Most free AZ-900 practice test material has the same weakness. The questions ask you to define a service, the answer arrives with a single line of justification, and nothing explains why the other three options were wrong. The live exam works differently. It describes a situation and asks which Azure service or concept fits it, and the wrong answers are almost always real Azure services that solve a neighbouring problem.
Below are 25 AZ-900 practice questions written to that standard, against the skills measured Microsoft published on 20 July 2026. They are split across the three domains in roughly the proportions Microsoft uses on the live exam, so a weak run in one section tells you exactly where to revise.
Exam Tip: AZ-900 gives you 45 minutes and requires a score of 700 or greater to pass. Microsoft does not publish a fixed question count for the exam, so treat 45 minutes as the only hard constraint and practise at a pace that leaves you review time.
How to use these AZ-900 practice questions
Work through all 25 before you check a single answer. Write your responses down, then score yourself in one pass at the end.
Give yourself 30 minutes. Sitting on a hard question until the answer surfaces is the habit that inflates every practice score and collapses on exam day, and a self-imposed clock is the cheapest way to break it.
When you review, read the explanation for every question you answered correctly as well as every one you missed. Guessing right and knowing right produce identical scores here and very different scores at the test centre.
Domain 1: Describe cloud concepts (25 to 30% of the exam)
Question 1
A company runs a workload on Azure Virtual Machines. Under the shared responsibility model, which task remains the customer's responsibility?
A. Replacing failed physical disks in the datacentre B. Patching the guest operating system on the virtual machine C. Maintaining the physical network fabric between racks D. Applying firmware updates to the host hypervisor
Answer: B
In an infrastructure as a service deployment the customer owns everything from the guest operating system upwards, which includes patching it. Options A, C and D all describe the physical layer and the host platform, which Microsoft retains responsibility for in every Azure service model. The line moves as you go up the stack, but it never moves far enough for a customer to touch datacentre hardware.
Question 2
An organisation wants to stop forecasting server purchases years ahead and instead pay only for the compute it actually uses each month. Which cloud characteristic delivers this?
A. High availability B. The consumption-based model C. Elasticity D. Disaster recovery
Answer: B
The consumption-based model charges for resources consumed rather than capacity provisioned, which converts a capital expense into an operating expense. Elasticity is the technical ability to add and remove capacity as demand changes, and it is what makes consumption-based billing worth having, but it is not the billing model itself. High availability and disaster recovery describe resilience outcomes and have no bearing on how you are invoiced.
Question 3
A regulator requires that a bank's customer records stay on hardware the bank controls, while its public marketing site can run anywhere. The bank wants both managed as one estate. Which cloud model fits?
A. Public cloud B. Private cloud C. Hybrid cloud D. Community cloud
Answer: C
A hybrid deployment keeps the regulated workload on private infrastructure while the unregulated workload runs in public cloud, with the two managed together. A pure public deployment breaks the regulator's requirement. A pure private deployment satisfies the regulator but forfeits the elasticity and cost profile the bank wants for the marketing site. Community cloud is shared infrastructure for organisations with common requirements, which is not what is described.
Question 4
A development team wants to run an event-driven function that processes an image whenever one is uploaded to storage. They do not want to manage, patch or scale any server. Which model does this describe?
A. Infrastructure as a service B. Serverless C. Software as a service D. Platform as a service with a dedicated App Service plan
Answer: B
Serverless abstracts the infrastructure entirely, scales on demand and bills for execution rather than reserved capacity, which is precisely what an event-triggered image processor needs. Infrastructure as a service would leave the team owning a virtual machine. Software as a service delivers finished applications, not custom code. Option D is genuinely platform as a service, but a dedicated App Service plan means reserved, always-on capacity, so it fails the requirement not to manage or pay for scale.
Question 5
An e-commerce site sees traffic multiply during a two-day sale and fall back afterwards. The business wants capacity to follow that curve automatically. Which benefit of cloud computing is being described?
