Free AZ-900 practice exam questions

What the 20 questions cover

Every question here passed the same checks as the full bank: the quoted sentence was found on the live official page, and an independent blind reviewer matched the answer. How we check questions.

The questions

Answers are hidden. Open “Show answer and source” under a question after you have picked yours.

1. Question 1 of 20 · D1: Describe cloud concepts · az9-d1-005

   Team A installed SQL Server on an Azure virtual machine. Team B uses a managed cloud SQL database. Who is responsible for maintaining and patching the database engine in each case?

   • A. Option A: The provider patches both engines, because both of them run inside Azure datacenters
   • B. Option B: Both teams patch their own engines, because each team owns its data
   • C. Option C: The provider patches Team A's engine; Team B patches its own database
   • D. Option D: Team A patches its own engine; the provider maintains Team B's database
   Show answer and source

   Answer: D. Either way, both teams remain responsible for the data stored in their databases.

   • A (incorrect): Running in Azure doesn't move responsibility. Software you install on your own VM is yours to patch.
   • B (incorrect): Owning the data doesn't mean owning the managed database engine. The provider maintains that.
   • C (incorrect): This reverses the split. The IaaS team patches, and the managed service is the provider's job.
   • D (correct): Correct. On a VM you installed, database patches are yours. With a cloud SQL database, the provider maintains the database itself.

   Official sourcelearn.microsoft.com

   If you deployed a virtual machine and installed an SQL database on it, you’d be responsible for database patches and updates

   learn.microsoft.com/en-us/training/modules/describe-cloud-compute/4-describe-shared-responsibility-model (official page)

2. Question 2 of 20 · D1: Describe cloud concepts · az9-d1-014

   A company has servers in its own datacenter, workloads in Azure and more workloads in another public cloud. It wants to manage all of them with one set of Azure tools. What fits?

   • A. Option A: Azure VMware Solution
   • B. Option B: Azure Arc
   • C. Option C: Azure Virtual Desktop
   • D. Option D: Azure ExpressRoute
   Show answer and source

   Answer: B. Azure Arc extends Azure management to resources wherever they run.

   • A (incorrect): It runs VMware workloads in Azure. It doesn't manage resources in other clouds.
   • B (correct): Correct. Azure Arc helps manage public, private, hybrid and multicloud environments.
   • C (incorrect): Azure Virtual Desktop delivers desktops and apps to users.
   • D (incorrect): ExpressRoute is a private network connection, not a management tool.

   Official sourcelearn.microsoft.com

   Azure Arc can help manage your cloud environment whether it's a public cloud solely on Azure, a private cloud in your datacenter, a hybrid configuration

   learn.microsoft.com/en-us/training/modules/describe-cloud-compute/5-define-cloud-models (official page)

3. Question 3 of 20 · D1: Describe cloud concepts · az9-d1-023

   During a ticket sale, a website automatically adds more VM instances to handle the load, then removes them when traffic falls. What is this called?

   • A. Option A: High availability: failing over to another region
   • B. Option B: Reliability: recovering from a failed component
   • C. Option C: Vertical scaling: scaling up and then back down
   • D. Option D: Horizontal scaling: scaling out and then back in
   Show answer and source

   Answer: D. Scaling out and in can happen automatically or manually.

   • A (incorrect): Failover keeps a service available during an outage. It doesn't add capacity for demand.
   • B (incorrect): Reliability is recovering from failures. The trigger here is demand, not failure.
   • C (incorrect): Vertical scaling changes the size of existing resources, not how many there are.
   • D (correct): Correct. Adding or removing instances is horizontal scaling.

   Official sourcelearn.microsoft.com

   Horizontal scaling is adding or subtracting the number of resources.

   learn.microsoft.com/en-us/training/modules/describe-benefits-use-cloud-services/2-high-availability-scalability-cloud (official page)

4. Question 4 of 20 · D1: Describe cloud concepts · az9-d1-032

   Microsoft separates 'management of the cloud' from 'management in the cloud'. Which example is management OF the cloud?

   • A. Option A: Monitoring resource health and automatically replacing failing resources
   • B. Option B: Calling REST APIs from your own tools to manage the environment
   • C. Option C: Running PowerShell scripts that change your resources' configuration
   • D. Option D: Managing your environment and all its resources through the Azure web portal
   Show answer and source

   Answer: A. Management of the cloud covers scaling, template deployment, health monitoring and alerts. Management in the cloud covers the portal, CLI, APIs and PowerShell.

