Describe Azure architecture and services
Domain 2 of AZ-900 accounts for 35-40% of the exam, the heaviest part of the syllabus. EarnYourCert has 183 original questions for this domain, all with explanations: 115 multiple choice, 37 yes/no and 31 completion or ordering items, like the real exam.
What this domain covers
- Regions, region pairs and availability zones
- Management groups, subscriptions and resource groups
- Compute: virtual machines, scale sets, App Service, containers and Functions
- Networking: VNets, peering, VPN Gateway and ExpressRoute
- Storage: access tiers and redundancy (LRS, ZRS, GRS, GZRS)
- Identity: Microsoft Entra ID, MFA, Conditional Access and Zero Trust
Domain 2 sample questions
8 questions from our 183-question bank for this domain. Try to answer before revealing the solution.
1. A multinational company plans to deploy its application in an Azure region that offers availability zones. At minimum, how many availability zones does an "availability zone region" in Azure typically have?
- At least ten
- Exactly one
- At least three
- Exactly two
Show answer
Correct answer: C. A region considered "availability zone enabled" in Azure offers a minimum of three independent zones, each with its own power, cooling, and networking, enabling resilient workload distribution. A single zone would provide no zone redundancy. Two zones aren't sufficient for the fault-tolerance model Azure defines for these regions. Ten is far more than any region currently offers.
2. A company has a management group hierarchy with a "Production" group and a "Non-Production" group. An administrator moves a subscription from "Non-Production" to "Production". What effect does this change have on inherited policies and permissions?
- The subscription permanently retains the policies and permissions of both groups simultaneously
- The subscription must be deleted and recreated for the new policies to apply
- Moving management groups has no effect on any policy or permission, since these are only assigned at the resource level
- The subscription stops inheriting policies and permissions from "Non-Production" and starts inheriting those of "Production"
Show answer
Correct answer: D. Policy and permission inheritance in the management group hierarchy follows the subscription's current position; when moved to a new group, it stops inheriting from the old group and starts inheriting from the new one. It doesn't permanently retain both, policies can be assigned at multiple levels (not just individual resources), and the subscription doesn't need to be deleted and recreated for the change to take effect.
3. A company has an Azure subscription and wants to ensure that, before creating resources of type "Microsoft.Sql/servers", the platform recognizes and enables that resource type in the subscription. What process describes this?
- Transferring the subscription to a new management group
- Registering the corresponding resource provider on the subscription
- Assigning a "SQL" type tag to the subscription
- Creating a new availability zone for that subscription
Show answer
Correct answer: B. Before resource types from a service can be used, its resource provider (in this case "Microsoft.Sql") must be registered on the subscription; many providers are auto-registered, but some require manual registration. Availability zones are physical locations unrelated to service registration. Tags are descriptive metadata with no functional effect. Changing management group affects governance, not resource provider registration.
4. What is the main difference between a public IP address and a private IP address in Azure?
- Both addresses are equally reachable from the internet
- A public IP can only be used on Spot virtual machines
- A private IP is billed twice as much as a public one
- A public IP is internet-reachable; a private IP is not
Show answer
Correct answer: D. A public IP address allows a resource to be reachable from the internet, while a private IP address only allows communication within the virtual network or networks connected to it.
5. A company has applications deployed in Azure and in its on-premises datacenter, and wants user requests routed to the best-performing endpoint (lowest latency) based on the user's location, at the name resolution level. Which Azure service best fits this?
- Azure Traffic Manager with performance routing
- Azure Virtual Network NAT Gateway for outbound network address translation
- Azure Service Bus for asynchronous messaging between decoupled components
- Azure Bastion for secure access to virtual machines without a public IP
Show answer
Correct answer: A. Azure Traffic Manager is a DNS-based traffic load balancer that can direct clients to the lowest-latency endpoint based on their geographic location, working with endpoints both in Azure and outside Azure (including on-premises). Azure Bastion provides secure remote access to VMs, not application traffic routing. NAT Gateway manages outbound address translation, not performance-based inbound routing. Azure Service Bus is a messaging service, not a network traffic routing service.
6. A developer writes an Azure Functions function that must run automatically every time a new file is uploaded to a Blob Storage container, without needing to periodically poll the storage. Which Azure Functions element makes this automatic execution possible?
- An availability zone
- A Blob Storage trigger
- A network security group
- A virtual network peering
Show answer
Correct answer: B. A trigger in Azure Functions defines the event that causes the function to execute; the Blob Storage trigger makes the function run automatically when a blob is created or modified, without manual polling. An availability zone is a physical datacenter location. A network security group filters network traffic. Virtual network peering connects VNets; none of these trigger function execution.
7. Which Azure Storage blob type is optimized for fast append operations, such as log files that are continuously appended to?
- Archive blob
- Block blob
- Page blob
- Append blob
Show answer
Correct answer: D. Append blobs are optimized for append operations, making them ideal for scenarios like logging, where data is continuously added to the end of the file.
8. An employee enters their username and password to sign in to an application. The system verifies that these credentials are correct and correspond to a registered user. Which security process does this action describe?
- Data governance
- Authentication
- Encryption in transit
- Authorization
Show answer
Correct answer: B. Authentication is the process of verifying that a user is who they claim to be, typically using credentials such as a username and password. Authorization is a subsequent step that determines what that already-authenticated user is allowed to do. Encryption in transit protects data while it travels over the network, unrelated to identity verification. Data governance refers to data management policies, not user identity verification.