AZ-900 practice questions with answers

Answer: A) Retire

• ARetiring means decommissioning a workload entirely, appropriate when an application is no longer needed — this both avoids unnecessary migration effort and eliminates the ongoing cost and maintenance burden of a system serving no real business purpose.
• BRetaining means deliberately keeping an application running as-is (typically on-premises) rather than migrating it, which is different from decommissioning it entirely.
• CReplacing means switching to an equivalent alternative (like a SaaS offering); the scenario specifically decommissions the application with no replacement at all, which is retiring.
• DRehosting moves an application to the cloud; the scenario specifically decommissions it instead of moving it anywhere, which is retiring.

Answer: A) Faster time to market, because ready-made managed services let the team spend its effort on the feature's own logic

Building on managed cloud services means a team doesn't have to build and host common components such as databases, identity and messaging. The team can focus on the feature that sets its product apart and deliver it faster.

• ACorrect. Managed (PaaS) services provide pre-built components and take over management of the underlying infrastructure. Microsoft notes that this cuts development time and lets teams focus on building applications instead of handling infrastructure. That is why the feature shipped sooner.
• BIncorrect. Many managed services can scale, but the scenario doesn't mention changing demand. It describes delivering the feature sooner by not building the supporting components, which is a time-to-market benefit.
• CIncorrect. Using cloud managed services is an operational expense paid as you consume. The team didn't buy hardware, and an upfront purchase model wouldn't explain the faster delivery.
• DIncorrect. The scenario is about delivery speed, not resilience. Also, using managed services doesn't remove the customer's responsibility for designing the application to handle failures.

Answer: A) Portability that reduces dependence on any one hosting provider

A container image bundles an app with its dependencies, so it runs the same way on-premises, on a laptop, or with any cloud provider. That portability reduces dependence on a single environment or provider.

• ACorrect. A container image packages the app with its dependencies, so the environment is the same wherever it is deployed. Microsoft's Docker overview describes containers as portable and able to run on-premises, at a service provider, or in the cloud. Because the image runs unchanged in each place, the company does not depend on one environment or provider.
• BIncorrect. Vertical scaling raises or lowers the capabilities of one resource, such as its CPU or RAM. The scenario is about running the same package in different environments, not about resizing a host.
• CIncorrect. High availability is about keeping resources running despite disruptions, and Azure backs it with SLAs. Running one image in several environments does not by itself give an uptime guarantee.
• DIncorrect. Consumption-based pricing is about how cloud resources are billed. The image runs the same way on a laptop and in an on-premises datacenter, where no consumption billing applies, so pricing is not the benefit shown.

Answer: A) The shared responsibility model

In the cloud, the shared responsibility model moves maintenance duties to the provider. The provider always handles physical hardware, and with PaaS it also manages the OS, so customer IT staff stop doing those tasks.

• ACorrect. Under the shared responsibility model, the provider always owns the physical datacenter, network, and hosts. With PaaS, it also takes on more of the stack, such as the operating system. The customer remains responsible for its data, accounts, and access.
• BIncorrect. Horizontal scaling means adding or removing instances, such as VMs or containers, to match demand. It does not change who maintains hardware or patches the OS.
• CIncorrect. High availability is about keeping resources available despite disruptions, with uptime guaranteed in service-level agreements. It does not describe maintenance tasks moving from customer to provider.
• DIncorrect. The consumption-based model means paying only for the resources you use. It describes how you're billed, not who handles hardware and OS maintenance.

Answer: A) Microsoft Sentinel

• AMicrosoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration, automation, and response (SOAR) platform, collecting and correlating security data across an environment, using AI-driven analytics to detect threats and enabling automated response playbooks.
• BDefender for Cloud focuses on cloud security posture management and workload protection recommendations; the broader SIEM/SOAR platform for collecting, correlating, and orchestrating responses to security data across an entire environment is specifically Microsoft Sentinel.
• CAzure Monitor collects general telemetry (metrics/logs); it isn't the purpose-built SIEM/SOAR security platform Microsoft Sentinel specifically provides.
• DA resource lock prevents deletion/modification of a resource; it has no relationship to security event correlation or threat detection.

Answer: A) Geo-redundant storage (GRS)

• AGRS replicates data to a secondary, geographically distant Azure region in addition to the primary region, protecting against the loss of an entire region — unlike locally redundant storage (LRS), which only protects against failures within a single datacenter.
• BLRS only replicates data within a single datacenter in the primary region, providing no protection if that entire region became unavailable — GRS specifically addresses this by replicating to a separate region.
• CAzure Storage always requires selecting some redundancy option (at minimum LRS); "no redundancy" isn't an available configuration, and certainly not one that would protect against a regional outage.
• DA resource lock prevents deletion/modification of a resource; it has no relationship to data replication redundancy.

