Welcome to Part 3 of our study series for the Microsoft Azure Fundamentals (AZ-900) certification. While reviewing official documentation builds foundational knowledge, working through realistic scenario-based questions is the most effective way to test your comprehension and boost your confidence before taking the exam.
 |
| Microsoft Azure Fundamentals (AZ-900) Practice Test - Part 3 |
In this az 900 practice test free guide (Part 3), we walk through 20 high-yield questions (Questions 41 through 60). You will test your understanding of core storage tiers, hybrid identity, security monitoring, cloud governance, and cost management. Every question features a clear breakdown explaining why the correct answer is right and why the other options do not apply.
AZ-900 Practice Test Questions
Q41: Event Routing & Serverless Integration
Your company wants to build an automated workflow that responds in real time whenever infrastructure state changes occur across Azure subscriptions, such as when a virtual machine starts or a storage account key is rotated.
You need a fully managed event routing service that allows applications to subscribe to built-in Azure resource events using a publish-subscribe model.
Which Azure service should you choose?
• Azure Event Grid: A fully managed, highly scalable event routing service that utilizes a publish-subscribe (pub/sub) architecture. It natively integrates with Azure resources as event publishers, allowing applications to subscribe to infrastructure state changes (e.g., VM creations, resource modifications, or key rotations) and route them directly to handlers such as Azure Functions, Logic Apps, or webhooks.
Why are the other options incorrect?
• Azure Service Bus: An enterprise message broker designed for high-value transactional messaging, decoupled queuing, and strict message ordering (FIFO), rather than reactive event broadcasting.
• Azure Event Hubs: A big data streaming platform and high-throughput ingestion engine capable of capturing millions of streaming telemetry and log data points per second.
• Azure API Management: A turnkey solution for publishing, securing, throttling, and analyzing enterprise APIs, not an event-driven message router.
Q42: Infrastructure as Code (IaC) & Deployment
A company needs to deploy identical application environments across development, testing, and production in Azure. The DevOps team wants to use an Infrastructure as Code (IaC) approach where they define all necessary resources declaratively in configuration files so the deployments are repeatable, consistent, and automated.
Which Azure feature should they use?
• ARM templates: Azure Resource Manager templates (JSON or Azure Bicep) provide a native declarative Infrastructure as Code (IaC) mechanism. You define the desired end-state infrastructure, properties, and dependencies in configuration files without writing procedural steps. Azure orchestrates the deployment consistently and repeatedly across multiple environments.
Why are the other options incorrect?
• Azure PowerShell & Azure CLI: These are imperative command-line interfaces. While they can script deployments, they require step-by-step procedural execution commands rather than native declarative configuration definitions.
• Azure Cloud Shell: An interactive, browser-based command terminal for administering Azure resources, not an Infrastructure as Code definition format.
Q43: Cloud Computing Concepts & Serverless
Complete the sentence regarding cloud architecture concepts:
In Microsoft Azure, serverless computing is best described as a model where:
• Serverless Computing: Serverless models (such as Azure Functions and Azure Logic Apps) completely abstract underlying server hardware, operating systems, and capacity management. Developers focus exclusively on writing application logic. The cloud provider dynamically handles infrastructure provisioning, maintenance, and event-driven auto-scaling, charging only for active compute execution time.
Why are the other options incorrect?
• Option A: Describes traditional Infrastructure as a Service (IaaS) or dedicated VM hosting with fixed capacity costs.
• Option C: Physical hardware is never eliminated; it is merely hosted, operated, and maintained by Microsoft rather than managed by the end customer.
• Option D: Describes purely client-side code execution in a web browser or mobile client, whereas serverless executes backend cloud services.
Q44: Cloud Compute & Virtualization
An engineering team is designing a hosting strategy for microservices. They need a compute option that packages an application together with its dependencies into an isolated unit that shares the underlying host operating system kernel. The solution must provide faster startup times and require less overhead than running a full guest operating system.
Which cloud compute technology matches this description?
• Containers: Provide operating system-level virtualization. Containers package application binaries, libraries, and dependencies into lightweight packages that share the host OS kernel. This avoids the heavy overhead of booting a dedicated guest operating system, resulting in sub-second startup times and high compute density.
Why are the other options incorrect?
• Virtual Machines: Emulate complete physical hardware and require an independent guest operating system (with its own kernel, drivers, and background services), causing slower boot times and higher resource overhead.
