Microsoft Azure Fundamentals (AZ-900) Exam Questions

A company wants to move its IT operations away from purchasing and maintaining physical servers, and instead pay only for the compute, storage, and networking it actually consumes, billed monthly. Which cloud computing characteristic does this describe?

✅ A. Consumption-based (pay-as-you-go) model
⬜ B. Economies of scale
⬜ C. High availability
⬜ D. Fault tolerance

Explanation:
The consumption-based model is a foundational cloud computing concept: instead of investing capital upfront in hardware, customers pay only for the resources they use, when they use them, similar to a utility bill for electricity or water.
Why other options are incorrect:
B: Economies of scale refers to cloud providers passing on cost savings gained from operating at massive scale; it is a reason cloud can be cheap, not the billing model itself.
C: High availability is about keeping a system running with minimal downtime, not about how it is billed.
D: Fault tolerance is the ability of a system to keep operating despite a component failure, unrelated to the billing model.
Source: Describe cloud computing - Training | Microsoft Learn

---

An organization keeps sensitive financial systems on infrastructure it owns and operates in its own datacenter, while running its public-facing marketing website on Azure. Which cloud deployment model best describes this organization’s overall strategy?

⬜ A. Public cloud
⬜ B. Private cloud
✅ C. Hybrid cloud
⬜ D. Community cloud

Explanation:
A hybrid cloud combines a private cloud (or on-premises datacenter) with a public cloud, allowing organizations to keep sensitive workloads under their own control while taking advantage of public cloud services for other workloads, with connectivity between the two environments.
Why other options are incorrect:
A: A public cloud deployment means all resources run in a shared, multi-tenant cloud environment; here the financial systems remain entirely on-premises.
B: A private cloud deployment means all resources run in a dedicated, single-tenant environment; here the marketing website runs in the public cloud.
D: A community cloud is shared by several organizations with common concerns; it is not one of the three deployment models covered in AZ-900 (public, private, hybrid) and doesn’t describe this scenario.
Source: Describe cloud computing - Training | Microsoft Learn

---

A development team rents virtual machines, virtual networks, and storage from Azure, and is fully responsible for installing, configuring, and patching the operating system and any software that runs on those VMs. Which cloud service category is this?

⬜ A. Software as a Service (SaaS)
⬜ B. Platform as a Service (PaaS)
✅ C. Infrastructure as a Service (IaaS)
⬜ D. Function as a Service (FaaS)

Explanation:
Infrastructure as a Service (IaaS) provides the most fundamental building blocks of cloud IT — virtualized compute, storage, and networking — while leaving the customer responsible for the operating system, middleware, runtime, and applications that run on top of it.
Why other options are incorrect:
A: SaaS delivers a fully managed application to end users; the provider manages everything below the application layer, so there is no OS to patch.
B: PaaS provides a managed platform (OS, middleware, runtime already handled) so developers focus only on their application code and data, not OS patching.
D: FaaS (serverless functions) abstracts away servers and the OS entirely; the customer only supplies code, not infrastructure.
Source: Describe cloud service types - Training | Microsoft Learn

---

A retail company deploys a web application on Azure App Service, where Microsoft manages the underlying servers, operating system patching, and runtime, while the company’s developers focus only on writing and deploying their application code. Which cloud service category does Azure App Service represent?

⬜ A. Infrastructure as a Service (IaaS)
✅ B. Platform as a Service (PaaS)
⬜ C. Software as a Service (SaaS)
⬜ D. On-premises

Explanation:
Platform as a Service (PaaS) provides a complete managed environment (operating system, runtime, middleware) for building and hosting applications, so developers can focus purely on application code and data without managing the underlying infrastructure.
Why other options are incorrect:
A: IaaS would require the company to manage its own VM operating system and patching, which is not the case here.
C: SaaS refers to a fully finished, ready-to-use application (like Microsoft 365), not a platform for building custom applications.
D: This is clearly a cloud-hosted service, not an on-premises deployment.
Source: Describe cloud service types - Training | Microsoft Learn

---

An organization uses Microsoft 365 (Word, Excel, Outlook) for its employees’ daily productivity needs. The organization does not manage any servers, operating systems, or application code for this software — it simply uses it through a web browser or app and pays a monthly subscription per user. Which cloud service category is Microsoft 365?

⬜ A. Infrastructure as a Service (IaaS)
⬜ B. Platform as a Service (PaaS)
✅ C. Software as a Service (SaaS)
⬜ D. Desktop as a Service (DaaS)

Explanation:
Software as a Service (SaaS) delivers a complete, ready-to-use application over the internet, managed entirely by the provider. Customers only manage their own data and user access, which matches how Microsoft 365 is consumed.
Why other options are incorrect:
A: IaaS would mean the organization manages its own virtual machines and OS, which does not apply to a finished application like Microsoft 365.
B: PaaS is a platform for building applications, not a finished, ready-to-use productivity suite.
D: Desktop as a Service is a category for virtual desktops (like Azure Virtual Desktop), not for productivity applications.
Source: Describe cloud service types - Training | Microsoft Learn

---

During a regional Azure datacenter outage, an application that was deployed across multiple Availability Zones in the region continued serving user requests with minimal disruption. Which cloud computing benefit does this best illustrate?

⬜ A. Elasticity
✅ B. High availability
⬜ C. Agility
⬜ D. Economies of scale

Explanation:
High availability refers to designing a system so it remains operational and accessible with minimal downtime, even when individual components or datacenters experience failures, often achieved using redundancy such as Availability Zones.
Why other options are incorrect:
A: Elasticity is about automatically scaling resources up or down to match demand, not about surviving a datacenter failure.
C: Agility refers to the speed at which resources can be provisioned and reconfigured, not about resilience to failure.
D: Economies of scale refers to cost savings from a provider’s scale of operations, unrelated to this scenario.
Source: Describe the benefits of using cloud services - Training | Microsoft Learn

---

An e-commerce website automatically adds additional web server instances during a flash sale when traffic spikes, and automatically removes those instances once traffic returns to normal, without any manual intervention. Which cloud computing benefit does this describe?

