What the AZ-900 exam looks like
Microsoft is deliberately vague about question counts because exam forms differ. What is fixed is the scoring scale and the skills-measured breakdown, which is published and updated on the exam page.
| Item | Detail |
|---|---|
| Exam code | AZ-900 (Microsoft Azure Fundamentals) |
| Questions | Approximately 32-36; Microsoft does not publish an exact figure |
| Scoring | Scaled 100-1000, passing score 700 |
| Describe cloud concepts | 25-30% |
| Describe Azure architecture and services | 35-40% |
| Describe Azure management and governance | 30-35% |
- ✓Question formats include single-answer, multiple-response, drag-and-drop ordering and yes/no series where each statement is scored separately.
- ✓In a yes/no series you usually cannot go back, so read all statements before answering the first.
- ✓There is no penalty for a wrong answer, so never leave one blank.
Practice: cloud concepts
This domain is platform-neutral. If you have studied any cloud fundamentals, most of it will already be familiar - the risk is answering from AWS vocabulary instead of Azure's.
Which cloud service model gives you the most control over the operating system?
Infrastructure as a Service. You manage the operating system, runtime and application; the provider manages the physical infrastructure and virtualisation. Platform as a Service takes the operating system away from you, and Software as a Service leaves you managing only your data and users.
A company keeps some workloads in its own data centre and runs others in Azure, with connectivity between them. What is this called?
A hybrid cloud. Distinguish it from multi-cloud, which means using two or more public cloud providers - the presence of an on-premises data centre in the question is what makes it hybrid rather than multi-cloud.
Which pricing characteristic describes paying only for the resources you actually consume, with no upfront hardware purchase?
Consumption-based pricing, which converts capital expenditure into operational expenditure. Exam wording often contrasts CapEx and OpEx directly, so learn which is which: buying servers is CapEx, paying a monthly Azure bill is OpEx.
What does high availability mean in the context of an Azure workload?
That the workload stays accessible during expected disruptions such as a single component or data centre failing. Do not confuse it with disaster recovery, which is about restoring service after a major unplanned event, or with scalability, which is about handling changes in load.
Practice: Azure architecture and services
The largest domain. You are being asked to match a described need to a named Azure service, and to know the hierarchy that everything sits inside.
What is the relationship between a management group, a subscription and a resource group?
They nest from broad to narrow: management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources. A subscription is the billing and access boundary; a resource group is a logical container for resources that share a lifecycle. This hierarchy underpins most governance questions, so learn the order.
A company wants to migrate existing on-premises virtual machines to Azure with minimal changes. Which service?
Azure Virtual Machines. Lift-and-shift with minimal changes points at IaaS. If the question emphasised not managing servers or deploying only code, it would be pointing at Azure App Service or Azure Functions instead.
What does an Azure Availability Zone protect a workload against?
The failure of a single data centre within a Region. Availability Zones are physically separate locations inside one Region, each with independent power, cooling and networking. Region pairs, by contrast, protect against a Region-wide event.
Which Azure service provides identity and access management for users and applications?
Microsoft Entra ID. This was renamed from Azure Active Directory, and current exam content uses the Entra name - if your study material still says Azure AD, it predates the change. Note that Entra ID is not a cloud version of on-premises Active Directory Domain Services; that would be Microsoft Entra Domain Services.
Practice: management and governance
This is where AZ-900 differs most from comparable exams on other platforms, and where candidates lose the most marks. Three tools answer three different questions, and the exam constructs scenarios specifically to see whether you can tell them apart.
You must ensure nobody can delete a production resource group, including users with the Owner role. What do you use?
A resource lock set to CanNotDelete. This is the key distinction: role-based access control decides who is permitted to act, but a lock applies to everyone regardless of role, including owners. When a question says even administrators or regardless of permissions, it wants a lock.
The company requires that resources may only be created in specific Azure regions. What enforces this?
Azure Policy. Policy governs what may be created and how it must be configured - allowed regions, allowed SKUs, required tags - and can audit or block non-compliant deployments. RBAC would let you stop someone creating anything at all, but it cannot express a rule about which region is acceptable.
A finance analyst needs to view billing data but must not be able to change any resources. What is the correct approach?
Assign an appropriate read-only role through role-based access control. This is the who-can-do-what question, which is RBAC's job. Reach for Policy only when the constraint is about the properties of resources rather than the permissions of people.
Which tool would you use to estimate the cost of a planned Azure deployment before building it?
The Azure Pricing Calculator. Keep it separate from the Total Cost of Ownership calculator, which compares running workloads on-premises against Azure, and from Microsoft Cost Management, which tracks and analyses spend you have already incurred.
How AZ-900 differs from AWS Cloud Practitioner
If you have taken or studied for the AWS entry-level exam, most of the cloud concepts domain transfers directly. Two things do not.
The first is governance depth. AZ-900 expects you to reason about the management group and subscription hierarchy, Azure Policy, RBAC scope inheritance and resource locks as an interacting system. The AWS equivalent exam touches governance far more lightly.
The second is question format. Microsoft uses drag-and-drop ordering and yes/no statement series, which punish partial knowledge differently from straight multiple choice - you cannot eliminate your way to an answer. Practise in the format, not just on the content.