• Virtual Machine Scale Sets: A management and auto-scaling pool for groups of individual Virtual Machines, but they still run on full VM architecture.
• Dedicated Hosts: Physical servers allocated entirely to a single tenant to host virtual machines for regulatory isolation, not a lightweight application containerization runtime.
Q45: Azure Core Architecture & Datacenters
An infrastructure specialist is learning about the physical foundation of Microsoft Azure. They need to identify the basic physical unit that consists of a dedicated building housing racks of servers, equipped with its own independent power supply, cooling systems, and network connections.
Which Azure infrastructure term describes this physical facility?
• Datacenter: An Azure datacenter is a physical building containing thousands of networked computer servers, enterprise storage arrays, and network switches, powered by isolated electrical feeds and dedicated cooling infrastructure.
Why are the other options incorrect?
• Availability zone: A physically separate location within an Azure region that is made up of one or more physical datacenters.
• Geography: A discrete geopolitical boundary (typically containing two or more Azure regions) designed to preserve data residency and compliance limits.
• Resource group: A logical management container used to organize, deploy, and govern Azure resources—it is not a physical facility.
Q46: Azure Resource Groups & Governance
An IT team is establishing cloud governance standards in Microsoft Azure. They need to define guidelines on how to structure and organize cloud assets using Azure Resource Groups.
Which of the following are valid factors or best practices for grouping resources into a resource group? (Select 3)
• Shared Lifecycle: Resources that are deployed, updated, and deleted together (such as the web tier, database, and virtual network of a specific project) belong in the same resource group for unified lifecycle management.
• Common RBAC Boundaries: Resource groups act as a primary scope for assigning Role-Based Access Control (RBAC) permissions to teams.
• Administrative & Cost Organization: Grouping assets by workload, environment (Dev/Test/Prod), or department simplifies resource tagging and cost allocation.
Why the other choices are incorrect:
• Regional Restriction: Resources inside a resource group do not have to be in the same region; a single resource group can manage resources spread across different regions worldwide.
• Multiple Resource Groups: An Azure resource can only belong to one resource group at a time.
Q47: Cloud Deployment Models
A growing startup wants to launch a new digital service without purchasing physical server hardware or operating an on-premises datacenter. They require a hosting model where the infrastructure is entirely owned, operated, and maintained by a third-party provider, and computing resources are delivered over the internet under a pay-as-you-go pricing structure.
Which cloud deployment model meets these requirements?
• Public Cloud: Infrastructure, physical hardware, and datacenter operations are owned and managed entirely by a third-party cloud service provider (such as Microsoft Azure). Organizations access scalable computing resources over the public internet and pay on an operational expenditure (OpEx) pay-as-you-go basis without capital investments.
Why are the other options incorrect?
• Private cloud: Dedicated exclusively to one organization, often requiring upfront capital expenditure (CapEx) to purchase and maintain local physical hardware.
• Hybrid cloud: Combines on-premises private datacenter infrastructure with public cloud resources.
• Community cloud: Infrastructure shared among several organizations with shared regulatory, industry, or compliance goals.
Q48: Azure Hybrid Connectivity
A retail company needs to establish secure network connectivity between multiple regional corporate offices and its resources in Microsoft Azure.
Which of the following technologies CANNOT be used to establish a network connection or tunnel between on-premises locations and Azure?
• FTPS: An application-layer file transfer protocol used to upload and download files securely between endpoints. It cannot create network-level routing tunnels or extend an on-premises network into an Azure Virtual Network.
Why are the other options valid hybrid networking solutions?
• Site-to-Site (S2S) VPN: Establishes an encrypted IPsec/IKE tunnel over the public internet to connect entire corporate branch offices to Azure Virtual Networks.
• Point-to-Site (P2S) VPN: Enables individual remote client devices (such as employee laptops) to connect securely to Azure virtual networks over an encrypted VPN tunnel.
• Azure ExpressRoute: Establishes a dedicated, private, high-speed fiber connection directly from on-premises datacenters to Azure, completely bypassing the public internet.
Q49: Azure Resource Group Management
An IT administrator creates an Azure resource group set to the East US region. The company needs to deploy a virtual machine in East US and a storage account in North Europe for disaster recovery purposes, managing both under this single resource group.
