Azure Fundamentals (AZ-900) — All Questions

Where can you review Microsoft's independent compliance certifications, such as ISO 27001 or SOC reports?

• a.A Network Security Group
• b.The Service Trust Portal (Microsoft's Trust Center)✓
• c.The Azure Pricing Calculator
• d.The Azure mobile app installed on phones and tablets

The Service Trust Portal and Trust Center publish Microsoft's certifications and audit documentation for customers and auditors. They demonstrate the compliance foundation Microsoft provides.

Microsoft Purview can automatically apply what to help protect sensitive information?

• a.Redundant availability zones inside a single region
• b.Network security group rules
• c.Virtual machine scale sets
• d.Data classifications and sensitivity labels✓

Purview scans data sources and can classify content and apply sensitivity labels, making it easier to govern and protect regulated data. Classification is the basis for downstream policies and reporting.

Every Microsoft Entra tenant in Azure has a single top-level management group known as what?

• a.The default resource group
• b.The root management group (Tenant Root Group)✓
• c.The global administrator account
• d.The organization's primary billing subscription

All management groups roll up to one built-in root management group at the top of the hierarchy. Policies or access assigned there can be inherited by every subscription in the tenant.

When does Azure Policy evaluate resources for compliance?

• a.Only when a user manually deletes a resource
• b.Only once, on the day the policy is written
• c.When a resource is created or updated, and again during periodic compliance scans✓
• d.Only once per month, at the moment the monthly invoice for the subscription is generated

Policy evaluates at resource creation/update and on a recurring schedule so existing resources are also assessed. This keeps the compliance picture current as your environment changes.

In cloud governance, what is the overarching goal?

• a.Making every resource publicly accessible
• b.Ensuring resources are used consistently, securely, and in line with organizational standards✓
• c.Guaranteeing that no resource is ever deleted
• d.Eliminating the need for any ongoing monitoring, logging, or auditing across the entire environment

Governance is about maintaining control, consistency, and compliance as an environment grows. Tools like Policy, RBAC, locks, and Blueprints implement that control at scale.

Do Azure resources automatically inherit tags from their parent resource group?

• a.Yes, but only the very first tag on the resource group is ever inherited by its resources
• b.Yes, every tag on a resource group is copied to its resources automatically
• c.No, and tags cannot be enforced in any way
• d.No; tags are not inherited by default, though Azure Policy can be used to enforce them✓

By default a resource does not pick up its resource group's tags automatically. To standardize tagging you can use Azure Policy effects such as Modify or Append to add required tags.

Azure Blueprints can lock the resources it deploys in order to do what?

• a.Reduce the cost of the deployed resources
• b.Automatically translate the resources to another language
• c.Prevent tampering or unauthorized changes to the governed resources✓
• d.Speeding up query performance on all of the databases within the group

Blueprint locking protects deployed resources so that even privileged users cannot alter or delete them, preserving the governed baseline. This enforces the intended configuration after deployment.

What is the purpose of a remediation task in Azure Policy?

• a.To delete the policy definition permanently
• b.To bring existing non-compliant resources into compliance with a policy✓
• c.To generate an invoice for policy usage
• d.To create an entirely new subscription and resource group within the tenant

Remediation tasks apply corrective effects (like Modify or DeployIfNotExists) to resources that already exist and are non-compliant. This fixes drift without recreating the resources.

The regulatory compliance dashboard in Microsoft Defender for Cloud maps your security posture against what?

• a.Industry and regulatory standards such as ISO 27001 or PCI DSS✓
• b.The current number of descriptive tags applied to each individual resource
• c.The current price of your subscription
• d.The physical distance between datacenters

Defender for Cloud can assess your environment against built-in regulatory standards and show where you fall short. This helps demonstrate and improve compliance against frameworks you must meet.

Even a user with the Owner role cannot delete a resource in which situation?

• a.When the resource is in a different region
• b.When a CanNotDelete lock is applied to the resource✓
• c.When the targeted resource has more than five tags applied to it
• d.When the subscription has a budget defined

Resource locks override RBAC permissions, so a CanNotDelete lock blocks deletion regardless of a user's role. The lock must be removed first, which itself requires appropriate permissions.

