Azure Fundamentals (AZ-900) — All Questions

A team wants a managed open-source relational database. Which Azure option fits?

• a.Azure Database for PostgreSQL✓
• b.Azure DNS for domain name resolution
• c.Azure Blob Storage for large unstructured object and media data sets
• d.Azure Bastion for secure VM access

Azure Database for PostgreSQL (and MySQL/MariaDB) are managed open-source relational databases. Microsoft handles maintenance, backups, and scaling. They suit teams standardizing on open-source engines.

Why might an organization use multiple Azure subscriptions?

• a.To physically separate the server racks inside each of the provider's datacenters
• b.To completely disable Azure across the company
• c.To change the fundamental laws of physics for their workloads
• d.To separate environments, billing, or teams and manage limits✓

Multiple subscriptions help separate environments (dev/test/prod), teams, or billing. They also help work around per-subscription service limits. Management groups can then govern them together.

What happens to the resources inside a resource group when the group is deleted?

• a.They are all deleted along with the group✓
• b.They are automatically moved to another subscription for safekeeping
• c.They are converted into blob objects
• d.They become permanently read-only forever

Deleting a resource group deletes all resources it contains. This makes groups useful for managing the lifecycle of related resources together. Resource locks can prevent accidental deletion.

Which factor is LEAST relevant when choosing an Azure region for a deployment?

• a.The favorite color of the IT manager✓
• b.Data residency and compliance requirements
• c.Whether the needed services and features are available there
• d.Proximity to your users to reduce latency

Region choice should consider compliance, latency, cost, and service availability. Personal preferences like a favorite color are irrelevant. Sound region selection balances the meaningful technical and legal factors.

How do Availability Zones differ from availability sets?

• a.Availability zones are primarily designed to protect against application-level software bugs
• b.Availability sets replicate data to entirely different regions
• c.Zones use separate datacenters; sets spread VMs within a single datacenter✓
• d.They are identical and interchangeable concepts

Availability Zones are separate datacenters within a region, protecting against a datacenter failure. Availability sets spread VMs across fault and update domains inside one datacenter. Zones offer stronger, cross-datacenter resilience.

A workload runs briefly only when a file is uploaded, a few times a day. Which compute option is most cost-effective?

• a.A 24/7 AKS cluster with many always-running nodes
• b.A dedicated bare-metal server
• c.A large always-on virtual machine
• d.Azure Functions✓

Azure Functions on the Consumption plan bills only while code runs. For sporadic, event-driven tasks this is very cost-effective. Always-on VMs or clusters would cost far more for the same rare workload.

What is the benefit of deployment slots in Azure App Service?

• a.They store archived blob objects at the lowest possible long-term storage cost
• b.They let you stage and swap app versions with minimal downtime✓
• c.They resolve DNS records faster for the app
• d.They encrypt the connected database automatically

Deployment slots host different versions of an app, such as staging and production. You can validate in staging and then swap with production nearly instantly. This enables safe releases with minimal downtime.

Which statement about a single Azure Virtual Network is correct?

• a.A VNet is a physical hardware device
• b.A VNet can exist without belonging to any subscription
• c.A VNet is scoped to a single region✓
• d.A VNet spans multiple regions automatically by default

A VNet is scoped to one region and one subscription. To connect VNets across regions, you use peering or gateways. Understanding this scope is important for network design.

To connect two VNets over Microsoft's private backbone with low latency, you would use…

• a.the shared public internet with an encrypted tunnel between the two networks
• b.VNet peering✓
• c.the Azure DNS resolution service
• d.a single blob storage container

VNet peering links two virtual networks over Microsoft's backbone with low latency. Traffic stays on the private network, not the public internet. It is commonly used to connect workloads across VNets or regions.

Which feature lets you access a PaaS service like a storage account over a private IP inside your VNet?

• a.Azure Private Link / private endpoint✓
• b.An availability set for the VMs
• c.A ReadOnly resource lock on the account
• d.A publicly routable IP address exposed directly to the open internet at large

Azure Private Link exposes a PaaS service through a private endpoint with a private IP in your VNet. Traffic avoids the public internet. This improves security and simplifies network design.

