Are flashcards effective for the AZ-900 exam?

Yes. Flashcards use active recall — retrieving an answer from memory — which research shows is one of the most effective study methods, especially in short, spaced sessions. They're ideal for AZ-900's heavy load of Azure service names and definitions.

What topics do the AZ-900 flashcards cover?

All three skill areas: Cloud concepts (shared responsibility, IaaS/PaaS/SaaS, cloud benefits), Azure architecture and services (regions, the management hierarchy, compute, networking, storage, identity), and Azure management and governance (cost tools, Azure Policy, RBAC, monitoring).

How should I study with these AZ-900 flashcards?

Lead with the highest-weighted area — Azure architecture and services (35–40%) — then management and governance, then cloud concepts. Mix the modes: flip to learn, type to test recall, match for speed, and quiz to check yourself before a full practice test.

Are the AZ-900 flashcards free?

Yes — 100% free, all four study modes, no paywall and no sign-up.

Do these flashcards match the current AZ-900 exam blueprint?

Yes. The cards are organized to the current Microsoft AZ-900 study guide (skills measured as of January 14, 2026), covering all three scored skill areas in their official proportions.

What is cloud computing?

The delivery of computing services — servers, storage, databases, networking, software, and analytics — over the internet, billed on a pay-as-you-go basis

What is the shared responsibility model?

A division of security duties between the cloud provider and the customer; what each owns shifts with the service type (IaaS, PaaS, SaaS)

Under the shared responsibility model, what is ALWAYS the customer's responsibility?

Information and data, devices, and accounts and identities — regardless of the cloud service type used

Under the shared responsibility model, what is ALWAYS Microsoft's responsibility?

Physical hosts, physical network, and the physical datacenter — regardless of service type

What is IaaS (Infrastructure as a Service)?

A cloud model that provides virtualized compute, storage, and networking; the customer manages the OS, runtime, and applications. Example: Azure Virtual Machines

What is PaaS (Platform as a Service)?

A managed platform for building and deploying apps; the provider manages OS and infrastructure, the customer manages apps and data. Example: Azure App Service

What is SaaS (Software as a Service)?

Fully managed software delivered over the internet; the provider manages almost everything and the customer just uses the app. Example: Microsoft 365

In which cloud model does the customer have the MOST responsibility?

IaaS — the customer manages the operating system, applications, and data on top of the provider's infrastructure

In which cloud model does the customer have the LEAST responsibility?

SaaS — the provider manages almost the entire stack; the customer mainly manages data, identities, and access

What is a public cloud?

Cloud services owned and operated by a third-party provider (like Microsoft) and shared across many customers over the public internet; no capital expense

What is a private cloud?

Cloud resources used exclusively by one organization, hosted on-premises or by a third party; offers more control but requires more management and cost

What is a hybrid cloud?

A computing environment that combines public and private clouds, allowing data and apps to move between them for flexibility, compliance, and gradual migration

What is Azure Arc used for?

Managing and governing servers, Kubernetes clusters, and databases across on-premises, multicloud, and edge from a single Azure control plane (key to hybrid scenarios)

What is CapEx (capital expenditure)?

Upfront spending on physical assets like servers and datacenters, depreciated over time; typical of on-premises infrastructure

What is OpEx (operational expenditure)?

Spending on services as you consume them with no large upfront cost; the cloud's pay-as-you-go model is OpEx

Does the cloud use a CapEx or OpEx model?

OpEx — you pay for resources as you consume them, converting large upfront capital costs into ongoing operational costs

What is the consumption-based (pay-as-you-go) model?

You pay only for the resources you use, with no upfront cost and the ability to stop paying when you stop using a resource

What is high availability in the cloud?

Designing services to remain accessible and operational for as much time as possible, minimizing downtime — often by spreading across availability zones

What is scalability in the cloud?

The ability to add or remove resources to match demand; includes scaling up (bigger resources) and scaling out (more instances)

What is the difference between scaling up and scaling out?

Scaling up (vertical) adds power to an existing resource; scaling out (horizontal) adds more instances of a resource

What is elasticity in the cloud?

The ability to automatically add or remove resources as demand changes in near real time, so you pay only for what you need at any moment

What is reliability in the cloud?

The ability of a system to recover from failures and continue to function; the cloud supports it with redundant, decentralized regions worldwide

What is predictability in the cloud?

Being able to forecast performance and cost; achieved through autoscaling, load balancing, and tools like the Pricing Calculator and Cost Management

What is agility in the cloud?

The ability to deploy and configure cloud resources quickly as requirements change, rather than waiting weeks to procure hardware

What is disaster recovery in the cloud?

The ability to restore services and data after a major outage, often using geo-redundant storage and services across paired regions

What is the benefit of cloud security and governance?

Centralized policy, templates, and built-in tools (like Azure Policy and Microsoft Defender for Cloud) help meet compliance and update standards consistently

What is manageability in the cloud (two meanings)?

Management OF the cloud (autoscaling, monitoring, alerts) and management IN the cloud (web portal, CLI, APIs, templates) to control resources

What is fault tolerance?

A system's ability to keep operating without interruption when one or more components fail, often through redundancy

Why does the cloud reduce time-to-market?

Resources can be provisioned in minutes instead of weeks, so teams can build, test, and deploy applications faster

What are economies of scale in the cloud?

Large providers buy compute and storage at huge volume and pass the lower per-unit cost to customers, making cloud cheaper than self-hosting

Which cloud model best fits a company that wants no responsibility for the OS or runtime, only the app's data?

SaaS — the provider manages everything except the customer's data, identities, and access

Which cloud model best fits a developer who wants to deploy code without managing servers or patching the OS?

PaaS — the platform handles infrastructure and OS while the developer focuses on the application

Which cloud model best fits lifting and shifting existing VMs to the cloud?

IaaS — you run virtual machines and control the OS, much like on-premises servers

What does 'security in the cloud' vs 'security of the cloud' mean?

Microsoft is responsible for the security OF the cloud (physical infrastructure); the customer is responsible for security IN the cloud (data, identities, configuration)

Which expense model removes the risk of over-provisioning hardware?

