AZ-900: Microsoft Azure Fundamentals

AZ-900 exam objectives and study guide

The skills measured on the AZ-900 exam, by objective domain. Percentages are the share of the exam each domain carries.

AZ-900 practice questions and answers

12 free sample questions from the AZ-900 bank, with the correct answer and a full explanation for each. These are original questions written to the Microsoft objective domains — not real exam content.

1. Question 1Describe Azure management and governance

   Before a proof of concept starts, one on-premises Linux VM must be connected so it receives an Azure Resource ID and appears under Azure Arc > Machines. Which component should be installed on the VM?

   • AAzure Connected Machine agent
   • BAzure Monitor Agent
   • CMicrosoft Defender for Endpoint sensor
   • DMicrosoft Entra Connect Sync agent

   Show answer and explanation

   Correct answer

   • Azure Connected Machine agent

   Explanation

   The Azure Connected Machine agent is installed on Windows or Linux machines hosted outside Azure to connect them to Azure Arc-enabled servers. After connection, the machine is represented as an Azure resource with an Azure Resource ID.

   • Azure Monitor Agent collects monitoring data and is separate from the Connected Machine agent; it does not replace it.
   • The Microsoft Defender for Endpoint sensor is used for endpoint protection and threat detection, not Azure Arc onboarding.
   • The Microsoft Entra Connect Sync agent synchronizes identity data for hybrid identity scenarios, not server management through Azure Arc.

   References:

   • Overview of the Azure Connected Machine agent
   • Azure Arc-enabled servers Overview
2. Question 2Describe Azure management and governance

   Users report that virtual machines are being created in regions that the operations team has not approved. Administrators want to keep the current Contributor assignments but prevent future deployments outside the approved region list. What should they configure?

   • AAssign an Azure Policy definition that allows only the approved locations and uses an enforcement effect.
   • BRemove the Contributor role from the users and assign the Reader role at the subscription scope.
   • CApply a resource lock at the subscription scope to block changes in unapproved regions.
   • DCreate a Microsoft Entra Conditional Access policy for Azure management sign-ins.

   Show answer and explanation

   Correct answer

   • Assign an Azure Policy definition that allows only the approved locations and uses an enforcement effect.

   Explanation

   Azure Policy is the appropriate control because it can evaluate resource properties, such as location, and use the deny effect to stop noncompliant deployments while leaving Azure RBAC role assignments unchanged.

   • An Azure Policy assignment that restricts allowed locations is correct because Azure Policy enforces organizational standards at the assigned scope.
   • Removing Contributor and assigning Reader is incorrect because it would prevent users from deploying approved resources too, and it changes permissions rather than enforcing a resource property rule.
   • A resource lock is incorrect because locks protect existing resources from deletion or modification; they do not restrict the region used for new deployments.
   • A Microsoft Entra Conditional Access policy is incorrect because Conditional Access evaluates sign-in and access conditions, not Azure resource location properties.

   References:

   • Overview of Azure Policy
   • Azure Policy definitions effect basics
   • What is Azure role-based access control (Azure RBAC)?
3. Question 3Describe Azure management and governance

   Kwame, a governance specialist, must set expectations for application teams before a tagging rollout. Some teams assume the labels will enforce access and location decisions by themselves. Which two statements should Kwame include? (Select two.)

   • ATags can help organize resources for management, automation, and cost reporting, but they don't create an Azure RBAC scope by themselves.
   • BTags assigned to a subscription or resource group aren't automatically inherited by lower-scope resources.
   • CA tag key can be used as the source address in a network security group rule to allow traffic for an application.
   • DTags are stored only in Azure DevOps and aren't visible on Azure resources in the Azure portal.
   • EChanging a tag value moves the tagged resource to a different subscription for billing and governance.

   Show answer and explanation

   Correct answers

   • Tags can help organize resources for management, automation, and cost reporting, but they don't create an Azure RBAC scope by themselves.
   • Tags assigned to a subscription or resource group aren't automatically inherited by lower-scope resources.

   Explanation

   The correct statements describe what Azure resource tags do and what they do not do.

