AZ-900 Practice Questions With Answers (Azure)

These eighteen questions come from Encodr's free Azure Fundamentals course, which has 13 units, 53 chapters and 1,172 study cards built on the AZ-900 skills measured as of July 20, 2026. The set is weighted roughly like the exam: five questions on cloud concepts, seven on Azure architecture and services, and six on management and governance. The official ranges are 25-30%, 35-40% and 30-35%, and the grouping below follows them. If you want the outline first, start with what is on the AZ-900 exam.

Answer each question before you read the answer line. Say it out loud or write it down, then compare. Committing to an answer first is what makes practice stick, and it is the idea behind the testing effect. If you miss one, read the explanation, then come back to the same question tomorrow rather than moving on, which is the spacing half of what spaced repetition actually does.

These are original practice questions written for the course, not real exam questions. The course is unofficial and is not affiliated with or endorsed by Microsoft. Azure details change, so the facts reflect Microsoft documentation as of November 2026.

Describe cloud concepts

1. Who is responsible for the operating system in PaaS?

A. Customer
B. Shared
C. Microsoft
D. A third-party vendor

Answer: C. Microsoft

Why: PaaS removes OS management from the customer.

2. Who is responsible for customer data in SaaS?

A. Customer
B. Microsoft
C. Shared
D. A third-party vendor

Answer: A. Customer

Why: Customer data stays with the customer in all four deployment types.

3. Developers want to deploy code without managing servers or OS patching. Which service type fits?

A. IaaS
B. PaaS
C. SaaS
D. On-premises

Answer: B. PaaS

Why: PaaS removes OS and middleware management; App Service is an example.

4. A company wants to replace a large up-front hardware purchase with ongoing monthly spending. Which shift does the consumption model deliver?

A. OpEx to CapEx
B. CapEx to depreciation
C. CapEx to OpEx
D. OpEx to perpetual licensing

Answer: C. CapEx to OpEx

Why: Moving to the cloud trades capital spending for operating spending.

5. How do you calculate the composite SLA of an app that depends on several services?

A. Add the SLA percentages together
B. Multiply the SLA percentages together
C. Take the highest SLA among the services
D. Average the SLA percentages of the services

Answer: B. Multiply the SLA percentages together

Why: Multiplying the SLAs gives a result below each individual value, reflecting more points of failure.

Describe Azure architecture and services

6. Which feature protects against the failure of a single datacenter within a region?

A. Region pairs and geo-replication
B. Availability sets alone
C. Availability zones
D. Resource locks

Answer: C. Availability zones

Why: Spreading across zones keeps the workload running if one zone fails.

7. A team wants the cheapest option that survives the loss of an availability zone while keeping all copies inside a single region. Which fits?

A. LRS
B. GRS
C. ZRS
D. GZRS

Answer: C. ZRS

Why: ZRS spreads copies across zones in the primary region only.

8. How does GZRS differ from GRS?

A. It keeps nine copies in total instead of six
B. It has more nines of durability per year
C. It copies to the secondary region synchronously, not asynchronously
D. It uses ZRS instead of LRS in the primary region

Answer: D. It uses ZRS instead of LRS in the primary region

Why: Both reach 16 nines; the difference is zone redundancy in the primary region.

9. Which built-in role can manage all resources but cannot assign roles?

A. Owner
B. Reader
C. Contributor
D. User Access Administrator

Answer: C. Contributor

Why: Contributor has full resource access without granting access.

10. A legacy app in Azure needs LDAP and Kerberos, and the team does not want to manage domain controllers. Which service fits?

A. Microsoft Entra Domain Services
B. Microsoft Entra ID
C. Microsoft Entra External ID
D. Microsoft Entra Conditional Access

Answer: A. Microsoft Entra Domain Services

Why: Domain Services is a managed domain for apps that depend on AD DS protocols.

11. Which Azure service is serverless and event-driven, running your code without you managing servers?

A. Azure Virtual Machines
B. Azure Container Instances
C. Azure Functions
D. Azure Batch

Answer: C. Azure Functions

Why: Functions is the FaaS option: you write code and Azure runs it.

12. A US federal agency needs isolated datacenters that keep its data in the US with screened personnel. Which fits?

A. Azure operated by 21Vianet
B. A paired region of East US
C. A standard public region with a lock
D. Azure Government

Answer: D. Azure Government

Why: Azure Government uses physically isolated US-only datacenters and screened US persons.

Describe Azure management and governance

13. A company wants deployments allowed only in two approved regions. Which service enforces this?

A. Azure role-based access control
B. Resource locks
C. Azure Policy
D. Resource tags

Answer: C. Azure Policy

Why: The built-in Allowed locations policy denies resources outside the approved regions.

14. Which Azure Policy effect blocks the creation or update of a non-compliant resource?

A. audit
B. deny
C. append
D. disabled

Answer: B. deny

Why: Deny stops a non-compliant resource from being created or updated.

15. A production database must stay fully usable and modifiable, but an administrator must not be able to delete it by accident. What should you apply?

A. A ReadOnly lock on the whole subscription
B. A CanNotDelete lock
C. An Azure Policy audit effect
D. A Department tag

Answer: B. A CanNotDelete lock

Why: CanNotDelete lets people keep working but blocks deletion.

16. Which of these is NOT one of the five Azure Advisor categories?

A. Reliability
B. Performance
C. Operational excellence
D. Networking

Answer: D. Networking

Why: The categories are Reliability, Security, Performance, Cost and Operational excellence.

17. Which part reports the health of an individual cloud resource, such as one specific VM?

A. Azure status page
B. Service Health overview
C. Resource Health
D. Azure Advisor score

Answer: C. Resource Health

Why: It tracks the health of a single resource.

18. An organization wants one map of its whole data estate. Which service provides it?

A. Azure Advisor
B. Azure Arc
C. Azure Service Health
D. Microsoft Purview

Answer: D. Microsoft Purview

Why: The Purview Data Map gives a map of the data estate with classification and lineage.

How to use your results

Count your misses by area, not just in total. If most of them cluster in one group, that is where your next week of study belongs. Several of these questions are about telling neighbors apart, and each of those has a longer treatment: LRS, ZRS, GRS and GZRS explained covers the redundancy options, and Azure RBAC vs Policy vs resource locks covers the governance trio. For a week-by-week schedule, see how to study for AZ-900.

Practice questions test whether the facts are retrievable, but they do not replace hands-on time. Open the Azure portal, look at a resource group, a storage account and the Access control (IAM) blade, and the terms will have somewhere to land. A set of eighteen is also too small to predict a result, so treat your score as a signal about where to look, not a forecast. Flashcards vs question banks explains what each format is good for.

If you are still choosing between clouds, AWS vs Azure: which cloud cert first compares this exam with the AWS one, and the AWS Cloud Practitioner practice questions are the same format.

Keep going

The full Azure Fundamentals flashcards have every card behind these questions and the rest of the course.