Free AZ-900 Practice Test Questions and Answers (2026)

This question matches core Azure compute services with their primary functions.

• Azure virtual machines are the foundational Infrastructure as a Service (IaaS) offering, providing complete operating system virtualization.
• Azure Container Instances (ACI) is a service that runs Docker containers on-demand, offering a portable, virtualized environment for applications without VM management.
• Azure App Service is a Platform as a Service (PaaS) specifically designed to host web applications, REST APIs, and mobile back ends, managing the infrastructure required to scale them.
• Azure Functions is a serverless, event-driven compute platform that allows you to run small pieces of code ("functions") without managing the underlying server infrastructure.

Azure virtual machines:

Source: Microsoft Docs - "What is an Azure virtual machine?"

Reference: "Azure virtual machines (VMs) is one of several types of on-demand, scalable computing resources that Azure offers... A VM is a physical computer's emulation, which offers the flexibility of virtualization without having to buy and maintain the physical hardware that runs it."

Azure Container Instances:

Source: Microsoft Docs - "What is Azure Container Instances?"

Reference: "Azure Container Instances (ACI) is a solution for any scenario that can operate in isolated containers, without orchestration... Containers are lightweight and portable... Because containers run directly on ACI, they get the same isolation as if they were running on a VM but without the overhead of a full OS."

Azure App Service:

Source: Microsoft Docs - "Azure App Service overview"

Reference: "Azure App Service is an HTTP-based service for hosting web applications, REST APIs, and mobile back ends... It's a fully managed platform as a service (PaaS) that takes care of the infrastructure... You can easily scale your apps... to meet demand."

Azure Functions:

Source: Microsoft Docs - "An introduction to Azure Functions"

Reference: "Azure Functions is an event-driven, serverless compute platform that helps you build more efficient, scalable, and reliable applications... Functions lets you write code in the language of your choice and it runs that code in response to events... without having to provision or manage servers."

The diagram illustrates the defense-in-depth model, a strategy that layers multiple, independent security controls to protect assets. The layers are arranged from the outermost barrier (top) to the core asset being protected (bottom).

1. Physical Security: This is the outermost layer, providing the first line of defense. It includes controls like guards, fences, and locked doors to prevent unauthorized physical access to the datacenter and hardware.
2. Perimeter: This layer is placed between the "Identity & Access" and "Network" layers. It represents the network edge, using controls like firewalls and Distributed Denial of Service (DDoS) protection to defend against large-scale network-based attacks.
3. Application: This layer is placed between the "Compute" and "Data" layers. It focuses on securing applications (e.g., through secure coding, Web Application Firewalls) as they are the direct gateway to accessing and processing the data.

The final, correct order from outer to inner is: Physical Security > Identity & Access > Perimeter > Network > Compute > Application > Data.

Microsoft Learn. (n.d.). What is defense in depth?. Microsoft Azure Documentation.

This document outlines the standard layered security model used by Microsoft. It explicitly details the order and purpose of each layer: "The layers are: physical security, identity and access, perimeter, network, compute, application, and data." This directly supports the placement of all three draggable layers in the provided diagram.

National Security Agency (NSA). (n.d.). Defense in Depth: A practical strategy for achieving Information Assurance in today's highly networked environments.

This foundational document (referenced in academic texts, e.g., Wikipedia "Defense in depth (computing)") establishes the "onion model" concept. It describes the layering of defenses, starting with Physical Security as a fundamental component, followed by network and host-level controls (like Perimeter and Compute), and finally protecting the Application and Data at the core.

National Institute of Standards and Technology (NIST). (n.d.). Glossary: Defense-in-Depth. Computer Security Resource Center (CSRC).

Document: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations.

Reference: This standard, along with the CSRC glossary, defines defense-in-depth as an "information security strategy integrating people, technology, and operations capabilities to establish variable barriers across multiple layers and dimensions of the organization." The layered model in the question is a direct visualization of implementing these variable barriers, which include physical, network (perimeter), and application controls as distinct layers.

The core requirement is to place the "FinServer" on a separate network segment for compliance. In Azure, a Virtual Network (VNet) represents an isolated network in the cloud. By creating one VNet exclusively for FinServer and another VNet for all other servers, you establish two distinct, isolated network segments. By default, resources in separate VNets cannot communicate with each other, which directly satisfies the compliance policy for network separation and isolation.

