Alerts in Azure Monitor watch metrics or logs and fire when defined conditions are met, such as high CPU usage. They can send notifications or trigger automated responses through action groups. This enables proactive operations and faster incident response.

Which Azure governance tool would you use to package policies, role assignments, and resource templates as a repeatable, enforceable set?

• a.Azure Blob Storage
• b.Azure Cache for Redis
• c.Azure Blueprints✓
• d.Azure DNS

Azure Blueprints lets you define a repeatable set of governance artifacts including policies, RBAC role assignments, and resource templates. You can deploy these consistently to new environments to ensure they start compliant. This standardizes how subscriptions are set up.

What does the principle of 'least privilege' mean when assigning RBAC roles?

• a.Users are given only the minimum permissions necessary to perform their tasks✓
• b.Permissions are assigned randomly
• c.Every user gets full administrator rights
• d.No user is ever given any access

Least privilege means granting users just enough access to do their jobs and no more. This reduces the risk and potential impact of compromised or misused accounts. RBAC supports this by allowing precise, scoped role assignments.

Which built-in RBAC role grants full access to manage all resources, including assigning roles to others?

• a.Contributor
• b.Reader
• c.Billing Reader
• d.Owner✓

The Owner role provides full access to manage resources and, unlike Contributor, can also grant access to others by assigning roles. Contributor can manage resources but cannot assign roles, and Reader can only view. Choosing the right role enforces least privilege.

Which built-in RBAC role lets a user manage resources but NOT grant access to other users?

• a.Contributor✓
• b.Guest
• c.Owner
• d.Reader

The Contributor role allows creating and managing all types of resources but does not permit assigning roles to others. That role-assignment capability is reserved for Owner and User Access Administrator. This separation supports controlled delegation.

Which built-in RBAC role provides view-only access with no ability to make changes?

• a.User Access Administrator
• b.Owner
• c.Reader✓
• d.Contributor

The Reader role grants the ability to view resources but not to create, modify, or delete them. It is ideal for auditors or stakeholders who need visibility without change rights. It represents the least-privileged of the common built-in roles.

What is the main benefit of applying consistent tagging across your Azure resources?

• a.It increases network bandwidth
• b.It reduces the number of regions used
• c.It enables accurate cost allocation and reporting by department, project, or environment✓
• d.It automatically encrypts the resources

Consistent tags let you slice cost and usage data by meaningful categories such as department or project. This supports chargeback, showback, and accountability across teams. Tagging standards can even be enforced through Azure Policy.

Which service helps you improve your organization's security posture by providing a security score and recommendations?

• a.Azure DNS
• b.Azure Cache for Redis
• c.Azure Blob Storage
• d.Microsoft Defender for Cloud✓

Microsoft Defender for Cloud assesses your resources' security and provides a secure score along with actionable recommendations. It helps identify misconfigurations and threats across your environment. Acting on its guidance strengthens overall security.

What does an action group in Azure Monitor define?

• a.The set of notifications and automated actions to run when an alert fires✓
• b.The size of a virtual machine
• c.The redundancy level of storage
• d.The physical location of a datacenter

An action group is a reusable collection of notification targets and actions, such as emails, SMS, or webhooks. When an alert triggers, its associated action group carries out these responses. This lets you standardize how incidents are communicated and handled.

Which capability of Azure Policy shows how many of your resources currently meet defined standards?

• a.Compliance reporting✓
• b.DNS resolution
• c.Autoscaling
• d.Blob replication

Azure Policy provides compliance reporting that evaluates resources against assigned policies. It shows which resources are compliant or non-compliant, giving a clear governance overview. This helps organizations track and prove adherence to standards.

What is the purpose of the Azure Pricing Calculator?

• a.To estimate the cost of Azure services before deploying them✓
• b.To deploy resources into production
• c.To monitor live performance
• d.To encrypt stored data

The Azure Pricing Calculator lets you model and estimate the cost of Azure services based on your expected configuration and usage. It supports planning and budgeting before any resources are provisioned. This helps avoid surprises on the bill.

