Azure Fundamentals (AZ-900) — All Questions

Which cloud service model gives you the most control over the operating system, networking, and installed software, while the provider manages only the physical hardware?

• a.Function as a Service (FaaS)
• b.Software as a Service (SaaS)
• c.Infrastructure as a Service (IaaS)✓
• d.Platform as a Service (PaaS)

IaaS provides virtualized compute, storage, and networking, leaving the customer responsible for the operating system and everything above it. The provider only manages the underlying physical infrastructure. This gives the greatest flexibility but also the most administrative overhead.

In which cloud service model does the provider deliver a complete, ready-to-use application over the internet, such as a hosted email or CRM product?

• a.Infrastructure as a Service (IaaS)
• b.Platform as a Service (PaaS)
• c.Software as a Service (SaaS)✓
• d.Desktop as a Service (DaaS)

SaaS delivers finished software that users simply consume, usually through a web browser. The provider manages everything from the hardware up to the application itself. Customers only configure settings and manage their own data and users.

A development team wants to deploy code without managing the underlying servers, operating system patches, or runtime. Which model best fits this need?

• a.Infrastructure as a Service (IaaS)
• b.Colocation hosting
• c.Platform as a Service (PaaS)✓
• d.Software as a Service (SaaS)

PaaS provides a managed platform including the operating system, runtime, and middleware, so developers focus only on their application code and data. The provider handles patching and infrastructure maintenance. This accelerates development while reducing operational burden.

What is the primary financial benefit of the cloud's consumption-based (pay-as-you-go) pricing model?

• a.Hardware must be purchased upfront for the year
• b.You pay only for the resources you actually use, converting capital expense into operating expense✓
• c.You receive a fixed monthly bill regardless of usage
• d.Costs are hidden until an annual audit

Consumption-based pricing charges you only for the compute, storage, and services you consume. This shifts spending from large upfront capital expenditure (CapEx) to flexible operating expenditure (OpEx). It lets organizations avoid over-provisioning and align cost with demand.

Which cloud benefit describes the ability to quickly add or remove resources to match changing demand?

• a.Scalability and elasticity✓
• b.High latency
• c.Manual provisioning
• d.Vendor lock-in

Scalability lets you increase capacity as workloads grow, while elasticity automatically adds or removes resources in response to demand. Together they ensure applications perform well during spikes and save money during quiet periods. This responsiveness is a core advantage of cloud computing.

What does the term 'high availability' primarily refer to in cloud computing?

• a.Keeping applications running and accessible with minimal downtime✓
• b.Encrypting data at rest
• c.Reducing the number of servers to save money
• d.Storing data in a single location

High availability means designing systems so they remain operational even when individual components fail. Cloud platforms achieve this through redundancy, load balancing, and distribution across fault domains. The goal is to minimize service interruptions and meet uptime commitments.

In the shared responsibility model, which task is ALWAYS the customer's responsibility regardless of the service model used?

• a.Maintaining the physical datacenter security
• b.Securing the physical network cabling
• c.Replacing failed physical hard drives
• d.Managing the data, accounts, and access identities✓

The customer always retains responsibility for their own data, user accounts, and identity/access management no matter which service model is chosen. The provider is always responsible for the physical datacenter and hardware. Responsibilities in between shift depending on IaaS, PaaS, or SaaS.

Under the shared responsibility model for IaaS, who is responsible for patching the guest operating system on a virtual machine?

• a.No patching is required in the cloud
• b.The customer✓
• c.The hardware vendor
• d.The cloud provider

With IaaS, the customer manages the virtual machine's operating system, including applying security patches and updates. The provider only maintains the physical host and hypervisor. This division is central to understanding cloud security obligations.

Which type of cloud deployment combines on-premises infrastructure with public cloud resources, allowing data and applications to move between them?

• a.Private cloud only
• b.Community cloud
• c.Hybrid cloud✓
• d.Public cloud only

A hybrid cloud connects private, on-premises environments with public cloud services so workloads can span both. This lets organizations keep sensitive systems local while bursting to the public cloud for scale. It is popular for gradual migration and regulatory needs.

What is a defining characteristic of a public cloud deployment?

• a.Hardware is dedicated exclusively to one organization on-premises
• b.Resources are owned and operated by a third-party provider and shared among multiple organizations✓
• c.It cannot connect to the internet
• d.It requires the customer to own the datacenter

In a public cloud, a third-party provider owns the infrastructure and offers services to many customers over the internet. Resources are multi-tenant and delivered on demand. This model offers low upfront cost and virtually unlimited scale.

