How to use AZ-900 flashcards effectively
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For AZ-900 preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the AZ-900 question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your AZ-900 flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real AZ-900 exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass AZ-900.
AZ-900 flashcard preview
Sample cards from the AZ-900 flashcard bank. Read the question, think of the answer, then read the explanation below.
A startup wants to deploy a web application that experiences unpredictable traffic spikes. They need to scale resources automatically without manual intervention. Which benefit of cloud computing directly addresses this requirement?
Elasticity
Elasticity is the ability of a cloud service to automatically scale resources up or down based on demand. This allows the startup to handle traffic spikes without manual intervention.
A company is planning to migrate its on-premises applications to Azure. They have a mix of monolithic and microservices-based applications. Which Azure compute service should they choose for a microservices architecture that requires independent scaling and deployment of components?
Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS) is designed for containerized microservices, allowing independent scaling and deployment of each service. Azure Functions is for serverless event-driven code, and App Service is for web apps but not optimal for microservices orchestration.
A company has multiple Azure subscriptions for different departments. They want to enforce consistent policies across all subscriptions regarding allowed virtual machine sizes and require compliance reporting. Which Azure feature should they use?
Azure Policy
Azure Policy allows you to create, assign, and manage policies that enforce rules for resources. It can be applied at the management group level to affect multiple subscriptions and provides compliance reporting.
A developer is building a serverless application that requires integration with an on-premises SQL Server database for real-time data processing. The on-premises network is connected to Azure via a site-to-site VPN. Which Azure service would allow the function to securely access the on-premises database without exposing it to the public internet?
Azure Functions in Premium plan with VNet integration
Azure Functions running on a Premium plan can be integrated with a VNet, and combined with a site-to-site VPN, they can access on-premises resources securely. The Consumption plan does not support VNet integration. Azure SQL Database is a PaaS service, and a hybrid connection is used for PaaS services to on-premises, but for a function accessing an on-prem SQL Server, VNet integration is appropriate.
A company deploys a multi-tier application using Azure virtual machines. The web tier VMs must be evenly distributed across two distinct data centers within an Azure region to avoid a single point of failure from an infrastructure outage. Which Azure construct should they use to meet this requirement?
Availability zone
An availability set ensures VMs are placed across multiple fault domains (separate racks with independent power and networking) and update domains. Fault domains correspond to physical hardware boundaries within a data center; spreading across multiple fault domains protects against hardware failures. However, the scenario mentions two distinct data centers within a region, which is exactly what availability zones provide. Availability sets only work within a single data center (they provide fault domains within a datacenter). Availability zones span separate physical locations (data centers) within a region. Therefore, availability zones are the correct choice. Proximity placement groups are for low latency, not fault tolerance. Load balancer distributes traffic but does not ensure physical separation of VMs.
A company wants to enforce a set of security policies across all their Azure subscriptions. They have created several individual policy definitions. Which Azure construct should they use to group these policies together and assign them as a single package?
Policy Initiative
A policy initiative (also known as a policy set) allows you to group related policies together for easier assignment and management. This helps ensure consistent application of a security baseline across subscriptions.
A company deploys a line-of-business application on an Azure virtual machine. The IT team wants to ensure the application remains secure. According to the shared responsibility model, which of the following security tasks is the sole responsibility of the customer (the company)?
Configuring the network security group (NSG) rules to restrict inbound traffic to the virtual machine.
The shared responsibility model defines which security tasks are managed by Microsoft (the cloud provider) and which are managed by the customer. Microsoft is responsible for the security of the physical datacenter, the hypervisor, and the underlying host infrastructure (including the fabric controller). The customer is responsible for securing their own resources such as virtual machines, including configuring network security groups, patching the operating system, and managing application-level security.
A company develops a web API that runs on Azure App Service. The development team wants to deploy a new version of the API to a staging environment, run integration tests against it, and then gradually shift production traffic to the new version. If any issues are detected, they want to immediately roll back to the previous version without redeploying. Which Azure App Service feature should the team use to meet these requirements?
Deployment slots
Deployment slots in Azure App Service allow you to create separate environments (slots) for your web app. You can deploy a new version to a staging slot, test it, and then swap the staging slot with the production slot to make the new version live. If issues arise, you can swap back to the previous slot, instantly rolling back. Autoscale adjusts capacity based on load, not deployment. Traffic Manager is a DNS-based traffic routing service for distributing traffic across endpoints, not an App Service feature for staging. Application Insights is a monitoring and diagnostics service, not a deployment feature.
A company deploys a critical application across two Azure regions for disaster recovery. They want to automatically failover traffic to the secondary region if the primary becomes unavailable. They also want to improve performance by routing users to the closest region. Which Azure service should they use?
Azure Traffic Manager
Azure Traffic Manager is a DNS-based traffic load balancer that can distribute traffic based on geographic location and health probes. It performs automatic failover and can route users to the nearest region for performance.