A. Resource groups are logical containers for managing resources, not for creating network isolation. Servers in different resource groups can still reside on the same network segment.

C. A VPN and virtual network gateways are used to connect networks, not to create the fundamental network segments themselves. This option is architecturally incorrect for this purpose.

D. Resource locks are a management feature that prevents accidental deletion or modification of a resource. They do not provide any form of network segmentation.

---

1. Microsoft Learn, "What is Azure Virtual Network?":

Reference: Under the "Isolate resources" section, the documentation states, "You can segment the virtual network into one or more subnets and allocate a portion of the virtual network's address space to each subnet... You can also provide network isolation for your resources with virtual networks. By default, resources in one virtual network can't communicate with resources in other virtual networks." This confirms that separate VNets provide the required network isolation.

2. Microsoft Learn, "Azure Resource Manager overview":

Reference: In the "Terminology" section, a "resource group" is defined as "A container that holds related resources for an Azure solution." The documentation focuses on its role in lifecycle management, access control, and billing, with no mention of network isolation capabilities. This supports why option A is incorrect.

3. Microsoft Learn, "Azure fundamentals: Describe core Azure architectural components":

Reference: In the "Describe resource groups" unit, it is explained that "Resource groups are a fundamental element of the Azure platform... Resource groups are a scope for applying role-based access control (RBAC) permissions." This reinforces that their purpose is management and access control, not network segmentation, making options A and D incorrect.

Each service is matched to its core function as defined by official documentation:

• Azure DevOps provides developer services, including CI/CD pipelines, to manage the entire software development lifecycle, which matches the description of an "integrated solution for the deployment of code."
• Azure Advisor acts as a personalized cloud consultant. It analyzes Azure resource configurations and usage to provide "guidance and recommendations" for optimizing reliability, security, performance, cost, and operational excellence.
• Azure Cognitive Services are a family of pre-built, API-based AI models that enable developers to "build intelligent AI applications" (e.g., vision, speech, language) without requiring deep data science expertise.
• Azure Application Insights, a feature of Azure Monitor, is an Application Performance Management (APM) service that "monitors web applications" for performance, availability, and usage diagnostics.

Azure DevOps: Microsoft Learn. (2024). "What is Azure DevOps?". Azure DevOps documentation. Retrieved November 5, 2025.

Reference: In the "What is Azure DevOps?" section, it states, "Azure DevOps provides developer services to support teams to plan work, collaborate on code development, and build and deploy applications."

Azure Advisor: Microsoft Learn. (2024). "Introduction to Azure Advisor". Azure Advisor documentation. Retrieved November 5, 2025.

Reference: The introductory paragraph states, "Azure Advisor is a personalized cloud consultant... It analyzes your resource configuration and usage telemetry and then recommends solutions that can help you improve an Azure environment."

Azure Cognitive Services: Microsoft Learn. (2024). "What are Azure Cognitive Services?". Azure AI services documentation. Retrieved November 5, 2025.

Reference: The main overview states, "Azure Cognitive Services are cloud-based artificial intelligence (AI) services that help developers build cognitive intelligence into applications...".

Azure Application Insights: Microsoft Learn. (2024). "What is Application Insights?". Azure Monitor documentation. Retrieved November 5, 2025.

Reference: The first sentence states, "Application Insights, a feature of Azure Monitor, is an extensible Application Performance Management (APM) service... Use it to monitor your live web applications."

Azure China: This statement is false. Due to Chinese regulations, Azure services in mainland China must be operated by a local partner. Microsoft licenses its technology to Shanghai Blue Cloud Technology Co., Ltd. (21Vianet), which operates and delivers Azure services independently.

Azure Government: This statement is true. Azure Government is a physically isolated instance of Azure operated by Microsoft, specifically by screened U.S. persons, to meet the compliance and security requirements of the US government.

Azure Government Availability: This statement is true. Access to Azure Government is restricted to US federal, state, local, and tribal government entities, as well as partners and solution providers who serve these entities.

Microsoft. (n.d.). What is Azure China 21Vianet? Microsoft Learn.

Section: Overview.

Quote: "Azure China is a physically separated instance of Microsoft Azure services located in mainland China. It's independently operated and transacted by Shanghai Blue Cloud Technology Co., Ltd. ('21Vianet')."

Microsoft. (n.d.). What is Azure Government? Microsoft Learn.

Section: Overview.

Quote: "Microsoft Azure Government is a separate instance of the Microsoft Azure service... It is operated by screened US persons..."

