Azure Fundamentals (AZ-900) — All Questions

What does a 'free tier' offered by some Azure services provide?

• a.Unlimited use of the service forever at no charge
• b.A discount that applies to every other Azure service
• c.A limited amount of the service that you can use at no charge✓
• d.Brand-new physical server hardware shipped directly to your office

Many services include a free tier or free monthly allotment up to a defined limit, after which normal charges apply. It lets you evaluate or run small workloads without cost.

What does consumption-based (metered) billing mean in Azure?

• a.You are billed only once per year with no usage tracking
• b.You pay a single fixed fee regardless of how much you use
• c.You must purchase and rack physical server hardware before using any of the service
• d.You are charged per unit of usage, such as per GB stored or per compute hour✓

Metered billing charges for the actual quantity of a resource consumed, like gigabytes or vCPU-hours. This pay-for-what-you-use model is central to cloud economics.

Azure Reservations deliver the best value for which kind of workload?

• a.Workloads that can tolerate being evicted from their capacity at any moment
• b.Experimental workloads whose usage is completely unknown
• c.Short-lived batch jobs that run for only a few minutes
• d.Steady-state, predictable workloads that run consistently✓

Because a reservation is a 1- or 3-year commitment, it pays off when a resource runs consistently over that period. Unpredictable or interruptible workloads are better served by pay-as-you-go or Spot.

A cost alert in Microsoft Cost Management is primarily used to do what?

• a.Encrypt all of the subscription's billing data for regulatory compliance
• b.Notify the right people when spending reaches a defined threshold✓
• c.Increase the resource limits of the subscription
• d.Automatically shut down every resource in the subscription

Cost alerts watch spend against budgets or thresholds and send notifications so teams can react before overspending. They are informational triggers, not automatic resource controls.

To attribute cloud spend to a specific project for internal chargeback, what is the recommended approach?

• a.Assign each project its own physical datacenter
• b.Apply a consistent tag to the project's resources and filter cost analysis by that tag✓
• c.Provision a separate, dedicated Azure region exclusively for each individual project
• d.Rename every resource to include the project name in the resource ID

Consistent tagging lets Cost Management group and report spend by project, department, or environment. Filtering cost analysis on the tag produces accurate chargeback or showback figures.

An Azure savings plan for compute provides a discount in exchange for what commitment?

• a.Committing to never scale the workload up or down
• b.Committing to a fixed hourly spend on compute for a one- or three-year term✓
• c.Committing to use only a single availability zone
• d.Committing to delete all existing pay-as-you-go resources before the discount applies

A savings plan discounts compute usage up to a chosen hourly dollar commitment over 1 or 3 years, offering more flexibility than a reservation tied to a specific SKU. Usage above the commitment is billed at pay-as-you-go rates.

How is data transfer between two different Azure regions generally treated for billing?

• a.It is always free regardless of volume
• b.It is billed only if the regions are in different continents at a premium rate only
• c.It is charged the same as data written to local disk
• d.It is typically charged as inter-region (egress) bandwidth✓

Moving data across regions incurs egress bandwidth charges, unlike much traffic that stays within a region. Architects weigh this when deciding where to replicate or process data.

Which products can benefit from Azure Hybrid Benefit licensing savings?

• a.Only open-source database engines running inside Linux containers
• b.Only services that have no on-premises equivalent
• c.Windows Server and SQL Server (and certain Linux subscriptions)✓
• d.Any third-party software installed on a virtual machine

Azure Hybrid Benefit applies to eligible Windows Server and SQL Server licenses with Software Assurance, plus some Linux subscriptions. It reduces the software portion of the cost for those specific products.

Why are Azure Spot Virtual Machines offered at a large discount?

• a.They run on Azure's spare, unused capacity that can be reclaimed when needed✓
• b.They come with a stronger uptime guarantee than standard VMs
• c.They store data on slower disks that never change price
• d.They are permanently limited to only the very smallest available virtual machine sizes

Spot pricing monetizes idle capacity, so the discount reflects the risk that Azure may evict the VM to serve paying, on-demand customers. That trade-off makes Spot ideal for interruptible workloads.

A common, often-overlooked source of unnecessary Azure spend is which of the following?

