AZ-900 Exam Review: Key Concepts Summary
Key Takeaways
AZ-900 offers 45 minutes of exam time; Microsoft does not publish the item count, passing is a scaled 700/1,000, and the U.S. list price is $99 before conditional offers.
Domain 1 Cloud Concepts is weighted 25–30% and covers cloud models, shared responsibility, and cloud economics.
Domain 2 Azure Architecture and Services is weighted 35–40% and includes regions, zones, resource hierarchy, and core services.
Domain 3 Management and Governance is weighted 30–35% and includes Pricing Calculator, Cost Management, tags, Policy, and monitoring.
For two independent dependent components at 99.9% availability each, multiplication gives 99.8001%, about 99.80%, not 99.81%.
Exam logistics you should walk in knowing (verified 2026)
| Item | Fact |
|---|---|
| Exam code / name | AZ-900: Microsoft Azure Fundamentals |
| Questions | Count not published for AZ-900 (most Microsoft exams have 40-60); Microsoft does not list question types in advance |
| Time | 45 minutes of exam time (about 65 minutes of seat time) |
| Scoring | Scaled 1–1,000; pass at 700 (not a raw 70%) |
| Cost | USD $99 U.S. list price (varies by country/taxes; promotions conditional) |
| Prerequisites | None |
| Validity | Fundamentals certifications do not expire — no annual renewal |
| Objectives updated | July 20, 2026 published skills outline (three domains; no separate AI expansion) |
Domain 1: Cloud Concepts (25-30%)
| Concept | Key fact |
|---|---|
| CapEx vs OpEx | CapEx = buy hardware up front; OpEx = pay-as-you-go for cloud services |
| IaaS | You manage OS + runtime + apps + data (Azure VMs) |
| PaaS | Provider manages OS; you manage app, data, settings, and identities (App Service) |
| SaaS | You retain responsibility for data, settings, identities, access, and endpoints (Microsoft 365) |
| Shared responsibility | The customer always owns data, accounts/identities, and devices, regardless of model |
| Public / Private / Hybrid | Multi-tenant / single-tenant dedicated / a mix of both |
| Scalability vs Elasticity | Scalability = ability to grow; elasticity = ability to scale capacity up and down with demand; automation depends on configuration |
| High availability | Redundancy that keeps a service running, backed by an SLA |
Trap: Scalability is the ability to change capacity; elasticity is the ability to expand and contract with demand. That adjustment may be automated, but automation is a configuration choice. The customer retains responsibilities for its data and identities across service models.
Domain 2: Azure Architecture & Services (35-40%)
Global infrastructure & hierarchy
| Concept | Key fact |
|---|---|
| Region | One or more datacenters in a latency-defined regional perimeter |
| Availability Zone | A separate location within a region containing one or more datacenters; zone-aware designs can survive a zone outage |
| Region pair | A Microsoft-defined pair in some geographies; not all regions are paired and pairing alone does not deploy disaster recovery |
| Hierarchy | Management group > Subscription > Resource group > Resource |
| Resource group | Logical container; each resource lives in exactly one group |
| ARM | Azure Resource Manager — the single control plane for all management tools |
Compute & networking at a glance
| Service | When to use |
|---|---|
| Azure VMs (IaaS) | Full OS control, lift-and-shift |
| App Service (PaaS) | Web apps and APIs without managing servers |
| Azure Functions | Event-driven compute; serverless plans (Flex Consumption recommended) meter executions |
| AKS | Orchestrate complex multi-container microservices |
| VPN Gateway | Encrypted tunnel over the internet to on-prem |
| ExpressRoute | Private connectivity that does not traverse the public internet |
| Load Balancer / App Gateway / Front Door | L4 / L7+WAF / global L7+CDN |
Storage & identity
| Service | Key fact |
|---|---|
| Blob / Files / Queue / Table | Unstructured / SMB shares / async messaging / NoSQL key-value |
| LRS, ZRS, GRS, GZRS | Local, zone, geo, or geo-zone redundancy; exact placement and failover behavior depend on account option |
| Entra ID | Cloud identity: SSO, MFA, Conditional Access |
| RBAC vs Azure Policy | RBAC = who can do things; Policy = what resources are allowed |
Domain 3: Management & Governance (30-35%)
| Concept | Key fact |
|---|---|
| Pricing Calculator | Estimate cost before deploying |
| Azure Migrate business case | Optional migration economics context; the TCO Calculator has been retired |
| Cost Management | Track actual spend, set budgets and alerts |
| Azure Advisor | Free recommendations across cost, security, reliability, performance, operations |
| Azure Policy | Enforce rules (e.g., allowed regions, required tags) |
| Resource locks | CanNotDelete or ReadOnly to prevent accidents |
| Tags | Key-value metadata; not inherited by child resources by default |
| ARM templates / Bicep | JSON IaC / simpler DSL that compiles to ARM JSON |
| Azure Monitor / Log Analytics / App Insights | Telemetry / KQL log queries / app performance monitoring |
| Service Health | Personalized Azure outage and maintenance notices |
Optional architecture context: availability arithmetic
A 99.9% monthly availability target corresponds to about 43 minutes of unavailability in a 30-day month. In a simplified model where two required services fail independently, you multiply their availability percentages: 99.9% × 99.9% = 99.8001% (about 99.80%). A real SLA depends on architecture, service terms, and shared-failure modes; multiplication is an optional planning illustration, not a published AZ-900 arithmetic objective or a contractual promise.
Final exam-day checklist
- Three service models (IaaS/PaaS/SaaS) and the shared responsibility split
- Public / private / hybrid deployment models
- Regions, Availability Zones, region pairs
- The four-level resource hierarchy
- VMs vs App Service vs Functions
- VPN Gateway vs ExpressRoute
- Storage redundancy (LRS/ZRS/GRS/GZRS) and tiers
- Entra ID, RBAC vs Azure Policy, Zero Trust principles
- Pricing Calculator vs Cost Management; migration business case is broader context
- Locks, tags, ARM/Bicep, Monitor, and SLA multiplication
Final Tip: AZ-900 tests breadth, not depth — you do not configure or code anything. Pass at a scaled 700/1,000, manage your 45 minutes, eliminate clearly wrong options, and answer every item because there is no guessing penalty.
What is the passing score for the AZ-900 exam?
70% of questions correct
700 on a 1–1,000 scaled score
800 out of 1000
A simple majority of correct answers
In an illustrative architecture where both services are required and their failures are independent, each service has 99.9% availability. What is the modeled combined availability?
99.9%
99.8001% (about 99.80%)
99.99%
100%
A company must protect data against a complete Azure region failure. Which storage redundancy option meets the requirement?
Locally Redundant Storage (LRS)
Zone-Redundant Storage (ZRS)
Geo-Redundant Storage (GRS)
Premium SSD
Hot access tier
Which THREE statements are principles of the Zero Trust model? (Select THREE)
Select all that apply
Verify explicitly
Trust all traffic on the internal network
Use least privilege access
Assume breach
Grant every authenticated user full access
Sections you finish are checked off in the contents.