Microsoft Azure Fundamentals
175 practice questions
Last reviewed: April 2026
Personal notes and resource links for your study journey
Filter by Certification
Microsoft Azure Fundamentals (AZ-900) is the entry-level credential for the Azure platform. It validates a candidate's ability to describe core cloud concepts, the major Azure architectural components, and Azure management and governance features. The audience is broad: business stakeholders, sales and pre-sales engineers, project managers, students, and engineers from other clouds who need an Azure literacy stamp. The exam is conceptual rather than hands-on — expect 40–60 questions in 45 minutes covering shared responsibility, cloud service models (IaaS/PaaS/SaaS), Azure regions and availability zones, core compute and storage services, Microsoft Entra, RBAC, and cost-management tooling.
Cloud benefits, capex vs. opex, IaaS / PaaS / SaaS, public / private / hybrid models, the shared responsibility model. Pure vocabulary domain — about 28% of questions.
Largest domain at 37%. Regions, availability zones, resource groups, subscriptions, management groups, and the headline services across compute (VMs, App Service, Functions, AKS, Container Instances), networking (VNets, peering, VPN, ExpressRoute), and storage (Blob, Files, Disks, Queues, Tables).
35% of the exam. Cost-management tools (TCO calculator, Pricing Calculator, Cost Management + Billing), Azure Policy, resource locks, Microsoft Purview, Service Health, Azure Advisor, and Azure Monitor / Log Analytics. Heavy on knowing which tool addresses which governance scenario.
Services you'll encounter on the exam and why each one matters.
On-demand Linux and Windows VMs spanning general-purpose, compute-optimized, memory-optimized, storage-optimized, GPU, and HPC series, with pay-as-you-go, reserved-instance, savings-plan, and spot purchasing options.
Why it's on the exam: Domain 2 (Describe Azure Architecture and Services) tests VMs as the headline IaaS compute option — instance series and purchasing options are recurring questions.
Fully managed PaaS for hosting web apps, REST APIs, and mobile backends with built-in autoscaling, deployment slots, custom domains, and CI/CD integration.
Why it's on the exam: AZ-900 frames App Service as the canonical PaaS answer when contrasting with VMs (IaaS) and Functions (serverless) in Domain 2.
Serverless event-driven compute with pay-per-execution pricing, triggers for HTTP / queue / blob / timer / Event Grid, and Consumption, Premium, and Dedicated hosting plans.
Why it's on the exam: Domain 1 (Cloud Concepts) tests serverless as a consumption-based model — Functions is the named Azure-native answer in Domain 2 service-selection questions.
Unified storage platform exposing Blob (object), Files (SMB/NFS), Queue, and Table services, with hot/cool/cold/archive tiers, redundancy options (LRS/ZRS/GRS/GZRS), and lifecycle management.
Why it's on the exam: Storage tiers and redundancy options are a Domain 2 staple — picking the right access tier and replication scheme drives many service-selection questions.
Fully managed PaaS relational database based on the SQL Server engine, with serverless and provisioned compute, automated backups, high availability, and built-in intelligence.
Why it's on the exam: The reference answer for "managed SQL on Azure" under Domain 2; the Azure-SQL-Database vs. SQL-Managed-Instance vs. SQL-on-VM distinction is a recurring distractor pattern.
Globally distributed multi-model NoSQL database with single-digit-millisecond latency, turnkey global replication, five consistency levels, and APIs for NoSQL, MongoDB, Cassandra, Gremlin, and Table.
Why it's on the exam: AZ-900 tests "pick SQL vs. NoSQL" service-selection questions where Cosmos DB is the Azure-native NoSQL answer under Domain 2.
Logically isolated private network in Azure: subnets, route tables, network security groups (NSGs), service endpoints, private endpoints, and peering across regions.
Why it's on the exam: The default networking primitive — Domain 2 tests subnet design and isolation; Domain 3 tests NSGs as a governance control on traffic.
Managed Kubernetes with Azure-managed control plane, automated upgrades and patching, integration with Entra ID and Azure Monitor, and node pools across multiple VM sizes.