✅ A. Elasticity
⬜ B. Fault tolerance
⬜ C. Agility
⬜ D. Reliability

Explanation:
Elasticity is the ability of a cloud environment to automatically scale resources out (add capacity) or in (remove capacity) in response to real-time demand, ensuring the application has just enough resources at any given moment.
Why other options are incorrect:
B: Fault tolerance is about a system continuing to operate correctly despite a component failure, not about scaling with demand.
C: Agility refers to how quickly new resources or environments can be provisioned in general, not the automatic demand-based scaling described here.
D: Reliability is about a system consistently performing its intended function over time, which is related but does not specifically describe automatic scaling.
Source: Describe the benefits of using cloud services - Training | Microsoft Learn

---

A startup needs to launch a new product feature quickly and provisions the required virtual machines, databases, and networking in Azure within minutes through the Azure portal, instead of waiting weeks to order and rack physical hardware. Which cloud computing benefit does this scenario best illustrate?

✅ A. Agility
⬜ B. Fault tolerance
⬜ C. Economies of scale
⬜ D. Elasticity

Explanation:
Agility describes the speed and flexibility with which cloud resources can be provisioned, configured, and reconfigured — turning a process that used to take weeks or months with physical hardware into a matter of minutes.
Why other options are incorrect:
B: Fault tolerance is about resilience to failures, not the speed of provisioning new resources.
C: Economies of scale is about cost efficiency gained from a provider’s scale, not deployment speed.
D: Elasticity refers specifically to automatically scaling existing resources up or down with demand, not the initial speed of provisioning.
Source: Describe the benefits of using cloud services - Training | Microsoft Learn

---

A mission-critical application is designed so that if one of its underlying virtual machines crashes, another instance automatically takes over the workload with no impact on end users. Which term best describes this design characteristic?

✅ A. Fault tolerance
⬜ B. Disaster recovery
⬜ C. Scalability
⬜ D. Consumption-based pricing

Explanation:
Fault tolerance is the ability of a system to continue operating properly even when one or more of its components fail, typically achieved through redundancy so that a failure is absorbed without visible impact to users.
Why other options are incorrect:
B: Disaster recovery is the process and set of policies for restoring functionality after a major disruptive event (like a regional outage), which is a broader, more reactive concept than tolerating a single component failure.
C: Scalability is about a system’s ability to handle increased load by adding resources, not specifically about surviving a failure.
D: Consumption-based pricing is a billing model and unrelated to resilience.
Source: Describe the benefits of using cloud services - Training | Microsoft Learn

---

After a severe flood destroys a company’s on-premises datacenter, the company is able to restore its critical applications and data from Azure backups in a different region within a few hours, following a documented recovery plan. Which term describes this capability?

✅ A. Disaster recovery
⬜ B. Fault tolerance
⬜ C. Vertical scaling
⬜ D. Elasticity

Explanation:
Disaster recovery is the practice of preparing for and recovering from events that disrupt normal operations, such as a natural disaster, by restoring data and applications from backups, often in a different geographic region, according to a predefined recovery plan.
Why other options are incorrect:
B: Fault tolerance refers to a system automatically absorbing a component failure with no downtime, which is a narrower, real-time concept than recovering from a full datacenter disaster.
C: Vertical scaling means adding more resources (CPU/RAM) to an existing machine, unrelated to disaster recovery.
D: Elasticity is about automatically matching resource capacity to demand, unrelated to recovering from a disaster.
Source: Describe the benefits of using cloud services - Training | Microsoft Learn

---

A company’s finance team is evaluating whether to buy and depreciate its own servers over several years (a large upfront investment) versus paying a monthly Azure subscription fee that can be adjusted based on usage. What are these two spending models called, respectively?

✅ A. Capital Expenditure (CapEx) and Operational Expenditure (OpEx)
⬜ B. Operational Expenditure (OpEx) and Capital Expenditure (CapEx)
⬜ C. Elastic spending and fixed spending
⬜ D. Consumption spending and reservation spending

Explanation:
Capital Expenditure (CapEx) is the traditional model of spending money upfront on physical infrastructure that is then depreciated over time. Operational Expenditure (OpEx) is spending money on services or products now and being billed for them as you use them, which is the model cloud computing enables.
Why other options are incorrect:
B: This reverses the correct order — buying and depreciating servers is CapEx, and the pay-as-you-go subscription is OpEx.
C, D: These are not the standard terms used in Microsoft’s AZ-900 curriculum for this distinction; the correct terms are Capital Expenditure and Operational Expenditure.
Source: Describe the benefits of using cloud services - Training | Microsoft Learn

---

Because Microsoft operates Azure datacenters at a massive global scale and can negotiate better prices on hardware, electricity, and networking than any single company could on its own, it can offer compute and storage services to customers at a lower cost than most customers could achieve running their own datacenter. Which cloud concept does this describe?

✅ A. Economies of scale
⬜ B. High availability
⬜ C. Serverless computing
⬜ D. Shared responsibility

Explanation:
Economies of scale describes the cost advantage a large cloud provider gains by purchasing and operating resources at massive scale, savings which are then passed on to customers in the form of lower prices than most organizations could achieve independently.
Why other options are incorrect:
B: High availability is about system uptime and resilience, not cost efficiency from scale.
C: Serverless computing is a compute execution model where infrastructure management is fully abstracted away, unrelated to bulk purchasing power.
D: The shared responsibility model describes how security duties are divided between provider and customer, not cost efficiencies.
Source: Describe the benefits of using cloud services - Training | Microsoft Learn

---

When a company runs virtual machines in Azure (Infrastructure as a Service), which of the following is Microsoft responsible for, and which is the customer responsible for, under the shared responsibility model?

✅ A. Microsoft is responsible for physical datacenter security and the underlying host infrastructure; the customer is responsible for the guest operating system, applications, and data on the VM
⬜ B. Microsoft is responsible for everything, including the customer’s application code and data
⬜ C. The customer is responsible for physical datacenter security; Microsoft is responsible for the guest operating system
⬜ D. Responsibility is split 50/50 regardless of the service model chosen

Explanation:
Under the shared responsibility model, Microsoft always retains responsibility for the physical security of datacenters, the physical network, and the physical hosts. For IaaS specifically, the customer retains responsibility for the guest operating system (including updates and patching), network controls they configure, applications, and data — responsibilities that shift further toward Microsoft as you move from IaaS to PaaS to SaaS.
Why other options are incorrect:
B: Microsoft never takes responsibility for customer data and application code under any service model; the customer always retains at least that responsibility.
C: Customers never manage physical datacenter security in any Azure service model — that is always Microsoft’s responsibility.
D: Responsibility is not a fixed 50/50 split; the exact division shifts depending on whether the service is IaaS, PaaS, or SaaS.
Source: Shared responsibility in the cloud - Microsoft Learn

---

A company wants to avoid being locked into a single vendor and decides to run some workloads on Azure and others on a different public cloud provider, integrating them as needed. Which cloud strategy does this describe?