Answer: A) Company 1: Azure ExpressRoute; Company 2: Azure VPN Gateway

Use ExpressRoute for a private, provider-delivered connection that avoids the public internet and has consistent latency. Use VPN Gateway for an encrypted site-to-site tunnel over an existing internet connection.

• ACorrect. ExpressRoute extends an on-premises network into the Microsoft cloud over a private connection through a connectivity provider. Because it doesn't go over the public internet, it offers more reliability, consistent latency, and a connection uptime SLA. VPN Gateway sends encrypted IPsec/IKE site-to-site traffic over the public internet, so it works over existing broadband.
• BIncorrect. This pair is reversed. VPN Gateway traffic travels over the public internet, which Company 1 wants to avoid. ExpressRoute requires a circuit through a connectivity provider, which Company 2 doesn't want to order.
• CIncorrect. ExpressRoute fits Company 1, but Azure Bastion provides browser-based RDP/SSH access to individual virtual machines. It doesn't create a site-to-site tunnel between an office network and a virtual network.
• DIncorrect. VPN Gateway fits Company 2, but virtual network peering connects Azure virtual networks to each other. It doesn't connect an on-premises datacenter to Azure.

Answer: A) Azure Batch

Azure Batch provides job scheduling as a service. It creates pools of VMs, installs the application, and schedules large numbers of parallel tasks, so there is no cluster or scheduler software to manage. Scale Sets, AKS, and Functions don't meet all of these requirements.

• ACorrect. Azure Batch runs large-scale parallel and HPC workloads. It creates and manages a pool of compute nodes, installs the applications, and automatically schedules tasks on the nodes, with no cluster or job-scheduler software for the customer to install, manage, or scale. Monte Carlo risk simulation is one of the documented examples.
• BIncorrect. Scale sets can create and autoscale many identical VMs, but they don't queue or distribute work. The team would still have to provide and operate its own scheduler to assign the tasks to instances.
• CIncorrect. AKS is a managed Kubernetes platform for containerized applications. The team would have to containerize the workload and configure and operate a Kubernetes cluster and its job resources, which the scenario specifically rules out.
• DIncorrect. Azure Functions runs event-driven serverless code. It is not designed for tens of thousands of multi-hour, VM-based compute tasks scheduled across a pool of nodes.

Answer: A) Azure Container Apps

Azure Container Apps is a fully managed, serverless container platform. It uses KEDA for event-driven scaling, including scale to zero, and Dapr plus built-in service discovery for microservices. It doesn't expose the Kubernetes API or require cluster management, unlike AKS Standard.

• ACorrect. Container Apps is a serverless platform for containerized apps that runs on Kubernetes, Dapr, KEDA and Envoy but doesn't expose the Kubernetes APIs. It scales on HTTP traffic, events or any KEDA-supported scaler, most apps can scale to zero, and it has built-in DNS-based service discovery and Dapr for microservices.
• BIncorrect. AKS gives direct access to the Kubernetes API and can run any Kubernetes workload. With AKS Standard, though, the cluster is in your subscription and you manage its configuration and operations, which is what the team wants to avoid.
• CIncorrect. Container Instances runs containers on demand without managing VMs, but it's a lower-level building block. It doesn't provide scaling or load balancing; to run five instances, you create five separate container instances.
• DIncorrect. Scale Sets automatically scale groups of identical virtual machines. They're IaaS, so the team would manage the VMs and any container platform on them, and they don't offer built-in microservice service discovery.

Answer: A) Azure Serial Console

Azure Serial Console provides interactive text-based access through the VM's serial port without depending on the network. That makes it the fallback for fixing a VM whose network configuration is broken.

• ACorrect. Serial Console connects through the VM's serial port (ttyS0 or COM1) and gives text-based access that does not depend on the network state, so it works even when the VM's network configuration is broken.
• BIncorrect. Bastion opens RDP/SSH sessions to VMs over their private IP addresses inside the virtual network. If the VM cannot be reached on the network, Bastion cannot connect to it either.
• CIncorrect. Boot diagnostics shows a screenshot and the serial log for diagnosis, but it is read-only. It provides no interactive session for changing settings, although Serial Console requires it to be enabled.
• DIncorrect. Network Watcher provides tools for monitoring and diagnosing network connectivity. It cannot open a session into the guest operating system to change its configuration.

