Question bank
Microsoft Certified: Azure Fundamentals
42 Microsoft Certified: Azure Fundamentals questions with the correct answer and a written explanation, organised across 3 exam domains.
- 42 questions
- 3 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Describe Azure architecture and services
15 questions in this domain
- Question 1Single Choice
What is the main function of a resource group in Azure?
- ATo define geographical boundaries for data residency
- BTo provide high availability within a region
- CTo logically group related resources for lifecycle managementCorrect answer
- DTo encrypt data at rest
Why this is the answer
A resource group is a logical container that holds related resources, enabling shared lifecycle and management.
- Question 2Multiple Select
Which of the following are PaaS compute services in Azure? (Choose all that apply)
- AAzure Virtual Machines
- BAzure App ServiceCorrect answer
- CAzure FunctionsCorrect answer
- DAzure Container InstancesCorrect answer
Why this is the answer
Azure App Service, Functions, and Container Instances are all managed platform services abstracting underlying infrastructure.
- Question 3Interactive
Examine the ARM template. What Azure resource does it create?
- AAzure Virtual Network
- BAzure VPN GatewayCorrect answer
- CAzure Load Balancer
- DAzure DNS
Why this is the answer
The template deploys a virtual network gateway of type 'Vpn', which is an Azure VPN Gateway.
- Question 4Single Choice
Which service should you use to migrate a legacy app needing full OS control?
- AAzure Functions
- BAzure App Service
- CAzure Virtual MachinesCorrect answer
- DAzure Container Instances
Why this is the answer
Virtual Machines provide full control over the OS and software, suitable for legacy migrations.
- Question 5Multiple Select
Select the correct statements about Azure Load Balancer.
- AOperates at Layer 7
- BDistributes traffic across backend resourcesCorrect answer
- CSupports health probesCorrect answer
- DProvides SSL termination
Why this is the answer
Load Balancer works at Layer 4, distributes traffic, and uses health probes to remove unhealthy instances.
- Question 6Interactive
In the CLI command, which redundancy option is specified?
- ALocally Redundant Storage (LRS)
- BGeo-Redundant Storage (GRS)Correct answer
- CZone-Redundant Storage (ZRS)
- DRead-Access Geo-Redundant Storage (RA-GRS)
Why this is the answer
The SKU Standard_GRS specifies Geo-Redundant Storage, which replicates data to a secondary region.
- Question 7Single Choice
Which service offers a private, dedicated network connection to Azure?
- AAzure VPN Gateway
- BAzure ExpressRouteCorrect answer
- CAzure Application Gateway
- DAzure DNS
Why this is the answer
ExpressRoute establishes a private connection to Azure, not using the public internet, offering higher reliability and lower latency.
- Question 8Multiple Select
Select the Azure Storage redundancy options that enable reading from the secondary region.
- ALocally Redundant Storage (LRS)
- BRead-Access Geo-Redundant Storage (RA-GRS)Correct answer
- CGeo-Redundant Storage (GRS)
- DRead-Access Geo-Zone Redundant Storage (RA-GZRS)Correct answer
Why this is the answer
RA-GRS and RA-GZRS both allow read access to the secondary region, while GRS and GZRS do not.
- Question 9Interactive
Based on the connection string, which database service is targeted?
- AAzure Cosmos DB
- BAzure SQL DatabaseCorrect answer
- CAzure Database for MySQL
- DAzure Synapse Analytics
Why this is the answer
The connection string format 'Server=tcp:*.database.windows.net' is typical for Azure SQL Database.
- Question 10Single Choice
Which storage service is best for storing large binary objects?
- AAzure Blob StorageCorrect answer
- BAzure Disk Storage
- CAzure Files
- DAzure Queue Storage
Why this is the answer
Blob Storage is optimized for massive amounts of unstructured object data such as images, videos, and backups.
- Question 11Multiple Select
Select the correct statements regarding Azure Cosmos DB.
- AIt is a globally distributed database serviceCorrect answer
- BIt supports only the SQL API
- CIt offers tunable consistency levelsCorrect answer
- DIt provides single-digit millisecond latencyCorrect answer
Why this is the answer
Cosmos DB is globally distributed, offers multiple consistency models, guarantees low latency, and supports multiple APIs.
