About these questions
These five questions are original. We wrote them to match the style of the AZ-900 skills measured, with all three domains represented. They are not real exam questions, and the real exam will word things differently.
How to use these
Try each question without looking at your notes, and pick an answer before you open the explanation. Then read the explanation even when you were right, because the reason the closest wrong option fails is where the learning is. Note any domain where you slipped and revisit it on the domains explained page.
Question 1 (Describe cloud concepts)
A small publisher moves its content website from virtual machines that it manages itself to Azure App Service. Under the shared responsibility model, which two items does the publisher still manage after the move? Choose two.
- A. Installing updates on the operating system
- B. The website code it deploys
- C. The physical security of the datacenter
- D. The articles and customer data the site stores
- E. Maintaining the web server software and runtime
Show the answer and explanation
Correct answers: B and D. App Service is a platform as a service offering. The provider runs the operating system, the web server, and the runtime, so options A and E move to the provider, and that reduced workload is the reason for the move. The publisher keeps its own application code and its data, and data stays the customer’s responsibility in every service model. Option C is the closest wrong answer because it sounds like something a customer might own, but the physical datacenter always belongs to the cloud provider.
Question 2 (Describe Azure architecture and services)
A hospital group keeps scan archives in an Azure storage account. The data must stay available if one datacenter in the region fails, and local law forbids copying it to another region. Which redundancy option should the group choose?
- A. Locally redundant storage (LRS)
- B. Geo-redundant storage (GRS)
- C. Zone-redundant storage (ZRS)
- D. Geo-zone-redundant storage (GZRS)
Show the answer and explanation
Correct answer: C. ZRS copies data synchronously across three availability zones in the primary region. Each zone is a separate physical location, so losing one datacenter does not make the data unavailable, and nothing leaves the region. LRS is the closest wrong option. It keeps all copies in a single datacenter, so that datacenter failing would make the data unavailable. GRS and GZRS both add a copy in a secondary region, which the law rules out.
Question 3 (Describe Azure architecture and services)
An insurance company runs a claims application in an Azure virtual network. The application must reach a storage account that holds claim photos through a private IP address from the network’s address range. The security team also wants public network access to the storage account turned off. What should the company use?
- A. A private endpoint
- B. A virtual network service endpoint
- C. A firewall rule that allows the application’s public IP address
- D. An Azure private DNS zone
Show the answer and explanation
Correct answer: A. A private endpoint places a network interface with a private IP address from your virtual network in front of the storage account, so traffic stays on that private address and public access can be disabled. A service endpoint is the closest wrong option. It keeps traffic from the subnet on the Azure backbone, but the storage account is still reached through its public endpoint, not a private address. A firewall rule only narrows who may use the public endpoint. A private DNS zone resolves names inside the network but does not create the private address itself.
Question 4 (Describe Azure management and governance)
A cloud team assigns a built-in Azure Policy definition with the deny effect that requires secure transfer (HTTPS) for storage accounts. Fifteen storage accounts that already exist do not meet the rule. What happens to those fifteen accounts?
- A. They are deleted
- B. They are automatically changed to comply
- C. They are ignored because they were created earlier
- D. They are reported as non-compliant
Show the answer and explanation
Correct answer: D. Azure Policy evaluates existing resources as well as new ones, and it flags those that break a rule as non-compliant. That is how teams see how far their environment is from the standard. A deny effect only blocks new or updated requests that violate the rule. It never deletes anything. Option B is the closest wrong answer, because fixing existing resources automatically needs a remediation task on a policy with an effect such as modify or deployIfNotExists.
Question 5 (Describe Azure management and governance)
Three engineers hold the Owner role on a subscription. They need to keep adjusting settings on the production Azure SQL database that supports the finance system. Management wants to make sure that no one, including the Owners, can delete the database by accident. What should be applied to the database?
- A. A ReadOnly lock
- B. A CanNotDelete lock
- C. The Reader role for the engineers
- D. A tag named Environment with the value Production
Show the answer and explanation
Correct answer: B. A CanNotDelete lock blocks deletion for every user, Owners included, while still letting people read and change the resource. A ReadOnly lock is the closest wrong option. It also stops deletion, but it blocks changes too, and the engineers still need to change settings. The Reader role would remove their ability to manage the database. A tag is only a label, so it protects nothing.
More guides for AZ-900
- AZ-900 Study Plan: 4-Week and 8-Week
- Is AZ-900 Hard? An Honest Look
- AZ-900 Prerequisites: What to Know First
- AZ-900 Renewal and Retakes Explained
- Is AZ-900 Worth It? An Honest Look
- AZ-900 Cheat Sheet: Key Facts to Review
- AZ-900 vs AI-901: Which First?
- AZ-900 vs SC-900: Which Exam First?
Next step
If these felt comfortable, check the exam format and book. If a domain felt shaky, try more questions in the AZ-900 practice tests.