Entry-level certification covering AZURE cloud basics, services, and pricing. No technical background required.
Cloud Service Benefits, Cloud Service Types, Shared Responsibility Model, IaaS/PaaS/SaaS
AZURE Regions & AZs, AZURE VM, AZURE Storage, AZURE Networking, AZURE AI Services
AZURE Cost Management, AZURE Policy, AZURE RBAC, AZURE Monitor, Microsoft Defender
Try real exam-style questions from the free sample set. Each answer comes with a full explanation.
A global e-commerce company wants to provide services for European customers. The company must comply with EU data protection regulations (GDPR) and must guarantee fast response times for European users.
What Azure concept should be utilized to simultaneously meet both of these requirements?
Answer: C. Azure Regions
A global e-commerce company must simultaneously satisfy two requirements: GDPR data residency compliance and fast response times for European users. Azure Regions are collections of datacenters in specific geographic locations, so selecting a European region ensures data is stored within the EU to meet GDPR compliance and reduces physical network distance to lower latency for users. Azure Regions is the only concept that addresses both requirements with a single selection.
Azure operates more than 60 regions worldwide, each consisting of one or more datacenters. GDPR includes data residency requirements mandating that personal data of EU citizens must be stored within the EU/EEA, and Azure technically guarantees this through region-specific data placement. Deploying services in a region close to users reduces physical network distance and shortens round-trip time (RTT). Region pairs also support disaster recovery and data redundancy within the same geographic boundary.
Availability Zones are frequently confused with Azure Regions. Availability Zones are physically separate datacenters within the same region, designed for fault isolation and high availability — they are not directly related to data sovereignty or geographic latency reduction. Management Groups and Resource Groups are resource management hierarchy tools with no bearing on where data is physically stored. When data sovereignty, GDPR, country-specific storage, and latency reduction are all mentioned together, choose Azure Regions.
A company wants to configure so that employees can access both on-premises internal systems and Azure-based cloud applications with just a single login.
Which Microsoft Entra ID feature meets this requirement?
Answer: C. SSO
A company wants its employees to access both on-premises internal systems and Azure-based cloud applications with just a single login. SSO (Single Sign-On) is the Microsoft Entra ID feature that allows accessing multiple systems and applications with one authentication without additional logins, precisely meeting this requirement. The scenario's core conditions of 'a single login' and 'integrated access to on-premises and cloud' match the definition of SSO.
SSO works by issuing a token upon the initial authentication that automatically handles all subsequent application access. It supports various protocols including SAML 2.0, OpenID Connect, OAuth 2.0, and Integrated Windows Authentication (IWA) to integrate with thousands of SaaS applications, and when synchronized with on-premises AD via Azure AD Connect, employees can use SSO for cloud apps with their existing credentials.
Option 1 (MFA) strengthens security through multifactor authentication but does not reduce the number of logins. Option 2 (Conditional Access) controls policy based on access conditions and has a different purpose from single-login convenience. Option 4 (Azure AD Connect) is an infrastructure component for implementing SSO, not SSO itself. When the exam presents keywords like 'single login,' 'unified access to multiple apps,' or 'on-premises and cloud,' select SSO.
A cloud administrator wants to prevent important Azure resources from being accidentally deleted or modified.
Which Azure feature can be applied to resources to restrict deletion or modification?
Answer: D. Azure Lock
In a scenario where a cloud administrator wants to prevent accidental deletion or modification of critical Azure resources, the key to determining the correct answer is identifying 'a direct protection mechanism that even RBAC Owner-role holders cannot bypass.' Azure Lock applies CanNotDelete or ReadOnly locks so that all users, including those with the Owner role, cannot delete or modify the resource without first removing the lock. Azure Policy or Azure RBAC alone cannot block deletion by Owner-role holders, making them insufficient as a final safeguard against accidental changes.