- Question 12Interactive
What does this CLI command do in terms of access management?
- AAssigns the Reader role to the user
- BAssigns the Contributor role to the user at resource group scopeCorrect answer
- CAssigns the Owner role to the user
- DRemoves all role assignments for the user
Why this is the answer
The command assigns the Contributor role to the specified user for the specified resource group.
- Question 13Single Choice
For petabyte-scale analytics, which Azure database service is recommended?
- AAzure SQL Database
- BAzure Database for PostgreSQL
- CAzure Cosmos DB
- DAzure Synapse AnalyticsCorrect answer
Why this is the answer
Synapse Analytics is purpose-built for massive parallel processing and petabyte-scale analytics, unlike OLTP databases.
- Question 14Multiple Select
Select the features that belong to Microsoft Entra ID.
- AMulti-Factor AuthenticationCorrect answer
- BConditional AccessCorrect answer
- CAzure Role-Based Access Control
- DSelf-Service Password ResetCorrect answer
Why this is the answer
MFA, Conditional Access, and SSPR are all features within Microsoft Entra ID. RBAC is a separate authorization system.
- Question 15Interactive
What high-availability feature is being configured in this template?
- AAvailability zonesCorrect answer
- BRegion pairs
- CResource groups
- DAzure Resource Manager
Why this is the answer
The 'zones' property indicates the VM is deployed across availability zones for fault tolerance within a region.
Describe Azure management and governance
16 questions in this domain
- Question 16Interactive
An administrator runs the following Azure CLI command: `az policy assignment create --name 'DenyUnmanagedDisks' --policy 'abc123' --scope /subscriptions/00000000-0000-0000-0000-000000000000`. What is the effect of this command?
- AIt creates a new policy definition
- BIt assigns an existing policy definition to the specified subscription scopeCorrect answer
- CIt modifies the policy definition's effect to 'Deny'
- DIt removes all previous policy assignments from the subscription
Why this is the answer
The command assigns an existing policy definition (referenced by ID 'abc123') to the subscription scope. A policy assignment enforces the policy's rules (e.g., Deny unmanaged disks) on resources within that scope.
- Question 17Interactive
A developer runs the following Azure CLI command: `az group create --name MyResourceGroup --location eastus`. What is the result of this command?
- AIt deploys a set of Azure resources into a new resource group
- BIt creates a new, empty resource group in the East US regionCorrect answer
- CIt creates a virtual machine named MyResourceGroup
- DIt creates a management group for organizing subscriptions
Why this is the answer
The command creates a new resource group named 'MyResourceGroup' in the 'eastus' location. Resource groups are logical containers for resources and do not contain any resources at creation time unless specified.
- Question 18Interactive
An administrator creates a policy definition with the following JSON: it checks if the resource location is in a list of allowed regions. What type of effect would block non-compliant resource creation?
- AAudit
- BDenyCorrect answer
- CAppend
- DDeployIfNotExists
Why this is the answer
The 'Deny' effect blocks resource creation or update if the condition is met. 'Audit' only logs non-compliance but allows creation. 'Append' adds fields and 'DeployIfNotExists' deploys additional resources.
- Question 19Single Choice
Which Azure tool provides automated recommendations to improve cost, security, reliability, performance, and operational excellence?
- AAzure Monitor
- BAzure AdvisorCorrect answer
- CAzure Service Health
- DAzure Cost Management
Why this is the answer
Azure Advisor is a built-in recommendation engine that provides suggestions in five categories: cost, security, reliability, performance, and operational excellence. Azure Monitor collects telemetry, Service Health reports platform issues, and Cost Management tracks billing.
- Question 20Multiple Select
Which of the following are benefits of using Azure management groups? (Choose all that apply.)
- AThey allow applying policies across multiple subscriptions at once.Correct answer
- BThey can directly contain Azure resources such as VMs.
- CThey enable inheritance of RBAC assignments to all subscriptions in the hierarchy.Correct answer
- DThey can be nested up to six levels deep for organizational structure.Correct answer
Why this is the answer
Management groups are containers for subscriptions only, not resources. They allow policy and RBAC inheritance across all subscriptions in the hierarchy and can be nested up to six levels.
