Azure Fundamentals (AZ-900) — All Questions

Which Azure service provides a global content delivery network (CDN) to cache content closer to users?

• a.Microsoft Entra ID
• b.Azure Functions
• c.Azure SQL Database
• d.Azure Content Delivery Network (CDN)✓

Azure CDN caches static content at edge locations around the world, delivering it from a point of presence near each user. This reduces latency and offloads traffic from the origin. It improves performance for websites, media, and downloads.

Which Azure networking service provides a Layer 7 (application layer) load balancer with features like URL-based routing and web application firewall?

• a.Azure Blob Storage
• b.Azure Load Balancer
• c.Azure DNS
• d.Azure Application Gateway✓

Azure Application Gateway is a web traffic load balancer operating at Layer 7 (the application layer). It supports URL-based routing, SSL termination, and an optional Web Application Firewall (WAF). This makes it suited to advanced HTTP/HTTPS routing scenarios.

What is the role of a management group in the Azure resource hierarchy?

• a.It hosts virtual machines
• b.It provides DNS resolution
• c.It organizes multiple subscriptions together so governance can be applied across them✓
• d.It stores blob data

A management group sits above subscriptions in the Azure hierarchy and groups them for unified governance. Policies and access assignments applied to a management group flow down to all subscriptions within it. This simplifies management for organizations with many subscriptions.

Which statement correctly orders the Azure resource hierarchy from broadest to narrowest scope?

• a.Management group, subscription, resource group, resource✓
• b.Resource, resource group, subscription, management group
• c.Subscription, management group, resource, resource group
• d.Resource group, resource, subscription, management group

The Azure hierarchy from broadest to narrowest is management group, then subscription, then resource group, then individual resource. Governance settings applied at a higher level are inherited by everything beneath. Understanding this order is essential for scoping policy and access.

Which Azure service provides secure storage and management of secrets, keys, and certificates?

• a.Azure DNS
• b.Azure Functions
• c.Azure Blob Storage
• d.Azure Key Vault✓

Azure Key Vault safeguards cryptographic keys, secrets such as passwords, and certificates. It centralizes secret management and controls access with policies and identities. This keeps sensitive values out of application code and configuration files.

What does Azure Virtual Network peering enable?

• a.Direct, low-latency connectivity between two virtual networks so resources can communicate as if on one network✓
• b.Serverless code execution
• c.Automatic cost reporting
• d.Encryption of blob storage

VNet peering connects two virtual networks so their resources can communicate directly over the Azure backbone. Traffic between peered VNets stays on Microsoft's private network with low latency. It is commonly used to link workloads across VNets or regions.

Which Azure compute option is best described as 'serverless,' where you focus on code and the platform handles scaling automatically?

• a.Azure ExpressRoute
• b.Azure Functions✓
• c.Azure Virtual Machines
• d.Azure availability sets

Azure Functions embodies serverless computing: you write event-triggered code and the platform automatically provisions and scales the compute. There are no servers for you to manage. Billing is tied to executions and resources consumed during runs.

Which Azure service would you use to queue messages between application components to decouple and scale them independently?

• a.Microsoft Entra ID
• b.Azure Queue Storage✓
• c.Azure DNS
• d.Azure Blob Storage

Azure Queue Storage stores large numbers of messages that components can add and retrieve asynchronously. This decouples producers from consumers, letting each scale independently and absorb load spikes. It improves resilience in distributed applications.

What is a key advantage of using PaaS services like Azure App Service over IaaS virtual machines for hosting a web app?

• a.The platform handles OS patching, scaling, and infrastructure so developers focus on the application✓
• b.You cannot deploy custom code
• c.You must manually patch the operating system
• d.You gain full control of the physical hardware

PaaS offerings such as Azure App Service manage the operating system, runtime, patching, and scaling for you. This reduces operational overhead compared to running and maintaining your own VMs. Developers can concentrate on building and deploying application features.

Which Azure service provides scalable big data analytics and data warehousing for large volumes of structured data?

• a.Azure DNS
• b.Azure Blob Storage
• c.Azure Key Vault
• d.Azure Synapse Analytics✓

Azure Synapse Analytics is an analytics service that combines data warehousing and big data processing. It can query large datasets using both serverless and provisioned resources. It supports enterprise reporting and advanced analytics at scale.

