AZ-900Questions 11-20Azure Architecture & ServicesOriginal Practice
AZ-900 Questions 11-20: Azure Compute, Networking, and Storage
Use these AZ-900 practice questions to test the Azure architecture and services section: compute, networking, storage, identity, and core resource organization. The questions are original, but they are written to feel close to the style and difficulty of a real fundamentals exam.
Series position: This continues the AZ-900 series after AZ-900 Questions 1-10: Cloud Concepts and Azure Architecture. This set focuses on the next logical objective area: Azure architecture and services.
Exam code
AZ-900: Microsoft Azure Fundamentals
AZ-900: Microsoft Azure Fundamentals
Question range
11-20
11-20
Domain focus
Azure architecture and services
Azure architecture and services
Best use
Timed review, weak-area check, or final warm-up
Timed review, weak-area check, or final warm-up
Exam tip: AZ-900 often tests whether you can choose the best Azure service type for a simple business requirement. Watch for keywords like “minimal management,” “private connectivity,” “serverless,” “globally distributed,” and “governance.”
Questions
Practice mode: Answers are hidden by default. Pick your answer first, then click Reveal answer and explanation to check your reasoning.
Question 11
A company wants to run custom line-of-business software that requires full control of the operating system, installed agents, and patch timing. Which Azure compute option best matches this requirement?
Reveal answer and explanation
Correct answer: C. Azure Virtual Machines
Azure Virtual Machines provide infrastructure as a service and give administrators control over the operating system, installed software, and many maintenance decisions.
Azure Virtual Machines provide infrastructure as a service and give administrators control over the operating system, installed software, and many maintenance decisions.
Why the others are wrong: App Service abstracts the OS. Azure Functions is serverless and event-driven. Container Apps is designed for containerized workloads, not full OS control.
Objective: Describe Azure compute and networking services.
Question 12
A developer needs to run code when a file is uploaded to storage. The solution should minimize server management and charge mainly based on executions. Which service is most appropriate?
Reveal answer and explanation
Correct answer: A. Azure Functions
Azure Functions is a serverless compute service designed for event-driven code execution, such as reacting to a file upload.
Azure Functions is a serverless compute service designed for event-driven code execution, such as reacting to a file upload.
Why the others are wrong: Virtual Desktop delivers desktops and apps. VM Scale Sets scale VMs. Azure DNS hosts DNS zones and records.
Objective: Describe cloud service types and compute options.
Question 13
Two virtual networks in Azure must communicate using Microsoft’s private backbone without sending traffic over the public internet. What should you configure?
Reveal answer and explanation
Correct answer: B. Virtual network peering
Virtual network peering connects Azure virtual networks so resources can communicate privately across the Azure backbone.
Virtual network peering connects Azure virtual networks so resources can communicate privately across the Azure backbone.
Why the others are wrong: DNS helps name resolution but does not connect VNets by itself. Azure Policy and resource locks are governance controls, not network connectivity features.
Objective: Describe virtual networking, including peering.
Question 14
An organization needs a private, dedicated connection from its datacenter to Azure. The connection should not traverse the public internet. Which Azure service should it use?
Reveal answer and explanation
Correct answer: B. Azure ExpressRoute
ExpressRoute provides private connectivity between on-premises environments and Azure through a connectivity provider.
ExpressRoute provides private connectivity between on-premises environments and Azure through a connectivity provider.
Why the others are wrong: VPN Gateway provides encrypted connectivity over the internet. Bastion provides secure VM access through the portal. Traffic Manager is DNS-based traffic routing.
Objective: Describe virtual networking, VPN Gateway, and ExpressRoute.
Question 15
A storage account must keep copies of data across multiple Azure availability zones in the same region. Which redundancy option should you choose?
Reveal answer and explanation
Correct answer: B. Zone-redundant storage (ZRS)
ZRS replicates data synchronously across multiple availability zones in the primary region.
ZRS replicates data synchronously across multiple availability zones in the primary region.
Why the others are wrong: LRS keeps copies within one datacenter. GRS and RA-GRS replicate to a secondary region, which is not what the question asks.
Objective: Describe Azure Storage redundancy options.
Question 16
A small office wants a fully managed file share in Azure that can be mounted by Windows clients using the SMB protocol. Which storage service should be used?
Reveal answer and explanation
Correct answer: C. Azure Files
Azure Files provides managed file shares that can be accessed over SMB and NFS, depending on configuration.
Azure Files provides managed file shares that can be accessed over SMB and NFS, depending on configuration.
Why the others are wrong: Blob Storage is object storage. Queue Storage stores messages. Table Storage stores NoSQL key/attribute data.
Objective: Compare Azure Storage services.
Question 17
A company wants users to sign in once and access multiple cloud applications without repeatedly entering credentials. Which concept is being described?
Reveal answer and explanation
Correct answer: B. Single sign-on
Single sign-on allows users to authenticate once and access multiple applications or services without repeated sign-in prompts.
Single sign-on allows users to authenticate once and access multiple applications or services without repeated sign-in prompts.
Why the others are wrong: MFA adds verification factors. Conditional Access evaluates signals to enforce access controls. RBAC grants permissions to Azure resources.
Objective: Describe authentication methods in Azure.
Question 18
An administrator needs to give a user permission to restart virtual machines in a resource group, but not manage billing for the subscription. Which Azure feature should be used?
Reveal answer and explanation
Correct answer: A. Azure role-based access control (RBAC)
Azure RBAC is used to grant specific permissions to Azure resources at scopes such as management group, subscription, resource group, or resource.
Azure RBAC is used to grant specific permissions to Azure resources at scopes such as management group, subscription, resource group, or resource.
Why the others are wrong: Service Health reports service issues. Advisor gives recommendations. Application Insights monitors application performance and usage.
Objective: Describe Azure identity, access, and security.
Question 19
A company wants to organize Azure resources so that policies and access can be applied across multiple subscriptions at once. Which Azure hierarchy feature is designed for this?
Reveal answer and explanation
Correct answer: B. Management group
Management groups let organizations manage access, policy, and compliance across multiple Azure subscriptions.
Management groups let organizations manage access, policy, and compliance across multiple Azure subscriptions.
Why the others are wrong: Resource groups organize resources within a subscription. Availability sets improve VM availability. Public endpoints expose services over public IP connectivity.
Objective: Describe management groups and the Azure resource hierarchy.
Question 20
A security team designs controls at the physical, identity, network, application, and data layers so that failure of one control does not leave the environment unprotected. Which security concept is this?
Reveal answer and explanation
Correct answer: B. Defense in depth
Defense in depth uses multiple layers of security controls to reduce risk if one layer fails or is bypassed.
Defense in depth uses multiple layers of security controls to reduce risk if one layer fails or is bypassed.
Why the others are wrong: Consumption-based pricing is a billing model. Elasticity is scaling with demand. Region pairing supports resiliency and update sequencing.
Objective: Describe Azure identity, access, and security.
Answer key
Reveal full answer key
| Question | Correct answer | Objective area |
|---|---|---|
| 11 | C | Compute |
| 12 | A | Serverless compute |
| 13 | B | Virtual networking |
| 14 | B | Hybrid connectivity |
| 15 | B | Storage redundancy |
| 16 | C | Storage services |
| 17 | B | Identity |
| 18 | A | Azure RBAC |
| 19 | B | Azure hierarchy |
| 20 | B | Security concepts |
Watch out: On fundamentals exams, the distractors are often real Azure services. The trick is matching the service to the requirement, not simply recognizing the product name.