A. Scalability B. Elasticity C. Reliability D. Manageability
Answer: B
Elasticity is the automatic addition and removal of resources in response to demand, which is what the two-day spike calls for. Scalability is the broader ability to grow capacity, but it does not carry the automatic contraction that makes the sale cost-effective. Reliability concerns recovery from failure. Manageability covers how the environment is administered and governed.
Question 6
Which of the following is a software as a service offering?
A. Azure Virtual Machines B. Azure SQL Database C. Microsoft 365 D. Azure Kubernetes Service
Answer: C
Microsoft 365 is a finished application delivered over the internet, with the customer responsible only for their data, devices and accounts. Azure Virtual Machines is infrastructure as a service. Azure SQL Database is platform as a service, since Microsoft runs the database engine but the customer designs the schema and writes the queries. Azure Kubernetes Service is also platform as a service, and the customer still owns the workloads running on the cluster.
Question 7
A company wants confidence that if one component of its application fails, the application keeps serving requests without manual intervention. Which cloud benefit is it prioritising?
A. Agility B. Predictability C. High availability D. Governance
Answer: C
High availability is the design property that keeps a service running when individual components fail, which is what continuing to serve requests without intervention means. Agility is the speed at which you can deploy and change resources. Predictability covers consistent performance and cost. Governance covers the controls that keep the estate compliant.
Domain 2: Describe Azure architecture and services (35 to 40% of the exam)
Question 8
An architect needs to deploy a workload into a region that meets United States government compliance requirements and is physically and logically isolated from global Azure. Which type of region should they choose?
A. A region pair B. An availability zone C. A sovereign region D. A paired datacentre
Answer: C
Sovereign regions such as Azure Government are separate instances of Azure built to meet specific national compliance and isolation requirements. A region pair is two regions in the same geography used for platform-managed resilience, not for compliance isolation. An availability zone is a physically separate location within a single region. A paired datacentre is not an Azure term.
Question 9
A workload must survive the loss of an entire datacentre building while staying inside one Azure region. Which feature provides this?
A. Availability zones B. Region pairs C. Availability sets D. Geo-redundant storage
Answer: A
Availability zones are physically separate locations within a region, each with independent power, cooling and networking, so distributing instances across zones survives the loss of a whole building. Region pairs protect against the loss of an entire region, which is broader than the requirement. Availability sets distribute virtual machines across fault and update domains inside a single datacentre. Geo-redundant storage replicates data across regions and applies to storage accounts rather than compute.
Question 10
A company needs to apply one Azure Policy assignment across every subscription owned by its finance division, with no risk of a new subscription being missed. Where should the policy be assigned?
A. To each resource group individually B. To a management group containing the finance subscriptions C. To each subscription individually D. To the tenant's Microsoft Entra ID directory
Answer: B
Management groups sit above subscriptions and exist to apply governance across many subscriptions at once, and a subscription added to the group later inherits the assignment automatically. Assigning per subscription or per resource group works today but guarantees the gap the company is trying to avoid. Microsoft Entra ID handles identity, not resource governance, so an Azure Policy assignment cannot target the directory.
Question 11
A team needs to run a legacy application that requires a specific operating system version, custom kernel modules and full administrative access to the host. Which compute option is appropriate?
A. Azure Functions B. Azure App Service C. Azure Virtual Machines D. Azure Container Instances
Answer: C
Virtual machines give complete control of the operating system, which is the only option here that permits custom kernel modules and administrative access. Azure Functions runs short, event-driven code with no operating system access. App Service is a managed platform that does not expose the host. Container Instances runs containerised workloads, and a legacy application requiring kernel-level customisation is a poor fit for a container the platform manages.
Question 12
An administrator needs a group of identical virtual machines that grows and shrinks automatically as CPU load changes. Which feature should they use?
A. An availability set B. Azure Virtual Machine Scale Sets C. Azure Virtual Desktop D. A load balancer on its own
Answer: B
Virtual Machine Scale Sets create and manage a group of identical, load-balanced virtual machines and can scale the instance count automatically against a metric such as CPU. An availability set improves resilience for a fixed set of machines but never changes how many there are. Azure Virtual Desktop delivers virtualised desktops and applications to users. A load balancer distributes traffic across instances that already exist.