OpEx / consumption-based — you scale resources to actual demand instead of buying for peak capacity upfront

What is a key benefit of high availability across availability zones?

If one datacenter or zone fails, the application keeps running from another zone, minimizing downtime

What cloud deployment model lets an organization meet data-residency rules while still using public cloud for other workloads?

Hybrid cloud — keep regulated data on a private cloud or on-premises and use public cloud elsewhere

Using cloud services from more than one provider (for example Azure and another vendor) to avoid lock-in or use best-of-breed services

Why is the cloud considered more secure than many on-premises setups?

Providers offer built-in security, continuous monitoring, automatic updates, and certifications most single organizations cannot match alone

What is the main trade-off of a private cloud?

More control and isolation, but higher cost and management overhead, and you lose the elasticity and pay-as-you-go benefits of public cloud

What is an Azure region?

A set of datacenters deployed within a latency-defined perimeter and connected by a dedicated low-latency network; you choose a region to deploy resources

What is an availability zone?

A physically separate datacenter (or group) within an Azure region, each with independent power, cooling, and networking, used for high availability

What is a region pair?

Two regions in the same geography paired for disaster recovery; updates roll out one region at a time and data can be replicated between them

What is an Azure datacenter?

A physical facility containing servers and infrastructure; multiple datacenters make up an availability zone or region

How many availability zones does an enabled Azure region have at minimum?

At least three physically separated availability zones

Your FREE AZ-900 Flashcards 2026 – 300+ Cards

Realistic, AZ-900 exam-style flashcards across all 3 Azure Fundamentals skill areas — flip, match, type, and quiz yourself.

How well do you know them?

