AZ-900 — frequently asked questions

In SaaS, Microsoft handles all platform security, so the customer retains 100% responsibility for their own data governance and classification.

No, operating system updates are fully managed by Microsoft in SaaS. The customer never touches the underlying infrastructure or OS layer.

No. Visual Studio is a local IDE. While it has Azure extensions, it does not host the browser-based Cloud Shell environment directly.

No. ARM is the management plane. You use Cloud Shell (via browser) to deploy and manage resources via ARM templates or CLI commands.

No, locks must be explicitly applied to each resource. However, applying them to the RG is often used as a management shortcut in exam scenarios.

RBAC allows granular permissions but does not provide a single, immediate 'block all writes' action like a lock does for this specific scenario.

Soft Delete retains deleted data for recovery but does not block the deletion operation itself. A Delete lock explicitly blocks the permission to delete.

Yes, locks can be applied to individual resources, but applying it to the storage account covers all its containers automatically.

No. The Settings app manages local device configurations and does not have built-in capabilities to interact with Azure infrastructure APIs.

PowerApps is a platform for building business applications, not for managing cloud infrastructure resources like virtual machines.

PaaS often requires application refactoring to leverage platform services, whereas lift-and-shift aims to move workloads with minimal to no code changes.

It means moving existing on-premises servers or applications to the cloud with little or no modification, typically using IaaS virtual machines.

No. Although it runs on Azure infrastructure, the user consumes the finished application, not the platform for building apps. That makes it SaaS.

Azure VMs are IaaS where you manage the OS and apps. M365 is SaaS where Microsoft manages everything and you just use the software.

No, Azure Advisor provides recommendations that require manual approval and implementation by the user or administrator.

No, the Pricing Calculator estimates costs for new projects. Advisor analyzes existing resources to find waste and suggest reductions.

No. The Basic plan only allows requests for billing, subscription management, and quota increases. Technical support requires a paid plan.

As of July 2022, Microsoft no longer offers Premier support agreements for new customers. Existing customers can renew, but new users should consider Professional Direct.

Standard GRS does not allow reads from the secondary region until a failover is triggered. The question requires reads while the primary is active.

No, the official term is 'Read Access Geo-Redundant Storage' (RA-GRS). The exam option uses 'Read-only' as a synonym for the read-access capability.

Yes, the Developer support plan includes access to Azure Architects for general guidance and architecture support, making it suitable for design assessments.

While terms vary, Azure support tiers generally group architectural advice together. Both Developer and Standard plans provide access to technical resources for design review, unlike Basic which only handles billing.

SaaS provides finished applications (like Outlook) where you have no access to the underlying infrastructure. You cannot install an OS or configure a VM in a SaaS environment.

IaaS gives you control over the VM's OS and configuration (Infrastructure as a Service). SaaS is a pre-built app hosted by Microsoft where you just log in (Software as a Service).

Azure VMs provide virtualized computing resources where the user manages the OS and software. PaaS abstracts the infrastructure, providing only the platform for code execution.

Azure App Service is a common PaaS example. It allows developers to build and host web apps without managing the underlying servers or OS.

No, Azure Storage Accounts are generally classified under Platform as a Service (PaaS) because they provide managed data storage services without requiring OS management.

In IaaS, you manage the operating system, installed applications, data, and configurations, while Microsoft manages the underlying physical hardware and virtualization layer.

Yes, the Basic tier fully supports custom domains, unlike Free and Shared tiers which require subdomains.

Yes, the 10GB limit applies per instance/app, so each of the 10 apps gets its own 10GB allocation.

Multiple directories create isolated tenants, requiring separate management of users, groups, and policies, which increases administrative effort rather than reducing it.

Use a single Azure AD tenant with Management Groups and Subscriptions to enforce hierarchy and RBAC permissions, allowing centralized management with granular access control.

Basic tier only provides 10 GB of local storage. Since the requirement is 12 GB, Basic is insufficient regardless of cost savings.

Standard tier supports custom SSL certificates and TLS/SSL termination, but you must provide your own certificate unless using Azure Managed Certificates.

CapEx involves upfront capital investment for hardware (on-premises). OpEx involves ongoing operational costs for resources consumed (cloud), such as Azure's pay-as-you-go model.

No. While Azure resources are elastic (can scale up/down), the billing model is either Consumption (Pay-As-You-Go) or Reserved Instances. Both are forms of OpEx.

Scalability is a technical characteristic of cloud infrastructure, not a financial accounting model. Financial models in this context are strictly CapEx or OpEx.

Pay-as-you-go is an Operational Expenditure (OpEx) because it involves recurring, variable costs for services used, rather than a one-time capital investment in hardware.

Because it involves recurring payments for services consumed without large upfront capital investments in physical hardware.

Not necessarily; while it involves prepayment, it is often still treated as an operating expense depending on accounting policies, but pay-as-you-go is definitively OpEx.

Cosmos DB is a NoSQL database for storing and retrieving data. It does not have built-in tools to train or deploy machine learning models.