   • A (correct): Correct. Management of the cloud is about managing your resources, such as automatic replacement and scaling.
   • B (incorrect): APIs are a way of managing in the cloud.
   • C (incorrect): PowerShell is a way of managing in the cloud.
   • D (incorrect): The portal is one of the ways of managing in the cloud.

   Official sourcelearn.microsoft.com

   Monitor the health of resources and automatically replace failing resources.

   learn.microsoft.com/en-us/training/modules/describe-benefits-use-cloud-services/5-manageability-cloud (official page)

5. Question 5 of 20 · D1: Describe cloud concepts · az9-d1-041

   Which statement about software as a service (SaaS) is accurate?

   • A. Option A: It needs deep technical expertise but has the lowest overhead
   • B. Option B: It sits in the middle and evenly shares responsibility with you
   • C. Option C: It's the most flexible model and gives you maximum control of the operating system
   • D. Option D: It may be the least flexible model, but it's the easiest to get running
   Show answer and source

   Answer: D. SaaS has the lowest operational overhead for customers.

   • A (incorrect): SaaS needs the least technical knowledge to use.
   • B (incorrect): That describes PaaS.
   • C (incorrect): That describes IaaS.
   • D (correct): Correct. SaaS is the least flexible but easiest to get up and running.

   Official sourcelearn.microsoft.com

   While the SaaS model may be the least flexible, it's also the easiest to get up and running.

   learn.microsoft.com/en-us/training/modules/describe-cloud-service-types/4-describe-software-service (official page)

6. Question 6 of 20 · D2: Describe Azure architecture and services · az9-d2-004

   A US government agency needs Azure datacenters that are isolated from the main instance of Azure, operated by screened US personnel and carrying extra compliance certifications. What should it use?

   • A. Option A: Availability zones in the East US region
   • B. Option B: A sovereign region such as US Gov Virginia
   • C. Option C: A management group for all of its subscriptions
   • D. Option D: A region pair inside the US geography
   Show answer and source

   Answer: B. Organizations may need sovereign regions for compliance or legal purposes.

   • A (incorrect): Availability zones add resiliency within a public region. They don't create an isolated instance.
   • B (correct): Correct. US government sovereign regions are isolated instances of Azure run by screened US personnel.
   • C (incorrect): Management groups organize governance. They don't change where or how datacenters are run.
   • D (incorrect): Region pairs are part of the main Azure instance, so they don't provide this isolation.

   Official sourcelearn.microsoft.com

   Sovereign regions are instances of Azure that are isolated from the main instance of Azure.

   learn.microsoft.com/en-us/training/modules/describe-core-architectural-components-of-azure/5-describe-azure-physical-infrastructure (official page)

7. Question 7 of 20 · D2: Describe Azure architecture and services · az9-d2-012

   A company wants separate invoices for production and for development and testing, and different access rules for each. What should it create?

   • A. Option A: Separate subscriptions for production and for dev/test
   • B. Option B: Separate management groups over a shared subscription
   • C. Option C: Separate resource groups inside a single subscription
   • D. Option D: Separate tags for each resource in a single subscription
   Show answer and source

   Answer: A. Subscriptions are a unit of management, billing and scale.

   • A (correct): Correct. Azure generates separate invoices per subscription, and access policies apply at the subscription level.
   • B (incorrect): A subscription has only one parent, and invoices still come per subscription.
   • C (incorrect): Resource groups organize resources, but invoices are generated per subscription.
   • D (incorrect): Tags help report costs, but they don't produce separate invoices or access boundaries.

   Official sourcelearn.microsoft.com

   Azure generates separate billing reports and invoices for each subscription.

   learn.microsoft.com/en-us/training/modules/describe-core-architectural-components-of-azure/6-describe-azure-management-infrastructure (official page)

8. Question 8 of 20 · D2: Describe Azure architecture and services · az9-d2-020

   A company runs hundreds of containers for a microservices app and needs a service that manages the containers' lifecycle across the fleet. Which service fits?

   • A. Option A: Azure Container Apps
   • B. Option B: Azure App Service
   • C. Option C: Azure Container Instances
   • D. Option D: Azure Kubernetes Service (AKS)
   Show answer and source

   Answer: D. Containers suit microservice architectures, where each part of an app can be scaled or updated independently.

   • A (incorrect): Container Apps removes container management overhead for apps, but Microsoft describes AKS as the orchestration service.
   • B (incorrect): App Service hosts web apps and APIs. It isn't a container orchestrator.
   • C (incorrect): Container Instances is the fastest, simplest way to run a container, not a fleet orchestrator.
   • D (correct): Correct. AKS is a container orchestration service that simplifies managing a fleet of containers.