✅ A. Multi-cloud
⬜ B. Hybrid cloud
⬜ C. Private cloud
⬜ D. Community cloud

Explanation:
A multi-cloud strategy involves using services from two or more public cloud providers, often to avoid vendor lock-in, meet data residency requirements, or take advantage of best-of-breed services from each provider.
Why other options are incorrect:
B: Hybrid cloud specifically refers to combining a private/on-premises environment with a public cloud, not combining two different public cloud providers.
C: A private cloud is a dedicated, single-tenant cloud environment, which does not describe using two public providers.
D: A community cloud is shared by multiple organizations with common concerns and is not part of the AZ-900 deployment-model or multi-cloud terminology used here.
Source: Describe cloud computing - Training | Microsoft Learn

---

A company wants to deploy resources close to its customers in Southeast Asia to reduce network latency. In Azure terminology, what is the term for a set of datacenters deployed within a defined perimeter and connected through a dedicated regional low-latency network, such as “Southeast Asia”?

⬜ A. Availability Zone
✅ B. Region
⬜ C. Resource group
⬜ D. Management group

Explanation:
An Azure region is a geographic area containing one or more datacenters, networked together with a low-latency network, that customers can deploy resources into. Deploying into the Southeast Asia region places resources physically close to customers in that geography.
Why other options are incorrect:
A: An Availability Zone is a physically separate location within a region, not the region itself.
C: A resource group is a logical container for organizing Azure resources; it has nothing to do with physical geography.
D: A management group is a container used to manage access, policy, and compliance across multiple subscriptions; it is not a physical location.
Source: Describe the core architectural components of Azure - Training | Microsoft Learn

---

To meet disaster recovery requirements, an organization wants to replicate its data to another Azure region that is specifically matched with its primary region and is unlikely to be updated at the same time during Azure platform updates. What is this matched region called?

⬜ A. A sovereign region
✅ B. A region pair
⬜ C. An Availability Zone
⬜ D. A resource group

Explanation:
Most Azure regions are paired with another region at least 300 miles away within the same geography, called a region pair. Azure prioritizes recovering only one region in a pair during a broad outage, and staggers planned maintenance so paired regions are not updated at the same time, making region pairs useful for disaster recovery strategies.
Why other options are incorrect:
A: A sovereign region (such as Azure Government or Azure China) is a physically isolated instance of Azure for specific compliance or legal requirements, not the general disaster-recovery pairing concept.
C: An Availability Zone is a physically separate location within a single region, not a pairing between two regions.
D: A resource group is a logical container for resources within a subscription; it is unrelated to region pairing.
Source: Describe the core architectural components of Azure - Training | Microsoft Learn

---

An architect wants to protect an application from a datacenter-level failure (such as loss of power or cooling in one building) while keeping the resources within the same Azure region for low-latency replication. Which Azure feature should be used to distribute the application’s VMs across physically separate datacenters with independent power, cooling, and networking, all within one region?

⬜ A. Region pairs
✅ B. Availability Zones
⬜ C. Resource groups
⬜ D. Azure Migrate

Explanation:
Availability Zones are physically separate locations within an Azure region, each with independent power, cooling, and networking. Deploying VMs across multiple Availability Zones protects an application from a single datacenter failure while keeping latency low, since the zones are within the same region.
Why other options are incorrect:
A: Region pairs protect against a broader regional disaster and are used for cross-region disaster recovery, not for low-latency, same-region datacenter fault tolerance.
C: Resource groups are a logical management construct for organizing resources; they provide no physical fault isolation.
D: Azure Migrate is a service for assessing and migrating on-premises workloads to Azure, unrelated to Availability Zones.
Source: What are availability zones? - Microsoft Learn

---

A cloud administrator wants to group a virtual machine, its associated virtual network, and its storage account together so they can be managed, monitored, and deleted as a single unit, since they all belong to the same application. Which Azure construct should be used?

⬜ A. Subscription
⬜ B. Management group
✅ C. Resource group
⬜ D. Region

Explanation:
A resource group is a logical container that holds related Azure resources for an application or solution, allowing them to be managed, deployed, monitored, and deleted together as a single unit. Every Azure resource must belong to exactly one resource group.
Why other options are incorrect:
A: A subscription is a billing and access-control boundary that can contain many resource groups; it is a broader construct than what’s needed here.
B: A management group is used to organize multiple subscriptions under common policies and access controls, not individual resources.
D: A region is the physical location where resources are deployed, not a logical grouping construct.
Source: Describe the core architectural components of Azure - Training | Microsoft Learn

---

A large enterprise has separate Azure subscriptions for its Finance, HR, and Engineering departments, and wants to apply a single set of compliance policies and access controls across all three subscriptions at once, without configuring each subscription individually. Which Azure resource organization feature enables this?

⬜ A. Resource groups
✅ B. Management groups
⬜ C. Availability sets
⬜ D. Region pairs

Explanation:
Management groups sit above subscriptions in the Azure resource hierarchy and let organizations manage access, policies, and compliance across multiple subscriptions at once, applying governance consistently across departments or business units.
Why other options are incorrect:
A: Resource groups organize individual resources within a single subscription; they cannot span or govern multiple subscriptions.
C: Availability sets are a compute feature for distributing VMs across fault domains and update domains within a datacenter; they have no relation to organizing subscriptions.
D: Region pairs are a disaster-recovery pairing between two geographic regions, unrelated to subscription governance.
Source: Describe the core architectural components of Azure - Training | Microsoft Learn

---

Which Azure service acts as the deployment and management layer for Azure, processing every request made through the Azure portal, Azure CLI, Azure PowerShell, or REST API, and providing a consistent way to organize, secure, and manage resources through consistent role-based access control and tagging?