• a.Applying additional descriptive tags and labels to every resource in the subscription
• b.Following Azure Advisor cost recommendations
• c.Over-provisioned or idle resources that continue to run without being used✓
• d.Reviewing the cost analysis dashboard regularly

Idle VMs, oversized SKUs, and orphaned disks keep billing while delivering no value. Regularly identifying and removing or resizing them is a primary optimization activity.

Azure Advisor's cost recommendations might suggest which of the following?

• a.Turning off all security monitoring to save money
• b.Buying reservations or resizing and shutting down underused virtual machines✓
• c.Moving all data to the most expensive storage tier
• d.Deleting your entire production subscription and all of the resources it contains

Advisor analyzes usage and recommends actions such as purchasing reservations or right-sizing idle VMs to cut cost. Its guidance is tailored to your actual resource utilization.

What is the role of an Azure billing account?

• a.It securely stores the encryption keys and certificates for all resources
• b.It defines which regions a subscription may deploy to
• c.It hosts the virtual machines used for billing calculations
• d.It manages invoices and payment for one or more subscriptions✓

A billing account is the top-level construct for managing invoices, payment methods, and the subscriptions grouped under it. It separates financial administration from technical resource management.

What does the cost forecast feature in Microsoft Cost Management help you do?

• a.Automatically purchase reservations on your behalf
• b.Guarantee that costs will never exceed a set amount
• c.Predict likely future spending based on historical usage patterns✓
• d.Encrypt and archive historical billing records for long-term retention

Forecasting projects future costs from past trends so teams can plan budgets and spot looming overruns. It is a planning aid, not an automatic spending control.

What is the scope flexibility of an Azure Reservation?

• a.It is limited to resources created after the reservation is purchased
• b.It can only ever be applied to one individual virtual machine at a time within the subscription
• c.It must be applied to every region simultaneously
• d.It can apply to a single subscription or be shared across all subscriptions in the billing account✓

Reservation scope can be set to a specific subscription or shared, letting the discount apply wherever matching usage occurs. Shared scope maximizes utilization of the commitment across an organization.

What is an Azure Policy initiative (also called a policy set)?

• a.A tool that encrypts resources that violate policy
• b.A group of related policy definitions managed and assigned together as a single unit✓
• c.A billing report that itemizes the monthly cost of every policy assignment you have made
• d.A single policy that can only ever contain one rule

An initiative bundles multiple policy definitions so you can assign and track them as one, with a unified compliance view. This simplifies enforcing a whole standard, such as a security baseline.

Which Azure Policy effect blocks a non-compliant resource from being created or updated?

• a.Append
• b.Deny✓
• c.Disabled
• d.Audit

The Deny effect stops a deployment that would violate the policy from ever succeeding. Audit only records non-compliance, while Append and Modify adjust the resource instead of blocking it.

Which Azure Policy effect records non-compliant resources without preventing their deployment?

• a.Audit✓
• b.Encrypt
• c.Delete
• d.Deny

The Audit effect logs a compliance warning but still allows the resource to be created. It is useful for measuring compliance before you enforce a stricter Deny.

What is the purpose of an Azure Policy exemption?

• a.To increase the compliance score artificially for all resources
• b.To exclude a specific resource or scope from evaluation of a policy or initiative✓
• c.To automatically and permanently delete any resource that is found to be non-compliant
• d.To grant a user administrative access to a subscription

An exemption formally excuses a resource or scope from a policy assignment, often for a documented business reason. It keeps compliance reporting honest by marking the exclusion rather than hiding it.

If you apply a CanNotDelete lock at the resource group level, what happens to the resources inside that group?

• a.The lock applies only to the resource group's name, not its contents
• b.They are immediately deleted to enforce the lock
• c.Only resources created after the lock are affected
• d.They inherit the lock and cannot be deleted until it is removed✓

Locks applied at a parent scope are inherited by child resources, so a CanNotDelete lock on a group protects every resource within it. The lock must be removed before those resources can be deleted.

A ReadOnly resource lock permits which operations on the locked resource?