Determine whether the following statement is True or False:
"An Azure resource group can contain and manage resources that are located in different Azure regions."
• Resource Group Regional Flexibility: Resources inside a resource group do not need to reside in the same region as the resource group itself. The region assigned to a resource group only determines where the metadata describing those resources is stored. The actual resources (such as VMs, databases, and disks) can reside across multiple global Azure regions within the same resource group.
Q50: Service Level Agreements (SLAs) & Commitments
An organization is preparing to deploy mission-critical business applications to Microsoft Azure. Before deploying, the compliance and operations teams need to review the formal contract terms that define Microsoft's official guarantees for service availability, target uptime percentages, and billing credit policies if performance guarantees are not met.
Which document or policy defines these commitments?
• Service Level Agreement (SLA): The formal contract between Microsoft and the customer specifying the guaranteed uptime performance targets (e.g., 99.9%, 99.95%, or 99.99%) for individual Azure services. It also establishes the specific service credit percentages credited back to the customer if availability drops below the stated threshold.
Why are the other options incorrect?
• Microsoft Product Terms: Defines general software licensing agreements, intellectual property rights, and terms of use for Microsoft commercial products.
• Acceptable Use Policy (AUP): Sets boundaries on acceptable and prohibited customer actions on Microsoft cloud infrastructure.
• Service Trust Portal (STP): A public portal hosting third-party compliance audit reports, SOC reports, ISO certifications, and security white papers.
Q51: Container Hosting & Serverless Compute
Developers in your organization have packaged several web microservices into Docker images. You need to select managed Azure platform services specifically designed to host and execute containerized applications without requiring your team to provision or manage underlying physical servers.
Which THREE Azure services can natively run containerized applications? (Select 3)
• Azure Container Instances (ACI): A serverless compute solution that runs Docker containers on demand without needing to provision virtual machines or configure cluster orchestrators.
• Azure App Service (Web App for Containers): A fully managed Platform as a Service (PaaS) offering that allows developers to deploy, scale, and run containerized web apps and APIs.
• Azure Kubernetes Service (AKS): A fully managed container orchestration platform designed to deploy, scale, and manage complex, multi-container microservices architectures.
Why the other choices are incorrect:
• Azure Bastion: Provides secure, browser-based RDP/SSH access to VMs without public IP exposure; it is not a container hosting runtime.
• Azure Route Server: A networking service facilitating dynamic routing between Network Virtual Appliances (NVAs) and Azure virtual networks.
Q52: Azure Marketplace & Solutions Catalog
Cloud engineers need a unified online catalog to discover, purchase, and deploy certified first-party and third-party solutions—such as preconfigured virtual machine images, database appliances, developer tools, and container templates configured specifically for Microsoft Azure.
Which service provides this technical catalog tailored for IT professionals and developers?
• Azure Marketplace: An online commercial marketplace offering thousands of certified technical solutions, virtual machine base images, network appliances, and developer frameworks built by Microsoft and industry partners specifically for IT professionals and developers building on Azure.
Why are the other options incorrect?
• Microsoft AppSource: Geared toward business leaders and commercial end-users looking for SaaS applications, business solutions (Dynamics 365), and Power Platform extensions.
• Azure Service Catalog: Used within an enterprise to create an internal catalog of approved internal applications for organizational users.
• Azure Quickstart Templates: An open-source community repository of JSON/Bicep code templates, not a commercial enterprise solution marketplace.
Q53: Content Delivery & Performance Optimization
Global users experience high latency and slow loading speeds when downloading high-bandwidth media and static website assets from a centrally hosted web application.
Which statement accurately describes how Azure Content Delivery Network (CDN) resolves this problem?
• Azure CDN: Azure Content Delivery Network caches static web content (images, videos, JavaScript, CSS files) at strategic edge points of presence (POPs) situated close to end users around the globe. This drastically cuts latency and network round-trip time (RTT) while reducing traffic loads on origin servers.
Why are the other options incorrect?
• Option A: Describes Azure Load Balancer (Layer 4 transport load balancing).
• Option C: Relates to database querying and indexing transformations, not edge caching.
• Option D: Describes Web Application Firewall (WAF) security inspection mechanisms.
Q54: Network Security & Traffic Filtering
Network administrators need to filter and block incoming transport-layer traffic based on protocol specifications (such as blocking all UDP traffic while permitting TCP).
