AZ-900 Azure architecture and services practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About

Language

✓ EnglishDeutschEspañolFrançaisPortuguês
Check readiness — free →

AZ-900 Describe Azure architecture and services: 237 practice questions

AZ-900 237 questions 12 shown free

12 of the 237 Describe Azure architecture and services questions in the Certsqill AZ-900 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for AZ-900? Take the free 5-min readiness check →

1. Availability Zones: Which Azure feature should they use?

Medium
A company deploys a web application to Azure and needs to ensure it remains available even if a single Azure datacenter in the primary region experiences an outage. The company cannot replicate data outside of the primary region due to data sovereignty requirements. Which Azure feature should they use?
  1. Availability Zones ✓
    Correct. Availability Zones are physically separate datacenters within the same Azure region, each with independent power, cooling, and networking. Deploying across AZs protects against single-datacenter failures while keeping all data within the primary region.
  2. Region pairs
    Incorrect. Region pairs replicate data to a different geographic region, which would violate the data sovereignty requirement to keep data within the primary region.
  3. Availability Sets
    Incorrect. Availability Sets group VMs within a single datacenter to protect against rack-level hardware failures. They do NOT protect against an entire datacenter failure.
  4. Azure Virtual Machine Scale Sets
    Incorrect. VM Scale Sets provide automatic scaling of VM instances but do not inherently protect against datacenter-level failures unless combined with zone-aware configuration.
The trap
Choosing region pairs for HA when data sovereignty prohibits cross-region replication — Availability Zones provide intra-region datacenter-level protection.

Availability Zones protect against single-datacenter failures while keeping data within the primary region — satisfying both the HA and data sovereignty requirements.

2. All resources in all three subscriptions: Which resources are affected by this policy?

Medium
A company has three subscriptions under a single management group. An IT administrator applies an Azure Policy to the management group that requires all resources to have a specific tag. Which resources are affected by this policy?
  1. Only resources in the management group's default subscription, but not resources located in the child subscriptions
    Incorrect. Management groups do not have a 'default subscription.' Policies inherit to all subscriptions within the group.
  2. All resources in all three subscriptions, because a management group policy is inherited by each subscription and resource within ✓
    Correct. Governance conditions like policies applied to a management group automatically inherit down to all subscriptions, resource groups, and resources within it.
  3. Only resources created after the policy is applied, because pre-existing resources in the group are never evaluated or affected by it
    Incorrect. Azure Policy affects existing resources (flagged as non-compliant) and new resources (denied or flagged at creation). It applies to all resources, not just new ones.
  4. Only the subscriptions themselves, because resource groups and individual resources are not subject to these policies
    Incorrect. Policy inheritance flows through the entire hierarchy: management group, subscriptions, resource groups, and resources. Resources at all levels are subject to the policy.
The trap
Assuming policies only apply to newly created resources — Azure Policy evaluates existing resources too and flags them as non-compliant.

Policies applied to a management group inherit to all subscriptions, resource groups, and resources within it — all resources in all three subscriptions are affected.

3. Azure Container Instances: Which Azure service best meets their needs?

Medium
A team has a containerized application that needs to run on demand for batch processing jobs. They do not want to manage virtual machines or a container orchestration cluster. Which Azure service best meets their needs?
  1. Azure Kubernetes Service (AKS), a managed cluster for orchestrating many containers that requires node and upgrade management
    Incorrect. AKS is a managed Kubernetes cluster for orchestrating containers at scale and requires cluster management (node pools, networking, upgrades), more than needed for simple on-demand batch jobs.
  2. Azure Virtual Machines, IaaS compute that can run containers but requires you to manage the guest OS yourself
    Incorrect. VMs are IaaS and require OS management, which the requirement to avoid managing virtual machines explicitly excludes.
  3. Azure Container Instances (ACI), a service that runs containers on demand without managing VMs or an orchestrator ✓
    Correct. Azure Container Instances runs containers directly in Azure without managing VMs or an orchestration platform, ideal for simple on-demand containerized workloads like batch processing.
  4. Azure App Service, a managed platform optimized for continuously available web apps rather than on-demand batch runs
    Incorrect. Azure App Service can run containers but is optimized for continuously available web apps and APIs, not simple on-demand batch container runs.
The trap
Choosing AKS because it is 'managed' — AKS still requires cluster management; ACI requires zero infrastructure management.

Azure Container Instances lets you run containers on demand without managing VMs or orchestration clusters — ideal for on-demand batch processing.