Which storage redundancy option replicates data synchronously across three availability zones in the primary region?

• a.Locally redundant storage (LRS)
• b.Geo-redundant storage (GRS)
• c.Zone-redundant storage (ZRS)✓
• d.Cool access tier

Zone-redundant storage (ZRS) writes copies of data across three separate availability zones within the primary region. This protects against the failure of a single datacenter/zone while keeping data in-region. It offers higher availability than LRS.

What best describes the purpose of Microsoft Entra ID single sign-on (SSO)?

• a.It hosts DNS zones
• b.It provisions virtual machines automatically
• c.It lets users sign in once and access multiple applications without re-entering credentials✓
• d.It encrypts data stored in blobs

Single sign-on (SSO) allows users to authenticate once with Microsoft Entra ID and then access many connected applications without repeated logins. This improves user experience and reduces password fatigue. It also strengthens security by centralizing authentication.

Which Azure service helps you migrate on-premises servers, databases, and applications to Azure with assessment and tracking tools?

• a.Azure Migrate✓
• b.Azure DNS
• c.Azure Blob Storage
• d.Azure Functions

Azure Migrate provides a central hub to discover, assess, and migrate on-premises workloads to Azure. It offers tools for server, database, and application migration along with readiness assessments. This streamlines planning and executing a cloud migration.

What is the primary function of a public IP address resource in Azure?

• a.It queues messages between apps
• b.It allows inbound and outbound communication between Azure resources and the internet✓
• c.It hosts static websites only
• d.It stores encryption keys

A public IP address enables Azure resources to communicate with the internet and public-facing services. It can be assigned to VMs, load balancers, and gateways. Without a public IP (or equivalent), a resource cannot be reached directly from the internet.

Which Azure feature lets a virtual machine authenticate to other Azure services without storing credentials in code?

• a.Storing passwords in the OS registry
• b.Emailing credentials to users
• c.Hardcoding keys in the application
• d.Managed identities in Microsoft Entra ID✓

Managed identities give Azure resources an automatically managed identity in Microsoft Entra ID. Resources use this identity to authenticate to services that support it, avoiding credentials in code. Azure handles the identity's lifecycle, improving security.

Which Azure service provides a fully managed, in-memory data cache to improve application performance?

• a.Azure DNS
• b.Azure Cache for Redis✓
• c.Azure Blob Storage
• d.Azure Migrate

Azure Cache for Redis is a managed in-memory data store based on the popular Redis engine. It speeds up applications by caching frequently accessed data close to compute. This reduces database load and improves response times.

What is the primary purpose of Microsoft Cost Management in Azure?

• a.To store unstructured data
• b.To monitor, analyze, and optimize spending across Azure resources✓
• c.To host web applications
• d.To deploy virtual machines

Microsoft Cost Management provides tools to track, analyze, and control Azure spending. It offers cost analysis, budgets, and recommendations to optimize usage. This helps organizations stay within budget and identify savings opportunities.

What is the main use of tags applied to Azure resources?

• a.To increase the resource's performance
• b.To attach metadata (key-value pairs) for organizing, tracking costs, and managing resources✓
• c.To physically label servers in the datacenter
• d.To encrypt the resource's data

Tags are key-value pairs you assign to resources to add descriptive metadata. They enable grouping and filtering for cost reporting, ownership, and environment tracking. For example, tagging by department lets you break down spending accurately.

What does Azure Policy help an organization enforce?

• a.Rules and standards that keep resources compliant, such as allowed regions or required tags✓
• b.The pricing of virtual machines
• c.The physical location of datacenters
• d.The color scheme of the portal

Azure Policy lets you define and enforce organizational rules for resources at scale. Policies can require certain configurations, restrict resource types or regions, and flag non-compliant resources. This drives consistent governance and regulatory compliance.

What does role-based access control (RBAC) in Azure allow you to do?

• a.Deploy virtual machines faster
• b.Reduce storage costs
• c.Grant users only the specific permissions they need, scoped to particular resources✓
• d.Encrypt all network traffic automatically

Role-based access control (RBAC) assigns permissions through roles at a chosen scope such as a subscription, resource group, or resource. This follows the principle of least privilege, granting only the access users need. It centralizes and simplifies permission management.