A company currently runs its application on-premises in a data center. The IT manager calculates that the cost per server per month is approximately $200 when considering hardware depreciation, electricity, cooling, and staff. The company is considering moving to Azure and discovers that Azure can provision the same server capacity for $150 per month, but only if the company commits to a three-year reservation. Which cloud concept best explains why Azure can offer a lower price even with the reservation commitment?
Economies of scale
Economies of scale refers to the cost advantages that enterprises obtain due to their scale of operation. Cloud providers like Microsoft Azure operate massive data centers worldwide, giving them significant purchasing power for hardware, energy, and bandwidth. This allows them to offer infrastructure at a lower per-unit cost than most individual organizations can achieve in an on-premises data center. The reservation commitment provides a discount for long-term usage, but the fundamental ability to offer a lower price stems from economies of scale. Rapid elasticity (scaling resources up/down quickly), high availability (ensuring uptime), and measured service (metering usage) do not directly explain the lower cost structure.
A company has an Azure tenant with a management group hierarchy. The 'Production' management group contains five subscriptions used by the operations team. The IT security team wants to grant the 'Network Contributor' role to a group of network administrators for all subscriptions under the 'Production' management group. The role assignment must automatically apply to any new subscription added under the 'Production' management group in the future. The network administrators already exist as a security group in Azure AD. What is the most efficient way to achieve this?
Assign the 'Network Contributor' role to the security group at the 'Production' management group scope.
Role assignments can be applied at the management group scope, and they are inherited by all subscriptions within that management group. This method automatically covers current subscriptions and any new subscriptions added later, without requiring manual per-subscription assignments or complex automation. Azure Policy cannot directly assign RBAC roles to security groups; it can deploy resources but not manage role assignments in this manner. Assigning at the root management group would grant access to all subscriptions across the entire tenant, which is broader than intended and not aligned with the principle of least privilege.
A company deploys two Azure virtual machines in an availability set. The application requires that at least one VM remains running during Azure platform-initiated maintenance, such as operating system updates to the underlying host. Which component of the availability set directly ensures that the VMs are not updated at the same time?
Update domains
An availability set groups VMs into update domains and fault domains. Update domains define a set of VMs that are updated together during planned maintenance. By placing VMs in different update domains, Azure ensures that only one update domain is taken offline at a time, keeping at least one VM running. Fault domains protect against hardware failures but do not affect maintenance updates. Availability zones are independent datacenters, not a component of an availability set. Proximity placement groups are used to minimize network latency between VMs.
A company has a policy that all Azure Storage accounts must have diagnostic settings enabled to send logs and metrics to a specific Log Analytics workspace. The governance team wants to automatically configure these diagnostic settings when a new storage account is created, without blocking the initial creation. The solution must not require manual intervention. Which Azure Policy effect should the team use in their policy definition?
DeployIfNotExists
Azure Policy supports several effects. 'DeployIfNotExists' is used to automatically deploy a resource (like a diagnostic setting) when a condition is met and the resource does not already exist. In this scenario, the condition is the creation of a storage account, and the missing resource is the diagnostic setting. The other effects are not suitable because they either block creation (Deny), report compliance only (Audit), or cannot create entire resources (Append).
A company deploys a mission-critical application across three Azure availability zones. The application is designed to continue operating without any interruption if an entire availability zone becomes unavailable. Which cloud computing characteristic does this scenario best illustrate?
Fault tolerance
Fault tolerance is the ability of a system to continue functioning without interruption when one or more of its components fail. In this scenario, the application is designed to survive the loss of an entire Azure availability zone (a failure domain) with zero downtime that the user experiences. High availability (option C) also aims for continuous operation but typically allows for a brief period of unavailability during failover, whereas fault tolerance ensures absolutely no interruption. Elasticity (option A) refers to automatically adjusting resources to match demand. Scalability (option D) is the ability to handle increased load by adding resources. Therefore, the scenario best illustrates fault tolerance.
A company has a governance requirement that every Azure virtual machine must have a tag named 'CostCenter' with the value 'Unassigned'. If a user creates a VM without the tag, or with a different value for that tag, the tag should be automatically corrected to 'Unassigned' immediately upon resource creation. The IT team is writing an Azure Policy definition to enforce this. Which Policy effect should they use?
Modify
The Modify effect in Azure Policy is specifically designed to add, update, or remove tags (or other properties) on resources that are non-compliant. It can be configured with a managed identity to automatically remediate non-compliant resources at creation time and on a schedule. Deny would block the resource, Audit would only report, and DeployIfNotExists deploys separate resources, not modify existing ones.
A company has a policy that all Azure resources deployed to production subscriptions must be tagged with a 'CostCenter' tag. They want to automatically prevent the creation of any resource that does not include this tag. Which Azure Policy effect should they use in their policy definition?