Question 13
An organisation needs a private, dedicated connection between its on-premises datacentre and Azure that does not traverse the public internet. Which service provides this?
A. Azure VPN Gateway B. Virtual network peering C. Azure ExpressRoute D. Azure DNS
Answer: C
ExpressRoute provides a private connection through a connectivity provider that bypasses the public internet, which is the stated requirement. A VPN gateway creates an encrypted tunnel that still travels over the public internet. Virtual network peering connects two Azure virtual networks to each other, not an on-premises site. Azure DNS hosts DNS records and provides no connectivity.
Question 14
A storage account must keep three copies of data in the primary region across separate availability zones, and also replicate to a second region. Which redundancy option meets both requirements?
A. Locally redundant storage B. Zone-redundant storage C. Geo-redundant storage D. Geo-zone-redundant storage
Answer: D
Geo-zone-redundant storage combines zonal redundancy in the primary region with replication to a secondary region, which is the only option that satisfies both halves of the requirement. Locally redundant storage keeps copies within a single datacentre. Zone-redundant storage spreads copies across zones but stays in one region. Geo-redundant storage replicates to a second region but keeps the primary copies within a single zone.
Question 15
A company must retain compliance records for seven years. The records are almost never read, and when they are, a retrieval delay of several hours is acceptable. Which access tier gives the lowest storage cost?
A. Hot B. Cool C. Archive D. Premium
Answer: C
The archive tier offers the lowest storage cost in exchange for the data being offline and requiring rehydration before it can be read, and a several-hour retrieval delay is exactly the trade the scenario accepts. Hot is for frequently accessed data and carries the highest storage cost. Cool suits infrequently accessed data that still needs immediate availability. Premium is optimised for low latency and is the most expensive of the four.
Question 16
Security wants to require multifactor authentication only when a user signs in from an unfamiliar location, while leaving normal office sign-ins unchallenged. Which capability enforces this?
A. Azure role-based access control B. Microsoft Entra Conditional Access C. Microsoft Defender for Cloud D. Azure Policy
Answer: B
Conditional Access evaluates signals such as location, device state and risk at sign-in, then applies controls like a multifactor prompt only when the conditions match. Azure role-based access control determines what an authenticated identity may do, not how strongly it must authenticate. Defender for Cloud assesses and improves the security posture of resources. Azure Policy governs the configuration of Azure resources, not sign-in behaviour.
Domain 3: Describe Azure management and governance (30 to 35% of the exam)
Question 17
A team wants to estimate the monthly cost of a proposed architecture before deploying anything. Which tool should they use?
A. Microsoft Cost Management B. The Total Cost of Ownership calculator C. The Azure pricing calculator D. Azure Advisor
Answer: C
The pricing calculator estimates the cost of Azure services you are considering but have not yet deployed, which is what a pre-deployment estimate needs. Microsoft Cost Management analyses and controls spending on resources that already exist. The Total Cost of Ownership calculator compares the cost of running on-premises against Azure, which is a migration business case rather than an architecture estimate. Azure Advisor makes recommendations against resources already running.
Question 18
A finance team needs to see Azure spending broken down by department and project, across resources that sit in many different resource groups. What should be applied to the resources?
A. Resource locks B. Tags C. Management groups D. Azure Policy initiatives
Answer: B
Tags are name and value pairs attached to resources, and cost reports can be filtered and grouped by them, which is the standard way to attribute spend across resource group boundaries. Resource locks prevent deletion or modification. Management groups organise subscriptions rather than individual resources. Azure Policy initiatives group policy definitions, and while a policy can enforce that tags are present, the tags themselves are what carry the cost data.
Question 19
An organisation must guarantee that every storage account created anywhere in its subscriptions requires secure transfer. Which service enforces this at deployment time?