Microsoft. (n.d.). Azure Government eligibility. Microsoft Learn.

Section: Customer eligibility.

Quote: "Azure Government is available to US government entities (federal, state, local, and tribal) and their partners. This includes US government contractors and solution providers who serve these entities..."

The Microsoft Trust Center is the dedicated public-facing website that provides detailed information about security, privacy, and compliance within Microsoft's cloud services, including Azure. It is the primary resource for customers to understand how Azure complies with various global, regional, and industry-specific requirements. The Trust Center contains comprehensive documentation, audit reports, and information on data protection standards, which directly enables a company to verify if Azure meets its specific regional compliance needs before migration.

A. the Knowledge Center: This is a generic term; the specific Microsoft resource for security, privacy, and compliance information is the Trust Center.

B. Azure Marketplace: This is an online store for discovering and deploying third-party applications and services on Azure, not for verifying platform compliance.

C. the Azure portal: This is the web-based management console for creating and managing Azure services, not a resource for compliance documentation.

1. Microsoft Learn, "Describe the purpose of the Microsoft Trust Center," AZ-900: Describe security, privacy, compliance, and trust. This module explicitly states, "The Trust Center is a website that provides information and details about how Microsoft implements and supports security, privacy, compliance, and transparency... It's an important resource for people in legal and compliance roles."

2. Microsoft Trust Center, "Compliance offerings for Microsoft 365, Azure, and other Microsoft services." This official page allows users to filter compliance certifications and attestations by region and country, directly addressing the need to check for regional requirements. For example, it lists specific compliance offerings for countries like Germany or Australia.

3. Microsoft Learn, "What is the Trust Center?," Microsoft security and compliance documentation. This document clarifies that the Trust Center is the central hub for finding information on "compliance with regulations and standards, such as ISO 27001, SOC, FedRAMP, and GDPR."

Azure Queue Storage is the correct match for reliable messaging. Its specific purpose is to store large numbers of messages that can be accessed by applications, enabling decoupled and asynchronous communication.

Azure Files is designed to provide fully managed cloud file shares accessible via the standard Server Message Block (SMB) protocol. This allows a Windows device (as well as Linux or macOS) to mount the share as a standard network drive.

Azure Blob storage is an object storage solution that provides Hot, Cool, and Archive access tiers. The Archive tier is a low-cost, offline tier intended for storing data that is rarely accessed and has flexible retrieval latency requirements.

Azure Queue Storage:

Source: Microsoft Corporation. (n.d.). What is Azure Queue Storage? Microsoft Docs.

Section: "What is Queue Storage"

Reference: "Azure Queue Storage is a service for storing large numbers of messages. You access messages from anywhere in the world via authenticated calls using HTTP or HTTPS... Queue Storage is often used to create a backlog of work to process asynchronously."

Azure Files:

Source: Microsoft Corporation. (n.d.). What is Azure Files? Microsoft Docs.

Section: "Overview"

Reference: "Azure Files offers fully managed file shares in the cloud that are accessible via the industry-standard Server Message Block (SMB) protocol, Network File System (NFS) protocol... This means you can mount an Azure file share on Windows, Linux, and macOS, just like you would use a file share on an on-premises file server."

Azure Blob storage:

Source: Microsoft Corporation. (n.d.). Access tiers for Azure Blob Storage - Hot, Cool, and Archive. Microsoft Docs.

Section: "Summary of access tiers"

Reference: "Azure Blob Storage offers different access tiers... The access tiers include: ... Archive - An offline tier optimized for storing data that is rarely accessed, and that has flexible latency requirements (on the order of hours)."

The proposed solution is incomplete. While Azure App Service (for applications) and Azure Storage (for unstructured data like files and blobs) are both Platform as a Service (PaaS) offerings, they do not cover all potential data and resource types. A typical enterprise migration of all resources would also include structured, relational data. The solution omits a PaaS database service, such as Azure SQL Database or Azure Database for MySQL/PostgreSQL, which would be required to migrate existing database workloads under the strict PaaS-only constraint. Therefore, this solution does not fully support the planned migration.

A. Yes: This is incorrect because the solution is insufficient. It fails to provide a PaaS offering for relational databases, which are a critical component of "all data and resources" for most companies.

1. Microsoft Learn, "What is Platform as a service (PaaS)?": This document defines PaaS and provides examples. It lists Azure App Service and Azure SQL Database as common PaaS services, illustrating that different services are needed for different workloads (applications vs. databases).

