About the AZ-900 Exam
The Microsoft Azure Fundamentals (AZ-900) exam is designed for candidates who want to demonstrate foundational knowledge of cloud services and how those services are provided with Microsoft Azure. It is a stepping stone to more advanced Azure role-based certifications.
Key exam facts:
- Format: 40–60 questions (multiple choice, multi-select, drag-and-drop, case studies)
- Duration: 60 minutes
- Pass mark: 700 out of 1000
- Cost: £130 / $165 USD
- Prerequisites: None — suitable for complete beginners
💡 How to use this page: Read each question carefully, form your own answer, then reveal the answer and explanation. Resist the urge to jump straight to the answer — active recall is the most effective study technique.
Practice interactively in our app
These static questions are great, but our app gives you instant feedback, explanations, and tracks your score automatically.
Try 5 Free Questions →
☁️ Cloud Concepts (Questions 1–10)
This domain covers approximately 25–30% of the AZ-900 exam and includes core cloud concepts like service models, cloud models, and the benefits of using cloud services.
Which cloud service model gives the customer the most control over the underlying operating system and infrastructure?
- Infrastructure as a Service (IaaS)
- Platform as a Service (PaaS)
- Software as a Service (SaaS)
- Function as a Service (FaaS)
Answer: IaaS. IaaS provides virtualised computing resources — virtual machines, storage, networking — over the internet. The customer is responsible for the OS, middleware, and applications. PaaS abstracts the OS layer, and SaaS provides fully managed applications.
A company subscribes to Microsoft 365. Which cloud service model does this represent?
- IaaS
- PaaS
- SaaS
- On-premises
Answer: SaaS. Software as a Service provides fully managed, ready-to-use applications delivered over the internet. Microsoft 365 (Word, Excel, Outlook, Teams) is a classic SaaS example — the user simply logs in and uses the software, with no infrastructure management.
Which of the following is a benefit of using cloud services over on-premises infrastructure? (Select all that apply)
- Economies of scale reduce costs
- Resources can be provisioned on-demand
- You always have complete control of the hardware
- Capital expenditure is replaced by operational expenditure
Answer: Options 1, 2, and 4. Cloud providers operate at massive scale, reducing per-unit costs. Resources can be provisioned instantly. CapEx (buying hardware) is replaced by OpEx (pay-as-you-go). However, you do NOT have direct control over the physical hardware in the public cloud — that's managed by the provider.
What does "high availability" mean in the context of Azure?
- Services are only available during business hours
- Services remain operational with minimal downtime even if components fail
- Data is stored in multiple geographic locations
- Services automatically scale based on demand
Answer: Services remain operational with minimal downtime. High availability means designing systems so they continue to function despite hardware or software failures. In Azure, this is achieved through redundancy, availability zones, and services like Azure Load Balancer.
What is the difference between CapEx and OpEx in cloud computing?
- CapEx refers to cloud spending; OpEx refers to on-premises spending
- CapEx is upfront spending on physical assets; OpEx is ongoing operational spending like pay-as-you-go cloud costs
- CapEx and OpEx are the same thing in cloud computing
- OpEx is always more expensive than CapEx
Answer: CapEx is upfront spending on assets; OpEx is ongoing operational spending. Traditional IT requires large upfront capital expenditure (CapEx) to buy servers and data centre space. Cloud computing shifts this to operational expenditure (OpEx) — you pay for what you use, when you use it, with no large upfront investment.
A developer uses Azure App Service to host a web application. They manage the application code but not the underlying operating system. Which service model does this represent?
- IaaS
- PaaS
- SaaS
- On-premises
Answer: PaaS. Platform as a Service provides a managed environment for building, testing, and deploying applications. Azure App Service is PaaS — developers deploy their code and the platform handles OS patching, scaling, and infrastructure management automatically.
Under the shared responsibility model, which of the following is ALWAYS the customer's responsibility, regardless of the service model used?