AZ-900 Flashcards

What is cloud computing?: The delivery of computing services — servers, storage, databases, networking, software, and analytics — over the internet, billed on a pay-as-you-go basis
What is the shared responsibility model?: A division of security duties between the cloud provider and the customer; what each owns shifts with the service type (IaaS, PaaS, SaaS)
Under the shared responsibility model, what is ALWAYS the customer's responsibility?: Information and data, devices, and accounts and identities — regardless of the cloud service type used
Under the shared responsibility model, what is ALWAYS Microsoft's responsibility?: Physical hosts, physical network, and the physical datacenter — regardless of service type
What is IaaS (Infrastructure as a Service)?: A cloud model that provides virtualized compute, storage, and networking; the customer manages the OS, runtime, and applications. Example: Azure Virtual Machines
What is PaaS (Platform as a Service)?: A managed platform for building and deploying apps; the provider manages OS and infrastructure, the customer manages apps and data. Example: Azure App Service
What is SaaS (Software as a Service)?: Fully managed software delivered over the internet; the provider manages almost everything and the customer just uses the app. Example: Microsoft 365
In which cloud model does the customer have the MOST responsibility?: IaaS — the customer manages the operating system, applications, and data on top of the provider's infrastructure
In which cloud model does the customer have the LEAST responsibility?: SaaS — the provider manages almost the entire stack; the customer mainly manages data, identities, and access
What is a public cloud?: Cloud services owned and operated by a third-party provider (like Microsoft) and shared across many customers over the public internet; no capital expense
What is a private cloud?: Cloud resources used exclusively by one organization, hosted on-premises or by a third party; offers more control but requires more management and cost
What is a hybrid cloud?: A computing environment that combines public and private clouds, allowing data and apps to move between them for flexibility, compliance, and gradual migration
What is Azure Arc used for?: Managing and governing servers, Kubernetes clusters, and databases across on-premises, multicloud, and edge from a single Azure control plane (key to hybrid scenarios)
What is CapEx (capital expenditure)?: Upfront spending on physical assets like servers and datacenters, depreciated over time; typical of on-premises infrastructure
What is OpEx (operational expenditure)?: Spending on services as you consume them with no large upfront cost; the cloud's pay-as-you-go model is OpEx
Does the cloud use a CapEx or OpEx model?: OpEx — you pay for resources as you consume them, converting large upfront capital costs into ongoing operational costs
What is the consumption-based (pay-as-you-go) model?: You pay only for the resources you use, with no upfront cost and the ability to stop paying when you stop using a resource
What is high availability in the cloud?: Designing services to remain accessible and operational for as much time as possible, minimizing downtime — often by spreading across availability zones
What is scalability in the cloud?: The ability to add or remove resources to match demand; includes scaling up (bigger resources) and scaling out (more instances)
What is the difference between scaling up and scaling out?: Scaling up (vertical) adds power to an existing resource; scaling out (horizontal) adds more instances of a resource
What is elasticity in the cloud?: The ability to automatically add or remove resources as demand changes in near real time, so you pay only for what you need at any moment
What is reliability in the cloud?: The ability of a system to recover from failures and continue to function; the cloud supports it with redundant, decentralized regions worldwide
What is predictability in the cloud?: Being able to forecast performance and cost; achieved through autoscaling, load balancing, and tools like the Pricing Calculator and Cost Management
What is agility in the cloud?: The ability to deploy and configure cloud resources quickly as requirements change, rather than waiting weeks to procure hardware
What is disaster recovery in the cloud?: The ability to restore services and data after a major outage, often using geo-redundant storage and services across paired regions
What is the benefit of cloud security and governance?: Centralized policy, templates, and built-in tools (like Azure Policy and Microsoft Defender for Cloud) help meet compliance and update standards consistently
What is manageability in the cloud (two meanings)?: Management OF the cloud (autoscaling, monitoring, alerts) and management IN the cloud (web portal, CLI, APIs, templates) to control resources
What is fault tolerance?: A system's ability to keep operating without interruption when one or more components fail, often through redundancy
Why does the cloud reduce time-to-market?: Resources can be provisioned in minutes instead of weeks, so teams can build, test, and deploy applications faster
What are economies of scale in the cloud?: Large providers buy compute and storage at huge volume and pass the lower per-unit cost to customers, making cloud cheaper than self-hosting
Which cloud model best fits a company that wants no responsibility for the OS or runtime, only the app's data?: SaaS — the provider manages everything except the customer's data, identities, and access
Which cloud model best fits a developer who wants to deploy code without managing servers or patching the OS?: PaaS — the platform handles infrastructure and OS while the developer focuses on the application
Which cloud model best fits lifting and shifting existing VMs to the cloud?: IaaS — you run virtual machines and control the OS, much like on-premises servers
What does 'security in the cloud' vs 'security of the cloud' mean?: Microsoft is responsible for the security OF the cloud (physical infrastructure); the customer is responsible for security IN the cloud (data, identities, configuration)
Which expense model removes the risk of over-provisioning hardware?: OpEx / consumption-based — you scale resources to actual demand instead of buying for peak capacity upfront
What is a key benefit of high availability across availability zones?: If one datacenter or zone fails, the application keeps running from another zone, minimizing downtime
What cloud deployment model lets an organization meet data-residency rules while still using public cloud for other workloads?: Hybrid cloud — keep regulated data on a private cloud or on-premises and use public cloud elsewhere
What is multicloud?: Using cloud services from more than one provider (for example Azure and another vendor) to avoid lock-in or use best-of-breed services
Why is the cloud considered more secure than many on-premises setups?: Providers offer built-in security, continuous monitoring, automatic updates, and certifications most single organizations cannot match alone
What is the main trade-off of a private cloud?: More control and isolation, but higher cost and management overhead, and you lose the elasticity and pay-as-you-go benefits of public cloud
What is an Azure region?: A set of datacenters deployed within a latency-defined perimeter and connected by a dedicated low-latency network; you choose a region to deploy resources
What is an availability zone?: A physically separate datacenter (or group) within an Azure region, each with independent power, cooling, and networking, used for high availability
What is a region pair?: Two regions in the same geography paired for disaster recovery; updates roll out one region at a time and data can be replicated between them
What is an Azure datacenter?: A physical facility containing servers and infrastructure; multiple datacenters make up an availability zone or region
How many availability zones does an enabled Azure region have at minimum?: At least three physically separated availability zones
What is an Azure sovereign region?: An isolated instance of Azure for specific compliance or legal needs, such as Azure Government (US) or Azure operated by 21Vianet (China)
What is a resource in Azure?: A manageable item available through Azure, such as a virtual machine, storage account, database, or virtual network
What is a resource group?: A logical container that holds related Azure resources; resources can belong to only one resource group at a time and share its lifecycle
Can a resource belong to more than one resource group?: No. A resource exists in exactly one resource group, though it can be moved to another
What is an Azure subscription?: A logical unit of Azure services linked to an account; it sets billing boundaries and access control and contains resource groups
What is a management group?: A container above subscriptions used to apply governance (policies, access) across many subscriptions at once in a hierarchy
What is the Azure management hierarchy from top to bottom?: Management groups, then subscriptions, then resource groups, then resources
What is an Azure Virtual Machine (VM)?: An on-demand, scalable IaaS compute resource that runs a full operating system, giving you control like a physical server
