Free AZ-900 Practice Exam Questions 2026 (With Explanations) — Azure Cloud Fundamentals

Q: [OVERVIEW]HealthCare Europe operates clinical telemetry ingestion lakes in Azure (`France Central`, paired with `France South`) subject to strict zero-data-loss durability mandates across both datacenter power failures and regional catastrophes.[/OVERVIEW] [ENVIRONMENT]• Availability Zone Resilience: Every write must be committed synchronously across 3 independent physical Availability Zones inside `France Central` before acknowledgment. • Regional Disaster Recovery: Asynchronous replication mus

D. Geo-zone-redundant storage (GZRS) — Geo-zone-redundant storage (GZRS) combines the high availability of zone-redundant storage (ZRS across 3 availability zones) with protection from regional outages via asynchronous geo-replication to a secondary paired region.

Q: [OVERVIEW]Banque Centrale Analytics migrates sovereign risk-modeling VMs to Microsoft Azure under strict regulatory auditor clauses requiring single-tenant hardware boundaries.[/OVERVIEW] [ENVIRONMENT]• Compliance Mandate: Multi-tenant hypervisor co-residency with external Azure customers is strictly prohibited. • Operational Requirement: The infrastructure team must still retain control over the underlying Azure maintenance scheduling window and deploy standard Windows/Linux VMs onto reserved p

D. Azure Dedicated Host — Azure Dedicated Host provides physical servers dedicated exclusively to your organization that host one or more of your virtual machines, offering hardware-level isolation and control over maintenance windows.

Q: [SCENARIO]You deploy backend Linux batch servers into an isolated private Azure VNet subnet (`snet-batch`) that must download OS security patches over HTTPS from public Ubuntu repositories.[/SCENARIO] [SOLUTION]Corporate security policy forbids assigning public IPv4 addresses directly to individual VM NICs and forbids permitting unsolicited inbound connections from the public Internet into `snet-batch`. You must attach a dedicated subnet-level outbound translation gateway.[/SOLUTION] [QUESTION]W

D. Virtual Network NAT Gateway — Virtual Network NAT (Network Address Translation) provides outbound-only internet connectivity for subnets. Outbound traffic uses the NAT gateway's static public IP without allowing any inbound traffic to initiate connections.

Q: [SCENARIO]During morning operations, a Cloud Engineer receives an alert that a single mission-critical VM (`vm-billing-01`) stopped responding in `West Europe`, while every other VM in the exact same resource group and region runs normally.[/SCENARIO] [SOLUTION]The engineer first glances at the global public `status.azure.com` page, which shows green across all Azure regions. Because the issue is isolated to one individual resource in your private subscription, a resource-specific diagnostic pan

B. Azure Resource Health — Azure Resource Health provides diagnostic information about the health of your individual cloud resources, helping you quickly identify whether a problem is caused by Azure platform downtime or an internal VM issue.

Q: You need to enforce governance standards across all resource groups in an Azure subscription. You must ensure that developers can only deploy virtual machines in the "France Central" region and that all storage accounts must enforce HTTPS. Which TWO Azure Policy concepts should you use? (Choose two.)

A. Assign the built-in policy definition "Secure transfer to storage accounts should be enabled". & C. Assign the built-in policy definition "Allowed locations" scoped to the subscription. — CORRECT: Options B and D. - Azure Policy enforces organizational compliance and guardrails via policy assignments such as 'Allowed locations' and secure transfer requirements. INCORRECT DISTRACTORS: - Option A grants write permissions without restrictions. - Options C and E are harmful.

Q: Your team wants to monitor and control cloud expenditures. Which TWO capabilities are natively provided by Microsoft Cost Management in Azure? (Choose two.)

B. Analyzing historic and forecasted cloud consumption trends using cost analysis dashboards. & C. Creating monthly spending budgets with automated threshold notification alerts. — CORRECT: Options B and C. - Microsoft Cost Management allows setting proactive cost budgets and visualizing current and forecasted spend trends. INCORRECT DISTRACTORS: - Options A, D, and E are absurd distractors.

Q: What are TWO primary use cases for deploying Azure Arc in an enterprise hybrid and multicloud environment? (Choose two.)

B. Governing and deploying container workloads across multi-cloud Kubernetes clusters using GitOps. & E. Managing on-premises Windows and Linux physical servers directly through the Azure portal with Azure Policy and VM extensions. — CORRECT: Options A and D. - Azure Arc projects external on-premises or other cloud infrastructure (servers, Kubernetes clusters) into Azure Resource Manager for unified management. INCORRECT DISTRACTORS: - Options B, C, and E are fictitious distractors.