4. Rack-level hardware failures and planned maintenance: What does this configuration protect against?

Medium
A company deploys two virtual machines as an Availability Set in Azure. What does this configuration protect against?
  1. A full Azure regional outage that affects every service running in the primary region simultaneously
    Incorrect. Regional outages are addressed by region pairs or geo-redundant replication. Availability Sets are scoped to a single datacenter within a region.
  2. Network latency between two virtual machines by placing them on the same shared physical host
    Incorrect. Availability Sets spread VMs across different fault and update domains, intentionally placing them on different hardware rather than the same host.
  3. An entire Azure datacenter going offline and taking all of its hosted resources down with it
    Incorrect. Availability Sets operate within a single datacenter. If the whole datacenter fails, they do not help; use Availability Zones for datacenter-level fault tolerance.
  4. Rack-level hardware failures and planned maintenance reboots within a single Azure datacenter ✓
    Correct. Availability Sets use fault domains (separate power and network racks) and update domains (sequential reboot groups), so both VMs are not taken down together by a rack failure or maintenance event in the same datacenter.
The trap
Thinking Availability Sets protect against datacenter failures — they only protect against rack-level failures and maintenance events within ONE datacenter.

Availability Sets protect against rack-level hardware failures and unplanned outages from planned maintenance within a single datacenter, using fault domains and update domains.

5. The application goes offline because Availability Sets do: What happens to the application?

Hard
A company has two virtual machines in an Availability Set in an Azure region that does not support Availability Zones. One morning, the entire Azure datacenter hosting both VMs goes offline due to a power failure. What happens to the application?
  1. The application goes offline because Availability Sets do not protect against datacenter-level failures ✓
    Correct. Availability Sets protect against rack-level failures and planned maintenance reboots within a single datacenter. Both VMs are still in the same datacenter. A full datacenter power failure takes down both VMs regardless of their Availability Set configuration.
  2. One VM automatically fails over to the paired Azure region to maintain availability
    Incorrect. Availability Sets have no automatic geo-failover capability. They do not replicate VMs to other regions. Geographic failover requires separate configuration such as Azure Site Recovery.
  3. The application continues to run because one fault domain in the Availability Set is in a different datacenter
    Incorrect. Fault domains in an Availability Set are different hardware racks within the SAME datacenter — not different datacenters. All fault domains share the same physical datacenter.
  4. Azure automatically restores the VMs from a datacenter backup within minutes
    Incorrect. Azure does not automatically restore customer VMs from backups upon datacenter failure. Backup restoration is a manual or customer-configured process and does not provide automatic failover.
The trap
Assuming Availability Sets provide datacenter-level protection — they only protect against rack failures within ONE datacenter.

Availability Sets protect within one datacenter — a full datacenter outage takes down all VMs in the set. Availability Zones are needed for datacenter-level fault tolerance.

6. Azure ExpressRoute: Which Azure connectivity option meets this requirement?

Medium
A financial institution is connecting its on-premises headquarters to Azure. Due to regulatory requirements, all network traffic between the headquarters and Azure must travel over a private connection that does not use the public internet. Which Azure connectivity option meets this requirement?
  1. Azure VPN Gateway with a Point-to-Site VPN
    Incorrect. Point-to-Site VPN connects individual client devices to Azure over the public internet using an encrypted tunnel — still traverses the public internet and violates the requirement.
  2. Azure ExpressRoute ✓
    Correct. ExpressRoute provides a private, dedicated connection between on-premises infrastructure and Azure through a connectivity provider. Traffic does not traverse the public internet, providing higher reliability, faster speeds, and consistent latencies.
  3. Azure VPN Gateway with a Site-to-Site VPN
    Incorrect. A Site-to-Site VPN uses an encrypted tunnel over the public internet. Even though the tunnel is encrypted, the traffic still traverses the public internet, which violates the regulatory requirement.
  4. Azure Virtual Network Peering
    Incorrect. VNet Peering connects two Azure VNets together within Azure. It does not connect on-premises networks to Azure.
The trap
Believing VPN = private because it is encrypted — VPN traffic is encrypted but still traverses the public internet; ExpressRoute is truly private.

ExpressRoute provides a private connection between on-premises and Azure that does not traverse the public internet — the only option meeting the regulatory requirement.