• a.Deleting the resource, but without being able to read any of its properties
• b.All operations, with a warning message
• c.Reading the resource only; no create, update, or delete actions✓
• d.Reading and updating, but not deleting

A ReadOnly lock is the stricter of the two lock types, blocking any modification or deletion while still allowing the resource to be viewed. CanNotDelete is the less restrictive option that allows updates.

How do Azure Blueprints differ from a plain ARM template?

• a.Blueprints package templates together with policies and role assignments and keep a relationship to what was deployed✓
• b.Blueprints are used solely to estimate the projected monthly cost of a planned deployment before any resources are actually created
• c.Blueprints replace the need for subscriptions entirely
• d.Blueprints can only deploy a single virtual machine at a time

A blueprint orchestrates multiple artifacts (ARM templates, policy assignments, and RBAC) as a repeatable package and maintains a connection to the deployed environment. A standalone template only defines resources without that governance bundle.

What is Microsoft Purview primarily used for?

• a.Delivering content from edge locations
• b.Provisioning virtual machines at scale
• c.Hosting and serving relational databases for transactional applications across many regions worldwide
• d.Unified data governance: discovering, classifying, and managing data across an organization's estate✓

Microsoft Purview helps organizations map, classify, and govern data wherever it lives, on-premises and in the cloud. It supports compliance by making sensitive data discoverable and manageable.

What does the Microsoft Service Trust Portal provide?

• a.Live performance metrics for your own resources
• b.A tool whose sole purpose is to author and validate custom Azure Policy definitions written in JSON format
• c.Audit reports, compliance certifications, and security documentation about Microsoft's cloud services✓
• d.A place to deploy and manage your virtual machines

The Service Trust Portal is where you access Microsoft's independent audit reports (such as ISO and SOC) and compliance materials. Auditors and compliance teams use it to verify Microsoft's controls.

Azure Advisor groups its recommendations into which set of categories?

• a.Public, private, hybrid, and community
• b.Bronze, silver, gold, and platinum support tiers for each resource
• c.Compute, storage, networking, and databases
• d.Cost, security, reliability, operational excellence, and performance✓

Advisor aligns its guidance to five pillars: cost, security, reliability, operational excellence, and performance. This mirrors the well-architected approach to running healthy workloads.

Where can you review Microsoft's independent compliance certifications, such as ISO 27001 or SOC reports?

• a.A Network Security Group
• b.The Service Trust Portal (Microsoft's Trust Center)✓
• c.The Azure Pricing Calculator
• d.The Azure mobile app installed on phones and tablets

The Service Trust Portal and Trust Center publish Microsoft's certifications and audit documentation for customers and auditors. They demonstrate the compliance foundation Microsoft provides.

Microsoft Purview can automatically apply what to help protect sensitive information?

• a.Redundant availability zones inside a single region
• b.Network security group rules
• c.Virtual machine scale sets
• d.Data classifications and sensitivity labels✓

Purview scans data sources and can classify content and apply sensitivity labels, making it easier to govern and protect regulated data. Classification is the basis for downstream policies and reporting.

Every Microsoft Entra tenant in Azure has a single top-level management group known as what?

• a.The default resource group
• b.The root management group (Tenant Root Group)✓
• c.The global administrator account
• d.The organization's primary billing subscription

All management groups roll up to one built-in root management group at the top of the hierarchy. Policies or access assigned there can be inherited by every subscription in the tenant.

When does Azure Policy evaluate resources for compliance?

• a.Only when a user manually deletes a resource
• b.Only once, on the day the policy is written
• c.When a resource is created or updated, and again during periodic compliance scans✓
• d.Only once per month, at the moment the monthly invoice for the subscription is generated

Policy evaluates at resource creation/update and on a recurring schedule so existing resources are also assessed. This keeps the compliance picture current as your environment changes.

In cloud governance, what is the overarching goal?

• a.Making every resource publicly accessible
• b.Ensuring resources are used consistently, securely, and in line with organizational standards✓
• c.Guaranteeing that no resource is ever deleted
• d.Eliminating the need for any ongoing monitoring, logging, or auditing across the entire environment

Governance is about maintaining control, consistency, and compliance as an environment grows. Tools like Policy, RBAC, locks, and Blueprints implement that control at scale.

