Many wrong answers on AZ-900 don't come from missing a concept. They come from picking a service whose name and role look almost the same as the right one. When two of the four options are a pair like Azure Policy and RBAC, or VPN Gateway and ExpressRoute, knowing each definition is not enough. You need to be able to say in one sentence what separates the two.
This post is the review entry in our AZ-900 deep-dive series. From the services explained one by one in the domain posts, it picks only the groups that keep showing up as each other's wrong options on the exam, and lays them out again by the criterion that separates them and the clue phrases that appear in questions.
---
Three Questions That Separate Look-Alike Services
When you meet two similar services, asking these three questions in order settles most cases. Two people walking down the same street are easy to tell apart once you ask where they are going, when they left, and how far they are traveling.
| Question | What it separates | Example | |------|------|------| | What does it protect or control? | Target (people, resources, data) | RBAC controls people's permissions; Azure Policy controls resource settings | | When do you use it? | Timing (before deployment, after deployment, during an outage) | The pricing calculator is used before deployment; Cost Management after | | How far does it reach? | Scope (datacenter, zone, region, global) | Availability sets work inside a datacenter; availability zones inside a region |
Every comparison table in this post follows these three axes. Rather than memorizing whole tables, practice spotting whether a question is asking about target, timing, or scope. That habit keeps you steady even when the options come in a combination you have never seen.
---
Domain 1: Look-Alike Pairs in Cloud Concepts
Domain 1 tests the exact meaning of terms more than service names. The terms that describe cloud benefits sound alike, so a typical question describes a situation and asks which benefit it represents.
Scalability vs Elasticity
| Category | Scalability | Elasticity | |------|------|------| | Core idea | The ability to add or remove resources when needed | The ability to grow and shrink automatically as demand changes | | Who adjusts | A person, manually or on a planned schedule | The system, automatically based on load | | Clue in the question | "Can add resources when needed" | "Automatically handles a sudden traffic spike" |
Exam tip: If you see the word "automatically," lean toward elasticity. Vertical scaling (a bigger VM) and horizontal scaling (more VMs) are both ways to achieve scalability, so don't confuse the method with the benefit.
High Availability vs Reliability vs Predictability
| Category | High availability | Reliability | Predictability | |------|------|------|------| | Core question | Is the service up right now? | Does it recover after a failure? | Can you know performance and cost in advance? | | Typical means | SLAs, redundant deployment | Spreading across zones and regions, self-healing | Autoscaling, pricing calculator and budgets | | Clue in the question | "Guarantees 99.95% uptime" | "Recovers even from a regional outage" | "Estimate next month's cost in advance" |
Exam tip: All three terms tend to appear next to words like "outage" or "SLA." If the sentence is about how long the service stays up, it is high availability; about recovering after a failure, reliability; about plans and budgets, predictability.
CapEx vs OpEx
| Category | CapEx (capital expenditure) | OpEx (operational expenditure) | |------|------|------| | How you spend | Buy servers and datacenters up front | Pay for what you use as you use it | | Typical environment | On-premises | The consumption-based model of the public cloud | | Clue in the question | "Large up-front investment," "depreciation" | "No up-front cost," "billed by usage" |
Related posts: Cloud Computing Concepts, Benefits of Cloud Services
---
Domain 2: Look-Alike Pairs in Architecture and Services
This domain carries the most weight, so it also has the most look-alike pairs. The main criteria are how wide a failure you are protecting against (scope) and what you are connecting to what, over which path (connection type).
Availability Sets vs Availability Zones vs Region Pairs
| Category | Availability set | Availability zone | Region pair | |------|------|------|------| | Failure it protects against | Rack-level hardware failure, planned maintenance reboots | Failure of an entire datacenter | A large disaster that affects a whole region | | Scope | Inside one datacenter | Physically separate datacenters within one region | A different region in the same geography | | SLA with two or more VMs | 99.95% | 99.99% | Not applicable (disaster recovery design) |
Exam tip: "Keeps running even if one datacenter goes down" → availability zones. "Prepare for a region-wide disaster" → region pairs. "Protect against hardware failure and maintenance reboots inside one datacenter" → availability sets.
