AZ-900 Practice Test Bank: 200+ Questions

Section 1.1: Microsoft AZ-900 overview and certification value

Microsoft AZ-900, formally known as Microsoft Azure Fundamentals, is aimed at candidates who need to demonstrate basic cloud and Azure knowledge. This includes students, career changers, business stakeholders, sales professionals, project coordinators, and aspiring technical professionals. It is also useful for IT practitioners who work around cloud solutions but are not yet in hands-on Azure administration roles. On the exam, Microsoft is not asking whether you can deploy complex production environments. Instead, it is asking whether you understand what Azure is, what kinds of services it offers, and how cloud principles shape cost, scalability, governance, and responsibility.

The certification has practical value because it gives you a recognized baseline. Employers often view AZ-900 as evidence that you can speak the language of cloud computing and understand core Azure terminology. For technical candidates, it creates a stepping stone to role-based certifications. For nontechnical candidates, it helps interpret cloud-related decisions and vendor conversations. In exam terms, that means many questions focus on service purpose and category rather than configuration details. You may need to identify whether a solution is compute, storage, networking, identity, or governance related, and to choose the service that best fits the requirement at a high level.

A common misconception is that a fundamentals exam requires only memorization. In reality, AZ-900 rewards conceptual distinction. For example, the exam often tests whether you can separate broad cloud benefits from specific Azure products, or whether you can recognize when Microsoft manages more responsibility in PaaS or SaaS than in IaaS. If you approach the test as a list of flashcards, similar answer choices can become confusing. If you approach it as a map of concepts and service families, the patterns become clearer.

Exam Tip: When evaluating answer choices, first identify the category being tested. Ask yourself: is this question about cloud concepts, core architecture, a service family, or governance? Eliminating category mismatches is one of the fastest ways to improve accuracy.

As you move through this book, keep the certification’s value aligned with your goal. If your objective is to pass the exam, study to recognize key distinctions quickly. If your objective is to build a foundation for future Azure learning, also focus on why services exist and what business problem each one solves. That dual perspective will help both on the test and beyond it.

Section 1.2: Official exam domains and weighting breakdown

The AZ-900 exam blueprint is organized into major domain areas. These domains reflect what Microsoft considers core Azure fundamentals knowledge. While percentages can change over time, the exam generally centers on three broad areas: describing cloud concepts; describing Azure architecture and services; and describing Azure management and governance. As an exam candidate, you should always verify the current skills outline on Microsoft Learn before your test date, because objectives and relative emphasis may be updated.

The first major domain, cloud concepts, covers material such as cloud models, shared responsibility, consumption-based pricing, and cloud benefits like scalability, elasticity, reliability, and high availability. This domain often looks simple, but it is one of the most trap-filled areas because Microsoft uses terms that sound similar. For instance, candidates sometimes confuse scalability with elasticity, or availability with fault tolerance. The exam tests whether you understand what each term means in context rather than whether you have merely seen the words before.

The second major domain, Azure architecture and services, is usually the broadest. It includes core architectural components such as regions, region pairs, availability zones, subscriptions, resource groups, and management groups. It also includes service families like compute, networking, storage, and identity. This domain is highly testable because Microsoft can ask you to identify the best service category for a scenario. Even when the exam avoids deep technical implementation, it still expects you to know the purpose of major services and their basic use cases.

The third major domain, Azure management and governance, covers cost management, service level agreements, compliance concepts, monitoring tools, and governance features such as resource locks, tags, policies, and role-based access control. Candidates sometimes underestimate this area because it sounds administrative. In practice, it generates many practical exam questions because governance tools are ideal for testing whether you know which Azure feature enforces, organizes, monitors, or reports on resources.

• Cloud concepts: know the principles and terminology clearly.
• Architecture and services: know what core Azure building blocks do.
• Management and governance: know which tool solves which control or visibility problem.

Exam Tip: Weighting matters. If one domain carries more exam emphasis, give it more study time, but do not ignore lower-weighted domains. Fundamentals exams often use easy-looking questions from lighter domains to separate prepared candidates from unprepared ones.

Your study strategy should mirror the blueprint. Build notes and practice review around the official domains, because that is how the exam is written. If you can explain each domain in plain language and identify the most common Azure services within it, you are preparing in the right direction.

Section 1.3: Registration process, exam providers, and identification requirements

Before you can sit for the AZ-900 exam, you must complete registration through Microsoft’s certification portal, which typically routes scheduling through an authorized exam delivery provider. The exact interface may change, but the process generally includes signing into a Microsoft account, selecting the AZ-900 exam, choosing a delivery method, selecting a date and time, and confirming payment or applying a voucher if you have one. This sounds routine, yet registration mistakes can create avoidable stress that affects exam performance.

Candidates typically choose between a test center appointment and an online proctored exam. A test center offers a controlled environment and can be a better option if your home internet, room setup, or device reliability is uncertain. Online delivery offers convenience, but it comes with stricter check-in requirements. You may need to verify your workspace, allow system checks, use a supported browser, and follow rules about desk cleanliness, prohibited items, and communication. If your environment fails compliance checks, your appointment can be delayed or terminated.

Identification requirements are especially important. The name in your exam registration should match your government-issued identification exactly or closely enough to satisfy the provider’s policy. Even minor mismatches can cause problems on exam day. Do not wait until the last minute to review your profile details. Also check appointment confirmation emails carefully, because they may contain country-specific ID rules, arrival timing, or check-in instructions.

Another practical consideration is scheduling strategy. New candidates often book too early out of enthusiasm or too late out of hesitation. Both can be costly. A good target is to schedule once you have a structured study plan and enough lead time for review. Booking a date can improve accountability, but only if you also reserve time for practice exams and weak-area remediation.

Exam Tip: Complete any online exam system test well before exam day. Technical issues are much easier to solve 48 hours in advance than 15 minutes before check-in.

If you must reschedule or cancel, review the provider’s policy immediately after booking. Retake and rescheduling rules can change, and missed deadlines may lead to forfeited fees. Administrative readiness is part of exam readiness. A calm, organized candidate starts the test with a mental advantage over someone distracted by logistics.

Section 1.4: Exam format, scoring model, and result reporting

Understanding the AZ-900 exam format helps reduce anxiety and improves pacing. The exam may include different item styles, such as standard multiple-choice, multiple-response, matching, and scenario-based items. Microsoft can vary the number and presentation of questions, so avoid relying on a fixed question count from informal sources. What matters more is learning how Microsoft frames fundamentals-level decisions. The exam often presents short business or technical needs and asks which concept or service best fits.

The scoring model is commonly misunderstood. Candidates usually hear that 700 is the passing score, but that does not mean 70 percent in a simple one-point-per-question sense. Microsoft uses scaled scoring, and not every item necessarily contributes the same way. The safest takeaway is practical rather than mathematical: aim for consistent accuracy across all domains instead of trying to calculate a minimum raw score. When candidates try to game the scoring model, they often neglect weaker topics that later cost them the pass.

Result reporting may provide an overall pass or fail outcome plus domain-level performance feedback. That feedback is useful, but remember that broad category feedback does not always reveal every underlying weakness. For example, a candidate might score acceptably overall in architecture and services while still being weak in networking or identity subtopics. Use the report as a directional guide, not as a complete diagnostic tool.

Question wording is one of the biggest challenges for beginners. The exam frequently includes answer choices that are true statements but not the best response to the exact prompt. Your task is not to find something reasonable; it is to find the most accurate answer under the stated conditions. Words such as best, most appropriate, primarily, and first can change the correct choice. Reading too quickly is a common reason candidates miss otherwise easy questions.

• Do not assume all questions have equal difficulty or equal point value.
• Do not spend excessive time on one tricky item early in the exam.
• Do focus on eliminating clearly incorrect options before choosing among the remaining answers.

Exam Tip: On fundamentals exams, overthinking can be as dangerous as underthinking. If an answer directly matches the tested concept and fits the wording precisely, do not talk yourself out of it by introducing advanced assumptions.

After the exam, review your result with a study mindset whether you pass or fail. A pass confirms readiness at the fundamentals level. A fail is not a verdict on your potential; it is feedback on your current preparation method. In both cases, the score report should shape your next step.

Section 1.5: Study planning for beginners with practice-test strategy

Beginners need a study plan that is simple, repeatable, and aligned to the exam objectives. Start by dividing your preparation into the official domains. Dedicate separate blocks to cloud concepts, Azure architecture and services, and management and governance. Within each block, learn definitions first, then relationships, then examples. For instance, do not just memorize that Azure Policy exists; understand that it is used to enforce or evaluate compliance conditions on resources. This structure helps you answer both direct and scenario-based questions.

