AZ-900 Practice Questions

ISO (International Organization for Standardization) is an independent non-governmental organization that develops international standards (e.g., ISO 27001) applicable across various industries globally. NIST (National Institute of Standards and Technology) is a US non-regulatory agency whose standards (like NIST SP 800-53) are frequently mandated for US federal information systems. GDPR (General Data Protection Regulation) is a comprehensive privacy law enacted by the European Union to protect the data privacy rights of EU citizens. Azure Government is a physically isolated cloud environment specifically designed for US federal, state, and local government agencies to meet strict US compliance requirements (such as FedRAMP High).

Microsoft Learn: What is Azure Government? "Azure Government is a cloud services platform... for US federal, state, and local government... physically isolated instance of Azure."

Source: https://learn.microsoft.com/en-us/azure/azure-government/

Microsoft Learn: General Data Protection Regulation (GDPR). "The General Data Protection Regulation (GDPR) introduces new rules for organizations that offer goods and services to people in the European Union (EU)..."

Source: https://learn.microsoft.com/en-us/compliance/regulatory/gdpr

Microsoft Learn: ISO/IEC 27001:2022 - Azure Compliance. "ISO/IEC 27000 family of standards provide a framework... International Organization for Standardization (ISO)..."

Source: https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-iso-27001

Microsoft Learn: Regulatory Compliance details for NIST SP 800-53 Rev. 5. Describes the mapping of Azure Policy to NIST standards used by US government frameworks.

Source: https://learn.microsoft.com/en-us/azure/governance/policy/samples/nist-sp-800-53-r5

Single sign-on (SSO) enables a user to authenticate once with a single set of credentials and subsequently access multiple applications and resources without needing to re-enter credentials.

Authorization is the process that occurs after a user's identity is verified (authentication). It determines what specific actions, data, or resources the authenticated user is permitted to access.

Multi-factor authentication (MFA) is a security method that verifies a user's identity by requiring them to present two or more distinct pieces of evidence (factors), such as a password (something you know) and a code from a mobile app (something you have).

Microsoft Entra documentation | What is single sign-on (SSO) in Microsoft Entra ID? This document defines SSO as a method that "enables users to sign in once with one account to access all the applications and resources they need."

Microsoft identity platform documentation | Authentication vs. authorization. This official documentation states, "Authorization is the process of granting an authenticated party permission to do something... Authorization determines what data you're allowed to access and what you can do with it."

Microsoft Entra documentation | How it works: Microsoft Entra Multi-Factor Authentication. This document defines MFA as "a process where a user is prompted during a sign-in event for additional forms of identification... This could be to enter a code from their cellphone..." This directly supports the definition of requiring "several elements."

Carnegie Mellon University (CMU) | CyLab | Security & Privacy Institute. Course materials on security fundamentals define authorization as the "process of determining if a user is allowed to perform a certain action on a resource," which aligns perfectly with identifying the access level.

A hybrid cloud is a composition of two or more distinct cloud infrastructures (private, community, or public). A company can start with a public cloud and later add a private cloud, or build both simultaneously. The migration path from private to hybrid is common but not a mandatory prerequisite.

A primary use case for hybrid cloud is "cloud bursting," which allows an application running on a private cloud or internal network to "burst" into a public cloud to tap into additional computing capacity when demand spikes.

A public cloud is provisioned for open use by the general public. While a company controls who accesses its own resources within the public cloud, the cloud model itself is multi-tenant and not restricted to a single company's users.

Mell, P., & Grance, T. (2011). The NIST Definition of Cloud Computing (Special Publication 800-145). National Institute of Standards and Technology, U.S. Department of Commerce.

Reference (Statement 1 & 3): Page 3, Section 2, "Deployment Models." The definition of "Hybrid Cloud" specifies it is a composition of two or more distinct clouds, with no required starting point. The definition of "Public Cloud" states it is "provisioned for open use by the general public," which directly contradicts Statement 3.