What does the Total Cost of Ownership (TCO) Calculator help organizations do?

• a.Configure DNS records
• b.Compare the cost of running workloads on-premises versus in Azure✓
• c.Encrypt data in transit
• d.Deploy virtual machines automatically

The TCO Calculator estimates the cost savings of migrating on-premises workloads to Azure. It compares current infrastructure expenses with projected Azure costs, including hardware, power, and staffing. This supports the business case for cloud migration.

Which of the following is a valid strategy to reduce Azure virtual machine costs for predictable, long-running workloads?

• a.Disabling monitoring entirely
• b.Running only during business hours without automation
• c.Deleting all backups
• d.Purchasing reserved instances for a one- or three-year term✓

Reserved instances let you commit to a VM for one or three years in exchange for a significant discount over pay-as-you-go pricing. They suit steady, predictable workloads that run continuously. This is a common cost-optimization technique in Azure.

What is Azure Spot pricing best suited for?

• a.Interruptible workloads that can tolerate being evicted when Azure needs the capacity back✓
• b.Mission-critical databases that must never stop
• c.Long-term reserved capacity
• d.Workloads requiring guaranteed uptime

Azure Spot pricing offers unused capacity at deep discounts, but Azure can reclaim (evict) it when demand rises. It is ideal for fault-tolerant, interruptible workloads like batch processing or testing. It should not be used for services that must run without interruption.

How does inheritance work when an Azure Policy is assigned at the subscription level?

• a.Only newly created resources in one region comply
• b.All resource groups and resources within that subscription inherit and must comply with the policy✓
• c.The policy applies to other subscriptions too
• d.Nothing inherits the policy

When a policy is assigned at the subscription scope, it applies to all resource groups and resources beneath it through inheritance. Lower scopes automatically fall under the higher-level assignment. This makes it efficient to enforce standards broadly.

What is the benefit of using Azure Monitor Log Analytics workspaces?

• a.They provision virtual machines
• b.They cache web content at the edge
• c.They host relational databases
• d.They collect and store log data so you can run queries and analyze it across resources✓

A Log Analytics workspace is a central repository where Azure Monitor stores log and performance data. You can query this data with a powerful language to investigate issues and build insights. Consolidating logs supports troubleshooting and reporting across your environment.

Which governance approach helps ensure resources are deployed only in approved geographic regions?

• a.Enabling zone-redundant storage
• b.Assigning the Reader RBAC role
• c.Applying a ReadOnly resource lock
• d.Using an Azure Policy that restricts allowed locations✓

A common Azure Policy restricts the regions in which resources may be deployed to an approved list. This supports data-residency and compliance requirements by preventing deployments elsewhere. Non-compliant deployment attempts are blocked or flagged.

What distinguishes RBAC from Azure Policy in governance?

• a.RBAC encrypts data and Policy provisions VMs
• b.RBAC controls who can do what to resources, while Azure Policy controls what configurations resources may have✓
• c.They are identical and interchangeable
• d.Azure Policy assigns user passwords

RBAC governs identity and access, determining which users or identities can perform which actions on resources. Azure Policy governs resource properties and configurations, enforcing standards regardless of who deploys. Used together, they provide comprehensive governance.

Which feature lets you group related alerts and manage the notification recipients and automated responses centrally?

• a.Availability zones
• b.Action groups✓
• c.Peering connections
• d.Blob tiers

Action groups centralize the recipients and actions that respond to alerts, such as notifying an on-call team or invoking automation. Reusing an action group across many alerts keeps notification logic consistent. This simplifies operations and incident handling.

What is a key reason to enable diagnostic settings on Azure resources?

• a.To reduce the resource's memory
• b.To physically relocate the datacenter
• c.To route resource logs and metrics to destinations like Log Analytics for analysis and retention✓
• d.To change the billing currency

Diagnostic settings specify where a resource's platform logs and metrics are sent, such as a Log Analytics workspace, storage account, or event hub. This enables long-term retention, analysis, and integration with monitoring tools. It is foundational to observability and auditing.

