These az 900 sample questions cover all three exam domains: cloud concepts, Azure architecture and services, and Azure management and governance. Each question includes four options, the correct answer, and an explanation of why the right choice fits and why the other options do not. Use them to check your understanding, not to memorize answers.
These az 900 sample questions are scenario-based, the way the real Microsoft Azure Fundamentals exam tends to test concepts. Read each question, pick an answer, then read the explanation even if you were correct, because the explanation shows the reasoning pattern behind the whole topic, not just this one item.
Microsoft does not publish official sample questions for AZ-900, so treat these as a way to check your grasp of the objectives, not as a preview of the exact wording you will see.
Sample Question 1: Cloud Models
Domain: Describe cloud concepts
A media streaming company runs its video encoding on dedicated servers in its own data center. Viewer demand spikes unpredictably, and it wants to add cloud capacity only during those peaks. The company must keep using the on-premises servers for the same baseline workload, and it wants one consistent identity and network policy across both locations. Which cloud model should the company choose?
A) Multi-cloud, because it uses two or more public cloud providers to avoid dependence on any single vendor.
B) Private cloud, because it keeps all encoding workloads and data inside the company's own controlled infrastructure.
C) Public cloud, because it provides the largest possible pool of compute capacity to absorb unpredictable spikes in demand.
D) Hybrid cloud, because it combines on-premises servers with public cloud resources that can handle peak demand.
Answer: D
Explanation: The correct answer is the hybrid cloud option: the scenario requires both keeping on-premises servers and adding public cloud capacity for spikes, so the model must combine the two. The public-cloud option is the strongest distractor because it is the obvious answer to sudden demand, but it drops the requirement to keep using the on-premises environment. The rule to remember is that hybrid cloud extends an existing on-premises footprint into the public cloud, for burst capacity, identity consistency, or shared networking, while public-cloud-only, private-cloud-only, and multi-cloud do not meet that combination.
Sample Question 2: Azure Policy and Governance
Domain: Describe Azure management and governance
A logistics and fleet operator is expanding into a country whose data-protection law requires vehicle location and driver data to stay within that country. The operator's cloud team needs a governance mechanism that blocks the creation of new telemetry resources anywhere else before those resources are deployed. Which Azure capability should they use?
A) Azure Blueprints that package an approved template for all telemetry resources
B) Azure Policy with a Deny effect for resources in an unapproved country
C) Resource locks on the telemetry storage accounts to prevent deletion or change
D) Microsoft Defender for Cloud to monitor and report current security exposure
Answer: B
Explanation: This is correct because Azure Policy is the governance service that can evaluate and block resources at deployment time, and a Deny effect prevents any new resource from being created outside the approved country. The Blueprint option is the strongest distractor: Azure Blueprints can bundle templates, roles, and policies, but it is the Azure Policy assignment inside that setup that actually inspects and denies non-compliant deployments. Resource locks protect existing resources from deletion or modification, and Microsoft Defender for Cloud provides security monitoring and recommendations, not deployment enforcement. The general rule is that regulatory rules like data-residency requirements are enforced with Azure Policy effects, especially Deny, at or before the moment a resource is created.
Sample Question 3: Management Tools
Domain: Describe Azure management and governance
A media streaming company has Azure App Service and SQL Database resources in a single subscription. Its operators work in an on-premises office that has no VPN or ExpressRoute connection to Azure. They need a browser interface to monitor health, review costs, and change resource settings for all Azure services from those computers. Which tool should they use?
A) Azure portal: a browser-based console they can open from the office to manage Azure services.
B) Azure Bastion: a browser-based RDP/SSH service that connects to Azure VMs in a VNet.
C) Azure VPN Gateway: a site-to-site VPN between the office and an Azure virtual network.
D) Azure Arc: a management service that brings non-Azure resources into the Azure portal.