Which deployment model dedicates cloud infrastructure to a single organization, often for stricter control or compliance?

• a.Private cloud✓
• b.Public cloud
• c.Hybrid cloud
• d.Multi-tenant SaaS

A private cloud provides computing resources used exclusively by one organization, whether hosted on-premises or by a provider. It offers greater control and isolation, which helps meet strict security or regulatory requirements. The trade-off is typically higher cost and management effort.

What is meant by 'agility' as a benefit of cloud computing?

• a.The requirement to sign multi-year hardware contracts
• b.The ability to rapidly develop, test, and deploy applications✓
• c.The guarantee of zero cost
• d.The elimination of all security concerns

Agility refers to how quickly you can provision resources and bring solutions to market in the cloud. Instead of waiting weeks to procure hardware, teams spin up environments in minutes. This speed accelerates innovation and experimentation.

Which concept describes distributing resources across multiple physical datacenters so a single failure does not take down a service?

• a.Data sovereignty
• b.Consumption-based billing
• c.Fault tolerance and redundancy✓
• d.Vertical scaling

Fault tolerance uses redundant components and locations so the failure of one does not disrupt the overall service. Cloud providers replicate resources across isolated fault domains. This design keeps applications available during hardware or facility failures.

What distinguishes 'vertical scaling' from 'horizontal scaling'?

• a.They are identical terms
• b.Vertical scaling adds more instances, while horizontal scaling adds CPU/RAM
• c.Vertical scaling adds power (CPU/RAM) to an existing resource, while horizontal scaling adds more instances✓
• d.Vertical scaling only applies to storage

Vertical scaling (scaling up) increases the capacity of a single machine by adding CPU, memory, or disk. Horizontal scaling (scaling out) adds more machines or instances to share the load. Cloud platforms support both, but scaling out is often more resilient.

Which of the following is an example of an operating expense (OpEx) enabled by the cloud?

• a.A one-time purchase of physical servers
• b.Buying a datacenter building
• c.A monthly bill for the compute hours consumed✓
• d.Purchasing networking hardware upfront

OpEx refers to ongoing, usage-based spending such as a monthly cloud bill for consumed services. This contrasts with CapEx, which is a large upfront purchase of assets. The cloud's pay-as-you-go model favors OpEx, improving cash flow and flexibility.

What does 'disaster recovery' in the cloud primarily help an organization achieve?

• a.Restoring systems and data quickly after a major outage or failure✓
• b.Eliminating the need for backups
• c.Reducing the monthly subscription cost
• d.Increasing application latency

Disaster recovery is the practice of restoring IT systems and data after a significant disruptive event. Cloud services make this easier and more affordable by replicating data to other regions. This minimizes downtime and data loss during major incidents.

Which cloud characteristic allows many customers to share the same physical infrastructure while remaining logically isolated?

• a.Single-tenancy
• b.Multi-tenancy✓
• c.Colocation
• d.On-premises hosting

Multi-tenancy means multiple customers (tenants) share the same underlying physical resources while their data and workloads stay logically separated. This efficient use of hardware lowers costs for everyone. Providers enforce strong isolation to keep tenants secure from one another.

A company wants to avoid the cost and effort of maintaining physical servers. Which cloud advantage most directly addresses this?

• a.Longer procurement times
• b.Increased hardware ownership
• c.Reduced infrastructure management responsibility✓
• d.Higher capital expenditure

By moving to the cloud, organizations offload the purchase, maintenance, and refresh of physical hardware to the provider. This reduces the management burden and staffing needed for datacenters. Teams can then focus on applications and business value instead of infrastructure.

What is the main purpose of a service-level agreement (SLA) offered by a cloud provider?

• a.It lists the provider's employees
• b.It formally defines the expected performance and uptime guarantees for a service✓
• c.It encrypts customer data automatically
• d.It sets the price of physical hardware

An SLA is a formal commitment that specifies metrics such as guaranteed uptime and availability for a service. If the provider fails to meet these targets, customers may receive service credits. SLAs help organizations plan for reliability and set expectations.

Which of the following best describes 'elasticity' in cloud computing?

