AZ-900 Describe cloud concepts: 94 practice questions

12 of the 94 Describe cloud concepts questions in the Certsqill AZ-900 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for AZ-900? Take the free 5-min readiness check →

1. The data stored in the application and the accounts: Which responsibility does your organization ALWAYS retain

1. The data stored in the application and the accounts that access it ✓

   Correct. Regardless of whether the service is IaaS, PaaS, or SaaS, the customer always retains responsibility for their data and the identities/accounts that access it. Microsoft never takes ownership of customer data.
2. Managing network infrastructure components such as routers and switches

   Incorrect. Network infrastructure (physical networking, routers, switches in the datacenter) is always Microsoft's responsibility in Azure.
3. Patching and updating the underlying operating system

   Incorrect. In SaaS, the provider manages the OS. In PaaS, the provider also manages the OS. Only in IaaS does the customer manage the OS.
4. The physical security of the datacenter where the servers are located

   Incorrect. Physical datacenter security is always Microsoft's responsibility in Azure, across all service types (IaaS, PaaS, SaaS).

The customer always retains responsibility for their data and access accounts — this is true across IaaS, PaaS, and SaaS.

2. The company, because Azure virtual machines are an IaaS: Who is responsible for patching the operating system

1. A shared responsibility, because Microsoft patches the OS kernel while the company handles application updates

   Incorrect. OS patching responsibility does not split at the kernel level. In IaaS, the entire guest OS, including kernel updates, is the customer's responsibility.
2. The company, because Azure virtual machines are an IaaS offering where the customer manages the guest OS ✓

   Correct. Azure VMs are an IaaS service. Microsoft manages the physical hardware, network, and hypervisor, but the customer is responsible for the guest OS, runtime, middleware, applications, and data.
3. Microsoft, because operating system patching in Azure is always handled automatically by the platform

   Incorrect. Microsoft manages the host OS (hypervisor layer), not the guest OS inside customer VMs. In IaaS the customer must patch and maintain the guest OS; Azure Update Manager can assist but must be configured by the customer.
4. Microsoft, because the provider is responsible for all infrastructure layers in every cloud service model

   Incorrect. The Shared Responsibility Model varies by service type. In IaaS the customer takes on more responsibility than in PaaS or SaaS, including the guest OS.

Azure VMs are IaaS. In IaaS, the customer manages the guest operating system, including security patching.

3. The information and data stored in the cloud: In the Microsoft Azure Shared Responsibility Model, which TWO re

Select two. More than one option is correct — every correct one is ticked below.

1. The information and data stored in the cloud ✓

   Correct. Customer data is always the customer's responsibility across all cloud service types.
2. Devices that are allowed to connect to the cloud service (mobile devices, PCs) ✓

   Correct. End-user devices that connect to cloud services are always the customer's responsibility. Microsoft does not manage customer endpoint devices.
3. The underlying compute and network hardware

   Incorrect. Physical compute and network hardware is always Microsoft's responsibility in Azure.
4. Physical security of the datacenter

   Incorrect. Physical datacenter security is always Microsoft's responsibility in Azure, across all service types.

The customer always retains responsibility for their data and for the end-user devices connecting to the service — these never transfer to the cloud provider.

4. Hybrid cloud: Which cloud deployment model allows them to meet both requirements?

1. Multi-cloud

   Incorrect. Multi-cloud refers to using services from multiple public cloud providers. It does not address keeping data on-premises — it would still move the data to one or more public clouds.
2. Public cloud

   Incorrect. A public cloud would require moving all workloads to Azure, which conflicts with the data residency requirement to keep customer records on-premises.
3. Private cloud

   Incorrect. A private cloud (hosted on-premises or by a dedicated provider) would not solve the capacity problem — the company still cannot get elastic scale beyond their physical hardware without connecting to a public cloud.
4. Hybrid cloud ✓

   Correct. A hybrid cloud connects on-premises infrastructure with cloud resources. The company can store sensitive data on-premises (meeting data residency requirements) while bursting to Azure for additional compute during peak periods.

Hybrid cloud connects on-premises and public cloud environments, enabling data residency compliance on-prem while bursting to the cloud for extra compute.

