Azure Fundamentals (AZ-900) — All Questions

In Azure, what is the primary purpose of a resource group?

• a.It is a billing currency
• b.It is a physical server rack
• c.It is a network firewall device
• d.It is a logical container that holds related Azure resources for management as a unit✓

A resource group is a logical container used to organize and manage related Azure resources together. Resources in a group typically share the same lifecycle, such as being deployed, updated, and deleted together. It also serves as a scope for applying permissions and policies.

What does an Azure region represent?

• a.A billing account
• b.A type of virtual machine
• c.A single physical server
• d.A set of datacenters deployed within a defined geographic area, connected by a low-latency network✓

An Azure region is a geographic area containing one or more datacenters networked together with low latency. Customers choose regions to place resources close to users and to meet data-residency needs. Region selection affects performance, cost, and available services.

What are Availability Zones within an Azure region designed to protect against?

• a.Incorrect billing charges
• b.Datacenter-level failures, by providing physically separate locations with independent power and networking✓
• c.Software bugs in your application
• d.Expired user passwords

Availability Zones are physically separate datacenters within a region, each with independent power, cooling, and networking. Distributing resources across zones protects applications from the failure of a single datacenter. This improves high availability within a single region.

Which Azure service provides on-demand, scalable virtual machines that you fully control at the operating system level?

• a.Azure App Service
• b.Azure Virtual Machines✓
• c.Azure Blob Storage
• d.Azure Functions

Azure Virtual Machines is an IaaS offering that lets you run and control full virtual servers in the cloud. You choose the OS, size, and installed software, and you manage patching and configuration. It suits workloads needing maximum control or custom environments.

Which Azure service is a fully managed platform for hosting web applications and APIs without managing the underlying servers?

• a.Azure App Service✓
• b.Azure Virtual Machines
• c.Azure Blob Storage
• d.Azure Virtual Network

Azure App Service is a PaaS offering for building and hosting web apps, REST APIs, and mobile backends. It manages the infrastructure, patching, and scaling so developers focus on code. It supports multiple languages and integrates with CI/CD pipelines.

Which Azure service lets you run small pieces of code (functions) without provisioning or managing servers, billed only while the code runs?

• a.Azure Functions✓
• b.Azure SQL Database
• c.Azure Kubernetes Service
• d.Azure Virtual Machines

Azure Functions is a serverless compute service that runs event-triggered code without managing infrastructure. You are billed based on executions and resource consumption while the function runs. It is ideal for lightweight, event-driven, or intermittent workloads.

Which Azure storage service is optimized for storing massive amounts of unstructured data such as images, videos, and backups?

• a.Azure SQL Database
• b.Azure Virtual Network
• c.Azure Blob Storage✓
• d.Azure Files

Azure Blob Storage is designed for large volumes of unstructured object data like media files, documents, and backups. It offers tiers (hot, cool, archive) to balance cost and access frequency. It is accessible over HTTP/HTTPS from anywhere.

Which Azure service provides fully managed file shares accessible over the SMB and NFS protocols?

• a.Azure Table Storage
• b.Azure Queue Storage
• c.Azure Files✓
• d.Azure Blob Storage

Azure Files offers managed cloud file shares that can be mounted by cloud or on-premises machines using SMB or NFS. It is useful for lift-and-shift scenarios and shared application data. Multiple systems can access the same files concurrently.

What is the primary function of an Azure Virtual Network (VNet)?

• a.It hosts serverless functions
• b.It provides an isolated, private network in Azure for resources to securely communicate✓
• c.It stores unstructured blobs
• d.It manages user identities

An Azure Virtual Network (VNet) is the fundamental building block for private networking in Azure. It lets resources such as VMs communicate securely with each other, the internet, and on-premises networks. VNets support subnets, routing, and network security controls.

Which service is Microsoft's cloud-based identity and access management solution used to sign in and access resources?

• a.Microsoft Entra ID✓
• b.Azure Virtual Machines
• c.Azure Monitor
• d.Azure Blob Storage

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity and access management service. It authenticates users and controls access to applications and Azure resources. It supports single sign-on, multifactor authentication, and conditional access.

Which Azure networking service acts as a load balancer that distributes incoming traffic across multiple backend resources?