What is a Virtual Machine Scale Set?: A service that lets you create and manage a group of identical, load-balanced VMs that automatically scale out or in with demand
What are Azure availability sets?: A way to group VMs across fault domains and update domains within a datacenter to protect against hardware failures and maintenance
What is Azure Virtual Desktop?: A desktop and app virtualization service that runs Windows desktops in the cloud, accessible from anywhere on any device
What are Azure Container Instances (ACI)?: The fastest, simplest way to run a single container in Azure without managing virtual machines (serverless containers)
What is Azure Kubernetes Service (AKS)?: A managed Kubernetes service for deploying, scaling, and managing containerized applications at scale
What is Azure App Service?: A PaaS offering for hosting web apps, REST APIs, and mobile back ends without managing the underlying infrastructure
What are Azure Functions?: A serverless compute service that runs event-triggered code without provisioning servers; you pay only while the code runs
What is serverless computing?: A model where the cloud provider fully manages the infrastructure and you pay only for execution; Azure Functions is the main example
When would you choose containers over a full VM?: When you want lightweight, portable, fast-starting workloads that share an OS kernel and don't need a full guest operating system per instance
What is a virtual network (VNet)?: The fundamental building block for private networks in Azure, enabling resources to securely communicate with each other, the internet, and on-premises networks
What is VNet peering?: Connecting two virtual networks so resources can communicate directly using private IP addresses, as if on the same network
What is an Azure VPN Gateway?: A service that sends encrypted traffic between an Azure virtual network and an on-premises location (site-to-site) or device (point-to-site) over the internet
What is Azure ExpressRoute?: A service that creates a private, dedicated connection between on-premises infrastructure and Azure, bypassing the public internet for more reliability and speed
What is the difference between VPN Gateway and ExpressRoute?: VPN Gateway uses encrypted traffic over the public internet; ExpressRoute uses a private, dedicated connection that never touches the public internet
What is Azure DNS?: A hosting service for DNS domains that resolves domain names to IP addresses using Microsoft's global network
What is a Network Security Group (NSG)?: A set of inbound and outbound security rules that allow or deny network traffic to Azure resources within a virtual network
What is Azure storage account?: A container that holds Azure Storage data objects — blobs, files, queues, and tables — with a unique namespace accessible worldwide
What is Azure Blob Storage?: Object storage optimized for storing massive amounts of unstructured data such as text, images, video, and backups
What are the Blob Storage access tiers?: Hot (frequent access), Cool (infrequent, stored 30+ days), Cold (rarely accessed, 90+ days), and Archive (lowest cost, offline, rarely accessed)
Which Blob access tier has the lowest storage cost?: The Archive tier — but it has the highest retrieval cost and latency and requires rehydration before reading
What is Azure Files?: Fully managed file shares in the cloud accessible via SMB or NFS, which can be mounted by cloud or on-premises machines
What is Azure Disk Storage?: Block-level storage volumes (managed disks) attached to Azure Virtual Machines, similar to a physical disk in a server
What is Azure Queue Storage?: A service for storing large numbers of messages that can be accessed from anywhere, used to decouple and scale application components
What is Azure Table Storage?: A NoSQL key-value store for structured, non-relational data, ideal for large amounts of flexible datasets
What is locally redundant storage (LRS)?: Replication that keeps three copies of your data within a single datacenter; the lowest-cost, lowest-durability redundancy option
What is zone-redundant storage (ZRS)?: Replication that copies data synchronously across three availability zones in a single region for higher availability
What is geo-redundant storage (GRS)?: Replication that copies data to a secondary region hundreds of miles away, protecting against a complete regional outage
Which storage redundancy option protects against an entire region failing?: Geo-redundant storage (GRS) or geo-zone-redundant storage (GZRS), which replicate to a secondary region
What is Azure Storage Mover / Migrate used for?: Moving large amounts of data into Azure; AzCopy and Azure Storage Explorer also help upload and manage storage data
What is Microsoft Entra ID (formerly Azure Active Directory)?: Microsoft's cloud-based identity and access management service that authenticates users and controls access to apps and resources
What is the difference between authentication and authorization?: Authentication (AuthN) proves who you are; authorization (AuthZ) determines what you are allowed to do once authenticated
What is single sign-on (SSO)?: A capability that lets a user sign in once and access multiple applications without re-entering credentials, reducing password fatigue
What is multifactor authentication (MFA)?: Requiring two or more verification factors — something you know, have, or are — to sign in, greatly improving account security
What is Conditional Access?: A Microsoft Entra feature that applies access policies based on signals like user, location, device, and risk before granting access
What is Microsoft Entra ID Protection?: A tool that detects, investigates, and remediates identity-based risks using automated risk policies
What is Microsoft Entra External ID / B2B?: A capability that lets external partners and guests securely access your resources using their own identities
What is the Azure portal?: A web-based, unified console where you build, manage, and monitor everything from simple web apps to complex deployments using a graphical interface
What is Azure Cloud Shell?: A browser-based, authenticated shell experience for managing Azure resources, available in Bash or PowerShell
What is Azure PowerShell?: A set of cmdlets for managing Azure resources directly from the PowerShell command line or in automation scripts
What is the Azure CLI?: A cross-platform command-line tool for creating and managing Azure resources using commands and scripts
What is the Azure mobile app?: An app for iOS and Android that lets you monitor resources, check health and metrics, and run Cloud Shell commands on the go
What is Azure Arc?: A service that extends Azure management and governance to resources running on-premises, at the edge, and in other clouds
What is Azure Resource Manager (ARM)?: The deployment and management layer for Azure; every request to manage a resource goes through ARM for consistent control, access, and tagging
What are ARM templates?: JSON files that define infrastructure as code, so you can deploy Azure resources declaratively and repeatedly
What is Azure Bicep?: A domain-specific language that simplifies infrastructure as code on Azure with cleaner syntax than ARM JSON templates
What is Azure SQL Database?: A fully managed PaaS relational database engine based on SQL Server, with automated patching, backups, and high availability
What is Azure Cosmos DB?: A globally distributed, multi-model NoSQL database service with low latency and elastic scalability across many regions
What is Azure Database for MySQL / PostgreSQL?: Fully managed, open-source relational database services on Azure that handle patching, backups, and scaling
What is Azure SQL Managed Instance?: A PaaS option that gives near-100% compatibility with on-premises SQL Server, ideal for lift-and-shift database migrations
What is the Azure Marketplace?: An online store of certified, ready-to-use applications and services from Microsoft and partners that can be deployed into Azure
What is Azure Virtual Machines best suited for?: Full control of the OS and software, lift-and-shift migrations, custom configurations, and apps that need a complete server
Which compute option is best for short-lived, event-driven code with no servers to manage?: Azure Functions (serverless) — it runs only when triggered and you pay only for execution time
Which networking service should you use for a private, high-bandwidth on-premises link to Azure?: Azure ExpressRoute — a dedicated private connection that bypasses the public internet
Which storage service is best for unstructured data like images and video?: Azure Blob Storage — object storage designed for massive amounts of unstructured data
Which Azure service provides managed Kubernetes?: Azure Kubernetes Service (AKS)
What identity service replaced the name 'Azure Active Directory'?: Microsoft Entra ID — the same service, rebranded
What is the difference between Microsoft Entra ID and on-premises Active Directory?: Entra ID is a cloud identity service using internet protocols (no Group Policy or OUs); on-premises AD manages domain-joined Windows devices with Group Policy
What does a load balancer do?: Distributes incoming network traffic across multiple resources to improve availability and reliability