Microsoft Azure. (n.d.). What is hybrid cloud computing? Microsoft Azure Documentation.

Reference (Statement 2): In the "Benefits of hybrid cloud" section, it explicitly lists "Scalability." It states, "hybrid cloud gives your business greater flexibility and more data deployment options... scale up to the public cloud to handle unexpected bursts in traffic."

Armbrust, M., Fox, A., Griffith, R., Joseph, A. D., Katz, R., Konwinski, A., ... & Zaharia, M. (2010). A view of cloud computing. Communications of the ACM, 53(4), 50–58.

Reference (Statement 2): Page 52, Section 3.3, "Application: Cloud Bursting." The paper describes this hybrid model: "It allows a private cloud to handle its average demand... while 'bursting' to a public cloud to handle peak loads."

DOI: https://doi.org/10.1145/1721654.1721672

Amazon Web Services. (n.d.). What is Hybrid Cloud? AWS Documentation.

Reference (Statement 2): The documentation highlights "Scalability" as a key benefit, stating, "you can use public cloud resources to instantly scale workloads up or down... instead of purchasing, installing, and maintaining new hardware for your private cloud."

Cloud computing offers significant benefits in agility and financial management. Agility refers to the ability to rapidly provision and de-provision resources to meet changing demands, a process that can take minutes in the cloud versus weeks for on-premises hardware. This is a core advantage. Financially, the cloud shifts the economic model from Capital Expenditure (CapEx), which involves large, upfront investments in physical infrastructure, to Operating Expenditure (OpEx), a pay-as-you-go model. This allows organizations to avoid significant initial costs and pay only for the resources they consume, improving cash flow and budget flexibility.

B: Cloud computing generally reduces administrative complexity by abstracting away the management of physical hardware, networking, and data centers, which are handled by the cloud provider.

C: Cloud services offer different, often more standardized, configuration options compared to on-premises environments, where an organization has complete control over hardware and software choices.

1. Microsoft Learn. (2024). Describe agility. In "Describe the benefits of using cloud services" (AZ-900). Microsoft. Retrieved from https://learn.microsoft.com/en-us/training/modules/describe-cloud-compute/3-describe-cloud-benefits.

Reference Point: This document states, "Agility is the ability to react quickly. Cloud services can allocate and deallocate resources quickly." This directly supports the benefit of rapid provisioning (Answer A).

2. Microsoft Learn. (2024). Describe capital expenditure (CapEx) versus operational expenditure (OpEx). In "Describe cloud service models" (AZ-900). Microsoft. Retrieved from https://learn.microsoft.com/en-us/training/modules/describe-cloud-service-models/3-describe-capex-opex.

Reference Point: This official courseware explains, "Cloud computing is OpEx because cloud computing operates on a pay-as-you-go model... you’re not investing in physical infrastructure." This confirms the shift from CapEx to OpEx (Answer D).

3. Microsoft Azure Documentation. (2023). Principles of cost optimization. In "Microsoft Azure Well-Architected Framework". Microsoft. Retrieved from https://learn.microsoft.com/en-us/azure/well-architected/cost/principles.

Reference Point: Under the "Adopt a consumption-based model" principle, the documentation highlights the benefit of converting "capital expenses to operating expenses" and avoiding "large capital investments."

The General Data Protection Regulation (GDPR) is the primary European Union (EU) regulation that aims to strengthen and standardize data protection and privacy for individuals within the EU and the European Economic Area (EEA), which makes the first statement true.

Regarding the scope, the GDPR has an extraterritorial reach, meaning it applies not only to organizations established in the EU but also to those located outside the EU if they process the personal data of data subjects who are in the EU by offering goods or services (whether paid or free) to them or by monitoring their behavior within the EU. This confirms the second statement is true.

