Microsoft AZ-900 Azure Fundamentals Practice Exam
Prepare for AZ-900 Azure Fundamentals with 762 practice questions mapped to Microsoft’s July 20, 2026 skills outline — cloud concepts, Azure architecture and services, and Azure management and governance — with instant, source-linked feedback in Learn mode and a timed 45-minute run in Exam mode.
Or 12 months of access for $69.99 $159.99 — save $90 (56% off)
One-time purchase — not a subscription. No auto-renewal, nothing to cancel.
762 practice questions — about 7¢ each on the 3-month plan, and about half the $99 US exam fee you’d pay again to retake.
Backed by our satisfaction guarantee. Instant access — no software to install.
PowerKram’s value promise vs. typical competing AZ-900 practice sets. On sale now.
AZ-900 exam at a glance
- Vendor
- Microsoft
- Exam code
- AZ-900
- Certification
- Microsoft Certified: Azure Fundamentals
- Level
- Beginner (Fundamentals)
- Blueprint
- Skills measured as of July 20, 2026 — three domains; minor wording changes only versus the prior edition
- Duration
- 45 minutes to complete the exam
- Questions
- Count not published by Microsoft; varies by exam form and may include interactive items
- Passing score
- 700 on Microsoft’s scaled score report (not a raw 70%)
- Cost
- Priced by the country or region where it is proctored ($99 USD in the United States)
- Delivery
- Proctored via Pearson VUE (test center or online); Certiport for students and educators
- Prerequisites
- None required; Microsoft’s audience profile assumes some experience in an area of IT
- Validity
- Does not expire — Microsoft Fundamentals certifications need no renewal
- Languages
- English, Japanese, Chinese (Simplified), Korean, Spanish, German, French, Indonesian, Arabic (Saudi Arabia), Chinese (Traditional), Italian, Portuguese (Brazil), Russian
Sources: Microsoft — Azure Fundamentals certification · AZ-900 study guide (skills measured as of July 20, 2026) · Microsoft — certification renewal policy. Confirm pricing for your region when you schedule.
About the AZ-900 Azure Fundamentals certification
AZ-900 earns Microsoft Certified: Azure Fundamentals, Microsoft’s beginner-level proof that you can describe cloud concepts in general and Azure in particular — compute, networking, and storage services, plus the features and tools used to secure, govern, and administer Azure. It is a conceptual exam: you will be asked which Azure construct, service, or governance tool fits a described need, not to configure one. There are no prerequisites and the credential does not expire.
The current edition is “skills measured as of July 20, 2026.” Microsoft’s change log lists it as minor wording updates to compute and networking, deployment tooling, and monitoring — the three domains and their weight ranges did not move. One correction worth making loudly: some prep material claims AZ-900 now tests Azure AI services, Copilot, or Responsible AI. The official outline contains no AI objectives at all; that content belongs to AI-900 Azure AI Fundamentals. What the outline does stress, and many candidates under-study, is identity and security — Microsoft Entra ID, Conditional Access, Zero Trust, defense-in-depth, and Microsoft Defender for Cloud all sit inside the architecture and services domain.
Every PowerKram question is tagged to one of the three domains and links to the Microsoft Learn page it derives from, so a missed question becomes a specific page to read. To see where Azure Fundamentals sits among the AWS, Azure, and Google Cloud entry points, read our guide to choosing a cloud certification track.
AZ-900 exam domains and weights
Microsoft publishes three weighted domains as ranges. Azure architecture and services is the heaviest at 35–40% — and the broadest, because identity and security live inside it. Plan study time roughly in proportion.
Regions, region pairs, sovereign regions, availability zones, and the resource group → subscription → management group hierarchy; compute (VMs, scale sets, Azure Virtual Desktop, containers, functions) and networking (virtual networks, peering, Azure DNS, VPN Gateway, ExpressRoute, public and private endpoints); storage tiers, redundancy, and migration tools; identity, access, and security.
Cost factors, the pricing calculator, cost management, and tags; Microsoft Purview, Azure Policy, and resource locks; the portal, Cloud Shell, CLI, PowerShell, Azure Arc, infrastructure as code, and ARM templates; Azure Advisor, Service Health, and Azure Monitor.
Cloud computing, the shared responsibility model, public/private/hybrid models, the consumption-based model and pricing models, and serverless; the benefits of high availability, scalability, reliability, predictability, security, governance, and manageability; IaaS, PaaS, and SaaS with their use cases.
Source: Microsoft AZ-900 study guide — skills measured as of July 20, 2026. Ranges are Microsoft’s; actual exam composition varies within them.