Reference Section: "Common PaaS scenarios" and "Advantages of PaaS".

2. Microsoft Learn, "App Service overview": This document explicitly categorizes Azure App Service as a PaaS offering.

Reference Section: "What is App Service?". It states, "Azure App Service is an HTTP-based service for hosting web applications, REST APIs, and mobile back ends... It's a platform as a service (PaaS) offering..."

3. Microsoft Learn, "What is Azure SQL Database?": This documentation confirms that Azure SQL Database is the appropriate PaaS solution for relational database workloads.

Reference Section: "Overview". It states, "Azure SQL Database is a fully managed platform as a service (PaaS) database engine that handles most of the database management functions..."

4. Microsoft Learn, "Compare IaaS, PaaS, and SaaS": This article provides a clear comparison of cloud service models, reinforcing that a complete solution often requires multiple, distinct PaaS services to cover different aspects like compute, data, and networking.

Reference Section: "PaaS" and the comparison chart.

To calculate the uptime percentage, you must determine the ratio of the actual operational time to the total scheduled time and then convert that ratio to a percentage.

1. Actual Operational Time (Numerator): This is calculated by taking the total possible time the service was scheduled to be available and subtracting any time it was unavailable.

• (Maximum Available Minutes – Downtime in Minutes)

1. Total Scheduled Time (Denominator): This is the total time frame being measured.

• Maximum Available Minutes

1. Percentage Conversion (Multiplier): To express the resulting ratio (a decimal) as a percentage, you must multiply it by 100.

• 100

The complete formula is: $\text{Availability \%} = \frac{(\text{Total Time} - \text{Downtime})}{\text{Total Time}} \times 100$

Microsoft. (2023). Service Level Agreements (SLA) for Online Services. Microsoft Licensing Documents.Reference: While specific calculation formulas are detailed in individual service SLAs, the concept is standardized. The SLA defines "Monthly Uptime Percentage," which is universally calculated by taking the total minutes in a month, subtracting the minutes of "Downtime," and dividing by the total minutes in the month.Lyu, M. R. (2007). "Software Reliability Engineering: A Roadmap." In Future of Software Engineering (FOSE '07). IEEE Computer Society, pp. 153–170.DOI: https://doi.org/10.1109/FOSE.2007.25Reference: This paper discusses software reliability and availability. On page 162, Availability ($A(t)$) is defined in its simplified form as a ratio of uptime to total time: $A(t) = \frac{\text{Uptime}}{\text{Uptime} + \text{Downtime}}$. This is mathematically equivalent to the formula in the answer: $\frac{(\text{Total Time} - \text{Downtime})}{\text{Total Time}}$.Zio, E. (2009). "Reliability engineering: Old problems and new challenges." Reliability Engineering & System Safety, 94(2), pp. 125–141.DOI: https://doi.org/10.1016/j.ress.2008.06.002Reference: Section 2.1 defines availability as "the probability that the system is operational at a given time $t$." The practical, time-based calculation for this is consistently represented as the ratio of operational time (total time minus downtime) to the total time over a given interval.

Azure Policy is the correct feature for restriction. It is designed to enforce rules and compliance at scale. A specific policy definition, such as "Allowed virtual machine size SKUs," can be applied at a subscription level to restrict which VM types are permitted for deployment.

Azure tags are key-value pairs used to add metadata to resources. Their primary purpose is to organize and identify resources for management, billing, and reporting. A common use case is applying a "CostCenter" tag to all resources to track spending.

Azure Blueprints is a service for declarative, repeatable environment deployment. It acts as a package that bundles multiple artifacts—including ARM templates (for resource deployment), Role-Based Access Control (RBAC) assignments, and Policy assignments—into a single, versioned blueprint definition.

Microsoft Learn. (2024). Overview of Azure Policy. Azure Governance documentation. Retrieved November 6, 2025, from https://learn.microsoft.com/en-us/azure/governance/policy/overview.

Section: "What is Azure Policy?" and "Policy definition." This source confirms that Azure Policy "enforces different rules and effects over your resources" and provides built-in policy definitions like "Allowed virtual machine size SKUs," which directly matches the first requirement.

Microsoft Learn. (2024). Use tags to organize your Azure resources and management hierarchy. Azure Resource Manager documentation. Retrieved November 6, 2025, from https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources.