Finally, while Azure itself is not automatically "GDPR compliant" (compliance is a shared responsibility with the customer), Microsoft, as a cloud service provider (processor), ensures that all Azure services and its contractual agreements provide the tools and capabilities necessary for a customer (controller) to build a GDPR-compliant infrastructure and comply with its obligations, making the third statement true.

European Commission. (n.d.). Data protection explained. (Section: "What is personal data?" and "Who processes personal data?"). [Official Vendor Documentation/Academic Source - Regulatory Body]

Reference for Statement 1 (Definition/Rules).

Microsoft Azure. (n.d.). Azure compliance documentation. (Section: "Privacy and GDPR" and "Implementation and mappings," specifically the GDPR control mapping). [Official Vendor Documentation]

Reference for Statement 3 (Azure compliance support).

European Council. (n.d.). Regulation (EU) 2016/679 (General Data Protection Regulation), Article 3: Territorial scope, Paragraph 2. [Official Vendor Documentation/Academic Source - Regulatory Body]

Reference for Statement 2 (Extraterritorial Scope/Applicability).

Investopedia. (2024, May 22). GDPR Explained: Key Rules for Data Protection in the EU. (Section: "Key Takeaways" and "What Is the General Data Protection Regulation?").

Reference for Statement 1 & 2 (Definition and Applicability).

Microsoft Azure Blog. (2018, April 16). Streamlining GDPR requests with the Azure portal. (Mentions Microsoft's commitment to be GDPR compliant across cloud services). [Official Vendor Documentation]

Reference for Statement 3 (Azure capabilities for DSRs).

Azure Functions is a core service within Azure's serverless computing offerings. It is an event-driven platform where you can execute small pieces of code, or "functions," without having to provision or manage the underlying infrastructure like virtual machines or containers. The platform automatically scales and manages the resources required to run the code in response to various triggers, such as an HTTP request or a new item in a storage queue. This model allows developers to focus solely on their application logic, and billing is based on the actual execution time and resources consumed, which is a key characteristic of serverless computing.

A. Azure Virtual Machines: This is an Infrastructure as a Service (IaaS) offering that requires users to provision, manage, and maintain the server and its operating system.

B. Azure Container instances: This service runs containers without managing virtual machines, but it is a serverless container orchestration service, not the primary event-driven code execution platform.

D. Azure storage account: This is a cloud storage solution for data services like blobs, files, and queues; it is not a compute service.

1. Microsoft Learn, AZ-900: Describe Azure compute and networking services. In the "Describe serverless computing" unit, it states, "Azure has two implementations of serverless compute: Azure Functions which are code-based (imperative) and Azure Logic Apps which are design-based (declarative)." This directly identifies Azure Functions as a primary serverless compute service.

2. Microsoft Learn, Introduction to Azure Functions. The overview section states, "Azure Functions is a serverless solution that allows you to write less code, maintain less infrastructure, and save on costs. Instead of worrying about deploying and maintaining servers, the cloud infrastructure provides all the up-to-date resources needed to keep your applications running."

3. Microsoft Learn, Azure virtual machines overview. The documentation clearly defines this service as Infrastructure as a Service (IaaS), stating, "Azure virtual machines (VMs) is one of several types of on-demand, scalable computing resources that Azure offers... This is an example of Infrastructure as a Service (IaaS)."

4. Microsoft Learn, Introduction to Azure Storage. The "What is Azure Storage?" section describes the service as "Microsoft's cloud storage solution for modern data storage scenarios," listing its data services (Blobs, Files, Queues, etc.), confirming it is not a compute service.

The matches are based on the core purpose of each Azure service:

• Azure Bot Services is the specific platform for developing, publishing, and managing conversational AI, or "digital online assistants," which can integrate speech.
• Azure Machine Learning is a comprehensive cloud service used to train, deploy, and manage ML models. These models "use past trainings" to "provide predictions."
• Azure Functions is Azure's event-driven, "serverless computing" service, allowing code to run on demand without managing the underlying infrastructure.
• Azure IoT Hub is a managed service that acts as a central message hub for secure, bi-directional communication and data ingestion from "millions of sensors" and IoT devices.