• a.Azure Functions
• b.Azure Blob Storage
• c.Microsoft Entra ID
• d.Azure Load Balancer✓

Azure Load Balancer distributes inbound network traffic across a pool of backend resources such as virtual machines. This improves availability and scalability by preventing any single resource from being overwhelmed. It operates at the transport layer (Layer 4).

Which service securely connects an on-premises network to Azure over an encrypted tunnel across the public internet?

• a.Azure Functions
• b.Azure VPN Gateway✓
• c.Azure Blob Storage
• d.Azure Policy

Azure VPN Gateway establishes encrypted site-to-site or point-to-site connections between on-premises networks and Azure VNets over the internet. It secures traffic using IPsec/IKE tunnels. It is a common choice for hybrid connectivity when a private circuit is not required.

Which Azure service provides a dedicated, private connection from your on-premises network to Azure that does not traverse the public internet?

• a.Azure VPN Gateway
• b.Azure ExpressRoute✓
• c.Azure Blob Storage
• d.Azure DNS

Azure ExpressRoute creates a private, dedicated connection between on-premises infrastructure and Azure through a connectivity provider. Because traffic bypasses the public internet, it offers more reliability, consistent latency, and higher security. It suits large-scale or mission-critical hybrid workloads.

Which Azure service is a fully managed relational database based on the SQL Server engine?

• a.Azure Files
• b.Azure Blob Storage
• c.Azure Cosmos DB
• d.Azure SQL Database✓

Azure SQL Database is a fully managed PaaS relational database built on the SQL Server engine. Microsoft handles patching, backups, and high availability, reducing administrative work. It is ideal for applications needing a managed relational data store.

Which Azure service is a globally distributed, multi-model NoSQL database designed for low-latency access at planetary scale?

• a.Azure SQL Database
• b.Azure Blob Storage
• c.Azure Cosmos DB✓
• d.Azure Files

Azure Cosmos DB is a globally distributed NoSQL database offering low latency and elastic scalability. It supports multiple data models and APIs and can replicate data across regions. It is suited to globally responsive applications needing guaranteed performance.

What is the purpose of a subnet within an Azure Virtual Network?

• a.It segments the VNet's IP address space to organize and isolate groups of resources✓
• b.It manages user passwords
• c.It stores backup files
• d.It provides serverless compute

A subnet divides a VNet's address range into smaller segments, letting you group and isolate resources. Segmentation improves security and organization, for example separating web and database tiers. Network security rules can be applied at the subnet level.

Which Azure service provides a container orchestration platform for deploying and managing containerized applications at scale?

• a.Azure DNS
• b.Azure Kubernetes Service (AKS)✓
• c.Azure Blob Storage
• d.Azure SQL Database

Azure Kubernetes Service (AKS) is a managed Kubernetes offering for orchestrating containerized workloads. It automates cluster management tasks such as scaling and upgrades. It is used to run microservices and portable containerized applications efficiently.

Which Azure service lets you run individual containers quickly without managing virtual machines or orchestrators?

• a.Azure Blob Storage
• b.Azure Kubernetes Service
• c.Azure Container Instances (ACI)✓
• d.Azure Virtual Machines

Azure Container Instances (ACI) runs containers on demand without provisioning or managing underlying servers or orchestration. It is ideal for simple, short-lived, or burst workloads. You pay per second for the compute resources the container consumes.

What does a Network Security Group (NSG) do in Azure?

• a.It manages billing alerts
• b.It hosts web applications
• c.It stores relational data
• d.It filters inbound and outbound network traffic to resources using allow/deny rules✓

A Network Security Group contains security rules that allow or deny network traffic to and from Azure resources such as VMs and subnets. Rules are based on source, destination, port, and protocol. NSGs are a core tool for controlling network-level access.

Which Azure service provides scalable, name-resolution (DNS) hosting for your domains within Azure?

• a.Azure Blob Storage
• b.Azure Policy
• c.Azure Functions
• d.Azure DNS✓

Azure DNS hosts your domain's DNS records on Microsoft's global network of name servers. It provides fast, reliable name resolution using Azure's infrastructure. You manage DNS records with the same tools and credentials as other Azure resources.

