AZ-900 Azure Architecture and Services Practice Questions (35–40% of the Exam)

Azure Architecture and Services is 35–40% of the exam, the largest domain. It covers regions, availability zones and the resource hierarchy, compute and networking, storage tiers and redundancy, and identity, access and security. Answer these 10 free questions with no signup, written to Microsoft's July 20, 2026 skills outline.

Last updated November 10, 2026.

10 Free AZ-900 Azure Architecture and Services Questions with Answers

Question 1: Azure Architecture and Services

A US federal agency wants to run workloads in Azure. Its compliance rules require an instance of Azure that is physically and logically isolated from the public cloud and operated by screened US personnel. What should it use?

  1. Azure Government regions
  2. A paired public US region
  3. Azure operated by 21Vianet
  4. A zone-enabled US region

Correct answer: A. A is correct because Azure Government regions, such as US Gov Virginia and US Gov Arizona, are isolated instances of Azure for US government agencies and partners, operated by screened US personnel. B is incorrect because a paired public region such as East US is part of the main global instance of Azure, so it is not isolated for government use. C is incorrect because Azure operated by 21Vianet is the sovereign instance for mainland China, run through a partnership with 21Vianet rather than for US agencies. D is incorrect because availability zones add datacenter-level resiliency inside a public region but do not create an isolated government instance.

Question 2: Azure Architecture and Services

Which statement about Azure regions is true?

  1. Every region contains a minimum of three availability zones
  2. Every region offers the same VM sizes and storage types
  3. Some services, such as Azure DNS, don't need a region chosen
  4. A region is made up of exactly one Azure datacenter

Correct answer: C. C is correct because a few global services, such as Microsoft Entra ID, Azure Traffic Manager and Azure DNS, are not deployed to a particular region. A is incorrect because the three-zone minimum applies to zone-enabled regions, and not every Azure region supports availability zones. B is incorrect because some services and VM features, such as specific VM sizes or storage types, are available in certain regions and not others. D is incorrect because a region contains at least one datacenter and often several nearby datacenters joined by a low-latency network.

Question 3: Azure Architecture and Services

A company wants development and production kept apart, with different access rules and a different spending limit for each environment. Which separation is the natural fit?

  1. Separate Azure regions
  2. Separate resource groups
  3. Separate availability zones
  4. Separate subscriptions

Correct answer: D. D is correct because subscriptions are both an access control boundary and a billing boundary, so each can have its own access policies and spending limits. A is incorrect because regions decide where resources physically run, not how access or spending is controlled. B is incorrect because resource groups can separate access, but they all share the subscription's billing and spending limit. C is incorrect because availability zones are physical resiliency boundaries inside a region and do not carry access rules or spending limits.

Question 4: Azure Architecture and Services

To place web servers and database servers in separate segments of one virtual network's address space, so that different traffic rules can apply to each, you should create ___.

  1. separate resource groups
  2. separate subnets
  3. separate peering links
  4. separate availability sets

Correct answer: B. B is correct because subnets divide a virtual network's address space into named segments, and each can be given its own traffic rules. A is incorrect because resource groups organize resources for management and do not divide a network's address space. C is incorrect because peering connects one virtual network to another rather than dividing one network into segments. D is incorrect because availability sets spread VMs across fault and update domains and do not segment network addresses.

Question 5: Azure Architecture and Services

What is the term for an endpoint that has a public IP address and can be accessed from anywhere in the world?

  1. Network interface
  2. Private endpoint
  3. Public endpoint
  4. Service endpoint

Correct answer: C. C is correct because a public endpoint has a public IP address, so it can be reached from anywhere in the world unless access is restricted. A is incorrect because a network interface connects a VM to a subnet and carries its IP configuration, rather than being an endpoint type. B is incorrect because a private endpoint sits in a virtual network and has a private IP address from that network's address space. D is incorrect because a service endpoint extends a subnet to services such as Storage or SQL for optimal routing; it is not the internet-facing address.

Question 6: Azure Architecture and Services

A company runs a primary and a secondary database server as two VMs with different configurations. It wants to reduce the chance that one hardware failure or one planned maintenance event takes down both VMs at the same time. It does not need autoscaling. What should it use?