✅ A. Azure Resource Manager (ARM)
⬜ B. Azure Monitor
⬜ C. Azure Advisor
⬜ D. Azure Policy

Explanation:
Azure Resource Manager (ARM) is the deployment and management service for Azure. Every action taken on Azure resources, whether through the portal, CLI, PowerShell, or an SDK, goes through Resource Manager, which provides consistent management features like access control, tagging, and locking across all resources.
Why other options are incorrect:
B: Azure Monitor is a service for collecting and analyzing telemetry to understand how applications and resources are performing, not the deployment/management layer itself.
C: Azure Advisor provides personalized recommendations for optimizing resources, not the underlying deployment mechanism.
D: Azure Policy enforces organizational rules and standards on resources; it operates on top of Resource Manager rather than being the deployment layer itself.
Source: Azure Resource Manager overview - Microsoft Learn

---

A gaming company runs a fleet of identical virtual machines behind a load balancer to handle a game’s backend workload, and wants the number of VM instances to automatically increase during peak play hours and decrease overnight, based on CPU utilization. Which Azure compute service is purpose-built for this scenario?

⬜ A. Availability sets
✅ B. Virtual Machine Scale Sets
⬜ C. Azure Container Instances
⬜ D. Resource groups

Explanation:
Virtual Machine Scale Sets let you create and manage a group of identical, load-balanced VMs, with the number of instances automatically increasing or decreasing in response to demand or a defined schedule — exactly the autoscaling behavior described.
Why other options are incorrect:
A: Availability sets group existing VMs across fault and update domains for higher availability, but they do not provide autoscaling of instance counts.
C: Azure Container Instances runs individual containers without an orchestrator; it isn’t designed for autoscaling a fleet of full VMs based on utilization.
D: Resource groups are a logical management container and have no autoscaling capability.
Source: Virtual Machine Scale Sets overview - Microsoft Learn

---

An administrator configures a group of VMs to be spread across multiple fault domains (separate physical racks, power, and network) and update domains (groups that are rebooted separately during planned maintenance) within a single datacenter, to increase availability against localized hardware failure and maintenance events. What is this Azure feature called?

⬜ A. Availability Zone
✅ B. Availability set
⬜ C. Region pair
⬜ D. Scale set

Explanation:
An availability set is a logical grouping of VMs within a single datacenter that spreads them across fault domains (to protect against a hardware rack or power failure) and update domains (so not all VMs reboot at the same time during planned maintenance).
Why other options are incorrect:
A: Availability Zones distribute resources across physically separate datacenters within a region, which is a different (larger-scale) fault-isolation mechanism than fault/update domains within one datacenter.
C: A region pair is a disaster-recovery pairing between two separate geographic regions, unrelated to fault/update domains within one datacenter.
D: A scale set automatically manages the number of VM instances for load and scaling purposes; it does not by itself define fault/update domain placement in the way described.
Source: Describe Azure compute and networking services - Training | Microsoft Learn

---

A team wants to deploy a web application without provisioning or managing any virtual machines, and wants Azure to automatically handle OS patching, scaling, and load balancing for the web tier. Which Azure service is the best fit?

✅ A. Azure App Service
⬜ B. Azure Virtual Machines
⬜ C. Azure Virtual Desktop
⬜ D. Azure ExpressRoute

Explanation:
Azure App Service is a fully managed Platform as a Service (PaaS) for building and hosting web apps, REST APIs, and mobile back ends, with the underlying infrastructure, OS patching, and built-in autoscaling and load balancing handled by Azure.
Why other options are incorrect:
B: Azure Virtual Machines is an IaaS offering that requires the customer to manage the OS and patching themselves, which contradicts the requirement.
C: Azure Virtual Desktop is a desktop and app virtualization service for end-user remote desktops, not for hosting web applications.
D: Azure ExpressRoute is a private network connectivity service between on-premises and Azure; it has nothing to do with hosting a web app.
Source: Azure App Service overview - Microsoft Learn

---

A developer needs to run a single containerized batch job for a short burst of time without provisioning a virtual machine or setting up a container orchestrator like Kubernetes. Which Azure service is designed for quickly running a single container with minimal management overhead?

⬜ A. Azure Kubernetes Service (AKS)
✅ B. Azure Container Instances (ACI)
⬜ C. Azure Virtual Machine Scale Sets
⬜ D. Azure Functions

Explanation:
Azure Container Instances (ACI) is the fastest and simplest way to run a single container in Azure, without having to manage virtual machines or adopt a higher-level orchestration service, making it ideal for simple, short-lived, or burst workloads.
Why other options are incorrect:
A: Azure Kubernetes Service is a full container orchestration platform intended for managing many containers at scale, which is more overhead than needed for a single short-lived job.
C: Virtual Machine Scale Sets manage groups of full VMs, not lightweight individual containers.
D: Azure Functions is a serverless compute service for running event-driven code, not specifically for running arbitrary containers as its primary purpose (though it can host containers in some configurations, ACI is the direct-fit answer for this scenario).
Source: Describe Azure compute and networking services - Training | Microsoft Learn

---

An organization wants to orchestrate dozens of containerized microservices, automatically handling scaling, self-healing, rolling updates, and load balancing across a cluster of nodes. Which Azure service should they use?

✅ A. Azure Kubernetes Service (AKS)
⬜ B. Azure Container Instances
⬜ C. Azure App Service
⬜ D. Azure Functions

Explanation:
Azure Kubernetes Service (AKS) is a managed Kubernetes container-orchestration service that automates deploying, scaling, self-healing, and managing containerized applications across a cluster of nodes, which is exactly what’s needed for orchestrating many microservices.
Why other options are incorrect:
B: Azure Container Instances runs individual containers without an orchestration layer for scaling, self-healing, or rolling updates across many services.
C: Azure App Service hosts web applications directly; it is not a container orchestration platform for many independent microservices.
D: Azure Functions runs individual pieces of event-driven code (serverless), not a fleet of orchestrated containers.
Source: What is Azure Kubernetes Service (AKS)? - Microsoft Learn

---

A developer wants to run a small piece of code that automatically triggers whenever a new file is uploaded to Azure Blob Storage, without provisioning any servers, and wants to pay only for the compute time consumed while the code executes. Which Azure service fits this requirement?