Q: Which TWO types of security artifacts can be centrally managed and securely stored inside Azure Key Vault? (Choose two.)

A. Cryptographic keys (such as RSA keys used for disk and database transparent data encryption). & D. Application secrets such as database connection strings and API tokens. — CORRECT: Options B and E. - Azure Key Vault provides dedicated secret management, cryptographic key storage (backed by HSMs), and automated SSL/TLS certificate handling. INCORRECT DISTRACTORS: - Option A belongs in Azure Blob Storage. - Options C and D are non-digital/legacy items.

Q: What are the TWO available types of Azure Resource Locks that administrators can apply to subscriptions, resource groups, or individual resources? (Choose two.)

C. ReadOnly (prevents authorized users from deleting or modifying the resource, only allowing reading). & E. CanNotDelete (prevents authorized users from deleting the resource, but allows reading and modifying). — CORRECT: Options A and C. - Azure Resource Manager provides exactly two lock types: CanNotDelete and ReadOnly. INCORRECT DISTRACTORS: - Options B, D, and E are fictitious inventives.

Q: Which TWO statements correctly describe Microsoft Service Level Agreements (SLAs) for Azure services? (Choose two.)

B. Composite SLAs are calculated by multiplying the individual service SLAs together (e.g. 99.95% * 99.99%). & D. If an Azure service fails to meet its published SLA guarantee, Microsoft provides a financial service credit applied to the customer bill. — CORRECT: Options B and D. - Microsoft SLAs are financially backed through service credits applied to subsequent billing cycles. - Composite availability is calculated by multiplying individual service SLAs. INCORRECT DISTRACTORS: - Option A is wrong (preview services have no SLA). - Options C and E are mathematically or operationally false.

Q1 / 10 CASE STUDY Moderate

Azure Architecture & Availability Zones

[OVERVIEW]HealthCare Europe operates clinical telemetry ingestion lakes in Azure (`France Central`, paired with `France South`) subject to strict zero-data-loss durability mandates across both datacenter power failures and regional catastrophes.[/OVERVIEW] [ENVIRONMENT]• Availability Zone Resilience: Every write must be committed synchronously across 3 independent physical Availability Zones inside `France Central` before acknowledgment. • Regional Disaster Recovery: Asynchronous replication must maintain an off-region copy hundreds of miles away in the paired region (`France South`).[/ENVIRONMENT] [REQUIREMENTS]Select the single built-in Azure Storage redundancy tier that guarantees BOTH synchronous 3-zone durability in the primary region AND asynchronous geo-replication to the paired secondary region.[/REQUIREMENTS] [QUESTION]Which Azure Storage redundancy configuration meets both durability requirements simultaneously?[/QUESTION]

Q2 / 10 CASE STUDY Moderate

Azure Architecture & Availability Zones

[OVERVIEW]Banque Centrale Analytics migrates sovereign risk-modeling VMs to Microsoft Azure under strict regulatory auditor clauses requiring single-tenant hardware boundaries.[/OVERVIEW] [ENVIRONMENT]• Compliance Mandate: Multi-tenant hypervisor co-residency with external Azure customers is strictly prohibited. • Operational Requirement: The infrastructure team must still retain control over the underlying Azure maintenance scheduling window and deploy standard Windows/Linux VMs onto reserved physical blades.[/ENVIRONMENT] [REQUIREMENTS]Provision dedicated physical server hardware exclusively allocated to this single Azure subscription with zero multi-tenant VM sharing.[/REQUIREMENTS] [QUESTION]Which Azure compute service satisfies this physical hardware isolation requirement?[/QUESTION]

Q3 / 10 YES NO Moderate

Azure Architecture & Availability Zones

[SCENARIO]You deploy backend Linux batch servers into an isolated private Azure VNet subnet (`snet-batch`) that must download OS security patches over HTTPS from public Ubuntu repositories.[/SCENARIO] [SOLUTION]Corporate security policy forbids assigning public IPv4 addresses directly to individual VM NICs and forbids permitting unsolicited inbound connections from the public Internet into `snet-batch`. You must attach a dedicated subnet-level outbound translation gateway.[/SOLUTION] [QUESTION]What Azure networking service should you attach directly to the private subnet to provide secure outbound-only internet connectivity?[/QUESTION]

Q4 / 10 YES NO Beginner

Pricing, Governance & Cost Optimization