Azure Blob, File, Queue, and Table services are all offered through what?

• a.An availability set of servers
• b.An Azure storage account✓
• c.A DNS zone resource
• d.A single dedicated virtual machine

These four data services are provided within an Azure storage account. The account defines settings like performance tier and redundancy. It is the top-level container for Azure Storage.

What is a snapshot of an Azure managed disk used for?

• a.Distributing incoming requests across many servers
• b.Resolving domain names for the network
• c.Directly serving high-volume public web traffic to end users worldwide
• d.A point-in-time copy for backup or creating new disks✓

A snapshot captures a disk at a point in time. It can be used for backup or to create new identical disks. Snapshots support recovery and duplication scenarios.

Azure File Sync is primarily used to…

• a.cache Azure file shares on local Windows servers✓
• b.encrypt individual blob objects using customer-managed encryption keys
• c.orchestrate large fleets of containers
• d.route and balance network traffic across regions

Azure File Sync caches Azure file shares on on-premises Windows servers. This gives fast local access while centralizing data in Azure. It supports hybrid file-sharing scenarios.

Azure Cosmos DB supports multiple APIs. Which is one of them?

• a.NoSQL (Core) and MongoDB API✓
• b.An SMB file-sharing protocol API
• c.An RDP remote desktop protocol API
• d.A dedicated SMTP email-sending API for outbound mail delivery

Cosmos DB offers several APIs, including NoSQL (Core), MongoDB, Cassandra, Gremlin, and Table. This lets teams use familiar tools and models. It is a multi-model, globally distributed database.

What does an Azure SQL Database elastic pool allow?

• a.Hosting and orchestrating containers at scale
• b.Performing faster DNS lookups for applications
• c.Storing large unstructured blob objects at the lowest available archive cost
• d.Multiple databases to share a set of resources cost-effectively✓

An elastic pool lets several databases share a common set of resources. Databases with varying, unpredictable usage benefit as capacity is pooled. This can lower cost compared with provisioning each database separately.

Every Microsoft Entra (Azure AD) tenant has a single top-level management group called what?

• a.The root management group✓
• b.The primary billing subscription
• c.The default resource group that is created automatically in each region
• d.The tenant blob container

Each tenant has one root management group at the top of the hierarchy. All other management groups and subscriptions descend from it. Policies applied there can affect the entire tenant.

A benefit of deploying with ARM/Bicep templates is that they are declarative and idempotent, meaning…

• a.they can only ever be run one single time
• b.each separate run randomly changes the resulting configuration in unpredictable ways
• c.they delete all existing resources on every run
• d.applying the same template repeatedly yields the same end state✓

Declarative templates describe the desired end state, not step-by-step commands. Idempotency means running them repeatedly converges to that same state. This makes deployments predictable and repeatable.

To achieve the highest single-region VM availability SLA, you should deploy VMs across what?

• a.One subnet only, without redundancy
• b.One single server placed inside one rack in one datacenter room
• c.Multiple Availability Zones✓
• d.One managed disk shared by all instances

Spreading VMs across multiple Availability Zones protects against a datacenter failure and earns the highest single-region VM SLA. A single server offers no redundancy. Zones provide independent power, cooling, and networking.

Under the Azure Functions Consumption plan, you are billed based on…

• a.the number of executions and resources used while running✓
• b.the color theme selected in the portal
• c.a single flat monthly fee that applies regardless of how much you actually use
• d.the number of DNS records you host

The Consumption plan bills on the number of executions and the resources consumed during each run. When nothing runs, you pay nothing (aside from minor storage). This aligns cost with actual activity.

Which Azure service stores and manages container images?

• a.Azure DNS, which hosts your public domain name records globally
• b.Azure Container Registry✓
• c.Azure Bastion for secure VM access
• d.Azure Key Vault for secrets and certificates

Azure Container Registry stores and manages container images and related artifacts. Services like AKS and ACI pull images from it. It supports private, secure image distribution.

Which Azure service uses DNS to route users to the best endpoint across multiple regions?