Which Azure Policy effect can automatically deploy a related resource when it is found to be missing?

• a.Deny
• b.Audit
• c.DeployIfNotExists✓
• d.Disabled

DeployIfNotExists triggers a deployment to add a required companion resource (for example, a diagnostic setting) when it is absent. It enforces standards by provisioning the missing piece rather than just blocking.

Azure provides many ready-made policy definitions so you do not have to write your own. These are called what?

• a.Deprecated policy definitions
• b.Built-in policy definitions✓
• c.Locked policy definitions
• d.Custom policy definitions

Built-in policies cover common governance needs, such as allowed locations or required tags, and can be assigned directly. Custom definitions are only needed when built-ins do not cover a specific requirement.

What does a tag applied to an Azure resource consist of?

• a.A name (key) paired with a value✓
• b.A single number assigned by Azure automatically
• c.A physical barcode on the server
• d.An encryption certificate

Each tag is a key-value pair, such as environment=production, that adds descriptive metadata. Consistent key-value tagging powers cost reporting, organization, and policy enforcement.

What is the primary benefit of organizing subscriptions into a management group hierarchy?

• a.It physically relocates the datacenters closer together
• b.Governance such as policy and access can be applied once and inherited by all subscriptions beneath it✓
• c.It automatically doubles the compute capacity
• d.It completely removes the need to use resource groups or subscriptions anywhere in the entire organization

Management groups let you assign Azure Policy and RBAC at a higher level so every subscription under them inherits the settings. This provides consistent governance across a large, multi-subscription organization.

At which scopes can an Azure Policy assignment be applied?

• a.Only on storage accounts created within the subscription
• b.Only at the level of an individual user account
• c.Management group, subscription, or resource group✓
• d.Only at the global Azure level for all customers

Policy can be assigned at a management group, subscription, or resource group, and it applies to everything within that scope. Broader scopes are inherited downward, enabling wide or targeted enforcement.

What is the Purview data map?

• a.A foundation that captures metadata about an organization's data assets across sources✓
• b.A network diagram of Azure regions
• c.A pricing sheet for storage services
• d.A prioritized list of recommended virtual machine sizes and pricing tiers for each workload

The data map is the underlying inventory in Purview that records metadata about scanned data assets. It enables discovery, lineage, and classification across the data estate.

Who primarily benefits from the documents available in the Service Trust Portal?

• a.End users trying to reset their passwords
• b.Customers estimating the price of a service
• c.Developers who are actively deploying and configuring a new virtual machine in the portal
• d.Auditors and compliance teams who need Microsoft's audit reports and certifications✓

The Service Trust Portal serves compliance, risk, and audit professionals verifying Microsoft's controls. It centralizes the evidence organizations need to satisfy their own regulators.

What does publishing a blueprint definition allow you to do?

• a.Assign a specific, versioned copy of the blueprint to a subscription✓
• b.Delete all existing subscriptions automatically
• c.To disable all Azure Policy enforcement across the entire organization's tenant
• d.Convert the blueprint into a virtual machine

Publishing creates a versioned blueprint that can then be assigned to subscriptions, deploying its artifacts consistently. Versioning lets you evolve the governance package over time in a controlled way.

Why would an organization group several policies into a single initiative?

• a.To automatically convert existing policy definitions into equivalent RBAC role assignments for users
• b.To simplify assignment and get one combined compliance view for a set of related policies✓
• c.To make each policy cost less to run
• d.To hide non-compliant resources from reporting

Grouping policies into an initiative means you assign and monitor them together, which is far easier for a broad standard than managing dozens of separate policies. Compliance is then reported at the initiative level.

Where can a custom Azure Policy definition be stored so it can be reused across scopes?

• a.Only inside a single virtual machine's disk
• b.Only inside a single public GitHub source-code repository shared with the community
• c.At a management group or subscription, so it can be assigned to child scopes✓
• d.Only within a Network Security Group

Custom policy definitions are saved at a management group or subscription scope, from which they can be assigned to that scope and everything beneath it. Storing at a management group maximizes reuse across many subscriptions.