Which statement best describes how tags and Azure Policy can work together?

• a.Tags replace the need for RBAC
• b.Azure Policy deletes all tags on creation
• c.Tags disable all Azure Policies
• d.Azure Policy can require, add, or enforce specific tags on resources automatically✓

Azure Policy can mandate that resources carry certain tags, append missing tags, or inherit tags from their resource group. This automates and enforces tagging standards across the environment. Consistent tags then power accurate cost tracking and organization.

Which factor most directly increases the monthly cost of an Azure virtual machine?

• a.The number of tags applied to the resource
• b.The VM size (its number of vCPUs and amount of memory)✓
• c.The number of descriptive metadata tags and key-value labels attached to the resource
• d.The color theme selected in the Azure portal

Compute cost scales with the VM size you select, because larger SKUs allocate more vCPUs and memory. Tags, names, and portal themes are metadata or cosmetic and have no effect on price.

How is network bandwidth generally billed in Azure?

• a.Outbound data transfer leaving Azure is typically charged, while most inbound data is free✓
• b.All inbound and outbound data transfer is billed at the same flat rate
• c.Network bandwidth is always included at no cost in every service
• d.Only the inbound data transferred into the Azure datacenter is metered and billed to the customer

Azure generally charges for egress (data flowing out of its datacenters) while ingress is usually free. This is why moving large volumes of data out of a region is a common, sometimes overlooked, cost driver.

Why might the exact same virtual machine size cost a different amount in two different Azure regions?

• a.Regions located farther from the equator always charge a premium because of higher cooling demands
• b.Pricing varies by region because the cost to operate each datacenter differs✓
• c.Region has no effect on price; all regions charge identical rates
• d.Only the primary region can host virtual machines at full price

Azure prices services per region, reflecting differences in local energy, land, labor, and taxes. Choosing a lower-cost region for latency-tolerant workloads is a legitimate optimization technique.

Azure Reservations require the customer to make what kind of commitment in exchange for a discount?

• a.A commitment to never resize the reserved resource
• b.A month-to-month commitment that can be canceled anytime for free
• c.A one-year or three-year commitment to a specific resource✓
• d.A commitment to keep the resource in a single availability zone

Reservations trade a 1-year or 3-year usage commitment for pricing well below pay-as-you-go. They fit steady, predictable workloads because you are effectively pre-paying for capacity you know you will use.

What does the Azure Hybrid Benefit allow an organization to do?

• a.Run Azure services for free for the first three years of a subscription
• b.Combine two separate Azure regions into a single shared billing zone with one blended rate
• c.Reuse existing on-premises Windows Server or SQL Server licenses with Software Assurance to lower Azure costs✓
• d.Automatically move on-premises servers into Azure without any migration tools

Azure Hybrid Benefit lets you apply eligible licenses you already own to Azure workloads, avoiding paying again for the software portion. It can be combined with Reservations for even deeper savings.

What can happen to an Azure Spot Virtual Machine when Azure needs the underlying capacity back?

• a.It is automatically upgraded to a reserved instance at no charge
• b.It continues running with a guaranteed service-level agreement
• c.It is migrated live to another region with guaranteed uptime
• d.It can be evicted (deallocated) with little notice✓

Spot VMs use Azure's surplus capacity at steep discounts, but Azure can reclaim that capacity at any time by evicting the VM. They are therefore appropriate only for interruptible, fault-tolerant work.

Azure Dev/Test pricing offers what advantage to eligible subscriptions?

• a.The automatic promotion and conversion of finished dev/test environments straight into production
• b.Guaranteed higher performance than standard subscriptions
• c.Reduced rates on certain services for non-production development and testing workloads✓
• d.A permanently free production environment for any workload

Dev/Test offers discounted rates on select services for teams building and testing, provided the resources are not used in production. It helps lower the cost of non-critical environments.