• a.Azure Bastion, which provides secure browser-based access to virtual machines
• b.Azure Files for managed file shares
• c.Azure Key Vault for storing secrets
• d.Azure Traffic Manager✓

Azure Traffic Manager is a DNS-based traffic router. It directs users to the most appropriate regional endpoint using routing methods like performance or priority. It improves availability and responsiveness across regions.

Which service provides global HTTP load balancing, acceleration, and a WAF at the network edge?

• a.Azure Queue Storage for asynchronous messaging between application components
• b.Azure DNS for name resolution
• c.Azure Table Storage for NoSQL key-value data
• d.Azure Front Door✓

Azure Front Door provides global HTTP/HTTPS load balancing, acceleration, SSL offload, and an optional WAF at the edge. It routes users to the fastest healthy backend. It is used for global, high-performance web delivery.

How are Network Security Group rules evaluated?

• a.By priority number, with the lowest number processed first✓
• b.In a completely random order that changes on every network connection attempt
• c.Strictly alphabetically by the rule name
• d.Only inbound rules are ever considered

NSG rules are processed in priority order, lowest number first, and the first match applies. Both inbound and outbound rule sets exist. Careful priority ordering ensures the intended allow/deny behavior.

In every Azure subnet, a small number of IP addresses are…

• a.permanently unusable for the life of the subscription
• b.always assigned as publicly routable addresses reachable from the internet
• c.reserved by Azure for internal use✓
• d.assigned exclusively to DNS servers

Azure reserves a few addresses in each subnet (for the network address, gateway, DNS mapping, and broadcast). These cannot be assigned to your resources. You must account for them when sizing subnets.

What does a shared access signature (SAS) provide for Azure Storage?

• a.Completely free storage with no charges
• b.Permanent and unrestricted access to every resource in the storage account forever
• c.A convenient way to delete the entire storage account
• d.Delegated, time-limited access to specific resources✓

A SAS grants delegated, time-bound access to specific storage resources with defined permissions. It avoids sharing the account keys directly. This supports secure, scoped access for clients.

Blob lifecycle management policies help you…

• a.automatically move or delete blobs based on their age✓
• b.encrypt the whole virtual network and all of its attached subnets automatically
• c.resolve domain names more quickly for applications
• d.assign RBAC roles to users at scale

Lifecycle management policies automatically transition blobs to cooler tiers or delete them based on rules like age. This optimizes storage cost over time. It reduces manual data-management work.

Compared with Standard HDD, Premium SSD managed disks offer…

• a.higher performance at a higher cost✓
• b.noticeably lower cost together with noticeably lower input/output performance
• c.no meaningful difference of any kind
• d.the exact same performance for a lower monthly price

Premium SSD delivers higher IOPS and throughput than Standard HDD, at a higher price. You choose disk type based on performance needs and budget. High-performance workloads justify the premium tier.

Azure SQL Managed Instance is best suited for customers who want…

• a.near-full SQL Server compatibility with managed infrastructure✓
• b.a globally distributed NoSQL database with turnkey multi-region replication
• c.a managed container orchestration platform
• d.a global DNS hosting service

SQL Managed Instance offers high compatibility with on-premises SQL Server while Microsoft manages the infrastructure. It eases lift-and-shift migrations that need instance-level features. It bridges IaaS control and PaaS convenience.

Azure Cosmos DB lets you choose among several…

• a.DNS record types for name resolution
• b.consistency levels ranging from strong to eventual✓
• c.virtual machine size families
• d.blob storage access tiers only, such as hot, cool, cold, and archive

Cosmos DB provides tunable consistency levels from strong to eventual. This lets you balance latency, availability, and data freshness. Choosing the right level suits your application's needs.

Before using a service type in a subscription, ARM may require you to register the corresponding…

• a.resource provider✓
• b.DNS zone that hosts the public name records for the organization's domain
• c.blob storage container for objects
• d.availability set for virtual machines

Resource providers supply Azure services (for example, Microsoft.Compute). A provider may need to be registered in a subscription before its resources can be created. ARM manages this registration.

Which statement about moving Azure resources between resource groups is TRUE?

