Prepstellar
Sign in Get it on Google Play

AZ-900 · Mock exam · 25 questions

AZ-900 mock exam: 25 free practice questions

Untimed here · timed and scored in the app

A free AZ-900 practice test with 25 exam-style questions drawn from the whole course and weighted by domain like the exam guide. Answer at your pace and read why each option is right or wrong.

  • 700 or greaterPassing score
  • Describe cloud concepts 25–30%
  • Describe Azure architecture and services 35–40%
  • Describe Azure management and governance 30–35%

Exam details from the vendor’s exam guide, captured 2026-08-30.

Swipe, scroll or use ← →

  1. Q1 / 25

    A team is deploying an HTTP-based application and wants Azure to maintain the hosting environment, scale the site, and integrate deployment. Which option fits?

    1. AAzure App Service managed web hosting
    2. BA customer-managed Azure virtual machine
    3. CAn Azure Virtual Desktop session
    4. DA virtual machine availability set
    Show the answer

    The clue is that your team wants Azure to manage the hosting environment while it focuses on the web application. App Service hosts web apps and REST APIs without requiring infrastructure management. It provides automatic scaling and integrated deployment and management. Its endpoints can be secured, and built-in load balancing distributes traffic.

    Next → 1 / 25

  2. Q2 / 25

    A company has predictable compute spending for the next three years, but its eligible compute services and virtual machine types may change. Which pricing choice best preserves that flexibility while reducing cost?

    1. ACommit to an hourly spend with Azure savings plan for compute.
    2. BUse pay-as-you-go with a three-year commitment.
    3. CReserve one specific virtual machine resource for the full three-year term.
    4. DRun every workload on Spot Virtual Machines and accept possible eviction.
    Show the answer

    Balance spend predictability against the requirement to change machine types. When your overall budget is predictable for three years but services will migrate, Azure savings plan for compute fits best. Committing to an hourly spend amount rather than a specific resource gives you discounted pricing while preserving flexibility across eligible compute services.

    Next → 2 / 25

  3. Q3 / 25

    Why can containers suit independently managed application components?

    1. AEach component requires its own fully managed guest operating system
    2. BEach component runs solely when a timer triggers a function
    3. CEvery component becomes a centrally delivered Windows desktop
    4. DEach isolated component can be scaled or updated separately
    Show the answer

    Look at how microservices evolve: components change and scale at different speeds. Containers package an application and its dependencies into lightweight units without an operating system per container. Because each component is isolated, you can update code or scale a busy service without altering other components on the host.

    Next → 3 / 25

  4. Q4 / 25

    Which statement defines a public cloud?

    1. AAn organization interconnects public and private cloud environments.
    2. BA third-party provider builds and operates cloud resources that are generally available for customers to purchase and use.
    3. CA single entity uses resources dedicated to that organization.
    4. DAn organization maintains hardware in its dedicated on-site datacenter.
    Show the answer

    Look at who can buy the resources. A public cloud is defined by general availability, where a third-party provider builds, operates, and sells access to anyone who wants to purchase services. It is not defined by size or location, but by whether the environment is open to the public rather than reserved for one entity.

    Next → 4 / 25

  5. Q5 / 25

    Which statement describes B2B direct connect?

    1. AIt creates mutual tenant trust without representing users in the inviting directory
    2. BIt creates guest users and removes their home-tenant access
    3. CIt deploys managed domain controllers for external organizations
    4. DIt synchronizes managed-domain resources back to Microsoft Entra ID
    Show the answer

    Look at directory presence to distinguish external patterns. B2B direct connect builds mutual trust with another Microsoft Entra tenant without adding user objects to your directory. Partner members collaborate in Teams shared channels from their home environment, eliminating the need to manage guest identities in your tenant.

    Next → 5 / 25

  6. Q6 / 25

    A nonproduction resource group has a monthly spending limit. The team needs an email at the threshold and an automatic shutdown so notification alone is not the final control. What should it configure?

    1. AA resource-group-scoped budget with a budget alert and threshold automation.
    2. BA Pricing calculator estimate with a regional comparison and no deployed-resource action.
    3. CA department spending quota alert that automatically changes the resource group.
    4. DAn Azure Prepayment credit alert generated at ninety and one hundred percent.
    Show the answer

    The resource group tells you where to scope the budget; the email and shutdown point to a budget alert linked to an action group or automation workflow. The alert emails its recipients and can start a workflow that shuts down test virtual machines after recorded spending crosses the threshold. Cost data can arrive late, so extra charges may accrue before shutdown.

