AZ-900 Azure architecture and services practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

AZ-900 Describe Azure architecture and services: 456 practice questions

AZ-900 456 questions 12 shown free

12 of the 456 Describe Azure architecture and services questions in the Certsqill AZ-900 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for AZ-900? Take the free 5-min readiness check →

1. Microsoft Entra ID: Which Azure service meets this requirement?

Easy
A logistics company needs a cloud directory for identities, authentication, and single sign-on across supported applications. Which Azure service meets this requirement?
  1. Azure Storage account
    A storage account provides namespaces and settings for storage services, not a general-purpose cloud identity directory.
  2. Microsoft Entra ID ✓
    Microsoft Entra ID is Azure’s cloud identity and access directory for authentication and access to applications.
  3. Azure Resource Manager
    Azure Resource Manager organizes and deploys Azure resources; it is not the cloud directory for user identities.
  4. Microsoft Entra Domain Services
    Microsoft Entra Domain Services supplies managed domain capabilities such as LDAP, Kerberos, and domain join.
The trap
Storage authorization is not the same as managing organizational identities. Resource organization does not provide directory authentication or application sign-in. Managed domain services differ from the primary cloud identity directory.

Microsoft Entra ID provides cloud identities, authentication, and single sign-on for supported applications.

2. Access tiers can balance storage cost against access: Select TWO statements that accurately describe suitable

Medium
A consulting business will store documents as objects in Azure Blob Storage. Select TWO statements that accurately describe suitable capabilities or considerations.

Select two. More than one option is correct — every correct one is ticked below.

  1. Archive objects are immediately readable without rehydration
    Archive storage is offline and requires rehydration before data can be read normally.
  2. Access tiers can balance storage cost against access frequency ✓
    Hot, cool, cold, and archive tiers support different access patterns, with archive requiring rehydration before reading.
  3. LRS automatically copies every object to another region
    LRS keeps copies within one physical location in the primary region and does not provide cross-region replication.
  4. Blob Storage stores unstructured objects such as documents ✓
    Blob Storage is designed for object data, including documents, media, backups, and other unstructured content.
  5. Azure Files provides the same object-storage interface for blobs
    Azure Files provides managed file shares, while Blob Storage exposes object storage with different access patterns.
The trap
Local redundancy does not mean geographic replication. Offline archive access requires a restoration or rehydration step. Managed file shares and object storage use different service models.

Blob Storage holds objects, while access tiers trade storage cost against retrieval patterns and availability.

3. Configure a network interface and suitable access: Which complementary step is required?

Medium
A small retailer chooses an Azure virtual machine for a customer-facing web application. The application must be reachable through an appropriate network path. Which complementary step is required?
  1. Configure a network interface and suitable access. ✓
    A VM requires a network interface and appropriate private or public network access for its intended connectivity.
  2. Create an Entra ID group for application users.
    An Entra ID group organizes identities and permissions, but it does not provide network reachability to the VM.
  3. Create a second VM image.
    A second image can support deployment or recovery, but it does not establish network connectivity to the running VM.
  4. Register a DNS name without configuring network connectivity.
    DNS can resolve a name, but it cannot connect customers to a VM without suitable networking and access controls.
The trap
Confuses deployment artifacts with network connectivity. Confuses identity management with application networking. Assumes name resolution creates a network path.

A VM application needs a network interface and suitable network configuration for its intended connectivity.

4. A geography can contain regions: Which statement is accurate?

Medium
A regional clinic must choose an Azure deployment location while keeping patient data within a specified geographic area. It is comparing an Azure region with a geography. Which statement is accurate?
  1. A region is broader than a geography and defines the wider data-residency boundary for its resources.
    A region is a deployment area, whereas a geography can group regions and represent broader residency boundaries.
  2. A geography is a single Azure datacenter.
    A geography is broader than a datacenter and can contain multiple Azure regions.
  3. A region is a billing and management boundary for subscriptions.
    A subscription is a billing and management boundary; a region is a deployment area containing datacenters.
  4. A geography can contain regions. ✓
    An Azure geography can contain multiple regions and can represent broader data-residency boundaries.
The trap
Confuses a geography with a physical facility. Confuses regions with subscriptions. Reverses the relationship between regions and geographies.