   • Tags help with organization, automation, and cost reporting, but don't create an Azure RBAC scope is correct. Azure RBAC scopes are management group, subscription, resource group, and resource scopes; tags are metadata.
   • Tags aren't automatically inherited from a subscription or resource group is correct. If inherited tag values are required, use Azure Policy or automation.
   • Using a tag key as an NSG source address is incorrect. Network security group rules can use IP addresses, application security groups, or Azure service tags, but not Azure resource tags.
   • Saying tags are stored only in Azure DevOps is incorrect. Azure DevOps work item tags exist, but Azure resources also support Azure resource tags.
   • Changing a tag value moves a resource to a different subscription is incorrect. Tags can help allocate or report costs, but they don't move resources between billing or deployment scopes.

   References:

   • Use tags to organize your Azure resources and management hierarchy
   • Understand scope for Azure RBAC
   • Azure service tags overview
   • Add Tags to Work Items to Categorize Lists and Boards
4. Question 4Describe Azure management and governance

   Portal search results show hundreds of resources, and operations staff cannot quickly identify which owner should receive maintenance notifications. Which Azure feature is intended to store owner metadata on resources for filtering and inventory?

   • AAzure resource tags
   • BAzure resource locks
   • CAzure management groups
   • DAzure Service Health

   Show answer and explanation

   Correct answer

   • Azure resource tags

   Explanation

   Azure resource tags are intended for this scenario. A tag such as Owner=<name or team> stores metadata on a resource so administrators can filter, inventory, and report on resources consistently.

   • Resource locks help prevent accidental deletion or modification, but they don't classify ownership.
   • Management groups organize subscriptions for governance at scale, not individual resource owner metadata.
   • Azure Service Health provides personalized health alerts and advisories, not resource classification metadata.

   References:

   • Use tags to organize your Azure resources and management hierarchy
   • Lock your Azure resources to protect your infrastructure
   • Organize your resources with management groups
5. Question 5Describe Azure management and governance

   Wingtip Toys operates separate Azure subscriptions for retail, analytics, and shared services. The platform team wants a hierarchical way to apply Azure Policy assignments and Azure RBAC role assignments to all current and future subscriptions in a business unit. Which approach should the team use?

   • ACreate a management group hierarchy and assign the controls at the relevant management group scope.
   • BMove the workloads into a shared resource group and assign the controls at the resource group scope.
   • CUse Azure Lighthouse to delegate administration of the subscriptions to a managing tenant.
   • DCreate separate policy assignments and role assignments in each subscription as it is created.

   Show answer and explanation

   Correct answer

   • Create a management group hierarchy and assign the controls at the relevant management group scope.

   Explanation

   Azure management groups provide a hierarchy above subscriptions. Policy assignments and Azure RBAC role assignments made at a management group scope are inherited by the subscriptions under that management group, which supports consistent governance at scale.

   • A resource group is contained within a single subscription and cannot group multiple subscriptions.
   • Azure Lighthouse is used for delegated resource management, commonly across tenants; it is not the native hierarchy for organizing subscriptions for inherited governance.
   • Creating assignments separately in each subscription can work for individual subscriptions, but it does not provide the requested hierarchy or automatic inheritance for future subscriptions.

   References:

   • Organize your resources with management groups
   • Understand scope for Azure RBAC
   • Overview of Azure Policy
6. Question 6Describe Azure management and governance

   Fourth Coffee's legal team is preparing for a customer audit. The auditors ask for Microsoft's SOC and ISO reports and information about how Microsoft protects cloud services. The team does not need to scan Azure resources or change workload configurations. Which tool should the team use?

   • AMicrosoft Service Trust Portal
   • BMicrosoft Defender for Cloud regulatory compliance dashboard
   • CAzure Monitor activity log
   • DMicrosoft Purview Compliance Manager

   Show answer and explanation

   Correct answer

   • Microsoft Service Trust Portal

   Explanation

   Microsoft Service Trust Portal is the correct tool for accessing Microsoft cloud security, privacy, and compliance documentation, including independent audit reports such as SOC and ISO-related materials.

