Introduction
The single best predictor of passing AZ-900 isn’t how much Microsoft Learn content you’ve consumed — it’s how consistently you score on realistic practice questions. This article gives you 25 scenario-style questions modeled on the real Azure Fundamentals exam, organized by the four official domains, with full answer explanations.
Use it as a diagnostic: if you get 20+ right on the first read, you’re exam-ready. Below 18, you have weak domains to revisit. After that, run a few full-length Sailor.sh AZ-900 mock exams under timed conditions to lock in performance.
How to Use These Questions
- Don’t peek. Try every question before reading the answer.
- Note your reasoning, not just the letter. The real exam tests why.
- Track wrong answers by domain. That’s where your study time should go next.
- AZ-900 has roughly 40–60 questions in 45 minutes — about 45–60 seconds per question. Time yourself.
Domain 1 — Cloud Concepts
Question 1
A company wants to deploy infrastructure without buying or maintaining physical servers, paying only for what they use. Which cloud benefit best describes this?
A. High availability B. Consumption-based pricing C. Elasticity D. Fault tolerance
Answer: B — Consumption-based pricing. Paying only for consumed resources is the textbook definition of OpEx/consumption pricing. Elasticity describes scaling up/down with load, not the billing model.
Question 2
Your organization needs to keep certain data on-premises for regulatory reasons but wants to run analytics workloads in Azure. Which deployment model applies?
A. Public cloud B. Private cloud C. Hybrid cloud D. Community cloud
Answer: C — Hybrid cloud. Hybrid combines on-premises infrastructure with public cloud services, typically connected over VPN or ExpressRoute.
Question 3
In the shared responsibility model, who is responsible for patching the operating system of an Azure Virtual Machine?
A. Microsoft B. The customer C. Both D. Neither — Azure VMs don’t have an OS
Answer: B — The customer. For IaaS (VMs), Microsoft manages the physical host; the customer manages the guest OS, runtime, and application. In PaaS (e.g., App Service), Microsoft patches the OS for you.
Question 4
Which service model abstracts the most infrastructure away from the user?
A. IaaS B. PaaS C. SaaS D. On-premises
Answer: C — SaaS. SaaS (e.g., Microsoft 365) abstracts everything; you just use the application. IaaS abstracts only the hardware.
Question 5
A startup wants minimal upfront cost and the ability to scale rapidly during product launches. Which benefit pair applies?
A. Capital expenditure and reliability B. Operational expenditure and elasticity C. Operational expenditure and disaster recovery D. Capital expenditure and high availability
Answer: B — Operational expenditure and elasticity. OpEx avoids upfront capital outlay; elasticity lets resources scale with demand.
Domain 2 — Azure Architecture and Services
Question 6
You need to deploy resources across multiple physically separate datacenters within the same region to protect against datacenter failure. What should you use?
A. Region pairs B. Availability zones C. Resource groups D. Management groups
Answer: B — Availability zones. AZs are physically separate datacenters within a region. Region pairs protect against entire-region failure (different concept).
Question 7
Which Azure storage redundancy option keeps six copies of your data across two regions?
A. LRS B. ZRS C. GRS D. RA-GRS
Answer: C — GRS (Geo-Redundant Storage). GRS keeps 3 copies in the primary region (LRS) plus 3 in a paired region, total 6. RA-GRS adds read access to the secondary but the copy count is the same. ZRS keeps 3 copies across availability zones in one region.
Question 8
You need to host a stateless web API that scales to zero when idle and charges per request. Which service fits best?
A. Azure Virtual Machine B. Azure App Service C. Azure Functions D. Azure Kubernetes Service
Answer: C — Azure Functions. Functions on the Consumption plan scale to zero and bill per execution. App Service can scale but doesn’t bill per request the same way.
Question 9
Which Azure service provides a global, layer-7 load balancer with CDN, WAF, and intelligent routing for web applications?
A. Azure Load Balancer B. Azure Application Gateway C. Azure Front Door D. Azure Traffic Manager
Answer: C — Azure Front Door. Front Door is global L7 with built-in CDN and WAF. Application Gateway is regional L7. Load Balancer is L4. Traffic Manager is DNS-based.
Question 10
What is the logical boundary that contains and bills Azure resources?
A. Resource group B. Subscription C. Management group D. Tenant
Answer: B — Subscription. Billing happens at the subscription level. Resource groups organize resources within a subscription. Management groups organize multiple subscriptions.
Question 11
You need to move 50 TB of on-premises data into Azure Blob storage. Internet bandwidth is limited. What is the most cost-effective service?
A. Azure ExpressRoute B. Azure Data Box C. AzCopy over public internet D. VPN Gateway
Answer: B — Azure Data Box. For large offline data transfers, Microsoft ships a physical device. ExpressRoute is a connectivity service, not a transfer device.
Question 12
A team needs to run a managed Kubernetes cluster without managing the control plane themselves. Which service is the right fit?
A. Azure Container Instances B. Azure Kubernetes Service C. Azure Virtual Machine Scale Sets D. Azure App Service
Answer: B — AKS. AKS manages the K8s control plane for you. ACI runs single containers without K8s.
Question 13
Microsoft’s identity service for cloud-based authentication and authorization is now called:
A. Azure AD B. Microsoft Entra ID C. Active Directory Domain Services D. Azure Identity Provider
Answer: B — Microsoft Entra ID. Microsoft rebranded Azure AD to Entra ID in 2023. The underlying service is the same; expect both names on the exam.
Question 14
Which of the following is not an Azure compute service?