- Question 21Interactive
An administrator runs the following Azure PowerShell cmdlet: `Get-AzResourceGroup -Name MyResourceGroup`. What information does this command retrieve?
- AIt deletes the specified resource group and all its resources
- BIt returns the properties (name, location, tags) of the specified resource groupCorrect answer
- CIt creates a new resource group with that name
- DIt lists all virtual machines inside the resource group
Why this is the answer
The `Get-AzResourceGroup` cmdlet retrieves information about one or more resource groups. Here it targets a specific resource group by name and returns its metadata such as location, tags, and provisioning state.
- Question 22Single Choice
How can you prevent accidental deletion of an Azure resource group and all its resources?
- AAssign the Reader role to all users
- BApply a CanNotDelete lock on the resource groupCorrect answer
- CUse Azure Policy to deny delete operations
- DAdd a tag named 'DoNotDelete'
Why this is the answer
A CanNotDelete lock prevents deletion of the resource group and all resources within it. Locks override RBAC permissions, so even an Owner cannot delete. RBAC roles and Azure Policy cannot prevent deletion of existing resources.
- Question 23Multiple Select
Which of the following are built-in RBAC roles in Azure? (Choose all that apply.)
- AOwnerCorrect answer
- BContributorCorrect answer
- CReaderCorrect answer
- DAdministrator
Why this is the answer
The three most common built-in roles for AZ-900 are Owner, Contributor, and Reader. 'Administrator' is not a built-in RBAC role in Azure (there are roles like 'User Access Administrator' but not plain 'Administrator').
- Question 24Interactive
An administrator uses the following Azure CLI command to add metadata to a storage account: `az resource tag --tags Environment=Production --resource-group MyRG --resource-name mystorageaccount --resource-type Microsoft.Storage/storageAccounts`. What is the main purpose of adding this tag?
- ATo enforce the storage account to only accept production traffic
- BTo categorize the storage account for cost tracking and managementCorrect answer
- CTo grant the 'Production' security group access to the storage account
- DTo create a backup of the storage account in the Production region
Why this is the answer
Tags are metadata key-value pairs used for organizing resources, grouping cost reports, and filtering. Applying a tag like Environment=Production helps in cost allocation and management, but does not affect security or behavior.
- Question 25Single Choice
What is the main difference between the Azure Pricing calculator and the Total Cost of Ownership (TCO) calculator?
- AThe Pricing calculator estimates costs for new workloads, while the TCO calculator compares on-premises vs. Azure costs.Correct answer
- BThe Pricing calculator is for virtual machines only, while the TCO calculator covers all services.
- CThe TCO calculator is used during migration, while the Pricing calculator is used after deployment.
- DBoth calculators serve the same purpose but the Pricing calculator is more accurate.
Why this is the answer
The Pricing calculator estimates monthly costs for new or modified Azure deployments based on user-configured resources. The TCO calculator is used before migration to compare the total cost of running current on-premises workloads versus migrating to Azure.
- Question 26Single Choice
Fabrikam GmbH is planning to migrate its on-premises ERP system to Azure. The ERP runs on two physical servers with 64 GB RAM and 8 cores each, plus 5 TB of SAN storage. The CIO demands a detailed business case comparing the total cost of ownership over three years. The IT manager has no existing license agreement for Windows Server. Which tool and pricing model should the architect recommend to justify the migration and minimize compute costs for the steady-state workload?
- AUse the Azure Pricing Calculator to estimate monthly costs and then select Reserved Instances for a one-year term to get the best discount.
- BUse the Total Cost of Ownership (TCO) Calculator to compare on-prem vs. Azure costs, then purchase Reserved Instances for three years to achieve maximum savings on compute.Correct answer
- CUse the Azure Pricing Calculator to obtain a monthly estimate, then apply Azure Hybrid Benefit to reduce Windows Server licensing costs.
- DUse the Total Cost of Ownership (TCO) Calculator to show savings, then select Pay-as-you-go because the workload may change after migration.