Microsoft Entra ID was previously known by what name?

• a.Azure Resource Manager
• b.Azure Key Vault
• c.Windows Server Active Directory only
• d.Azure Active Directory (Azure AD)✓

Microsoft rebranded Azure Active Directory as Microsoft Entra ID. It remains Microsoft's cloud identity and access management service for signing in and securing access to resources.

In identity and access management, what does 'authentication' establish?

• a.How much a user's activity will cost
• b.What actions a user is permitted to perform
• c.Who a user is, by verifying their identity✓
• d.Which region a user's data is stored in

Authentication (AuthN) confirms identity, typically through credentials or factors like a password plus a phone prompt. It answers 'who are you?' before any access decision is made.

What does 'authorization' determine after a user has signed in?

• a.What resources and actions the authenticated user is allowed to access✓
• b.Whether the user's password is spelled correctly
• c.Which datacenter the user physically visited
• d.How fast the user's home internet network connection currently happens to be

Authorization (AuthZ) decides what an already-authenticated identity may do, such as read a file or manage a VM. In Azure, RBAC is the primary mechanism for authorization.

In an access request, which process happens first?

• a.Authentication happens first, then authorization✓
• b.Neither is required if the user is inside the corporate network
• c.They always happen at exactly the same instant with no order
• d.Authorization happens first, then authentication

You must first prove who you are (authentication) before the system can decide what you may do (authorization). Getting this order right is fundamental to secure access.

What does multifactor authentication (MFA) require from a user?

• a.Two or more verification factors of different types✓
• b.Only the user's email address
• c.A single password that is simply very long and complex
• d.Two passwords that are exactly the same

MFA combines factors from different categories, such as something you know plus something you have or are. Requiring multiple factors greatly reduces the risk from a stolen password.

Which of the following is an example of the 'something you have' authentication factor?

• a.A fingerprint scan or other biometric reading taken from the user
• b.A security question answer
• c.A code from a phone authenticator app or a hardware token✓
• d.A memorized password

'Something you have' refers to a possession like a phone, authenticator app, or hardware key. A password is 'something you know' and a fingerprint is 'something you are.'

What threat does multifactor authentication most directly protect against?

• a.Accidental overspending against a defined subscription cost budget
• b.High network latency between regions
• c.Physical damage to the datacenter
• d.Unauthorized access when a password has been compromised✓

Even if an attacker steals a password, MFA blocks them because they lack the second factor. This makes MFA one of the most effective single controls against account takeover.

What does Conditional Access in Microsoft Entra ID let an organization do?

• a.Estimate the cost of future deployments
• b.Provision virtual machines automatically
• c.Store and serve large amounts of unstructured object and blob data across many regions
• d.Enforce access controls based on signals such as user, location, device, and risk✓

Conditional Access evaluates signals at sign-in and then applies controls, like requiring MFA or a compliant device. It brings access decisions in line with real-world risk.

Which is a realistic example of a Conditional Access policy?

• a.Changing the portal theme based on the time of day
• b.Automatically deleting a user's files after each login
• c.Requiring MFA when a user signs in from an unfamiliar or untrusted location✓
• d.Automatically doubling the storage redundancy tier each time a user signs into the app

A typical Conditional Access rule strengthens verification for risky conditions, such as sign-ins from unexpected locations. This lets low-risk access stay frictionless while high-risk access is challenged.

How do Azure RBAC roles and Microsoft Entra ID roles differ in what they control?

• a.They are completely identical, fully interchangeable features that control exactly the same scope of access across Azure
• b.Azure RBAC roles control access to Azure resources, while Entra ID roles control identity and directory tasks✓
• c.Entra ID roles control network bandwidth while RBAC controls encryption
• d.RBAC controls billing while Entra roles control storage tiers

Azure RBAC governs actions on resources like VMs and storage, whereas Entra ID (directory) roles govern tasks like managing users and groups. Understanding the split prevents over- or under-granting access.

Which of the following is an example of passwordless authentication?