What is Azure Content Delivery Network (CDN)?: A distributed network of servers that caches content close to users to deliver web content with low latency
What is the difference between Azure Files and Blob Storage?: Azure Files provides mountable SMB/NFS file shares with a folder structure; Blob Storage is flat object storage for unstructured data
What is a fault domain?: A group of hardware sharing a common power source and network switch; spreading VMs across fault domains protects against hardware failure
What is an update domain?: A logical group of hardware updated and rebooted together during maintenance; spreading VMs across them avoids simultaneous reboots
Which database service is best for globally distributed, low-latency NoSQL workloads?: Azure Cosmos DB
What is Azure Migrate?: A central hub of tools to assess and migrate on-premises servers, databases, web apps, and data to Azure
What does the Azure Region selection affect?: Service availability, data residency/compliance, latency to users, and pricing — all can vary by region
What is Azure Service Bus?: A fully managed enterprise message broker used to decouple applications and services with queues and publish-subscribe topics
Which compute model gives the customer the most control over the OS?: Azure Virtual Machines (IaaS) — you fully manage the guest operating system
What is the purpose of tags on Azure resources?: Name-value pairs applied to resources to organize them and group costs for billing, governance, and reporting
Which service lets you run identical, autoscaling VMs as a managed group?: Virtual Machine Scale Sets
Which Azure storage redundancy keeps data in one datacenter only?: Locally redundant storage (LRS)
What is the relationship between subscriptions and billing?: Each subscription has its own billing and usage tracking; organizations often split workloads, environments, or departments into separate subscriptions
What is Azure App Service best suited for?: Hosting web applications and APIs without managing servers, with built-in scaling, deployment slots, and SSL
What protocol does a site-to-site VPN connection use?: IPsec/IKE encrypted tunnels over the public internet between an on-premises VPN device and an Azure VPN gateway
What is the smallest deployable unit in the Azure management hierarchy?: A resource (such as a single VM or storage account)
Which tool gives a graphical way to manage Azure in a browser?: The Azure portal
Which tools let you manage Azure from a command line?: Azure CLI, Azure PowerShell, and Azure Cloud Shell (browser-based)
Which service caches static content near users to reduce latency?: Azure Content Delivery Network (CDN)
What kind of data is best stored in Azure Table Storage?: Structured, non-relational (NoSQL) key-value data that does not need complex joins or stored procedures
What is a primary benefit of availability zones for a VM workload?: Deploying across zones protects against an entire datacenter failure within a region, offering up to a 99.99% SLA
Which service connects two Azure virtual networks privately?: Virtual network (VNet) peering
What is the role of an internet gateway in a VNet?: Allows resources in the virtual network to communicate with the public internet, while NSGs and subnets control the traffic
Which Azure database is fully managed and compatible with existing SQL Server skills?: Azure SQL Database (or SQL Managed Instance for higher compatibility)
What is the benefit of a region pair?: Automatic data replication options, sequential updates to avoid simultaneous downtime, and prioritized recovery during a broad outage
What does SSO reduce?: The number of times users must enter credentials and the number of passwords they must remember, lowering risk and help-desk load
Which identity feature blocks risky sign-ins based on location or device?: Conditional Access
Which compute service runs a single container with the least management?: Azure Container Instances (ACI)
Which storage type would you attach to a VM as its operating-system disk?: Azure Disk Storage (managed disks)
What is Microsoft Cost Management?: A suite of tools to monitor, allocate, and optimize Azure spending through analysis, budgets, alerts, and recommendations
What is the Azure Pricing Calculator?: A free tool to estimate the cost of Azure products and services before you deploy them, by configuring a sample architecture
What is the Total Cost of Ownership (TCO) Calculator?: A tool that estimates the cost savings of migrating on-premises workloads to Azure by comparing current and cloud costs
What is the difference between the Pricing Calculator and the TCO Calculator?: The Pricing Calculator estimates the cost of a planned Azure deployment; the TCO Calculator compares on-premises costs against Azure to show savings
What factors affect Azure cost?: Resource type, services used, region, ingress/egress traffic, subscription type, and the Azure Marketplace items chosen
Why is data egress (outbound) often charged while ingress is usually free?: Azure generally does not charge for data going into Azure (ingress) but charges for data leaving regions or Azure (egress)
What is an Azure budget?: A spending threshold set in Cost Management that triggers alerts when actual or forecasted costs approach or exceed it
What is a cost alert?: An automated notification from Cost Management when spending, a budget, or a credit reaches a defined threshold
How can resource tags help with cost management?: Tags group and report costs by department, project, or environment, making it easy to allocate and analyze spending
What is Azure Reservations (Reserved Instances)?: A way to commit to one or three years of a resource for a significant discount versus pay-as-you-go pricing
What is the Azure Hybrid Benefit?: A licensing benefit that lets you use existing on-premises Windows Server and SQL Server licenses to lower Azure costs
What are Azure spot VMs used for?: Running interruptible workloads on unused capacity at deep discounts, with the trade-off that Azure can reclaim them anytime
Name three ways to reduce Azure costs.: Use reservations or savings plans, right-size and deduplicate resources, use spot VMs, apply Azure Hybrid Benefit, and shut down unused resources
What is a service-level agreement (SLA)?: A formal commitment by Microsoft about the expected performance and uptime of a service, expressed as a percentage
What does an SLA of 99.9% mean for downtime?: Roughly up to about 8.7 hours of allowable downtime per year (around 43 minutes per month)
Do free Azure services have a financially backed SLA?: No. Free tier and preview services typically have no financially backed SLA
How can you increase the composite SLA of an application?: Add redundancy (availability zones, multiple regions) and remove single points of failure; combining services multiplies their individual SLAs
What is an Azure service-credit?: A credit applied to your bill when Microsoft fails to meet the committed SLA for a paid service
What is the Azure service lifecycle (preview vs GA)?: Services move through private preview, public preview, then general availability (GA); preview features may lack full SLA and support
What is Azure Policy?: A governance service that creates, assigns, and manages rules to enforce standards and assess compliance across resources
What is the difference between Azure Policy and RBAC?: Azure Policy controls WHAT properties resources can have (compliance/standards); RBAC controls WHO can do WHAT actions (access)
What is a resource lock?: A lock that prevents accidental deletion or modification of a resource; types are CanNotDelete (Delete) and ReadOnly
What is the difference between a CanNotDelete and a ReadOnly lock?: CanNotDelete allows reading and modifying but not deleting; ReadOnly allows only reading — no modifying or deleting
What are Azure Blueprints (and their successor)?: A way to define a repeatable set of resources, policies, and assignments to deploy compliant environments; Microsoft now recommends Template Specs and deployment stacks instead
What is the Microsoft Purview governance portal?: A unified data governance service that helps discover, catalog, classify, and manage data across on-premises, multicloud, and SaaS
What is role-based access control (RBAC)?: A system that grants users, groups, and apps only the access they need by assigning roles at a defined scope
At what scopes can an RBAC role be assigned?: Management group, subscription, resource group, or individual resource — and it is inherited downward
What is the principle of least privilege?: Granting users only the minimum access required to do their job, reducing the attack surface
What is the Zero Trust security model?: A model that assumes breach and verifies every request explicitly, uses least-privilege access, and never trusts based on network location alone
What is defense in depth?: A layered security strategy where multiple defenses (physical, identity, perimeter, network, compute, app, data) slow and stop attackers
What is Microsoft Defender for Cloud?: A tool for cloud security posture management and workload protection that monitors security, gives a secure score, and detects threats across hybrid and multicloud