What is the purpose of a resource lock in Azure?

• a.To encrypt data at rest
• b.To lower the monthly bill
• c.To speed up resource deployment
• d.To prevent accidental deletion or modification of critical resources✓

Resource locks protect important resources from accidental changes or deletion. A 'CanNotDelete' lock allows edits but blocks deletion, while a 'ReadOnly' lock blocks both changes and deletion. Locks apply regardless of a user's RBAC permissions.

Which Azure service collects telemetry such as metrics and logs to help you observe the health and performance of resources?

• a.Azure Key Vault
• b.Azure Monitor✓
• c.Azure Blob Storage
• d.Azure DNS

Azure Monitor gathers metrics, logs, and other telemetry from Azure resources and applications. It enables visualization, alerting, and analysis of performance and availability. This visibility is essential for detecting and diagnosing issues.

Which two lock types are available for Azure resource locks?

• a.Encrypt and Decrypt
• b.CanNotDelete and ReadOnly✓
• c.Public and Private
• d.Hot and Cool

Azure supports two lock types: CanNotDelete, which permits reads and updates but prevents deletion, and ReadOnly, which prevents any modification or deletion. These locks override RBAC permissions to safeguard resources. They are applied at the resource, group, or subscription scope.

What is the benefit of setting a budget in Microsoft Cost Management?

• a.It tracks spending against a defined threshold and can trigger alerts when limits are approached✓
• b.It provisions new subscriptions
• c.It automatically doubles your resource capacity
• d.It encrypts all your resources

A budget in Cost Management sets a spending threshold for a scope such as a subscription or resource group. When actual or forecasted costs approach the limit, alerts notify stakeholders. This proactive control helps prevent unexpected overspending.

Which tool provides personalized recommendations to improve the cost, security, reliability, performance, and operational excellence of your Azure resources?

• a.Azure Functions
• b.Azure Blob Storage
• c.Azure Advisor✓
• d.Azure DNS

Azure Advisor analyzes your resource configuration and usage, then provides tailored recommendations. Its guidance spans cost optimization, security, reliability, performance, and operational excellence. Following its suggestions improves your environment's efficiency and posture.

How can Azure Policy remediate a resource that is created without a required tag?

• a.It increases the resource's size
• b.It encrypts the resource
• c.It can be configured to deny the deployment or automatically add the missing tag✓
• d.It deletes the entire subscription

Azure Policy supports effects such as 'deny,' which blocks non-compliant deployments, and 'modify' or 'append,' which can add a required tag. This ensures resources meet standards either by prevention or automatic correction. Remediation tasks can also fix existing non-compliant resources.

In RBAC, what does the 'scope' of a role assignment determine?

• a.The billing currency
• b.The physical datacenter used
• c.The set of resources to which the granted permissions apply✓
• d.The color of the resource icon

The scope defines where a role's permissions take effect, such as a management group, subscription, resource group, or individual resource. Assigning at a broad scope grants access to everything beneath it. Choosing the narrowest appropriate scope supports least-privilege access.

What is a primary advantage of using management groups for governance?

• a.They store application secrets
• b.Policies and access assigned at a management group are inherited by all subscriptions within it✓
• c.They provide serverless compute
• d.They cache web content

Management groups let you apply governance such as Azure Policy and RBAC across many subscriptions at once. Assignments made at the management group level are inherited by all contained subscriptions and resources. This ensures consistent policy across a large organization.

Which feature helps you understand where your Azure money is going by breaking down spending by resource, tag, or service?

• a.Cost analysis in Microsoft Cost Management✓
• b.Azure DNS
• c.Availability zones
• d.Network peering

Cost analysis provides interactive breakdowns of your Azure spending across dimensions such as service, resource group, and tag. It helps identify cost drivers and trends over time. These insights support budgeting and optimization decisions.

What is the purpose of an Azure alert in Azure Monitor?

• a.To encrypt stored data
• b.To create new subscriptions
• c.To provision virtual networks
• d.To notify you or trigger an action when a monitored condition or threshold is met✓

Alerts in Azure Monitor watch metrics or logs and fire when defined conditions are met, such as high CPU usage. They can send notifications or trigger automated responses through action groups. This enables proactive operations and faster incident response.

