Welcome to Part 2 of our study series for the Microsoft Azure Fundamentals (AZ-900) certification. Reading through documentation is a great first step, but practicing with scenario-based questions is the most effective way to check your knowledge and build confidence before exam day.
 |
| Microsoft Azure Fundamentals (AZ-900) Practice Test - Part 2 |
In this AZ-900 practice test (Part 2), we cover 20 high-yield practice questions (Questions 21 through 40). You will review core cloud architecture, security, Microsoft Entra ID identity management, governance, and Azure cost optimization. Each question includes a simple breakdown explaining why the correct answer is right and why the other options do not fit.
AZ-900 Practice Test Questions
Q21: Identity Management (Matching)
Match each identity management term to its correct definition.
To answer, drag the appropriate term from the column on the left to its definition on the right. Each term may be used once, more than once, or not at all.
1. The security process that confirms the identity of a user or service by validating submitted credentials.
2. The mechanism that allows a user to log in one time and automatically access multiple related services without re-entering credentials.
3. The process of evaluating permissions to decide which resources or data an identified user is allowed to access and modify.
• Authentication (AuthN): The initial step of verifying that a person, device, or application is truly who they claim to be. This is typically accomplished by verifying credentials such as passwords, digital certificates, or tokens.
• Single sign-on (SSO): Enables users to authenticate once with a single set of enterprise credentials and access multiple independent cloud and on-premises applications without needing to sign in separately to each one.
• Authorization (AuthZ): Occurs after authentication is established. It verifies what privileges, operations, and resources the authenticated identity is permitted to access (such as read, write, or delete permissions enforced through Role-Based Access Control).
• Multifactor authentication (MFA) (unused option): A security practice requiring users to provide two or more distinct types of authentication factors (something you know, something you have, or something you are) during sign-in.
Q22: Cloud Concepts & Benefits
Select the answer that correctly completes the sentence:
[ ________ ] is the cloud capability that automatically allocates extra computing capacity during sudden traffic spikes and releases it when demand drops.
Elasticity is the ability of a cloud infrastructure to dynamically adapt resource capacity in real time. When demand suddenly surges, the environment automatically provisions additional compute resources (scales out). When demand returns to normal, it automatically de-provisions those resources (scales in) to avoid unnecessary costs.
Why are the other options incorrect?
• Scalability: Refers more broadly to the capability of a system to handle increased workloads by adding capacity (scaling vertically or horizontally), but elasticity specifically highlights the dynamic, automatic scaling up and down based on workload fluctuations.
• High availability: Focuses on keeping systems operational and accessible with minimal or zero downtime in the event of failures.
• Geo-distribution: Refers to hosting applications and data across multiple physical regions to improve performance for global users and protect against regional outages.
• Disaster recovery: Is the process of restoring applications and data following catastrophic outages or data loss events.
Q23: Shared Responsibility Model (Ordering)
An organization is planning its cloud migration strategy and reviewing how maintenance duties are divided under the shared responsibility model.
You need to arrange the hosting models based on the amount of operational responsibility handled by the cloud service provider.
In which order should you arrange the models, from the greatest cloud provider responsibility (top) to the least cloud provider responsibility (bottom)?
1. Position 1 (Top — Greatest CSP Responsibility):
2. Position 2:
3. Position 3:
4. Position 4 (Bottom — Least CSP Responsibility):
Under the Shared Responsibility Model, the division of management tasks between the customer and the cloud service provider (CSP) varies by deployment tier:
• Software as a Service (SaaS) (Greatest CSP responsibility): The provider manages nearly the entire stack—including physical datacenters, network infrastructure, servers, virtualization, operating systems, runtime, and the application software itself. The customer is only responsible for configuring user access, securing endpoint devices, and managing their own data.
• Platform as a Service (PaaS): The provider manages physical hardware, network infrastructure, virtualization, OS installation, and automated OS patching. The customer focuses solely on deploying and managing their application code and data.
• Infrastructure as a Service (IaaS): The provider manages physical security, hardware infrastructure, and the virtualization layer. The customer retains control and responsibility over operating system updates, network configuration, middleware, runtime environments, and applications.
• On-premises datacenter (Least CSP responsibility): There is no cloud provider involved; the organization/customer is 100% responsible for every layer of the architecture, from physical building security to application maintenance.