   Official sourcelearn.microsoft.com

   Azure Kubernetes Service (AKS) is a container orchestration service.

   learn.microsoft.com/en-us/training/modules/describe-azure-compute-networking-services/5-containers (official page)

9. Question 9 of 20 · D2: Describe Azure architecture and services · az9-d2-028

   Two virtual networks in different Azure regions must communicate privately, and their traffic must never enter the public internet. What should be configured?

   • A. Option A: A point-to-site VPN
   • B. Option B: Public IPs on each VM
   • C. Option C: Azure DNS alias records
   • D. Option D: Virtual network peering
   Show answer and source

   Answer: D. Peering lets you build a global interconnected network through Azure.

   • A (incorrect): Point-to-site connects a single computer to a VNet.
   • B (incorrect): Public IPs expose resources to the internet, which is the opposite of the goal.
   • C (incorrect): Alias records help with name resolution. They don't connect networks.
   • D (correct): Correct. Peered traffic is private and travels on the Microsoft backbone, even across regions.

   Official sourcelearn.microsoft.com

   Network traffic between peered networks is private, and travels on the Microsoft backbone network, never entering the public internet.

   learn.microsoft.com/en-us/training/modules/describe-azure-networking-services/2-virtual-network (official page)

10. Question 10 of 20 · D2: Describe Azure architecture and services · az9-d2-035

    Components of an order system need reliable asynchronous messaging. Each message is under 64 KB, there can be millions of them, and many messages trigger Azure Functions. Which storage service fits?

    • A. Option A: Azure Table Storage
    • B. Option B: Azure Files
    • C. Option C: Azure Blob Storage
    • D. Option D: Azure Queue Storage
    Show answer and source

    Answer: D. Queues are accessed through authenticated HTTP or HTTPS calls.

    • A (incorrect): Table storage holds structured NoSQL data, not messages for processing.
    • B (incorrect): Azure Files provides managed file shares, not a message queue.
    • C (incorrect): Blob storage is an object store for text and binary data.
    • D (correct): Correct. Queue storage holds millions of messages up to 64 KB and is often paired with Functions.

    Official sourcelearn.microsoft.com

    Azure Queue storage stores large numbers of messages for asynchronous processing.

    learn.microsoft.com/en-us/training/modules/describe-azure-storage-services/4-describe-azure-storage-services (official page)

11. Question 11 of 20 · D2: Describe Azure architecture and services · az9-d2-043

    A team needs a storage account for blobs, file shares, queues and tables and has no special performance requirements. Which account type does Microsoft recommend for most scenarios?

    • A. Option A: Standard general-purpose v2
    • B. Option B: Premium block blobs
    • C. Option C: Premium file shares
    • D. Option D: Premium page blobs
    Show answer and source

    Answer: A. The account type determines which storage services and redundancy options are available.

    • A (correct): Correct. It supports blobs, files, queues and tables and is recommended for most scenarios.
    • B (incorrect): Premium block blobs suit high transaction rates or low latency, and they don't support all four services.
    • C (incorrect): Premium file shares support Azure Files only.
    • D (incorrect): Premium page blobs support page blobs only.

    Official sourcelearn.microsoft.com

    Standard storage account type for blobs, file shares, queues, and tables. Recommended for most scenarios using Azure Storage.

    learn.microsoft.com/en-us/training/modules/describe-azure-storage-services/2-accounts (official page)

12. Question 12 of 20 · D2: Describe Azure architecture and services · az9-d2-051

    Microsoft compares authentication methods by security and convenience. Which approach does it describe as both high security and high convenience?

    • A. Option A: Passwords plus a security question
    • B. Option B: Passwordless authentication
    • C. Option C: Passwords used on their own
    • D. Option D: SSO built on a single password
    Show answer and source

    Answer: B. Passwordless replaces the password with a trusted device plus a biometric or PIN.

    • A (incorrect): Both factors are something the user knows, so a stolen password is still a large risk.
    • B (correct): Correct. Passwordless is high security and high convenience.
    • C (incorrect): Passwords alone are high convenience but low security.
    • D (incorrect): SSO is only as secure as the first sign-in, which here is still just a password.

    Official sourcelearn.microsoft.com

    Notice Passwordless authentication is high security and high convenience while passwords on their own are low security but high convenience.

    learn.microsoft.com/en-us/training/modules/describe-azure-identity-access-security/3-authentication-methods (official page)

13. Question 13 of 20 · D2: Describe Azure architecture and services · az9-d2-059

    Which of the following is one of the guiding principles of Microsoft's Zero Trust model?