• a.Applications must be manually restarted daily
• b.Resources remain fixed regardless of load
• c.Storage is limited to a single disk
• d.Resources automatically expand or contract to match real-time demand✓

Elasticity is the automatic scaling of resources up or down in response to workload changes. During a traffic spike, more capacity is added; when demand falls, capacity is released. This keeps performance steady while avoiding payment for idle resources.

In the shared responsibility model for SaaS, which responsibility shifts almost entirely to the provider?

• a.Managing the application, runtime, and operating system✓
• b.Setting data-sharing permissions
• c.Choosing which users get accounts
• d.Managing user access and data classification

In SaaS, the provider manages nearly the entire stack including the application, runtime, and operating system. The customer's remaining duties center on their data, users, and access configuration. This makes SaaS the lowest-maintenance model for consumers.

Why is 'geographic distribution' of datacenters valuable to cloud customers?

• a.It increases the physical distance data must travel
• b.It forces all data into one country
• c.It lets applications serve users from nearby locations, reducing latency and improving resilience✓
• d.It removes the need for redundancy

Providers operate datacenters around the world so applications can run close to their users. This lowers latency and improves the user experience. Geographic spread also supports disaster recovery and compliance with data-residency requirements.

Which statement about capital expenditure (CapEx) is correct?

• a.It is a recurring monthly usage charge
• b.It only applies to cloud subscriptions
• c.It is a large upfront investment in physical assets like servers and datacenters✓
• d.It eliminates the need to own hardware

CapEx is spending on tangible assets, such as buying servers or building a datacenter, that are used over many years. Traditional on-premises IT relies heavily on CapEx. Cloud computing reduces CapEx by shifting toward pay-as-you-go OpEx.

What is a key reason organizations adopt cloud computing for 'reliability'?

• a.Built-in redundancy and backups keep services running and recoverable during failures✓
• b.It makes applications run offline permanently
• c.It guarantees the code has no bugs
• d.It removes the need for testing

Reliability in the cloud comes from redundant infrastructure, automated backups, and the ability to recover quickly from failures. Providers design their platforms to keep services available and data protected. This lets organizations meet uptime and continuity goals more easily.

A workload experiences predictable spikes every weekday morning. Which cloud capability lets it automatically add capacity during those spikes and remove it afterward?

• a.Data archiving
• b.Static provisioning
• c.Autoscaling✓
• d.Manual server purchasing

Autoscaling monitors demand and adjusts the number of running resources automatically. During predictable morning spikes it adds instances, then removes them when traffic subsides. This maintains performance while controlling cost, a hallmark of elastic cloud design.

Which of the following is generally NOT considered a benefit of moving to the public cloud?

• a.Full ownership and physical control of the underlying hardware✓
• b.Reduced upfront capital costs
• c.Scalability on demand
• d.Global reach and availability

Public cloud customers do not own or physically control the hardware; that stays with the provider. The recognized benefits include on-demand scalability, lower upfront costs, and global reach. Trading physical control for these advantages is the essence of the public cloud model.

In Azure, what is the primary purpose of a resource group?

• a.It is a billing currency
• b.It is a physical server rack
• c.It is a network firewall device
• d.It is a logical container that holds related Azure resources for management as a unit✓

A resource group is a logical container used to organize and manage related Azure resources together. Resources in a group typically share the same lifecycle, such as being deployed, updated, and deleted together. It also serves as a scope for applying permissions and policies.

What does an Azure region represent?

• a.A billing account
• b.A type of virtual machine
• c.A single physical server
• d.A set of datacenters deployed within a defined geographic area, connected by a low-latency network✓

An Azure region is a geographic area containing one or more datacenters networked together with low latency. Customers choose regions to place resources close to users and to meet data-residency needs. Region selection affects performance, cost, and available services.

What are Availability Zones within an Azure region designed to protect against?

• a.Incorrect billing charges
• b.Datacenter-level failures, by providing physically separate locations with independent power and networking✓
• c.Software bugs in your application
• d.Expired user passwords

Availability Zones are physically separate datacenters within a region, each with independent power, cooling, and networking. Distributing resources across zones protects applications from the failure of a single datacenter. This improves high availability within a single region.

Which Azure service provides on-demand, scalable virtual machines that you fully control at the operating system level?