Q24: Azure Governance & Policy
A cloud administrator needs to implement several governance rules across multiple Azure subscriptions to meet an internal security baseline. The baseline requires enforcing allowed deployment regions, mandatory resource tags, and specific storage account configurations.
The administrator needs to bundle these individual policy definitions together so they can be assigned and monitored for compliance as a single unit.
What should the administrator create?
• An initiative definition: An Azure Policy initiative definition (also known as a policy set) is a collection of related policy definitions grouped together toward a specific goal or compliance standard (such as ISO 27001 or organizational tagging baselines). Grouping them into an initiative simplifies management by allowing administrators to assign and evaluate the entire set of policies as a single object.
Why are the other options incorrect?
• A resource lock: Used to prevent accidental deletion or modification of Azure resources (using CanNotDelete or ReadOnly locks), not to group governance rules.
• A policy exemption: Used to exempt a specific resource hierarchy or individual resource from the evaluation of an assigned policy or initiative definition.
• A custom role assignment: Grants specific permissions to identities (users, groups, or service principals) through Azure Role-Based Access Control (RBAC), but does not define or group compliance policies.
Q25: Azure Monitoring & Performance
A development team hosts a customer-facing e-commerce web application in Microsoft Azure. The team needs to monitor the live application to capture client-side performance telemetry, diagnose browser JavaScript errors, and track end-to-end user request durations.
Which Azure service feature should the team use?
• Application Insights: A core Application Performance Management (APM) feature of Azure Monitor. It monitors live web applications and collects both server-side metrics (request rates, response times, dependency tracking) and client-side telemetry (browser page load times, frontend JavaScript exceptions, and user interaction analytics).
Why are the other options incorrect?
• Azure Activity Log: Tracks control-plane events and administrative actions performed on Azure resources (such as creating, modifying, or deleting a resource), but does not monitor in-guest or client-side application performance.
• Azure Service Health: Provides personalized notifications and status updates about Azure service issues, planned maintenance, and regional service health advisories.
• Azure Network Watcher: Provides network-layer diagnostic and troubleshooting tools (such as Packet Capture, IP Flow Verify, and Connection Troubleshoot) for Azure Virtual Networks (IaaS), but does not collect application-level or browser-level telemetry.
Q26: Identity & Microsoft Entra ID
An IT administrator needs to onboard several new employees by provisioning user accounts that will allow them to authenticate to organizational cloud resources and receive access permissions.
Which service in the Microsoft Azure portal should the administrator use to create the user accounts?
• Microsoft Entra ID: Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. User accounts, security groups, enterprise applications, and directory roles are created and managed directly within Microsoft Entra ID.
Why are the other options incorrect?
• Resource groups: Logical containers used to deploy, group, and manage related Azure resources (such as virtual machines, storage accounts, and databases), but they cannot be used to create user identities.
• Cost Management + Billing: A suite of tools for monitoring, allocating, and optimizing Azure cloud spend and billing invoices.
• Subscriptions: Represents a logical billing and management boundary in Azure. While you assign permissions (RBAC roles) to users at the subscription scope, the user objects themselves must reside in and be created through Microsoft Entra ID.
Q27: Azure High Availability & Architecture
A company is deploying a mission-critical line-of-business application across multiple Azure virtual machines within a single Azure region.
The solution must remain continuously operational even if an entire physical datacenter facility within that region experiences an unexpected power outage or hardware failure.
Which feature should the company select when deploying the virtual machines?
• Availability zones: Availability Zones are physically separate datacenter locations within an Azure region. Each zone has independent power, cooling, and networking infrastructure. Deploying virtual machines across multiple Availability Zones protects applications and workloads from an entire datacenter outage.
Why are the other options incorrect?
• Availability sets: Availability Sets distribute virtual machines across multiple physical hardware racks (fault domains and update domains) inside a single datacenter. They protect against local hardware or power supply failures on a rack, but cannot protect against a full datacenter failure.
• Proximity placement groups: A logical grouping strategy used to keep virtual machines physically close to each other inside the same datacenter to achieve the lowest possible network latency. This does not provide datacenter-level redundancy.
• Azure Dedicated Hosts: Provides physical servers dedicated to a single customer's subscription to meet compliance and licensing needs, but a single dedicated host does not inherently protect against datacenter outages unless combined with an availability zone design.