Section: "Introduction" and "Common use cases." This document states, "You apply tags to your Azure resources... to logically organize them... A common use case is to group resources by cost center." This directly supports the answer for the second requirement.

Microsoft Learn. (2024). Overview of Azure Blueprints. Azure Governance documentation. Retrieved November 6, 2025, from https://learn.microsoft.com/en-us/azure/governance/blueprints/overview.

Section: "What is Azure Blueprints?" and "What it does." This source explains that a blueprint is a "package for creating specific sets of standards" and allows the composition of artifacts such as "Resource Manager templates, Role-Based Access Control (RBAC) assignments, and Policy assignments." This matches the third requirement perfectly.

The proposed solution does not meet the goal. Azure resource groups are logical containers used for managing, monitoring, and controlling access to related resources. They do not provide any physical isolation or high-availability guarantees. Deploying virtual machines into multiple resource groups does not ensure they are placed in different physical data centers. To protect services against the failure of a single data center, the virtual machines must be deployed across multiple Availability Zones. Each Availability Zone is a physically separate data center within an Azure region, with independent power, cooling, and networking, thus providing the required resiliency.

A. Yes: This is incorrect because a resource group is a management and billing boundary, not a physical or fault-tolerant boundary. Resources in different resource groups can still reside in the same data center.

1. Microsoft Learn, "Regions and Availability Zones in Azure": Under the "Availability Zones" section, it states, "Availability Zones are physically separate datacenters within an Azure region... To ensure resiliency, there's a minimum of three separate zones in all enabled regions." This confirms that Availability Zones are the correct mechanism for data center-level redundancy.

2. Microsoft Learn, "Availability options for Azure Virtual Machines": This document explicitly states, "Availability Zones... protect your applications and data from datacenter failures." It clearly distinguishes this from other concepts and highlights its role in high availability.

3. Microsoft Learn, "What is Azure Resource Manager?": In the "Terminology" section, a resource group is defined as "A container that holds related resources for an Azure solution." This definition emphasizes its role as a logical container for management, with no mention of physical isolation or high availability capabilities.

Azure Resource Manager allows for the movement of resources, including virtual machines, between different Azure subscriptions. This is a standard administrative capability, often facilitated through the Azure portal or Azure Resource Mover. When a virtual machine is moved, all of its dependent resources (such as managed disks, network interfaces, and public IP addresses) must also be selected for the move operation. These dependent resources must reside in the same source resource group as the VM. The operating system (Option 4) is irrelevant to the move operation, and stating they "cannot be moved" (Option 1) is factually incorrect.

Microsoft Corporation. (n.d.). Move a Windows VM to another Azure subscription or resource group. Microsoft Learn. Retrieved November 3, 2025.

Section: "Move a VM to another subscription"

Quote: "You can move a VM and its associated resources to a different subscription by using the Azure portal."

Microsoft Corporation. (n.d.). Move resources to a new resource group or subscription. Microsoft Learn. Retrieved November 3, 2025.

Section: "Checklist before moving resources"

Quote: "The service must enable the ability to move resources. ... Virtual Machines and their associated resources (managed disks, network interfaces, public IPs) support the move operation."

Microsoft Corporation. (n.d.). Move resources to a new resource group or subscription. Microsoft Learn. Retrieved November 3, 2025.

Section: "Checklist before moving resources"

Note: This reference addresses the "same resource group" (Option 3) constraint. The rule is: "All resources in the source group that you want to move must be in the same source resource group. And, they must be moved to the same target resource group." This confirms that a specific move operation is tied to a single source resource group, but it does not prohibit the general capability of moving VMs from a subscription (which may be in different RGs) via separate operations. Therefore, Option 2 remains the most accurate statement of capability.

Azure AD Conditional Access policies are the appropriate tool for this requirement. They function as if-then statements, evaluating signals from users, devices, and locations to enforce organizational access rules. A Conditional Access policy can be configured to use "device compliance" as a condition for granting access. In this scenario, a policy would grant access to the Azure AD-integrated applications only if the user's device is marked as compliant by a management solution like Microsoft Intune, which can verify that the latest security patches are installed.

A. Azure Bastion: This service provides secure RDP and SSH connectivity to Azure virtual machines directly through the Azure portal, not for controlling access to applications based on device health.

C. Azure Policy: This service enforces rules and standards for Azure resources to ensure they remain compliant with corporate standards, but it does not manage user access to applications.

