AZ-900 Practice Test

B is correct.

Explanation: Cloud computing delivers computing services over the internet, so you can change capacity rapidly instead of buying and installing physical datacenter infrastructure before the sale.

A is incorrect: Customers keep responsibility for their cloud data in every service model.

C is incorrect: Faster application code performance is not a stated property of cloud computing; capacity change and global reach are.

D is incorrect: Networking and storage are examples of cloud services you consume, not capabilities that cloud computing eliminates.

C is correct.

Explanation: SaaS is a complete, fully developed cloud application model, and the provider manages nearly all infrastructure, platform, and application maintenance. The company manages data, identity and access settings, and device access posture, which matches productivity and finance and expense tracking scenarios.

A is incorrect: IaaS gives the most control but requires the company to install and maintain operating systems and configure networking and storage, which needs operations staff.

B is incorrect: PaaS removes operating system and middleware maintenance, but the company would still need to build and manage application code and data.

D is incorrect: Lift-and-shift migration applies to moving existing workloads to IaaS and still leaves operating system and network management with the company.

B is correct.

Explanation: Azure Arc can help manage resources in public cloud, private cloud, hybrid, and multicloud environments, which fits an estate that spans two public cloud providers and a private cloud.

A is incorrect: A private cloud serves one organization and brings greater cost with fewer public cloud benefits, and it does not manage the existing public cloud workloads.

C is incorrect: Retiring the private cloud changes the architecture rather than providing management across the current environments.

D is incorrect: Deployment models can be combined, as hybrid and multicloud show.

A and D are correct.

Explanation: In SaaS the provider manages nearly all infrastructure, platform, and application maintenance. You still manage your data, identity and access settings, and the access posture of the devices that connect to the service.

B is incorrect: Operating system maintenance for a SaaS offering belongs to the provider, and you have no access to those servers.

C is incorrect: Middleware and development tools are maintained by the provider in SaaS, and also in PaaS.

A is correct.

Explanation: With a consumption-based model you pay for the IT resources you use and release them when you finish, so spending becomes operational expenditure instead of an upfront capital purchase.

B is incorrect: Charges follow the resources you consume, so they change as you add or remove resources.

C is incorrect: You still pay for the resources you consume, even though the provider owns the hardware.

D is incorrect: The model avoids buying unused capacity, so you do not need to purchase for peak load in advance.

B is correct.

Explanation: IaaS provides the most flexibility and control, and it supports lift-and-shift migration where the workload moves to the cloud with minimal application changes. You keep control of operating system, network, and storage configuration while the provider maintains the hardware, internet connectivity, and physical security.

A is incorrect: SaaS delivers a complete, fully developed application, so you cannot move legacy application software into it or control the operating system.

C is incorrect: PaaS has the provider maintain the operating systems and middleware, so you would not keep operating system and network configuration control, and the legacy applications would likely need changes.

D is incorrect: A cloud analytics service is a Platform as a Service (PaaS) scenario and is not used to host existing legacy operating systems.

D is correct.

Explanation: With IaaS the customer installs and maintains the operating systems and configures networking, database, and storage. Plan for the staff and processes needed to patch and support those operating systems, even for short-lived development and test environments.

A is incorrect: The provider maintains the hardware.

B is incorrect: The provider maintains internet connectivity.

C is incorrect: The provider enforces physical security.

C is correct.

Explanation: PaaS is a middle ground between IaaS and SaaS. The provider maintains the infrastructure, operating systems, middleware, development tools, and analytics services, so the team can focus on application code, data, and access controls. Application development frameworks and analytics or business-intelligence workloads are typical PaaS scenarios.

A is incorrect: With IaaS you must install and maintain the operating system and configure networking, database, and storage, which adds the maintenance work the team wants to avoid.

B is incorrect: SaaS delivers a finished application, so it does not give the team a place to develop and run its own application code.

D is incorrect: A lift-and-shift migration is an Infrastructure as a Service (IaaS) scenario that leaves the team responsible for installing and patching operating systems.

A and C are correct.

Explanation: In the shared responsibility model, you always retain responsibility for your data, the devices permitted to connect, and your accounts and identities, no matter which service model you choose.

B is incorrect: The cloud provider is responsible for physical hosts in the datacenter.

D is incorrect: The cloud provider is responsible for the physical network in the datacenter.

D is correct.

Explanation: A hybrid cloud connects a public cloud and a private cloud, so you can keep workloads with security or compliance requirements in the private environment and use public cloud capacity for a temporary surge in demand.

A is incorrect: A public cloud alone does not keep the regulated application in the organization's own datacenter.

B is incorrect: A private cloud serves a single organization and does not provide the public cloud capacity needed for the peak.

C is incorrect: Multicloud uses multiple public cloud providers and still does not include the organization's private environment.

A is correct.

Explanation: Azure Functions is an event-driven serverless compute service that runs code in response to events such as messages, timers, and REST requests. It scales automatically with demand and charges for CPU time while the code runs.

B is incorrect: Azure Virtual Machines bills for provisioned servers that you also patch and configure, so it does not match a pay-for-execution model for unpredictable message volume.

