The Azure Architecture and Services domain is the heart of the AZ-900 exam, covering the core building blocks of Microsoft Azure. In plain English, this domain is about understanding the fundamental components that make up Azure's cloud infrastructure—things like virtual machines, storage accounts, databases, networking, and identity services. You'll learn how these pieces fit together to create scalable, secure, and cost-effective solutions. For example, you'll explore how Azure Virtual Machines let you run Windows or Linux in the cloud, how Azure Blob Storage stores massive amounts of unstructured data like photos or videos, and how Azure SQL Database provides a managed relational database service. This domain also introduces key architectural concepts like regions (geographic locations of data centers), availability zones (isolated data centers within a region for high availability), and resource groups (logical containers for managing related resources). Understanding these basics is crucial because they form the foundation for everything else in Azure.
Why is this important for real-world IT, security, and cloud work? Because Azure is one of the leading cloud platforms, and professionals across all IT roles need to know how to design and manage cloud solutions. For instance, a system administrator might need to decide between using Azure VMs or Azure App Service to host a web application, weighing factors like scalability, maintenance, and cost. A security analyst must understand Azure's shared responsibility model—where Microsoft secures the physical infrastructure (data centers, network) and you secure your data, identities, and access. Without grasping these architectural components, you can't make informed decisions about cloud adoption, cost optimization, or security. Real-world scenarios include setting up a disaster recovery plan using Azure Site Recovery, or configuring Azure Active Directory for single sign-on across multiple apps. This domain gives you the vocabulary and mental model to talk about these solutions with colleagues and clients.
On the AZ-900 exam, this domain tests your knowledge of Azure's core services and how they work together. Specifically, you'll need to identify the right service for a given business requirement. For example, a question might ask: "Which Azure service should you use to host a web app that automatically scales based on demand?" (Answer: Azure App Service). Or "Which storage option is best for storing virtual machine disks?" (Answer: Azure Managed Disks). You'll also be tested on high-level architectural concepts like the difference between IaaS, PaaS, and SaaS, and when to use each. The exam doesn't require deep technical skills—you won't be asked to write code or configure a network—but you must understand the purpose and typical use cases of each service. Expect questions about Azure regions, availability zones, resource groups, and management tools like Azure Portal, Azure CLI, and Azure PowerShell. The weight of this domain (35-40%) means you'll see many questions here, so it's critical to master it.
To approach studying this domain effectively, start by creating a mental map of Azure's service categories: compute, networking, storage, databases, identity, and management. Use Microsoft's official documentation and free learning paths on Microsoft Learn, which include interactive modules and sandboxes. For each service, ask yourself: What problem does it solve? When would I use it? What are its key features? Then, reinforce your learning with practice exams that mimic the real test format. Focus on scenarios that require choosing between similar services, like Azure SQL Database vs. SQL Server on a VM, or Azure Blob vs. Azure Files. Finally, use mnemonic devices to remember tricky concepts—for example, remember that availability zones protect against data center failures, while region pairs protect against regional disasters. By building this foundational knowledge, you'll not only pass the exam but also be prepared for real-world Azure work.
AZ-900 Describe Azure architecture and services — Key Topics
Azure Architecture and Services covers the core components of Azure—compute, networking, storage, databases, identity, and management—and how they work together to build cloud solutions, tested through scenario-based questions on service selection and architectural concepts.
Identify the appropriate Azure compute service (e.g., VMs, App Service, Functions) for a given workload scenario
Differentiate between Azure storage options (Blob, Disk, File, Queue, Table) based on use case
Understand Azure networking concepts (VNet, load balancer, VPN Gateway, CDN) and their purposes
Describe Azure database services (SQL Database, Cosmos DB, Azure Database for MySQL/PostgreSQL) and when to use each
Explain Azure identity services (Azure AD, RBAC, MFA) and their role in security
Recognize Azure management tools (Portal, CLI, PowerShell, Cloud Shell) and their typical uses
Common exam traps
Where candidates lose marks on Describe Azure architecture and services
⚠Confusing Azure Blob Storage (unstructured data) with Azure Files (managed file shares) or Azure Disk (VM disks)
⚠Thinking that availability zones and region pairs are the same thing—zones protect within a region, pairs protect across regions
⚠Assuming all virtual machines are IaaS, but Azure VMs are IaaS while App Service is PaaS—know the difference for scenario questions
⚠Mixing up Azure SQL Database (PaaS) with SQL Server on Azure VM (IaaS) in terms of management responsibility
⚠Forgetting that Azure AD is for identity and access management, not just Active Directory in the cloud—it's a separate service
AZ-900 Describe Azure architecture and services — Practice Questions
30 questions from this objective · 39% of your AZ-900 exam
A development team wants to deploy a microservices-based application using containers. They want to orchestrate the containers with automatic scaling and rolling updates, but they want to avoid managing the underlying infrastructure such as virtual machines. Which Azure compute service meets these requirements?
