9 real AZ-900 sample questions, each with a worked explanation and a rationale for every option, right and wrong. No account, no card. This is the reasoning the AZ-900 tests: knowing why the tempting answer is wrong, not just spotting the right one.
The real AZ-900 is Typically 40 to 60 questions questions in 45 minutes, pass mark 700 / 1000. For a domain-by-domain breakdown and a study plan, read the AZ-900 study guide. The full bank has 245 questions.
lock_openFree sampleDescribe Azure Architecture and Servicesmedium
Inside a single Azure region, a designer wants the construct made up of one or more physically separate datacentres that each have independent power, cooling, and networking and that act as an isolation boundary. Which construct fits?
- AAn availability zone, a separate datacentre that is an isolation boundarycheck_circle Correct
- BA region pair set up across two regions in one geography
- CA sovereign region isolated for legal or compliance reasons
- DA resource group that logically groups related Azure resources
An availability zone is a physically separate datacentre within a region acting as an isolation boundary. An availability zone is defined as one or more physically separate datacentres within a region, each equipped with independent power, cooling, and networking, deliberately set up as an isolation boundary so that one zone failing leaves the others working.
Why A is correct: Correct. An availability zone is defined as one or more physically separate datacentres within a region, each equipped with independent power, cooling, and networking, deliberately set up as an isolation boundary so that one zone failing leaves the others working.
Why B is wrong: A region pair spans two distinct regions for cross-region recovery, so it operates above the region level rather than as a separate datacentre inside one region, which is what the stem requires.
Why C is wrong: A sovereign region is an isolated instance of Azure for compliance purposes, not a separate datacentre within a normal region acting as a resiliency isolation boundary, so it does not fit.
Why D is wrong: A resource group is a logical management container with no physical datacentre or independent power meaning, so it cannot be the isolation boundary made of separate datacentres.
lock_openFree sampleDescribe Azure Architecture and Serviceseasy
A new engineer provisions a virtual machine, a virtual network, and a database for an application. In Azure terminology, what single word describes each of these individually created, deployed items?
- AA resource, the basic building block that you create or deploycheck_circle Correct
- BA resource group, the named container these items are placed into
- CA subscription, the unit of billing and management used
- DA management group, the governance layer above these
A resource is any single item you create, provision, or deploy in Azure, such as a VM, network, or database. Azure defines a resource as the basic building block: anything you create, provision, or deploy is a resource, and virtual machines, virtual networks, and databases are the canonical examples of resources.
Why A is correct: Correct. Azure defines a resource as the basic building block: anything you create, provision, or deploy is a resource, and virtual machines, virtual networks, and databases are the canonical examples of resources.
Why B is wrong: A resource group is a logical container that holds related items together, so a candidate may reach for it; but the group is the container, not the deployed virtual machine, network, or database itself.
Why C is wrong: A subscription is a unit of management, billing, and scale that links to an account, so it sounds foundational; but it sits well above and contains these items rather than being one of the deployed items.
Why D is wrong: A management group organises subscriptions so governance conditions can be applied as a unit, which tempts a candidate seeking a high-level term; but it governs subscriptions and is not itself a deployed virtual machine, network, or database.
lock_openFree sampleDescribe Azure Architecture and Servicesmedium
A team must apply different access-management policies and distinct spending limits to its development workload versus its production workload, managing each set as one unit. Which Azure boundary applies those access policies as a unit?
- AThe subscription, set per workload boundarycheck_circle Correct
- BThe individual resource, configured per item
- CThe datacentre, chosen for each workload
- DThe availability zone, picked per workload
Azure applies access-management policies at the subscription level, making the subscription the access-control boundary. A subscription is Azure's access-control boundary because Azure applies access-management policies at the subscription level, so separating dev and prod into distinct subscriptions applies each policy set as a single unit.
Why A is correct: Correct. A subscription is Azure's access-control boundary because Azure applies access-management policies at the subscription level, so separating dev and prod into distinct subscriptions applies each policy set as a single unit.
Why B is wrong: You can scope some assignments to a single resource, so per-item control seems sufficient; but Azure applies access-management policies at the subscription level, not as the unit-wide boundary described here.
Why C is wrong: Datacentres are the physical facilities holding the servers, so they sound foundational; but you do not interact with them directly and they are not where access-management policies are applied.
Why D is wrong: Availability zones are isolation boundaries for resilience within a region, so the word boundary is tempting; but they address fault isolation, not access-management policy scope.
lock_openFree sampleDescribe Azure Management and Governanceeasy
An organisation needs a single unified view to govern its data wherever it lives, spanning on-premises stores, multiple clouds, and SaaS applications, with automated data discovery, sensitive-data classification, and end-to-end data lineage. Which tool provides this?