Answer: A
Explanation: The Azure portal is correct because it is a web-based, unified management console, so the on-premises team can use any internet-connected browser without first creating a VPN or ExpressRoute to a virtual network. The VPN Gateway option is the strongest distractor: it is a real hybrid-connectivity service, but this scenario is about resource management through a browser, not connecting the office to a virtual network. The Azure Bastion answer is also network-specific and only gives RDP/SSH to VMs; the Azure Arc answer applies to non-Azure resources, which the scenario does not require. General rule: for browser-based Azure management, choose the Azure portal; keep hybrid networking solutions for traffic between networks, not for the portal UI.
Sample Question 4: Service Models and Shared Responsibility
Domain: Describe cloud concepts
A regulated financial services firm is migrating a trading application to Azure. The application has a hard low-latency requirement and depends on a vendor network driver that must be loaded into the operating system kernel. The firm wants to reduce the amount of infrastructure it manages, but it cannot change the application. Which cloud service type should the firm select?
A) Platform as a service (PaaS)
B) Infrastructure as a service (IaaS)
C) Function as a service (FaaS)
D) Software as a service (SaaS)
Answer: B
Explanation: The IaaS option is correct because the shared responsibility model gives the customer control over the operating system when infrastructure is provided as a service. Installing a vendor driver into the OS kernel requires exactly that control, so the latency target can be met. The strongest distractor is the PaaS option; it is attractive because PaaS offloads OS patching and management, but PaaS deliberately hides the OS and does not allow loading a custom kernel driver. General rule: every step up from IaaS to PaaS to SaaS moves responsibility for the OS and runtime to the provider, so choose IaaS when the workload requires OS-level components or configuration.
Sample Question 5: Database Capacity and Scaling
Domain: Describe Azure architecture and services
Contoso Airlines runs its flight check-in system in Azure. At peak times, each check-in station opens a connection to the reservations database and holds it while writing a boarding record. The database reaches its maximum number of concurrent connections, although its CPU and storage are unused. The operations team wants to add web app instances behind a load balancer. What should they do instead to fix the database failure?
A) Deploy the web app and database in another Azure region for high availability.
B) Change the reservations database to a service tier with a higher connection limit.
C) Add a read replica of the database and route read-only check-in lookups to it.
D) Add more web app instances behind the load balancer to spread the connection load.
Answer: B
Explanation: The service-tier option is correct because the constraint is the database's maximum concurrent sessions and connections, a per-database ceiling. Adding web app instances is horizontal scaling and raises aggregate application capacity, but it does not change how many connections that single database accepts. The read-replica option shifts lookup traffic, not the write connections described in the scenario. Moving to another region improves availability and disaster recovery, not the connection ceiling. The general rule is to identify whether the bottleneck is aggregate capacity or a per-item, per-partition, or per-connection limit; if it is the latter, scale up that specific resource or redesign the workload so that it is no longer a single hot spot.
Sample Question 6: Availability Zones and Redundancy
Domain: Describe Azure architecture and services
Tailwind Airlines runs self-service bag-drop kiosks at one airport. The kiosks must keep accepting bags even if one data center in the Azure region they use fails, and no completed bag-drop can be lost. Passengers are waiting, so redundancy must not add noticeable write latency. Which architecture should the airline use?
A) Place the app and database in a single availability zone and enable automatic scaling.
B) Use two availability zones in the same Azure region and a zone-redundant database.
C) Use one virtual machine and back up its managed disk to a second Azure region.
D) Deploy the app and database to two Azure regions and use geo-replication between them.
Answer: B
Explanation: This is correct because a single data-center failure maps to an availability-zone failure. Availability zones are physically separate data-center locations inside the same Azure region, so a zone-redundant app and database can keep running when one zone fails while using the region's low-latency network. The strongest distractor is the two-region geo-replication option: it also provides redundancy, but it replicates across a wide-area network, which adds latency and, with async geo-replication, can risk losing a recently completed write. The general rule is to use availability zones when the workload must survive a data-center-level failure with low latency and no data loss, and to use multiple regions only when it must survive an entire-region outage and can tolerate higher replication delay.