What is the main benefit of using availability sets for virtual machines in Azure?

• a.They encrypt all stored data
• b.They provide serverless functions
• c.They reduce the cost of storage
• d.They distribute VMs across fault and update domains to reduce the impact of hardware failures and maintenance✓

Availability sets group VMs across multiple fault domains and update domains within a datacenter. This ensures that hardware failures or planned maintenance affect only a subset of the VMs. As a result, the application stays available during such events.

Which Azure storage redundancy option keeps multiple copies of your data within a single datacenter?

• a.Read-access geo-redundant storage (RA-GRS)
• b.Locally redundant storage (LRS)✓
• c.Geo-redundant storage (GRS)
• d.Zone-redundant storage (ZRS)

Locally redundant storage (LRS) replicates data three times within a single physical location in the primary region. It is the lowest-cost option but does not protect against a datacenter-wide outage. Higher redundancy tiers spread copies across zones or regions.

Which storage redundancy option replicates data to a secondary region hundreds of miles away for regional disaster protection?

• a.Locally redundant storage (LRS)
• b.Premium SSD
• c.Geo-redundant storage (GRS)✓
• d.Zone-redundant storage (ZRS)

Geo-redundant storage (GRS) copies data to a secondary region far from the primary one. This protects against a complete regional outage such as a natural disaster. It offers the highest durability among the standard redundancy options.

What is Azure Blob Storage's 'archive' access tier best suited for?

• a.Real-time streaming video
• b.Rarely accessed data that can tolerate retrieval latency, stored at the lowest cost✓
• c.Active database files
• d.Frequently accessed transactional data

The archive tier stores data offline at the lowest cost, intended for long-term retention of rarely accessed data. Retrieving archived data takes time (rehydration) and incurs higher access costs. It suits compliance archives and backups that are seldom read.

Which Azure service provides a global content delivery network (CDN) to cache content closer to users?

• a.Microsoft Entra ID
• b.Azure Functions
• c.Azure SQL Database
• d.Azure Content Delivery Network (CDN)✓

Azure CDN caches static content at edge locations around the world, delivering it from a point of presence near each user. This reduces latency and offloads traffic from the origin. It improves performance for websites, media, and downloads.

Which Azure networking service provides a Layer 7 (application layer) load balancer with features like URL-based routing and web application firewall?

• a.Azure Blob Storage
• b.Azure Load Balancer
• c.Azure DNS
• d.Azure Application Gateway✓

Azure Application Gateway is a web traffic load balancer operating at Layer 7 (the application layer). It supports URL-based routing, SSL termination, and an optional Web Application Firewall (WAF). This makes it suited to advanced HTTP/HTTPS routing scenarios.

What is the role of a management group in the Azure resource hierarchy?

• a.It hosts virtual machines
• b.It provides DNS resolution
• c.It organizes multiple subscriptions together so governance can be applied across them✓
• d.It stores blob data

A management group sits above subscriptions in the Azure hierarchy and groups them for unified governance. Policies and access assignments applied to a management group flow down to all subscriptions within it. This simplifies management for organizations with many subscriptions.

Which statement correctly orders the Azure resource hierarchy from broadest to narrowest scope?

• a.Management group, subscription, resource group, resource✓
• b.Resource, resource group, subscription, management group
• c.Subscription, management group, resource, resource group
• d.Resource group, resource, subscription, management group

The Azure hierarchy from broadest to narrowest is management group, then subscription, then resource group, then individual resource. Governance settings applied at a higher level are inherited by everything beneath. Understanding this order is essential for scoping policy and access.

Which Azure service provides secure storage and management of secrets, keys, and certificates?

• a.Azure DNS
• b.Azure Functions
• c.Azure Blob Storage
• d.Azure Key Vault✓

Azure Key Vault safeguards cryptographic keys, secrets such as passwords, and certificates. It centralizes secret management and controls access with policies and identities. This keeps sensitive values out of application code and configuration files.

What does Azure Virtual Network peering enable?