Azure Lock provides two types. A CanNotDelete lock allows reading and modification but blocks deletion, while a ReadOnly lock allows only reading and blocks both modification and deletion. Locks can be configured at three levels: subscription, resource group, and individual resource, and locks at a higher scope are automatically inherited by child resources. Removing a lock requires Microsoft.Authorization/locks/* permission, which is included only in the Owner or User Access Administrator roles.
Azure Policy is a tool for auditing and enforcing compliance of resource configurations, and Azure RBAC controls access through role assignments, but Owner-role holders can still delete resources. When an exam question mentions 'prevent accidental deletion,' 'block even Owners,' or 'restrict modification,' select Azure Lock (CanNotDelete or ReadOnly). If the question mentions 'compliance auditing,' consider Azure Policy instead.
A distribution company wants to migrate virtual machines, databases, and web applications currently running in their on-premises data center to the Azure cloud environment.
Which Azure service helps assess the current on-premises environment and develop a migration plan to Azure before starting the migration?
Answer: B. Azure Migrate
The MOST critical conditions in this scenario are evaluating the current on-premises environment and developing a migration plan before starting the migration. Azure Migrate is an integrated migration hub that automatically discovers and analyzes on-premises assets, assesses Azure migration readiness, and estimates expected costs — satisfying all three conditions. Azure Site Recovery is a replication service for disaster recovery, and Azure Backup is a data backup service.
Azure Migrate installs a lightweight appliance in the on-premises environment to automatically collect server specs, performance data, operating systems, installed software, and network dependencies. Based on collected data, it recommends appropriate Azure VM sizes, estimates post-migration monthly costs, and visualizes service dependency maps. It provides server migration tools, Azure Database Migration Service, and web app migration tools in a single hub for one-stop support across workload types.
AZ-900 exams frequently test the distinction between Azure migration-related services. For pre-migration assessment and planning, choose Azure Migrate; for disaster recovery and business continuity, choose Azure Site Recovery. For data backup and restore, choose Azure Backup; for database-specific migration, choose Azure Database Migration Service.
An operations team wants to track CPU, memory, and disk usage of virtual machines running on Azure in real time, and automatically receive alert notifications when specific thresholds are exceeded.
Which Azure service meets these requirements?
Answer: A. Azure Monitor
The two most critical requirements in this scenario are tracking VM CPU, memory, and disk utilization in real time, and automatically receiving alert notifications when specific thresholds are exceeded. Azure Monitor satisfies both requirements as Azure's unified monitoring service, collecting resource metrics in real time and automatically sending email, SMS, and webhook notifications when conditions are met through Alert Rules and Action Groups. Option 2 (Azure Service Health) notifies about Azure platform-level outages and maintenance, while Option 3 (Azure Advisor) provides usage pattern-based recommendations and differs from real-time metric monitoring.
Azure Monitor is a unified platform that collects metrics, logs, and traces. For virtual machines, host metrics such as CPU utilization, available memory, disk read/write, and network in/out are automatically collected without an agent. Alert rules are categorized as metric-based, log-based, and activity log-based, and when an alert fires, various automated actions can be triggered through Action Groups including email, SMS, Azure Functions execution, and ITSM integration.
When exam questions mention 'real-time metric monitoring,' 'tracking CPU, memory, and disk utilization,' or 'threshold-based automatic alert notifications,' select Azure Monitor. Azure Service Health is dedicated to Azure platform events (outages and maintenance), and Azure Advisor provides resource optimization recommendations. Option 4 (Azure Log Analytics) is a log data analysis tool within Azure Monitor, and the primary functions of real-time performance metric collection and threshold alerting are handled by Azure Monitor.
The Microsoft AZURE Fundamentals (AZ-900) exam consists of 50 questions with a 45-minute time limit.
The passing score for the AZ-900 exam is 700 out of 1000.
The AZ-900 sample set (20 questions with full explanations) is free. The full bank of 320+ questions is available with a CloudMasterIT subscription.