   • Microsoft Defender for Cloud regulatory compliance dashboard evaluates your Azure environment against compliance controls; it is not the primary source for Microsoft's third-party audit reports.
   • Azure Monitor activity log records subscription-level control-plane events, such as resource creation or configuration changes.
   • Microsoft Purview Compliance Manager helps track compliance posture and improvement actions, but the stated need is to obtain Microsoft cloud trust and audit documentation.

   References:

   • Get started with the Microsoft Service Trust Portal
   • Microsoft Purview Compliance Manager
   • Activity Log in Azure Monitor
   • Improve regulatory compliance in Microsoft Defender for Cloud
7. Question 7Describe cloud concepts

   Fabrikam is building an inventory solution and wants two serverless components: one to run custom event-handling code and one to create low-code business workflows with built-in connectors. Which two Azure services should Fabrikam select?

   • AAzure Functions
   • BAzure Logic Apps
   • CAzure Virtual Machine Scale Sets
   • DAzure Kubernetes Service

   Show answer and explanation

   Correct answers

   • Azure Functions
   • Azure Logic Apps

   Explanation

   Azure Functions provides event-driven serverless compute for custom code. Azure Logic Apps provides serverless workflow orchestration with a visual designer and many managed connectors.

   • Azure Virtual Machine Scale Sets can scale IaaS VMs, but the customer still manages the VM operating system and application platform.
   • Azure Kubernetes Service is a managed Kubernetes service, but it is not the low-code workflow service and still requires Kubernetes operational knowledge.

   References:

   • Azure Functions Overview
   • Workflow Integration and Automation
8. Question 8Describe cloud concepts

   Telemetry from branch devices is written to an Azure Storage account. The platform must notify downstream components when new blobs are created and then execute short validation code without polling or managing servers. Which two Azure services should be selected?

   • AAzure Event Grid
   • BAzure Functions
   • CAzure Service Bus queues
   • DAzure Batch

   Show answer and explanation

   Correct answers

   • Azure Event Grid
   • Azure Functions

   Explanation

   Azure Event Grid is an event routing service that can publish Azure Storage events such as blob creation to subscribers. Azure Functions can run short validation code in response to those events without server administration.

   • Azure Service Bus queues are useful for enterprise messaging, but they do not by themselves subscribe to Blob Storage events without an event source or integration.
   • Azure Batch runs large-scale parallel and high-performance computing jobs; it is not the serverless event-routing component for storage events.

   References:

   • Introduction to Azure Event Grid
   • Azure Functions Overview
9. Question 9Describe cloud concepts

   Tailwind Traders' support team must automate approvals when a customer relationship management record changes. The workflow should send an approval email, update a SaaS ticketing system, and post a message to a collaboration channel. Business analysts prefer a visual designer and built-in connectors instead of writing and hosting code. Which service should they use?

   • AAzure Logic Apps
   • BAzure Functions
   • CAzure Automation
   • DAzure App Service Web Apps

   Show answer and explanation

   Correct answer

   • Azure Logic Apps

   Explanation

   Azure Logic Apps is the best fit because it provides serverless workflow automation, a visual designer, and managed connectors for SaaS and enterprise systems.

   • Azure Functions is serverless and event-driven, but it is code-first rather than a visual workflow service for business analysts.
   • Azure Automation is intended for process automation such as runbooks and configuration tasks, not SaaS workflow orchestration with a broad connector designer.
   • Azure App Service Web Apps hosts web applications and APIs, but it does not provide the low-code workflow orchestration experience described.

   References:

   • Workflow Integration and Automation
   • Azure Functions Overview
   • Azure Automation overview
10. Question 10Describe cloud concepts

    Relecloud protects an Azure Data Lake Storage Gen2 account with network controls. Azure Databricks serverless SQL warehouses in the same region need access, and the security team wants centralized rules without maintaining individual outbound IP lists. What should Relecloud configure?

    • AAssociate the storage account with a network security perimeter profile and add an inbound rule for the regional AzureDatabricksServerless service tag.
    • BAdd the published Azure Databricks serverless outbound IP addresses to each storage account firewall rule.
    • CAdd Azure Databricks serverless subnet IDs directly to the storage account firewall configuration.
    • DAdd an AzureDatabricksServerless service tag rule on the storage account firewall without a network security perimeter association.