Who the AZ-900 exam is for
Microsoft’s audience profile describes a technology professional who wants to prove foundational cloud and Azure knowledge, with experience in an area of IT such as infrastructure, database management, or software development. In practice that covers:
- On-premises IT staff — server, network, and help-desk roles mapping existing skills onto Azure’s regions, subscriptions, and identity model.
- Developers and database professionals building the platform vocabulary before AZ-204 or DP-series exams.
- Career switchers and students with some IT exposure who want a first Azure credential that never lapses.
- Technical sellers, project managers, and procurement staff working on Azure deals — there are no prerequisites, though the exam is written for readers comfortable with IT terms.
AZ-900 is the on-ramp, not the destination. The usual next step is AZ-104 Azure Administrator; sibling fundamentals such as SC-900 and DP-900 pair naturally. For the roles an Azure foundation supports — with skills, credentials, and salary ranges — see our Azure and cloud career roadmap.
What this AZ-900 practice exam delivers
Learn mode
The answer, the reasoning, and why each distractor is wrong, immediately after every question — built for the “which service fits” judgment AZ-900 rewards, such as ExpressRoute versus VPN Gateway or a resource lock versus Azure Policy.
Exam mode
A timed run against Microsoft’s 45-minute limit, reported on the three domains, so pacing and the scaled 700 bar feel familiar before test day.
Score by AZ-900 domain
Results split across cloud concepts, architecture and services, and management and governance — so you can see whether the heavy 35–40% architecture domain, identity included, is where your points are leaking.
Source-linked explanations
All 762 questions cite the Microsoft Learn page they were built from — storage redundancy, Conditional Access, Azure Arc, ARM templates — so you verify against Microsoft, not memorize a letter.
Sample AZ-900 practice questions
Ten free scenario questions spread across the three domains in rough proportion to their weights, each with a full explanation and a source link to Microsoft Learn. The complete 762-question bank comes with full access.
A hospital must keep patient records in its own datacenter for regulatory reasons, but wants to run its seasonal analytics workloads in Azure and connect the two environments.
Which cloud model fits this requirement?
- Public cloud only
- Private cloud only
- Hybrid cloud
- Software as a service
Show answer & explanation
Correct: C — Hybrid cloud. A hybrid model combines on-premises (private) infrastructure with public cloud resources and connects them, so regulated data stays in the hospital’s datacenter while elastic analytics runs in Azure.
Why not the others: public cloud only (A) would move the regulated records off-premises; private cloud only (B) forgoes Azure for the analytics; SaaS (D) is a service type, not a deployment model, and doesn’t describe where the records live.
Source: Microsoft Learn — Hybrid architecture considerations →A company is moving email to a SaaS offering, a web app to PaaS, and a legacy server to IaaS, and wants to know which security duties never transfer to Microsoft.
Under the shared responsibility model, which responsibilities stay with the customer in every service type?
- Physical datacenter, physical hosts, and physical network
- Information and data, devices, and accounts and identities
- The hypervisor and host operating system
- Network controls and application-level security
Show answer & explanation
Correct: B. In Microsoft’s model the customer always retains responsibility for its information and data, the endpoints and devices that access it, and its accounts and identities — whether the workload is IaaS, PaaS, or SaaS.
Why not the others: the physical datacenter, hosts, and network (A) are always Microsoft’s; the hypervisor and host OS (C) belong to Microsoft once you are in the cloud; network controls and application security (D) shift between customer and Microsoft depending on the service type, so they are not “always” the customer’s.
Source: Microsoft Learn — Shared responsibility in the cloud → Further reading: PowerKram — Enterprise Security Practices →A concert-ticketing site runs on Azure. During on-sale events it automatically adds virtual machine instances, then removes them when traffic drops so it stops paying for idle capacity.
Which cloud benefit is the site using?
- Scalability — scaling out and back in automatically to match demand
- Predictability — a fixed monthly bill regardless of usage
- Reliability — recovering from a regional disaster
- Manageability — deploying through templates and the portal
Show answer & explanation
Correct: A — Scalability. Adding instances when load rises and removing them when it falls is horizontal scaling (scale out and in); doing it automatically with autoscale means you pay only for the capacity the demand requires.
Why not the others: predictability (B) concerns forecasting cost and performance, and this bill deliberately varies with usage; reliability (C) is about recovering from failures, not handling load spikes; manageability (D) describes how you manage resources, not how capacity tracks demand.
Source: Microsoft Learn — Autoscale in Azure →An insurer runs a claims application in a single Azure region and needs it to survive the failure of an entire datacenter without moving to another region.
What should they do?