✅ A. Azure Functions
⬜ B. Azure Virtual Machines
⬜ C. Azure Kubernetes Service
⬜ D. Azure Virtual Desktop

Explanation:
Azure Functions is a serverless, event-driven compute service that lets you run small pieces of code in response to triggers (such as a blob being uploaded), automatically managing the underlying compute, and billing based on actual execution time and resources consumed.
Why other options are incorrect:
B: Azure Virtual Machines require you to provision and manage a persistent server, which contradicts the serverless, event-triggered requirement.
C: Azure Kubernetes Service is a container orchestration platform requiring cluster management, which is far more overhead than a simple triggered function.
D: Azure Virtual Desktop provides virtualized desktops for end users, unrelated to event-driven backend code execution.
Source: Azure Functions overview - Microsoft Learn

---

A company wants its remote employees to securely access a full Windows desktop environment and their corporate applications from any device, with the desktop session actually running in Azure rather than on the employee’s local machine. Which Azure service is designed for this?

✅ A. Azure Virtual Desktop
⬜ B. Azure App Service
⬜ C. Azure Container Instances
⬜ D. Azure Functions

Explanation:
Azure Virtual Desktop is a desktop and application virtualization service that runs in Azure, allowing users to remotely access a full Windows desktop and their applications securely from virtually any device.
Why other options are incorrect:
B: Azure App Service hosts web applications and APIs, not full virtualized desktop sessions.
C: Azure Container Instances runs individual containers, not full desktop operating system sessions for end users.
D: Azure Functions is for running small pieces of serverless backend code, unrelated to desktop virtualization.
Source: What is Azure Virtual Desktop? - Microsoft Learn

---

An architect is designing a network in Azure and needs private IP address spaces so that virtual machines and other resources can communicate securely with each other, the internet, and on-premises networks. Which Azure resource provides this fundamental building block for private networking?

✅ A. Azure Virtual Network (VNet)
⬜ B. Azure DNS
⬜ C. Azure Load Balancer
⬜ D. Azure ExpressRoute

Explanation:
Azure Virtual Network (VNet) is the fundamental building block for private networking in Azure. It enables Azure resources such as VMs to securely communicate with each other, the internet, and on-premises networks, and can be segmented into subnets.
Why other options are incorrect:
B: Azure DNS provides domain name resolution hosting; it does not provide the private IP address space and connectivity itself.
C: Azure Load Balancer distributes network traffic across multiple resources; it does not define the underlying private network.
D: Azure ExpressRoute provides a dedicated private connection from on-premises to Azure, but it is not the virtual network construct itself.
Source: What is Azure Virtual Network? - Microsoft Learn

---

A bank needs to connect its on-premises datacenter to Azure over a dedicated, private, high-bandwidth connection that does not travel over the public internet at all, for both performance and compliance reasons. Which Azure networking service should it use?

⬜ A. Site-to-site VPN Gateway
✅ B. Azure ExpressRoute
⬜ C. Azure DNS
⬜ D. Azure Load Balancer

Explanation:
Azure ExpressRoute lets organizations create a private, dedicated connection between their on-premises infrastructure and Azure, facilitated through a connectivity provider, that does not traverse the public internet — offering higher reliability, faster speeds, and lower latency than internet-based connections.
Why other options are incorrect:
A: A site-to-site VPN Gateway connection does provide connectivity between on-premises and Azure, but it does so by creating an encrypted tunnel over the public internet, not a dedicated private connection.
C: Azure DNS is a hosting service for DNS domains; it has no role in establishing private network connectivity.
D: Azure Load Balancer distributes traffic among resources within Azure; it does not connect on-premises networks to Azure.
Source: What is Azure ExpressRoute? - Microsoft Learn

---

A company needs to establish an encrypted connection between its on-premises network and its Azure Virtual Network over the public internet, as a lower-cost alternative to a dedicated private circuit. Which Azure service is designed for this?

✅ A. VPN Gateway
⬜ B. Azure ExpressRoute
⬜ C. Azure Bastion
⬜ D. Azure Front Door

Explanation:
Azure VPN Gateway is a service used to send encrypted traffic between an Azure virtual network and an on-premises location, or between virtual networks, over the public internet, making it a lower-cost alternative to ExpressRoute for establishing connectivity.
Why other options are incorrect:
B: Azure ExpressRoute provides a dedicated, private connection that does not use the public internet, making it a higher-cost, higher-reliability alternative rather than an internet-based encrypted tunnel.
C: Azure Bastion provides secure RDP/SSH access to VMs directly through the Azure portal without exposing public IPs; it is unrelated to site-to-site connectivity.
D: Azure Front Door is a global entry-point and content delivery/routing service for web applications, not a site-to-site VPN service.
Source: What is Azure VPN Gateway? - Microsoft Learn

---

An application receives a large volume of incoming traffic, and the company wants to distribute that traffic evenly across several virtual machines to improve responsiveness and avoid overloading any single VM. Which Azure networking service should be used?

✅ A. Azure Load Balancer
⬜ B. Azure DNS
⬜ C. Azure Virtual Network
⬜ D. Azure ExpressRoute

Explanation:
Azure Load Balancer distributes incoming network traffic across multiple virtual machines or resources, helping ensure high availability and responsiveness by preventing any single instance from becoming overloaded.
Why other options are incorrect:
B: Azure DNS resolves domain names to IP addresses; it does not distribute traffic across backend instances.
C: Azure Virtual Network provides the private networking backbone but does not itself perform traffic distribution across VMs.
D: Azure ExpressRoute is for private connectivity between on-premises and Azure, unrelated to load distribution among VMs.
Source: What is Azure Load Balancer? - Microsoft Learn

---

A company wants to store business-critical data so that it survives not just a hardware failure but even the loss of an entire Azure region, by maintaining copies of the data in a secondary, geographically distant Azure region. Which storage redundancy option should it choose?