5. Capital expenditure: Purchasing the on-premises server hardware is classified as which type of expenditure?

1. Capital expenditure (CapEx) ✓

   Correct. Purchasing physical hardware such as servers is a Capital Expenditure (CapEx) — an upfront investment in physical infrastructure with costs spread over the asset's useful life through depreciation.
2. Consumption-based expenditure

   Incorrect. Consumption-based is the cloud billing model (pay for what you use), not a type of expenditure. The formal classification for hardware purchase is CapEx.
3. Operational expenditure (OpEx)

   Incorrect. OpEx refers to ongoing expenses for running a business, such as monthly cloud service subscriptions. Hardware purchases are CapEx, not OpEx.
4. Variable expenditure

   Incorrect. Variable expenditure is not a formal accounting classification in this context. Cloud computing is associated with a consumption-based model, but the formal contrast is CapEx vs OpEx.

Purchasing physical server hardware is a Capital Expenditure (CapEx) — an upfront investment. Cloud services are OpEx — ongoing operational costs.

6. Operational expenditure: How should this cost commitment be classified?

1. Capital expenditure (CapEx), because a multi-year commitment resembles a hardware depreciation schedule with owned assets

   Incorrect. The resemblance to a depreciation schedule is superficial. CapEx involves owning a depreciable asset; Reserved Instances only give committed pricing on a service with no asset to depreciate.
2. Operational expenditure (OpEx), because the company pays for a cloud service without owning any physical asset ✓

   Correct. Even though the company makes a long-term financial commitment, Reserved Instances are a cloud service with no physical asset purchased or owned, so it remains an OpEx model paying for compute capacity as a service.
3. Neither CapEx nor OpEx, because cloud reservations use a separate consumption-based accounting category entirely

   Incorrect. Consumption-based is a pricing model description, not a separate accounting category. Cloud expenses are classified as OpEx in standard accounting practice.
4. Capital expenditure (CapEx), because a large upfront payment creates a capitalized balance-sheet asset

   Incorrect. CapEx requires purchasing a capitalized asset. Paying upfront for a cloud service is a prepaid service expense, which is treated as OpEx, not a balance-sheet asset.

Reserved Instances are OpEx — the company pays for a cloud service at a discounted rate but never owns physical infrastructure.

7. Azure Functions: Which Azure service best meets these requirements?

1. Azure Virtual Machines, IaaS compute that runs continuously and can be scripted to watch a storage account for uploads

   Incorrect. Azure VMs run continuously and incur cost even when idle unless deallocated. They require OS management and do not trigger automatically from storage events.
2. Azure Container Instances, which run containers on demand and are started manually each time a new image is uploaded

   Incorrect. Azure Container Instances run containers on demand but are not event-driven by design and require explicit invocation; they do not auto-trigger from storage events the way Functions does.
3. Azure Functions, a serverless, event-driven compute service that runs code and charges only for actual execution time ✓

   Correct. Azure Functions is a serverless, event-driven compute service. It triggers automatically in response to events such as a new blob in storage and charges only for execution time, with no cost when idle.
4. Azure App Service, a managed platform for hosting web apps that stays running and can handle uploaded image processing

   Incorrect. Azure App Service is best for continuously hosting web apps and APIs on a plan that incurs cost while active, even when no requests are processed.

Azure Functions is the correct choice — it is serverless, event-driven, and charges only during execution, eliminating idle compute costs.

8. Ensuring services stay accessible with minimal downtime: What does high availability mean in the context of cl

1. Ensuring the cloud provider meets its contractual uptime commitments defined in a service agreement

   Incorrect. This describes a Service Level Agreement (SLA), a contract about uptime targets. High availability is the architectural design that enables that uptime.
2. Ensuring resources automatically scale out to handle sudden increases in application demand

   Incorrect. This describes scalability or elasticity, not high availability. Scaling handles capacity; HA handles fault tolerance.
3. Ensuring data is replicated across multiple geographic regions to support disaster recovery

   Incorrect. Cross-region replication describes geo-redundancy or disaster recovery. It can contribute to HA, but HA itself is about minimizing downtime from component failures, not geographic replication.
4. Ensuring services stay accessible with minimal downtime, even when individual components fail ✓

   Correct. High availability means designing systems to keep operating even when individual components fail, minimizing unplanned downtime.

High availability means designing systems to remain accessible with minimal downtime when components fail — it is about fault tolerance, not scaling or SLAs.