A. Virtual Machines B. App Service C. Cosmos DB D. Functions
Answer: C — Cosmos DB. Cosmos DB is a globally distributed, multi-model database service, not compute.
Question 15
A company has applications that must communicate with on-premises systems over a private connection that does not traverse the public internet. What should they use?
A. Site-to-Site VPN B. ExpressRoute C. Point-to-Site VPN D. Azure Front Door
Answer: B — ExpressRoute. ExpressRoute is a private, dedicated connection that bypasses the public internet. VPNs go over the public internet.
Domain 3 — Azure Management and Governance
Question 16
Which tool helps you compare the cost of running workloads on-premises vs. in Azure before migrating?
A. Azure Pricing Calculator B. Azure Cost Management C. Total Cost of Ownership (TCO) Calculator D. Azure Advisor
Answer: C — TCO Calculator. TCO compares on-prem vs. Azure costs pre-migration. The Pricing Calculator estimates Azure-only costs.
Question 17
You want to enforce that all storage accounts deployed in your subscription must have HTTPS-only traffic enabled. What should you use?
A. Azure RBAC B. Resource lock C. Azure Policy D. Azure Blueprint
Answer: C — Azure Policy. Policy enforces rules on resources (e.g., require HTTPS). RBAC controls who can do what. Locks prevent deletion/modification.
Question 18
A composite service depends on two underlying services with 99.9% SLAs in series. What is the resulting composite SLA?
A. 99.9% B. 99.8% C. 99.81% D. 100%
Answer: B — ~99.8%. Multiplying 0.999 × 0.999 = 0.998001, which rounds to ~99.8%. Composite SLAs always get worse in series.
Question 19
Which service provides personalized recommendations to optimize your Azure deployments for cost, performance, security, and reliability?
A. Azure Monitor B. Azure Advisor C. Service Health D. Microsoft Defender for Cloud
Answer: B — Azure Advisor. Advisor gives personalized recommendations across five pillars. Defender for Cloud focuses on security posture specifically.
Question 20
You need to prevent anyone, including subscription owners, from accidentally deleting a critical resource group. What’s the simplest way?
A. RBAC: remove Delete permission B. Resource lock with CanNotDelete C. Azure Policy with deny effect D. Move it to another subscription
Answer: B — Resource lock with CanNotDelete. Locks apply regardless of role permissions. They’re the standard guardrail for production resources.
Question 21
Which Azure governance service lets you package ARM templates, RBAC assignments, and policies into a repeatable deployment artifact?
A. Azure Policy B. Azure Blueprints C. Azure DevOps D. Azure Resource Manager
Answer: B — Azure Blueprints. Blueprints package templates + policies + RBAC for repeatable environment provisioning.
Question 22
A user has Reader role at the subscription scope and Contributor at a specific resource group scope. Inside that resource group, what can they do?
A. Read only B. Read and write C. Read, write, and delete the subscription D. Nothing — conflicting roles cancel out
Answer: B — Read and write. RBAC is additive. The more permissive role wins at any given scope. Contributor allows create/edit but not delegation.
Question 23
Which Microsoft portal documents Azure’s compliance certifications (ISO, SOC, HIPAA, GDPR, etc.)?
A. Azure portal B. Service Trust Portal C. Microsoft Defender for Cloud D. Microsoft Purview
Answer: B — Service Trust Portal. STP hosts compliance reports and certifications. Purview focuses on data governance and cataloging.
Question 24
You want a single pane of glass to query logs across multiple Azure services using Kusto Query Language (KQL). What should you use?
A. Azure Monitor Metrics B. Log Analytics workspace C. Application Insights D. Service Health
Answer: B — Log Analytics workspace. Log Analytics is the KQL-queryable log store. Metrics and App Insights feed into it but aren’t the query interface themselves.
Question 25
Which combination most accurately reflects the difference between Azure Policy and RBAC?
A. Policy controls users; RBAC controls resources B. Policy controls resource configuration; RBAC controls user permissions C. They are interchangeable D. Both control billing
Answer: B — Policy controls resource configuration; RBAC controls user permissions. Policy says what resources can look like. RBAC says who can do what.
Scoring Yourself
| Score | Verdict |
|---|---|
| 23–25 | Exam-ready. Schedule with confidence. |
| 19–22 | Close. Review missed-domain content, then re-test on a full-length mock. |
| 15–18 | One more focused study week recommended. |
| Below 15 | Revisit Microsoft Learn AZ-900 path; don’t book the exam yet. |
Common Mistakes on Practice Questions
- Reading too fast. Words like least cost, highest availability, minimum effort change the right answer.
- Memorizing keywords. “Global load balancer” → “Front Door” is fine, but the exam often describes scenarios without the keyword. Understand the service capabilities.
- Confusing similar services. Application Gateway vs. Load Balancer vs. Front Door vs. Traffic Manager is the #1 mix-up. Make a cheat sheet.
- Ignoring shared responsibility nuances. PaaS vs. IaaS responsibility splits are tested repeatedly.
Next Steps
Twenty-five questions is a useful diagnostic — but the real exam pulls from a much broader bank, with multi-select, drag-and-drop, and hot-area question types. Practice under realistic conditions before you book your slot.
Sailor.sh’s full AZ-900 mock exam bundle gives you hundreds of additional questions across every domain, all question types Microsoft uses, and detailed explanations for every answer. Most candidates pass on the first attempt after consistently scoring 80%+ on two consecutive full-length mocks.
Pair this with our AZ-900 exam guide 2026 for full context on what’s tested and how to plan your final week of prep.