    • A. Option A: Assume breach: limit the potential impact and segment access
    • B. Option B: Trust devices that are already on the corporate network
    • C. Option C: Grant broad, standing admin access to reduce sign-in prompts
    • D. Option D: Verify each user once at the network perimeter, then trust them
    Show answer and source

    Answer: A. Zero Trust assumes breach at the outset and verifies each request as though it came from an uncontrolled network.

    • A (correct): Correct. Assume breach is one of the three principles, with verify explicitly and least privilege.
    • B (incorrect): Zero Trust grants access based on authentication, not network location.
    • C (incorrect): Zero Trust uses least privilege, with just-in-time and just-enough access.
    • D (incorrect): Zero Trust verifies each request, not just once at the perimeter.

    Official sourcelearn.microsoft.com

    Assume breach - Limit the potential impact and segment access.

    learn.microsoft.com/en-us/training/modules/describe-azure-identity-access-security/7-describe-zero-trust-model (official page)

14. Question 14 of 20 · D3: Describe Azure management and governance · az9-d3-004

    A team buys a preconfigured VM with specialized software from a third-party vendor through Azure Marketplace. What does the team pay for?

    • A. Option A: Only the Azure services, because Marketplace software is always free to use
    • B. Option B: Only a one-time license fee, because Azure compute is included
    • C. Option C: The Azure services it uses, plus the vendor's services, billed as the vendor sets
    • D. Option D: Only the vendor's fee, because Marketplace VMs don't use Azure resources
    Show answer and source

    Answer: C. Solutions in Azure Marketplace are certified and compliant with Azure policies and standards.

    • A (incorrect): Marketplace vendors can charge for their solutions.
    • B (incorrect): Billing structures are set by the vendor, and you still pay for the Azure services you use.
    • C (correct): Correct. You may pay for both the Azure services and the vendor's services or expertise.
    • D (incorrect): A Marketplace VM still runs on Azure resources that you pay for.

    Official sourcelearn.microsoft.com

    you may pay for not only the Azure services that you're using, but also the services or expertise of the third-party vendor.

    learn.microsoft.com/en-us/training/modules/describe-cost-management-azure/2-describe-factors-affect-costs-azure (official page)

15. Question 15 of 20 · D3: Describe Azure management and governance · az9-d3-012

    An administrator adds the tag CostCenter=1234 to a resource group. What happens to the resources inside it?

    • A. Option A: Nothing; resources don't inherit tags from resource groups
    • B. Option B: Resources inherit it only if the group also has a resource lock
    • C. Option C: Only resources created after the tag was added inherit it
    • D. Option D: All existing and future resources in the group inherit the tag
    Show answer and source

    Answer: A. Because tags aren't inherited, you can create tagging schemas that differ by level. Azure Policy can enforce tag rules.

    • A (correct): Correct. Tags aren't inherited from subscriptions or resource groups.
    • B (incorrect): Locks are inherited, but tags aren't, with or without a lock.
    • C (incorrect): Tags aren't inherited, even by new resources.
    • D (incorrect): Tags don't flow down automatically.

    Official sourcelearn.microsoft.com

    Resources don't inherit tags from subscriptions and resource groups

    learn.microsoft.com/en-us/training/modules/describe-cost-management-azure/7-describe-purpose-of-tags (official page)

16. Question 16 of 20 · D3: Describe Azure management and governance · az9-d3-019

    A policy that allows only certain VM sizes is assigned after 40 VMs already exist. What does Azure Policy do about the existing VMs?

    • A. Option A: It ignores them, because policies apply only when new resources are created
    • B. Option B: It deletes any existing VM that doesn't comply with the allowed sizes
    • C. Option C: It immediately resizes every noncompliant VM to an allowed size
    • D. Option D: It evaluates and monitors them, including VMs created before the policy
    Show answer and source

    Answer: D. The policy also applies whenever an existing VM is resized.

    • A (incorrect): Policy also evaluates resources that already exist.
    • B (incorrect): Azure Policy doesn't delete noncompliant resources.
    • C (incorrect): Policy evaluates and reports the existing VMs. It doesn't resize them.
    • D (correct): Correct. Azure Policy evaluates existing resources as well as new ones.