Why this is the answer
The TCO calculator is designed specifically for comparing on-premises infrastructure costs with Azure, making it the correct pre-migration tool for building a business case. Since the workload is stable and the company has no existing licenses, Reserved Instances (especially three-year) provide the highest discount (up to 72%) for steady-state compute. Azure Hybrid Benefit does not apply because there are no eligible licenses. The Pricing calculator is for estimating new Azure deployments, not for comparing on-prem vs. cloud.
- Question 27Multiple Select
A large financial institution must enforce PCI DSS compliance across 20 subscriptions used by different lines of business. The compliance team wants to ensure that (1) all storage accounts use encryption at rest, (2) no public IP addresses are assigned to virtual machines, (3) a specific set of regulatory controls is audited continuously, and (4) the evidence for audits is collected automatically. Which two Azure services should be combined to achieve these goals with minimal administrative overhead? (Choose two.)
- AAzure Policy with built-in PCI DSS initiativeCorrect answer
- BAzure Blueprints to deploy the environment
- CMicrosoft Purview for data classification
- DAzure Compliance Manager in the Service Trust PortalCorrect answer
Why this is the answer
Azure Policy (with the built-in PCI DSS initiative) can enforce encryption and deny public IPs across all subscriptions via management group scoping, and the Regulatory Compliance dashboard provides continuous monitoring. Compliance Manager (in the Service Trust Portal) helps track controls, assign actions, and collect evidence for audits. Blueprints are for initial deployment, not continuous enforcement or audit evidence collection. Purview focuses on data governance, not resource compliance or audit evidence.
- Question 28Interactive
You are the cloud architect for a global e-commerce company. Your operations team needs to automate the deployment of a standardized network topology (VNet, subnets, NSGs) and enforce a policy that all virtual machines must use managed disks and be tagged with 'Environment' and 'CostCenter'. The deployment must be repeatable across multiple subscriptions in different management groups. You decide to use a combination of Azure tools. Review the following code snippet that represents a core part of your solution. Identify which Azure service this snippet belongs to and explain its role in the overall governance strategy.
- AThis is an Azure Policy definition that assigns a built-in initiative with deny effects for managed disks and required tags.
- BThis is an Azure Blueprint artifact that packages ARM templates and policy assignments for a compliant environment.Correct answer
- CThis is an ARM template that deploys a VNet and assigns RBAC roles to network contributors.
- DThis is an Azure Resource Graph query that retrieves all non-compliant resources for tagging enforcement.
Why this is the answer
The code snippet shows a Blueprint artifact (blueprint.json) that includes a policy assignment for the 'Require managed disks' initiative and an ARM template for the network topology. Azure Blueprints orchestrate the deployment of policies, RBAC, and templates as a single, versioned unit, enabling repeatable and compliant environments across multiple subscriptions. This is superior to using only ARM templates (which lack policy enforcement) or individual policies (which require separate assignments).
- Question 29Single Choice
Contoso, a multinational conglomerate, has 15 Azure subscriptions organized under three management groups: 'Research', 'Sales', and 'IT-Ops'. The CIO wants to grant the 'IT Security' team read-only access to all subscriptions in the 'Research' and 'IT-Ops' management groups, but not to 'Sales'. Additionally, they must enforce a policy that all resources across the entire tenant must use the 'CostCenter' tag. What is the most efficient way to implement these requirements?
- AAssign the Reader role at the root management group and add an explicit deny assignment for the Sales management group.
- BAssign the Reader role to the 'IT Security' group on the 'Research' and 'IT-Ops' management groups individually, and assign the tag policy at the root management group.Correct answer
- CAssign the Reader role at the root management group and use Azure Policy with a deny effect to block access to Sales resources.
- DCreate a custom role with read permissions and assign it at the subscription level for each of the 10 subscriptions in Research and IT-Ops, then assign the tag policy at each management group.
Why this is the answer
RBAC assignments at the management group level are inherited by all subscriptions under that group, so assigning Reader on the two required management groups grants access efficiently without affecting Sales. The tenant-wide tag policy is best assigned at the root management group so it applies to all subscriptions. Assigning at root for RBAC would also give access to Sales, which is not desired. Azure Policy cannot block RBAC permissions. Subscription-level assignments would require 10 manual assignments, which is not efficient.