• a.Azure App Service
• b.Azure Virtual Machines✓
• c.Azure Blob Storage
• d.Azure Functions

Azure Virtual Machines is an IaaS offering that lets you run and control full virtual servers in the cloud. You choose the OS, size, and installed software, and you manage patching and configuration. It suits workloads needing maximum control or custom environments.

Which Azure service is a fully managed platform for hosting web applications and APIs without managing the underlying servers?

• a.Azure App Service✓
• b.Azure Virtual Machines
• c.Azure Blob Storage
• d.Azure Virtual Network

Azure App Service is a PaaS offering for building and hosting web apps, REST APIs, and mobile backends. It manages the infrastructure, patching, and scaling so developers focus on code. It supports multiple languages and integrates with CI/CD pipelines.

Which Azure service lets you run small pieces of code (functions) without provisioning or managing servers, billed only while the code runs?

• a.Azure Functions✓
• b.Azure SQL Database
• c.Azure Kubernetes Service
• d.Azure Virtual Machines

Azure Functions is a serverless compute service that runs event-triggered code without managing infrastructure. You are billed based on executions and resource consumption while the function runs. It is ideal for lightweight, event-driven, or intermittent workloads.

Which Azure storage service is optimized for storing massive amounts of unstructured data such as images, videos, and backups?

• a.Azure SQL Database
• b.Azure Virtual Network
• c.Azure Blob Storage✓
• d.Azure Files

Azure Blob Storage is designed for large volumes of unstructured object data like media files, documents, and backups. It offers tiers (hot, cool, archive) to balance cost and access frequency. It is accessible over HTTP/HTTPS from anywhere.

Which Azure service provides fully managed file shares accessible over the SMB and NFS protocols?

• a.Azure Table Storage
• b.Azure Queue Storage
• c.Azure Files✓
• d.Azure Blob Storage

Azure Files offers managed cloud file shares that can be mounted by cloud or on-premises machines using SMB or NFS. It is useful for lift-and-shift scenarios and shared application data. Multiple systems can access the same files concurrently.

What is the primary function of an Azure Virtual Network (VNet)?

• a.It hosts serverless functions
• b.It provides an isolated, private network in Azure for resources to securely communicate✓
• c.It stores unstructured blobs
• d.It manages user identities

An Azure Virtual Network (VNet) is the fundamental building block for private networking in Azure. It lets resources such as VMs communicate securely with each other, the internet, and on-premises networks. VNets support subnets, routing, and network security controls.

Which service is Microsoft's cloud-based identity and access management solution used to sign in and access resources?

• a.Microsoft Entra ID✓
• b.Azure Virtual Machines
• c.Azure Monitor
• d.Azure Blob Storage

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity and access management service. It authenticates users and controls access to applications and Azure resources. It supports single sign-on, multifactor authentication, and conditional access.

Which Azure networking service acts as a load balancer that distributes incoming traffic across multiple backend resources?

• a.Azure Functions
• b.Azure Blob Storage
• c.Microsoft Entra ID
• d.Azure Load Balancer✓

Azure Load Balancer distributes inbound network traffic across a pool of backend resources such as virtual machines. This improves availability and scalability by preventing any single resource from being overwhelmed. It operates at the transport layer (Layer 4).

Which service securely connects an on-premises network to Azure over an encrypted tunnel across the public internet?

• a.Azure Functions
• b.Azure VPN Gateway✓
• c.Azure Blob Storage
• d.Azure Policy

Azure VPN Gateway establishes encrypted site-to-site or point-to-site connections between on-premises networks and Azure VNets over the internet. It secures traffic using IPsec/IKE tunnels. It is a common choice for hybrid connectivity when a private circuit is not required.

Which Azure service provides a dedicated, private connection from your on-premises network to Azure that does not traverse the public internet?

• a.Azure VPN Gateway
• b.Azure ExpressRoute✓
• c.Azure Blob Storage
• d.Azure DNS

Azure ExpressRoute creates a private, dedicated connection between on-premises infrastructure and Azure through a connectivity provider. Because traffic bypasses the public internet, it offers more reliability, consistent latency, and higher security. It suits large-scale or mission-critical hybrid workloads.

Which Azure service is a fully managed relational database based on the SQL Server engine?

• a.Azure Files
• b.Azure Blob Storage
• c.Azure Cosmos DB
• d.Azure SQL Database✓

Azure SQL Database is a fully managed PaaS relational database built on the SQL Server engine. Microsoft handles patching, backups, and high availability, reducing administrative work. It is ideal for applications needing a managed relational data store.