⬜ A. Locally Redundant Storage (LRS)
⬜ B. Zone-Redundant Storage (ZRS)
✅ C. Geo-Redundant Storage (GRS)
⬜ D. No redundancy needed

Explanation:
Geo-Redundant Storage (GRS) replicates data to a secondary, geographically distant Azure region (in addition to three synchronous copies in the primary region), protecting against the loss of an entire region, not just a single datacenter or zone.
Why other options are incorrect:
A: Locally Redundant Storage (LRS) only replicates data three times within a single datacenter, providing no protection against a datacenter or region-wide outage.
B: Zone-Redundant Storage (ZRS) replicates data across multiple Availability Zones within a single region, protecting against a datacenter failure but not a full regional outage.
D: Not using redundancy would leave the data vulnerable to any hardware, datacenter, or regional failure, which does not meet the stated requirement.
Source: Azure Storage redundancy - Microsoft Learn

---

A media company has large video archive files that are accessed only once every few years for compliance retention purposes, and it wants to minimize storage costs for this data while accepting that retrieval may take several hours when needed. Which Azure Blob Storage access tier is most appropriate?

⬜ A. Hot tier
⬜ B. Cool tier
✅ C. Archive tier
⬜ D. Premium tier

Explanation:
The Archive access tier offers the lowest storage cost but the highest data retrieval latency (data must first be rehydrated, which can take hours), making it ideal for data that is rarely accessed, such as long-term compliance archives.
Why other options are incorrect:
A: The Hot tier is optimized for data that is accessed frequently and offers the highest storage cost with the lowest access cost, the opposite of what’s needed here.
B: The Cool tier is intended for infrequently accessed data that is still stored for at least 30 days, but it does not offer costs as low as the Archive tier nor does it expect multi-hour retrieval times.
D: Premium tier storage uses high-performance SSD-backed hardware for latency-sensitive workloads, which is the most expensive option and unsuitable for rarely accessed archival data.
Source: Access tiers for blob data - Microsoft Learn

---

A global retailer wants every employee to sign in once with a single set of credentials to securely access Microsoft 365, internal line-of-business applications, and third-party SaaS applications, with support for multi-factor authentication and conditional access policies. Which Azure service provides this centralized identity and access management?

✅ A. Microsoft Entra ID
⬜ B. Azure Resource Manager
⬜ C. Azure Key Vault
⬜ D. Azure Policy

Explanation:
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft’s cloud-based identity and access management service, providing single sign-on, multi-factor authentication, and conditional access across Microsoft 365, custom applications, and thousands of other SaaS applications.
Why other options are incorrect:
B: Azure Resource Manager is the deployment and management layer for Azure resources; it does not manage user identity and sign-in.
C: Azure Key Vault securely stores secrets, keys, and certificates; it is not an identity provider for user sign-in across applications.
D: Azure Policy enforces organizational rules on resource configurations; it has no role in user authentication.
Source: What is Microsoft Entra ID? - Microsoft Learn

---

Before deploying any resources, an organization wants to estimate the monthly cost of a planned Azure architecture (specific VM sizes, storage accounts, and databases) so it can budget accurately. Which Azure tool is designed specifically for this pre-deployment cost estimation?

⬜ A. Azure Cost Management
✅ B. Pricing calculator
⬜ C. Azure Advisor
⬜ D. Azure Monitor

Explanation:
The Azure pricing calculator lets you configure the specific Azure services and sizes you plan to use and generates an estimated cost, helping with budgeting and comparing configuration options before anything is deployed.
Why other options are incorrect:
A: Azure Cost Management tracks and analyzes actual spending on resources that are already deployed, rather than estimating costs before deployment.
C: Azure Advisor provides recommendations for optimizing existing deployed resources for cost, performance, and other factors, not upfront cost estimation for a hypothetical architecture.
D: Azure Monitor collects telemetry and performance data from running resources; it has no cost-estimation function.
Source: Pricing calculator | Microsoft Azure

---

A company runs dozens of Azure resources across several departments and wants to see spending broken down by department and project, set budgets with alerts, and analyze cost trends over time for resources that are already running. Which Azure tool provides this?

✅ A. Azure Cost Management
⬜ B. Pricing calculator
⬜ C. Azure Policy
⬜ D. Azure Blueprints

Explanation:
Azure Cost Management (part of Cost Management + Billing) provides tools to monitor, allocate, and optimize the cost of already-running Azure workloads, including budgets, alerts, and detailed spending analysis over time.
Why other options are incorrect:
B: The pricing calculator is used before deployment to estimate future costs, not to analyze the actual spending of resources that are already running.
C: Azure Policy enforces configuration rules and compliance on resources; it does not provide cost tracking or budgeting.
D: Azure Blueprints is used to define repeatable sets of Azure resources that adhere to an organization’s standards; it is not a cost-analysis tool.
Source: Cost Management overview - Microsoft Learn

---

A company wants to label its Azure resources with metadata such as “CostCenter: Marketing” and “Environment: Production” so it can filter and group resources for cost reporting and organization across resource groups and subscriptions. Which Azure feature enables this?

⬜ A. Resource locks
✅ B. Resource tags
⬜ C. Management groups
⬜ D. Availability sets

Explanation:
Resource tags are name/value pairs that can be applied to Azure resources, resource groups, and subscriptions to logically organize them, which is especially useful for grouping resources for cost reporting, such as by cost center or environment, across organizational boundaries.
Why other options are incorrect:
A: Resource locks prevent resources from being accidentally deleted or modified; they do not provide metadata for cost categorization.
C: Management groups organize multiple subscriptions for governance purposes, but do not provide the granular metadata labeling that tags do.
D: Availability sets are a compute high-availability feature, unrelated to metadata tagging for cost reporting.
Source: Use tags to organize your Azure resources - Microsoft Learn

---

A company runs a steady, predictable workload on a set of virtual machines 24/7 for the next three years and wants to significantly reduce its compute costs compared to paying the standard pay-as-you-go rate, in exchange for committing to that usage upfront. Which Azure pricing option should it use?

⬜ A. Spot VMs
✅ B. Reserved Instances (reservations)
⬜ C. Pay-as-you-go pricing
⬜ D. Free tier pricing

Explanation:
Azure Reservations (Reserved Instances) let customers commit to using a specific amount of compute (or other) resources for a one- or three-year term in exchange for a significant discount compared to pay-as-you-go pricing, making them ideal for steady, predictable workloads.
Why other options are incorrect:
A: Spot VMs offer deep discounts on unused Azure capacity but can be evicted at any time when Azure needs the capacity back, making them unsuitable for a workload that must run continuously.
C: Pay-as-you-go pricing is the standard on-demand rate without any upfront commitment discount, which is more expensive than a reservation for a steady long-term workload.
D: Free tier pricing applies to limited free amounts of certain services for new accounts or specific always-free services; it does not apply to sustained production compute at scale.
Source: Save costs with Azure Reservations - Microsoft Learn

---

A data analytics team has a large, interruptible batch-processing job that can tolerate being stopped and restarted, and wants to run it as cheaply as possible by taking advantage of Azure’s spare, unused compute capacity. Which Azure pricing/VM option is best suited for this workload?