Q28: Microsoft Entra ID Capabilities
For each of the following statements, select Yes if the statement is true. Otherwise, select No:
1. Microsoft Entra ID can provide single sign-on (SSO) to third-party Software as a Service (SaaS) applications.
2. A Microsoft Entra ID tenant requires an active on-premises Active Directory domain controller to authenticate cloud users.
3. Non-Windows devices, such as macOS and Android devices, can be registered in Microsoft Entra ID.
• Statement 1 (Yes): Microsoft Entra ID integrates with thousands of pre-configured third-party SaaS applications (such as ServiceNow, Salesforce, and Google Workspace) via standard identity protocols (SAML 2.0, OpenID Connect, and OAuth 2.0) to enable centralized Single Sign-On (SSO).
• Statement 2 (No): Microsoft Entra ID is a native cloud-based identity and access management service. It is fully capable of operating as an independent identity provider in the cloud without requiring any connection to or deployment of on-premises Active Directory Domain Services (AD DS) domain controllers.
• Statement 3 (Yes): Microsoft Entra ID supports device identity management across multiple operating systems. Users can register personal or corporate devices running Windows, macOS, iOS, Android, and Linux to enable device-based Conditional Access and Mobile Device Management (MDM) integration.
Q29: Azure Hybrid Networking (Multiple Choice)
An enterprise plans to establish an encrypted Site-to-Site (S2S) VPN connection to securely link its corporate on-premises datacenter to an existing Azure Virtual Network (VNet).
Which two Azure networking components must be provisioned in the Azure VNet to support this VPN connection? Each correct answer presents part of the solution. (Select 2)
To connect an on-premises network to an Azure Virtual Network using a Site-to-Site VPN tunnel, the following components are required in Azure:
• A Virtual Network Gateway: This resource contains the routing and VPN software instances that maintain the secure IPsec/IKE tunnel and exchange encrypted traffic with the on-premises VPN device.
• A dedicated subnet named GatewaySubnet: Azure requires a specific subnet configured with the exact name GatewaySubnet inside the virtual network. The Virtual Network Gateway VMs and routing services are deployed exclusively into this subnet.
Why the other options are incorrect:
• Azure NAT Gateway: Provides outbound-only internet connectivity for virtual machines in private subnets, but does not handle cross-premises VPN routing.
• Azure Front Door: A global web application accelerator and content delivery network (CDN) operating at Layer 7 (HTTP/HTTPS), not a private site-to-site network gateway.
• Azure Bastion: Provides secure RDP and SSH connectivity to virtual machines directly over TLS via the Azure portal without public IP exposure, but does not provide site-to-site hybrid network routing.
Q30: Cloud Deployment Models
This question requires that you evaluate the underlined text to determine if it is correct.
An enterprise that adopts a hybrid cloud architecture connects its local on-premises datacenter with a public cloud provider to share data and run applications across both environments.
Review the underlined text. If it makes the statement correct, select "No change is needed." If the statement is incorrect, select the answer choice that makes the statement correct.
• No change is needed: A hybrid cloud is a computing model that connects an organization's on-premises infrastructure (or private cloud) with one or more public cloud environments. This model enables organizations to retain sensitive data or legacy systems on-premises while taking advantage of public cloud scalability and cost efficiency.
Why are the other options incorrect?
• a private cloud: A private cloud provides cloud services used exclusively by a single organization and is hosted internally (or in a dedicated hosted facility). It does not, by definition, integrate with external public cloud infrastructure.
• a multi-region public cloud: Involves deploying resources across multiple geographical regions within a public cloud provider, but does not involve an on-premises integration.
• an on-premises virtualization host: Represents local hypervisor hardware (such as Hyper-V or VMware) located inside a datacenter and does not represent an integrated cloud model on its own.
Q31: Azure Security & Firewall
Complete the sentence by selecting the correct Azure Firewall rule type:
[ ______________________ ] in Azure Firewall allow administrators to filter outbound HTTP and HTTPS traffic based on destination Fully Qualified Domain Names (FQDNs).
• Application rules: Azure Firewall Application rules evaluate Layer 7 traffic (such as HTTP, HTTPS, and MSSQL) and allow or deny access based on target Fully Qualified Domain Names (FQDNs) (e.g., *.microsoft.com) and URL paths.