C is incorrect: Azure Virtual Desktop provides virtualized desktops and applications for users, not event-triggered code execution.

D is incorrect: Azure IoT Central is a software as a service IoT platform, not a general event-driven code execution service.

B is correct.

Explanation: Management groups sit above subscriptions. Governance conditions applied to a management group inherit downward to the subscriptions it contains, and management groups can be nested up to six levels below the tenant root group.

A is incorrect: A resource group contains resources, not subscriptions, so it cannot act as a container for 40 subscriptions.

C is incorrect: Resource groups cannot be nested, so settings cannot flow from a parent resource group to a child resource group.

D is incorrect: Applying conditions to each resource does not scale across 40 subscriptions and would need to be repeated for every new resource.

D is correct.

Explanation: Availability zones are physically separate datacenters within a region, each with independent power, cooling, and networking. Because the datacenters in a region are connected by low-latency networking, this design protects against a single datacenter failure while keeping latency low.

A is incorrect: Sovereign regions are isolated Azure instances for specific compliance or legal needs, not a datacenter-level resiliency option.

B is incorrect: A larger virtual machine in the same datacenter still fails when that datacenter loses power or cooling.

C is incorrect: Most paired regions are at least 300 miles apart, which addresses regional events rather than low-latency protection inside one region.

A and C are correct.

Explanation: Virtual machine scale sets create and manage a group of identical, load-balanced virtual machines and can scale the number of instances automatically as demand changes. Availability sets spread virtual machines across update domains and fault domains, which reduces the effect of planned maintenance and hardware failures.

B is incorrect: Durable Functions adds stateful behavior to Azure Functions code and does not distribute virtual machines across update and fault domains.

D is incorrect: Azure IoT Edge runs selected cloud capabilities closer to devices and does not provide virtual machine scaling or fault isolation.

B is correct.

Explanation: Azure Virtual Machines is an infrastructure as a service offering that gives you control over the operating system and the software you install, which is what a specific OS build and custom drivers require. In exchange for that control, you remain responsible for patching, updates, and configuration.

A is incorrect: Azure Functions runs code in response to events and does not give you control of the underlying operating system or driver installation.

C is incorrect: Azure Container Instances runs uploaded containers without virtual machine management, so you do not administer a full server operating system.

D is incorrect: Azure App Service hosts applications without infrastructure management, so you cannot install custom operating system drivers.

B is correct.

Explanation: Azure App Service hosts web apps, REST APIs, mobile back ends, and background jobs without infrastructure management. It provides automatic scaling, high availability, support for Windows and Linux, integrated deployment, and multiple language and framework options.

A is incorrect: Virtual machines give the most hosting control, but you must manage patching, updates, and configuration yourself.

C is incorrect: Azure Kubernetes Service orchestrates containers, which means the team still manages container images and cluster workloads.

D is incorrect: Azure IoT Hub enables cloud-to-device communication and is not a web application hosting service.

C is correct.

Explanation: Azure is an expanding set of cloud services for building, managing, and deploying applications on a global network. You can keep the legacy application running on virtual machines and adopt managed databases, autoscaling web apps, and machine learning services alongside it.

A is incorrect: Running existing applications on virtual machines is supported, so a rewrite is not a prerequisite for using Azure.

B is incorrect: Azure includes infrastructure options such as virtual machines in addition to managed services.

D is incorrect: Azure services extend beyond virtual machines and include autoscaling web apps, AI, and machine learning.

C is correct.

Explanation: Azure Kubernetes Service is a container orchestration service for managing fleets of containers. Containers let you scale and update each microservice component independently.

A is incorrect: Azure Container Instances runs uploaded containers without virtual machine management, but it does not provide fleet orchestration.

B is incorrect: Azure Virtual Desktop delivers desktop and application virtualization to users, not container orchestration.

D is incorrect: Azure Machine Learning supports custom model development, training, and lifecycle management rather than orchestrating application containers.

A is correct.

Explanation: An Azure account can have multiple subscriptions, and using separate subscriptions is a way to logically separate development, test, and production workloads. Resources are created within a subscription.

B is incorrect: An Azure free account provides time-limited product access and credits, so it is not a substitute for separating ongoing workloads.

C is incorrect: One Azure account can contain multiple subscriptions, so additional accounts are not required.

D is incorrect: Creating and using Azure services requires a subscription, so workloads cannot be deployed without one.

B and C are correct.

Explanation: In most cases, the regions in a pair are at least 300 miles apart, and that separation improves resilience to regional events while helping you keep data within required geographic boundaries.

A is incorrect: Paired regions are separated by distance rather than co-located, so a shared building would defeat the purpose of the pairing.

D is incorrect: Isolated Azure instances for specific compliance or legal needs are sovereign regions, which are a different concept from region pairs.

B and D are correct.

Explanation: Azure Policy can enforce tagging conventions, such as requiring a costCenter tag when resources are created, and tags must be applied to the individual resources you want to report on because tags are name-value metadata attached to each resource. Together these actions support cost allocation and forecasting for each business unit.

A is incorrect: Tags do not inherit from a subscription to the resources inside it, so subscription-level tags leave the individual resources untagged.