A strong beginner plan typically includes three phases. Phase one is foundation building. Read objective-aligned content, create concise notes, and make sure you can explain key concepts in your own words. Phase two is guided practice. Use practice questions to identify whether you can distinguish similar concepts and service names. Phase three is exam simulation. Take timed mock exams and review every incorrect answer, including why the wrong options were wrong. That final step is critical because it builds exam reasoning, not just content exposure.

Practice tests are often misused. They are not only score predictors; they are diagnostic tools. If you simply repeat the same questions until the answers look familiar, you may inflate your confidence without improving understanding. Instead, categorize every mistake. Was it a terminology error, a service identification error, a governance-tool confusion, or a reading mistake caused by rushing? When you label mistakes, your review becomes much more effective.

A practical weekly plan might include concept study on weekdays and one timed mini-assessment on the weekend. As your exam date gets closer, increase the proportion of mixed-domain practice. This matters because the real exam will not present topics in a neat chapter order. Your brain must learn to switch quickly from cloud models to storage options to compliance tools without losing accuracy.

Exam Tip: After each practice session, write one sentence explaining why the correct answer is correct and one sentence explaining why your chosen wrong answer seemed attractive. That is how you expose recurring traps in your thinking.

Finally, build a final review strategy. In the last week, focus less on learning entirely new material and more on weak-area analysis, service comparison tables, official objective review, and full-length timed practice. In the last 24 hours, prioritize sleep, calm review, and logistical readiness over cramming. A prepared, rested candidate performs better than an exhausted candidate who tried to cover everything at the last minute.

Section 1.6: Common AZ-900 mistakes and how to avoid them

The most common AZ-900 mistake is underestimating the exam because it is an entry-level certification. Candidates often assume that broad familiarity with cloud buzzwords is enough. The result is shallow preparation, especially in areas where Microsoft tests subtle distinctions. To avoid this, make sure you can define terms precisely and connect them to business or technical outcomes. If you cannot explain the difference between cloud models or the purpose of a governance feature in simple language, your understanding is probably not exam-ready.

Another frequent mistake is confusing similar Azure services. Beginners may mix up identity and access concepts, storage offerings, or governance tools because the names all seem plausible. The solution is to compare services side by side. Ask what each service is mainly for, what problem it solves, and what category it belongs to. On the exam, wrong answers are often designed to be plausible but slightly misaligned. Your job is to spot that misalignment quickly.

Rushing is also a major issue. Candidates often read the first half of a question, think they know the topic, and choose an answer before noticing a key qualifier. Words like minimize management overhead, pay only for what is used, enforce compliance, or provide centralized monitoring change the answer. Slow enough to capture the requirement, but not so much that you lose pacing.

Some candidates rely too heavily on memorized practice answers. This creates a false sense of mastery. If a practice question is reworded, the memorizer struggles; the prepared candidate still succeeds because they understand the concept behind the question. Review should therefore focus on patterns: what clue in the scenario points to this service or concept, and what clue rules out the alternatives?

• Avoid assuming fundamentals means trivial.
• Avoid studying service names without use cases.
• Avoid ignoring weaker domains just because they feel less technical.
• Avoid last-minute cramming as your only strategy.

Exam Tip: If two answers both seem correct, ask which one directly satisfies the stated requirement and which one is only generally related. The exam usually rewards the more specific fit.

The final mistake is poor exam-day readiness. Late arrival, forgotten identification, unsupported online setup, or fatigue can erase weeks of good study. Build your plan so that content review, practice-test analysis, scheduling, and exam-day logistics all work together. AZ-900 success is not about mastering advanced Azure administration. It is about demonstrating clear, structured, accurate fundamentals knowledge under exam conditions.

Section 2.1: Describe cloud concepts - what cloud computing means

Cloud computing refers to the delivery of computing services over the internet. These services can include servers, storage, networking, databases, analytics, and software. Instead of an organization buying, installing, and maintaining all resources in its own data center, a cloud provider makes those resources available on demand. In practical terms, cloud computing gives organizations access to scalable IT capabilities without requiring them to own all the underlying infrastructure.

On the AZ-900 exam, cloud computing is usually tested through its defining benefits. You should recognize terms such as high availability, scalability, elasticity, agility, fault tolerance, disaster recovery, and global reach. Scalability means a system can handle increased workload by adding resources. Elasticity goes a step further by allowing resources to expand and contract automatically or rapidly as demand changes. Agility refers to the speed with which resources can be deployed. The exam may present a scenario about a company launching a new service quickly in multiple regions; this points toward agility and global reach.

A common trap is confusing cloud computing with virtualization alone. Virtualization is a technology often used inside cloud environments, but it is not the same as cloud computing. The cloud also includes service delivery, self-service provisioning, broad network access, pooled resources, and measured usage. Another trap is assuming cloud always means public cloud. Cloud computing is a broader idea that includes private and hybrid models as well.

Exam Tip: If an answer choice says a company can provision resources when needed and pay based on usage, that is a strong indicator of cloud computing benefits. Those phrases are classic exam signals.

Cloud concepts are not only technical; they are also operational and financial. The cloud enables organizations to deploy faster, reduce procurement delays, and improve flexibility. If a question asks why a business would move to the cloud, think beyond hardware. The answer may involve speed, resiliency, easier expansion, or reduced management overhead. The exam tests whether you understand the business value of the cloud, not just its technical definition.

Section 2.2: Shared responsibility model and cloud responsibilities

The shared responsibility model explains that security and management duties are divided between the cloud provider and the customer. The exact split depends on the service type. This is one of the most important AZ-900 concepts because Microsoft wants entry-level candidates to understand that moving to the cloud does not remove all customer responsibility. Instead, responsibility shifts depending on what is being consumed.

In an on-premises environment, the customer is responsible for everything: facilities, physical servers, networking, operating systems, applications, and data. In the cloud, the provider always takes responsibility for some portion of the stack, especially the physical infrastructure. As you move from IaaS to PaaS to SaaS, more responsibility shifts to the provider. In IaaS, the customer still manages items such as the operating system, applications, and data. In PaaS, the provider manages more of the platform, and the customer focuses more on applications and data. In SaaS, the provider manages almost everything except the customer’s data, access, and usage decisions.

A classic exam trap is assuming that if Microsoft hosts the service, Microsoft also manages customer identities, data classification, account permissions, and endpoint security decisions. That is not correct. Customers remain responsible for their data, identity controls, and how services are configured and used. Questions may test this by asking who is responsible for patching the operating system in a virtual machine versus in a software application delivered as a service.

Exam Tip: If the scenario mentions a virtual machine, expect the customer to manage the guest operating system. If it describes a finished software product accessed through the web, expect the provider to manage much more of the stack.

The exam is not looking for deep engineering detail here. It is testing whether you understand the principle that responsibility is shared and changes by service model. When eliminating answer choices, ask: is this a physical infrastructure task, a platform task, or a customer-controlled task such as data and access? That reasoning usually leads to the correct answer.

Section 2.3: Cloud models: public, private, and hybrid

AZ-900 requires you to compare the three major cloud deployment models: public cloud, private cloud, and hybrid cloud. These are often confused because all three can deliver cloud-like capabilities. The key differences involve ownership, access, and where resources are located.

A public cloud is owned and operated by a third-party provider such as Microsoft. Resources are delivered over the internet, and multiple customers share the provider’s underlying infrastructure, even though their data and workloads remain logically isolated. Public cloud is associated with high scalability, rapid provisioning, and reduced need for the customer to manage physical hardware. It is often the best fit for organizations that want flexibility and lower upfront costs.

A private cloud is used by a single organization. It may be hosted in the organization’s own data center or by a third party, but the environment is dedicated to that one organization. Private cloud can offer greater control and can support specific compliance or legacy requirements. However, it usually involves more management overhead and often higher cost than public cloud.

Hybrid cloud combines public and private environments and allows data and applications to move between them as needed. This is especially important on the exam because hybrid cloud is often the correct answer in scenarios involving phased migration, regulatory constraints, or temporary expansion of capacity from on-premises systems into cloud resources. If a company must keep certain workloads on-premises but still wants cloud benefits for other workloads, hybrid is the best fit.

A common trap is confusing hybrid with multi-cloud. Hybrid refers to combining on-premises or private cloud resources with public cloud resources. Multi-cloud refers to using services from multiple cloud providers. While both can appear in real life, AZ-900 cloud model questions typically focus on public, private, and hybrid only.

Exam Tip: Look for signal phrases. “Dedicated to one organization” suggests private cloud. “Available over the internet from a provider” suggests public cloud. “Some resources remain on-premises while others run in the cloud” strongly suggests hybrid.

The exam tests whether you can match a business requirement to the correct model, not whether you can design a full enterprise strategy. Focus on the defining use case of each model and eliminate answers that do not satisfy the stated control, location, or flexibility requirement.