    Show answer and explanation

    Correct answer

    • Associate the storage account with a network security perimeter profile and add an inbound rule for the regional AzureDatabricksServerless service tag.

    Explanation

    For Azure Databricks serverless compute access to Azure Storage in the same region, the documented approach is to associate the storage account with a network security perimeter profile and create an inbound access rule that allows the regional AzureDatabricksServerless service tag.

    • Allowlisting published outbound IP addresses works for some resources, but it violates the requirement to avoid maintaining IP lists.
    • Allowlisting serverless subnet IDs on storage accounts is not the recommended current approach for Databricks serverless access to Azure Storage.
    • Adding the AzureDatabricksServerless service tag directly to a storage account firewall is the wrong scope; the service tag is supported for network security perimeter inbound rules targeting Azure Storage.

    References:

    • Configure a firewall for serverless compute access
    • Azure Storage firewall rules and network access
11. Question 11Describe cloud concepts

    Woodgrove Bank's mobile API has sharp traffic spikes at lunchtime and no requests overnight. Developers can implement the API as HTTP-triggered functions, and the operations team wants to avoid paying for a dedicated compute instance while the app is idle. Which hosting option best matches the requirement?

    • AAzure Functions on the Consumption plan
    • BAzure Functions on the Premium plan with always-ready instances
    • CAzure App Service Web Apps on the Basic B1 tier
    • DAzure Kubernetes Service with the cluster autoscaler enabled

    Show answer and explanation

    Correct answer

    • Azure Functions on the Consumption plan

    Explanation

    The Azure Functions Consumption plan is the best fit for event-driven workloads that should scale automatically and avoid dedicated always-on compute while idle.

    • Azure Functions Premium plan with always-ready instances supports advanced features and reduced cold starts, but allocated or always-ready capacity is billed even when there are no requests.
    • Azure App Service Basic B1 is a dedicated App Service plan tier, so it does not meet the requirement to avoid dedicated idle compute.
    • Azure Kubernetes Service with cluster autoscaler can scale nodes, but the team would still operate a Kubernetes cluster and it is not the simplest serverless Functions hosting option.

    References:

    • Azure Functions Scale and Hosting
    • Azure Functions Consumption plan hosting (legacy)
12. Question 12Describe cloud concepts

    During a design review for a claims process, Jamal, a solution architect, must recommend a serverless approach for several dependent steps that may wait for external approval and retry failed activities. Developers want to express the orchestration in code within an Azure Functions project and avoid building their own state store. Which service capability should he recommend?

    • ADurable Functions
    • BAzure Logic Apps
    • CAzure Service Bus topics
    • DAzure App Service deployment slots

    Show answer and explanation

    Correct answer

    • Durable Functions

    Explanation

    Durable Functions is an extension of Azure Functions for stateful serverless workflows. It supports orchestrator functions, activity functions, durable timers, retries, and checkpointing of workflow state.

    • Azure Logic Apps can orchestrate workflows, but the requirement specifically calls for code-based orchestration inside an Azure Functions project.
    • Azure Service Bus topics provide publish-subscribe messaging, not code-based durable orchestration with checkpoints.
    • Azure App Service deployment slots help manage web app deployments and swaps; they do not provide serverless workflow state management.

    References:

    • Durable Functions Overview: Stateful Serverless Workflows
    • Azure Functions Overview
    • Workflow Integration and Automation

Membership includes 170 questions and explanations aligned to the AZ-900 curriculum.

Other Microsoft certifications

Every one of these is included with the same membership as AZ-900.

AB-900Microsoft

Microsoft 365 Copilot and Agent Administration Fundamentals

This exam is intended for candidates who are familiar with Microsoft 365, including core services, security, identity and access, data…

161 practice questionsView

AI-900Microsoft

Microsoft Azure AI Fundamentals

This exam measures knowledge of machine learning and AI concepts and related Microsoft Azure services. It is intended for candidates…

193 practice questionsView

DP-900Microsoft

Microsoft Azure Data Fundamentals

This exam measures knowledge of core data concepts and related Microsoft Azure data services. It is intended for candidates who are…

198 practice questionsView

AZ-900 exam FAQ