A geography can contain multiple Azure regions and represent broader data-residency boundaries.

5. Operate the managed domain infrastructure: Which responsibility belongs to Microsoft?

Medium
A research organization uses Microsoft Entra Domain Services for legacy applications requiring domain join and LDAP. Which responsibility belongs to Microsoft?
  1. Deploy customer-managed domain controllers in virtual machines.
    Deploying and managing domain controllers in virtual machines is the traditional customer-managed approach, not the managed service model.
  2. Administer only cloud identities in Microsoft Entra ID.
    Microsoft Entra ID provides cloud identity capabilities, but this does not identify Microsoft’s responsibility for operating the managed domain.
  3. Configure legacy applications and their access to the managed domain.
    The organization configures applications and access; Microsoft operates the underlying managed domain infrastructure.
  4. Operate the managed domain infrastructure. ✓
    Microsoft operates the managed domain infrastructure, while the organization configures dependent applications, identities, and access.
The trap
Replaces the managed service with customer infrastructure. Confuses directory identity administration with managed domain operation. Assigns customer configuration duties to Microsoft.

Microsoft operates the managed domain infrastructure; the customer configures applications and access.

6. Azure Files shared storage: Which Azure service fits this requirement?

Easy
A financial services company needs several Azure virtual machines to access the same managed SMB file share. Which Azure service fits this requirement?
  1. Azure Queue Storage
    Queue Storage holds asynchronous messages; it does not present a shared SMB file system to virtual machines.
  2. Azure Blob Storage with an archive access tier
    Blob Storage stores objects, while archive is intended for offline data needing rehydration before reading.
  3. Azure Files shared storage ✓
    Azure Files provides managed file shares that supported clients can access through standard file-sharing protocols.
  4. Azure managed disks
    Managed disks provide block storage for virtual machines, rather than a shared managed file share.
The trap
Confuses message storage with shared file storage. Confuses object storage and archive retrieval with SMB access. Confuses VM-attached disks with file shares.

Azure Files provides managed shared file shares that multiple virtual machines can access.

7. Starts function execution when its configured event occurs: What does the trigger primarily do?

Medium
An internal development team configures an Azure Function with an event trigger. What does the trigger primarily do?
  1. Keeps a virtual machine running continuously for the application.
    A virtual machine provides persistent compute, but an event trigger does not create or maintain one.
  2. Publishes a public website with built-in domain registration.
    App Service can host websites, while Azure DNS manages records and neither automatically registers domains.
  3. Starts function execution when its configured event occurs. ✓
    An event trigger causes the function to run when the associated event is detected.
  4. Creates a private network connection between the function and every dependent service.
    Networking requires suitable virtual network integration and service configuration; triggers do not create universal private connectivity.
The trap
Assumes triggers automatically establish private network connectivity. Confuses event-driven execution with persistent virtual-machine hosting. Confuses Functions with web hosting and domain registration.

An event trigger starts a Function when its configured event occurs.

8. Place redundant resources in separate availability zones: Which approach meets the requirement?

Hard
A manufacturing company must keep an application available when one datacenter location fails, but it must remain within one Azure region. Which approach meets the requirement?
  1. Place redundant resources in separate availability zones within the same region. ✓
    Availability zones are separate physical locations within a region, helping isolate failures of power, cooling, or networking.
  2. Use one availability zone.
    One zone leaves the application dependent on the physical location that contains that zone.
  3. Deploy redundant resources across multiple regions and configure regional failover.
    Multiple regions can address regional failures, but this approach violates the requirement to remain within one region.
  4. Deploy the application in a paired region.
    A paired region is outside the stated single-region constraint and requires configured multi-region resilience.
The trap
Provides no redundancy across physical locations. Violates the requirement to remain within one region. Solves a broader failure while violating the geographic constraint.

Availability zones provide physical-location separation while keeping resources within one Azure region.