• a.Many resources can be moved, though some have restrictions✓
• b.It permanently deletes the resource being moved
• c.It always changes the region the resource runs in
• d.It is completely impossible for any type of Azure resource under all conditions

Many resources can be moved between resource groups or subscriptions, but some services have limitations. Moving does not change the resource's region. Always check move support before relying on it.

Azure Dedicated Host provides…

• a.a managed NoSQL database for global apps
• b.physical servers dedicated to a single customer's VMs✓
• c.global DNS-based traffic routing
• d.serverless event-driven functions that scale automatically with incoming demand

Azure Dedicated Host gives you physical servers dedicated to your organization's VMs. This supports compliance, licensing, and isolation requirements. You gain visibility and control over the underlying hardware.

Azure App Service can host web apps built in…

• a.only low-level assembly language compiled directly for the host processor
• b.no programming languages at all
• c.multiple languages such as .NET, Java, Node.js, Python, and PHP✓
• d.only the COBOL programming language

App Service supports many popular languages and frameworks, including .NET, Java, Node.js, Python, and PHP. It manages the hosting platform for you. This flexibility suits diverse web workloads.

To deploy a VPN or ExpressRoute gateway, a VNet needs a special subnet called…

• a.DefaultSubnet
• b.PublicSubnet
• c.BlobSubnet
• d.GatewaySubnet✓

A gateway requires a dedicated subnet named GatewaySubnet. Azure places the gateway resources there. Using the exact name is required for the gateway to deploy correctly.

Azure Private DNS zones are used to…

• a.store container images for deployment
• b.resolve names privately for resources inside your virtual networks✓
• c.assign RBAC roles to users
• d.host only public-facing marketing websites that anyone on the internet can reach

Private DNS zones provide name resolution within and between VNets without exposing records publicly. They support custom domain names for internal resources. This keeps internal naming private and manageable.

Which blob storage feature helps meet compliance by preventing data from being modified or deleted for a set period?

• a.Automatic autoscaling of the storage account
• b.Virtual network peering between two networks
• c.The hot access tier, which is optimized for frequently accessed active data
• d.Immutable (WORM) storage policies✓

Immutable, write-once-read-many (WORM) policies prevent blobs from being changed or deleted for a defined period. This helps meet regulatory retention requirements. It protects critical records from tampering.

A benefit of Azure managed disks over manually managing storage accounts for VM disks is…

• a.you must manually create and manage all of the underlying storage accounts yourself
• b.Azure handles the underlying storage accounts for you✓
• c.disks cannot be resized after creation
• d.no redundancy options are available for them

Managed disks let Azure handle the underlying storage accounts, simplifying management. You just specify disk type and size. They also improve reliability and scaling compared with unmanaged disks.

What is the relationship between a Microsoft Entra tenant and Azure subscriptions?

• a.A tenant can be associated with many subscriptions, but each subscription trusts one tenant✓
• b.Each tenant is permitted to have only one single subscription associated with it, ever
• c.Subscriptions and tenants are exactly the same thing
• d.Tenants are physical servers in a datacenter

A Microsoft Entra tenant is an identity boundary that can hold many subscriptions. Each subscription trusts exactly one tenant for authentication. This separates identity from billing and resource management.

Which ordering reflects increasing abstraction (less infrastructure to manage) for compute?

• a.Virtual machines are the most abstracted option
• b.VMs, then App Service, then Functions✓
• c.Azure Functions first, then App Service, and finally virtual machines at the end
• d.App Service is less abstracted than virtual machines

VMs (IaaS) require the most management, App Service (PaaS) less, and Functions (serverless) the least. Moving along this order, you manage less infrastructure. Choosing the right level balances control and simplicity.

To protect stored data against a complete regional outage, which redundancy level is the minimum needed?

• a.ZRS, which keeps copies within one region
• b.GRS or GZRS (geo-redundant)✓
• c.LRS, which keeps copies in one datacenter
• d.Premium solid-state disks configured for the highest possible database throughput

Protecting against a full regional outage requires geo-redundant storage (GRS or GZRS), which replicates to a second region. LRS and ZRS stay within one region. Geo-redundancy adds cross-region durability.