Proposed solution: The administrators create Application Security Groups (ASGs) and define protocol-filtering rules directly on them without using any Network Security Groups (NSGs).
Does this solution meet the goal?
• ASGs vs NSGs: Application Security Groups (ASGs) do not contain security rules and cannot inspect or filter traffic by themselves. They function solely as logical tags or groupings of virtual machine network interfaces (NICs).
• Rule Enforcement: To filter network traffic by protocol (TCP/UDP), IP address, or port, you must configure security rules inside a Network Security Group (NSG). The ASGs are then specified as source or destination objects within those NSG rules.
Q55: Cloud Service Models (IaaS vs PaaS vs SaaS)
During a cloud migration assessment, database administrators evaluate managed relational database services where the cloud provider manages the operating system, hardware provisioning, backups, and automated patching, while the customer remains responsible only for the database schema, data, and access permissions.
Under which cloud service model is Azure SQL Database categorized?
• Azure SQL Database (PaaS): In this managed model, Microsoft automates infrastructure provisioning, OS updates, database engine patching, high availability, and disaster recovery backups. The customer only administers database configurations, schemas, queries, and user permissions.
Why are the other options incorrect?
• Infrastructure as a Service (IaaS): Examples include SQL Server hosted on an Azure Virtual Machine, where the administrator manages operating system patches, storage volumes, and database engine maintenance.
• Software as a Service (SaaS): Fully managed end-user software applications (like Microsoft 365) where customers only consume the finished software without managing database layers.
• On-premises hosting: Traditional infrastructure where the internal IT team is 100% responsible for physical servers, hypervisors, OS, and software stacks.
Q56: Azure IoT Ecosystem & Edge Computing
A smart factory project requires solutions to connect industrial sensors, run cloud logic directly on local gateway hardware, and provide hardware-based security for edge microcontroller devices.
Which Azure service category encompasses Azure IoT Hub, Azure IoT Central, Azure IoT Edge, and Azure Sphere?
• Azure IoT Services: Azure IoT is the dedicated solution suite for connecting, managing, and securing edge devices:
- Azure IoT Hub: Central bidirectional messaging gateway connecting millions of IoT devices.
- Azure IoT Central: Ready-made SaaS environment for rapid IoT device management and telemetry visualization.
- Azure IoT Edge: Deploys cloud intelligence and custom logic to run locally on physical edge appliances.
- Azure Sphere: Comprehensive security solution including secured microcontrollers (MCUs), a custom Linux-based OS, and cloud monitoring.
Why are the other options incorrect?
• Big Data & Analytics: Includes Synapse Analytics, HDInsight, and Databricks.
• Azure DevOps: Focuses on CI/CD pipelines, code repos, and agile project tracking.
• AI & Machine Learning: Focuses on Azure OpenAI, Cognitive Services, and ML modeling.
Q57: Azure Role-Based Access Control (RBAC)
In Microsoft Azure Role-Based Access Control (Azure RBAC), granting access involves attaching a role to a target across three fundamental elements: security principal, role definition, and scope.
Which element identifies "WHO" is being granted access to resources (such as a user, group, service principal, or managed identity)?
• Security Principal ("Who"): An identity object representing an entity requesting access to Azure resources (a user account, security group, service principal, or managed identity).
Why the other elements differ:
• Role definition ("What"): A collection of granular permissions detailing what actions can be executed (e.g., Reader, Contributor, Owner).
• Scope ("Where"): The target boundary or container where the permissions take effect (Management Group > Subscription > Resource Group > Resource).
• Management group: A top-level governance boundary (Scope level), not an identity.
Q58: Azure Physical Architecture & Facilities
During a physical security and compliance review of cloud facilities, an auditor evaluates the standalone buildings that house physical server racks and are equipped with independent electrical power generators, cooling systems, and network routing hardware.
Which level of Microsoft Azure's physical infrastructure is being evaluated?
• Azure Datacenter: The physical building housing thousands of computer servers organized in hardware racks, supported by isolated power grids, backup diesel generators, chiller cooling systems, and redundant networking switches.
Why are the other options incorrect?
• Azure Region: A geographical area containing one or more datacenters linked through a dedicated low-latency fiber network.
• Azure Management Group: A logical governance boundary used to manage RBAC, policies, and compliance across subscriptions.