Azure Bot Services: Microsoft. (n.d.). What is Azure Bot Service? Microsoft Learn. Retrieved November 5, 2025, from https://learn.microsoft.com/en-us/azure/bot-service/bot-service-overview

Reference (Summary of "What is Azure Bot Service?"): This document defines the service as a "managed bot development service" used to "create an intelligent, enterprise-grade bot" that provides a "conversational interface."

Azure Machine Learning: Microsoft. (n.d.). What is Azure Machine Learning? Microsoft Learn. Retrieved November 5, 2025, from https://learn.microsoft.com/en-us/azure/machine-learning/overview-what-is-azure-machine-learning

Reference (Section "What is Azure Machine Learning?"): "Azure Machine Learning is a cloud service for accelerating and managing the machine learning project lifecycle. Machine learning professionals... can use it in their day-to-day workflows to train and deploy models, and manage MLOps."

Azure Functions: Microsoft. (n.d.). Introduction to Azure Functions. Microsoft Learn. Retrieved November 5, 2025, from https://learn.microsoft.com/en-us/azure/azure-functions/functions-overview

Reference (Section "What is Azure Functions?"): "Azure Functions is a serverless solution that allows you to write less code, maintain less infrastructure, and save on costs. Instead of worrying about deploying and maintaining servers, the cloud infrastructure provides all the up-to-date resources needed to keep your applications running."

Azure IoT Hub: Microsoft. (n.d.). What is Azure IoT Hub? Microsoft Learn. Retrieved November 5, 2025, from https://learn.microsoft.com/en-us/azure/iot-hub/iot-hub-what-is-iot-hub

Reference (Section "Overview"): "Azure IoT Hub is a managed service, hosted in the cloud, that acts as a central message hub for bi-directional communication between your IoT application and the devices it manages."

Reference (Section "Connect and manage devices"): "You can also use IoT Hub to... scale to millions of simultaneously connected devices..."

This question assesses the fundamental financial concepts of Capital Expenditure (CapEx) versus Operational Expenditure (OpEx) as applied to cloud and on-premises models.

• CapEx (Capital Expenditure) refers to the upfront spending on physical infrastructure (e.g., servers, datacenters, networking equipment). These costs are high initially but the value of the asset depreciates over time.
• OpEx (Operational Expenditure) refers to the ongoing, consumption-based spending for services or products. There is no upfront cost, and expenses are deducted in the same period they are incurred.

1. Azure Pay-As-You-Go is a classic OpEx model. You pay only for the services you consume, like a monthly utility bill. It is not an upfront capital investment.
2. Azure Reserved VM Instances are also OpEx. Although they may involve a commitment, you are paying for a service and a discount, not acquiring a physical asset. Microsoft still owns and manages the hardware.
3. Deploying your own datacenter is the definitive example of CapEx, as it requires large, upfront investments in buildings, physical servers, and infrastructure.

Microsoft Learn. (n.d.). Describe capital expenditure (CapEx) and operational expenditure (OpEx). In "Microsoft Azure Fundamentals: Describe cloud concepts (AZ-900)". Module: "Describe the benefits and considerations of using cloud services".

Section: "Compare capital expenditure (CapEx) and operational expenditure (OpEx)"

Supporting Text: "CapEx is an upfront spending of money on physical infrastructure... OpEx is spending on products and services as needed, and paying for them immediately... Cloud services are an example of OpEx." This directly supports that Pay-As-You-Go (a cloud service) is OpEx (Statement 1 is No) and deploying a datacenter (physical infrastructure) is CapEx (Statement 3 is Yes).

Microsoft Learn. (n.d.). What are Azure Reservations?. In "Save costs with Azure Reservations".