Why are the other options incorrect?
• DNAT rules: Destination Network Address Translation (DNAT) rules are used to translate incoming public internet traffic on the firewall's public IP address to private IP addresses and ports within an Azure Virtual Network.
• Network rules: Network rules filter Layer 3 and Layer 4 traffic based on source IP addresses, destination IP addresses, transport protocols (TCP/UDP/ICMP), and destination port numbers. They do not evaluate domain names/FQDNs at the application layer.
• Threat intelligence rules: Threat intelligence-based filtering automatically alerts on or blocks inbound and outbound communication with known malicious IP addresses and domains published by the Microsoft Threat Intelligence feed.
Q32: Azure Hybrid Networking & Gateways
A network administrator is setting up an IPsec Site-to-Site (S2S) VPN connection between a remote branch office and an Azure Virtual Network (VNet).
The administrator has already created the Azure Virtual Network Gateway. Now, they need to create an Azure resource that represents the remote branch office's physical VPN hardware and defines its public IP address along with its local IP address ranges.
Which Azure resource should the administrator create?
• Local Network Gateway: In Azure networking, a Local Network Gateway represents the remote on-premises or branch office location. It stores the configuration details of the external on-premises VPN device (its public IP address or FQDN) and the local on-premises IP address prefixes (subnets) that Azure routes traffic to across the VPN tunnel.
Why are the other options incorrect?
• Virtual Network Gateway: This represents the Azure-side VPN termination endpoint deployed in the Azure VNet's GatewaySubnet, not the representation of the on-premises VPN device.
• Azure NAT Gateway: Provides outbound-only internet connectivity for virtual machines in Azure subnets, but does not represent or terminate Site-to-Site VPN connections.
• Azure Route Server: Facilitates dynamic routing between Network Virtual Appliances (NVAs) and the Azure virtual network via Border Gateway Protocol (BGP), but does not serve as the object that defines on-premises VPN appliance endpoints.
Q33: Azure Resource Locks & Governance
Select the answer that correctly completes the sentence:
If a ReadOnly lock is applied to an Azure resource group, [ ______________________ ] until the lock is removed.
• ReadOnly Lock: When a ReadOnly lock is applied at a resource group scope, all resources inside that resource group inherit the lock. Authorized users can still view (read) the resources and their configurations, but no user—regardless of their Azure RBAC role (including Contributor or Owner)—can update, reconfigure, or delete any resource until the lock is explicitly removed.
• CanNotDelete Lock: Allows authorized users to read and modify resource configurations, but prevents anyone from deleting the resource until the lock is deleted.
• RBAC Override: Azure Resource Locks take precedence over Role-Based Access Control (RBAC) permissions. Having the Owner or Global Administrator role does not bypass the lock; the lock must be deleted first by an identity with Microsoft.Authorization/locks/* permissions.
Q34: Azure Reservations & Pricing
A company runs steady-state, predictable database workloads on Azure virtual machines 24 hours a day, 7 days a week. The finance team wants to minimize compute costs by committing to the longest standard term available through Azure Reservations.
What is the longest commitment duration available when purchasing standard Azure Reserved Virtual Machine Instances?
• 3 years: Azure Reservations (including Reserved VM Instances and Azure Savings Plans for compute) offer commitment terms of either 1 year or 3 years. Committing to a 3-year term yields the greatest discount percentage compared to standard pay-as-you-go hourly rates.
Why are the other options incorrect?
• 6 months: Azure does not offer 6-month reservation commitments. Workloads needing short-term capacity are billed at standard pay-as-you-go rates or can use Spot VMs for fault-tolerant tasks.
• 2 years: There is no 2-year commitment option available for Azure Reservations.
• 10 years: Azure does not provide 10-year reservation contracts. The longest available commitment term for standard compute reservations is 3 years.
Q35: Compliance & Regulatory Management
Complete the sentence by selecting the correct administrative portal:
A compliance officer needs to track the organization's regulatory posture, evaluate assessments against industry standards (such as ISO 27001 and GDPR), and review recommended improvement actions.
Compliance Manager is accessed from the [ ________________________ ].