What is the Microsoft Defender for Cloud secure score?: A measurement of your security posture; higher scores mean fewer identified risks and better adherence to recommendations
What is Azure Monitor?: A platform service that collects, analyzes, and acts on telemetry (metrics and logs) from Azure and on-premises environments
What is Log Analytics?: A tool within Azure Monitor for writing and running queries against collected log data to investigate and analyze it
What is Application Insights?: An Azure Monitor feature for application performance management (APM) that monitors live web apps for performance and usage
What are Azure Monitor alerts?: Notifications and automated actions triggered when a metric or log condition crosses a defined threshold
What is Azure Service Health?: A service that gives personalized alerts and guidance about Azure service issues, planned maintenance, and health advisories affecting your resources
What are the three views in Azure Service Health?: Azure status (global outages), Service health (issues affecting your services), and Resource health (health of your specific resources)
What is the Azure status page?: A global page showing the health of Azure services across all regions, regardless of which resources you use
What is Resource health in Azure?: A view that reports the current and past availability of your individual resources and explains why a resource may be unavailable
What is the Azure mobile app used for in monitoring?: Checking resource status, metrics, alerts, and service health, and running quick management tasks from a phone
What is Microsoft Entra Privileged Identity Management (PIM)?: A service that provides just-in-time, time-bound privileged access with approval workflows and auditing to limit standing admin rights
Which tool would you use to ENFORCE that all resources are deployed only to a specific region?: Azure Policy — it can deny or audit resources that do not meet the rule
Which tool would you use to PREVENT a critical resource from being deleted?: A resource lock (CanNotDelete / Delete lock)
Which tool estimates savings from moving on-premises servers to Azure?: The Total Cost of Ownership (TCO) Calculator
Which tool estimates the monthly cost of a new Azure deployment?: The Azure Pricing Calculator
Which service gives a unified view of security posture and threat protection?: Microsoft Defender for Cloud
Which service collects metrics and logs to monitor performance?: Azure Monitor
Which service notifies you about an Azure outage affecting your subscription?: Azure Service Health
What does RBAC control that Azure Policy does not?: WHO can perform actions on resources (access), whereas Azure Policy controls WHAT configuration resources may have
Which governance tool helps classify and catalog data across your estate?: Microsoft Purview
What is the benefit of setting a budget with alerts?: It proactively warns you before spending exceeds plan, helping avoid surprise bills
Why might two regions have different prices for the same service?: Costs (power, real estate, taxes) and supply differ by location, so Azure pricing varies by region
What is the SLA impact of combining multiple services in an application?: Composite SLA is the product of each service's SLA, so adding more dependent services usually lowers the overall guarantee unless you add redundancy
What does a ReadOnly lock prevent?: Any modification or deletion of the resource; only read operations are allowed
How does the Azure Hybrid Benefit lower cost?: It lets you reuse existing eligible Windows Server and SQL Server licenses instead of paying for new ones in Azure
What is the secure score used for?: Tracking and improving your security posture by following Defender for Cloud's prioritized recommendations
Which Azure Monitor tool is for querying collected logs?: Log Analytics
Which Azure Monitor tool monitors a live application's performance?: Application Insights
What is the relationship between management groups and Azure Policy?: Assigning a policy at a management group applies it to all subscriptions and resources beneath it, enabling org-wide governance
What is a savings plan for compute?: A flexible pricing model giving lower rates in exchange for a one- or three-year commitment to a fixed hourly spend on compute
How do reservations differ from savings plans?: Reservations commit to a specific resource type/region for a discount; savings plans commit to an hourly compute spend and apply flexibly across services
What is the purpose of Azure Advisor?: A free service that analyzes your configuration and gives personalized recommendations for cost, security, reliability, performance, and operational excellence
Which five categories does Azure Advisor cover?: Cost, security, reliability, operational excellence, and performance
What does a 99.99% SLA roughly allow for yearly downtime?: About 52 minutes of downtime per year
What is the difference between a budget and a cost alert?: A budget is the spending threshold you set; a cost alert is the notification fired when spending nears or crosses that budget
Which tool would generate a personalized cost-optimization recommendation?: Azure Advisor
What is just-in-time access?: Granting elevated permissions only for the time they are needed and removing them afterward, reducing standing privilege (provided by Entra PIM)
Why use multiple subscriptions for governance?: To separate billing, apply different policies and limits, and isolate environments (such as production and development)
What does compensatory scoring mean on the AZ-900 exam?: You only need an overall scaled score of 700 to pass; you do not have to pass each individual skill area
What use case best fits a public cloud?: Workloads that benefit from elasticity and low cost without capital investment, such as web apps with variable traffic
What use case best fits a hybrid cloud?: Keeping sensitive or regulated data on-premises while bursting other workloads to public cloud, or migrating gradually
What is the main cost benefit of the consumption-based model?: No upfront capital cost and no charge for idle capacity — you pay only for what you actually use
Which is automatic: scalability or elasticity?: Elasticity — it automatically adds or removes resources in near real time as demand changes
Which cloud benefit ensures a service keeps running during a datacenter failure?: High availability, typically achieved by spreading the workload across availability zones
Which cloud benefit is about recovering after a failure?: Reliability — supported by redundant, decentralized regions and disaster-recovery options
Why is the cloud described as having predictability?: Performance and cost can be forecast and controlled using autoscaling, load balancing, and tools like the Pricing Calculator
What is the difference between management OF the cloud and management IN the cloud?: Management OF the cloud is automation, monitoring, and self-healing; management IN the cloud is the tools (portal, CLI, APIs, templates) you use to control resources
Which service type would a fully managed email platform like Microsoft 365 be?: SaaS — finished software you consume without managing the platform or infrastructure
Under the shared responsibility model, who patches the OS on an Azure VM?: The customer — IaaS leaves the guest operating system to you
Under the shared responsibility model, who patches the OS for a PaaS service?: Microsoft — the provider manages the operating system and platform in PaaS
What is a cloud workload?: An application or service (and its resources) running in the cloud, such as a website, database, or batch job
What does it mean to 'go global in minutes' with the cloud?: You can deploy resources to regions worldwide quickly to reduce latency and meet local requirements, without building datacenters
What is the trade-off of choosing IaaS over PaaS?: More control and flexibility (you manage the OS) but more responsibility for patching, scaling, and maintenance
What is the main reason organizations adopt cloud agility?: They can provision and reconfigure resources in minutes instead of waiting weeks to buy and install hardware
What is an Azure resource provider?: A service that supplies Azure resources (such as Microsoft.Compute for VMs); ARM uses providers to create and manage resources
What is Azure Virtual WAN?: A networking service that brings many networking, security, and routing functions together to connect branches and VNets at scale
What is a public endpoint?: An endpoint that exposes a service over the public internet, reachable by a public IP address
What is a private endpoint?: A network interface that connects you privately to an Azure service using a private IP inside your VNet, keeping traffic off the public internet
What is Azure Bastion?: A service that provides secure RDP and SSH access to VMs directly in the portal without exposing public IP addresses
What is a subnet within a VNet?: A range of IP addresses that segments a virtual network so you can group and secure resources separately
What is Azure Application Gateway?: A web traffic load balancer that manages traffic to web applications, with features like SSL termination and a web application firewall
