AZ900Prep → Practice Questions

AZ-900 Practice Questions 2026

15 questions · All three domains · Full explanations · January 2026 objectives

These questions reflect the difficulty and style of the real AZ-900 exam. The exam is scenario-based — not "define this term" but "given this situation, which Azure service or feature applies?" Click any answer to see whether you got it right and read the full explanation. Your score tracks as you go.

Questions marked [NEW 2026] cover objectives added in the January 2026 update — these appear on your exam but are missing from older prep materials. See all 11 new objectives →
Score: 0 / 0
—
Domain 1: Cloud Concepts

Q1. Which cloud characteristic specifically refers to the ability to automatically increase AND decrease resources based on demand, ensuring you only pay for what you use at any given moment?

  1. High Availability
  2. Scalability
  3. Elasticity
  4. Reliability
Answer: C — Elasticity. Elasticity means automatic bidirectional scaling — up when demand rises, down when it falls. Scalability is the ability to scale but doesn't imply automatic or bidirectional adjustment. High Availability is about uptime. Reliability is about recovering from failures.
Domain 1: Cloud Concepts

Q2. Under the Shared Responsibility Model for PaaS, which tasks remain the customer's responsibility?

  1. Managing the physical network infrastructure
  2. Patching the host operating system
  3. Managing application data and user access
  4. Maintaining the hypervisor and virtualisation layer
Answer: C — Managing application data and user access. In PaaS, Microsoft manages the OS, runtime, middleware, hardware, and virtualisation. The customer manages applications, data, and who can access them. Memory aid: in SaaS you manage data and access only; in PaaS you add application management; in IaaS you also manage the OS and runtime.
Domain 1: Cloud Concepts

Q3. NEW 2026 A company's DR plan requires that no more than 4 hours of transaction data is lost in a catastrophic failure. Which metric describes this requirement?

  1. RTO (Recovery Time Objective)
  2. SLA (Service Level Agreement)
  3. RPO (Recovery Point Objective)
  4. MTTR (Mean Time to Repair)
Answer: C — RPO. Recovery Point Objective defines how much data can be lost — the maximum age of data that must be recoverable. In this case RPO = 4 hours. RTO defines how quickly systems must be restored (how much downtime is acceptable). Both are now formal AZ-900 January 2026 objectives.
Domain 2: Azure Architecture & Services

Q4. A developer stops a VM by shutting it down from within the Windows guest operating system. What is the billing impact?

  1. All billing stops immediately
  2. Compute billing stops but storage billing continues
  3. Compute billing continues because the VM is still allocated
  4. Only licensing costs continue
Answer: C — Compute billing continues. Stopping from the guest OS puts the VM into a Stopped (but still Allocated) state. Azure still reserves compute resources and bills for them. To stop compute billing you must Deallocate the VM via the Azure Portal, CLI, or API. Storage costs continue in both cases.
Domain 2: Azure Architecture & Services

Q5. A company needs a private connection to Azure from their data centre that does not travel over the public internet and offers guaranteed bandwidth. What should they use?

  1. Azure VPN Gateway
  2. Azure ExpressRoute
  3. Azure Virtual WAN
  4. Azure Bastion
Answer: B — Azure ExpressRoute. ExpressRoute is a private dedicated connection through a connectivity provider that never touches the public internet, with guaranteed bandwidth and lower latency. VPN Gateway encrypts traffic but sends it over the public internet. Bastion provides browser-based RDP/SSH access to VMs.
Domain 2: Azure Architecture & Services

Q6. Compliance documents must be retained for 7 years and accessed at most once every 2–3 years. Which Azure Blob Storage access tier has the lowest monthly storage cost?

  1. Hot
  2. Cool
  3. Cold
  4. Archive
Answer: D — Archive. Archive has the lowest storage cost and is designed for rarely accessed data. Trade-offs: data must be rehydrated (can take hours) before it can be read, and a 180-day minimum storage period applies. For compliance documents accessed once every 2–3 years with no urgency, Archive is the optimal economic choice.
Domain 2: Azure Architecture & Services

Q7. NEW 2026 An application in Azure App Service needs to read secrets from Azure Key Vault without storing any credentials in code. What is the recommended approach?

  1. Store the Key Vault access key in an environment variable
  2. Create a service principal and store its secret in a config file
  3. Assign a Managed Identity to the App Service and grant it Key Vault access
  4. Use a shared access signature stored in application settings
Answer: C — Managed Identity. Managed Identity lets App Service authenticate to Key Vault using an auto-managed Entra ID identity — no credentials to create, store, or rotate. This solves the "secret zero" problem. System-Assigned Managed Identity is tied to one resource; User-Assigned can be shared across multiple resources.
Domain 2: Azure Architecture & Services

Q8. NEW 2026 A company needs to process e-commerce orders reliably, with guaranteed delivery, message ordering, and a dead-letter queue for failed messages. Which Azure messaging service should they use?

  1. Azure Event Grid
  2. Azure Event Hubs
  3. Azure Service Bus
  4. Azure Notification Hubs
Answer: C — Azure Service Bus. Service Bus is the enterprise message broker designed for reliable transactional messaging: guaranteed delivery, FIFO ordering, duplicate detection, dead-letter queues, and transactions. Event Hubs is for high-throughput event streaming (IoT telemetry, logs). Event Grid routes events to handlers reactively. Notification Hubs sends mobile push notifications.
Domain 2: Azure Architecture & Services

Q9. NEW 2026 Which statement accurately describes the relationship between ARM Templates and Bicep?