• Microsoft Purview portal: Microsoft Purview Compliance Manager is hosted within the Microsoft Purview portal (and Microsoft Purview compliance portal). It helps organizations manage multi-cloud compliance requirements, perform risk assessments, calculate a risk-based compliance score, and track actionable technical improvement recommendations.
Why are the other options incorrect?
• Microsoft Entra admin center: Used for identity and access management, including user accounts, groups, role assignments (RBAC), and Conditional Access policies, not regulatory compliance scoring.
• Azure Cost Management + Billing: Used for tracking, budgeting, and analyzing Azure cloud expenditures and billing data.
• Azure Service Health portal: Provides notifications and status dashboards regarding Azure service outages, planned infrastructure maintenance, and resource health alerts.
Q36: Cloud Models (Private vs Public Cloud)
An enterprise is deciding whether to implement an on-premises private cloud environment or migrate completely to a public cloud provider.
Which two statements describe key characteristics of the private cloud deployment model? Each correct answer presents part of the solution. (Select 2)
• Hardware procurement & maintenance: In a private cloud, the organization owns or leases the physical equipment. This requires substantial upfront capital expenditure (CapEx) to purchase servers, storage arrays, network switches, and uninterruptible power supplies, as well as ongoing costs to maintain and replace aging hardware.
• Exclusive control & security: Because the private cloud infrastructure is dedicated entirely to a single organization (single-tenant architecture), the enterprise maintains full authority over physical access controls, custom hardware configurations, and specialized regulatory compliance requirements.
Why the other choices describe the Public Cloud:
• A: Multi-tenancy (sharing physical infrastructure with other unrelated customer organizations) is a defining property of a public cloud, not a private cloud.
• D: Pay-as-you-go pricing (OpEx) where the cloud provider manages the physical infrastructure is characteristic of the public cloud.
• E: High/near-limitless scalability is a benefit of large-scale public cloud providers; a private cloud's capacity is constrained by the physical servers purchased and installed in the local datacenter.
Q37: Cloud Benefits (Multiple Choice)
A company is evaluating the advantages of migrating its on-premises infrastructure to a public cloud provider.
Which two options represent standard benefits provided by cloud computing? Each correct answer presents part of the solution. (Select 2)
• High availability: Cloud platforms offer built-in redundancy across power, networking, and server infrastructure (including Availability Zones and regional replication) to ensure applications remain accessible with minimal or zero downtime in the event of hardware or component failures.
• Elasticity: Cloud computing allows environments to automatically add resources (scale out) during unexpected demand spikes and release those resources (scale in) when demand decreases, ensuring cost efficiency and optimal performance.
Why the other choices are incorrect:
• A & E: In a public cloud, the cloud provider manages all physical datacenters, hardware lifecycle, cabling, and physical disk replacement. Customers do not have physical access to the provider's server rooms.
• C: Public cloud infrastructure eliminates upfront capital expenditures (CapEx) for server hardware, allowing organizations to operate on a flexible operational expenditure (OpEx) pay-as-you-go model instead.
Q38: Cloud Deployment Models
A financial services firm hosts its core transactional database servers within its private on-premises datacenter to comply with strict local data retention regulations. The firm deploys its public-facing web applications to Microsoft Azure and links the two environments with a secure VPN connection to enable seamless communication.
Which cloud deployment model is the firm using?
• Hybrid cloud: A hybrid cloud connects an organization's on-premises infrastructure (or private cloud) with a public cloud environment (such as Microsoft Azure). It allows data and workloads to be shared and integrated across both environments, providing flexibility and enabling legacy or regulatory workloads to remain on-premises while taking advantage of public cloud scalability.
Why are the other options incorrect?
• Public cloud: A model where all computing resources, applications, and storage are owned, maintained, and operated entirely by a third-party cloud service provider with no on-premises infrastructure integration.
• Private cloud: A model where computing infrastructure is exclusively dedicated to a single organization, typically hosted and maintained within the company’s own datacenter or a private hosted facility without integrating with public cloud platforms.
• Multi-cloud: An architecture that utilizes services from two or more distinct public cloud providers (such as combining Microsoft Azure and Amazon Web Services) simultaneously.
Q39: Cloud Capabilities & Agility
Select the answer that correctly completes the sentence:
[ ______________________ ] is the cloud capability that allows organizations to rapidly provision and configure computing resources within minutes to accelerate software development and adapt quickly to business requirements.