9. Microsoft Entra ID authentication: Which capability addresses this requirement?

Medium
A remote workforce needs employees to prove who they are before accessing company applications. Which capability addresses this requirement?
  1. Azure RBAC
    Azure RBAC authorizes actions on Azure resources after an identity has been established.
  2. Microsoft Entra ID authorization through resource scopes
    Authorization determines permitted actions or resources; it does not establish who the user is.
  3. Conditional Access policy evaluation
    Conditional Access evaluates identity and context signals to apply controls after initial authentication.
  4. Microsoft Entra ID authentication ✓
    Authentication verifies the identity of a person or workload before access decisions are applied.
The trap
Uses an access decision for an identity-verification task. Confuses post-authentication controls with identity proof. Confuses permission assignment with identity verification.

Authentication verifies identity; authorization and Conditional Access determine permitted access afterward.

10. Azure managed disks for VM block storage: Which service is most suitable?

Medium
A software startup runs Azure virtual machines and wants OS and data storage without operating storage hardware. Which service is most suitable?
  1. Azure Queue Storage for asynchronous messages
    Queue Storage stores asynchronous messages and cannot serve as a virtual machine operating-system or data disk.
  2. Azure Blob Storage
    Blob Storage provides object storage, which uses a different access model from virtual machine block disks.
  3. Azure Files for managed shared file storage
    Azure Files provides managed file shares, not the block storage interface normally used for VM operating-system and data disks.
  4. Azure managed disks for VM block storage ✓
    Managed disks provide block storage for virtual machines while Azure manages the underlying storage infrastructure.
The trap
This confuses objects with directly attached VM storage. This confuses message queues with block storage. This confuses shared files with VM block devices.

Managed disks provide VM block storage while Azure operates the underlying storage infrastructure.

11. Azure App Service: Which Azure service is appropriate?

Medium
An online training provider wants to host a web application without managing the operating system or virtual-machine patching. Which Azure service is appropriate?
  1. Azure Container Instances running a custom web container
    Container Instances run containers, but the customer still manages the application image and its dependencies.
  2. Azure Functions
    Functions is intended for event-driven serverless code, whereas this requirement describes managed web application hosting.
  3. Azure virtual machines
    Virtual machines provide broad control, but the customer remains responsible for guest operating-system maintenance.
  4. Azure App Service ✓
    App Service provides managed hosting for web applications and APIs without requiring customers to manage the underlying operating system.
The trap
Confuses event-driven functions with continuous web hosting. Chooses infrastructure requiring guest OS administration. Treats container execution as equivalent to managed web hosting.

App Service hosts web applications while Azure manages the underlying platform and operating system.

12. Availability zones are distinct physical locations within: Which TWO statements are accurate?

Easy
A university is reviewing Azure’s physical organization and wants to understand failure isolation. Which TWO statements are accurate? Select TWO.

Select two. More than one option is correct — every correct one is ticked below.

  1. Availability zones are distinct physical locations within a region. ✓
    Availability zones provide separate physical locations with independent power, cooling, and networking within supported regions.
  2. A subscription represents one physical Azure datacenter.
    A subscription is a billing and management boundary, not a physical datacenter or geographic deployment location.
  3. An Azure region consists of datacenters within a geographic area. ✓
    An Azure region is a geographic area containing datacenters connected through Azure infrastructure.
  4. A resource group can contain resources from only one Azure region.
    A resource group can contain resources located in different regions, although its metadata has a region.
  5. Using paired regions automatically replicates every resource between them.
    Region pairing does not automatically replicate every resource; services require their own configured resilience mechanisms.
The trap
Confuses administrative scope with physical infrastructure. Confuses resource-group metadata with resource-location restrictions. Assumes region pairing provides universal automatic replication.

Regions group datacenters geographically, while availability zones separate physical locations within a region.

444 more Describe Azure architecture and services questions

The remaining 444 questions in this domain are part of the full AZ-900 bank — 1200 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your AZ-900 readiness — free

Other AZ-900 domains

Part of the Certsqill AZ-900 question bank · Describe Azure architecture and services · Every answer, right and wrong, comes with its own explanation.