- AAzure Policy, which governs Azure resource configuration, not data
- BMicrosoft Purview, which governs the data estate across all sourcescheck_circle Correct
- CMicrosoft Defender for Cloud, which manages cloud security posture
- DAzure Monitor, which collects operational telemetry from your resources
Microsoft Purview governs the data estate across on-premises, multicloud, and SaaS sources with discovery, classification, and lineage. Microsoft Purview is a family of data governance solutions that brings insights about on-premises, multicloud, and SaaS data together into one view, building a current map of the data estate that includes classification and end-to-end lineage so sensitive data can be located and managed at scale.
Why A is wrong: Azure Policy enforces rules on Azure resource configurations, which is a governance service, but it operates on resource settings rather than mapping and classifying the data estate, so it does not give a unified view of data.
Why B is correct: Correct. Microsoft Purview is a family of data governance solutions that brings insights about on-premises, multicloud, and SaaS data together into one view, building a current map of the data estate that includes classification and end-to-end lineage so sensitive data can be located and managed at scale.
Why C is wrong: Microsoft Defender for Cloud assesses security posture and surfaces protection recommendations, which is appealing for oversight, but its focus is security rather than discovering and classifying data across sources.
Why D is wrong: Azure Monitor gathers metrics and logs about how resources perform, which is broad visibility, but it covers operational telemetry rather than cataloguing, classifying, or tracing the lineage of data.
lock_openFree sampleDescribe Azure Management and Governancemedium
Your organisation runs servers and Kubernetes clusters in an on-premises datacentre and in a competing public cloud, and wants to govern and monitor them through the same Azure control surface as if they were Azure resources. Which capability is designed to project these non-Azure resources into Azure Resource Manager?
- AAzure Resource Manager, the management layer that handles requests for resources
- BAzure Arc, which projects non-Azure resources into Azure Resource Managercheck_circle Correct
- CThe Azure portal, the graphical console used to manage your resources
- DAzure Cloud Shell, the browser-based shell for running commands
Azure Arc extends Azure management and governance to resources outside Azure by projecting them into Azure Resource Manager. Azure Arc is the capability that extends Azure management and governance outward: it works with Azure Resource Manager to project existing non-Azure servers, Kubernetes clusters, and databases into ARM, letting hybrid and multicloud resources be inventoried, governed, and monitored exactly as if they were running in Azure.
Why A is wrong: Azure Resource Manager is the management layer that processes create, update, and delete requests for resources, and Arc relies on it, but ARM by itself does not project external servers or clusters into Azure.
Why B is correct: Correct. Azure Arc is the capability that extends Azure management and governance outward: it works with Azure Resource Manager to project existing non-Azure servers, Kubernetes clusters, and databases into ARM, letting hybrid and multicloud resources be inventoried, governed, and monitored exactly as if they were running in Azure.
Why C is wrong: The Azure portal is a web-based graphical console for building and monitoring resources, but it is a management interface and does not provide the hybrid or multicloud projection that brings outside resources under Azure governance.
Why D is wrong: Azure Cloud Shell is a browser-based shell hosting the Azure CLI and Azure PowerShell, but it only runs commands and cannot project on-premises or other-cloud resources into Azure Resource Manager.
lock_openFree sampleDescribe Azure Management and Governancemedium
An administrator is using a borrowed workstation and needs to run Azure commands from a web browser straight away, with nothing to install locally and already signed in under their own Azure credentials. Which option meets all of these conditions?
- AInstall the Azure CLI on the borrowed workstation
- BOpen Azure Cloud Shell from the web browsercheck_circle Correct
- CBrowse to the Azure portal graphical console
- DInstall Azure PowerShell on the workstation
Cloud Shell is the browser-based, zero-install shell that opens already authenticated to your Azure credentials. Azure Cloud Shell is delivered through the browser with no local installation or configuration required, and it opens already authenticated to your Azure credentials, supporting both Bash CLI and PowerShell, which is exactly what a borrowed-machine, sign-in-ready, zero-install requirement calls for.
Why A is wrong: The Azure CLI is a capable command-line tool, but installing it requires a local download plus separate sign-in setup, which breaks the borrowed-machine and zero-install conditions in this scenario.
Why B is correct: Correct. Azure Cloud Shell is delivered through the browser with no local installation or configuration required, and it opens already authenticated to your Azure credentials, supporting both Bash CLI and PowerShell, which is exactly what a borrowed-machine, sign-in-ready, zero-install requirement calls for.
Why C is wrong: The Azure portal is a graphical web console rather than a command shell, so although it runs in a browser it cannot run the shell commands the administrator wants to execute here.