A. Azure Policy B. Azure role-based access control C. Microsoft Purview D. Resource locks
Answer: A
Azure Policy evaluates resources against rules and can deny a deployment that does not comply, which enforces the requirement rather than merely reporting on it. Role-based access control determines who may create a storage account, not how it must be configured. Microsoft Purview governs data across the estate. Resource locks protect existing resources from change or deletion.
Question 20
An engineer must be able to read and reconfigure a production virtual machine but must not be able to delete it, even though their role grants delete permissions. Which lock type should be applied?
A. ReadOnly B. CanNotDelete C. Deny assignment D. Exclusive
Answer: B
A CanNotDelete lock allows authorised users to read and modify a resource while blocking deletion, which matches the requirement precisely. A ReadOnly lock would also block the reconfiguration the engineer needs to perform. Deny assignments exist in Azure but are created by the platform in specific scenarios rather than applied as a resource lock. Exclusive is not an Azure lock type.
Question 21
A company runs Windows servers in its own datacentre and on another cloud provider. It wants to inventory them and apply Azure Policy to them from the Azure portal. Which service enables this?
A. Azure Migrate B. Azure Arc C. Azure Site Recovery D. Azure Stack
Answer: B
Azure Arc extends Azure management and governance to servers, Kubernetes clusters and data services running outside Azure, including on other clouds, so they can be inventoried and governed from the portal. Azure Migrate assesses and moves workloads into Azure, which is not what is wanted here. Azure Site Recovery handles disaster recovery replication. Azure Stack brings Azure services into a customer's own datacentre, which does not help with servers on a third-party cloud.
Question 22
A team wants its Azure environment defined in declarative template files stored in source control, so that redeploying produces an identical result every time. Which approach are they adopting?
A. Infrastructure as code using ARM templates or Bicep B. Continuous integration using the Azure CLI C. Configuration drift management using Azure Advisor D. Manual deployment through the Azure portal
Answer: A
Infrastructure as code defines resources declaratively in files that can be versioned and redeployed repeatably, and Azure Resource Manager templates and Bicep are the native implementations. Scripting with the Azure CLI is imperative rather than declarative, so it describes the steps rather than the desired state. Azure Advisor makes recommendations and does not deploy anything. Portal deployment is the manual approach this team is moving away from.
Question 23
An administrator wants a personalised list of recommendations to reduce spend and improve reliability across their existing Azure resources. Which service provides it?
A. Azure Monitor B. Azure Service Health C. Azure Advisor D. Microsoft Cost Management
Answer: C
Azure Advisor analyses deployed resources and returns recommendations across cost, reliability, security, operational excellence and performance. Azure Monitor collects and analyses telemetry rather than issuing recommendations. Azure Service Health reports on Azure platform incidents and planned maintenance affecting your resources. Microsoft Cost Management analyses spending but does not cover reliability.
Question 24
Users report that an Azure service they depend on is degraded, and the operations team needs to know whether Microsoft has an active platform incident affecting their subscription. Where should they look?
A. Azure Monitor alerts B. Azure Service Health C. Application Insights D. Log Analytics
Answer: B
Azure Service Health provides a personalised view of Azure incidents, planned maintenance and health advisories that affect the resources in your subscriptions, which answers the question of whether the fault is Microsoft's. Azure Monitor alerts fire on conditions in your own telemetry. Application Insights monitors application performance and availability. Log Analytics is where queries run against collected log data.
Question 25
A development team needs to trace a slow web request through their application, identify which dependency call caused the delay, and see the exception that followed. Which Azure Monitor capability should they use?
A. Application Insights B. Azure Service Health C. Azure Advisor D. Azure Policy
Answer: A
Application Insights is the application performance monitoring feature of Azure Monitor, and it captures request telemetry, dependency timings and exceptions, which is exactly the chain the team needs to follow. Azure Service Health covers platform incidents rather than application code. Azure Advisor issues configuration recommendations. Azure Policy governs resource configuration and collects no application telemetry.