    Next → 6 / 25

  7. Q7 / 25

    Which option adds read access to GZRS data in the secondary region before failover?

    1. AZRS with replicas in a secondary region
    2. BRA-GZRS with readable secondary replicas
    3. CGZRS with unreadable secondary replicas
    4. DRA-GRS with zone-redundant primary replicas
    Show the answer

    Adding read access before failover while keeping zone redundancy in the primary region requires RA-GZRS. Base GZRS keeps data unreadable in the secondary region until a failover happens. The read-access variant lets workloads like reporting jobs read secondary data while the primary region runs normally.

    Next → 7 / 25

  8. Q8 / 25

    Which requirement best matches the documented SaaS use case?

    1. AA custom guest operating system for an IoT server
    2. BA physical host purchased for connected-device telemetry
    3. CA simplified managed platform for an IoT solution
    4. DA container upload with direct platform deployment control
    Show the answer

    Check whether the requirement asks for a ready application rather than infrastructure you configure. Azure IoT Central is the SaaS example for connected devices because it delivers a simplified managed application without server administration. When you want device solution management without building platforms or running virtual machines, SaaS fits the requirement.

    Next → 8 / 25

  9. Q9 / 25

    Which information can Application Insights monitor for a web application?

    1. ASubscription prices, resource locks, policies, and management groups
    2. BAdvisor categories, dismissed recommendations, and cost opportunities
    3. CRegional outages, planned maintenance, advisories, and support cases
    4. DRequest rates, response times, failures, dependencies, and user trends
    Show the answer

    Look for measurements of the web application's performance and how people use it. Application Insights can monitor request rates, response times, failure rates, dependency calls, user counts, and session trends. It can also monitor server performance counters, which can include CPU, memory, and network usage.

    Next → 9 / 25

  10. Q10 / 25

    A company needs separate invoices and different access rules for production and development. Which Azure scope should separate the environments?

    1. ATwo availability zones inside the same Azure region
    2. BTwo nested resource groups inside one shared group
    3. CTwo resources attached directly to the Tenant Root Group
    4. DTwo Azure subscriptions, one for each environment
    Show the answer

    Check whether the scenario demands separate invoices. Resource groups can carry different role assignments, but only a subscription is a billing unit with its own invoice. Placing development and production in separate subscriptions gives finance one invoice per environment, and each subscription can have its own access policies, so developers can hold no access in production.

    Next → 10 / 25

  11. Halfway, at your pace

    In the app the mock exam is timed and scored like the real thing.

    Opens in your browser. Nothing to install.

    Start studying

    On your phone, with the same account

    Get it on Google Play

  12. Q11 / 25

    Which statement correctly distinguishes high availability from scalability?

    1. AAvailability and scalability both require a fixed instance count
    2. BAvailability limits disruption risk, while scalability changes capacity
    3. CAvailability changes capacity, while scalability prevents maintenance
    4. DAvailability predicts demand, while scalability removes hardware failures
    Show the answer

    Look for the kind of change: a maintenance event or hardware failure calls for lower disruption risk, while changing traffic calls for capacity adjustment. Grouping virtual machines reduces the chance that one event affects every instance. Scaling changes one resource's capacity or the number of instances as demand changes.

    Next → 11 / 25

  13. Q12 / 25

    A production resource group already holds thousands of resources created without the CostCenter tag, and new resources keep arriving without it. Tagging the resource group itself did not reach the resources inside. Which approach fixes both the existing estate and future deployments?

    1. AAssign a policy that denies the creation of any resource without the tag, which also corrects the existing ones.
    2. BTag the resource group again and wait for the resources inside it to pick up the value.
    3. CAssign a policy that adds the tag from the parent resource group, then run a remediation task over the existing resources.
    4. DPlace a ReadOnly lock on the resource group so untagged resources can no longer be changed.
    Show the answer

    Notice the two distinct problems: incoming deployments and existing noncompliant resources. Because resources do not inherit container tags, an Azure Policy with the modify effect must add the tag to incoming resources. Existing noncompliant resources do not update automatically, so you must run a remediation task to correct the backlog.

    Next → 12 / 25

  14. Q13 / 25

    A development team needs standards-based cloud identity and sign-in for a new internal employee application, with no requirement for LDAP or Kerberos. Which directory service fits?