Use Azure Machine Learning to build, test, and deploy predictive models. It provides the necessary compute and algorithmic frameworks.

Not necessarily for the sync process itself, but Azure AD Connect typically runs on a server connected to the on-premises AD. You can sync accounts and then retire the on-premises infrastructure once the migration is complete.

Manual creation leads to errors and forces users to learn new credentials. Sync ensures consistency, automation, and immediate access for thousands of users without disruption.

Yes, new resources cannot be created after Dec 1, 2021, and full support ends Aug 31, 2024, but existing workspaces remain functional.

ML Studio (classic) uses drag-and-drop modules, while Azure ML offers a more robust environment with code-first approaches and advanced MLOps features.

Use Azure Resource Manager (ARM) templates, Bicep, or Azure Blueprints to define and deploy identical resources automatically.

APIM is an API gateway for publishing and securing APIs, not an infrastructure provisioning tool. It manages traffic to existing resources but does not create them.

No, Management Groups are hierarchical containers for applying policies and access controls. They cannot provision or create resources.

Use Azure Resource Manager (ARM) templates or Azure Blueprints to define and automate the deployment of identical resource sets.

ARM templates ensure consistency, repeatability, and version control for infrastructure, eliminating human error and saving time compared to manual portal clicks.

While primarily for Azure, ARM supports some hybrid scenarios, but it is specifically designed for managing Azure resources within the Azure ecosystem.

The question explicitly demands a guaranteed availability of 99.99%. While 99.95% is good, it does not meet the strict business requirement stated in the scenario.

No. The SLA depends on the underlying infrastructure resilience. Without distributing VMs across multiple Availability Zones, a Load Balancer cannot protect against a full zone outage.

No. A single virtual machine instance is hosted within a specific physical location, which corresponds to one Availability Zone. It cannot span multiple zones.

You need at least two VM instances. Each instance should ideally reside in a different Availability Zone to ensure redundancy against zone-level failures.

The question explicitly requires a guaranteed availability of 99.99%. The 99.95% SLA applies to Availability Sets or single-zone deployments, which do not meet the stricter requirement.

No. To receive the 99.99% SLA for Virtual Machines, you must deploy at least two instances across two or more Availability Zones within the same region.

It is a managed service for Windows 10 devices, focusing on device deployment and security for end-users, not for managing Azure virtual machines.

Use DevTest Labs when developers need to quickly create and tear down test environments using reusable templates, especially with mixed OS requirements.

Reserved VMs require a 1-3 year commitment. Deploying and deleting VMs weekly makes this commitment impractical and financially wasteful.

Azure DevTest Labs is ideal for this scenario as it allows reusable templates and artifacts to reduce administrative effort for dev/test VMs.

VMSS is for scaling identical instances for load-balanced apps, not for managing diverse, short-lived custom VMs for individual developers.

Yes, Azure DevTest Labs supports both Windows and Linux virtual machines, allowing you to build environments for any OS.

DirectAccess is a legacy Windows Server technology requiring complex deployment and specific infrastructure. P2S VPN is simpler, cloud-native, and supported by Azure Gateway natively.

Yes, but for very large scale, consider Azure Firewall or application-level authentication. P2S is optimal for typical remote worker scenarios up to several thousand concurrent connections.

AIP protects static content like documents and emails via labeling. It does not provide the dynamic secret management needed for deployment automation.

Azure Key Vault is the standard service for storing and managing secrets, keys, and certificates securely for applications and deployments.

MFA verifies identity at login but does not store or encrypt the actual password or key. It prevents unauthorized access but leaves the secret itself unprotected if compromised elsewhere.

Use Azure Key Vault. It is a centralized service for managing secrets, keys, and certificates, providing encryption and strict access controls.

No, Azure Government is restricted to US-based government entities and their authorized partners due to strict sovereignty and compliance regulations.

Azure Government is an isolated cloud instance with different data centers, compliance certifications (like FedRAMP), and access restrictions compared to the global Azure Commercial cloud.

Identity Protection supplies the anonymous IP risk detection and its user risk policy, while Conditional Access is part of Identity Protection's policy enforcement layer.

It detects anonymous IP address use, atypical travel, malware-linked IP, unfamiliar sign-in properties, leaked credentials, and password spray attacks.

Azure AD Identity Protection, through its sign-in risk policy, detects signals such as anonymous IP address use, atypical travel, and leaked credentials, and can require a password change or block.

PIM provides just-in-time, time-bound, and approval-based activation of privileged administrative roles in Azure AD and Azure, with audit records — it does not evaluate sign-in risk.

Azure CLI provides az commands, not the Az PowerShell cmdlets. Without the Azure PowerShell module, the script cannot authenticate to or create Azure resources.

Yes. Cloud Shell is browser-based and hosted by Azure, providing a PowerShell experience with the Az module preinstalled, so Chrome OS or any browser-capable device works.

Yes for this exam item. PowerShell Core 6.0 was the first cross-platform release and runs on macOS; the point being tested is cross-platform PowerShell, not the exact version number.