What your score means
Score one point per question, then compare against this table. These bands are a readiness indicator based on the pass threshold, not a prediction of your scaled exam score.
| Score out of 25 | Percentage | What it suggests |
|---|---|---|
| 22 to 25 | 88% and above | Exam-ready on knowledge. Book the exam and spend your remaining time on the Microsoft practice assessment for question wording. |
| 19 to 21 | 76% to 84% | Close. Identify which of the three domains lost you points and revise that one rather than restarting the syllabus. |
| 15 to 18 | 60% to 72% | Borderline. You recognise the service names but not the selection logic. More scenario questions, not more reading. |
| Below 15 | Under 60% | Not ready. Work back through the objectives for your two weakest domains before testing again. |
Read the pattern rather than the total. Losing four points spread evenly across three domains means something different from losing four points all in Azure architecture and services, which is the largest section of the exam at 35 to 40%.
What changed in the July 2026 objectives update
Microsoft last revised the AZ-900 skills measured on 20 July 2026. The change log lists three minor revisions, all within existing sections rather than new ones: Azure compute and networking services, features and tools for managing and deploying Azure resources, and monitoring tools in Azure.
The three domain groups and their weightings did not move. Cloud concepts remains 25 to 30%, Azure architecture and services remains 35 to 40%, and Azure management and governance remains 30 to 35%.
That stability matters when you choose study material. A practice set written against the previous version is still largely valid for AZ-900, unlike the situation candidates face on exams that get restructured. What ages badly is material predating the Microsoft Entra ID rename, since questions still calling it Azure Active Directory will not match the wording you see on screen.
If you want the full revision schedule rather than a question set, our 4-week AZ-900 study plan breaks the objectives into daily sessions.
Frequently Asked Questions
How many questions are on the AZ-900 exam?
Microsoft does not publish a fixed question count for AZ-900, and the number varies by exam form. What is published is the time limit of 45 minutes. Plan your pacing against the clock rather than a question count you cannot rely on, and use the exam sandbox on Microsoft Learn to see the interface before exam day.
What is a passing score for AZ-900?
You need a score of 700 or greater. Microsoft scores on a scale rather than as a straight percentage, so 700 does not mean 70% of questions answered correctly, and there is no published raw-score equivalent. Aiming for 85% or better on quality practice material gives you a sensible margin.
Is AZ-900 hard?
AZ-900 is a fundamentals certification and it is the easiest of Microsoft's Azure exams, but candidates still fail it by treating it as a vocabulary test. The questions describe a business situation and ask which service fits, and the distractors are usually real Azure services that solve an adjacent problem. Knowing that Azure Advisor exists is not the same as knowing when it is the right answer instead of Azure Monitor.
Are AZ-900 practice tests enough to pass?
Practice tests diagnose readiness, they do not create it. Used well, they show you which of the three domains is costing you points so you can revise selectively instead of rereading everything. Candidates who only drill questions tend to recognise items they have seen before and stall on unfamiliar phrasings of the same concept, which is why reading the reasoning behind every distractor matters more than the raw score.
Does the AZ-900 certification expire?
No. Microsoft states that fundamentals certifications do not expire, so once you hold Azure Fundamentals it is yours permanently with no annual renewal assessment. That is different from associate, expert and specialty certifications such as AZ-104, which require a free online renewal assessment each year before they lapse.
Can I retake AZ-900 if I fail?
Yes. Microsoft allows a retake 24 hours after a first failed attempt, and the waiting period lengthens for subsequent attempts. Use that first 24 hours to work through the score report by skill area rather than rebooking immediately, because the report tells you which of the three domains pulled you under 700.
Ready to Start Practising?
Twenty-five questions tell you where you stand today. They do not tell you whether you can hold that standard across a full exam form under a 45-minute clock, which is the actual test.
CertCrush's AZ-900 course gives you a full question bank with the same explanation depth used above, mapped to the July 2026 objectives, plus timed mock exams that mirror the live format. You can see which domain is costing you points and drill it specifically instead of rereading material you already know.
Create a free account and take your first timed AZ-900 practice exam today.