Which Azure governance tool would you use to package policies, role assignments, and resource templates as a repeatable, enforceable set?

• a.Azure Blob Storage
• b.Azure Cache for Redis
• c.Azure Blueprints✓
• d.Azure DNS

Azure Blueprints lets you define a repeatable set of governance artifacts including policies, RBAC role assignments, and resource templates. You can deploy these consistently to new environments to ensure they start compliant. This standardizes how subscriptions are set up.

What does the principle of 'least privilege' mean when assigning RBAC roles?

• a.Users are given only the minimum permissions necessary to perform their tasks✓
• b.Permissions are assigned randomly
• c.Every user gets full administrator rights
• d.No user is ever given any access

Least privilege means granting users just enough access to do their jobs and no more. This reduces the risk and potential impact of compromised or misused accounts. RBAC supports this by allowing precise, scoped role assignments.

Which built-in RBAC role grants full access to manage all resources, including assigning roles to others?

• a.Contributor
• b.Reader
• c.Billing Reader
• d.Owner✓

The Owner role provides full access to manage resources and, unlike Contributor, can also grant access to others by assigning roles. Contributor can manage resources but cannot assign roles, and Reader can only view. Choosing the right role enforces least privilege.

Which built-in RBAC role lets a user manage resources but NOT grant access to other users?

• a.Contributor✓
• b.Guest
• c.Owner
• d.Reader

The Contributor role allows creating and managing all types of resources but does not permit assigning roles to others. That role-assignment capability is reserved for Owner and User Access Administrator. This separation supports controlled delegation.

Which built-in RBAC role provides view-only access with no ability to make changes?

• a.User Access Administrator
• b.Owner
• c.Reader✓
• d.Contributor

The Reader role grants the ability to view resources but not to create, modify, or delete them. It is ideal for auditors or stakeholders who need visibility without change rights. It represents the least-privileged of the common built-in roles.

What is the main benefit of applying consistent tagging across your Azure resources?

• a.It increases network bandwidth
• b.It reduces the number of regions used
• c.It enables accurate cost allocation and reporting by department, project, or environment✓
• d.It automatically encrypts the resources

Consistent tags let you slice cost and usage data by meaningful categories such as department or project. This supports chargeback, showback, and accountability across teams. Tagging standards can even be enforced through Azure Policy.

Which service helps you improve your organization's security posture by providing a security score and recommendations?

• a.Azure DNS
• b.Azure Cache for Redis
• c.Azure Blob Storage
• d.Microsoft Defender for Cloud✓

Microsoft Defender for Cloud assesses your resources' security and provides a secure score along with actionable recommendations. It helps identify misconfigurations and threats across your environment. Acting on its guidance strengthens overall security.

What does an action group in Azure Monitor define?

• a.The set of notifications and automated actions to run when an alert fires✓
• b.The size of a virtual machine
• c.The redundancy level of storage
• d.The physical location of a datacenter

An action group is a reusable collection of notification targets and actions, such as emails, SMS, or webhooks. When an alert triggers, its associated action group carries out these responses. This lets you standardize how incidents are communicated and handled.

Which capability of Azure Policy shows how many of your resources currently meet defined standards?

• a.Compliance reporting✓
• b.DNS resolution
• c.Autoscaling
• d.Blob replication

Azure Policy provides compliance reporting that evaluates resources against assigned policies. It shows which resources are compliant or non-compliant, giving a clear governance overview. This helps organizations track and prove adherence to standards.

What is the purpose of the Azure Pricing Calculator?

• a.To estimate the cost of Azure services before deploying them✓
• b.To deploy resources into production
• c.To monitor live performance
• d.To encrypt stored data

The Azure Pricing Calculator lets you model and estimate the cost of Azure services based on your expected configuration and usage. It supports planning and budgeting before any resources are provisioned. This helps avoid surprises on the bill.

What does the Total Cost of Ownership (TCO) Calculator help organizations do?

• a.Configure DNS records
• b.Compare the cost of running workloads on-premises versus in Azure✓
• c.Encrypt data in transit
• d.Deploy virtual machines automatically

The TCO Calculator estimates the cost savings of migrating on-premises workloads to Azure. It compares current infrastructure expenses with projected Azure costs, including hardware, power, and staffing. This supports the business case for cloud migration.