• Agility: Cloud agility refers to the ability to rapidly develop, test, and deploy applications. Because cloud resources can be provisioned in minutes using automated scripts or the portal (rather than waiting weeks or months for physical server procurement and setup), organizations can respond quickly to changing business demands and bring new features to market much faster.
Why are the other options incorrect?
• Disaster recovery: Focuses on restoring application functionality, critical data, and infrastructure after a major outage or natural disaster.
• Geo-distribution: Refers to deploying services across multiple global geographical regions to minimize latency for end users and provide geographic redundancy.
• High availability: Focuses on ensuring that services remain operational and accessible with minimal or zero downtime during hardware or network failures.
Q40: Cloud Service Models (SaaS)
A business adopts a cloud-hosted productivity suite that provides employees with email, calendar, and document collaboration tools accessed directly through a web browser. The service provider manages all software patching, server infrastructure, and security updates, while the business pays a recurring per-user monthly subscription.
Which cloud service model is the business using?
• Software as a Service (SaaS): SaaS provides a fully developed, end-user software solution hosted and managed by the cloud provider. Users typically access the application via a web browser or mobile client, and the organization licenses the software through a recurring subscription model (such as monthly or annual per-user licensing, e.g., Microsoft 365). The cloud provider is responsible for maintaining the application code, runtime, operating systems, and physical hardware.
Why are the other options incorrect?
• Infrastructure as a Service (IaaS): Rents virtualized computing infrastructure (such as virtual machines, virtual networks, and storage). The customer is responsible for installing, configuring, and updating the operating system and applications.
• Platform as a Service (PaaS): Provides a managed development and deployment environment (such as Azure App Service or Azure SQL Database). The cloud provider manages the OS and runtime, while developers manage their own application code and databases.
• Function as a Service (FaaS): A serverless compute model (such as Azure Functions) where event-driven code runs on-demand without the need to manage infrastructure or maintain long-running application instances.
Key Takeaways for AZ-900 (Part 2 Summary)
• Identity & Microsoft Entra ID: In Azure, identity serves as the primary security boundary. Microsoft Entra ID handles Authentication (verifying who you are) and works alongside Role-Based Access Control (RBAC) to enforce Authorization (what you are allowed to access).
• Resource Locks Precedence: Azure Resource Locks (ReadOnly and CanNotDelete) strictly override RBAC roles, including Owner permissions. Even administrators cannot delete or modify locked resources without removing the lock first.
• Hybrid Connectivity Components: Setting up an encrypted Site-to-Site (S2S) VPN requires a Virtual Network Gateway deployed in a dedicated
GatewaySubnetwithin Azure, paired with a Local Network Gateway representing the on-premises network endpoint.• Compute Cost Savings: For predictable, steady-state workloads, Azure Reservations provide significant discounts for commitment terms of up to 3 years compared to standard pay-as-you-go pricing.
Frequently Asked Questions (AZ-900 FAQ)
1. What is the difference between Authentication and Authorization in Azure?
Authentication (AuthN) is the process of verifying a user's identity by checking submitted credentials (such as username, password, or MFA token). Authorization (AuthZ) occurs after identity is confirmed, determining what resources or actions the authenticated user is allowed to perform.
2. Do Azure Resource Locks override administrator RBAC permissions?
Yes. Resource locks take precedence over Azure Role-Based Access Control (RBAC). Even users assigned the Owner or Contributor role cannot modify or delete a resource protected by a ReadOnly or CanNotDelete lock until that lock is explicitly removed.
3. What is the difference between Availability Sets and Availability Zones?
Availability Sets protect virtual machines against hardware and power failures within a single datacenter rack (fault and update domains). Availability Zones provide higher resilience by placing VMs across physically separate datacenter facilities within the same Azure region, each with independent power and cooling.
4. What is the longest commitment term available for Azure Reserved VM Instances?
Azure Reservations offer commitment durations of either 1 year or 3 years. Committing to a 3-year term provides the maximum cost savings for predictable, ongoing workloads.
Ready to See Your Results?
Congratulations on completing all 20 questions in Part 2 of our practice test series! Practicing with scenario questions is the most effective way to prepare for the Microsoft Azure Fundamentals AZ-900 certification.
Click the button above to calculate your total score, share your result in the comments below, and get ready for the next practice session!