Section 2.4: Service types: IaaS, PaaS, and SaaS

The three core cloud service types are Infrastructure as a Service, Platform as a Service, and Software as a Service. These are fundamental to AZ-900 because they explain how much of the technology stack the provider manages and how much the customer manages. Many exam questions are really asking you to identify the level of abstraction.

IaaS provides basic computing building blocks such as virtual machines, storage, and networking. The provider manages the physical hardware and virtualization layer, but the customer still manages the operating system, installed software, and most configuration inside the workload. If a scenario mentions lift-and-shift migration, custom control over virtual machines, or management of the guest operating system, think IaaS.

PaaS provides a managed platform for building, deploying, and running applications without managing the underlying infrastructure in the same way as IaaS. The provider manages more of the environment, including operating systems and runtime components in many cases, while the customer focuses on the application and data. If the scenario emphasizes developer productivity, reduced infrastructure management, or deploying code directly to a managed environment, think PaaS.

SaaS delivers complete software applications over the internet. End users consume the software without managing the infrastructure or platform behind it. Microsoft 365 is a classic example. In exam language, SaaS is the best answer when the scenario is about using a ready-made application rather than building or hosting one.

A frequent trap is choosing PaaS whenever development is mentioned. Not every development-related scenario is PaaS. If the company still needs full control of the operating system, that points back to IaaS. Another trap is assuming SaaS means no customer responsibility at all. Customers still manage users, access, data, and configuration choices.

Exam Tip: Ask yourself one question: what is the customer trying to avoid managing? If the answer is physical servers only, it may be IaaS. If the answer includes operating systems and runtime platforms, it may be PaaS. If the answer is the entire application stack, it is likely SaaS.

Be prepared to distinguish these models using short business descriptions. The exam often tests practical identification rather than textbook definitions.

Section 2.5: Consumption-based model, CapEx, and OpEx

Cloud economics are a core part of the Describe cloud concepts domain. The exam expects you to understand how the cloud changes spending patterns. In traditional IT environments, organizations often make large upfront purchases for servers, storage, networking equipment, and facilities. These are capital expenditures, or CapEx. CapEx involves paying significant costs in advance for assets that will be used over time.

Operational expenditure, or OpEx, refers to ongoing costs incurred as resources are consumed. Cloud services commonly use an OpEx model because organizations pay for usage over time rather than buying all hardware in advance. This is closely related to the consumption-based model. In a consumption-based model, the customer is charged according to how much of a service is used. If usage increases, cost increases. If usage drops, cost can decrease. This supports flexibility and helps align spending with actual demand.

On the exam, the wording may be simple but the distractors can be tricky. A common trap is assuming cloud always eliminates all fixed cost. That is not true. Some cloud services can still involve reserved commitments or predictable monthly costs. However, the foundational AZ-900 principle is that cloud makes it possible to shift from large upfront CapEx toward more flexible OpEx and pay-as-you-go consumption.

Another trap is selecting the answer that sounds cheapest. The exam is usually testing the pricing model, not whether cloud is universally less expensive in every situation. The better answer is often the one that describes financial flexibility, the ability to scale spending with demand, or reduced need for upfront hardware investment.

Exam Tip: If a scenario mentions avoiding large initial purchases, improving budgeting flexibility, or paying only for resources used, think OpEx and consumption-based pricing. If it mentions purchasing hardware that becomes a long-term asset, think CapEx.

Be sure to connect this topic to business outcomes. Cloud spending supports experimentation, faster deployment, and rapid growth without waiting for procurement cycles. That is why this concept appears often in introductory certification exams.

Section 2.6: Exam-style drills for Describe cloud concepts

This section is about how to think like the exam. The Describe cloud concepts domain is less about memorizing Azure product names and more about classifying requirements correctly. To perform well, train yourself to identify keywords, eliminate near-correct distractors, and choose the answer that best fits the principle being tested.

Start by asking what category the question belongs to. Is it testing a cloud model, a service type, a responsibility boundary, or a pricing concept? Once you know the category, look for decisive clues. Phrases like “maintain full control of the operating system” suggest IaaS. “Use a complete application through the internet” suggests SaaS. “Keep some resources on-premises” suggests hybrid cloud. “Pay only for what is used” suggests consumption-based pricing and OpEx. This approach turns many broad questions into straightforward identification exercises.

A common mistake is overthinking. Because AZ-900 is a fundamentals exam, the correct answer is usually the one that matches the core definition most directly. Do not add assumptions that are not stated in the question. If the scenario simply says the organization wants to quickly deploy resources without buying servers, do not infer compliance, private networking, or advanced architecture needs unless the question explicitly includes them.

Exam Tip: When two options both seem partly correct, choose the one that is more general and foundational if the question is also general. AZ-900 often rewards the broad principle rather than the niche exception.

As you review practice material, track your weak areas by theme. If you repeatedly confuse PaaS and SaaS, create a one-line distinction and revisit examples. If you miss public versus hybrid cloud questions, focus on ownership and location clues. Final exam readiness comes from repetition and pattern recognition. The more scenarios you translate into cloud principles, the more confidently you will answer under time pressure.

This chapter prepares you for later Azure architecture topics by giving you the conceptual framework behind service selection. If you can identify the cloud principle being tested, you will be able to reason through more advanced questions across the rest of the course.

Section 3.1: Describe cloud concepts - high availability, scalability, elasticity, and reliability

This section covers several cloud benefits that appear repeatedly on the AZ-900 exam. Microsoft wants you to understand these as distinct ideas, even though they are related in practice. High availability refers to designing services so they remain accessible even when failures occur. This is often achieved through redundancy, failover mechanisms, and distributed deployment. If a question emphasizes minimizing downtime or keeping a service operational despite component failure, high availability is likely the correct concept.

Reliability is broader. It means a system can consistently recover from failures and continue operating as expected. In Azure wording, reliability often overlaps with resiliency and fault tolerance. Exam questions may present a service that continues to function after an outage in one location. That points to reliability, while wording focused on maximum uptime may point more directly to high availability. Both are connected, but the exam may expect the more precise term based on the scenario.

Scalability means the ability to increase or decrease resources to meet demand. You should recognize both vertical scaling and horizontal scaling at a high level, although AZ-900 usually stays conceptual. If usage grows and the organization adds more capacity, that is scalability. By contrast, elasticity is the ability to automatically or dynamically scale in response to changing demand, often in near real time. Elasticity is especially associated with cloud environments because resources can be provisioned and released quickly.

A classic exam trap is giving a scenario with temporary traffic spikes. If the wording stresses that resources expand during the spike and shrink afterward, the best answer is usually elasticity rather than general scalability. If the wording simply says the company can add more resources as the business grows, scalability is stronger. Watch for words like automatically, dynamically, spike, and unexpected demand.

• High availability = service remains available with minimal downtime.
• Reliability = service can recover from failure and operate consistently.
• Scalability = capacity can increase or decrease to match workload needs.
• Elasticity = capacity adjusts quickly, often automatically, as demand changes.

Exam Tip: If two answers both seem correct, choose the one that matches the language of the scenario most precisely. “Handles sudden increases and then reduces resources” is elasticity. “Supports long-term growth” is scalability. “Stays up during failure” is high availability. “Recovers and keeps functioning” is reliability.

For AZ-900, you do not need to design architectures at expert level, but you do need to recognize why cloud platforms are valuable. These benefits are part of that value story. Microsoft often frames them in business terms rather than engineering terms, so practice translating plain language into cloud vocabulary.

Section 3.2: Predictability, security, governance, and manageability benefits

Beyond uptime and scaling, the exam also expects you to know other core benefits of cloud computing: predictability, security, governance, and manageability. These often appear in conceptual questions that ask why an organization chooses the cloud. Because the answer choices can all sound positive, your task is to identify which benefit is being described most directly.

Predictability means confidence in both performance and cost. In Azure, predictable performance can come from the consistency of standardized cloud services, while predictable cost can come from tools for budgeting, monitoring, and estimating spend. If a question focuses on forecasting expenses or understanding usage before deployment, predictability is a strong candidate. However, be careful not to confuse cost predictability with low cost. The exam may test whether you understand that cloud pricing can be controlled and estimated, not simply assumed to be cheaper in every case.

Security in the cloud refers to the tools, controls, and capabilities used to protect data, applications, and infrastructure. Azure provides many built-in security services, but the exam also expects awareness of the shared responsibility model from the cloud concepts domain. Microsoft secures the underlying platform, while customers still configure identities, data access, and many workload settings. A common trap is assuming the cloud provider handles all security automatically. That is not correct.

Governance is about ensuring resources comply with organizational standards and regulatory requirements. On the exam, governance is often linked with policy enforcement, standardization, and control across multiple subscriptions or teams. If a scenario mentions enforcing rules, consistency, or compliance requirements, governance is more likely than security. Security protects; governance controls and standardizes.