VPN Gateway vs ExpressRoute vs VNet Peering
| Category | VPN Gateway | ExpressRoute | VNet peering | |------|------|------|------| | What it connects | An on-premises network or a single PC ↔ an Azure VNet | An on-premises network ↔ Azure | An Azure VNet ↔ an Azure VNet | | Path | An encrypted tunnel over the public internet | A dedicated private connection that does not use the internet | The Microsoft backbone network | | Clue in the question | "Encrypted connection over the internet" | "Does not travel over the internet," "higher bandwidth" | "Connect two virtual networks directly" |
Exam tip: VPN comes in two flavors. Site-to-site connects an entire office network to Azure; point-to-site connects a single remote worker's PC.
Public Endpoint vs Private Endpoint
| Category | Public endpoint | Private endpoint | |------|------|------| | Address | A public IP address | A private IP address from your VNet's address space | | Who can reach it | Anywhere on the internet (can be limited with firewall rules) | Only networks connected to that VNet | | Clue in the question | "An address reachable from the internet" | "Reach a PaaS service through a private IP inside the VNet" |
Related posts: Public Endpoints vs Private Endpoints
Virtual Machines vs App Service vs Functions vs Containers
| Service | Model | What you manage | Clue in the question | |------|------|------|------| | Virtual Machines | IaaS | Everything from the operating system up | "Full control of the OS," "move existing servers as they are" | | App Service | PaaS | Your code and app settings | "Host web apps and APIs without managing infrastructure" | | Azure Functions | Serverless | Only the function code, billed per execution | "Run code only when an event occurs" | | Container Instances | PaaS | A single container | "Run a container quickly without orchestration" | | Azure Kubernetes Service | Managed Kubernetes | Groups of containers and deployment policies | "Deploy, scale, and manage many containers" |
Related posts: Azure Virtual Machines Explained, Compute and Networking
LRS vs ZRS vs GRS vs GZRS
| Option | Where the copies live | Failure it survives | |------|------|------| | LRS | Three copies in one datacenter in the primary region | Disk or server failure | | ZRS | Spread across three availability zones in the primary region | Failure of one datacenter (zone) | | GRS | Three copies LRS-style in the primary region + three in a secondary region | Failure of the entire primary region | | GZRS | Three copies ZRS-style in the primary region + three in a secondary region | Both zone failures and region failures |
Exam tip: Options with an RA- prefix, RA-GRS and RA-GZRS, let you read data from the secondary region even when nothing is wrong. If the question says "read from the secondary region even without an outage," the answer is an RA- option.
AzCopy vs Storage Explorer vs File Sync vs Data Box vs Azure Migrate
| Tool | Form | When to use it | |------|------|------| | AzCopy | Command-line tool | Bulk-copy blobs and files in one go from a script | | Azure Storage Explorer | Desktop GUI app | Browse and manage storage accounts on screen | | Azure File Sync | Sync service | Keep Windows file servers and Azure Files continuously in sync | | Azure Data Box | Physical device | Ship large data sets that are hard to move over the network | | Azure Migrate | Migration hub | Assess servers, databases, and web apps and move them to Azure |
Exam tip: "Copy once" versus "keep in sync" is what separates AzCopy from File Sync. If internet bandwidth is limited and the data runs to tens of terabytes, the answer is Data Box.
Microsoft Entra ID vs Microsoft Entra Domain Services
| Category | Microsoft Entra ID | Microsoft Entra Domain Services | |------|------|------| | What it is | A cloud identity and access management service | A managed domain service | | Key features | SSO, MFA, Conditional Access, app sign-in | Domain join, group policy, LDAP, Kerberos/NTLM authentication | | Clue in the question | "Access SaaS apps with a single sign-in" | "Move a legacy app without managing domain controllers yourself" |
Related posts: Defense in Depth and Advanced Entra ID Concepts
---
Domain 3: Look-Alike Pairs in Management and Governance
Every tool in domain 3 exists to "control" or "manage" something, so names alone rarely tell them apart. Separate them by what they control and by whether you use them before or after deployment.
Azure Policy vs RBAC vs Resource Locks
| Category | RBAC | Azure Policy | Resource locks | |------|------|------|------| | Question it answers | Who can do what? | Which rules must a resource follow? | How do I stop accidental deletion or changes? | | What it controls | Permissions of users, groups, and managed identities | Resource settings (region, SKU, tags, and so on) | A specific resource, resource group, or subscription | | Typ