Introduction
The single best predictor of passing AZ-900 isn’t how much Microsoft Learn content you’ve consumed — it’s how consistently you score on realistic practice questions. This article gives you 25 scenario-style questions modeled on the real Azure Fundamentals exam, organized by the three official domains, with full answer explanations.
Use it as a diagnostic: if you get 20+ right on the first read, you’re exam-ready. Below 18, you have weak domains to revisit. After that, run a few full-length Sailor.sh AZ-900 mock exams under timed conditions to lock in performance.
How to Use These Questions
- Don’t peek. Try every question before reading the answer.
- Note your reasoning, not just the letter. The real exam tests why.
- Track wrong answers by domain. That’s where your study time should go next.
- AZ-900 has roughly 40–60 questions in 45 minutes — about 45–60 seconds per question. Time yourself.
Domain 1 — Cloud Concepts
Question 1
A company wants to deploy infrastructure without buying or maintaining physical servers, paying only for what they use. Which cloud benefit best describes this?
A. High availability B. Consumption-based pricing C. Elasticity D. Fault tolerance
Answer: B — Consumption-based pricing. Paying only for consumed resources is the textbook definition of OpEx/consumption pricing. Elasticity describes scaling up/down with load, not the billing model.
Question 2
Your organization needs to keep certain data on-premises for regulatory reasons but wants to run analytics workloads in Azure. Which deployment model applies?
A. Public cloud B. Private cloud C. Hybrid cloud D. Community cloud
Answer: C — Hybrid cloud. Hybrid combines on-premises infrastructure with public cloud services, typically connected over VPN or ExpressRoute.
Question 3
In the shared responsibility model, who is responsible for patching the operating system of an Azure Virtual Machine?
A. Microsoft B. The customer C. Both D. Neither — Azure VMs don’t have an OS
Answer: B — The customer. For IaaS (VMs), Microsoft manages the physical host; the customer manages the guest OS, runtime, and application. In PaaS (e.g., App Service), Microsoft patches the OS for you.
Question 4
Which service model abstracts the most infrastructure away from the user?
A. IaaS B. PaaS C. SaaS D. On-premises
Answer: C — SaaS. SaaS (e.g., Microsoft 365) abstracts everything; you just use the application. IaaS abstracts only the hardware.
Question 5
A startup wants minimal upfront cost and the ability to scale rapidly during product launches. Which benefit pair applies?
A. Capital expenditure and reliability B. Operational expenditure and elasticity C. Operational expenditure and disaster recovery D. Capital expenditure and high availability
Answer: B — Operational expenditure and elasticity. OpEx avoids upfront capital outlay; elasticity lets resources scale with demand.
Domain 2 — Azure Architecture and Services
Question 6
You need to deploy resources across multiple physically separate datacenters within the same region to protect against datacenter failure. What should you use?
A. Region pairs B. Availability zones C. Resource groups D. Management groups
Answer: B — Availability zones. AZs are physically separate datacenters within a region. Region pairs protect against entire-region failure (different concept).
Question 7
Which Azure storage redundancy option keeps six copies of your data across two regions?
A. LRS B. ZRS C. GRS D. RA-GRS
Answer: C — GRS (Geo-Redundant Storage). GRS keeps 3 copies in the primary region (LRS) plus 3 in a paired region, total 6. RA-GRS adds read access to the secondary but the copy count is the same. ZRS keeps 3 copies across availability zones in one region.
Question 8
You need to host a stateless web API that scales to zero when idle and charges per request. Which service fits best?
A. Azure Virtual Machine B. Azure App Service C. Azure Functions D. Azure Kubernetes Service
Answer: C — Azure Functions. Functions on the Consumption plan scale to zero and bill per execution. App Service can scale but doesn’t bill per request the same way.
Question 9
Two virtual networks in the same Azure region need to communicate over the Microsoft backbone using private IP addresses, with no gateways or public internet involved. What should you configure?