Sample Question 7: Managed Identity and Azure RBAC
Domain: Describe Azure management and governance
A telecoms operator runs a call-analytics app in Azure Functions that already authenticates with a system-assigned managed identity. The app must now read call recordings from Azure Storage. The change cannot require modifying the app's code or restarting the app. What should you do?
A) Assign the Storage Blob Data Reader role to its managed identity on the storage account.
B) Redeploy the function with a new user-assigned managed identity and a new connection string.
C) Store a shared access signature in Key Vault and change the function code to retrieve it.
D) Add a storage account key to the app settings and change the function code to use that key.
Answer: A
Explanation: The role assignment option is correct because the function already has a system-assigned managed identity, so granting that identity the Storage Blob Data Reader role is an Azure RBAC change. RBAC role assignments do not require modifying code, redeploying, or restarting the app. The storage account key option is the strongest distractor: it can grant access, but the function would need to be changed to use that key. The shared access signature and redeploy options also require code changes or a redeployment. In general, Azure RBAC separates authorization from application code, so assigning the appropriate role to an existing identity is the choice that meets constraints such as no downtime and no code change.
Sample Question 8: Containers Without Orchestration
Domain: Describe Azure architecture and services
A fleet operator has a GPS message-processing component packaged as a Linux Docker image. The component will be moved to Azure and must continue running from the same image with no code changes. The operations team wants no VM provisioning or patching and no container orchestrator to manage. Which Azure compute service should the team use?
A) Deploy the image to Azure Kubernetes Service.
B) Run the image in Azure Container Instances.
C) Run the image on Azure Virtual Machines.
D) Refactor the code into Azure Functions.
Answer: B
Explanation: Azure Container Instances is correct because it runs the existing Linux Docker image directly in Azure without provisioning or patching VMs and without requiring a container orchestrator, so it satisfies both the no-code-change and no-orchestrator constraints. The Azure Kubernetes Service option also runs the same image with no code changes, but it would introduce an orchestrator and cluster management that the team explicitly wants to avoid. The Azure Virtual Machines option would require managing an operating system, and the Azure Functions option would require rewriting the component as function code. General rule: use container instances when you need the simplest way to run an existing container; choose Kubernetes only when you need orchestration at scale; choose VMs when you need full OS control; choose Functions when you can write event-driven code.
Sample Question 9: Cost-Optimized Compute
Domain: Describe Azure management and governance
A university research group needs to run a large image-processing batch workload. The workload is fault-tolerant and saves progress after each image, so it can be paused and resumed if an Azure compute node is reclaimed. The group has no deadline and wants the lowest possible compute cost. What should you recommend?
A) Deploy one standard Azure virtual machine and run the batch on it.
B) Deploy two Azure virtual machines that are in an availability set.
C) Deploy Azure Virtual Desktop session hosts to run the batch.
D) Deploy an Azure Virtual Machine Scale Set with spot virtual machines.
Answer: D
Explanation: The correct choice is the scale-set option with spot virtual machines. Spot VMs use Azure's unused capacity at a reduced price, and because the batch saves progress and can be paused or resumed, the possible eviction of a spot VM does not lose work. The strongest distractor is the availability-set option: it appears to protect against losing a VM, but availability sets are for maintaining VM availability during hardware failures or updates, not for reducing cost, and they require at least two paying VMs. The rule is that interruptible, cost-sensitive batch workloads should use spot VMs; reserve high-availability options such as availability sets for workloads that must run continuously.
How you use these az 900 sample questions matters more than how many you do in one sitting. Read the scenario fully before looking at the options, since several answers describe real Azure features and are only wrong because they do not fit this specific constraint. If you got a question wrong, do not just note the correct letter; re-read the explanation and connect it back to the domain objective on the exam objectives page, since that is the same list Microsoft uses to build the real exam.
For a full-length, timed run at these same three domains, see the practice test page. If you are still deciding how much time you need before sitting the exam, the study plan lays out a domain-weighted schedule. When you are ready to book, the cost and booking page covers how registration and online proctoring work.
Exam facts on this page come from Microsoft’s own pages (official exam page). Prices, versions and policies change — confirm there before you book.