- Physical data centre security
- Hypervisor maintenance
- Managing user accounts and access (identity)
- Operating system patching
Answer: Managing user accounts and access (identity). In the shared responsibility model, certain responsibilities always remain with the customer regardless of service model: identity and access management, data classification, and end-user device security. Physical security and hypervisors are always Microsoft's responsibility. OS patching shifts between the customer and Microsoft depending on whether the service is IaaS, PaaS, or SaaS.
What is meant by "scalability" in cloud computing?
- The ability to recover quickly from disasters
- The ability to increase or decrease resources to match demand
- The ability to run workloads across multiple cloud providers
- The ability to encrypt data at rest and in transit
Answer: The ability to increase or decrease resources to match demand. Scalability refers to a system's ability to handle growing or shrinking workloads by adjusting resources. This can be vertical (scaling up — more power to existing machines) or horizontal (scaling out — adding more machines).
Which cloud deployment model is best for an organisation that needs to keep sensitive data on-premises while also leveraging public cloud services for less sensitive workloads?
- Public cloud
- Private cloud
- Hybrid cloud
- Community cloud
Answer: Hybrid cloud. A hybrid cloud environment combines on-premises infrastructure (or private cloud) with public cloud services, allowing data and applications to be shared between them. This is particularly valuable for organisations with compliance or data sovereignty requirements that prevent them from moving all workloads to the public cloud.
Which term describes how cloud providers can offer lower per-unit prices because they purchase resources at a much larger scale than individual businesses?
- Elasticity
- Geo-distribution
- Economies of scale
- Agility
Answer: Economies of scale. Cloud providers like Microsoft operate at massive scale — buying hardware, power, and networking in enormous quantities. This lets them pass cost savings on to customers, offering lower prices than most businesses could achieve by running their own infrastructure.
How are you scoring so far?
Our interactive app tracks your score automatically and explains every answer in real time.
Continue Practising (Free) →
🏗️ Azure Architecture (Questions 11–18)
This domain covers the physical and logical structure of Azure, including regions, availability zones, resource groups, and the management hierarchy.
What is the purpose of an Azure Resource Group?
- To provide redundancy across datacenters
- To logically group related Azure resources for easier management, access control, and billing
- To connect on-premises networks to Azure
- To define the geographic location of Azure datacenters
Answer: Logical grouping for management. A Resource Group is a container that holds related Azure resources. It lets you apply access controls, policies, and manage cost for all resources in the group as a single unit. Every Azure resource must belong to exactly one resource group.
What is an Azure Region Pair?
- Two datacenters located in the same building
- Two Azure regions within the same geography that are paired for disaster recovery purposes
- A subscription that spans two Azure regions
- A pair of virtual machines deployed for high availability
Answer: Two paired regions for disaster recovery. Azure region pairs are two regions within the same geography (e.g., UK South and UK West) separated by at least 300 miles. Paired regions replicate data and services for disaster recovery, and Azure ensures that planned maintenance doesn't affect both regions simultaneously.
An organisation has multiple Azure subscriptions and wants central visibility and control. What should they use?
- Azure Resource Groups
- Azure Monitor
- Azure Management Groups
- Azure Blueprints
Answer: Azure Management Groups. Management Groups sit above subscriptions in the Azure hierarchy. They allow you to apply policies and RBAC across multiple subscriptions at once, and settings are inherited by all child subscriptions. This provides central governance across an entire organisation's Azure estate.
What is the Azure hierarchy from broadest to most specific?
- Management Groups → Subscriptions → Resource Groups → Resources
- Resources → Resource Groups → Subscriptions → Management Groups
- Subscriptions → Management Groups → Resource Groups → Resources
- Management Groups → Resource Groups → Subscriptions → Resources
Answer: Management Groups → Subscriptions → Resource Groups → Resources. This is the Azure management hierarchy from broadest to most specific. Management Groups contain subscriptions; subscriptions contain resource groups; resource groups contain individual resources (VMs, storage accounts, etc.).
Which Azure service provides a dedicated private connection between on-premises infrastructure and Azure, bypassing the public internet?