• a.Direct, low-latency connectivity between two virtual networks so resources can communicate as if on one network✓
• b.Serverless code execution
• c.Automatic cost reporting
• d.Encryption of blob storage

VNet peering connects two virtual networks so their resources can communicate directly over the Azure backbone. Traffic between peered VNets stays on Microsoft's private network with low latency. It is commonly used to link workloads across VNets or regions.

Which Azure compute option is best described as 'serverless,' where you focus on code and the platform handles scaling automatically?

• a.Azure ExpressRoute
• b.Azure Functions✓
• c.Azure Virtual Machines
• d.Azure availability sets

Azure Functions embodies serverless computing: you write event-triggered code and the platform automatically provisions and scales the compute. There are no servers for you to manage. Billing is tied to executions and resources consumed during runs.

Which Azure service would you use to queue messages between application components to decouple and scale them independently?

• a.Microsoft Entra ID
• b.Azure Queue Storage✓
• c.Azure DNS
• d.Azure Blob Storage

Azure Queue Storage stores large numbers of messages that components can add and retrieve asynchronously. This decouples producers from consumers, letting each scale independently and absorb load spikes. It improves resilience in distributed applications.

What is a key advantage of using PaaS services like Azure App Service over IaaS virtual machines for hosting a web app?

• a.The platform handles OS patching, scaling, and infrastructure so developers focus on the application✓
• b.You cannot deploy custom code
• c.You must manually patch the operating system
• d.You gain full control of the physical hardware

PaaS offerings such as Azure App Service manage the operating system, runtime, patching, and scaling for you. This reduces operational overhead compared to running and maintaining your own VMs. Developers can concentrate on building and deploying application features.

Which Azure service provides scalable big data analytics and data warehousing for large volumes of structured data?

• a.Azure DNS
• b.Azure Blob Storage
• c.Azure Key Vault
• d.Azure Synapse Analytics✓

Azure Synapse Analytics is an analytics service that combines data warehousing and big data processing. It can query large datasets using both serverless and provisioned resources. It supports enterprise reporting and advanced analytics at scale.

Which storage redundancy option replicates data synchronously across three availability zones in the primary region?

• a.Locally redundant storage (LRS)
• b.Geo-redundant storage (GRS)
• c.Zone-redundant storage (ZRS)✓
• d.Cool access tier

Zone-redundant storage (ZRS) writes copies of data across three separate availability zones within the primary region. This protects against the failure of a single datacenter/zone while keeping data in-region. It offers higher availability than LRS.

What best describes the purpose of Microsoft Entra ID single sign-on (SSO)?

• a.It hosts DNS zones
• b.It provisions virtual machines automatically
• c.It lets users sign in once and access multiple applications without re-entering credentials✓
• d.It encrypts data stored in blobs

Single sign-on (SSO) allows users to authenticate once with Microsoft Entra ID and then access many connected applications without repeated logins. This improves user experience and reduces password fatigue. It also strengthens security by centralizing authentication.

Which Azure service helps you migrate on-premises servers, databases, and applications to Azure with assessment and tracking tools?

• a.Azure Migrate✓
• b.Azure DNS
• c.Azure Blob Storage
• d.Azure Functions

Azure Migrate provides a central hub to discover, assess, and migrate on-premises workloads to Azure. It offers tools for server, database, and application migration along with readiness assessments. This streamlines planning and executing a cloud migration.

What is the primary function of a public IP address resource in Azure?

• a.It queues messages between apps
• b.It allows inbound and outbound communication between Azure resources and the internet✓
• c.It hosts static websites only
• d.It stores encryption keys

A public IP address enables Azure resources to communicate with the internet and public-facing services. It can be assigned to VMs, load balancers, and gateways. Without a public IP (or equivalent), a resource cannot be reached directly from the internet.

Which Azure feature lets a virtual machine authenticate to other Azure services without storing credentials in code?

• a.Storing passwords in the OS registry
• b.Emailing credentials to users
• c.Hardcoding keys in the application
• d.Managed identities in Microsoft Entra ID✓

Managed identities give Azure resources an automatically managed identity in Microsoft Entra ID. Resources use this identity to authenticate to services that support it, avoiding credentials in code. Azure handles the identity's lifecycle, improving security.

Which Azure service provides a fully managed, in-memory data cache to improve application performance?