A. VNet peering B. ExpressRoute C. Point-to-Site VPN D. Azure DNS
Answer: A — VNet peering. Peering connects two Azure virtual networks directly over the Microsoft backbone. ExpressRoute and VPNs connect on-premises networks to Azure. Azure DNS resolves names; it doesn’t connect networks.
Question 10
What is the logical boundary that contains and bills Azure resources?
A. Resource group B. Subscription C. Management group D. Tenant
Answer: B — Subscription. Billing happens at the subscription level. Resource groups organize resources within a subscription. Management groups organize multiple subscriptions.
Question 11
You need to move 50 TB of on-premises data into Azure Blob storage. Internet bandwidth is limited. What is the most cost-effective service?
A. Azure ExpressRoute B. Azure Data Box C. AzCopy over public internet D. VPN Gateway
Answer: B — Azure Data Box. For large offline data transfers, Microsoft ships a physical device. ExpressRoute is a connectivity service, not a transfer device.
Question 12
A team needs to run a managed Kubernetes cluster without managing the control plane themselves. Which service is the right fit?
A. Azure Container Instances B. Azure Kubernetes Service C. Azure Virtual Machine Scale Sets D. Azure App Service
Answer: B — AKS. AKS manages the K8s control plane for you. ACI runs single containers without K8s.
Question 13
Which service is Microsoft’s cloud-based identity and access management service used to sign users in to Azure and Microsoft 365?
A. Active Directory Domain Services B. Microsoft Entra ID C. Microsoft Purview D. Azure Key Vault
Answer: B — Microsoft Entra ID. Entra ID handles cloud authentication, single sign-on, MFA, and Conditional Access. Active Directory Domain Services is the traditional on-premises directory. The current exam uses the Entra naming exclusively.
Question 14
Which of the following is not an Azure compute service?
A. Virtual Machines B. App Service C. Cosmos DB D. Functions
Answer: C — Cosmos DB. Cosmos DB is a globally distributed, multi-model database service, not compute.
Question 15
A company has applications that must communicate with on-premises systems over a private connection that does not traverse the public internet. What should they use?
A. Site-to-Site VPN B. ExpressRoute C. Point-to-Site VPN D. Azure Front Door
Answer: B — ExpressRoute. ExpressRoute is a private, dedicated connection that bypasses the public internet. VPNs go over the public internet.
Domain 3 — Azure Management and Governance
Question 16
Your team has designed a new Azure architecture but deployed nothing yet. Which tool produces an estimate of the expected monthly Azure bill for the planned services?
A. Azure Pricing Calculator B. Cost Management C. Advisor D. Azure Monitor
Answer: A — Azure Pricing Calculator. The Pricing Calculator estimates costs for planned services before deployment. Cost Management analyzes what deployed resources actually cost, and Advisor recommends savings on resources that already exist.
Question 17
You want to enforce that all storage accounts deployed in your subscription must have HTTPS-only traffic enabled. What should you use?
A. Azure RBAC B. Resource lock C. Azure Policy D. Azure Blueprint
Answer: C — Azure Policy. Policy enforces rules on resources (e.g., require HTTPS). RBAC controls who can do what. Locks prevent deletion/modification.
Question 18
An administrator wants to run Azure CLI and Azure PowerShell commands from a browser without installing anything locally. What should they use?
A. Azure Arc B. Azure Cloud Shell C. ARM templates D. Application Insights
Answer: B — Azure Cloud Shell. Cloud Shell is a browser-based shell with the CLI and PowerShell preinstalled. Azure Arc extends Azure management to non-Azure machines, and ARM templates are declarative deployment files, not a shell.
Question 19
Which service provides personalized recommendations to optimize your Azure deployments for cost, performance, security, and reliability?
A. Azure Monitor B. Advisor C. Service Health D. Microsoft Defender for Cloud
Answer: B — Advisor. Advisor gives personalized recommendations across cost, performance, security, reliability, and operational excellence. Defender for Cloud focuses on security posture specifically.