- Azure VPN Gateway
- Azure ExpressRoute
- Azure CDN
- Azure Traffic Manager
Answer: Azure ExpressRoute. ExpressRoute provides a private, dedicated connection between your on-premises infrastructure and Microsoft Azure datacenters, bypassing the public internet entirely. This offers more reliable connectivity, higher bandwidth, and better security than VPN connections over the internet.
A company wants to ensure their application remains available even if an entire Azure datacenter fails, but they don't need cross-region redundancy. What should they use?
- Deploy to multiple Azure regions
- Deploy across multiple Availability Zones within a single region
- Use Azure Site Recovery
- Enable geo-redundant storage (GRS)
Answer: Multiple Availability Zones. Availability Zones are physically separate datacenters within a single Azure region. Deploying across 2–3 AZs protects against datacenter-level failures (power, cooling, networking) while keeping resources within the same region. This is more cost-effective than multi-region deployment when cross-region redundancy isn't required.
Which Azure tool provides a browser-based interface to manage Azure resources without needing to install any software?
- Azure Portal
- Azure CLI
- Azure PowerShell
- Azure Resource Manager templates
Answer: Azure Portal. The Azure Portal (portal.azure.com) is a web-based, unified console that provides a graphical user interface to manage all your Azure resources. Azure CLI and PowerShell are command-line tools requiring installation. ARM templates are JSON files for infrastructure-as-code.
What is Azure Resource Manager (ARM)?
- A tool for monitoring Azure resource performance
- A service for migrating on-premises workloads to Azure
- The deployment and management service that provides a consistent layer for managing Azure resources
- A backup and disaster recovery service
Answer: Deployment and management layer. Azure Resource Manager (ARM) is the underlying service that processes all Azure management operations. Whether you use the Portal, CLI, PowerShell, or SDKs, all requests pass through ARM. It provides consistent authentication, access control, and a unified API surface for managing Azure resources.
Unlock 300+ questions in the interactive app
Full question bank, timed mock exams, and progress tracking — £14.99 one-time.
Get Full Access →
🔐 Identity & Security (Questions 19–28)
Security and identity questions make up 15–20% of the exam. This domain often catches candidates out — make sure you understand the difference between authentication and authorisation, and the tools Azure provides for each.
What is the difference between authentication and authorisation?
- They are the same thing
- Authentication verifies who you are; authorisation determines what you're allowed to do
- Authentication determines what you're allowed to do; authorisation verifies who you are
- Authentication is for users; authorisation is for services
Answer: Authentication = who you are; Authorisation = what you can do. Authentication (AuthN) is the process of proving your identity — e.g., logging in with a username and password. Authorisation (AuthZ) is what happens after you're authenticated — determining what resources and actions you're permitted to access.
Which Azure service implements Zero Trust by evaluating signals such as user location, device state, and risk before granting access?
- Multi-Factor Authentication
- Conditional Access
- Azure RBAC
- Azure Firewall
Answer: Conditional Access. Conditional Access policies in Microsoft Entra ID evaluate contextual signals (who is the user, what device are they using, where are they logging in from, what's their risk score) before deciding whether to grant access, require MFA, or block the request. This is the technical implementation of Zero Trust principles in Azure.
What does Azure RBAC stand for and what does it control?
- Resource-Based Access Control — manages which Azure services are available in a region
- Role-Based Access Control — manages who can access Azure resources and what they can do with them
- Risk-Based Access Control — evaluates the security risk of user sign-ins
- Resource Billing and Cost — controls spending limits on Azure subscriptions
Answer: Role-Based Access Control, managing resource access. Azure RBAC is an authorisation system built on Azure Resource Manager. You assign roles (Owner, Contributor, Reader, or custom roles) to users, groups, or service principals at a specific scope (management group, subscription, resource group, or resource).
Which Azure service provides security recommendations and a unified view of your security posture across Azure resources?
- Azure Key Vault
- Azure Sentinel
- Microsoft Defender for Cloud
- Azure Monitor
Answer: Microsoft Defender for Cloud. Defender for Cloud (formerly Azure Security Center) provides security posture management and threat protection. It assesses your Azure resources against security best practices, assigns a Secure Score, and provides actionable recommendations to improve your security posture.