Why it's on the exam: AZ-900 frames AKS as the canonical container-orchestration option in Domain 2 alongside Container Apps and Container Instances.
Container Apps runs serverless microservices on managed Kubernetes with autoscale to zero; Container Instances runs single containers without orchestration overhead.
Why it's on the exam: Domain 2 tests the AKS-vs-Container-Apps-vs-Container-Instances trio as the named container hosting options on Azure.
Load Balancer distributes L4 TCP/UDP traffic across backend pools; Application Gateway adds L7 routing, TLS termination, WAF, and URL-based path rules.
Why it's on the exam: Paired with VMs and VMSS as the canonical high-availability answer in Domain 2; the L4-vs-L7 distinction surfaces in service-selection questions.
Managed DNS hosting for public and private zones, with global anycast resolvers, alias records pointing to Azure resources, and integration with Traffic Manager and Front Door.
Why it's on the exam: Domain 2 tests Azure DNS as the platform name-resolution service that backs both public-facing domains and internal Virtual Network resolution.
Front Door is a global L7 load balancer + CDN with anycast, WAF, and origin failover; Azure CDN caches static and dynamic content at Microsoft and partner edge POPs.
Why it's on the exam: The expected Domain 2 answer for "reduce latency for global users" scenarios — also surfaces alongside WAF in Domain 3 governance discussions.
Low-code workflow service with 1,400+ prebuilt connectors for SaaS, on-prem, and Azure services — used for B2B integration, scheduled jobs, and event-driven business processes.
Why it's on the exam: AZ-900 names Logic Apps in Domain 2 as the no-code integration counterpart to Functions (code-first) for connecting Azure to external systems.
Event Grid routes Azure-emitted and custom events to subscribers via push delivery; Service Bus provides FIFO queues, topics, and subscriptions for enterprise messaging.
Why it's on the exam: Domain 2 tests event-vs-message patterns — Event Grid (events) and Service Bus (messages) are the two named Azure-native answers.
Backup protects VMs, files, SQL, and SAP HANA with retention and immutability; Site Recovery orchestrates replication and failover of workloads across Azure regions or from on-prem.
Why it's on the exam: Domain 3 (Management and Governance) tests these as the named Azure-native answers for business continuity, RPO/RTO objectives, and disaster recovery drills.
Centralized hub for assessing and migrating servers, databases, web apps, and VDI to Azure, with dependency analysis, cost estimation, and integrated replication tooling.
Why it's on the exam: AZ-900 references Azure Migrate in Domain 2 as the named first step for cloud-adoption planning and on-prem-to-Azure workload moves.
Cloud identity and access management — users, groups, app registrations, conditional access, MFA, B2B/B2C, and SSO across Azure, Microsoft 365, and thousands of SaaS apps.
Why it's on the exam: Domain 3 tests Entra ID (formerly Azure AD) as the foundation of identity-based security, conditional-access policies, and the cloud shared-responsibility model.
Managed secret, key, and certificate store backed by HSMs, with access policies, RBAC, soft-delete, and integration for encryption-at-rest across Azure services.
Why it's on the exam: Encryption-at-rest with customer-managed keys and centralized secret rotation is the standard Domain 3 answer for protecting credentials and sensitive data.
Metrics, logs, alerts, dashboards, distributed tracing (Application Insights), and KQL-driven Log Analytics workspaces across every Azure resource and on-prem agent.
Why it's on the exam: Domain 3 tests Azure Monitor for operational visibility — and the Monitor-vs-Defender-for-Cloud distinction surfaces in service-selection questions on monitoring vs. security posture.
Cloud security posture management (CSPM) plus cloud workload protection (CWP) with Secure Score, regulatory compliance dashboards, and threat protection for VMs, containers, and databases.
Why it's on the exam: Domain 3 names Defender for Cloud as the Azure-native answer for unified security posture, compliance reporting, and workload threat protection.
$60k–$95k–$135k USD annual
AZ-900 alone rarely moves the needle on salary — it is a foundational signal, not a hiring requirement. Range reflects US-based roles where cloud literacy is expected. Engineers with hands-on Azure experience typically pair AZ-900 with AZ-104 or AZ-204, which lift compensation meaningfully.