Manageability refers to how easily cloud resources can be administered. Azure supports this through portals, command-line tools, templates, and monitoring capabilities. Questions may describe deploying resources consistently, managing environments at scale, or tracking operational health. That language points to manageability. The cloud makes management easier because services can be configured, monitored, and automated from centralized tools.

• Predictability = more confidence in expected cost and performance.
• Security = protecting systems and data with cloud and customer controls.
• Governance = enforcing standards, policies, and compliance requirements.
• Manageability = administering, monitoring, and automating resources efficiently.

Exam Tip: When a question mentions rules across many Azure resources, think governance before security. When it mentions operational administration and monitoring, think manageability. When it mentions estimating cost or expected behavior, think predictability.

These benefits are easy to overlook because candidates focus more on technical Azure services. But AZ-900 is a fundamentals exam. Microsoft wants you to articulate why cloud adoption matters from an organizational perspective, not just a technical one.

Section 3.3: Describe Azure architecture and services - regions and region pairs

Azure is organized into physical and logical structures, and one of the most important is the region. A region is a set of datacenters deployed within a defined geographic area. On the exam, if you see language about where Azure services are deployed, regional service availability, or meeting latency and residency needs, the concept being tested is often Azure regions. Regions allow organizations to place workloads closer to users, which can improve performance and support legal or compliance expectations.

Do not assume every service is available in every region. AZ-900 may test that service availability can vary by region. This means choosing a region is not just a geography decision; it can also affect what Azure services or features you can use. Questions sometimes include this nuance as a distractor, especially when answer options imply that all Azure capabilities exist identically everywhere.

Region pairs are another favorite test point. Each Azure region is paired with another region within the same geography in most cases. Region pairs support certain disaster recovery and platform update strategies. Microsoft prioritizes one region in the pair during planned updates to help reduce simultaneous impact. If a scenario refers to business continuity, disaster recovery planning, or paired regional strategy, region pairs may be the expected answer.

A common confusion is between region pairs and availability zones. Region pairs involve two separate regions. Availability zones are separate physical locations within a single region. If the question asks about protection against a regional outage, region pairs are more relevant. If it asks about redundancy within one region, availability zones are more likely.

• Region = one or more datacenters in a specific geographic area.
• Use regions to address latency, service availability, and data residency concerns.
• Region pairs support broader resilience and planned update sequencing.

Exam Tip: Read carefully for the phrase “within a region” versus “across regions.” That one wording difference often determines whether the correct concept is availability zones or region pairs.

From an exam reasoning standpoint, when you evaluate answer choices, ask: Is the scenario about location selection, legal/data residency, service availability, or disaster recovery across large geographic boundaries? If yes, regions and region pairs should be high on your shortlist.

Section 3.4: Availability zones, datacenters, and Azure geographies

Availability zones are physically separate locations within an Azure region. Each zone has independent power, cooling, and networking. The purpose is to improve resiliency by distributing resources across separate facilities in the same region. On AZ-900, this is usually tested conceptually: if an organization wants additional protection from datacenter-level failure without leaving the region, availability zones are the best match.

This matters because many candidates think any redundancy automatically means cross-region deployment. Not so. Azure gives multiple layers of resilience. Datacenter redundancy may exist inside a region, availability zones provide separate physical locations within a region, and region pairs support resilience across regions. The exam may ask you to distinguish among these layers based on how broad the failure scenario is.

Datacenters are the physical facilities housing Azure infrastructure. AZ-900 does not require deep hardware knowledge, but you should understand that regions are made up of datacenters and that availability zones represent separate physical locations. If an answer choice says a geography consists directly of subscriptions or resource groups, that is incorrect. Geographies relate to regional location structures, not organizational hierarchy.

Azure geographies are larger market areas that contain one or more regions, generally preserving data residency and compliance boundaries. Questions may refer to a country or multi-country boundary for compliance purposes. In that case, geography is often the right term, especially if the scenario is broader than a single region. Candidates often confuse geography with region because both refer to location, but geography is the larger scope.

• Datacenter = physical facility for Azure infrastructure.
• Availability zone = separate physical location within a single Azure region.
• Geography = larger boundary containing one or more regions.

Exam Tip: Think in size order: datacenter, availability zone, region, geography. If you can mentally place each term on that ladder, many architecture questions become straightforward.

Watch for wording traps. “Separate buildings in the same regional area” suggests availability zones. “A market boundary containing multiple regions” suggests geography. “Physical facility” suggests datacenter. The exam often rewards candidates who pay close attention to scope.

Section 3.5: Resources, resource groups, subscriptions, and management groups

This is one of the highest-value architecture topics on AZ-900 because it tests how Azure is organized logically. A resource is an individual manageable item in Azure, such as a virtual machine, storage account, or virtual network. A resource group is a container that holds related resources for an Azure solution. Questions often test whether you know that resources in a resource group can be managed together for lifecycle and access purposes.

A major trap is assuming a resource group is tied permanently to one service type or one region. In reality, a resource group can contain many kinds of resources, and while resource group metadata has a location, the resources inside it can have their own locations depending on service rules. AZ-900 usually keeps this simple, but you should avoid overgeneralized assumptions.

A subscription is primarily a unit of billing and access control. It provides a boundary for Azure costs and resource organization. Many exam questions describe a need to separate billing for departments, projects, or environments. In such cases, a subscription is often the correct answer. Subscriptions also help apply limits and administrative separation.

Management groups sit above subscriptions and allow governance and policy application across multiple subscriptions. If the scenario says an organization has many subscriptions and wants to apply policies, compliance rules, or access controls consistently, management groups are likely the best answer. This is a favorite exam distinction: resource groups organize resources, subscriptions organize billing and access boundaries, and management groups organize multiple subscriptions.

• Resource = individual Azure service instance.
• Resource group = logical container for related resources.
• Subscription = billing and access boundary.
• Management group = governance layer above subscriptions.

Exam Tip: Ask yourself what is being grouped: individual services, related project components, billing units, or multiple subscriptions. That reveals the correct Azure scope level almost immediately.

For the exam, memorize the hierarchy direction: resources live in resource groups, resource groups belong to subscriptions, and subscriptions can be organized into management groups. If an answer choice reverses that hierarchy, it is wrong. This structure is foundational for later governance and cost management topics as well.

Section 3.6: Practice bank for cloud benefits and core architecture

As you work through the AZ-900 practice bank, this chapter’s objectives often appear in mixed-question form. One question may begin with a business requirement such as reducing downtime, then switch to an Azure architectural choice such as using availability zones or selecting a region. Another may ask about compliance and then require you to identify whether the correct control point is a management group, subscription, or resource group. The exam is not testing advanced engineering design. It is testing whether you can map short scenarios to the correct cloud principle and Azure term.

The best practice approach is to classify each item before answering. First, ask whether the question is about a benefit of cloud computing or an architectural component of Azure. Second, identify the scope: single resource, collection of resources, billing boundary, multiple subscriptions, one datacenter area, one region, or multiple regions. Third, watch for keywords. Words like uptime, failure, spike, policy, billing, residency, and within a region are all strong clues.

Common traps in practice questions include choosing a technically possible answer instead of the most accurate exam answer. For example, a subscription can help organize resources, but if the question specifically asks for a container for related solution components, resource group is the better answer. Similarly, both region pairs and availability zones improve resilience, but they address different failure scopes. The exam frequently rewards precision over general familiarity.

Exam Tip: During review, create a weak-area list of terms that you still confuse. Most AZ-900 misses in this chapter come from concept overlap, not from lack of effort. If you repeatedly mix up elasticity and scalability, or geography and region, isolate those pairs and review them together.

For final readiness, practice answering in two passes. On the first pass, eliminate clearly wrong options by scope or definition. On the second pass, compare the remaining answers against the exact wording of the scenario. This is especially effective for mixed cloud-concepts-and-architecture items. By exam day, your goal is not just recall. Your goal is fast recognition of what Microsoft is really asking.

Mastering these concepts will improve performance not only in this chapter’s practice bank but across the full AZ-900 exam. Azure fundamentals questions are often simple on the surface, yet they are designed to reveal whether you understand the platform’s core language. When you can identify the right term quickly and defend why it is better than the alternatives, you are thinking like a successful test-taker.

Section 4.1: Describe Azure architecture and services - compute services

Azure compute services provide processing power for applications, websites, APIs, background jobs, and enterprise workloads. On the AZ-900 exam, compute questions usually test whether you understand the broad categories of compute and the level of management responsibility involved. You should be able to distinguish between infrastructure-based compute, platform-based hosting, container-based deployment, and serverless execution.