A budget alert in Microsoft Cost Management notifies stakeholders based on what?

• a.The number of resources deployed regardless of their cost
• b.Whether a resource has been assigned the correct tags
• c.The ambient physical temperature reported by sensors inside the datacenter facility
• d.Actual or forecasted spending crossing a defined threshold✓

Budgets track spend for a chosen scope and fire alerts when actual or forecasted costs approach the limit you set. This gives teams advance warning before overspending occurs.

Which action is an example of 'right-sizing' to reduce Azure costs?

• a.Moving every workload to the most expensive region
• b.Permanently deleting all diagnostic and activity logs in order to free up storage space
• c.Adding more tags to each resource to trigger discounts
• d.Resizing a consistently underutilized virtual machine to a smaller SKU✓

Right-sizing matches a resource's capacity to its real demand, so an over-provisioned VM is scaled down to a cheaper SKU. Azure Advisor frequently surfaces right-sizing opportunities.

What is the billing effect of stopping (deallocating) an Azure virtual machine?

• a.All storage and networking charges are eliminated immediately
• b.You are charged the same as when the VM is running
• c.The virtual machine is permanently deleted along with all of its attached data disks
• d.You stop paying for its compute while deallocated, though you still pay for attached disks✓

Deallocating releases the compute resources so you no longer pay for vCPU/memory time, but persistent disks and reserved IPs still incur charges. Fully stopped-deallocated is different from merely shutting down the guest OS.

How does autoscaling help control cost?

• a.It removes capacity when demand falls, so you avoid paying for idle resources✓
• b.It disables resource monitoring so that fewer metrics are collected and billed each month
• c.It applies a flat discount to every resource in the subscription
• d.It permanently locks capacity at the maximum size to avoid outages

Autoscaling adds instances during spikes and removes them when load drops, aligning spend with real demand. Paying only for what you actively use is a core cloud cost principle.

Moving rarely accessed blob data to the cool or archive access tier has what effect?

• a.It increases the redundancy to geo-redundant automatically
• b.It speeds up frequent read operations on that data
• c.It lowers storage cost for infrequently accessed data✓
• d.It converts the data into a relational database

Cooler tiers charge less for storage in exchange for higher access costs and, for archive, retrieval latency. Placing seldom-read data in the right tier is a simple, effective saving.

You want to estimate the monthly price of a new architecture before you deploy anything. Which tool should you use?

• a.Microsoft Defender for Cloud
• b.The Total Cost of Ownership (TCO) Calculator
• c.The Azure Pricing Calculator✓
• d.Azure Service Health

The Pricing Calculator models the cost of a configuration you plan to build in Azure. The TCO Calculator, by contrast, compares existing on-premises costs against Azure.

Your finance team wants to compare the cost of your current on-premises datacenter against running the same workloads in Azure. Which tool fits best?

• a.The Total Cost of Ownership (TCO) Calculator tool for migrations
• b.The Total Cost of Ownership (TCO) Calculator✓
• c.The Azure Pricing Calculator
• d.Azure Monitor

The TCO Calculator estimates the savings of migrating existing infrastructure to Azure, factoring in hardware, power, and staffing. It is aimed at building the business case for migration.

Which of the following is a genuine factor that affects the cost of an Azure service?

• a.The type of resource and the settings you choose for it✓
• b.The web browser used to access the portal
• c.How many users are viewing the Azure portal
• d.The number of characters in the resource's display name

Cost depends on the resource type, its configuration (size, tier, redundancy), and its region. Cosmetic factors like names or the browser used have no bearing on billing.

At which scopes can you analyze spending in Microsoft Cost Management?

• a.Management group, subscription, and resource group✓
• b.Only at the scope of one individual resource at a time
• c.Only for resources tagged as production
• d.Only across the entire Azure global cloud

Cost Management lets you view and filter costs at management group, subscription, and resource-group scopes. This flexibility supports both organization-wide and team-level financial visibility.