7. Azure VPN Gateway with a Site-to-Site VPN: Which connection type should they use?

Hard
A retail company needs to connect its on-premises datacenter to Azure. The connection must provide consistent, predictable latency for a database synchronization workload. The company has a limited budget and accepts that traffic will travel over the public internet as long as it is encrypted. Which connection type should they use?
  1. Azure ExpressRoute Global Reach, an add-on that connects multiple on-premises sites through existing ExpressRoute circuits
    Incorrect. ExpressRoute Global Reach connects on-premises locations to each other through the Azure network and requires existing ExpressRoute circuits, so it is neither stand-alone nor budget-friendly.
  2. Azure ExpressRoute, a private dedicated circuit offering consistent latency but at a significantly higher cost
    Incorrect. ExpressRoute provides private, consistent latency but at significantly higher cost due to dedicated circuits. The company explicitly has a limited budget, so ExpressRoute is not cost-appropriate.
  3. Azure VPN Gateway with a Site-to-Site VPN, an encrypted tunnel over the public internet that suits a limited budget ✓
    Correct. A Site-to-Site VPN provides an encrypted connection over the public internet, meeting the encryption and budget requirements. Latency varies over the internet, but it is the appropriate low-cost choice when internet transit is accepted.
  4. Azure Virtual Network Peering, which links two Azure VNets and provides no on-premises connectivity at all
    Incorrect. VNet Peering connects two Azure VNets and does not provide on-premises to Azure connectivity.
The trap
Selecting ExpressRoute for 'consistent latency' without noting the company also accepts internet transit and has limited budget — all constraints matter.

VPN Gateway is the correct choice when the company accepts internet transit (with encryption) and has a limited budget; ExpressRoute provides consistent latency at higher cost.

8. Azure Blob Storage: Which Azure storage service is designed for storing large amounts of unstructured data suc

Easy
Which Azure storage service is designed for storing large amounts of unstructured data such as images, videos, log files, and backups?
  1. Azure Queue Storage
    Incorrect. Azure Queue Storage stores messages for asynchronous processing between application components. It is not designed for storing files, images, or unstructured binary data.
  2. Azure Table Storage
    Incorrect. Azure Table Storage is a NoSQL key-attribute store for structured, non-relational data — not for unstructured binary objects like images or videos.
  3. Azure Files
    Incorrect. Azure Files provides managed file shares accessible via SMB or NFS protocols — it is designed for file-sharing scenarios, not large-scale unstructured object storage.
  4. Azure Blob Storage ✓
    Correct. Azure Blob Storage is optimized for storing massive amounts of unstructured data — data that does not fit a relational or hierarchical model — including text, binary data, images, videos, backups, and log files.
The trap
Choosing Azure Files because it stores 'files' — Azure Files is for SMB/NFS file shares; Blob Storage is for unstructured object data at scale.

Azure Blob Storage is the service for unstructured data — images, videos, backups, and log files at any scale.

9. Azure Files: Which Azure storage service should they use?

Medium
A company has a legacy Windows application that reads and writes files using the SMB protocol. The company wants to move this file storage to Azure without modifying the application. Which Azure storage service should they use?
  1. Azure Files ✓
    Correct. Azure Files supports the SMB protocol and can be mounted as a network drive by Windows (and Linux/macOS) systems. Legacy applications using SMB can access Azure Files without any code changes.
  2. Azure Queue Storage
    Incorrect. Azure Queue Storage handles asynchronous message queuing. It does not store or serve files via SMB protocol.
  3. Azure Blob Storage
    Incorrect. Azure Blob Storage does not natively support the SMB protocol. Applications must be modified to use REST APIs or Azure SDK to access Blob Storage — violating the no-modification requirement.
  4. Azure Disk Storage
    Incorrect. Azure Disk Storage provides block-level volumes for Azure VMs. It is not a file-sharing service accessible via SMB from multiple clients simultaneously.
The trap
Choosing Blob Storage because it stores 'files' — Blob uses REST API access, not SMB; Azure Files is the SMB-compatible service.

Azure Files supports SMB protocol, allowing legacy Windows applications to access cloud file storage without modification.