    Official sourcelearn.microsoft.com

    Azure Policy also evaluates and monitors all current VMs in your environment, including VMs that were created before the policy was created.

    learn.microsoft.com/en-us/training/modules/describe-features-tools-azure-for-governance-compliance/3-describe-purpose-azure-policy (official page)

17. Question 17 of 20 · D3: Describe Azure management and governance · az9-d3-027

    Why is the Azure portal resilient to the failure of an individual datacenter?

    • A. Option A: It caches all of the user's resources in the browser
    • B. Option B: It's hosted inside each user's Azure Cloud Shell
    • C. Option C: It runs in one home region with a paired failover
    • D. Option D: It maintains a presence in every Azure datacenter
    Show answer and source

    Answer: D. The portal updates continuously and needs no downtime for maintenance.

    • A (incorrect): The browser doesn't hold your resources.
    • B (incorrect): Cloud Shell is a separate shell tool inside the portal.
    • C (incorrect): The portal isn't limited to one region and its pair.
    • D (correct): Correct. That presence makes the portal resilient to individual datacenter failures.

    Official sourcelearn.microsoft.com

    It maintains a presence in every Azure datacenter.

    learn.microsoft.com/en-us/training/modules/describe-features-tools-manage-deploy-azure-resources/2-describe-interacting-azure (official page)

18. Question 18 of 20 · D3: Describe Azure management and governance · az9-d3-035

    Which TWO resource types hosted outside Azure can Azure Arc manage? Select TWO.

    • A. Option A: Kubernetes clusters
    • B. Option B: Employees' personal phones
    • C. Option C: Microsoft 365 tenants
    • D. Option D: On-premises network switches
    • E. Option E: Servers
    Show answer and source

    Answer: A, E. Arc also covers Azure data services and SQL Server outside Azure.

    • A (correct): Correct. Kubernetes clusters are one of the resource types Arc can manage outside Azure.
    • B (incorrect): Personal devices aren't an Arc resource type.
    • C (incorrect): Microsoft 365 tenants aren't an Azure Arc resource type.
    • D (incorrect): Network switches aren't among the resource types Arc manages.
    • E (correct): Correct. Servers are one of the resource types Arc can manage outside Azure.

    Official sourcelearn.microsoft.com

    Currently, Azure Arc allows you to manage the following resource types hosted outside of Azure: Servers Kubernetes clusters

    learn.microsoft.com/en-us/training/modules/describe-features-tools-manage-deploy-azure-resources/3-describe-purpose-of-azure-arc (official page)

19. Question 19 of 20 · D3: Describe Azure management and governance · az9-d3-042

    Which TWO of the following are Azure Advisor recommendation categories? Select TWO.

    • A. Option A: Reliability
    • B. Option B: Licensing
    • C. Option C: Identity
    • D. Option D: Compliance
    • E. Option E: Operational Excellence
    Show answer and source

    Answer: A, E. The five categories are Reliability, Security, Performance, Operational Excellence and Cost.

    • A (correct): Correct. Reliability flags configuration risks to keep apps running.
    • B (incorrect): Licensing isn't one of Advisor's five categories.
    • C (incorrect): Identity isn't one of Advisor's five categories.
    • D (incorrect): Compliance isn't one of Advisor's five categories.
    • E (correct): Correct. Operational Excellence suggests workflow and deployment improvements.

    Official sourcelearn.microsoft.com

    Operational Excellence suggests workflow and deployment improvements.

    learn.microsoft.com/en-us/training/modules/describe-monitoring-tools-azure/2-describe-purpose-of-azure-advisor (official page)

20. Question 20 of 20 · D3: Describe Azure management and governance · az9-d3-050

    A team wants an email when a VM's CPU stays above 80%, and wants to reuse the same notification setup for Service Health and Advisor. What should it configure?

    • A. Option A: An Advisor recommendation with a resource tag
    • B. Option B: A log alert rule with a Cost Management budget
    • C. Option C: A Resource Health check with a resource lock
    • D. Option D: A metric alert rule with an action group
    Show answer and source

    Answer: D. Alerts can be metric-based or log-based. The action group controls who gets notified and what happens next.

    • A (incorrect): Advisor doesn't watch CPU thresholds.
    • B (incorrect): Budgets track spending, not CPU.
    • C (incorrect): Locks don't send notifications.
    • D (correct): Correct. A metric alert detects the condition, and action groups are reusable across services.

    Official sourcelearn.microsoft.com

    For example, a metric alert can send you an email when a VM's CPU stays above 80%

    learn.microsoft.com/en-us/training/modules/describe-monitoring-tools-azure/4-describe-azure-monitor (official page)