A security team needs to investigate alerts across an entire organisation, correlating signals from multiple data sources including firewalls, identity systems, and endpoints. Which Azure service should they use?
- Microsoft Defender for Cloud
- Azure Monitor
- Microsoft Sentinel
- Azure Security Center
Answer: Microsoft Sentinel. Microsoft Sentinel is a SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automated Response) solution. It ingests data from across your entire organisation — cloud, on-premises, or from other providers — correlates signals to detect threats, and can automate responses to incidents.
💰 Cost & Governance (Questions 24–31)
Which tool would you use to compare the cost of running workloads on-premises versus in Azure?
- Azure Pricing Calculator
- Azure Total Cost of Ownership (TCO) Calculator
- Azure Cost Management + Billing
- Azure Advisor
Answer: Azure TCO Calculator. The Total Cost of Ownership Calculator helps you estimate cost savings when migrating to Azure from on-premises. It factors in server hardware, storage, networking, IT labour, and electricity costs. The Pricing Calculator estimates costs for Azure services specifically, not for comparing with on-premises.
What is an Azure Reserved Instance?
- A VM that is reserved for emergency use during outages
- A commitment to use a specific Azure resource for 1 or 3 years in exchange for a significant discount over pay-as-you-go pricing
- A dedicated physical server reserved exclusively for one customer
- A VM image reserved in Azure Marketplace
Answer: A 1 or 3-year commitment in exchange for discounts. Azure Reserved Instances (Reserved VM Instances) allow you to prepay for 1 or 3 years of compute capacity, saving up to 72% compared to pay-as-you-go pricing. They're ideal for stable, predictable workloads that run continuously. They are NOT dedicated physical hardware (that's Azure Dedicated Hosts).
Which Azure service provides personalised recommendations to improve cost efficiency, security, performance, and operational excellence?
- Azure Monitor
- Azure Advisor
- Azure Policy
- Azure Service Health
Answer: Azure Advisor. Azure Advisor analyses your Azure resources and usage patterns, then provides personalised recommendations across five pillars: Cost, Security, Reliability, Operational Excellence, and Performance. For example, it might recommend downsizing an underutilised VM or enabling soft delete on storage accounts.
What factors influence the cost of Azure services? (Select three)
- The Azure region where resources are deployed
- The amount of data egress (data leaving Azure)
- The number of users in your Microsoft Entra ID tenant
- The pricing tier or SKU of the resource selected
Answer: Region, data egress, and pricing tier. Azure costs are influenced by: (1) Region — prices vary between regions due to local electricity, real estate, and labour costs; (2) Data egress — data leaving Azure to the internet or to other regions incurs transfer charges; (3) Resource SKU/tier — higher tiers offer more features and capacity at higher cost. The number of Entra ID users doesn't directly affect resource costs.
What is the purpose of Azure Cost Management + Billing?
- To estimate the cost of Azure services before deployment
- To monitor current spending, set budgets, and analyse cost trends for existing Azure resources
- To compare Azure costs with other cloud providers
- To automatically reduce costs by deallocating unused resources
Answer: Monitor spending and set budgets for existing resources. Azure Cost Management + Billing provides tools to understand, monitor, and control your existing Azure spending. You can view costs by service, resource group, or tag; set budget alerts; download invoices; and analyse spending trends over time.
✅ Exam Day Tips
Having practised hundreds of questions, here are the most important things to remember on exam day:
- Read every word. AZ-900 questions often hinge on a single word like "always", "never", "most cost-effective", or "without requiring".
- Eliminate obviously wrong answers. On multi-choice questions, you can usually eliminate 1–2 options immediately, improving your odds significantly.
- Don't overthink it. AZ-900 is a fundamentals exam. The answer is usually the most straightforward interpretation of the question.
- Flag and return. If unsure, flag the question and move on. Return to flagged questions after completing the rest.
- You need 700/1000 to pass. That's 70% — you don't need to get everything right. Stay calm if you're unsure of some questions.
Keep practising with our interactive app
These 28 questions are just a sample. The full app has 300+ questions with score tracking, topic filters, and timed mock exams.
Try 5 Free Questions →