    1. AExternal ID for customers for employee directory management
    2. BMicrosoft Entra Domain Services for modern app-only access
    3. CMicrosoft Entra ID for modern cloud application access
    4. DB2B direct connect for internal application authentication
    Show the answer

    Select the service that powers modern authentication. When a developer builds a new internal web application for employees that needs standards-based cloud sign-in without legacy protocols like LDAP or Kerberos, Microsoft Entra ID is the intended solution. It manages cloud identities, single sign-on, and application access directly, avoiding the unnecessary overhead of a managed domain.

    Next → 13 / 25

  15. Q14 / 25

    Where does software as a service sit on the responsibility spectrum?

    1. AMost service responsibility belongs to the cloud consumer
    2. BGuest operating-system patching becomes the consumer's defining task
    3. CPhysical datacenter responsibility moves to the cloud consumer
    4. DMost service responsibility belongs to the cloud provider
    Show the answer

    Look at who runs the application: SaaS gives you a managed application, so the provider carries most service work. You still manage cloud data, connected devices, accounts, identities, users, roles, and policies. The provider runs the authentication platform, so identity and access remain shared.

    Next → 14 / 25

  16. Q15 / 25

    What can a user do with an individual Azure Advisor recommendation?

    1. AConvert it into global status, maintenance, or advisories
    2. BRewrite it as a metric, log, or availability test
    3. CTake the suggested action, postpone it, or dismiss it
    4. DAssign it to Azure Status, Service Health, or Resource Health
    Show the answer

    The clue is what you can do with one recommendation after reading it. Treat it as guidance with a suggested action. Take that action now if safe, postpone it if a change needs a window, or dismiss it if it does not apply to your workload. These choices help you fit the advice to your situation.

    Next → 15 / 25

  17. Q16 / 25

    What does an Azure datacenter provide at the physical infrastructure layer?

    1. ASubscriptions grouped under shared access policies and compliance rules
    2. BGlobal services that never require a selected deployment location
    3. CServers in racks supported by dedicated power, cooling, and networking
    4. DPaired regions connected to guarantee automatic service replication
    Show the answer

    Look at the physical layer at the bottom of Azure infrastructure. A datacenter is the actual building housing the hardware. You never select one directly; it simply supplies servers in racks with dedicated power, cooling, and networking that Azure groups into zones and regions.

    Next → 16 / 25

  18. Q17 / 25

    What reliability benefit do virtual machine availability sets provide within a region?

    1. AThey commit eligible compute usage to an hourly spend
    2. BThey report health for every Azure service worldwide
    3. CThey reduce shared maintenance and hardware-failure exposure
    4. DThey estimate monthly infrastructure costs before deployment
    Show the answer

    Focus on the failure boundary inside one Azure region. An availability set groups virtual machines to give VM-level redundancy. It reduces the chance that one maintenance event or hardware failure affects every machine in the group. This improves resiliency within a region; it does not model costs, create a pricing commitment, or report worldwide health.

    Next → 17 / 25

  19. Q18 / 25

    Which statement correctly describes Azure Prepayment credit alerts?

    1. AThey notify department owners whenever a fixed spending quota reaches fifty percent.
    2. BThey apply to every subscription at eighty percent of a monthly resource-group budget.
    3. CThey compare estimated compute prices across regions before resources are deployed.
    4. DThey apply to Enterprise Agreement organizations at ninety and one hundred percent consumption.
    Show the answer

    Identifying the correct alert type depends on the underlying contract and funding model. Credit alerts apply exclusively to organizations with Enterprise Agreements. Azure issues them when consumption reaches ninety percent and one hundred percent of the Azure Prepayment balance. These alerts notify account owners that prepaid funds are running out, rather than tracking individual resource group budgets.

    Next → 18 / 25

  20. Q19 / 25

    A team has one virtual network and needs a distinct address range for a protected application tier. Which component should it create?

    1. AA DNS zone for that application tier's address range
    2. BA peering for that application tier's address range
    3. CA subnet for that application tier's address range
    4. DAn ExpressRoute circuit for that application tier's address range
    Show the answer

    Note that the requirement is segmentation inside one existing virtual network. A subnet carves out a distinct, nonoverlapping address range within that virtual network for a specific workload like an application tier. It also gives you the exact scope to attach a network security group to allow or deny traffic into that protected tier.

    Next → 19 / 25

  21. Q20 / 25

    Which outcome is a benefit of high availability for a grouped virtual-machine workload?

    1. AA guarantee that hardware maintenance cannot occur
    2. BA requirement to run the workload on one virtual machine
    3. CA lower chance that one event affects every virtual machine
    4. DA fixed instance count during every demand change
    Show the answer

    The clue is one event affecting every virtual machine. In an availability set, grouping reduces the chance that maintenance or hardware failure affects all instances at once. A payroll service on four grouped virtual machines can keep answering requests while affected instances are serviced, even though maintenance still occurs.