The first major category is virtual machines. Azure Virtual Machines give you the most control because you manage the operating system, installed software, patching decisions, and many configuration details. This makes VMs a strong fit when an organization needs custom software, specific OS settings, or a migration path for existing servers. In exam scenarios, VMs are often the correct answer when the requirement explicitly mentions control over the OS or support for legacy applications.

Platform-managed compute reduces administrative overhead. Azure App Service is the most common example at this level for web applications and APIs. Rather than maintaining a server yourself, you deploy the app and let Azure manage much of the hosting environment. Azure Functions goes even further toward serverless computing, where code runs in response to events and you do not need to provision a traditional server for continuous operation.

Containers represent another important compute model. They package an application and its dependencies in a portable format, making deployment more consistent across environments. On the exam, containers are usually associated with portability, microservices, and faster deployment. You are not expected to know deep orchestration details for AZ-900, but you should recognize Azure Kubernetes Service as a managed option for container orchestration.

Exam Tip: If a question asks for the most control, choose a VM-oriented answer. If it emphasizes rapid web app deployment with less infrastructure management, App Service is more likely. If it emphasizes event-driven execution or paying for execution time rather than an always-running server, Azure Functions is a strong signal.

A common trap is assuming that every application belongs on a VM because VMs can run almost anything. While technically possible, AZ-900 often expects you to choose the most appropriate managed service, not the most flexible service. Another trap is confusing serverless with containerization. Serverless focuses on on-demand code execution without server management, while containers focus on packaging and deployment consistency.

To identify the correct answer, focus on three clues: control requirements, application type, and operational overhead. If the scenario values simplicity and managed hosting, avoid VM distractors. If the scenario requires custom machine-level configuration, avoid platform service answers. Microsoft tests whether you can classify the need correctly at a foundational level.

Section 4.2: Virtual machines, containers, functions, and app services

This section compares the compute services that AZ-900 candidates most often mix up. The exam wants you to know what each service is best for and what wording in a scenario points to one service over another. Think of these four options as a spectrum from maximum control to maximum abstraction.

Azure Virtual Machines are infrastructure as a service. They provide virtualized compute resources in Azure and allow you to choose Windows or Linux operating systems. Use them when you need administrator-level control, custom software installation, or compatibility with traditional server workloads. In exam wording, phrases like “lift and shift,” “legacy application,” “full OS control,” or “custom server configuration” usually point to VMs.

Azure App Service is a platform as a service offering for hosting web apps, API apps, and mobile app back ends. It removes much of the infrastructure management burden. The exam often expects App Service when the requirement is to host a website or web API quickly without managing servers. This is one of the easiest service matches to learn, and it appears often in introductory Azure questions.

Azure Functions is used for event-driven, serverless workloads. Functions are triggered by events such as HTTP requests, timers, or messages. This is a favorite exam distinction: when code should run only when triggered, Azure Functions is often preferred over a VM or continuously running app. The billing and operating model differ because you focus on code execution rather than server uptime.

Containers package an application with its dependencies so that it behaves consistently across environments. Azure supports containers in multiple ways, but for AZ-900 you mainly need to recognize Azure Container Instances for simple container execution and Azure Kubernetes Service for managed orchestration at scale. If the scenario emphasizes microservices, portability, or container orchestration, container-related services become likely answers.

Exam Tip: App Service is for hosted applications, Functions is for event-triggered code, VMs are for OS-level control, and AKS is for orchestrating many containers. Build these four anchors in memory and use them to eliminate distractors quickly.

Common exam traps include confusing App Service with Functions because both reduce infrastructure management. The key difference is hosting model: App Service typically hosts an application continuously, while Functions responds to triggers. Another trap is choosing AKS any time containers are mentioned. If the scenario does not require orchestration or scaling of many containers, a simpler container service may be more appropriate.

When comparing answers, ask what the company actually wants to manage: machines, applications, containers, or only code execution. That framing usually reveals the best answer.

Section 4.3: Virtual networks, VPN, ExpressRoute, DNS, and load balancing

Azure networking questions in AZ-900 are typically about basic connectivity and traffic distribution, not low-level network engineering. You should understand the role of Azure Virtual Network, secure hybrid connectivity options, name resolution services, and load balancing choices. The exam often presents a business need such as connecting offices to Azure, resolving names, or distributing user traffic across resources.

Azure Virtual Network, or VNet, is the foundational private networking service in Azure. It enables Azure resources such as virtual machines to communicate with each other, with the internet if allowed, and with on-premises environments through connectivity services. If a question asks for a private Azure network or isolation of resources, VNet is the expected concept.

For hybrid connectivity, know the difference between VPN Gateway and ExpressRoute. VPN Gateway uses encrypted traffic over the public internet to connect Azure with on-premises networks. ExpressRoute provides a dedicated private connection that does not traverse the public internet in the same way. On the exam, when a scenario stresses higher reliability, private connectivity, or predictable performance for enterprise connectivity, ExpressRoute is usually the better answer. If it stresses secure connectivity over the internet, VPN Gateway fits.

Azure DNS hosts DNS domains and provides name resolution using Azure infrastructure. DNS questions at this level are usually straightforward: if the scenario is about translating domain names to IP addresses or hosting DNS records, Azure DNS is the match. Do not confuse DNS with load balancing. DNS helps clients find endpoints; it does not distribute traffic in the same way a load balancer does.

Load balancing is another frequent exam topic. Azure Load Balancer distributes traffic at the network layer, while Azure Application Gateway is more application-aware and is commonly associated with web traffic features. For AZ-900, you mostly need to know the general purpose: load balancing improves availability and performance by distributing incoming traffic across multiple resources.

Exam Tip: Public internet plus encryption suggests VPN; dedicated private circuit suggests ExpressRoute. Name resolution suggests DNS. Traffic distribution suggests a load-balancing service, not DNS.

A common trap is choosing ExpressRoute simply because it sounds more advanced. AZ-900 rewards requirement matching, not prestige. Another trap is treating VNet as a complete hybrid connectivity solution by itself. VNet is the network foundation, but VPN Gateway or ExpressRoute is what extends connectivity to on-premises environments.

To identify the right networking answer, isolate the core need first: private network, site-to-site connection, name resolution, or traffic distribution. Then choose the Azure service that directly solves that need.

Section 4.4: Storage accounts, blobs, files, disks, and redundancy choices

Storage is a core AZ-900 area because many exam questions ask you to match a data type or business requirement to the correct Azure storage service. Start with the storage account: it is the top-level Azure resource that provides access to storage services such as blobs, files, queues, and tables. You do not need deep configuration knowledge, but you must understand what kinds of data each service is designed to hold.

Azure Blob Storage is for unstructured data such as images, video, documents, backups, and logs. Blob is one of the most commonly tested storage services because it fits many cloud storage scenarios. If the requirement involves massive scalable object storage, Blob Storage is usually correct. Azure Files provides managed file shares accessible over standard file-sharing protocols, making it suitable when users or applications need shared file access.

Azure managed disks provide persistent storage for Azure Virtual Machines. This is a key distinction: if the question is about storage attached to a VM, especially OS disks or data disks, think managed disks rather than blobs or files. Many candidates lose easy points by selecting Blob Storage for a VM disk scenario simply because both store data.

Redundancy is also tested at a high level. Azure offers different replication choices such as locally redundant storage, zone-redundant storage, and geo-redundant storage. At the exam level, focus on the business idea behind them. Local redundancy keeps copies within a single location. Zone redundancy protects across availability zones in a region. Geo-redundancy replicates to a secondary geographic region for higher durability and resilience.

Exam Tip: Object data like images and backups points to blobs. Shared file access points to Azure Files. VM-attached persistent storage points to managed disks. Redundancy answers are often about balancing resilience needs against cost.

A common trap is choosing the most redundant option automatically. More replication is not always required in the scenario. If the requirement only asks for low-cost local durability, a geo-redundant answer may be excessive. Another trap is mixing up data structure terms. For AZ-900, keep it simple: blobs are objects, files are shares, disks are VM storage.

When comparing storage answers, identify both the access pattern and the resilience requirement. What kind of data is being stored? How is it accessed? How much durability or regional resilience is requested? These clues will guide you to the correct storage service and replication choice.

Section 4.5: Azure Active Directory, authentication, and authorization basics

Identity is fundamental in Azure, and AZ-900 regularly tests basic sign-in and access control concepts. Microsoft Entra ID, previously called Azure Active Directory, is Azure’s cloud-based identity and access management service. For exam purposes, it is the service associated with user identities, application identities, sign-in, and access to cloud resources.

The two most important terms here are authentication and authorization. Authentication answers the question, “Who are you?” It verifies identity, often using a username and password, multifactor authentication, or other sign-in methods. Authorization answers the question, “What are you allowed to do?” It determines which resources and actions an authenticated identity can access.

