Question 1

AZ-900: Who is responsible for patching the operating system? on a VM

Accepted Answer

Customer (IaaS) In IaaS you manage the guest OS; in PaaS and SaaS Microsoft does.

Question 2

AZ-900: Responsibility that never moves to the provider

Accepted Answer

Data, identities, accounts and devices These stay with the customer in every model.

Question 3

AZ-900: Keep sensitive data on-premises but use the cloud for peaks

Accepted Answer

Hybrid cloud Mixes on-premises and public cloud connected together.

Question 4

AZ-900: Law forbids shared infrastructure

Accepted Answer

Private cloud Hardware dedicated to one organisation.

Question 5

AZ-900: Pay only for what you use, no upfront hardware

Accepted Answer

Consumption-based, OpEx Costs follow usage instead of a big capital purchase.

Question 6

AZ-900: Run code on an event, pay per execution, no servers to manage

Accepted Answer

Serverless (Azure Functions) The provider handles servers and scaling.

Question 7

AZ-900: Add more VM instances to handle load

Accepted Answer

Scale out (horizontal) Adding instances is horizontal; bigger VM is vertical.

Question 8

AZ-900: Capacity grows and shrinks automatically with demand

Accepted Answer

Elasticity / autoscale Automatic scaling in both directions.

Question 9

AZ-900: Install and administer your own OS and software

Accepted Answer

IaaS You manage everything above the hypervisor.

Question 10

AZ-900: Deploy code, platform runs and scales it

Accepted Answer

PaaS You manage the app and data only.

Question 11

AZ-900: Users just sign in to a finished application

Accepted Answer

SaaS Provider runs the whole application.

Question 12

AZ-900: Survive the failure of one datacenter in a region

Accepted Answer

Availability zones Zones are physically separate locations within a region.

Question 13

AZ-900: Survive a whole-region outage

Accepted Answer

Region pair, geo-redundancy Paired region in the same geography is the secondary.

Question 14

AZ-900: Isolated Azure for a government with separate compliance

Accepted Answer

Sovereign region (Azure Government) Isolated instance with separate data and identity.

Question 15

AZ-900: Apply a policy to many subscriptions at once

Accepted Answer

Management group Sits above subscriptions; assignments inherit downward.

Question 16

AZ-900: Group resources that share a lifecycle

Accepted Answer

Resource group One resource belongs to exactly one group.

Question 17

AZ-900: Identical VMs that autoscale

Accepted Answer

Virtual Machine Scale Sets Group of load-balanced identical VMs that scales.

Question 18

AZ-900: Spread VMs over racks and maintenance groups in one datacenter

Accepted Answer

Availability set Fault and update domains.

Question 19

AZ-900: Orchestrate many containers

Accepted Answer

Azure Kubernetes Service Managed Kubernetes.

Question 20

AZ-900: Connect on-premises to Azure with encryption over the internet

Accepted Answer

VPN Gateway Site-to-site or point-to-site IPsec tunnel.

Question 21

AZ-900: Private, high-bandwidth, consistent link not over the internet

Accepted Answer

ExpressRoute Provider-based private connection.

Question 22

AZ-900: Let two virtual networks talk over the Azure backbone

Accepted Answer

VNet peering Low-latency private connection between VNets.

Question 23

AZ-900: Reach a PaaS service on a private IP in your VNet

Accepted Answer

Private endpoint (Private Link) Gives the service a private IP and lets you disable public access.

Question 24

AZ-900: Filter traffic by port and source on a subnet

Accepted Answer

Network security group Allow and deny rules.

Question 25

AZ-900: Rarely read data kept at the lowest storage cost

Accepted Answer

Archive tier Offline; needs rehydration.

Question 26

AZ-900: Survive a datacenter failure within the region, cheaply

Accepted Answer

ZRS Copies in three zones.

Question 27

AZ-900: Survive a region failure

Accepted Answer

GRS or GZRS Copies asynchronously to the paired region.

Question 28

AZ-900: SMB file share in the cloud

Accepted Answer

Azure Files Managed SMB and NFS shares.

Question 29

AZ-900: Sync on-premises Windows file servers with a cloud share

Accepted Answer

Azure File Sync Caches files locally, tiers the rest to Azure.

Question 30

AZ-900: Too much data for the network; ship it

Accepted Answer

Azure Data Box Offline physical transfer.

Question 31

AZ-900: Assess and migrate on-premises servers

Accepted Answer

Azure Migrate Discovery, assessment and migration hub.

Question 32

AZ-900: Cloud directory for users and apps

Accepted Answer

Microsoft Entra ID Identity and access service for Microsoft 365 and Azure.

Question 33

AZ-900: Legacy app needs LDAP, Kerberos and domain join without domain controllers

Accepted Answer

Entra Domain Services Managed domain services.

Question 34

AZ-900: Sign in once to reach many apps

Accepted Answer

Single sign-on One authentication, many apps.

Question 35

AZ-900: Require a second proof beyond a password

Accepted Answer

Multifactor authentication Know, have, are.

Question 36

AZ-900: Require MFA only from unknown locations or unmanaged devices

Accepted Answer

Conditional Access If-then policy on sign-in signals.

Question 37

AZ-900: Give a team read-only access to one resource group

Accepted Answer

RBAC Reader at resource group scope Role plus scope plus principal.

Question 38

AZ-900: Verify explicitly, least privilege, assume breach

Accepted Answer

Zero Trust The three principles.

Question 39

AZ-900: Secure score and threat protection across clouds

Accepted Answer

Microsoft Defender for Cloud Posture management and workload protection.

Question 40

AZ-900: Estimate the cost of a planned deployment

Accepted Answer

Pricing calculator Estimates before you deploy.

Question 41

AZ-900: See and analyse what you spent, warn at a limit

Accepted Answer

Cost Management budget and alerts Budgets alert but don't stop resources.

Question 42

AZ-900: Only allow certain regions or VM sizes

Accepted Answer

Azure Policy Controls resource configuration.

Question 43

AZ-900: Stop anyone, even an owner, deleting a resource

Accepted Answer

CanNotDelete lock Locks override permissions.

Question 44

AZ-900: Discover and classify sensitive data and meet compliance

Accepted Answer

Microsoft Purview Data governance and compliance.

Question 45

AZ-900: Run Azure commands from the browser with nothing to install

Accepted Answer

Cloud Shell Bash or PowerShell hosted in Azure.

Question 46

AZ-900: Manage on-premises servers and other clouds from Azure

Accepted Answer

Azure Arc Extends the control plane outside Azure.

Question 47

AZ-900: Repeatable, declarative deployments

Accepted Answer

ARM template or Bicep Declarative IaC through Resource Manager.

Question 48

AZ-900: Personalised recommendations for cost, security, reliability

Accepted Answer

Azure Advisor Five-pillar recommendations.

Question 49

AZ-900: Is an Azure outage or maintenance affecting me?

Accepted Answer

Azure Service Health Personalised view of Azure issues.

Question 50

AZ-900: Find slow requests and exceptions in a web app

Accepted Answer

Application Insights Application performance monitoring.

AZ-900 question patterns

Find a pattern

In this list

Wording that decides the answer

Cloud concepts

Architecture and compute

Networking and storage

Identity and security

Cost, governance and monitoring