• Azure Availability Set: A logical grouping within a single datacenter that separates VMs across hardware fault domains and update domains.
Q59: Azure Compute Models & Infrastructure (IaaS)
Migrating a legacy line-of-business application to Azure requires installing custom operating system drivers, modifying low-level system registries, and maintaining complete administrative (root/administrator) control over the underlying operating system environment.
Which Azure compute service delivers these capabilities under the Infrastructure as a Service (IaaS) model?
• Azure Virtual Machines (IaaS): Provides full virtualization and complete administrative (root/admin) authority over the guest operating system. It allows custom kernel modules, OS patches, specialized software drivers, and legacy system configurations required during lift-and-shift migrations.
Why are the other options incorrect?
• Azure App Service (PaaS): A fully managed web hosting service where the operating system and infrastructure maintenance are abstracted away.
• Azure Container Instances (ACI): Serverless container hosting that executes isolated Docker containers without granting access to underlying OS registries or kernels.
• Azure Functions (Serverless/FaaS): Event-driven code execution where the underlying runtime and host OS are completely managed by Azure.
Q60: Storage Security & Encryption (CMK)
Enterprise compliance standards mandate that organizations maintain full lifecycle control (including key creation, rotation, and revocation) over the cryptographic keys used to secure virtual machine storage.
Determine whether the following statement is True or False:
"Azure allows virtual machine managed disks to be encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault."
• Customer-Managed Keys (CMK): By default, Azure Managed Disks are automatically encrypted at rest using Platform-Managed Keys (PMK). However, organizations with strict compliance or security standards can configure Server-Side Encryption (SSE) using Customer-Managed Keys (CMK). These keys are generated, stored, and managed securely in Azure Key Vault or Azure Key Vault Managed HSM, giving the organization complete authority over key access permissions, automated rotation, and immediate revocation.
Key Takeaways for AZ-900 (Part 3 Summary)
• Event Routing vs Big Data Streaming: Azure Event Grid routes reactive state-change events using a pub-sub model, while Azure Event Hubs is engineered for high-throughput streaming telemetry, and Azure Service Bus handles enterprise transactional message queues.
• Infrastructure as Code (IaC): Azure Resource Manager (ARM) templates and Bicep provide a declarative approach to provision and automate identical cloud environments consistently across Dev, Test, and Production.
• Containers vs Virtual Machines: Containers share the host OS kernel for rapid deployment with minimal overhead (hosted on ACI, App Service, or AKS), whereas Virtual Machines deliver full administrative OS control under the IaaS model.
• Azure RBAC Architecture: Role-Based Access Control connects a Security Principal (Who: User, Group, Managed Identity) to a Role Definition (What: permissions) across an assigned Scope (Where: Management Group down to Resource).
• Storage Encryption Keys: While Azure encrypts storage at rest by default using Platform-Managed Keys (PMK), enterprises can use Customer-Managed Keys (CMK) in Azure Key Vault for full lifecycle and rotation control.
Frequently Asked Questions (AZ-900 FAQ)
1. What is the difference between Azure Event Grid and Azure Event Hubs?
Azure Event Grid is an event-routing service built on a publish-subscribe model that triggers reactive actions when Azure resource states change. Azure Event Hubs is a high-speed big data ingestion engine designed to process millions of streaming events and telemetry logs per second.
2. Can an Azure Resource Group contain resources located in different regions?
Yes. An Azure Resource Group can hold resources deployed across multiple different global Azure regions. The region selected when creating the resource group only determines where the management metadata is stored.
3. When should you choose Containers over Virtual Machines in Azure?
Containers are the best choice when you need fast startup times, lightweight architecture, and microservices portability because they share the underlying OS kernel. Virtual Machines are required when an application demands custom OS kernel modifications, low-level registry access, or full root administrative control.
4. What are the three core components of an Azure RBAC role assignment?
Every Azure RBAC assignment consists of: Security Principal (identifies WHO receives access), Role Definition (specifies WHAT actions are allowed), and Scope (defines WHERE the permissions apply).
Ready to See Your Results?
Great job finishing this az 900 free practice test module! Consistently working through scenario-based evaluations is proven to be the most effective study method to build confidence for the Microsoft Azure Fundamentals AZ-900 certification.
Click the button above to calculate your total score, drop your score in the comments below, and jump into our next practice set to keep your momentum going!