In Azure Cosmos DB, provisioned throughput is measured in…

• a.gigabytes transferred per second across the global replication network
• b.Request Units per second (RU/s)✓
• c.the number of DNS queries answered
• d.the count of virtual CPUs assigned

Cosmos DB measures throughput in Request Units per second (RU/s). RUs abstract the CPU, memory, and IOPS needed for operations. You provision or autoscale RU/s to match workload demand.

How can Azure App Service handle increased web traffic automatically?

• a.By deleting the app to reduce the load on servers
• b.By reducing available memory down to zero
• c.By turning off the connected database to conserve resources during peak traffic
• d.By scaling out to more instances based on rules✓

App Service can scale out automatically, adding instances when rules or metrics indicate higher demand. It scales back in when demand falls. This keeps performance steady while managing cost.

Which service provides outbound-only internet connectivity with a stable public IP for resources in a subnet?

• a.Azure Key Vault for secrets and certificates
• b.Azure NAT Gateway✓
• c.Azure DNS for resolving domain names
• d.Azure Bastion, providing secure browser-based RDP and SSH into virtual machines

Azure NAT Gateway provides scalable outbound internet connectivity with a consistent public IP. Resources initiate outbound traffic without needing individual public IPs. Inbound connections are not allowed through it.

How can you restrict a storage account so only specific networks can reach it?

• a.Add several additional DNS records
• b.Move all blobs to the archive access tier
• c.Configure storage firewall and virtual network rules✓
• d.Delete the entire storage account and recreate it in a different Azure region

Storage account firewalls and virtual network rules restrict access to selected networks or IP ranges. Combined with private endpoints, they limit exposure. This strengthens the security of stored data.

By default, data in Azure managed disks and Storage is protected with…

• a.encryption applied only to blob objects and never to any virtual machine disks
• b.encryption only if you purchase a separate add-on
• c.encryption at rest using Storage Service Encryption✓
• d.no encryption of any kind

Azure encrypts data at rest by default using Storage Service Encryption. This applies to Storage and managed disks without extra configuration. You can also use customer-managed keys for more control.

What is an Azure geography?

• a.A billing currency used on invoices
• b.A discrete market, often a country, containing one or more regions for data residency✓
• c.A single physical server installed within one specific rack inside a datacenter room
• d.A particular virtual machine size family

An Azure geography is a discrete market, typically aligning with a country, that contains one or more regions. Geographies preserve data residency and compliance boundaries. Region pairs stay within the same geography.

Can a resource group in one region contain resources located in other regions?

• a.Yes, resources in a group can reside in different regions✓
• b.Only when the resources are in the same server rack
• c.Only if all of the resources involved happen to be blob storage objects specifically
• d.No, this is never possible under any circumstances

A resource group has its own metadata location, but the resources it contains can live in different regions. The group is a logical, not physical, boundary. This gives flexibility in organizing resources.

Which App Service tier provides a fully isolated, dedicated environment for high scale and security?

• a.The Free tier for small test apps
• b.The cool storage tier for infrequent data
• c.The Isolated (App Service Environment) tier✓
• d.The archive access tier used for rarely accessed long-term storage of blob data

The Isolated tier, using an App Service Environment, runs apps in a dedicated, network-isolated environment. It supports high scale and stricter security. It suits workloads with demanding compliance needs.

For running many interdependent microservices with automated scaling and self-healing, which is most appropriate?

• a.One standalone Azure Container Instance
• b.A single Azure Function triggered occasionally by an incoming HTTP request only
• c.A single static blob in storage
• d.Azure Kubernetes Service (AKS)✓

AKS orchestrates many containers with automated scaling, rolling upgrades, and self-healing. It suits complex microservices architectures. ACI or a single Function is better for simpler, isolated tasks.

An Azure VM typically has an OS disk, optional data disks, and a…

• a.queue disk for messages
• b.blob disk for object storage
• c.DNS disk used specifically for hosting the machine's public domain records
• d.temporary disk✓

An Azure VM has an OS disk, optional data disks, and a temporary disk for short-lived data like a page file. The temporary disk is not persistent and can be lost on deallocation. Persistent data belongs on managed disks.