C is incorrect: Tags do not inherit from a resource group to its resources, so resource group tags alone do not produce per-resource cost allocation.

C is correct.

Explanation: Microsoft Purview is a family of data governance, risk, and compliance solutions that gives a unified view of on-premises, multicloud, and SaaS data, and it supports data maps, sensitive-data discovery, secure access, and data-access management at scale.

A is incorrect: Azure Policy creates and manages rules that control resource configurations, so it does not provide a unified view of data across on-premises, multicloud, and SaaS sources.

B is incorrect: Resource locks only prevent accidental changes or deletion of resources, so they do not discover sensitive data or manage data access.

D is incorrect: The Service Trust Portal provides access to documentation about Microsoft security, privacy, and compliance practices, not a view of your own data estate.

B is correct.

Explanation: An Azure savings plan for compute commits you to a fixed hourly amount of spend for one or three years and applies that discount flexibly across eligible compute services, which suits a steady spending baseline with a changing service mix.

A is incorrect: Reservations commit to specific resources and capacity, so they fit stable and predictable workloads rather than a mix of services that changes often.

C is incorrect: Spot Virtual Machines use unused capacity and can be evicted, so they suit fault-tolerant, interruptible workloads and not workloads that cannot accept interruptions.

D is incorrect: Azure Marketplace covers third-party products and services and is a separate cost factor, not a commitment-based discount for eligible compute usage.

A is correct.

Explanation: Azure Policy uses policies and initiatives to control resource configurations, can prevent the creation of noncompliant resources, and applies with inheritance from the subscription scope down to resource groups and resources.

B is incorrect: A ReadOnly lock allows only read operations, so it would block valid resource creation and changes rather than enforce configuration standards.

C is incorrect: A Microsoft Purview data map supports data governance across on-premises, multicloud, and SaaS data, not enforcement of Azure resource configuration rules.

D is incorrect: The Service Trust Portal supplies Microsoft security, privacy, and compliance documentation, so it cannot block noncompliant resource creation.

D is correct.

Explanation: Budgets in Microsoft Cost Management set a spending limit for a scope, send alerts as spending approaches that limit, and can trigger automation such as suspending nonproduction resources.

A is incorrect: Cost analysis groups and displays costs by dimensions such as resource group, region, or service, but it does not send alerts or run automation.

B is incorrect: Department spending quota alerts apply to department spending thresholds and do not provide the automation the team needs for its test subscription.

C is incorrect: Credit alerts track remaining Azure credit for commitments and do not enforce a monthly spending target or suspend resources.

D is correct.

Explanation: A Delete lock allows read and modification operations but prevents deletion, so staff can still change settings while the resource is protected from removal.

A is incorrect: A ReadOnly lock allows only read operations, so it would also block the configuration changes that staff must make.

B is incorrect: Changing role assignments manages permissions, but a lock prevents the change regardless of the role-based access control permissions a user holds.

C is incorrect: An audit-only policy evaluation highlights noncompliant resources; use a lock when the requirement is to prevent deletion.

B is correct.

Explanation: The Service Trust Portal provides authenticated access to information about Microsoft security, privacy, and compliance practices, and you can search documents and save or pin them in My Library for later use. Some materials require a nondisclosure agreement.

A is incorrect: Microsoft Purview governs your own data across on-premises, multicloud, and SaaS sources rather than publishing Microsoft compliance documentation.

C is incorrect: Azure Policy evaluation reports on resources that do not meet your rules, so it does not supply Microsoft security and privacy documentation.

D is incorrect: Resource locks prevent accidental changes or deletion of resources and provide no compliance documentation.

A and C are correct.

Explanation: Locks inherit through resource-group and subscription scopes, so resources in a locked subscription receive the same protection, and a ReadOnly lock restricts users to read operations.

B is incorrect: The lock must be removed before the change is allowed, regardless of the role-based access control permissions a user holds.

D is incorrect: A Delete lock allows reads and modifications and prevents only deletion; use a ReadOnly lock when modifications must also be blocked.

A is correct.

Explanation: The Azure Pricing calculator estimates the cost of individual resources or a complete solution and lets you select compute, storage, network, regions, service tiers, and redundancy. The estimates are informational only, so using the calculator does not provision resources or create charges.

B is incorrect: Deploying the solution first creates real resources and real charges, which the team must avoid.

C is incorrect: The Total Cost of Ownership calculator has been retired, so it is not available for this estimate.

D is incorrect: Budgets and cost analysis work with the costs of resources that already exist in a subscription, so they cannot estimate a solution that is not deployed.

C is correct.

Explanation: Bandwidth charges apply to data that moves out of Azure datacenters, so a workload that streams large volumes of data to internet viewers has costs that scale with outbound data transfer.

A is incorrect: Data ingress and egress are priced differently, so planning around inbound traffic does not account for the cost that grows with viewer downloads.

B is incorrect: Marketplace purchases cover third-party products bought through Azure, which is a separate cost factor from the data transfer generated by streaming.

D is incorrect: Subscription type affects how resources are billed and which offers apply, but it does not change the fact that outbound data transfer is metered as traffic grows.