⬜ A. Reserved Instances
✅ B. Spot VMs
⬜ C. Dedicated Hosts
⬜ D. Premium SSD storage

Explanation:
Azure Spot VMs let customers take advantage of unused Azure compute capacity at significant discounts, with the tradeoff that Azure can evict those VMs with little notice when it needs the capacity back — an acceptable tradeoff for interruptible, fault-tolerant batch workloads.
Why other options are incorrect:
A: Reserved Instances require a one- or three-year commitment to guaranteed capacity, which is the opposite of the flexible, interruptible, lowest-cost option needed here.
C: Dedicated Hosts provide physical servers dedicated to a single customer for isolation and compliance reasons, at a higher cost, not the cheapest interruptible option.
D: Premium SSD storage is a high-performance disk tier for latency-sensitive workloads; it is unrelated to compute pricing for batch jobs.
Source: Use Azure Spot Virtual Machines - Microsoft Learn

---

A company’s compliance team wants to enforce a rule across all subscriptions that only allows virtual machines to be deployed in the “East US” and “West Europe” regions, and wants Azure to automatically flag or block any deployment that violates this rule. Which Azure service should be used?

✅ A. Azure Policy
⬜ B. Azure Monitor
⬜ C. Azure Advisor
⬜ D. Resource locks

Explanation:
Azure Policy is a service used to create, assign, and manage policies that enforce organizational standards and assess compliance at scale, such as restricting which regions resources can be deployed to, and can audit or deny non-compliant deployments.
Why other options are incorrect:
B: Azure Monitor collects and analyzes telemetry about resource performance and health; it does not enforce deployment rules.
C: Azure Advisor gives recommendations for best practices and optimizations, but it does not actively prevent non-compliant deployments.
D: Resource locks prevent accidental deletion or modification of existing resources; they don’t restrict which regions new resources can be deployed into.
Source: What is Azure Policy? - Microsoft Learn

---

An administrator wants to prevent a critical production database resource from being accidentally deleted by any team member, while still allowing normal read and write operations against the database to continue. Which Azure governance feature should be applied to the resource?

✅ A. A CanNotDelete resource lock
⬜ B. A ReadOnly resource lock
⬜ C. Azure Policy
⬜ D. A management group

Explanation:
A CanNotDelete resource lock allows authorized users to still read and modify a resource (such as writing data to a database) but prevents the resource itself from being deleted, which matches the stated requirement exactly.
Why other options are incorrect:
B: A ReadOnly lock would prevent all modifications, including normal write operations, which is more restrictive than required and would break normal database operations.
C: Azure Policy enforces rules about how resources are configured or deployed; it is not the mechanism used to directly prevent deletion of a specific existing resource.
D: A management group is used to organize and govern multiple subscriptions, not to protect a single resource from deletion.
Source: Lock resources to prevent unexpected changes - Microsoft Learn

---

An organization is planning a large-scale, multi-year migration to Azure and wants a structured, Microsoft-provided methodology covering strategy, planning, readiness, adoption, governance, and management to guide the initiative. Which Microsoft resource is designed for this purpose?

✅ A. Cloud Adoption Framework (CAF)
⬜ B. Azure Policy
⬜ C. Azure Advisor
⬜ D. Total Cost of Ownership calculator

Explanation:
The Cloud Adoption Framework (CAF) for Azure is a collection of documentation, best practices, tools, and guidance from Microsoft that helps organizations create and implement the strategy, plans, and governance needed for successful cloud adoption at scale.
Why other options are incorrect:
B: Azure Policy is a specific governance enforcement tool, not a comprehensive strategic framework for an entire cloud adoption journey.
C: Azure Advisor is a recommendation engine for optimizing already-deployed resources, not a strategic adoption methodology.
D: The TCO calculator estimates cost comparisons between on-premises and cloud; it is only one small input into a broader adoption strategy, not the framework itself.
Source: Cloud Adoption Framework for Azure - Microsoft Learn

---

A company has servers running in its own datacenter and in another cloud provider, and wants to manage and apply consistent Azure governance, such as Azure Policy and tagging, to those non-Azure servers from within the Azure portal, alongside its native Azure resources. Which Azure service enables this?

✅ A. Azure Arc
⬜ B. Azure Migrate
⬜ C. Azure Resource Manager
⬜ D. Azure Advisor

Explanation:
Azure Arc extends Azure management capabilities to resources outside of Azure, including on-premises servers, other clouds, and Kubernetes clusters, allowing organizations to apply Azure governance tools like Policy and tagging, and manage them alongside native Azure resources from a single control plane.
Why other options are incorrect:
B: Azure Migrate helps assess and migrate workloads into Azure; it does not provide ongoing management of resources that remain outside Azure.
C: Azure Resource Manager is the management layer for native Azure resources; on its own it does not extend to non-Azure infrastructure without Arc.
D: Azure Advisor gives optimization recommendations for Azure resources; it does not extend governance tooling to external infrastructure.
Source: What is Azure Arc? - Microsoft Learn

---

A new Azure administrator wants a web-based, graphical interface to create, manage, and monitor Azure resources, with visual dashboards, without needing to write any scripts or commands. Which Azure tool should they use?

⬜ A. Azure Cloud Shell
✅ B. Azure portal
⬜ C. Azure CLI
⬜ D. Azure PowerShell

Explanation:
The Azure portal is a web-based, graphical user interface that allows administrators to build, manage, and monitor Azure resources through a visual dashboard, without requiring any command-line or scripting knowledge.
Why other options are incorrect:
A: Azure Cloud Shell is a browser-accessible command-line shell (supporting Bash or PowerShell) for scripting against Azure, not a graphical point-and-click interface.
C: Azure CLI is a cross-platform command-line tool for managing Azure resources via typed commands, not a graphical dashboard.
D: Azure PowerShell is a set of command-line cmdlets for managing Azure resources via scripts, also not a graphical interface.
Source: Azure portal overview - Microsoft Learn

---

A DevOps engineer wants to automate repetitive Azure resource management tasks using scripts, and wants a browser-based, pre-authenticated command-line environment (supporting both Bash and PowerShell) accessible directly from the Azure portal without installing anything locally. Which Azure tool fits this need?