  1. Bicep replaces ARM Templates and is incompatible with them
  2. ARM Templates offer more capabilities than Bicep
  3. Bicep is a domain-specific language that compiles to ARM JSON and has equivalent capabilities
  4. Bicep requires a separate Azure deployment service
Answer: C — Bicep compiles to ARM JSON. Bicep produces identical results to ARM Templates — it is a cleaner syntax that generates ARM JSON during deployment. Every ARM capability is available in Bicep. Both are declarative, idempotent, and version-control friendly. Microsoft considers Bicep the preferred approach for new projects.
Domain 2: Azure Architecture & Services

Q10. NEW 2026 A company's Global Administrator is attempting to manage Azure resources but is being denied access. What is the most likely reason?

  1. Global Administrators automatically have Owner access to all Azure subscriptions
  2. Entra ID roles and Azure RBAC roles are separate systems — a Global Administrator has no Azure resource access by default
  3. The administrator needs to activate their role in Privileged Identity Management first
  4. Global Administrator only applies to Microsoft 365, not Azure
Answer: B — Entra ID roles and Azure RBAC roles are separate systems. Entra ID roles (like Global Administrator) manage the directory: users, groups, apps. Azure RBAC roles manage resources: VMs, storage, subscriptions. A Global Administrator has zero Azure resource access by default and must be explicitly granted an Azure RBAC role.
Domain 3: Management & Governance

Q11. Which Azure tool should you use BEFORE a cloud migration to compare the total cost of running a workload on-premises vs on Azure?

  1. Azure Cost Management + Billing
  2. Azure Pricing Calculator
  3. Azure TCO Calculator
  4. Azure Advisor
Answer: C — Azure TCO Calculator. The Total Cost of Ownership Calculator is specifically designed to compare on-premises infrastructure cost vs Azure — it builds the business case for migration. Azure Pricing Calculator estimates what an Azure deployment would cost. Cost Management + Billing tracks actual spend after deployment. Advisor gives recommendations once you are on Azure.
Domain 3: Management & Governance

Q12. An Azure Policy with which effect BLOCKS the creation of non-compliant resources before they are deployed?

  1. Audit
  2. Deny
  3. Append
  4. DeployIfNotExists
Answer: B — Deny. The Deny effect evaluates resource creation requests and rejects those that don't comply with the policy before they succeed. Audit logs non-compliance without blocking. Append adds fields to the resource. DeployIfNotExists auto-deploys a companion resource when one is missing.
Domain 3: Management & Governance

Q13. A Contributor on a resource group tries to delete a VM and is blocked. No error about permissions appears — just a refusal. What is the most likely cause?

  1. Contributors cannot delete VMs, only Owners can
  2. A Resource Lock is applied to the VM or resource group
  3. The VM must be stopped before it can be deleted
  4. Contributor requires MFA to perform deletions
Answer: B — A Resource Lock. Resource Locks override RBAC. Even an Owner cannot delete a locked resource — they must remove the lock first. CanNotDelete locks prevent deletion while allowing read and modify. ReadOnly locks prevent all changes. Contributor has full resource management including deletion when no lock is present.
Domain 3: Management & Governance

Q14. NEW 2026 A company wants to reduce Azure compute costs with flexibility to change VM sizes as workloads evolve over the next year. Which cost commitment tool is most appropriate?

  1. Azure Reservations for a specific VM SKU
  2. Azure Savings Plans with a fixed hourly commitment
  3. Azure Spot VMs for all production workloads
  4. Azure Hybrid Benefit for Windows licences
Answer: B — Azure Savings Plans. Savings Plans commit to a fixed hourly spend ($/hour) that applies to any eligible compute regardless of VM size, series, or region — exactly the flexibility needed when workloads change. Azure Reservations lock in a specific VM SKU and region (less flexible, potentially higher discount). Spot VMs can be evicted and are unsuitable for production workloads.
Domain 3: Management & Governance

Q15. A company needs to verify their environment's compliance with ISO 27001 and download Microsoft's actual ISO 27001 audit report. Which tools provide each of these?

  1. Azure Security Center for compliance, Azure Policy for reports
  2. Microsoft Defender for Cloud for compliance posture, Service Trust Portal for audit reports
  3. Azure Monitor for compliance, Azure Advisor for reports
  4. Azure Blueprints for compliance, Azure Arc for reports
Answer: B — Defender for Cloud and Service Trust Portal. Microsoft Defender for Cloud includes a Regulatory Compliance dashboard showing your posture against standards like ISO 27001. The Service Trust Portal is where Microsoft publishes the actual third-party audit reports and certifications for Azure — you log in to download them. The Microsoft Trust Center is the public overview page; the STP is where the reports live.

525 more questions in the full bundle

Five practice modes including Wrong Only and Smart Mix — so you always drill where you need to. Full explanation on every question. Weighted to the real exam domain proportions.

Get all 540 questions →

About these questions

All 15 questions are written from scratch against the published January 2026 AZ-900 exam objectives. They are not exam dumps. The real AZ-900 is 40–60 questions in 45–60 minutes with a passing score of 700/1000. Questions are scenario-based — not definitions, but "given this situation, which Azure service applies?"

Scoring consistently above 80% on practice sets is a strong indicator you are ready to book. Run practice tests across all three domains before your exam date, paying particular attention to Domain 3 (Management & Governance), which is 30–35% of the exam and the most commonly under-studied.