10. The Archive tier: Which blob access tier should they use?

Medium
A company stores regulatory compliance documents in Azure Blob Storage. These documents are accessed less than once per year for audits, but must be retained for seven years. The company wants to minimize storage costs. Which blob access tier should they use?
  1. The Cold tier, which lowers storage cost below Cool but stays higher than Archive for rarely accessed data
    Incorrect. The Cold tier (90-day minimum) costs less than Cool but more than Archive. For data accessed less than once a year, Archive provides the lowest storage cost.
  2. The Archive tier, the lowest-cost option for rarely accessed data that tolerates hours of retrieval latency ✓
    Correct. The Archive tier has the lowest storage cost and targets rarely accessed data with retrieval latency of hours. For documents accessed less than once a year, its low storage cost outweighs the higher retrieval cost.
  3. The Cool tier, designed for infrequently accessed data with a 30-day minimum but higher storage cost than Archive
    Incorrect. The Cool tier (30-day minimum) is for infrequently accessed data, not data touched less than once a year. Archive provides even lower storage cost for this pattern.
  4. The Hot tier, optimized for frequently accessed data and carrying the highest per-gigabyte storage cost
    Incorrect. The Hot tier has the highest storage cost and targets frequently accessed data, so it is not appropriate when minimizing cost for rarely accessed data.
The trap
Choosing Cold or Cool instead of Archive for data accessed less than once per year — Archive has the lowest storage cost for near-zero access frequency.

The Archive tier has the lowest storage cost for rarely accessed data — perfect for compliance documents accessed less than once per year.

11. The download will fail because data in the Archive tier: What will happen?

Hard
A company stores backup files in the Archive access tier within an Azure Blob Storage account. An administrator receives an urgent request to retrieve one of these files immediately. The administrator tries to download the file from the Azure portal. What will happen?
  1. The download will succeed immediately because the Archive tier is simply a cost-saving setting that does not affect read performance
    Incorrect. The Archive tier stores data offline. It is not immediately readable. This is one of the most important characteristics of the Archive tier.
  2. The download will succeed immediately but at a significantly higher cost than reading from the Hot tier
    Incorrect. Immediate access is not possible from the Archive tier regardless of cost. The data must be rehydrated first before it can be read.
  3. The download will fail because data in the Archive tier must first be rehydrated to the Hot or Cool tier, which can take hours ✓
    Correct. Data in the Archive tier is stored offline and cannot be read directly. To access it, the blob must first be rehydrated (changed to Hot or Cool tier), a process that can take up to 15 hours for standard priority or as little as 1 hour for high priority.
  4. The system will automatically move the file to the Hot tier before the download starts, without any delay
    Incorrect. Azure does not automatically rehydrate archived blobs upon access. Rehydration must be explicitly initiated by the user and takes hours to complete.
The trap
Thinking Archive tier is like Cool/Cold but cheaper — Archive stores data offline and cannot be read without an explicit rehydration step taking hours.

Archive tier data cannot be read immediately — it must first be rehydrated to Hot or Cool, which takes up to several hours.

12. Read-access geo-redundant storage: Which storage redundancy option should they choose?

Medium
A company needs their Azure storage data to be automatically replicated to a secondary Azure region. During a primary region failure, the company requires read access to the secondary region's data before any failover is initiated. Which storage redundancy option should they choose?
  1. Geo-redundant storage (GRS), which copies data to a secondary region that is not readable until failover
    Incorrect. GRS replicates to a secondary region, but that region is not readable by default; secondary data becomes accessible only after a failover, not before.
  2. Geo-zone-redundant storage (GZRS), combining zone redundancy locally with a secondary region not readable by default
    Incorrect. GZRS provides ZRS in the primary region and LRS in the secondary. Like GRS, the secondary is not readable by default unless RA-GZRS is used.
  3. Zone-redundant storage (ZRS), which replicates only across Availability Zones within the single primary region
    Incorrect. ZRS replicates across Availability Zones within the primary region only. It does not replicate to a secondary region, so it offers no protection against regional failure.
  4. Read-access geo-redundant storage (RA-GRS), replicating to a secondary region that stays readable at all times ✓
    Correct. RA-GRS replicates data to a secondary region and keeps that region's data available for read access at all times, even before any failover.
The trap
Choosing GRS because it replicates cross-region — GRS secondary is NOT readable before failover; RA-GRS is required for pre-failover secondary reads.

RA-GRS provides cross-region replication AND makes the secondary region readable before any failover — GRS replicates but does not allow secondary reads before failover.

225 more Describe Azure architecture and services questions

The remaining 225 questions in this domain are part of the full AZ-900 bank — 485 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your AZ-900 readiness — free

Other AZ-900 domains

Part of the Certsqill AZ-900 question bank · Describe Azure architecture and services · Every answer, right and wrong, comes with its own explanation.