This distinction appears frequently in AZ-900. If the scenario mentions verifying a user’s identity during sign-in, the concept is authentication. If it mentions granting or restricting permissions to resources, the concept is authorization. Many exam distractors rely on candidates treating these words as interchangeable. They are related but not the same.

Microsoft Entra ID supports single sign-on, multifactor authentication, and conditional access concepts, all of which may appear in simple foundational questions. Single sign-on reduces repeated sign-ins across applications. Multifactor authentication improves security by requiring more than one factor. Even if the exam does not go deep into policy design, you should understand these basic benefits.

Role-based access control, or RBAC, is another concept tied to authorization. RBAC assigns permissions based on roles so users receive the level of access they need. On the exam, if the requirement is to control who can manage or view Azure resources, RBAC is often the right concept. This is different from the identity directory itself. Microsoft Entra ID manages identities; RBAC governs access to Azure resources.

Exam Tip: Authentication confirms identity. Authorization grants permissions. If a question mentions sign-in, credentials, or MFA, think authentication. If it mentions roles, permissions, or access to resources, think authorization or RBAC.

A common trap is assuming Azure Active Directory is the same as traditional on-premises Active Directory Domain Services. They are related in name but not identical in function. AZ-900 may test that Entra ID is for cloud identity and access management. Stay at the foundational level and avoid importing advanced on-prem assumptions into cloud identity questions.

To choose the correct answer, identify whether the scenario is about identity verification, permission assignment, or directory-based user management. That single decision often eliminates most incorrect options immediately.

Section 4.6: Exam-style practice for compute, network, storage, and identity

This chapter’s final section is about exam-style reasoning rather than memorization. AZ-900 questions in this domain often describe a need in plain business language and expect you to map it to the right service. The strongest test-taking strategy is to identify the category first, then narrow to the specific service. Ask yourself whether the scenario is primarily about running workloads, connecting resources, storing data, or controlling access.

For compute scenarios, decide how much infrastructure management is expected. If the organization wants complete operating system control, virtual machines are a likely fit. If it wants to host a web app or API without managing servers, App Service is usually stronger. If the workload runs in response to events, Functions becomes likely. If the scenario highlights packaged applications or microservices, think containers and possibly AKS.

For networking scenarios, look for clues such as “private network,” “connect branch office,” “dedicated connection,” “resolve domain names,” or “distribute traffic.” Those phrases map naturally to VNet, VPN Gateway, ExpressRoute, DNS, and load balancing services. The exam often tests your ability to separate related concepts. DNS helps users find services; load balancers distribute connections among services.

For storage scenarios, focus on what is being stored and how it is accessed. Unstructured object data suggests Blob Storage. Shared file access suggests Azure Files. Persistent VM storage suggests managed disks. If the question adds a resilience angle, compare redundancy choices at a high level rather than getting lost in implementation detail.

For identity scenarios, first determine whether the requirement is sign-in or permission control. Authentication, MFA, and single sign-on point toward identity verification through Microsoft Entra ID. Roles and access permissions point toward authorization and RBAC. This distinction is one of the easiest ways to eliminate distractors.

Exam Tip: The best AZ-900 answer is usually the most direct service match, not the most technically powerful service. Avoid overengineering. Read for keywords, classify the requirement, and choose the simplest correct Azure service.

Common traps across all four domains include choosing a valid service instead of the best service, ignoring key wording such as “shared,” “event-driven,” or “dedicated,” and confusing broad categories with specific tools. Build a habit of elimination: remove answers from the wrong category first, then compare the remaining options by use case. This method is especially effective on scenario-based questions where several Azure services sound familiar.

As part of your final review strategy, create a one-page comparison sheet covering VMs versus App Service versus Functions, VPN versus ExpressRoute, blobs versus files versus disks, and authentication versus authorization. Repeated comparison practice is what turns this chapter into fast exam-day recognition.

Section 5.1: Describe Azure management and governance - factors affecting costs

AZ-900 expects you to understand the basic factors that affect Azure costs. Microsoft does not test deep pricing math here, but it does expect you to recognize why one deployment costs more than another. Azure uses a consumption-based model for many services, so cost is often influenced by resource type, usage level, time running, performance tier, storage amount, data transfer, and geographic region. If a virtual machine runs continuously, it generally costs more than one used only when needed. If a storage account uses a higher redundancy or access tier, the cost may increase. If a service is deployed in one region instead of another, pricing can vary.

Another important factor is subscription type and purchasing model. Organizations may have different agreements, offers, or discounts. On the exam, however, focus less on contract detail and more on the idea that pricing is not identical across all scenarios. Reserved capacity or reserved instances can reduce cost when a workload is predictable over time, while pay-as-you-go is more flexible but may cost more for steady long-term usage. Spot pricing may appear in some study materials as a low-cost option for interruptible workloads, but AZ-900 usually emphasizes simpler cost ideas rather than advanced buying strategies.

You should also understand that inbound data transfer to Azure is typically treated differently from outbound data transfer from Azure. Questions may test whether network movement affects cost. Likewise, the number of users, transactions, operations, or executions can matter for services such as databases, serverless functions, or messaging platforms. The exam may not ask you to calculate a bill, but it can ask what general factors influence it.

Exam Tip: When a question asks what can increase Azure cost, look for changes in usage, performance tier, storage size, redundancy, or region. Be cautious of distractors that sound administrative, such as tags or resource groups. Those help organization, not direct pricing.

A common trap is confusing cost control with cost elimination. Governance tools can reduce waste, but they do not make resources free. For example, using Azure Policy to limit allowed SKUs may prevent expensive deployments, but the billing model remains based on the resources consumed. Another trap is assuming that all cloud spending is lower than on-premises in every case. Azure can provide cost benefits, but actual savings depend on workload design, usage patterns, and service selection.

On the exam, identify the business requirement first. If the requirement is “What affects cost?” think usage and configuration. If it is “How do we estimate?” that belongs to calculators. If it is “How do we monitor actual spend?” that belongs to Cost Management. This distinction appears repeatedly in AZ-900 questions.

Section 5.2: Cost Management, pricing calculator, and TCO calculator

This section is heavily tested because the tool names are easy to confuse. The Azure Pricing Calculator is used before deployment to estimate the expected cost of Azure services. It helps you model a planned solution by selecting services, regions, performance tiers, and expected usage. If a company wants to know the estimated monthly price of running virtual machines, storage, and bandwidth in Azure, the Pricing Calculator is the right fit.

The Total Cost of Ownership, or TCO, Calculator is different. It is designed to compare the estimated cost of running workloads in Azure versus continuing to run them on-premises. It considers areas such as servers, storage, networking, electricity, and IT labor assumptions. In exam scenarios, if the organization is evaluating whether migrating to Azure could save money compared with its current datacenter, the TCO Calculator is usually the best answer.

Azure Cost Management focuses on monitoring, analyzing, and optimizing actual or forecasted cloud spend after resources are in use. It helps organizations review spending patterns, identify high-cost services, set budgets, and create alerts. This is about financial visibility and control in an active environment, not initial estimation alone. If the scenario mentions tracking current spending by subscription, resource group, service, or tag, think Cost Management.

Exam Tip: Pricing Calculator equals estimate Azure costs. TCO Calculator equals compare Azure with on-premises. Cost Management equals analyze and control ongoing cloud spending.

A frequent exam trap is choosing the Pricing Calculator when the scenario clearly asks for a comparison against existing datacenter costs. Another trap is selecting Cost Management when the wording says “before migrating” or “before deploying.” Pay attention to timeline words. Before deployment usually means calculator. During or after deployment usually means Cost Management.

Budgets are another concept worth remembering. In Azure Cost Management, budgets help organizations define spending thresholds and trigger notifications. They do not automatically stop all services by default, which is another common misunderstanding. A budget is a financial control and alerting mechanism, not a shutdown switch. Also remember that tags can support cost reporting by grouping resources according to department, project, or environment. Tags themselves are not billing tools, but they improve cost analysis.

For AZ-900 reasoning, ask three quick questions: Are we estimating an Azure design? Are we comparing Azure to on-premises? Are we reviewing actual Azure spending? Those three questions usually separate the correct tool from distractors.

Section 5.3: Azure Policy, resource locks, tags, and blueprints concepts

Governance in Azure means controlling how resources are deployed, organized, and protected so that the environment remains compliant with company standards. AZ-900 commonly tests four foundational concepts: Azure Policy, resource locks, tags, and Azure Blueprints concepts. You do not need to build them in detail for this exam, but you must know what problem each one solves.

Azure Policy is used to enforce rules and assess compliance across Azure resources. It can deny the creation of resources that do not meet requirements, allow creation but audit noncompliant settings, or help standardize configurations. Typical examples include allowing deployments only in specific regions, requiring certain tags, or limiting approved resource SKUs. If a scenario asks how to ensure that users can create resources only in approved locations, Azure Policy is a classic answer.