Deny
The 'Deny' effect blocks any resource creation or update that does not meet the policy condition. In this case, if a resource is created without the 'CostCenter' tag, the policy denies the request. 'Audit' only logs non-compliance. 'DeployIfNotExists' creates a remediation task but does not block creation. 'Modify' can add tags, but the requirement is to prevent creation if the tag is missing, so 'Deny' is correct.
A cloud provider uses virtualization technology to host multiple customers on the same physical server. Each customer's data, applications, and operating systems are logically isolated and secured from one another. Which characteristic of cloud computing does this scenario best describe?
Resource pooling
This scenario describes the resource pooling characteristic of cloud computing. Resource pooling allows the provider to serve multiple customers (tenants) from the same physical infrastructure while maintaining logical isolation and security. The other options are also key cloud characteristics but do not align with the concept of shared physical resources managed for multiple tenants.
A company has a root management group that contains two child management groups: Production and Development. Each child management group contains several subscriptions. The security team assigns a built-in Azure Policy definition with the 'Deny' effect to the Production management group to enforce encryption on all storage accounts. Later, the Development team requests that storage accounts in their subscriptions must not be encrypted because they host temporary test data that needs to be quickly deleted and recreated. The security team must allow this exception for Development only, without changing the policy for Production. What should the security team do?
Create an Azure Policy exemption for the Development management group with the 'Mitigated' category.
Azure Policy inheritances can be overridden by exemptions. When a policy with Deny effect is assigned at a parent scope (like a management group), it applies to all child scopes (subscriptions/resource groups) unless an exemption is created. An Azure Policy exemption excludes a scope from policy evaluation and reporting. There are two categories: 'Mitigated' (for policies that are still compliant due to compensating controls) and 'Waiver' (for a limited time). Creating an exemption at the Development management group allows storage accounts in Development subscriptions to be created without encryption while the Deny policy remains enforced for Production.
A company deploys a critical application on Azure virtual machines. They want to ensure that the VMs are distributed across physically separate datacenters within a single Azure region to protect against a single datacenter failure. Which Azure feature should they use?
Availability zones
Availability zones are physically separate locations (datacenters) within an Azure region. Each zone has independent power, cooling, and networking. Deploying VMs across zones protects against a single datacenter failure. Availability sets distribute VMs across fault domains and update domains within one datacenter, not across datacenters. Resource groups are logical containers. Azure Site Recovery replicates workloads across regions for disaster recovery.
A company has a policy that all Azure resources must have a tag named 'CostCenter'. The governance team wants to automatically add the tag with a default value 'IT' to any new resource that is created without it. The team wants the tag to be applied during resource creation, not just report non-compliance. The solution must also support remediation for existing non-compliant resources if needed later. Which Azure Policy effect should the team use in their policy definition?
Modify
The question tests knowledge of Azure Policy effects, specifically how to automatically enforce resource tagging. The 'Modify' effect is the correct choice because it can add, change, or remove tags on resources during creation or update, and it supports remediation tasks for existing non-compliant resources. 'Append' can also add tags to new resources, but it cannot modify existing tags and does not support remediation. 'DeployIfNotExists' is used to deploy a resource (e.g., a diagnostic setting) when a specific resource exists, not for modifying tags. 'Audit' only evaluates compliance without applying any changes.
A company has a regulatory requirement that all Azure resources must be deployed only in the West Europe region. The governance team needs to automatically prevent any user or application from creating resources in any other region. The team must also ensure that this restriction is applied to all existing and future subscriptions within the tenant. Which Azure service should the governance team use?
Azure Policy
Azure Policy is the correct service for enforcing rules on resource properties during deployment. The 'Allowed Locations' built-in policy definition can be assigned at a management group scope to restrict the regions where resources can be created, and this assignment applies to all subscriptions within that management group hierarchy, including existing and future ones. Azure Blueprints orchestrates the deployment of multiple resources and policies, but the enforcement of the location restriction itself is done via Azure Policy. Management Groups organize subscriptions but do not enforce resource-level constraints. RBAC controls who can create resources but not where they can be created. Therefore, Azure Policy is the appropriate solution for this governance requirement.
AZ-900 flashcards by domain
The AZ-900 flashcard bank covers all 3 official blueprint domains published by Microsoft. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Describe cloud concepts
Describe Azure architecture and services
Describe Azure management and governance
Flashcards vs practice tests: which is better for AZ-900?
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that AZ-900 questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.AZ-900 questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective AZ-900 study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
AZ-900 flashcards — frequently asked questions
Are the AZ-900 flashcards free?
Yes — all AZ-900 flashcards on Courseiva are completely free, no account required. Every card includes the question, correct answer, and a full explanation. Create a free account to track which cards you have studied and get spaced repetition recommendations.
How many AZ-900 flashcards are on Courseiva?
Courseiva has 1011+ original AZ-900 flashcards across all 3 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are written by certified engineers against the official Microsoft exam objectives.
How are Courseiva flashcards different from Anki or Quizlet?
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official AZ-900 exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Can I use AZ-900 flashcards offline?
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Track your AZ-900 flashcard progress
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included