• a.Signing in with Windows Hello, a FIDO2 security key, or the Microsoft Authenticator app✓
• b.Emailing your current account password to yourself so you can retrieve it later for safekeeping
• c.Writing the password on a sticky note
• d.Typing a long password followed by a PIN

Passwordless methods verify identity without a typed password, using biometrics, a security key, or an app approval. They improve both security and user experience by removing the weakest link.

What is a core guiding principle of the Zero Trust security model?

• a.Grant every user administrator access by default
• b.Never trust, always verify each request explicitly✓
• c.Disable authentication for internal applications
• d.Trust any request that originates inside the corporate network

Zero Trust assumes no implicit trust based on network location and verifies every request. It combines explicit verification, least-privilege access, and an assume-breach mindset.

Which set of ideas represents the guiding principles of Zero Trust?

• a.Granting broad standing access, disabling MFA, and hiding all of the alerts
• b.Encrypt nothing, allow legacy protocols, and trust every device
• c.Trust the network, share all credentials, and skip logging
• d.Verify explicitly, use least-privilege access, and assume breach✓

Zero Trust rests on verifying every request, granting only the minimum access needed, and designing as though a breach has already happened. These principles reduce both the likelihood and impact of compromise.

What does a defense-in-depth security strategy rely on?

• a.Trusting all internal traffic without inspection
• b.Removing all authentication requirements in order to simplify user access
• c.A single strong firewall as the only protection
• d.Multiple layers of controls so no single failure exposes everything✓

Defense in depth stacks independent controls, so if one layer is bypassed, others still protect the asset. Each layer slows or stops an attacker, buying time to detect and respond.

Which of the following represents a layer in the defense-in-depth model?

• a.The identity and access layer✓
• b.The portal color-theme layer
• c.The invoice generation layer
• d.The resource naming and tagging layer

Defense in depth includes layers such as physical, identity/access, perimeter, network, compute, application, and data. Identity is a critical layer, often called the modern security perimeter.

What does the Secure Score in Microsoft Defender for Cloud help you do?

• a.Encrypt data automatically without configuration
• b.Calculate the exact monthly bill for compute
• c.Automatically choosing whichever Azure region has the lowest network latency
• d.Measure your current security posture and track improvements over time✓

Secure Score summarizes how well your environment follows security best practices and rises as you remediate recommendations. It gives teams a clear, trackable target for hardening.

Conditional Access is a capability of which Microsoft Entra ID licensing level?

• a.A tier that is exclusive to on-premises Active Directory
• b.The free tier available to everyone
• c.A premium tier (Entra ID P1 or P2)✓
• d.A tier included only with virtual machines

Conditional Access requires an Entra ID premium license rather than the free tier. Organizations that need risk-based access controls plan for the appropriate licensing.

What does Microsoft Entra B2B collaboration enable?

• a.Migrating virtual machines between regions
• b.Automatically encrypting all blob storage data while it is at rest in every region
• c.Automatically lowering your Azure bill
• d.Inviting external guest users to securely access your organization's resources✓

Entra B2B lets you invite partners and vendors as guest identities so they can access shared apps and resources without a separate account in your systems. You control what those guests can reach.

What is Microsoft Entra External ID (formerly Azure AD B2C) primarily used for?

• a.Managing identity and sign-in for customer-facing (consumer) applications✓
• b.Provisioning Azure virtual networks
• c.Managing internal employee payroll
• d.Storing and serving very large media, image, and video files for applications

External ID / B2C provides customizable sign-up and sign-in experiences for the customers of an app. It keeps consumer identities separate from an organization's internal workforce directory.

In Microsoft Entra ID, what does a 'tenant' represent?

• a.A single virtual machine running the directory
• b.A monthly billing invoice generated for identity and directory services
• c.A physical rack of servers in one datacenter
• d.A dedicated, isolated instance of the directory for an organization✓

A tenant is an organization's own isolated directory instance, containing its users, groups, and app registrations. Each tenant is logically separated from every other organization's directory.

What does Privileged Identity Management (PIM) in Microsoft Entra ID provide?