Why D is wrong: Azure PowerShell runs cmdlets effectively, but installing it on the borrowed workstation involves a local install and configuration, which conflicts with the no-install requirement in this scenario.
lock_openFree sampleDescribe Cloud Conceptseasy
A new cloud customer wants to know which responsibility they retain no matter whether they adopt IaaS, PaaS, or SaaS. Which set always stays with the customer?
- ATheir stored data and their accounts and identitiescheck_circle Correct
- BThe physical datacentre and the racks within it
- CThe physical network that links the servers
- DThe physical hosts that run the workloads
Your data and your identities are always your responsibility in the cloud, whatever the service model. Across the shared responsibility model, data or information stored in the cloud and the accounts and identities of people, services, and devices are listed as always the customer's, irrespective of whether the service is IaaS, PaaS, or SaaS, because only the customer can govern who and what they trust.
Why A is correct: Correct. Across the shared responsibility model, data or information stored in the cloud and the accounts and identities of people, services, and devices are listed as always the customer's, irrespective of whether the service is IaaS, PaaS, or SaaS, because only the customer can govern who and what they trust.
Why B is wrong: The physical datacentre is real and tempting because the customer pays for capacity, but the model lists it as always the provider's responsibility, never the customer's.
Why C is wrong: The physical network is a genuine shared-responsibility item, yet the model assigns the physical network to the provider in every service model, not the customer.
Why D is wrong: Physical hosts feel customer-adjacent because workloads run on them, but the model places the physical hosts permanently with the provider regardless of service type.
lock_openFree sampleDescribe Cloud Conceptseasy
A start-up wants to run on infrastructure that is built and operated entirely by a third-party provider, is open to anyone willing to purchase services, and requires no capital outlay to add more capacity. Which cloud deployment model is being described?
- APublic cloud, owned and run by a third-party provider for any paying customercheck_circle Correct
- BPrivate cloud, dedicated to one tenant and reachable by any paying customer
- CHybrid cloud, interlinking a private cloud with a third-party provider
- DMulticloud, combining services from several third-party providers at once
A public cloud is provider-run, open to any paying customer, and scales without capital outlay. The defining trait of a public cloud is third-party ownership and operation with general availability to any purchaser, and because capacity is consumed on demand rather than bought up front there is no capital expenditure required to scale, which is exactly what the start-up wants.
Why A is correct: Correct. The defining trait of a public cloud is third-party ownership and operation with general availability to any purchaser, and because capacity is consumed on demand rather than bought up front there is no capital expenditure required to scale, which is exactly what the start-up wants.
Why B is wrong: A private cloud is used by a single entity and tempts candidates who hear 'maintained for customers', but it is not open to anyone who wants to purchase and it requires buying and maintaining hardware, so it fails the no-capital-outlay and general-availability clauses.
Why C is wrong: A hybrid cloud connects a private and a public cloud and looks attractive because a provider is involved, but it includes a private component the start-up never mentions and does not describe a model that is purely third-party operated and open to all.
Why D is wrong: Multicloud means using multiple public cloud providers together and draws candidates who fixate on the 'third-party' wording, but the scenario describes a single offering open to anyone rather than the deliberate use of more than one provider.
lock_openFree sampleDescribe Cloud Conceptseasy
Under the infrastructure as a service (IaaS) model, which of the following tasks is the customer responsible for rather than the cloud provider?
- AMaintaining the physical server hardware that runs inside the cloud datacenter
- BProviding physical security controls for the cloud datacenter facility itself
- CInstalling, configuring, and maintaining the guest operating system on the rented computecheck_circle Correct
- DMaintaining the network connectivity that links the datacenter to the internet
Under IaaS the provider maintains the hardware and facility, but the customer installs, configures, and maintains the operating system. IaaS gives the customer maximum control, so the provider maintains only hardware, datacenter physical security, and internet connectivity, while the customer takes on operating system installation, configuration, and ongoing maintenance plus everything above it.
Why A is wrong: Maintaining physical hardware is a real provider task that customers often assume they share, but under IaaS the provider owns and maintains the hardware while the customer only rents capacity on it.
Why B is wrong: Physical security is a genuine responsibility, and candidates know security matters, but datacenter physical security is held by the provider under every cloud model including IaaS, not by the customer.
Why C is correct: Correct. IaaS gives the customer maximum control, so the provider maintains only hardware, datacenter physical security, and internet connectivity, while the customer takes on operating system installation, configuration, and ongoing maintenance plus everything above it.
Why D is wrong: Internet connectivity to the datacenter is plausible because the customer does configure their own virtual networking, but the underlying connection of the datacenter to the internet is maintained by the provider under IaaS.
Examworthy is not affiliated with or endorsed by Microsoft. All questions are original, blueprint-aligned practice material. We never reproduce live exam items. AZ-900 and related marks belong to their respective owners.