Source: levels.fyi 2025 cloud generalist roles, U.S. BLS OEWS May 2024 (15-1244 network and computer systems administrators), Glassdoor 2025. Figures are approximate; actual compensation depends on role, region, and experience.
AZ-900 is one of the highest-volume Microsoft certifications globally, partly because Microsoft frequently runs free voucher campaigns through Microsoft Learn challenges and partner programs. Recruiters treat it as a baseline literacy signal rather than a differentiator — useful on a resume for non-engineering roles (sales, project management, consulting) where a cloud vocabulary is increasingly assumed. Engineers commonly use AZ-900 as a stepping stone to AZ-104 or AZ-204; in that context it pairs naturally with the AI-900 or DP-900 fundamentals to round out a full Azure-platform overview.
There are no formal prerequisites. AZ-900 is designed to be the first Azure exam most candidates take, and Microsoft's official Microsoft Learn path requires no prior cloud experience. Plan on around 10–15 hours of free content on Microsoft Learn covering the three exam areas.
If you already hold AWS Cloud Practitioner or Google Cloud Digital Leader, expect to need only 5–10 hours to map equivalent vocabulary onto Azure-specific service names. Microsoft Learn Sandboxes provide a free hands-on environment that — while not strictly required — makes terminology stick faster. Microsoft regularly distributes free AZ-900 vouchers through "Get Certified" challenges, Microsoft Ignite registration, and partner training programs.
AZ-900 sits at the Fundamentals tier — the most approachable Microsoft exam. Plan on 15–25 hours of study over 2–3 weeks if you have no prior cloud exposure; experienced engineers often pass with 5–10 hours of focused review. The exam runs about 45 minutes with roughly 40–60 questions in mixed formats: multiple choice, multiple response, and drag-and-drop matching exercises. There are no case studies at the Fundamentals level.
The most common stumbling block is service-name overload — Azure has dozens of named services across compute, networking, storage, security, and governance, and the exam expects you to match each to its primary use case. Memorizing the management-and-governance toolset (Azure Policy vs. Blueprints vs. Resource Locks vs. Microsoft Purview) is where most candidates spend their final review hours.
Most recent skills-measured update. Refreshed AI/ML and Microsoft Entra (formerly Azure AD) terminology, added emphasis on Azure Arc and FinOps tooling. Microsoft refreshes the AZ-900 outline approximately yearly without changing the exam code.
Restructured the exam into three domains (down from six), repositioned Microsoft Entra and renamed several services in line with Microsoft's 2022 branding.
AZ-900 (Microsoft Azure Fundamentals) is a considered an entry-level exam testing breadth of conceptual understanding rather than hands-on depth Foundational-level exam. Most candidates need 30–80 hours of study spread over 3–6 weeks for foundational-level exams. Most candidates who score consistently above the passing threshold on practice exams pass on their first attempt.
Most candidates need 30–80 hours of study spread over 3–6 weeks for foundational-level exams. Time-to-pass varies widely by prior experience. Engineers with hands-on production experience in the underlying technology typically need less; candidates new to the platform should plan toward the upper end of that range.
AZ-900 is a recognized credential in the Azure ecosystem and signals validated knowledge to employers, recruiters, and clients. Whether it is worth the time and fee for you depends on your role and goals — it tends to pay off most for cloud engineers, architects, and consultants who work with Azure day-to-day or want to move into roles that do.
The passing score for AZ-900 is 700 / 1000. The exam contains 40 questions and lasts 45 min.
The AZ-900 exam fee is $99 USD. Fees are set by Azure and may vary by region; always confirm the current price on the official Azure certification page before booking.
Microsoft fundamentals certifications never expire (AZ-900, AI-900, DP-900, SC-900).
Yes. You can take the exam online (proctored via the provider's secure browser, available 24/7 in most regions) or at an in-person Pearson VUE test center during business hours. Both formats use the same questions, time limit, and passing score.
CertLabPro provides 15 study modes across the practice question bank for AZ-900. The exam-simulation mode mirrors the real exam: 40 questions in 45 min, with the same passing threshold of 700 / 1000. Browse mode lets you read every Q&A statically.