- Question 30Multiple Select
The IT operations team at a hospital chain notices that monthly Azure costs have exceeded the budget by 20% for two consecutive months. The finance director demands immediate actions to prevent further overruns while maintaining availability for critical patient record systems. The environment consists of 50 VMs, multiple storage accounts, and an Azure SQL database. Which two actions should the team prioritize to gain control over costs and enforce financial accountability? (Choose two.)
- AImmediately shut down all non-production VMs during off-hours using automation runbooks.
- BCreate a budget in Azure Cost Management with alerts at 80% and 100% of budget, and set up an action group to notify the finance team.Correct answer
- CReview the cost analysis view in Azure Cost Management to identify which services or resources caused the spike.Correct answer
- DPurchase three-year Reserved Instances for all VMs to lock in lower rates immediately.
Why this is the answer
The first step is always to analyze the cost breakdown in Cost Management to understand the root cause of the overspend. Then, setting up budgets and alerts provides proactive governance for future periods. Shutting down VMs without analysis could impact availability and may not address the root cause. Buying RIs without knowing which VMs are stable could lock in costs for underutilized resources. The order should be: diagnose, then implement controls.
- Question 31Interactive
You are the Azure administrator for a software company that uses a DevOps pipeline to deploy infrastructure. The team reported that a production database was accidentally deleted by a junior engineer who had Contributor rights on the resource group. You need to prevent this without removing the engineer's ability to manage other resources. Your solution must also ensure that tagging requirements ('Environment', 'CostCenter') are enforced at resource creation. Examine the following PowerShell script that your team plans to use. Identify the key flaw in this script's approach to governance.
- AThe script does not remove the Contributor role from the junior engineer, so they can still delete resources until the lock is applied.
- BThe script applies the lock at the resource group level, which does not protect individual resources inside the group.
- CThe script only applies the lock after the policy is assigned, leaving a window where resources can be created without tags.Correct answer
- DThe script does not use -Force parameter, so the lock command will fail if a conflicting lock exists.
Why this is the answer
The script first assigns the Azure Policy for required tags, then applies the lock. However, the lock is applied only after the policy assignment. If a new resource is created between the policy assignment and the lock application (or if the lock fails), that resource is unprotected. The correct order is to apply the lock first to prevent any future deletions, then assign the policy for tagging. Additionally, the lock itself does not affect the engineer's ability to create resources; the lock only prevents delete/modify actions once applied.
Describe cloud concepts
11 questions in this domain
- Question 32Single Choice
Which cloud computing benefit ensures that applications remain operational even if one component fails by using redundant infrastructure across multiple availability zones?
- AHigh availabilityCorrect answer
- BScalability
- CSecurity
- DGovernance
Why this is the answer
High availability (HA) is the ability of a system to remain operational despite component failures. Azure achieves HA through redundancy across Availability Zones (physically separate datacenters within a region). Scalability deals with capacity adjustment, security with protection, and governance with policies and compliance.
- Question 33Multiple Select
Which of the following Azure services are classified as Platform-as-a-Service (PaaS)? (Select all that apply.)
- AAzure App ServiceCorrect answer
- BAzure Virtual Machines
- CAzure SQL DatabaseCorrect answer
- DMicrosoft 365
Why this is the answer
Azure App Service and Azure SQL Database are PaaS services because they provide a managed platform where customers deploy applications or databases without managing the underlying OS. Azure VMs are IaaS (customer manages OS). Microsoft 365 is SaaS.
- Question 34Interactive
Refer to the code block. Which cloud service model does the command represent?
- AInfrastructure-as-a-Service (IaaS)Correct answer
- BPlatform-as-a-Service (PaaS)
- CSoftware-as-a-Service (SaaS)
- DOn-premises virtualization
Why this is the answer
The command 'az vm create' deploys a virtual machine, which is an IaaS resource. The customer manages the OS, middleware, and applications on that VM, while Azure manages the physical host and hypervisor.
- Question 35Single Choice
In the shared responsibility model for cloud security, which of the following is the responsibility of the cloud customer when using Infrastructure-as-a-Service (IaaS)?