- Place all virtual machines in one resource group
- Create a second subscription for the application
- Apply a tag marking the workload as critical
- Deploy the application across multiple availability zones in the region
Show answer & explanation
Correct: D — Availability zones. Availability zones are physically separate groups of datacenters within one region, each with independent power, cooling, and networking; spreading the app across zones keeps it running if one datacenter fails.
Why not the others: a resource group (A) is a logical container with no physical placement; a second subscription (B) is a billing and management boundary, not resilience; a tag (C) is metadata and changes nothing about where resources run.
Source: Microsoft Learn — What are availability zones? →A media company stores video archives in Azure Storage. The data must survive a full regional outage, and its apps must be able to read from the secondary region even before Microsoft initiates a failover.
Which redundancy option meets both needs?
- Locally redundant storage (LRS)
- Read-access geo-redundant storage (RA-GRS)
- Zone-redundant storage (ZRS)
- Geo-redundant storage (GRS) without read access
Show answer & explanation
Correct: B — RA-GRS. Geo-redundant storage copies data to a paired secondary region, protecting against a regional outage; the read-access variant also lets applications read the secondary copy at any time, not only after a failover.
Why not the others: LRS (A) keeps all copies in one datacenter; ZRS (C) spreads copies across zones but stays within a single region; plain GRS (D) survives a regional outage but the secondary is readable only after failover.
Source: Microsoft Learn — Azure Storage redundancy →A bank wants to connect its on-premises network to Azure over a dedicated private connection through a connectivity provider, with traffic that does not travel over the public internet.
Which Azure service provides this?
- Azure VPN Gateway with a site-to-site tunnel
- Virtual network peering
- Azure ExpressRoute
- Azure DNS
Show answer & explanation
Correct: C — Azure ExpressRoute. ExpressRoute extends an on-premises network into Microsoft’s cloud over a private connection supplied by a connectivity provider, so traffic does not traverse the public internet.
Why not the others: a site-to-site VPN Gateway (A) is encrypted but runs over the public internet; virtual network peering (B) connects Azure virtual networks to each other, not to on-premises; Azure DNS (D) hosts name resolution and provides no connectivity.
Source: Microsoft Learn — What is Azure ExpressRoute? →A security team wants employees to sign in with just a password from the corporate network, but be prompted for multifactor authentication when signing in from anywhere else.
Which Microsoft Entra capability enforces this rule?
- Azure role-based access control (RBAC)
- Microsoft Entra Conditional Access
- Microsoft Entra Domain Services
- Azure resource locks
Show answer & explanation
Correct: B — Conditional Access. Conditional Access evaluates signals such as user, location, and device at sign-in and then applies a decision — allow, block, or require MFA — which is exactly a location-based MFA policy.
Why not the others: RBAC (A) controls what an authenticated user can do to Azure resources, not how they sign in; Entra Domain Services (C) provides managed domain features like LDAP and Kerberos for legacy apps; resource locks (D) protect resources from deletion or change and have nothing to do with authentication.
Source: Microsoft Learn — What is Conditional Access? → Further reading: PowerKram — Identity, MFA & Conditional Access (SC-300 guide) →An operations lead wants to stop anyone — including subscription owners — from accidentally deleting a production database, while still allowing its settings to be changed.
What should they apply?
- A CanNotDelete (Delete) resource lock on the database
- A ReadOnly resource lock on the database
- A tag labeling the database as production
- An Azure Advisor recommendation
Show answer & explanation
Correct: A — a CanNotDelete lock. A delete lock lets authorized users read and modify the resource but blocks deletion, and locks apply regardless of the user’s RBAC role until the lock is removed.
Why not the others: a ReadOnly lock (B) also blocks modification, which the lead wants to keep; a tag (C) is only metadata and prevents nothing; Azure Advisor (D) makes recommendations but enforces no restriction.
Source: Microsoft Learn — Lock your resources →A retailer runs servers in its own datacenter and in another cloud provider. It wants to see and govern them in the Azure portal and apply Azure Policy to them alongside its Azure resources.
Which service makes this possible?
- Azure Migrate
- Azure Virtual Desktop
- Azure Service Health
- Azure Arc
Show answer & explanation
Correct: D — Azure Arc. Azure Arc projects servers, Kubernetes clusters, and data services running outside Azure — on-premises or in other clouds — into Azure Resource Manager, so they can be managed and governed with Azure tools such as Azure Policy.
Why not the others: Azure Migrate (A) assesses and moves workloads into Azure rather than governing them where they are; Azure Virtual Desktop (B) delivers virtual desktops; Service Health (C) reports on Azure platform incidents, not your external servers.
Source: Microsoft Learn — Azure Arc overview →A platform team wants every test environment deployed identically from a declarative file kept in source control, so the same definition can be redeployed repeatably.
