Azure Fundamentals (AZ-900) · 38% practice allocation

Azure AZ-900: Describe Azure architecture and services Practice Questions

5 free sample questions from the Describe Azure architecture and services domain, with answers and explanations. The full AZ-900 bank has 60 questions across 3 domains. Questions are scenario-based and written from the official Azure exam guide.

1.

What is the correct hierarchy of Azure's management scopes, from TOP (broadest) to BOTTOM (most specific)?

  • A. Subscriptions → Management groups → Resource groups → Resources
  • B. Management groups → Subscriptions → Resource groups → Resources✓ Correct
  • C. Management groups → Resource groups → Subscriptions → Resources
  • D. Resource groups → Subscriptions → Management groups → Resources
Explanation

The Azure hierarchy is: management groups (organize multiple subscriptions) → subscriptions (billing and access boundary) → resource groups (logical containers for resources) → resources. Policies and access applied at a higher scope inherit downward. The other options scramble this order — remember that management groups sit above subscriptions, and resource groups live inside subscriptions.

2.

Which concept describes the security model that assumes breach, verifies every request explicitly regardless of network location, and applies least-privilege access?

  • A. Consumption-based security
  • B. Zero Trust✓ Correct
  • C. Perimeter-based security
  • D. Defense-in-depth's physical layer
Explanation

Zero Trust is built on three principles: verify explicitly, use least-privilege access, and assume breach — trust is never granted based on network location. Perimeter-based security (C) is the older 'trusted inside the firewall' model Zero Trust replaces. Option D names one layer of a different (complementary) model. Option A is a made-up term blending billing with security.

3.

A team needs to run a short-lived, event-driven piece of code every time a file lands in storage, with no servers to manage and per-execution billing. Which Azure compute service fits BEST?

  • A. Azure Kubernetes Service (AKS)
  • B. Azure Virtual Desktop
  • C. Azure Functions✓ Correct
  • D. Azure Virtual Machines
Explanation

Azure Functions is Azure's serverless, event-driven compute service — it triggers on events (like a blob upload), scales automatically, and bills per execution. VMs (D) require full infrastructure management. AKS (A) runs containerized workloads but you still manage clusters and node pools — heavyweight for one event-driven task. Azure Virtual Desktop (B) delivers remote desktops to users, not event-driven code.

4.

A company requires a private, dedicated connection from its on-premises datacenter to Azure that does NOT traverse the public internet, with predictable bandwidth for large data volumes. Which option meets this requirement?

  • A. Site-to-site VPN over the internet
  • B. Point-to-site VPN
  • C. ExpressRoute✓ Correct
  • D. Azure DNS
Explanation

ExpressRoute provides a private, dedicated circuit between on-premises infrastructure and Azure through a connectivity provider — it never touches the public internet and offers predictable, high bandwidth. Point-to-site (B) connects individual devices over the internet; site-to-site VPN (A) is encrypted but still rides the public internet with variable performance. Azure DNS (D) resolves names; it's not a connectivity service.

5.

Users complain about entering passwords repeatedly across company applications, and IT wants to reduce password-related attacks. Which TWO Microsoft Entra ID capabilities directly address these goals? (Select 2)

  • A. Single sign-on (SSO), so one authentication grants access to multiple applications✓ Correct
  • B. Disabling authentication entirely for internal apps
  • C. Passwordless authentication methods such as Windows Hello, FIDO2 keys, or the Authenticator app✓ Correct
  • D. Azure DNS private zones
  • E. Storing all passwords in a shared spreadsheet
Explanation

SSO removes repeated password prompts by letting one sign-in grant access to multiple applications, and passwordless methods (Hello, FIDO2, Authenticator) remove the password as an attack surface. Options B and E are dangerous anti-practices, not capabilities. Option D is a name-resolution feature with no relation to authentication.

Test yourself across every AZ-900 domain

The free AZ-900 practice test mixes about 20 questions weighted like the exam. The full 60-question bank adds instant grading, flashcards and a timed mock exam.

Take the free AZ-900 practice testPractice the full bank

Study this domain

Describe Azure architecture and services study guide (AZ-900) →

Other AZ-900 domains

← All Azure Fundamentals study resources