    Next → 20 / 25

  22. Q21 / 25

    A web application receives almost no traffic overnight, but the team must still verify that it responds. Which capability should it use?

    1. AService Health alerts with planned maintenance notices
    2. BAzure Monitor metric alerts with current CPU usage
    3. CLog Analytics trend queries with historical user sessions
    4. DApplication Insights availability tests with synthetic requests
    Show the answer

    Solve the overnight blind spot by generating artificial traffic instead of waiting for real users. When traffic drops, passive monitoring looks clean simply because nobody makes requests. Application Insights availability tests send synthetic requests on a schedule, like calling the login page every five minutes, to confirm the web application responds.

    Next → 21 / 25

  23. Q22 / 25

    What does Azure Virtual Network peering connect?

    1. ATwo DNS records by registering a shared domain name
    2. BTwo subnets by creating a new virtual network boundary
    3. CTwo virtual networks for direct private communication
    4. DTwo public endpoints by assigning one private IP address
    Show the answer

    Identify the scope of the connection. Peering links two independent virtual networks so their workloads can talk privately across the Microsoft backbone without traversing the public internet. Each virtual network retains its own address space, subnets, and administration. Peering does not create a new network boundary or merge the two networks into one.

    Next → 22 / 25

  24. Q23 / 25

    A new application needs provider-operated resources that can be provisioned and removed quickly. The organization has no requirement for dedicated private resources and wants to scale without buying hardware. Which model should it select?

    1. APrivate cloud, purchasing dedicated hardware to gain complete infrastructure control
    2. BPublic cloud, using generally available resources without capital expenditure for scaling
    3. CPrivate cloud, hosting dedicated resources on-site and maintaining the hardware
    4. DHybrid cloud, retaining a private environment and connecting public resources to it
    Show the answer

    The decisive clues are provider-operated resources, quick provisioning, and scaling without buying hardware. Public cloud fits that combination because it can scale without capital expenditure for additional infrastructure. Dedicated private resources are not required here, and no need to connect public and private environments is given.

    Next → 23 / 25

  25. Q24 / 25

    When is a Cost Management budget alert generated?

    1. AWhen a resource is added to the Pricing calculator for an estimate.
    2. BWhen a monthly estimate is compared across two deployment regions.
    3. CWhen Azure Prepayment reaches exactly fifty percent of its balance.
    4. DWhen actual or forecasted spending reaches a threshold defined for the budget.
    Show the answer

    The clue is the threshold you set for a budget. When actual spending reaches that threshold, or forecasted cost is projected to exceed it, a budget alert appears in the cost-alerts area. The recipients configured on the budget also get an email. A team could choose eighty percent of its monthly development budget to leave time to react.

    Next → 24 / 25

  26. Q25 / 25

    A company must connect its corporate VPN device to an Azure virtual network through an IPsec site-to-site tunnel over the internet. Which service fits?

    1. AAzure ExpressRoute for the site-to-site tunnel
    2. BA private endpoint for the site-to-site tunnel
    3. CAzure VPN Gateway for the site-to-site tunnel
    4. DA public endpoint for the site-to-site tunnel
    Show the answer

    Look for the keywords IPsec, site-to-site, and internet in the requirement. Azure VPN Gateway uses IPsec to create an encrypted connection between a corporate VPN gateway in an on-premises datacenter and an Azure virtual network. While the traffic travels across the public internet, end-to-end IPsec encryption provides the necessary security for private data.

    Next → 25 / 25

  27. That’s the whole mock exam

    Every question you miss comes back exactly when you’re about to forget it.

    Back to the course

    Opens in your browser. Nothing to install.

    Start studying

    On your phone, with the same account

    Get it on Google Play

How to use this mock exam

Sit all 25 questions in one go: the mix covers every domain in the same proportion as the exam, so a low score points at the domain you skipped rather than at bad luck.

Read the explanation under every question, including the ones you got right: the reason an option is wrong is usually the thing being tested.

Then retake it in the app, where the mock exam is timed and scored and the questions you miss come back on a schedule.

Start studying Get it on Google Play

The whole course, on your computer and your phone

Lessons you can read, audio you can listen to on the way to work, and practice that remembers what you got wrong.

Opens in your browser. Nothing to install.

Start studying

On your phone, with the same account

Get it on Google Play

“This app is the ‘One Lake’ for preparing the certification exams. Really worth it.”

Abdelhak Y. Google Play review