Do Azure resources automatically inherit tags from their parent resource group?

• a.Yes, but only the very first tag on the resource group is ever inherited by its resources
• b.Yes, every tag on a resource group is copied to its resources automatically
• c.No, and tags cannot be enforced in any way
• d.No; tags are not inherited by default, though Azure Policy can be used to enforce them✓

By default a resource does not pick up its resource group's tags automatically. To standardize tagging you can use Azure Policy effects such as Modify or Append to add required tags.

Azure Blueprints can lock the resources it deploys in order to do what?

• a.Reduce the cost of the deployed resources
• b.Automatically translate the resources to another language
• c.Prevent tampering or unauthorized changes to the governed resources✓
• d.Speeding up query performance on all of the databases within the group

Blueprint locking protects deployed resources so that even privileged users cannot alter or delete them, preserving the governed baseline. This enforces the intended configuration after deployment.

What is the purpose of a remediation task in Azure Policy?

• a.To delete the policy definition permanently
• b.To bring existing non-compliant resources into compliance with a policy✓
• c.To generate an invoice for policy usage
• d.To create an entirely new subscription and resource group within the tenant

Remediation tasks apply corrective effects (like Modify or DeployIfNotExists) to resources that already exist and are non-compliant. This fixes drift without recreating the resources.

The regulatory compliance dashboard in Microsoft Defender for Cloud maps your security posture against what?

• a.Industry and regulatory standards such as ISO 27001 or PCI DSS✓
• b.The current number of descriptive tags applied to each individual resource
• c.The current price of your subscription
• d.The physical distance between datacenters

Defender for Cloud can assess your environment against built-in regulatory standards and show where you fall short. This helps demonstrate and improve compliance against frameworks you must meet.

Even a user with the Owner role cannot delete a resource in which situation?

• a.When the resource is in a different region
• b.When a CanNotDelete lock is applied to the resource✓
• c.When the targeted resource has more than five tags applied to it
• d.When the subscription has a budget defined

Resource locks override RBAC permissions, so a CanNotDelete lock blocks deletion regardless of a user's role. The lock must be removed first, which itself requires appropriate permissions.

Which Azure Policy effect can automatically deploy a related resource when it is found to be missing?

• a.Deny
• b.Audit
• c.DeployIfNotExists✓
• d.Disabled

DeployIfNotExists triggers a deployment to add a required companion resource (for example, a diagnostic setting) when it is absent. It enforces standards by provisioning the missing piece rather than just blocking.

Azure provides many ready-made policy definitions so you do not have to write your own. These are called what?

• a.Deprecated policy definitions
• b.Built-in policy definitions✓
• c.Locked policy definitions
• d.Custom policy definitions

Built-in policies cover common governance needs, such as allowed locations or required tags, and can be assigned directly. Custom definitions are only needed when built-ins do not cover a specific requirement.

What does a tag applied to an Azure resource consist of?

• a.A name (key) paired with a value✓
• b.A single number assigned by Azure automatically
• c.A physical barcode on the server
• d.An encryption certificate

Each tag is a key-value pair, such as environment=production, that adds descriptive metadata. Consistent key-value tagging powers cost reporting, organization, and policy enforcement.

What is the primary benefit of organizing subscriptions into a management group hierarchy?

• a.It physically relocates the datacenters closer together
• b.Governance such as policy and access can be applied once and inherited by all subscriptions beneath it✓
• c.It automatically doubles the compute capacity
• d.It completely removes the need to use resource groups or subscriptions anywhere in the entire organization

Management groups let you assign Azure Policy and RBAC at a higher level so every subscription under them inherits the settings. This provides consistent governance across a large, multi-subscription organization.

At which scopes can an Azure Policy assignment be applied?

• a.Only on storage accounts created within the subscription
• b.Only at the level of an individual user account
• c.Management group, subscription, or resource group✓
• d.Only at the global Azure level for all customers

Policy can be assigned at a management group, subscription, or resource group, and it applies to everything within that scope. Broader scopes are inherited downward, enabling wide or targeted enforcement.

What is the Purview data map?