  1. A proximity placement group
  2. A Virtual Machine Scale Set
  3. An Azure Dedicated Host
  4. An availability set

Correct answer: D. D is correct because an availability set spreads VMs across fault domains and update domains, so a single hardware failure or maintenance event does not affect both VMs. A is incorrect because a proximity placement group keeps VMs physically close for low latency, which does not spread them across failure points. B is incorrect because a scale set manages a group of identical VMs from one configuration, which does not suit two differently configured servers. C is incorrect because a dedicated host reserves a single physical server for your VMs, so both VMs would share the same hardware.

Question 7: Azure Architecture and Services

An app reads messages from the storage account named contosodata. It connects to the endpoint https://contosodata.___.core.windows.net.

  1. table
  2. queue
  3. file
  4. blob

Correct answer: B. B is correct because Queue Storage uses the queue service endpoint, which combines the unique account name with queue.core.windows.net. A is incorrect because the table endpoint is used by Table Storage for structured NoSQL entities, not for messages. C is incorrect because the file endpoint is used by Azure Files for file shares, not for messages. D is incorrect because the blob endpoint is used by Blob Storage for objects such as files and media, not for messages.

Question 8: Azure Architecture and Services

A company is moving a legacy app to Azure VMs. The app reads its configuration from a mapped network drive, and several Azure VMs and on-premises servers must mount that same share at the same time over SMB. Which Azure Storage service should it use?

  1. Azure Files
  2. Azure Blob Storage
  3. Azure Table Storage
  4. Azure Disk Storage

Correct answer: A. A is correct because Azure Files offers fully managed file shares that cloud and on-premises machines can mount at the same time over SMB or NFS. B is incorrect because Blob Storage is object storage accessed through REST APIs and URLs, which does not match an app that expects a mapped SMB drive. C is incorrect because Table Storage holds structured NoSQL entities and does not present data as a mountable network file share. D is incorrect because a managed disk is a block-level volume attached to a virtual machine, so it is not a share that on-premises servers can mount over SMB.

Question 9: Azure Architecture and Services

An organization's on-premises Active Directory does not monitor sign-in behavior. The security team wants Microsoft to flag suspicious sign-in attempts, such as sign-ins from unexpected locations or unknown devices, at no extra cost. What should the organization connect its directory to?

  1. Microsoft Entra Domain Services
  2. Azure role-based access control
  3. Microsoft Entra ID
  4. A second on-premises domain controller

Correct answer: C. C is correct because once on-premises AD is connected to Microsoft Entra ID, Microsoft can detect suspicious sign-in attempts such as unexpected locations or unknown devices. A is incorrect because Entra Domain Services provides a managed domain for legacy apps in Azure and is not the service that analyzes cloud sign-in behavior. B is incorrect because Azure RBAC grants permissions to Azure resources and does not analyze where or how users sign in. D is incorrect because an additional domain controller adds capacity and redundancy but still provides no sign-in risk monitoring.

Question 10: Azure Architecture and Services

Which statement about Microsoft Entra Conditional Access is true?

  1. It scans deployed Azure resources and reports noncompliant configurations
  2. It collects sign-in signals, decides, and then allows, blocks, or requires MFA
  3. It sets which actions a user may perform on Azure resources after sign-in
  4. It applies the same MFA prompt to every sign-in, whatever the signals

Correct answer: B. B is correct because Conditional Access gathers signals such as user, location and device, makes a decision from them and enforces it by allowing, blocking or challenging for MFA. A is incorrect because evaluating resource configuration for compliance is what Azure Policy does. C is incorrect because deciding which actions a user can take on Azure resources is the job of Azure role-based access control. D is incorrect because Conditional Access gives a more granular MFA experience, for example skipping the prompt at a known location.

Azure Architecture and Services Subsections in Microsoft's Outline

SubsectionSkills outline areaDomainQuestions
2.1Core architectural componentsAzure Architecture and Services45
2.2Compute and networkingAzure Architecture and Services55
2.3StorageAzure Architecture and Services45
2.4Identity, access and securityAzure Architecture and Services45

More AZ-900 Practice

FlashGenius is not affiliated with or endorsed by Microsoft. Microsoft, Azure and AZ-900 are trademarks of Microsoft. These are original practice questions, not questions from the real exam. Your score here is practice accuracy, not a Microsoft score or a pass prediction.