Resource locks protect resources from accidental deletion or modification. Two core lock types are commonly referenced: CanNotDelete and ReadOnly. A CanNotDelete lock prevents deletion but still allows updates in many cases. A ReadOnly lock is more restrictive and prevents changes as well. If the business requirement is to stop an administrator from accidentally deleting a critical storage account, think resource lock, not policy.

Tags are name-value pairs assigned to resources for organization. They are especially useful for categorizing resources by cost center, owner, environment, application, or department. Tags support management and cost reporting, but they do not enforce access control by themselves. On the exam, tags are often the best answer when the requirement is to group or report resources logically for billing or administration.

Azure Blueprints has historically been presented as a way to define a repeatable set of Azure resources, policies, role assignments, and templates to support standardized deployments. Even though Azure governance offerings continue to evolve, AZ-900 questions may still refer to blueprints concepts as packaged governance and deployment standards for environments that must be created consistently.

Exam Tip: Policy enforces standards. Locks protect from change or deletion. Tags organize and label. Blueprints package governance artifacts for repeatable environments.

A common trap is confusing Azure Policy with role-based access control. RBAC controls who can perform actions. Azure Policy controls what configurations are allowed or assessed. Another trap is assuming tags can prevent noncompliant deployment. Tags help classification; they do not replace policy enforcement. Read the wording carefully: “prevent,” “enforce,” and “require” often point to Policy, while “categorize” and “report by department” often point to tags.

Section 5.4: Microsoft Purview, compliance, and trust resources

AZ-900 also tests whether you understand Azure and Microsoft trust and compliance resources at a high level. Microsoft Purview is associated with data governance, risk, and compliance capabilities across data estates. For foundational exam purposes, think of Purview as helping organizations discover, classify, and manage data, which supports governance and compliance goals. If the scenario focuses on understanding data assets, applying classification, or improving data governance across environments, Purview is the likely match.

Compliance in Azure refers to Microsoft’s alignment with industry standards, regulations, and certifications. Organizations often need evidence that cloud services support requirements such as privacy, security, and regulatory obligations. For AZ-900, you should know that Microsoft provides documentation and resources to help customers review compliance offerings, audit reports, and trust-related information. The Microsoft Service Trust Portal is a common example. It gives access to compliance documentation, privacy information, audit reports, and other trust resources.

Questions in this area often test recognition rather than technical depth. If a company wants to review Microsoft compliance reports or learn how Azure services align with specific standards, trust and compliance documentation resources are the correct direction. If a company wants to govern its own data estate through classification and visibility, Purview is more appropriate.

Exam Tip: Distinguish between Microsoft proving platform compliance and a customer governing its own data. Service Trust Portal supports trust and compliance documentation. Purview supports data governance and related compliance activities.

A common trap is selecting a security monitoring tool when the scenario is really about regulatory documentation. Azure Monitor and Defender serve operational and security purposes, but they are not the primary answer for obtaining audit reports or official compliance artifacts. Another trap is assuming compliance is automatic simply because resources are in Azure. Microsoft provides compliant platforms and documentation, but customers still have responsibilities for data handling, configuration, identity, and governance under the shared responsibility model.

On the exam, look for clues like “audit reports,” “certifications,” “regulatory documentation,” “privacy information,” or “trust resources.” Those phrases usually indicate Microsoft trust and compliance resources rather than deployment or monitoring services. Look for “data catalog,” “classification,” or “data governance,” and think Purview.

Section 5.5: Azure Portal, Cloud Shell, Azure Arc, ARM, and monitoring tools

This section blends management interfaces, deployment methods, hybrid management, and monitoring services. Azure Portal is the web-based graphical interface for creating, configuring, and managing Azure resources. It is the most visible management tool and often appears as the default administrative interface in introductory questions. Azure Cloud Shell provides a browser-accessible command-line environment that supports tools like Azure CLI and PowerShell, making it useful for scripted or command-based management without requiring local installation.

Azure Resource Manager, commonly called ARM, is the deployment and management service for Azure. ARM enables infrastructure as code through templates so that resources can be deployed consistently and repeatedly. In exam terms, if the scenario asks for declarative, repeatable deployment of Azure resources, ARM templates are an important concept. This is different from manually creating resources through the portal.

Azure Arc extends management capabilities to resources outside native Azure, such as on-premises servers or resources in other clouds. The key exam idea is centralized management. If an organization wants to apply Azure management and governance experiences across hybrid or multicloud resources, Azure Arc is relevant.

Monitoring tools are another major exam target. Azure Monitor collects and analyzes telemetry from Azure and other environments. It supports metrics, logs, alerts, and insights for operational visibility. Azure Service Health provides information about Azure service issues, planned maintenance, and advisories that may affect your subscriptions. Azure Advisor gives best-practice recommendations related to reliability, security, performance, operational excellence, and cost. These tools solve different problems, so read scenarios carefully.

Exam Tip: Monitor watches performance and health data. Service Health tells you about Azure platform issues affecting services and subscriptions. Advisor recommends improvements. ARM deploys resources. Portal and Cloud Shell are management interfaces. Arc extends Azure management beyond Azure.

A common trap is mixing up Azure Monitor and Service Health. If the issue is your application’s CPU, response times, or logs, think Azure Monitor. If Microsoft has an outage in a region affecting your subscription, think Service Health. Another trap is confusing Cloud Shell with ARM. Cloud Shell is an environment for running commands; ARM is the management and deployment framework underneath resource provisioning.

From an exam strategy perspective, classify the requirement: graphical management, command-line management, repeatable deployment, hybrid control, operational telemetry, platform incident awareness, or optimization advice. That classification usually leads directly to the right Azure tool.

Section 5.6: Exam-style drills for management, governance, and monitoring

In this final section, focus on how AZ-900 frames management and governance questions. Microsoft often uses short business scenarios with one dominant requirement. Your task is to ignore extra words and identify the primary need. For example, a scenario may mention cost, compliance, and deployment together, but only one is the actual decision point. The best answer is not the tool that is generally useful; it is the tool that most directly satisfies the stated need.

Build a mental checklist. If the scenario says estimate before deployment, think Pricing Calculator. If it says compare with on-premises costs, think TCO Calculator. If it says track actual spending or create budgets, think Cost Management. If it says enforce allowed configurations, think Azure Policy. If it says prevent deletion, think resource locks. If it says categorize resources for billing or ownership, think tags. If it says review Microsoft compliance reports, think trust resources. If it says monitor telemetry, think Azure Monitor. If it says see Microsoft service outages, think Service Health.

Exam Tip: AZ-900 distractors are often related tools from the same domain. Eliminate answers by asking what each tool does not do. Tags do not enforce. Locks do not estimate cost. Pricing Calculator does not monitor live spend. Service Health does not replace application monitoring.

Another useful drill is scope awareness. Governance controls can apply at different scopes, and management requirements often imply a broad or narrow scope. If a company wants a standard applied across many subscriptions, a governance tool with broad assignment scope is more likely than a manual portal setting. If the requirement is repeatable deployment, ARM concepts are stronger than ad hoc administration. If the requirement involves on-premises resources managed through Azure, Arc is the clue.

When reviewing practice tests, do weak-area analysis by category. If you repeatedly miss calculator questions, rewrite the tool differences in one line each. If you miss governance questions, compare Policy, locks, tags, and RBAC side by side. If monitoring questions are difficult, separate Monitor, Service Health, and Advisor. This kind of targeted review is far more effective than rereading everything.

For exam-day readiness, slow down on wording such as estimate, enforce, audit, delete, classify, monitor, and advise. Those verbs are often the key. AZ-900 rewards precise recognition. You do not need to be an Azure administrator yet; you need to choose the Azure service that best matches the requirement. Master that mapping, and this domain becomes one of the most scoreable sections of the exam.

Section 6.1: Full-length mock exam aligned to all AZ-900 domains

Your full-length mock exam is the closest practice version of the real AZ-900 experience, so take it seriously. Sit for it in one session, use a realistic time limit, and avoid pausing to look up answers. This is where Mock Exam Part 1 and Mock Exam Part 2 become more than practice sets; together they simulate the mental pacing required on test day. The objective is not only to measure what you know, but also to expose how you perform under mild time pressure, how often you overthink, and whether you can shift smoothly across official domains.

The mock should include balanced coverage of the core exam areas: cloud concepts, Azure architecture and services, and Azure management and governance. As you move through questions, classify each one before answering. Ask yourself whether the item is testing cloud model understanding, a core Azure resource or service, or a governance and operations tool. This habit improves accuracy because many wrong choices come from adjacent domains. For example, a student may recognize a real Azure term but choose a monitoring service when the scenario is really about compliance, or choose a compute resource when the question is really about storage durability.