A company has a virtual machine running a legacy application that needs high-performance, low-latency storage for transactional data. They need to attach a storage solution that provides the highest IOPS and throughput. Which Azure managed disk type should they choose?
A company wants to migrate an on-premises application to Azure. The application requires consistently high disk throughput for database files. They plan to use Azure virtual machines with managed disks. Which disk type should they choose to get the highest possible IOPS and throughput at a premium cost?
A company needs to run a simple background job that runs every hour for 10 minutes. They want to containerize the job but do not want to manage a container orchestration platform. Which Azure service is simplest and most cost-effective?
A company needs to share a set of files between multiple Azure VMs using the SMB protocol. They require a managed file share that can be mounted simultaneously by multiple VMs with permissions managed via Active Directory. Which Azure storage services should they use? (Select all that apply.)
A company is developing a web application that will be deployed to Azure App Service. The application experiences unpredictable spikes in traffic, and the company wants the number of instances to automatically increase during high demand and decrease during low demand to optimize costs. The company also needs to use a custom domain name and ensure the application is accessible over HTTPS. Which App Service plan tier should the company choose?
A company plans to deploy a three-tier web application in Azure. The application consists of web servers, application servers, and database servers. The company wants to protect the virtual machines (VMs) from planned maintenance events (e.g., OS updates) and unplanned hardware failures. They want to ensure that at least one VM in each tier remains available during such events. The solution should be deployed entirely within a single Azure region. What should the company use for the VMs?
A company has an on-premises datacenter with critical line-of-business applications. They plan to migrate some workloads to Azure but need a reliable, high-bandwidth, and low-latency connection that does not traverse the public internet. The connection must be dedicated and guaranteed for a consistent network experience. Which Azure service should the company use?
A company is migrating a legacy on-premises application to Azure. The application runs on multiple Windows Server virtual machines and requires a shared file system that multiple servers can mount simultaneously using the SMB protocol. The data must also be accessible from on-premises servers in a hybrid configuration. The IT team wants to minimize management overhead and avoid provisioning additional servers solely for file sharing. Which Azure service should they use?
A global e-commerce company needs to store product catalog data that must be available for reads and writes from multiple Azure regions simultaneously. The application requires consistently low latency (single-digit milliseconds) for writes from any region, and the database must automatically replicate all changes across regions with conflict resolution. The company wants a fully managed database service with native multi-region write support. Which Azure database service should the company use?
A company plans to migrate their on-premises file server to Azure. The file server stores shared documents that are accessed by multiple Windows and Linux virtual machines using the SMB protocol. The company wants a fully managed cloud file share that can be mounted simultaneously by multiple VMs, and they want to minimize management overhead. Which Azure service should they use?
A global e-commerce company runs its website on Azure virtual machines in two different Azure regions: West US and East US. The company wants to distribute incoming web traffic to the region that provides the lowest latency for each user. Additionally, if one region becomes unavailable, all traffic should automatically fail over to the healthy region. The solution must not require any changes to the web application code. Which Azure service should the company use?
Which Azure service provides an integrated development environment and tools for building and deploying applications to Azure directly from a web browser?
Which Azure database service is a globally distributed, multi-model NoSQL database that supports multiple data models and multi-master global distribution?
Which Azure service provides a way to connect microservices-based applications using patterns like service discovery, circuit breaker, and distributed tracing?
A company wants to run Windows and Linux containers together in Azure without managing Kubernetes cluster infrastructure. Which service should they use?
A company wants to synchronize files between multiple on-premises Windows file servers and Azure Blob Storage for backup and centralized access. Which Azure service BEST enables this?
A company is planning to migrate its on-premises applications to Azure. They have a mix of monolithic and microservices-based applications. Which Azure compute service should they choose for a microservices architecture that requires independent scaling and deployment of components?
A solutions architect is designing a storage solution for a large media company. The company needs to store video files that are accessed infrequently but must be retained for several years for compliance. Which two Azure storage options meet these requirements? (Select two.)
A developer is building a serverless application that requires integration with an on-premises SQL Server database for real-time data processing. The on-premises network is connected to Azure via a site-to-site VPN. Which Azure service would allow the function to securely access the on-premises database without exposing it to the public internet?
A company is designing a multi-tier application on Azure. The web tier needs to scale out based on CPU usage, while the database tier requires high-performance storage for transactional data. Which combination of Azure services should they choose?
A company is deploying a mission-critical application that must remain available even if a physical Azure datacenter within a region fails. The application will run on multiple virtual machines. Which Azure feature should they use to protect against this specific failure scenario?
More Describe Azure architecture and services questions available in the full practice test.