• a.A foundation that captures metadata about an organization's data assets across sources✓
• b.A network diagram of Azure regions
• c.A pricing sheet for storage services
• d.A prioritized list of recommended virtual machine sizes and pricing tiers for each workload

The data map is the underlying inventory in Purview that records metadata about scanned data assets. It enables discovery, lineage, and classification across the data estate.

Who primarily benefits from the documents available in the Service Trust Portal?

• a.End users trying to reset their passwords
• b.Customers estimating the price of a service
• c.Developers who are actively deploying and configuring a new virtual machine in the portal
• d.Auditors and compliance teams who need Microsoft's audit reports and certifications✓

The Service Trust Portal serves compliance, risk, and audit professionals verifying Microsoft's controls. It centralizes the evidence organizations need to satisfy their own regulators.

What does publishing a blueprint definition allow you to do?

• a.Assign a specific, versioned copy of the blueprint to a subscription✓
• b.Delete all existing subscriptions automatically
• c.To disable all Azure Policy enforcement across the entire organization's tenant
• d.Convert the blueprint into a virtual machine

Publishing creates a versioned blueprint that can then be assigned to subscriptions, deploying its artifacts consistently. Versioning lets you evolve the governance package over time in a controlled way.

Why would an organization group several policies into a single initiative?

• a.To automatically convert existing policy definitions into equivalent RBAC role assignments for users
• b.To simplify assignment and get one combined compliance view for a set of related policies✓
• c.To make each policy cost less to run
• d.To hide non-compliant resources from reporting

Grouping policies into an initiative means you assign and monitor them together, which is far easier for a broad standard than managing dozens of separate policies. Compliance is then reported at the initiative level.

Where can a custom Azure Policy definition be stored so it can be reused across scopes?

• a.Only inside a single virtual machine's disk
• b.Only inside a single public GitHub source-code repository shared with the community
• c.At a management group or subscription, so it can be assigned to child scopes✓
• d.Only within a Network Security Group

Custom policy definitions are saved at a management group or subscription scope, from which they can be assigned to that scope and everything beneath it. Storing at a management group maximizes reuse across many subscriptions.

Microsoft Entra ID was previously known by what name?

• a.Azure Resource Manager
• b.Azure Key Vault
• c.Windows Server Active Directory only
• d.Azure Active Directory (Azure AD)✓

Microsoft rebranded Azure Active Directory as Microsoft Entra ID. It remains Microsoft's cloud identity and access management service for signing in and securing access to resources.

In identity and access management, what does 'authentication' establish?

• a.How much a user's activity will cost
• b.What actions a user is permitted to perform
• c.Who a user is, by verifying their identity✓
• d.Which region a user's data is stored in

Authentication (AuthN) confirms identity, typically through credentials or factors like a password plus a phone prompt. It answers 'who are you?' before any access decision is made.

What does 'authorization' determine after a user has signed in?

• a.What resources and actions the authenticated user is allowed to access✓
• b.Whether the user's password is spelled correctly
• c.Which datacenter the user physically visited
• d.How fast the user's home internet network connection currently happens to be

Authorization (AuthZ) decides what an already-authenticated identity may do, such as read a file or manage a VM. In Azure, RBAC is the primary mechanism for authorization.

In an access request, which process happens first?

• a.Authentication happens first, then authorization✓
• b.Neither is required if the user is inside the corporate network
• c.They always happen at exactly the same instant with no order
• d.Authorization happens first, then authentication

You must first prove who you are (authentication) before the system can decide what you may do (authorization). Getting this order right is fundamental to secure access.

What does multifactor authentication (MFA) require from a user?

• a.Two or more verification factors of different types✓
• b.Only the user's email address
• c.A single password that is simply very long and complex
• d.Two passwords that are exactly the same

MFA combines factors from different categories, such as something you know plus something you have or are. Requiring multiple factors greatly reduces the risk from a stolen password.

Which of the following is an example of the 'something you have' authentication factor?

• a.A fingerprint scan or other biometric reading taken from the user
• b.A security question answer
• c.A code from a phone authenticator app or a hardware token✓
• d.A memorized password

'Something you have' refers to a possession like a phone, authenticator app, or hardware key. A password is 'something you know' and a fingerprint is 'something you are.'