Answer: A) Download the latest Azure ISO/IEC 27001 certificate and audit report from the Service Trust Portal

Microsoft's ISO/IEC 27001 certification for Azure is kept up through regular independent audits, so customers should get the current certificate and audit report from the Service Trust Portal instead of relying on old copies.

• ACorrect. Azure undergoes regular independent third-party audits for ISO/IEC 27001, so documents from two years ago may be out of date. Microsoft publishes the current ISO certificates and audit reports in the Service Trust Portal.
• BIncorrect. Certification is maintained through regular independent audits, so it isn't permanent. An old report may not show the current certification status or the services currently in scope.
• CIncorrect. The Azure Policy regulatory compliance initiative helps assess the customer's own resources against ISO 27001 controls. Microsoft says it gives only a partial view of compliance, and it doesn't replace Microsoft's third-party certificate and audit report.
• DIncorrect. Azure Advisor gives recommendations about reliability, security, performance, cost and operational excellence for your resources. It doesn't publish Microsoft's compliance certificates or audit reports.

Answer: A) Operations on the content stored inside a resource, such as reading blobs

In an Azure role definition, Actions cover control plane operations (managing resources) and DataActions cover data plane operations on the data inside a resource, such as reading or writing blobs.

• ACorrect. DataActions list data plane actions that the role allows on the data within a resource. Examples include reading or writing blobs in a storage container and reading queue messages.
• BIncorrect. Managing the resource itself, such as creating or deleting a storage account or container, is a control plane operation. Those operations go in the Actions list, not DataActions.
• CIncorrect. Deny assignments block actions even when a role assignment grants access. They are separate from role definitions. NotDataActions only subtracts actions from a wildcard and is not a deny rule.
• DIncorrect. AssignableScopes, not DataActions, defines the scopes where a role definition can be assigned.

Answer: A) A CanNotDelete resource lock

A CanNotDelete lock blocks deletion for all users and roles, overriding their permissions, while still allowing reads and changes. A ReadOnly lock would also block configuration changes. Because RBAC is additive, assigning Reader to Owners doesn't restrict them.

• ACorrect. With a CanNotDelete (Delete) lock, authorized users can read and modify the resource but cannot delete it. Locks apply to all users and roles, including Owners, and override user permissions.
• BIncorrect. A ReadOnly lock blocks deletion, but it also blocks updates. It's similar to limiting all authorized users to Reader permissions, so administrators could no longer change the account's configuration.
• CIncorrect. Tags are name-value metadata used to organize resources and track costs. A tag doesn't stop anyone from deleting the resource.
• DIncorrect. Azure RBAC is additive: effective permissions are the sum of all of a user's role assignments. Adding Reader to administrators who already hold Owner removes none of their Owner permissions, so they could still delete the storage account.

Answer: A) Store the template as a template spec in a resource group

A template spec stores a versioned ARM template as an Azure resource. Teams with RBAC read access can deploy it but can't change it, which avoids SAS tokens and copies of the template drifting apart.

• AA template spec stores an ARM template in Azure as its own resource and supports versioning. Access is managed through Azure RBAC, so users with read access can deploy the template without being able to change it.
• BMicrosoft describes this as the approach template specs improve on. Sharing from a storage account means making the template public or managing SAS tokens, not RBAC, and it doesn't version the template as a resource.
• CAn Azure Policy initiative groups policy definitions to check or enforce compliance. It doesn't store or deploy ARM templates.
• DA management group organizes subscriptions so that access and policies can be applied together. It doesn't store, version, or share ARM templates.

Answer: A) An Azure Policy assignment that uses the Allowed Locations definition to deny resources in unapproved regions

Azure RBAC controls what actions a user can take, and Azure Policy controls which resource configurations are allowed. So a Contributor can still be blocked by an Allowed Locations policy. Used together, the two give full scope control.

• ACorrect. Azure Policy checks resource properties against business rules, whatever permissions the user has. The built-in Allowed Locations definition, with a Deny effect, limits where new resources can be created. Even when a user is allowed to perform an action, Azure Policy blocks a create that would produce a non-compliant resource.
• BIncorrect. Azure RBAC manages which actions a user can perform at a scope. The developer's Contributor role allows creating storage accounts, which is why the same deployment works in an approved region. Blocking based on resource properties like location is Azure Policy's job.
• CIncorrect. A ReadOnly lock stops all authorized users from updating or deleting resources in its scope, and it doesn't check a resource's region. A subscription-level ReadOnly lock would block control-plane changes in every region, so the deployment in the approved region would also fail.
• DIncorrect. Azure Advisor analyzes configuration and usage and gives best-practice recommendations for cost, security, reliability, performance, and operational excellence. It recommends actions but doesn't deny deployments.