Which of the following is a valid strategy to reduce Azure virtual machine costs for predictable, long-running workloads?

• a.Disabling monitoring entirely
• b.Running only during business hours without automation
• c.Deleting all backups
• d.Purchasing reserved instances for a one- or three-year term✓

Reserved instances let you commit to a VM for one or three years in exchange for a significant discount over pay-as-you-go pricing. They suit steady, predictable workloads that run continuously. This is a common cost-optimization technique in Azure.

What is Azure Spot pricing best suited for?

• a.Interruptible workloads that can tolerate being evicted when Azure needs the capacity back✓
• b.Mission-critical databases that must never stop
• c.Long-term reserved capacity
• d.Workloads requiring guaranteed uptime

Azure Spot pricing offers unused capacity at deep discounts, but Azure can reclaim (evict) it when demand rises. It is ideal for fault-tolerant, interruptible workloads like batch processing or testing. It should not be used for services that must run without interruption.

How does inheritance work when an Azure Policy is assigned at the subscription level?

• a.Only newly created resources in one region comply
• b.All resource groups and resources within that subscription inherit and must comply with the policy✓
• c.The policy applies to other subscriptions too
• d.Nothing inherits the policy

When a policy is assigned at the subscription scope, it applies to all resource groups and resources beneath it through inheritance. Lower scopes automatically fall under the higher-level assignment. This makes it efficient to enforce standards broadly.

What is the benefit of using Azure Monitor Log Analytics workspaces?

• a.They provision virtual machines
• b.They cache web content at the edge
• c.They host relational databases
• d.They collect and store log data so you can run queries and analyze it across resources✓

A Log Analytics workspace is a central repository where Azure Monitor stores log and performance data. You can query this data with a powerful language to investigate issues and build insights. Consolidating logs supports troubleshooting and reporting across your environment.

Which governance approach helps ensure resources are deployed only in approved geographic regions?

• a.Enabling zone-redundant storage
• b.Assigning the Reader RBAC role
• c.Applying a ReadOnly resource lock
• d.Using an Azure Policy that restricts allowed locations✓

A common Azure Policy restricts the regions in which resources may be deployed to an approved list. This supports data-residency and compliance requirements by preventing deployments elsewhere. Non-compliant deployment attempts are blocked or flagged.

What distinguishes RBAC from Azure Policy in governance?

• a.RBAC encrypts data and Policy provisions VMs
• b.RBAC controls who can do what to resources, while Azure Policy controls what configurations resources may have✓
• c.They are identical and interchangeable
• d.Azure Policy assigns user passwords

RBAC governs identity and access, determining which users or identities can perform which actions on resources. Azure Policy governs resource properties and configurations, enforcing standards regardless of who deploys. Used together, they provide comprehensive governance.

Which feature lets you group related alerts and manage the notification recipients and automated responses centrally?

• a.Availability zones
• b.Action groups✓
• c.Peering connections
• d.Blob tiers

Action groups centralize the recipients and actions that respond to alerts, such as notifying an on-call team or invoking automation. Reusing an action group across many alerts keeps notification logic consistent. This simplifies operations and incident handling.

What is a key reason to enable diagnostic settings on Azure resources?

• a.To reduce the resource's memory
• b.To physically relocate the datacenter
• c.To route resource logs and metrics to destinations like Log Analytics for analysis and retention✓
• d.To change the billing currency

Diagnostic settings specify where a resource's platform logs and metrics are sent, such as a Log Analytics workspace, storage account, or event hub. This enables long-term retention, analysis, and integration with monitoring tools. It is foundational to observability and auditing.

Which statement best describes how tags and Azure Policy can work together?

• a.Tags replace the need for RBAC
• b.Azure Policy deletes all tags on creation
• c.Tags disable all Azure Policies
• d.Azure Policy can require, add, or enforce specific tags on resources automatically✓

Azure Policy can mandate that resources carry certain tags, append missing tags, or inherit tags from their resource group. This automates and enforces tagging standards across the environment. Consistent tags then power accurate cost tracking and organization.