PrepFree AZ-900 practice test
12 original questions written by our editors against the official Microsoft exam domains. They are not real exam questions. Pick an answer to see why it is right or wrong.
-
Question 1 of 12Describe cloud concepts
A company moves an application to Azure virtual machines (IaaS). After a security review, the team asks who is responsible for installing security patches on the VMs' guest operating system. What is the answer?
Show answer
Answer: D. Under the shared responsibility model for IaaS, Microsoft manages the physical datacenter, hosts and network, while the customer manages the guest operating system, applications and data. Microsoft does not patch the OS inside your VMs in IaaS. The ISP has no role in the VM's software.
-
Question 2 of 12Describe cloud concepts
An online shop gets ten times its normal traffic during a two-week holiday sale. It wants extra capacity added automatically during the sale and removed afterwards, paying only for what it uses. Which cloud benefit does this describe?
Show answer
Answer: A. Elasticity is the ability to add and remove resources automatically as demand changes, which fits the consumption-based model. Fault tolerance is about surviving component failures, and predictability is about consistent performance and cost. Governance covers policies and compliance, not matching capacity to demand.
-
Question 3 of 12Describe cloud concepts
A development team wants to deploy its web application code to Azure without managing virtual machines, operating system updates or web server software. Which cloud service type fits best?
Show answer
Answer: B. PaaS, such as Azure App Service, runs your code while the provider manages the OS and runtime platform. IaaS would leave the team managing VMs and OS updates. SaaS delivers a finished application rather than a platform for your own code, and on-premises hosting keeps all management with the company.
-
Question 4 of 12Describe Azure architecture and services
A company runs a critical app on VMs in one Azure region. It must keep running if a whole datacenter in that region fails, but it does not need to survive the loss of the entire region. What should it use?
Show answer
Answer: B. Availability zones are physically separate datacenter locations within a region, so spreading VMs across them survives a datacenter failure. An availability set spreads VMs across racks and update domains inside a datacenter, which does not cover losing the whole datacenter. Resource groups and subscriptions are management boundaries with no effect on physical resilience.
-
Question 5 of 12Describe Azure architecture and services
A company has three Azure subscriptions for its finance department. It wants to apply the same access permissions and policies to all three at once instead of configuring each subscription separately. What should it use?
Show answer
Answer: B. Management groups sit above subscriptions, and access and policy assigned to a management group are inherited by every subscription in it. Resource groups live inside a subscription and cannot contain subscriptions. Tags label resources for reporting, and locks prevent deletion or changes, neither applies permissions or policies.
-
Question 6 of 12Describe Azure architecture and services
A bank wants a private, dedicated connection between its on-premises datacenter and Azure that does not travel over the public internet. Which service should it use?
Show answer
Answer: B. ExpressRoute provides a private connection from on-premises to Microsoft's network through a connectivity provider, without going over the public internet. VPN Gateway encrypts traffic but sends it over the internet. Virtual network peering connects Azure virtual networks to each other, and Azure DNS only hosts name resolution.
-
Question 7 of 12Describe Azure architecture and services
A company wants users to sign in with just a password from the office network, but to require multifactor authentication whenever they sign in from anywhere else. Which Microsoft Entra feature enforces this?
Show answer
Answer: C. Conditional Access evaluates signals such as location and then applies requirements like MFA. RBAC decides what an authenticated user can do with Azure resources, not how they sign in. Entra Domain Services provides managed domain features such as LDAP and Kerberos, and Defender for Cloud assesses and protects workload security posture.
-
Question 8 of 12Describe Azure architecture and services
A company must keep old audit files for seven years. The files are almost never read, and when they are, waiting several hours for them is acceptable. Which blob storage access tier gives the lowest storage cost?
Show answer
Answer: D. The Archive tier has the lowest storage cost and suits rarely accessed data that can tolerate hours of rehydration before reading. Hot, Cool and Cold are online tiers that allow immediate access, which is why their storage costs more. Cool and Cold suit infrequently accessed data that still needs to be read without delay.
-
Question 9 of 12Describe Azure management and governance
Administrators must still be able to change the settings of a production database, but nobody, including subscription owners, should be able to delete it by accident. What should be applied?
Show answer
Answer: B. A delete lock blocks deletion for all users, including owners, while still allowing changes. A read-only lock and the Reader role would both block the configuration changes the administrators need. A tag is only a label and does not prevent anything.
-
Question 10 of 12Describe Azure management and governance
For data residency reasons, a company must make sure new resources can only be created in European regions. Which service enforces this rule?
Show answer
Answer: B. Azure Policy can enforce rules such as allowed locations and deny deployments that break them. Resource locks prevent deletion or modification of existing resources but do not restrict where new ones are created. Azure Advisor gives recommendations, and budgets track spending; neither blocks a deployment.
-
Question 11 of 12Describe Azure management and governance
Marketing, sales and HR share one Azure subscription. Finance wants each department's Azure costs shown separately in cost reports. What is the simplest way to make this possible?
Show answer
Answer: D. Tags are name-value pairs that can be used to group and filter costs in cost analysis, for example by department. Availability zones are about resilience, not cost reporting. Resource locks prevent changes, and Azure Arc extends Azure management to non-Azure servers; neither splits costs by department.
-
Question 12 of 12Describe Azure management and governance
An operations team wants to be alerted when an Azure service outage or planned maintenance affects the services and regions it uses. Which tool is designed for this?
Show answer
Answer: B. Azure Service Health reports service issues, planned maintenance and health advisories that affect your own subscriptions and regions, and can send alerts. Azure Advisor gives best-practice recommendations, not incident notices. Application Insights monitors your application's telemetry, and Azure Arc manages resources outside Azure.
| Exam domain | Correct |
|---|