Which approach does this describe?
- Creating each environment manually in the Azure portal
- Running one-off Azure CLI commands from Cloud Shell
- Infrastructure as code using Azure Resource Manager (ARM) templates
- Tracking environments with tags in Microsoft Cost Management
Show answer & explanation
Correct: C — Infrastructure as code with ARM templates. An ARM template is a declarative JSON definition of the resources to deploy; stored in source control, it redeploys the same environment consistently every time.
Why not the others: manual portal work (A) is not repeatable or versioned; ad-hoc CLI commands (B) are imperative one-offs rather than a declarative definition; tags in Cost Management (D) track spend and deploy nothing.
Source: Microsoft Learn — What are ARM templates? → Further reading: PowerKram — DevOps & Infrastructure as Code guide →Keep going: study guides and career paths
AZ-900 opens Microsoft’s role-based Azure track and shows up as step one on several PowerKram career paths. Two places to go next.
Deep dive: AZ-900 format and scoring, the July 2026 edition, common traps, study plan, and retakes
Format and how it’s scored
You have 45 minutes to complete AZ-900, proctored through Pearson VUE at a test center or online (students and educators can also schedule through Certiport). Microsoft does not publish a fixed question count, and the exam may include interactive components. Scoring is scaled: you need 700 on the score report, which is not the same as 70% of questions correct, because the score reflects item weighting. Microsoft prices the exam by country or region — $99 USD in the United States. Microsoft — exam scoring and score reports →
The July 20, 2026 edition — and what it does not add
The current skills outline took effect July 20, 2026. Microsoft’s change log marks it as minor updates inside three sub-areas — compute and networking services, tools for managing and deploying resources, and monitoring tools — with no change to the domains, their weights, or the audience profile. English updates first; localized versions typically follow about eight weeks later, and you can request 30 extra minutes if the exam isn’t offered in your language. Despite widespread claims, there are no AI, Copilot, or Responsible AI objectives on AZ-900; if AI is your interest, AI-900 is the exam that covers it. AZ-900 study guide and change log →
Common traps
“Fundamentals” does not mean vague. The recurring traps: storage redundancy acronyms (LRS, ZRS, GRS, GZRS and their read-access variants — know which failure each survives); VPN Gateway versus ExpressRoute (encrypted over the internet versus a private provider circuit); resource locks versus Azure Policy versus RBAC (protect a resource, enforce a rule, or grant a permission); and the Entra naming, where “Azure Active Directory” is now Microsoft Entra ID. One currency note: Azure Blueprints is being retired in phases — no new definitions after July 31, 2026, full retirement January 31, 2027 — and it is not on the current outline, so treat it as a distractor. Microsoft — Azure Blueprints retirement timeline →
Realistic study plan
Two to four weeks at a few hours a week is typical, less if you already work in IT. Work through Microsoft’s free AZ-900 course content on Microsoft Learn, open an Azure account to click through the portal, Cloud Shell, and a storage account’s redundancy settings, and weight your time toward architecture and services — especially identity and security, which candidates under-study. Use PowerKram Learn mode with the sourced links to close gaps while the reasoning is fresh, then finish with Exam-mode runs under the 45-minute clock. Microsoft Learn — AZ-900T00 Azure Fundamentals course →
Retakes, renewal, and what comes next
If you don’t pass, you can retake after 24 hours; later attempts require a 14-day wait, with a maximum of five attempts in 12 months. There is nothing to renew — Microsoft Fundamentals certifications do not expire. From here, most candidates head to AZ-104 Azure Administrator, AZ-204 Azure Developer, or a sibling fundamentals exam such as SC-900 or DP-900. Explore where Microsoft certifications lead in cloud engineering →
AZ-900 exam FAQ
What are the AZ-900 exam domains and weights?
Does AZ-900 test Azure AI, Copilot, or Responsible AI?
How long is AZ-900, how many questions are there, and what score do I need?
Does the Azure Fundamentals certification expire?
What happens if I fail AZ-900?
How long do I get access to this AZ-900 practice exam, and is it a subscription?
Who should take AZ-900, and what comes after it?
Prepare now, pay over time with Affirm & Klarna
Split the cost of full AZ-900 access into scheduled payments at checkout with Affirm or Klarna. Choose your plan when you check out.
Get full AZ-900 exam access
All 762 questions across the three domains, both study modes, source-linked explanations, score-by-domain, and unlimited retakes for your whole access period.
or 12 months for $69.99 $159.99 — save $90 (56%)
Buy one exam, get a second free — and it’s backed by our satisfaction guarantee.