What is Azure Load Balancer?: A service that distributes inbound network traffic across backend resources to improve availability and scale
What is the difference between Azure Files and Azure Disk Storage?: Azure Files offers shared file shares many machines can mount over SMB/NFS; Disk Storage is a block disk attached to a single VM
What is Azure NetApp Files?: A high-performance, fully managed file storage service for enterprise workloads requiring low latency
What is Azure Data Box?: A physical device used to transfer very large amounts of data into Azure when network transfer is impractical
What is AzCopy?: A command-line tool for copying data to and from Azure Storage (blobs and files) efficiently
What is Azure Storage Explorer?: A standalone app that provides a graphical interface to manage Azure Storage data across accounts
What is Azure File Sync?: A service that synchronizes on-premises file servers with Azure Files, keeping a cloud copy and freeing local space
What is the resource required by every Azure Virtual Machine besides compute?: Storage (a disk), networking (a NIC and virtual network), and an OS image are all required to run a VM
What is Azure Virtual Desktop best suited for?: Delivering secure, cloud-hosted Windows desktops and apps to users on any device, ideal for remote or contract workers
When should you use App Service instead of a VM for a web app?: When you want managed hosting with built-in scaling and deployment and don't need control of the underlying OS
What is the difference between Microsoft Entra ID and Microsoft Entra Domain Services?: Entra ID is cloud identity using modern protocols; Entra Domain Services provides managed domain features (like LDAP and domain join) without running domain controllers
What is passwordless authentication?: Signing in without a password using methods like Windows Hello, the Microsoft Authenticator app, or FIDO2 security keys
What is the purpose of an external identity (B2B/B2C)?: B2B lets partner guests use their own credentials to access your resources; B2C lets customers sign in to your apps with their identities
Which Azure service runs containerized apps at scale with orchestration?: Azure Kubernetes Service (AKS)
Which Azure compute option requires the least management for a single container?: Azure Container Instances (ACI)
What is Azure Cosmos DB best used for?: Globally distributed, low-latency NoSQL applications needing elastic scale across many regions
What is Azure SQL Database?: A fully managed PaaS relational database based on the SQL Server engine, with automated patching, backups, and scaling
Which Azure storage redundancy survives a region-wide outage with the highest durability?: Geo-zone-redundant storage (GZRS) — zone redundancy in the primary region plus a copy in the paired region
What determines which services and prices are available where you deploy?: The Azure region — service availability, data residency, and pricing all vary by region
What does Azure DNS provide?: Hosting and resolution of DNS domains using Microsoft's global network of name servers
What connects two VNets so resources use private IPs as if on one network?: Virtual network (VNet) peering
What is a managed disk in Azure?: A block storage volume managed by Azure and attached to a VM, where Azure handles storage account management behind the scenes
Which storage tier is cheapest for data accessed less than once a quarter but still online?: The cool or cold tier; the archive tier is cheaper still but is offline and must be rehydrated
What is the smallest unit of the Azure management hierarchy?: A resource — a single service instance like a VM or storage account
How does governance applied at a management group reach a VM?: Policies and access at the management group are inherited down to subscriptions, then resource groups, then the resource
What is a key reason to use multiple subscriptions?: To separate billing and apply different governance and limits to different environments or departments
What service should you use to securely connect to a VM without a public IP?: Azure Bastion
Which connectivity option offers consistent latency and high bandwidth by avoiding the internet?: Azure ExpressRoute
What is a NIC in the context of an Azure VM?: A network interface card that connects a VM to a virtual network so it can communicate
Which database service gives near-full SQL Server compatibility for lift-and-shift?: Azure SQL Managed Instance
What is the benefit of containers over VMs?: They are lightweight, fast to start, and portable because they share the host OS kernel instead of bundling a full OS
Which service hosts web apps and APIs as a managed platform?: Azure App Service
Which identity feature reduces the number of passwords a user must enter?: Single sign-on (SSO)
Which feature blocks or allows access based on conditions like device and location?: Conditional Access
What is Microsoft Cost Management used for?: Monitoring, allocating, budgeting, and optimizing Azure spending across subscriptions
Which calculator estimates the cost of a NEW Azure deployment?: The Azure Pricing Calculator
Which calculator compares on-premises costs to Azure?: The Total Cost of Ownership (TCO) Calculator
What is the main factor that often surprises people in Azure billing?: Data egress (outbound transfer) is charged, while inbound (ingress) is usually free
How can tags reduce cost confusion?: They label resources so spend can be grouped and reported by department, project, or environment
What is an Azure reservation?: A one- or three-year commitment to a resource for a significant discount over pay-as-you-go
When should you set a budget in Cost Management?: Whenever you want to be alerted before spending crosses a planned threshold to avoid surprise bills
Which tool ENFORCES that resources meet configuration standards?: Azure Policy
Which tool controls WHO can perform actions on resources?: Azure role-based access control (RBAC)
Which tool PREVENTS accidental deletion of a single resource?: A resource lock (CanNotDelete / Delete lock)
What does a ReadOnly resource lock allow?: Only reading the resource — no modifications and no deletion
At what scopes can RBAC and Azure Policy be applied?: Management group, subscription, resource group, or resource — and they are inherited downward
What is the principle of least privilege?: Grant each identity only the minimum access required to do its job, reducing risk
What is Microsoft Purview used for in governance?: Discovering, cataloging, classifying, and managing data across on-premises, multicloud, and SaaS sources
What does Azure Advisor recommend?: Personalized best practices across cost, security, reliability, performance, and operational excellence
What does Azure Service Health tell you?: Whether Azure outages, planned maintenance, or health advisories are affecting your specific resources
What does Azure Monitor collect?: Metrics and logs (telemetry) from Azure and on-premises resources for analysis, alerting, and visualization
Which Azure Monitor feature queries collected log data?: Log Analytics
Which Azure Monitor feature monitors a live application's performance?: Application Insights
What is the difference between Azure Service Health and Azure Monitor?: Service Health reports Azure platform issues affecting you; Monitor reports your own resources' and apps' performance telemetry
What is the Azure portal?: A web-based graphical console for creating, managing, and monitoring Azure resources
What is Azure Cloud Shell?: A browser-based, authenticated command-line environment (Bash or PowerShell) for managing Azure
What is infrastructure as code (IaC)?: Defining and deploying infrastructure through declarative files (like ARM templates or Bicep) for repeatable, consistent results
What is Azure Resource Manager (ARM)?: The deployment and management layer all Azure management requests pass through for consistent control and access
What is an ARM template?: A JSON file that defines Azure resources declaratively so the same environment can be deployed repeatedly
What is Azure Bicep?: A domain-specific language that simplifies infrastructure as code with cleaner syntax than ARM JSON
What is Azure Arc used for in governance?: Extending Azure management, policy, and RBAC to servers and clusters running on-premises, at the edge, or in other clouds
What does a 99.9% SLA roughly permit for downtime?: About 8.7 hours per year (roughly 43 minutes per month)
How do you improve an application's composite SLA?: Add redundancy across availability zones or regions and remove single points of failure
Do free or preview Azure services carry a financially backed SLA?: No — free tier and preview services typically have no financially backed SLA
What is the Azure Hybrid Benefit?: A licensing benefit that lets you reuse existing Windows Server and SQL Server licenses to lower Azure cost
What is the secure score in Microsoft Defender for Cloud?: A measurement of your security posture; following its recommendations raises the score and reduces risk
What is just-in-time VM access?: Opening management ports to a VM only when needed and for a limited time, reducing the attack surface
What governance question does Azure Policy answer vs. RBAC?: Azure Policy answers 'what configuration may resources have?'; RBAC answers 'who may perform which actions?'