- APatching the operating system running inside the virtual machineCorrect answer
- BSecuring the physical datacenter
- CMaintaining the hypervisor
- DReplacing failed network switches
Why this is the answer
In IaaS, the cloud provider manages the physical infrastructure (datacenter, servers, network, hypervisor). The customer is responsible for everything inside the VM, including the operating system, applications, data, and network security configurations.
- Question 36Multiple Select
Which of the following are characteristics of the consumption-based (pay-as-you-go) pricing model? (Select all that apply.)
- ANo upfront capital expenditure requiredCorrect answer
- BCosts increase linearly with resource usageCorrect answer
- CYou are billed a fixed monthly fee regardless of usage
- DResources must be pre-provisioned for peak demand to avoid overspending
Why this is the answer
The consumption-based model shifts costs from CapEx to OpEx: you pay only for what you use, with no upfront investment. Costs increase with usage, but you can reduce them by scaling down. Fixed fees are typical of reserved capacity, not pay-as-you-go. Pre-provisioning for peak is a traditional on-premises approach; cloud allows dynamic scaling.
- Question 37Interactive
Examine the code block. This Azure Policy definition enforces a rule. Which cloud concept does this rule primarily support?
- AGovernanceCorrect answer
- BHigh availability
- CScalability
- DDisaster recovery
Why this is the answer
Azure Policy is a governance tool that enforces organizational rules (e.g., requiring tags or restricting regions) to ensure compliance and consistency. It does not directly provide high availability, scalability, or disaster recovery.
- Question 38Single Choice
Which cloud deployment model is characterized by a single-tenant environment that can be hosted on-premises or by a third-party provider exclusively for one organization?
- APrivate cloudCorrect answer
- BPublic cloud
- CHybrid cloud
- DMulti-cloud
Why this is the answer
A private cloud is dedicated to a single organization, providing maximum control over security and compliance. It can be hosted on-premises or in a third-party datacenter as long as the infrastructure is not shared (single-tenant).
- Question 39Multiple Select
Which of the following are considerations or challenges of using cloud services that organizations must plan for? (Select all that apply.)
- AVendor lock-inCorrect answer
- BUnpredictable costs if not properly monitoredCorrect answer
- CAutomatic compliance with all regulations
- DElimination of all security responsibilities
Why this is the answer
Cloud computing introduces risks such as vendor lock-in (dependency on a specific provider), cost variability without governance, and compliance complexity under the shared responsibility model. The provider does not automatically make you compliant, and security responsibilities are shared, not eliminated.
- Question 40Interactive
Analyze the code block. Which concept does this infrastructure deployment primarily illustrate?
- AHigh availabilityCorrect answer
- BScalability
- CGovernance
- DCost management
Why this is the answer
The Bicep code deploys two virtual machines in separate availability zones (zone1 and zone2) behind a load balancer. This architecture is designed to provide high availability by ensuring that if one zone fails, the VM in the other zone continues serving traffic.
- Question 41Single Choice
Which cloud service model provides the customer with the most control over the operating system and network configuration?
- AInfrastructure-as-a-Service (IaaS)Correct answer
- BPlatform-as-a-Service (PaaS)
- CSoftware-as-a-Service (SaaS)
- DFunction-as-a-Service (FaaS)
Why this is the answer
IaaS gives customers the highest level of control over the operating system, networking, and storage. PaaS abstracts the OS and runtime, while SaaS and FaaS provide even less control. IaaS is suitable when full OS customization is required.
- Question 42Multiple Select
Which of the following are examples of using governance in Azure to enforce organizational policies? (Select all that apply.)
- AApplying a policy to ensure all resources have a 'CostCenter' tagCorrect answer
- BConfiguring auto-scaling to add VMs when CPU exceeds 80%
- CRestricting resource creation to specific Azure regions using Azure PolicyCorrect answer
- DEnabling encryption at rest for a storage account
Why this is the answer
Governance involves creating policies and processes to control and audit resources. Tag enforcement and region restrictions are examples of Azure Policy, a governance tool. Auto-scaling is a scalability feature, and encryption is a security measure—not governance directly (though policies can enforce encryption).
Frequently asked questions
Everything about the Microsoft Certified: Azure Fundamentals question bank and how to use it.