Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- About 40-60 questions in around 45 minutes of exam time. Scaled score out of 1,000; you need 700. Check the official page for the current counts.
- Domain weights: cloud concepts 25-30%, architecture and services 35-40%, management and governance 30-35%.
- No penalty for wrong answers, so answer everything. Some question types (yes/no sets, drag and drop, hot area) can’t be revisited once you move on, so read carefully.
How to read an AZ-900 question
| The question says | Think |
|---|---|
| Least administrative effort | The more managed option: PaaS over IaaS, serverless over VM |
| Full control of the OS | IaaS virtual machine |
| Survive datacenter failure | Availability zones, ZRS |
| Survive region failure | Region pair, GRS or GZRS |
| Not over the public internet | ExpressRoute, private endpoint |
| Estimate before deploying | Pricing calculator |
| Prevent accidental deletion | Resource lock |
| Enforce a standard configuration | Azure Policy |
| Who can do what | RBAC |
Statements questions (“select Yes if the statement is true”) are mostly about precise wording. Watch for always, only, never.
Shared responsibility
| IaaS | PaaS | SaaS | |
|---|---|---|---|
| Data, accounts, devices | You | You | You |
| Applications | You | Shared | Microsoft |
| Operating system | You | Microsoft | Microsoft |
| Physical hosts and datacenter | Microsoft | Microsoft | Microsoft |
Hierarchy
Management groups → subscriptions → resource groups → resources. RBAC and Policy inherit downward. A resource is in one resource group. Resource groups don’t nest.
Storage
| Redundancy | Survives |
|---|---|
| LRS | Disk or rack failure (1 datacenter) |
| ZRS | Zone failure |
| GRS | Region failure |
| GZRS | Zone and region failure |
| RA- variants | Add read access to the secondary |
| Tier | Note |
|---|---|
| Hot | Frequent access |
| Cool | 30 days minimum |
| Cold | 90 days minimum |
| Archive | 180 days minimum, offline, rehydrate to read |
Services: Blob (objects), Files (SMB/NFS), Queue (messages), Table (NoSQL), Disk (VM volumes).
VM availability
Single VM with premium disks 99.9% → availability set 99.95% → zones 99.99%.
Pairs people mix up
| A | B | The difference |
|---|---|---|
| VPN Gateway | ExpressRoute | Encrypted over internet / private provider link |
| Entra ID | Entra Domain Services | Cloud identity / managed domain controllers |
| RBAC | Azure Policy | User permissions / resource configuration |
| Policy | Resource lock | Compliance rules / prevent delete or change |
| CanNotDelete | ReadOnly | Can modify but not delete / cannot modify or delete |
| Cost Management | Pricing calculator | Actual spending / future estimate |
| Azure Advisor | Service Health | Recommendations for your resources / Azure incidents affecting you |
| Azure Monitor | Application Insights | Platform metrics and logs / app performance monitoring |
| Defender for Cloud | Azure Advisor | Security posture and threats / broad best practice |
| Cloud Shell | Azure CLI | Hosted browser shell / the command-line tool itself |
| Scale up | Scale out | Bigger machine / more machines |
| Availability set | Availability zone | Racks in one datacenter / separate datacenters |
| Data Box | Azure Migrate | Ship data offline / assess and migrate workloads |
| ARM template | Bicep | JSON / simpler language that compiles to it |
| Private cloud | Hybrid cloud | Only yours / mix with public, connected |
Defaults that are usually right
- PaaS over IaaS when the question asks for less management.
- MFA and Conditional Access for sign-in protection; passwordless where offered.
- Tags plus Cost Management for cost reporting; budgets for alerts.
- Policy to enforce, RBAC to authorise, locks to protect.
- Templates (ARM or Bicep) for repeatable deployment.