AZ-900 cheat sheet
Last-minute reference for AZ-900. Architecture and services is the largest area; the look-alike tools decide most marks.
Exam facts
| Duration | 45 minutes (65 minutes seat time) |
| Passing score | 700 / 1000 |
| Price | Set per country or region; shown at booking |
| Level | Fundamentals |
| Expires | Never; no renewal |
Skill areas
| Area | Weight |
|---|---|
| Describe Azure architecture and services | 35–40% |
| Describe Azure management and governance | 30–35% |
| Describe cloud concepts | 25–30% |
Shared responsibility
| IaaS | PaaS | SaaS | |
|---|---|---|---|
| Data, devices, accounts | You | You | You |
| Applications | You | Shared | Microsoft |
| Operating system | You | Microsoft | Microsoft |
| Physical datacenter | Microsoft | Microsoft | Microsoft |
Storage redundancy
| Option | Survives |
|---|---|
| LRS | Disk or server failure |
| ZRS | Datacenter (zone) failure |
| GRS | Region failure |
| GZRS | Zone and region failure |
Add RA- for read access to the secondary region. Tiers: hot, cool, cold, archive (offline, rehydrate first).
Requirement to service
| Requirement | Answer |
|---|---|
| Full control of the OS | Virtual machine (IaaS) |
| Many identical VMs, autoscale | VM Scale Sets |
| Survive a datacenter failure | Availability zones |
| Survive a rack failure in one datacenter | Availability set |
| Survive a region failure | Region pair / geo-redundancy |
| Event-driven code, pay per run | Azure Functions |
| Host a web app with least management | App Service |
| Cloud desktops | Azure Virtual Desktop |
| Private link to Azure, not over the internet | ExpressRoute |
| Encrypted tunnel over the internet | VPN Gateway |
| Connect two VNets | Peering |
| Move tens of TB offline | Azure Data Box |
| Keep on-prem file servers in sync | Azure File Sync |
| Require MFA outside the office | Conditional Access |
| Who can do what on resources | Azure RBAC |
| Security posture and threats | Defender for Cloud |
| Estimate cost before deploying | Pricing calculator |
| Budgets and spend on running resources | Cost Management |
| Group costs by department | Tags |
| Allowed regions, required settings | Azure Policy |
| Block deletion, even by Owners | Resource lock |
| Discover and classify data | Microsoft Purview |
| Manage servers outside Azure | Azure Arc |
| Repeatable deployments as code | ARM templates |
| Is Azure itself having an outage? | Service Health |
| Recommendations for my resources | Azure Advisor |
| Metrics, logs and alerts for my resources | Azure Monitor |
Hierarchy
Management group → subscription → resource group → resource. Policies, roles and locks inherit downwards. A resource is in exactly one resource group; deleting the group deletes its resources.
Traps
- Availability set ≠ availability zone. Set: racks in one datacenter. Zone: separate datacenters.
- RBAC ≠ Policy ≠ lock. Who; what configuration; stop deletion or change.
- Calculator ≠ Cost Management. Before deployment; after deployment.
- Service Health ≠ Azure Monitor. Microsoft’s platform; your resources.
- Scale up ≠ scale out. Bigger machine; more machines.
- Your data is always yours, in every service type.
- Old names: Azure Active Directory is now Microsoft Entra ID.
Night-before checklist
- Name the three areas and which is largest
- Draw the shared responsibility table from memory
- The four redundancy options, cold
- Check ID and proctoring rules; see exam day
Take the 20-question practice test and check your weakest area.