AZ-900 Practice Test

Skills this practice test covers

• Explain the shared responsibility model and how it shifts across IaaS, PaaS and SaaS.
• Choose between public, private and hybrid cloud for a given business need.
• Place resources in the hierarchy of management groups, subscriptions and resource groups.
• Pick compute, network and storage options for a workload, including storage tiers and redundancy.
• Describe how Microsoft Entra ID, Conditional Access and Azure RBAC control who can do what.
• Name the right tool for a governance or monitoring task, such as Azure Policy, resource locks or Azure Advisor.

3 domains · 34 topics · 299 of 352 questions sorted by domain

Requirements

• No formal prerequisites: anyone can book the exam.
• Recommended: a working idea of common IT terms, such as servers, networks and storage.
• Recommended: some experience in any area of IT, such as infrastructure, databases or software development.

About the AZ-900 exam

How to earn the certification

Earns

Microsoft Certified: Azure FundamentalsFundamentals

It has no expiry date, so there is nothing to renew.

After

• AZ-104 Microsoft Azure Administrator

  The associate exam for administrators who manage Azure identities, storage, compute and virtual networks.

• AI-200 Developing AI Cloud Solutions on Azure

  The associate exam for developers who build cloud and AI solutions on Azure.

• SC-500 Implementing End-to-End Security Controls for Cloud and AI Workloads

  The associate exam for security engineers who protect cloud and AI workloads.

How to prepare for AZ-900

1. 1

   Start with who manages what

   Begin with the shared responsibility model and the split between IaaS, PaaS and SaaS. Many later questions about Azure services rest on knowing which side manages each layer.

2. 2

   Click through a free Azure account

   Create a resource group, a storage account and a small virtual machine in the Azure portal, then delete them. Seeing the hierarchy makes the architecture questions concrete.

3. 3

   Give architecture and services the most time

   It is the largest domain. Build a table that pairs each compute, storage and identity service with one sentence on when to use it.

4. 4

   Sort the governance and monitoring tools

   Write one line on what Azure Policy, resource locks, tags, Microsoft Purview, Azure Advisor, Azure Service Health and Azure Monitor each do. These tools often appear side by side as answer options.

5. 5

   Use flashcards, then a timed run

   Drill the glossary in flashcard mode, then work through the AZ-900 practice test by domain in study mode. Finish with a timed run and reread the explanation for each miss.

   Start a timed AZ-900run

Microsoft Learn's free Azure Fundamentals learning paths follow the same outline, one path per domain. Microsoft training partners also teach it as the one-day AZ-900T00 course.

Who AZ-900 is for

• People new to the cloud who want a recognized first certification.
• Managers, sellers and buyers who discuss Azure with technical teams.
• IT staff who run on-premises systems and are starting to move workloads to Azure.
• Students who plan to continue to AZ-104 or another associate-level Azure exam.

Typical job titles: Cloud support associate · IT support specialist · Junior cloud administrator · Technical sales specialist · IT project coordinator

AZ-900 glossary

20 terms from the exam objectives and the vendor's official material, each defined in a sentence.

ARM templates

JSON files that declare the resources a deployment needs, so Azure Resource Manager can build them the same way every time.

Availability zones

Physically separate datacenters inside one Azure region, each with its own power, cooling and networking.

Azure Advisor

A service that reviews existing resources and recommends changes for cost, security, reliability, performance and operations.

Azure Arc

A service that brings servers and Kubernetes clusters outside Azure under Azure management.

Azure Policy

A service that sets rules for resources and audits or blocks anything that breaks them, such as a disallowed region.

Azure role-based access control (RBAC)

The Azure system that gives each person only the actions they need, by assigning roles at a chosen scope.

Azure Service Health

A view of Azure outages, planned maintenance and advisories that affect the services and regions a customer uses.

Conditional Access policies

Rules that allow, block or challenge a sign-in based on signals such as the user, the device and the location.

Consumption-based model

Paying only for the cloud resources actually used, instead of buying hardware up front.

Infrastructure as a service (IaaS)

Renting virtual machines, storage and networks, while the customer manages the operating system and everything above it.

Management groups

Containers above subscriptions that apply policies and access rules to many subscriptions at once.

Microsoft Entra ID

Microsoft's cloud identity service, which signs users in and controls their access to apps and Azure resources.

Platform as a service (PaaS)

A managed platform for running apps, where the provider looks after the servers, operating system and runtime.

Region pairs

Two linked Azure regions in the same geography. Microsoft updates them one at a time and recovers one of them first after a wide outage.

Resource groups

Containers that hold related Azure resources, so they can be managed and deleted together.

Resource locks

Settings that block deleting a resource, or any change to it, for everyone until the lock is removed.

Serverless

Running code without managing any servers. The provider scales it and charges only while it runs.

Shared responsibility model

The split of security and management duties between Microsoft and the customer, which changes with the service type.

Software as a service (SaaS)

Finished software delivered over the internet, such as email, where the provider runs almost everything.

Zero Trust

A security model that checks every request as if it came from an open network, instead of trusting the internal network.