AZ-900 — Microsoft Azure Fundamentals Quick Review

Quick Review focus

This independent Quick Review is for candidates preparing for the real Microsoft Azure Fundamentals (AZ-900) exam from Microsoft. Use it to refresh high-yield concepts before moving into topic drills, mock exams, and detailed explanations.

AZ-900 is a recognition-and-understanding exam. You usually need to identify the best Azure service, pricing concept, security control, governance tool, or cloud model from short scenarios. The main challenge is not deep configuration; it is choosing the correct concept quickly and avoiding similar-sounding distractors.

What to know at a glance

Cloud concepts

Cloud service models

Common trap: Virtual Machines are IaaS, even when hosted in Azure. Azure App Service and Azure Functions are PaaS-style services because you do not manage the underlying server OS.

Deployment models

Core cloud benefits

CapEx vs OpEx

Shared responsibility model

The shared responsibility model is one of the most frequently tested AZ-900 concepts. The more managed the service, the more responsibility Microsoft carries for the platform, but the customer still owns identity decisions, data, access, and configuration choices.

High-yield rule: Microsoft secures the cloud infrastructure; customers secure what they put in the cloud and how they allow access to it.

Azure architecture and resource organization

Management hierarchy

Important rules:

• A resource belongs to one resource group.
• A resource group belongs to one subscription.
• Resources in the same resource group do not have to be in the same Azure region.
• Role assignments and policies can be applied at multiple scopes and inherited downward.
• Tags help with organization and cost reporting, but tags do not enforce compliance by themselves.

Regions and availability

Common trap: Availability zones are inside a region. They are not the same as regions, and they are not the same as resource groups.

Azure Resource Manager

Azure Resource Manager, often called ARM, is the deployment and management layer for Azure resources.

Compute services

Compute decision rules

Common trap: “Serverless” does not mean no servers exist. It means the customer does not manage the servers.

Storage services

Core storage types

Blob access tiers

Common trap: Archive is not for data that must be immediately readable.

Storage redundancy

Decision rule: If the question says protect against datacenter failure within the same region, think ZRS. If it says protect against regional outage, think GRS/GZRS.

Networking

Foundational networking concepts

Connectivity services

Load balancing and traffic distribution

Common trap: Traffic Manager does not directly proxy application traffic; it uses DNS to direct clients.

Identity, access, and security

Microsoft Entra ID

Microsoft Entra ID is Microsoft’s cloud identity and access management service. AZ-900 questions often test whether you can distinguish identity authentication from Azure resource authorization.

Authentication vs authorization

Common trap: Microsoft Entra ID authenticates identities. Azure RBAC authorizes management access to Azure resources.

Azure role-based access control

High-yield rule: Grant access at the least broad scope that satisfies the requirement.

Security tools

Defense in depth

Defense in depth means using layered controls rather than relying on a single security mechanism.

Governance and compliance

Governance tools

Policy vs RBAC vs locks

Common trap: If the scenario says “ensure resources can only be created in approved regions,” choose Azure Policy, not tags.

Compliance and trust resources

Pricing, cost management, and service levels

Cost drivers

Cost tools

Common trap: Use the pricing calculator before deployment to estimate Azure service costs. Use Cost Management after resources exist to monitor and manage spending.

Service level concepts

For composite availability, multiply the availability of dependent components when every component is required for the solution to work:

\[ \text{Composite availability} = A_1 \times A_2 \times A_3 \times \cdots \]

Common trap: Adding more required dependencies can reduce composite availability unless the architecture adds redundancy.

Monitoring and management

Monitoring tools

Management tools

Common trap: PowerShell and CLI can often perform similar management tasks, but they use different syntax and are preferred by different administrator workflows.

Scenario decision map

    flowchart TD
	    A[Read the scenario requirement] --> B{Need identity or access?}
	    B -->|Sign-in, MFA, SSO| C[Microsoft Entra ID]
	    B -->|Permissions on Azure resources| D[Azure RBAC]
	    B -->|Prevent noncompliant deployments| E[Azure Policy]
	    A --> F{Need compute hosting?}
	    F -->|OS control| G[Azure Virtual Machines]
	    F -->|Web app without server management| H[Azure App Service]
	    F -->|Event-driven code| I[Azure Functions]
	    F -->|Container orchestration| J[AKS]
	    A --> K{Need connectivity?}
	    K -->|Encrypted over internet| L[VPN Gateway]
	    K -->|Private circuit| M[ExpressRoute]
	    K -->|Secure VM admin without public RDP/SSH| N[Azure Bastion]
	    A --> O{Need cost planning?}
	    O -->|Estimate before deployment| P[Pricing calculator]
	    O -->|Compare on-premises to Azure| Q[TCO calculator]
	    O -->|Analyze current spend| R[Cost Management]

Common AZ-900 traps

How to use practice questions effectively

After this Quick Review, use IT Mastery practice to turn recognition into exam-speed decision making.

1. Start with topic drills for one area at a time, such as identity, pricing, storage, or networking.
2. Review every missed item with detailed explanations, especially when two Azure services seemed plausible.
3. Build a short “confusion list” of pairs you mix up, such as Azure Policy vs RBAC or VPN Gateway vs ExpressRoute.
4. Move to mixed original practice questions once individual topics feel familiar.
5. Use mock exams to practice pacing, wording recognition, and elimination.

A strong AZ-900 question bank should help you explain why the right answer is right and why the distractors are wrong.

Final quick checklist

Before your next practice set, confirm you can answer these without notes:

• Which responsibilities remain with the customer in IaaS, PaaS, and SaaS?
• When should you choose VMs, App Service, Functions, containers, or AKS?
• What is the difference between a region, availability zone, resource group, and subscription?
• Which storage service fits blobs, files, queues, tables, and VM disks?
• When do you choose LRS, ZRS, GRS, or GZRS?
• How do Microsoft Entra ID, MFA, Conditional Access, and Azure RBAC differ?
• When should you use Azure Policy, tags, locks, or management groups?
• Which tool estimates cost before deployment, compares TCO, or monitors current spend?
• Which monitoring tool fits logs, app performance, service incidents, or resource health?

Next step: take a focused AZ-900 topic drill from the question bank, review the detailed explanations, and repeat this Quick Review for any topic where you miss more than a few questions.

Continue in IT Mastery

Use this Quick Review as a final concept map, then move into IT Mastery for focused topic drills, mixed practice sets, timed mock exams, and detailed explanations. The practice questions are original IT Mastery practice items; they are not official Microsoft questions, copied live-exam content, or exam dumps.