To find us again, just search “Career Employer AZ-900”

By Career EmployerUpdated Jun 19, 2026

300+ free AZ-900 flashcards — 4 ways to study

AZ-900 Flashcard of the DayNew daily

The classic card. Do you know this one?

Click Study Flashcards above to open the flashcard hub — hundreds of AZ-900 cards you can flip, match, type, or quiz yourself on. Every card is drawn from the three official Azure Fundamentals skill areas, so you study exactly what the exam tests.^[1] Pair them with our free practice test and study guide.

AZ-900 Flashcard Study Modes

Most flashcard sites give you one thing: a card to flip. Ours has four modes so you can both learn the material and prove you know it — the difference between recognizing an answer and recalling it under exam pressure.

Flip (Study) — the classic card. Flip term ↔ definition, shuffle the deck, and mark each card “Got it” or “Still learning.”
Match (Game) — a timed game: pair each term to its definition as fast as you can. Great for cementing Azure service names.
Type (Recall) — read the definition and type the term. Typing forces true active recall instead of passive recognition.
Quiz (Test) — multiple-choice questions generated from the cards, so you self-test exactly like exam day.

Free AZ-900 flashcards from Career Employer — active recall for the Microsoft Azure Fundamentals exam

Why Flashcards Work for the AZ-900 Exam

Flashcards aren’t busywork — they’re built on active recall: pulling an answer out of memory strengthens it far more than re-reading notes. Pair that with spacing — short sessions across several days rather than one cram — and you retain more in less time.

AZ-900 is dense with terminology — dozens of Azure service names, the shared responsibility model, the management hierarchy, storage redundancy options, and governance tools.^[3] Spaced flashcards are the most efficient way to keep it all fresh. Used alongside our practice test and study guide, they turn review time into measurable progress.

AZ-900 Flashcards by Skill Area

The cards are organized by the three official AZ-900 skill areas. Drill the highest-weighted one first — Azure architecture & services is the largest at 35–40% of the exam:^[1]

AZ-900 flashcards by skill area and weight
Skill area	Exam weight
Azure Architecture & Services	35–40%
Management & Governance	30–35%
Cloud Concepts	25–30%

How to Get the Most Out of These Flashcards

Lead with the heavy area. Azure architecture & services (35–40%) is the largest — start there.
Use Type and Quiz, not just Flip. Recognizing the right answer is easy; recalling and choosing it is the real test.
Drill your weakest area. Pick a single skill-area deck and grind it until the Match time drops and the Quiz score climbs.
Then prove it. When the cards feel easy, confirm with a full practice test — aim comfortably above passing before exam day.

AZ-900 Flashcards FAQ

Hundreds of free AZ-900 flashcards, organized across all three Azure Fundamentals skill areas — cloud concepts, Azure architecture and services, and Azure management and governance. They're free with no account required.

References

1.Microsoft. “Microsoft Certified: Azure Fundamentals (AZ-900) Study Guide.” learn.microsoft.com. ↑
2.Microsoft. “Microsoft Certified: Azure Fundamentals — Certification Page.” learn.microsoft.com. ↑
3.Microsoft. “Shared responsibility in the cloud.” learn.microsoft.com. ↑

Career Employer

Career Employer is the ultimate resource to help you get started working the job of your dreams. We cover topics from general career information, career searching, exam preparation with free study materials, career interviewing, and becoming successful in your career of choice.

All Posts

Career Employer’s Editorial Process

Here at Career Employer, we focus a lot on providing factually accurate information that is always up to date. We strive to provide correct information using strict editorial processes, article editing, and fact-checking for all of the information found on our website. We only utilize trustworthy and relevant resources. To find out more, make sure to read our full editorial process page here.