9. Governance: Which benefit of cloud computing allows an organization to enforce corporate standards across all

1. Governance ✓

   Correct. Governance is the cloud benefit that enables organizations to apply and enforce organizational standards, policies, and compliance controls across all cloud resources.
2. Reliability

   Incorrect. Reliability is the cloud benefit that ensures systems remain operational and recover from failures. It is about uptime and fault tolerance, not standards enforcement.
3. Agility

   Incorrect. Agility refers to the speed at which cloud resources can be provisioned and deployed — not policy or standard enforcement.
4. Manageability

   Incorrect. Manageability covers how you interact with and deploy cloud resources (templates, portal, CLI, monitoring). While related, Governance specifically addresses policy enforcement and compliance — not operational management tooling.

Governance enables organizations to enforce standards, policies, and compliance controls across cloud resources — distinct from Manageability (how you deploy/manage) and Reliability (uptime).

10. Platform as a Service: Which cloud service type best meets their requirements?

1. Function as a Service (FaaS), a serverless model that runs short-lived event-driven functions without OS management

   Incorrect. Azure Functions (FaaS) can run .NET code without OS management, but FaaS targets short-lived event-driven functions, not hosting a full web app with routing and state. The better fit here is PaaS.
2. Platform as a Service (PaaS), a managed platform where the provider handles the OS, patching, and infrastructure ✓

   Correct. PaaS such as Azure App Service provides a managed platform where the provider handles OS management, patching, and infrastructure, letting developers focus on application code and data.
3. Software as a Service (SaaS), fully managed applications consumed by users rather than hosting custom code

   Incorrect. SaaS provides finished applications like Microsoft 365. The team cannot deploy a custom .NET app as SaaS; SaaS is for consuming existing applications, not hosting custom code.
4. Infrastructure as a Service (IaaS), compute and storage where the customer still manages the OS, runtime, and patching

   Incorrect. IaaS such as Azure Virtual Machines requires the customer to manage the OS, patching, runtime, and middleware, which does not meet the requirement of avoiding OS management.

PaaS is the right choice — it provides a managed platform where developers deploy code without managing OS, patching, or server infrastructure.

11. Infrastructure as a Service: Which cloud service type gives the customer the MOST responsibility for managing

1. Software as a Service (SaaS), where the provider manages everything and users configure only data and access

   Incorrect. SaaS has the least customer responsibility. The provider manages everything from hardware to the application; the customer manages only data, access, and user configuration.
2. Function as a Service (FaaS), where the customer writes only function code and the provider manages all infrastructure

   Incorrect. FaaS (serverless, like Azure Functions) requires even less management than PaaS; the customer writes only function code while infrastructure, OS, and runtime are fully managed.
3. Infrastructure as a Service (IaaS), where the customer manages the guest OS, middleware, runtime, apps, and data ✓

   Correct. IaaS gives customers the most control and responsibility: the customer manages the guest OS, middleware, runtime, applications, and data, while the provider manages only hardware, network, and hypervisor.
4. Platform as a Service (PaaS), where the provider manages the OS, middleware, and runtime for the customer's application

   Incorrect. In PaaS the provider manages the OS, middleware, and runtime, and the customer manages only the application and data, which is less responsibility than IaaS.

IaaS gives the customer the most responsibility — they manage the OS, middleware, runtime, and applications. The provider only handles physical infrastructure.

12. The customer records stored in Azure SQL Database: Which TWO of the following are the CUSTOMER'S responsibilit

Select two. More than one option is correct — every correct one is ticked below.

1. Patching the operating system running beneath Azure App Service

   Incorrect. In PaaS, Microsoft manages the underlying OS, runtime, and platform. The customer does not have visibility into or responsibility for the OS beneath App Service.
2. The customer records stored in Azure SQL Database ✓

   Correct. In all cloud service types, the customer always owns and is responsible for their data. Microsoft never takes ownership of customer data, even in PaaS.
3. Physical security of the Azure datacenter where the application is hosted

   Incorrect. Physical datacenter security is always Microsoft's responsibility, across IaaS, PaaS, and SaaS.
4. The accounts and identities that access the application ✓

   Correct. Managing who has access — user accounts, identities, and access controls — is always the customer's responsibility, regardless of cloud service type.

In PaaS, the customer retains responsibility for their data and for managing identities — Microsoft manages OS, runtime, and physical infrastructure.

Other AZ-900 domains

• Describe Azure architecture and services — 237 questions →
• Describe Azure management and governance — 154 questions →
• All 485 AZ-900 questions →