Exam Tip: On foundational exams, speed comes from pattern recognition. Before reading answer choices, identify the service family or concept family the question belongs to. This reduces the chance of being lured by familiar distractors.

During the mock exam, mark questions that felt uncertain even if you answered them correctly. These are often more valuable than obvious misses because they reveal unstable knowledge. A lucky guess will not hold up on exam day. Also note whether your errors cluster around wording. AZ-900 frequently uses terms like highly available, scalable, consumption-based, capital expenditure, operational expenditure, governance, and shared responsibility. If these trigger hesitation, your revision should focus on distinctions, not memorization alone.

Do not aim for perfection in the first pass. Aim for a clean process: read carefully, identify the objective, eliminate wrong categories, and choose the best answer. The full mock exam is the bridge between learning content and demonstrating exam readiness.

Section 6.2: Detailed answer review and distractor analysis

The value of a mock exam comes primarily from the review phase. After completing both parts of the mock, spend more time reviewing than testing. For every missed item, determine whether the problem was knowledge, interpretation, or discipline. Knowledge errors mean you did not know the concept. Interpretation errors mean you knew the topic but misread the requirement. Discipline errors happen when you rushed, changed a correct answer without evidence, or selected a partially true option instead of the best one.

This is where distractor analysis matters. AZ-900 answer choices often include plausible Azure services that are technically real but contextually wrong. A classic trap is confusing tools that sound related: Azure Policy versus Azure Monitor, network security versus identity protection, or a cloud deployment model versus a pricing benefit. The exam is not trying to trick you with obscure detail; it is testing whether you can match a requirement to the correct concept. A wrong answer often reveals exactly what distinction you have not fully mastered.

Review each distractor as if you were teaching it. Why is it tempting? What problem does it actually solve? In what type of question would it become correct? This method builds transfer skills. Instead of memorizing one answer, you create a map of related concepts. For example, if an answer choice is wrong because it focuses on monitoring rather than governance, you strengthen both categories at once. If a choice is wrong because it addresses authentication while the question asks about authorization or access control, you sharpen identity fundamentals that appear frequently in basic Azure scenarios.

Exam Tip: When two answers both seem correct, ask which one most directly satisfies the stated need with the least extra assumption. The AZ-900 exam usually rewards the most straightforward foundational fit.

Create a short review log with four columns: question theme, why your answer was wrong, why the correct answer was better, and what clue words you missed. This turns review into a repeatable exam strategy. By the time you reach the real exam, you should be able to recognize the common trap patterns immediately.

Section 6.3: Performance breakdown by official exam objective

Weak Spot Analysis only works when it is mapped to the official exam objectives. Do not review your results as a single percentage score. Break your performance into the AZ-900 domains and then into subthemes. Start with cloud concepts, then Azure architecture and services, then Azure management and governance. Inside those categories, identify whether your misses came from cloud models, shared responsibility, cloud benefits, core architecture, compute, networking, storage, identity, pricing, compliance, or monitoring.

This breakdown is essential because broad labels hide useful detail. For example, a low score in Azure architecture and services might actually be strong on compute and weak on networking. A low score in governance might really be confusion between policy, resource organization, and monitoring tools. If you only say, “I need to study governance,” your revision remains too vague to be effective. Instead, target the exact exam objective language. That helps because Microsoft writes questions against those objectives, not against your personal study notes.

A practical scoring model is to categorize each objective as green, yellow, or red. Green means you answer confidently and correctly. Yellow means you often get the right answer but hesitate or rely on elimination. Red means repeated misses or concept confusion. Your final review plan should focus heavily on red, reinforce yellow, and briefly maintain green. This approach prevents the common trap of over-studying favorite topics while ignoring weak ones.

Exam Tip: If you are repeatedly missing questions from different domains, look for a cross-cutting problem such as misreading key terms, not distinguishing service categories, or failing to notice scope words like most appropriate, best, or primary.

The purpose of objective-level breakdown is not just to improve content knowledge. It also helps build confidence. When you can say exactly what you are strong in and exactly what still needs work, your final study becomes controlled and efficient rather than stressful and random.

Section 6.4: Final revision plan for Describe cloud concepts

Your final revision for Describe cloud concepts should center on distinctions that commonly appear in introductory scenario questions. Review cloud models first: public, private, and hybrid cloud. Make sure you can identify each based on ownership, access, control, and connectivity. Then revisit the consumption-based model, capital expenditure versus operational expenditure, and the major cloud benefits such as high availability, scalability, elasticity, agility, fault tolerance, and disaster recovery support. These ideas are foundational and often tested through comparison rather than direct definition.

Shared responsibility is another high-value review area. Focus on what changes across IaaS, PaaS, and SaaS. Students often remember the broad idea but miss the exam because they cannot apply it. The key is to know which responsibilities shift to the provider as you move from infrastructure toward software. Be especially careful with security-related wording. The customer always retains some responsibility, but the scope varies by service model. Questions may test this with practical phrasing rather than charts.

A strong revision routine for this objective is to build mini comparison tables from memory and then verify them. Compare IaaS, PaaS, and SaaS. Compare public, private, and hybrid cloud. Compare OpEx and CapEx. Compare scalability and elasticity. If you can explain each pair or trio in one sentence, you are ready for most AZ-900 items in this domain.

Exam Tip: Watch for answer choices that are true statements about cloud computing but do not answer the specific question. For example, a benefit of cloud may be listed when the item is actually asking about a deployment model or a responsibility boundary.

In the final 48 hours before the exam, do not drown yourself in long notes. Rehearse clean definitions and practical differentiators. This objective rewards clarity. If you can quickly recognize the model, the benefit, or the responsibility split being tested, you will gain easy points.

Section 6.5: Final revision plan for Describe Azure architecture and services

This objective is broad, so your final revision must be organized by service family. Start with core architectural components: regions, region pairs, availability zones, subscriptions, management groups, and resource groups. Make sure you understand what each one is for and how they relate. Many students lose points here by mixing organization and governance structures with deployment locations or resiliency features. Then review core services by category: compute, networking, storage, databases, and identity.

For compute, know when Azure Virtual Machines, containers, and serverless options fit at a high level. For networking, focus on virtual networks, load balancing concepts, VPN-style connectivity, and basic name resolution ideas where relevant. For storage, compare blob, file, queue, and table storage conceptually, and understand durability and access pattern basics. For identity, review Microsoft Entra ID, authentication, and the role of directory-based access. The exam does not expect deep administration, but it does expect you to pick the right service type for a scenario.

One effective final review method is categorization drill. Take common Azure terms and sort them quickly into architecture, compute, networking, storage, database, or identity. If you hesitate, that is a weak signal worth reviewing. AZ-900 often tests whether you can recognize the service class before applying the definition. Another strong technique is contrast review: compare virtual machines versus containers, Azure Files versus Blob Storage, and Azure DNS-related ideas versus network connectivity services at a fundamentals level.

Exam Tip: When a question mentions sign-in, user directory, or controlling access, think identity first. When it mentions hosting code or applications, think compute. When it mentions retaining data, think storage. When it mentions traffic flow or connectivity, think networking.

Your goal is not to memorize every Azure service ever created. Your goal is to identify the core purpose of the major services named in the exam objectives and avoid choosing a real service from the wrong category.

Section 6.6: Final revision plan for Describe Azure management and governance

The final objective area often decides borderline scores because students underestimate it. Azure management and governance includes cost management, service-level awareness, compliance concepts, monitoring, and tools that help control or organize resources. Your review should clearly separate governance, cost control, and operational visibility. These categories are related, but the exam expects you to know which tool or concept fits which purpose.

Begin with cost-related concepts such as factors that influence pricing, the purpose of cost management tools, and why calculators or estimators matter at a high level. Then review governance structures and controls such as resource organization, tagging concepts, locks, and policy-based standardization. After that, revisit monitoring and health tools. Students often confuse preventive governance with reactive observation. A governance tool enforces or evaluates compliance with standards; a monitoring tool helps track performance, health, or logs. That distinction appears frequently in distractors.

Also review compliance and trust topics from a fundamentals perspective. You should understand why organizations care about standards, regulatory alignment, and service trust information, even if the exam does not require auditor-level detail. Service-level agreements should be understood conceptually as commitments around availability, not as memorization of every percentage across every product. Focus on what an SLA represents and how it relates to resiliency thinking.

Exam Tip: If the scenario asks how to observe, analyze, or be alerted on resource behavior, think monitoring. If it asks how to enforce standards, restrict configurations, or maintain organizational control, think governance. If it asks how to estimate or track spending, think cost management.

Finish your preparation with an exam day checklist. Sleep properly, arrive early or verify your online testing setup, read every item carefully, and do not let one difficult question disrupt your pacing. Trust your process: identify the objective, eliminate wrong categories, and choose the best foundational answer. That is how final review turns into certification success.