• a.Azure DNS
• b.Azure Cache for Redis✓
• c.Azure Blob Storage
• d.Azure Migrate

Azure Cache for Redis is a managed in-memory data store based on the popular Redis engine. It speeds up applications by caching frequently accessed data close to compute. This reduces database load and improves response times.

What is an Azure region pair?

• a.Two regions in the same geography paired for replication and recovery✓
• b.Two subscriptions that are billed together on one invoice
• c.Two identical storage accounts inside one datacenter
• d.Two virtual machines placed within the very same server rack for performance

A region pair links two regions within the same geography for platform resilience. Azure staggers updates and prioritizes recovery across the pair. Some services replicate data to the paired region automatically.

In a region that supports Availability Zones, at minimum how many physically separate zones are provided?

• a.Three zones✓
• b.Ten zones
• c.One zone
• d.Twenty zones

Availability Zone-enabled regions provide at least three physically separate zones. Each zone has independent power, cooling, and networking. Spreading resources across zones protects against a datacenter-level failure.

Which statement about Azure resource groups is TRUE?

• a.Resource groups are physical server racks in a datacenter
• b.Each resource belongs to exactly one resource group✓
• c.Resource groups are not allowed to contain any resources
• d.A single resource can belong to many different resource groups simultaneously

Every Azure resource lives in exactly one resource group. The group is a logical container for related resources. It also serves as a scope for permissions and policies.

What is an Azure subscription primarily used for?

• a.A billing and management boundary for Azure resources✓
• b.A single DNS record entry
• c.A single physical fiber-optic cable running between two datacenters
• d.A single virtual machine instance

A subscription is a logical container that acts as a billing and management boundary. Resources are deployed into subscriptions, which link to an Entra tenant. Organizations often use several subscriptions to separate workloads.

Where do management groups sit in the Azure hierarchy?

• a.Inside a single resource group as a child object
• b.Directly below subscriptions in every case
• c.Below individual resources, nested inside each deployed resource itself
• d.Above subscriptions, to organize and govern them✓

Management groups sit above subscriptions and can be nested. Policies and access assigned to a management group flow down to all contained subscriptions. This enables governance at scale.

What is Azure Resource Manager (ARM)?

• a.The deployment and management layer for creating and managing Azure resources✓
• b.A specialized storage tier designed for infrequently accessed archival data sets
• c.A low-level physical networking protocol
• d.A particular family of virtual machine sizes

Azure Resource Manager is the control plane that handles requests to create, update, and delete resources. All portal, CLI, and API calls go through ARM. It provides consistent management, access control, and tagging.

What is the main purpose of an ARM template (or Bicep file)?

• a.To store large volumes of unstructured blob data cheaply
• b.To assign user roles and permissions only
• c.To define infrastructure as code for repeatable deployments✓
• d.To continuously monitor the CPU and memory usage of running virtual machines

ARM templates and Bicep files declare infrastructure as code. They enable consistent, repeatable, and automated deployments. Because they are declarative, applying the same file yields the same result.

Choosing a larger VM size with more vCPUs and memory is an example of what?

• a.Reducing overall redundancy in the system
• b.Scaling out horizontally to more instances
• c.Geo-replication of stored data
• d.Scaling up vertically✓

Increasing a single machine's CPU and memory is vertical scaling, or scaling up. Adding more instances instead is scaling out. Both approaches are supported in Azure.

Which Azure feature automatically maintains and scales a group of identical load-balanced VMs?

• a.Azure Key Vault for secrets and certificates
• b.Virtual Machine Scale Sets✓
• c.Azure DNS name resolution service for hosting your public domains
• d.Azure Blob Storage for object data

Virtual Machine Scale Sets manage a group of identical VMs behind a load balancer. They can automatically scale the instance count based on demand. This supports large, elastic, highly available workloads.

In Azure App Service, what does the App Service plan define?

• a.The compute resources and pricing tier that host your app✓
• b.The redundancy level of your blob storage
• c.The operating system patch schedule for your VMs
• d.The DNS records and name-server settings for your organization's public domain

The App Service plan defines the underlying compute (size, tier, and instance count) that runs your apps. Multiple apps can share a plan. The chosen tier affects features, scale, and cost.