✅ A. Azure Cloud Shell
⬜ B. Azure Advisor
⬜ C. Azure Policy
⬜ D. Azure Monitor

Explanation:
Azure Cloud Shell is a browser-based, authenticated shell environment accessible directly from the Azure portal (or shell.azure.com) that supports both Bash and PowerShell for managing Azure resources via scripts, with no local installation required.
Why other options are incorrect:
B: Azure Advisor provides recommendations for resource optimization; it is not a command-line scripting environment.
C: Azure Policy enforces governance rules on resources; it is not a shell or scripting tool.
D: Azure Monitor collects and analyzes telemetry data; it does not provide a command-line management shell.
Source: Overview of Azure Cloud Shell - Microsoft Learn

---

A team wants to define their entire Azure infrastructure (VMs, networking, storage) as a declarative JSON or Bicep file, so the same environment can be deployed repeatedly and consistently across development, test, and production, following Infrastructure as Code practices. Which Azure feature supports this?

✅ A. Azure Resource Manager (ARM) templates
⬜ B. Azure Advisor
⬜ C. Azure Cost Management
⬜ D. Resource locks

Explanation:
Azure Resource Manager (ARM) templates (including the Bicep language, which compiles to ARM templates) let you define infrastructure declaratively in a file, enabling consistent, repeatable deployment of the same environment across multiple stages, a core Infrastructure as Code practice.
Why other options are incorrect:
B: Azure Advisor gives recommendations for improving existing resources; it is not used to declaratively define and repeatably deploy infrastructure.
C: Azure Cost Management analyzes and tracks spending; it has no role in defining or deploying infrastructure.
D: Resource locks protect existing resources from deletion or modification; they play no part in declarative infrastructure deployment.
Source: Infrastructure as Code (IaC): ARM template overview - Microsoft Learn

---

After running several Azure resources for a few months, an administrator wants personalized, automated recommendations for improving cost efficiency, security posture, reliability, and performance based on the actual configuration and usage of their existing resources. Which Azure service provides this?

✅ A. Azure Advisor
⬜ B. Azure Policy
⬜ C. Azure Blueprints
⬜ D. Azure Resource Manager

Explanation:
Azure Advisor analyzes your resource configuration and usage telemetry and provides personalized, actionable recommendations across cost, security, reliability, operational excellence, and performance, helping you follow Azure best practices.
Why other options are incorrect:
B: Azure Policy enforces predefined organizational rules on resources; it does not generate personalized best-practice recommendations across all these categories.
C: Azure Blueprints (being retired) is used to package and repeatably deploy a set of compliant resources, not to analyze and recommend improvements to existing resources.
D: Azure Resource Manager is the deployment/management layer for Azure; it does not itself generate optimization recommendations.
Source: Introduction to Azure Advisor - Microsoft Learn

---

An operations team wants a single service to collect, analyze, and act on telemetry (metrics and logs) from applications and infrastructure across their entire Azure environment, so they can set up alerts, build dashboards, and troubleshoot performance issues. Which Azure service serves as this central monitoring solution?

✅ A. Azure Monitor
⬜ B. Azure Advisor
⬜ C. Azure Policy
⬜ D. Azure Service Health

Explanation:
Azure Monitor is the comprehensive solution for collecting, analyzing, and acting on telemetry from cloud and on-premises environments, including infrastructure metrics and application/platform logs, and provides the foundation for alerting and dashboards, with Log Analytics and Application Insights as key components.
Why other options are incorrect:
B: Azure Advisor provides best-practice recommendations, not the underlying telemetry collection and alerting platform.
C: Azure Policy enforces configuration compliance rules; it does not collect or analyze operational telemetry.
D: Azure Service Health reports on the health of the Azure platform itself and planned maintenance affecting your resources, which is narrower than the full telemetry/monitoring solution Azure Monitor provides.
Source: Azure Monitor overview - Microsoft Learn

---

A development team wants to monitor the live performance of their web application — including response times, failure rates, and user behavior such as page views — and receive alerts when the application starts throwing unusual numbers of exceptions. Which component of Azure Monitor is purpose-built for this application performance monitoring?

⬜ A. Log Analytics
✅ B. Application Insights
⬜ C. Azure Advisor
⬜ D. Azure Service Health

Explanation:
Application Insights is an Azure Monitor feature specifically designed for application performance management (APM), tracking metrics like response times, failure rates, exceptions, and user behavior for live web applications.
Why other options are incorrect:
A: Log Analytics is the tool used to edit and run queries against log data collected by Azure Monitor from many sources; it is a more general log query engine rather than being purpose-built for application performance monitoring specifically.
C: Azure Advisor provides general best-practice recommendations across resources, not live application performance telemetry.
D: Azure Service Health reports on Azure platform incidents and planned maintenance, not the performance of a specific customer application.
Source: Application Insights overview - Microsoft Learn

---

During a widespread Azure outage affecting several services in a specific region, an administrator wants a personalized view showing exactly which of their subscriptions’ resources are impacted, along with guidance and estimated restoration times, as opposed to a generic status page for all of Azure. Which service should they check?

✅ A. Azure Service Health
⬜ B. Microsoft Trust Center
⬜ C. Azure Advisor
⬜ D. Compliance Manager

Explanation:
Azure Service Health provides a personalized view of the health of the specific Azure services and regions your resources actually use, notifying you of service issues, planned maintenance, and health advisories relevant to your subscriptions specifically, unlike a generic global status page.
Why other options are incorrect:
B: The Microsoft Trust Center provides information about Microsoft’s security, privacy, and compliance practices and certifications; it is not a real-time, personalized incident-tracking tool for your resources.
C: Azure Advisor gives best-practice recommendations for cost, security, and performance; it does not report on live service outages.
D: Compliance Manager (in Microsoft Purview) helps manage regulatory compliance assessments and controls; it is unrelated to tracking live service incidents.
Source: What is Azure Service Health? - Microsoft Learn