Section: "How reservation discounts are applied"

Supporting Text: The documentation describes reservations as a billing discount applied to a subscription's consumed resources (e.g., virtual machines). The model is a "commitment to a one-year or three-year plan," but it remains a payment for a service (an operational cost), not the purchase of a depreciable asset. Thus, it remains within the OpEx model.

Armbrust, M., et al. (2010). A View of Cloud Computing. Communications of the ACM, 53(4), 50–58.

DOI: https://doi.org/10.1145/1721654.1721672

Section: 2. "The Rise of Cloud Computing"

Supporting Text: This foundational paper from UC Berkeley defines a key advantage of cloud computing as "the ability to pay for use of computing resources on a short-term basis as needed (e.g., processors by the hour, storage by the day) and release them when no longer needed... This elasticity of resources, without paying a premium for large scale, is unprecedented in the history of IT." This directly contrasts the OpEx "pay-for-use" model with the "provisioning for peak" CapEx model of traditional datacenters.

IoT Hub is a managed Platform as a Service (PaaS) that acts as the core message hub for secure and reliable bidirectional communication between IoT devices and an application back end.

IoT Central is a fully managed application platform (SaaS) that builds upon IoT Hub. It simplifies the development, management, and maintenance of IoT solutions by providing a ready-to-use user interface and API surface.

Azure Sphere is a comprehensive, end-to-end security solution that includes a hardware component (a secured microcontroller unit or MCU), a specialized software (the Azure Sphere OS), and a cloud security service.

Microsoft Learn. (n.d.). What is Azure IoT Hub? Microsoft. Retrieved November 5, 2025.

Section: "What is Azure IoT Hub?"

Quote: "Azure IoT Hub is a managed service, hosted in the cloud, that acts as a central message hub for bidirectional communication between your IoT application and the devices it manages."

Microsoft Learn. (n.d.). What is Azure IoT Central? Microsoft. Retrieved November 5, 2025.

Section: "What is IoT Central?"

Quote: "IoT Central is a fully managed SaaS (software-as-a-service) solution... IoT Central simplifies the initial setup of your IoT solution and reduces the management burden, operational costs, and overhead of a typical IoT project."

Microsoft Learn. (n.d.). What is Azure Sphere? Microsoft. Retrieved November 5, 2025.

Section: "What is Azure Sphere?"

Quote: "Azure Sphere is a comprehensive IoT security solution that includes hardware, OS, and cloud components... It's a secured, high-level application platform with built-in communication and security features for internet-connected devices."

Statement 1 is No. A resource group is a logical container. Its location specifies only where the resource group's metadata is stored. The resources held within that resource group can be in any Azure region.

Statement 2 is No. Tags are not inherited by default. A tag applied to a resource group applies only to the resource group object itself, not to the resources within it. Tag inheritance must be enforced using an Azure Policy definition.

Statement 3 is Yes. Azure Role-Based Access Control (RBAC) permissions are inherited. When a role is assigned to a user at a specific scope (like a resource group), those permissions propagate down to all resources contained within that scope.

Microsoft Learn. (2025, March 31). What is Azure Resource Manager? Section: "Important considerations". Retrieved November 3, 2025.

Citation: "The resources in a resource group can be located in different regions than the resource group... When you create a resource group, you need to provide a location for that resource group... The resource group stores metadata about resources."

Microsoft Learn. (2025, March 30). Understand scope for Azure RBAC. Section: "Scope". Retrieved November 3, 2025.

Citation: "In Azure, you can specify a scope at four levels: management group, subscription, resource group, and resource. Scopes are structured in a parent-child relationship... Lower levels inherit role permissions from higher levels."

Microsoft Learn. (2025, September 15). Use tags to organize your Azure resources and management hierarchy. Section: "Inherit tags". Retrieved November 3, 2025.

Citation: "Resources don't inherit the tags you apply to a resource group or a subscription. To apply tags from a subscription or resource group to the resources, see Assign policy definitions for tag compliance."