Which Azure service is a globally distributed, multi-model NoSQL database designed for low-latency access at planetary scale?

• a.Azure SQL Database
• b.Azure Blob Storage
• c.Azure Cosmos DB✓
• d.Azure Files

Azure Cosmos DB is a globally distributed NoSQL database offering low latency and elastic scalability. It supports multiple data models and APIs and can replicate data across regions. It is suited to globally responsive applications needing guaranteed performance.

What is the purpose of a subnet within an Azure Virtual Network?

• a.It segments the VNet's IP address space to organize and isolate groups of resources✓
• b.It manages user passwords
• c.It stores backup files
• d.It provides serverless compute

A subnet divides a VNet's address range into smaller segments, letting you group and isolate resources. Segmentation improves security and organization, for example separating web and database tiers. Network security rules can be applied at the subnet level.

Which Azure service provides a container orchestration platform for deploying and managing containerized applications at scale?

• a.Azure DNS
• b.Azure Kubernetes Service (AKS)✓
• c.Azure Blob Storage
• d.Azure SQL Database

Azure Kubernetes Service (AKS) is a managed Kubernetes offering for orchestrating containerized workloads. It automates cluster management tasks such as scaling and upgrades. It is used to run microservices and portable containerized applications efficiently.

Which Azure service lets you run individual containers quickly without managing virtual machines or orchestrators?

• a.Azure Blob Storage
• b.Azure Kubernetes Service
• c.Azure Container Instances (ACI)✓
• d.Azure Virtual Machines

Azure Container Instances (ACI) runs containers on demand without provisioning or managing underlying servers or orchestration. It is ideal for simple, short-lived, or burst workloads. You pay per second for the compute resources the container consumes.

What does a Network Security Group (NSG) do in Azure?

• a.It manages billing alerts
• b.It hosts web applications
• c.It stores relational data
• d.It filters inbound and outbound network traffic to resources using allow/deny rules✓

A Network Security Group contains security rules that allow or deny network traffic to and from Azure resources such as VMs and subnets. Rules are based on source, destination, port, and protocol. NSGs are a core tool for controlling network-level access.

Which Azure service provides scalable, name-resolution (DNS) hosting for your domains within Azure?

• a.Azure Blob Storage
• b.Azure Policy
• c.Azure Functions
• d.Azure DNS✓

Azure DNS hosts your domain's DNS records on Microsoft's global network of name servers. It provides fast, reliable name resolution using Azure's infrastructure. You manage DNS records with the same tools and credentials as other Azure resources.

What is the main benefit of using availability sets for virtual machines in Azure?

• a.They encrypt all stored data
• b.They provide serverless functions
• c.They reduce the cost of storage
• d.They distribute VMs across fault and update domains to reduce the impact of hardware failures and maintenance✓

Availability sets group VMs across multiple fault domains and update domains within a datacenter. This ensures that hardware failures or planned maintenance affect only a subset of the VMs. As a result, the application stays available during such events.

Which Azure storage redundancy option keeps multiple copies of your data within a single datacenter?

• a.Read-access geo-redundant storage (RA-GRS)
• b.Locally redundant storage (LRS)✓
• c.Geo-redundant storage (GRS)
• d.Zone-redundant storage (ZRS)

Locally redundant storage (LRS) replicates data three times within a single physical location in the primary region. It is the lowest-cost option but does not protect against a datacenter-wide outage. Higher redundancy tiers spread copies across zones or regions.

Which storage redundancy option replicates data to a secondary region hundreds of miles away for regional disaster protection?

• a.Locally redundant storage (LRS)
• b.Premium SSD
• c.Geo-redundant storage (GRS)✓
• d.Zone-redundant storage (ZRS)

Geo-redundant storage (GRS) copies data to a secondary region far from the primary one. This protects against a complete regional outage such as a natural disaster. It offers the highest durability among the standard redundancy options.

What is Azure Blob Storage's 'archive' access tier best suited for?

• a.Real-time streaming video
• b.Rarely accessed data that can tolerate retrieval latency, stored at the lowest cost✓
• c.Active database files
• d.Frequently accessed transactional data

The archive tier stores data offline at the lowest cost, intended for long-term retention of rarely accessed data. Retrieving archived data takes time (rehydration) and incurs higher access costs. It suits compliance archives and backups that are seldom read.