• a.Free virtual machines for administrators
• b.The automatic scheduled deletion of all inactive guest user accounts each month
• c.Just-in-time, time-bound privileged access that can require approval✓
• d.Permanent administrator rights for all users

PIM reduces standing privilege by granting elevated roles only when needed, for a limited time, often with approval and auditing. This shrinks the window in which powerful permissions can be misused.

What do Microsoft Entra ID security defaults primarily do?

• a.Move all of the organization's data into one single centralized region
• b.Enforce baseline protections, such as requiring MFA for users✓
• c.Disable all sign-in requirements for convenience
• d.Automatically buy reservations to save money

Security defaults turn on a set of preconfigured, sensible protections like MFA and blocking legacy authentication. They give organizations a strong baseline without building custom policies.

In cloud security, identity is frequently described as the new what?

• a.Billing boundary
• b.The archived cool storage tier layer
• c.Security perimeter✓
• d.Physical firewall

Because users and services connect from anywhere, controlling identity has become the primary boundary rather than the network edge. This shift underpins Zero Trust thinking.

What is an advantage of assigning an Azure role to a group rather than to individual users?

• a.It completely removes the need for any form of user authentication entirely
• b.It automatically encrypts all resources
• c.It makes each user's access completely invisible
• d.It simplifies access management and scales better as membership changes✓

Assigning roles to groups means you manage access by adding or removing members rather than editing many individual assignments. This reduces errors and administrative effort at scale.

The lifecycle of a system-assigned managed identity is tied to what?

• a.A password stored in the application code
• b.The Azure resource on which it is enabled✓
• c.The region's availability zones
• d.The billing account's payment method

A system-assigned managed identity is created with its resource and deleted when that resource is deleted. This tight lifecycle removes the burden of managing credentials separately.

Which signal can a Conditional Access policy evaluate when deciding whether to allow access?

• a.Sign-in risk, device state, location, or the application being accessed✓
• b.The individual user's personally preferred favorite color and portal theme
• c.The number of tags on a resource group
• d.The current price of a virtual machine

Conditional Access weighs signals like user and sign-in risk, device compliance, location, and the target app. Based on those, it can allow, block, or require additional controls such as MFA.

How do single sign-on (SSO) and multifactor authentication (MFA) complement each other?

• a.SSO encrypts data while MFA provisions servers
• b.They are exactly the same feature simply offered under two different marketing names with no real difference
• c.SSO reduces the number of logins for convenience, while MFA adds verification factors for security✓
• d.MFA removes the need to ever authenticate again

SSO improves usability by letting one authentication grant access to many apps, and MFA strengthens that single authentication with extra factors. Used together, they balance convenience and strong security.

What does cloud security posture management (CSPM) in Microsoft Defender for Cloud focus on?

• a.Provisioning and configuring brand-new virtual networks and their subnets automatically
• b.Translating documentation into other languages
• c.Reducing the price of storage accounts
• d.Finding misconfigurations and continuously improving your security posture✓

CSPM continuously assesses resources for weaknesses and misconfigurations and recommends fixes, feeding the Secure Score. It helps prevent breaches by closing gaps before they are exploited.

How does the Zero Trust model differ from the traditional 'castle-and-moat' network approach?

• a.It only applies to physical building security
• b.It trusts all internal and external traffic equally without checks
• c.It does not automatically trust a request just because it originates inside the network✓
• d.It completely removes the need for any user accounts or sign-in credentials across the organization

The old model trusted anything inside the perimeter; Zero Trust verifies every request regardless of origin. This reflects modern reality where users and threats can be anywhere.

How does just-in-time (JIT) VM access in Microsoft Defender for Cloud reduce risk?

• a.It automatically doubles the virtual machine's compute and memory capacity each time a session opens
• b.It permanently opens all ports for convenience
• c.It opens management ports only when needed, for a limited time, instead of leaving them always open✓
• d.It deletes the virtual machine after each session

JIT access keeps management ports closed until a user requests time-limited access, shrinking the attack surface. Leaving RDP or SSH always open is a common source of compromise that JIT mitigates.