Question 20
You need to prevent anyone, including subscription owners, from accidentally deleting a critical resource group. What’s the simplest way?
A. RBAC: remove Delete permission B. Resource lock with CanNotDelete C. Azure Policy with deny effect D. Move it to another subscription
Answer: B — Resource lock with CanNotDelete. Locks apply regardless of role permissions. They’re the standard guardrail for production resources.
Question 21
Which service provides unified data governance, letting an organization catalog, classify, and track its data across Azure and on-premises sources?
A. Azure Policy B. Microsoft Purview C. Azure Monitor D. Cost Management
Answer: B — Microsoft Purview. Purview governs data (cataloging, classification, lineage). Azure Policy governs resource configuration — a distinction the exam tests directly.
Question 22
A user has Reader role at the subscription scope and Contributor at a specific resource group scope. Inside that resource group, what can they do?
A. Read only B. Read and write C. Read, write, and delete the subscription D. Nothing — conflicting roles cancel out
Answer: B — Read and write. RBAC is additive. The more permissive role wins at any given scope. Contributor allows create/edit but not delegation.
Question 23
Which Microsoft portal documents Azure’s compliance certifications (ISO, SOC, HIPAA, GDPR, etc.)?
A. Azure portal B. Service Trust Portal C. Microsoft Defender for Cloud D. Microsoft Purview
Answer: B — Service Trust Portal. STP hosts compliance reports and certifications. Purview focuses on data governance and cataloging.
Question 24
You want a single pane of glass to query logs across multiple Azure services using Kusto Query Language (KQL). What should you use?
A. Azure Monitor Metrics B. Log Analytics workspace C. Application Insights D. Service Health
Answer: B — Log Analytics workspace. Log Analytics is the KQL-queryable log store. Metrics and App Insights feed into it but aren’t the query interface themselves.
Question 25
Which combination most accurately reflects the difference between Azure Policy and RBAC?
A. Policy controls users; RBAC controls resources B. Policy controls resource configuration; RBAC controls user permissions C. They are interchangeable D. Both control billing
Answer: B — Policy controls resource configuration; RBAC controls user permissions. Policy says what resources can look like. RBAC says who can do what.
Scoring Yourself
| Score | Verdict |
|---|---|
| 23–25 | Exam-ready. Schedule with confidence. |
| 19–22 | Close. Review missed-domain content, then re-test on a full-length mock. |
| 15–18 | One more focused study week recommended. |
| Below 15 | Revisit Microsoft Learn AZ-900 path; don’t book the exam yet. |
Common Mistakes on Practice Questions
- Reading too fast. Words like least cost, highest availability, minimum effort change the right answer.
- Memorizing keywords. “Global load balancer” → “Front Door” is fine, but the exam often describes scenarios without the keyword. Understand the service capabilities.
- Confusing similar services. Azure Policy vs. RBAC vs. resource locks, and VPN Gateway vs. ExpressRoute vs. VNet peering, are the #1 mix-ups. Make a cheat sheet.
- Ignoring shared responsibility nuances. PaaS vs. IaaS responsibility splits are tested repeatedly.
Next Steps
Twenty-five questions is a useful diagnostic — but the real exam pulls from a much broader bank and runs on a scaled 1,000-point score with a 700 passing bar. Practice under realistic, timed conditions before you book your slot.
Start with our free 20-question AZ-900 practice test — no signup required. Then use Sailor.sh’s full AZ-900 mock exam bundle: 8 timed 50-question mock exams, 420 unique questions in total, scored on the real exam’s 1,000-point scale with detailed explanations for every answer. Most candidates pass on the first attempt after consistently clearing the 700 bar on two consecutive full-length mocks.
Pair this with our AZ-900 exam guide 2026 for full context on what’s tested and how to plan your final week of prep.