D. Azure Firewall: This is a network security service that protects Azure Virtual Network resources by filtering network traffic; it does not evaluate the compliance state of endpoint devices.

1. Microsoft Learn, "What is Conditional Access in Azure Active Directory?"

Section: Common signals

Content: "Device compliance - Users with devices marked as compliant with a specific policy can be differentiated from users with noncompliant devices." This document establishes that device compliance is a primary signal used by Conditional Access.

2. Microsoft Learn, "Conditional Access: Grant"

Section: Require device to be marked as compliant

Content: "This control requires that the device the user is signing in from is marked as compliant by a mobile device management (MDM) solution like Microsoft Intune... If a device isn't registered with an MDM solution, access is blocked." This directly confirms that requiring a compliant device is a grant control within Conditional Access.

3. Microsoft Learn, "Use compliance policies to set rules for devices you manage with Intune"

Section: How Intune device compliance policies work

Content: This document explains how Microsoft Intune evaluates device settings, such as OS version and security patch levels, to determine if a device is compliant. This compliance status is then reported to Azure AD for use in Conditional Access policies.

This question maps security controls to the standard "defense in depth" layered security model.

• Multifactor authentication (MFA) is a core component of the Identity and access layer. It ensures that a user is who they claim to be by requiring multiple forms of verification before granting access to resources.
• Software updates and patches are applied to virtual machines and operating systems to remediate vulnerabilities. This is a crucial security practice for hardening resources in the Compute layer.
• Surveillance cameras are a physical control used to monitor and protect the physical buildings and assets within a data center, placing them in the Physical security layer.

Microsoft Learn. (2024). Security - Defense in depth. Microsoft Docs.

Reference: In the "Defense in depth" article, Microsoft maps security controls to their respective layers. "Identity & access" is shown as the layer that includes controls like "Multi-factor authentication." The "Compute" layer is shown to protect virtual machines, which is accomplished via controls like patch management. The "Physical security" layer is described as the "first line of defense," protecting the physical hardware in the datacenter.

Microsoft Learn. (2024). Azure facilities, premises, and physical security. Microsoft Docs.

Reference: In the section "Facility security," the documentation states, "Video surveillance cameras are placed at strategic points throughout the data center..." This confirms that surveillance cameras are a key component of the Physical security layer.

National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations. Special Publication (SP) 800-53, Revision 5.

Reference: This standard, widely used in academia and government, defines security control families.

IA-2 (Identification and Authentication): Details the use of multi-factor authentication for identity management (Identity and access).

SI-2 (Flaw Remediation): Mandates the timely installation of "security-relevant software and firmware updates" (Compute).

PE-3 (Physical and Environmental Protection): Describes physical access controls, including the use of "video surveillance" (Physical security).

Statement 1 (Limited Services): False. An Azure free account includes free amounts of over 20 popular services for 12 months (for new customers) and over 65 always-free services, which is a broad selection beyond just Virtual Machines and Storage. This includes services like Azure App Service, Azure Functions, Azure SQL Database, and various AI/ML services (Source 1.1, 1.3).

Statement 2 (Expiration): True. The Azure free account has two components that expire: the $200 credit expires after 30 days, and the free services with limited quantity expire after 12 months (Source 1.4, 1.6). After expiration, the subscription is disabled unless upgraded to a Pay-as-you-go subscription.

Statement 3 (Multiple Accounts): False. The Azure free account offer is generally limited to one account per new customer (Source 1.1). Official documentation implies a restriction to one free account per person/entity to prevent misuse of the free credit and service limits (Source 2.2, 2.6).

Microsoft Azure Official Documentation. (2025). Create Your Azure Free Account Or Pay As You Go. (Source 1.1, 2.1).

Microsoft Azure Official Documentation. (2025). Explore Free Azure Services. (Source 1.3).

Microsoft Azure Official Documentation. (2025). Create free services with Azure free account - Microsoft Cost Management. (Source 1.4).

Microsoft Azure Official Documentation. (2025). Avoid charges with your Azure free account - Microsoft Cost Management. (Source 1.6).

Microsoft Azure Official Documentation. (2025). Azure for Students | Microsoft Azure (Referenced for the one-account-per-person principle across free offers). (Source 2.2).

Microsoft Azure Official Documentation. (2025). Troubleshoot issues when you sign up for a new account in the Azure portal - Microsoft Cost Management. (Referenced for sign-up process implying one account per unique identity/card). (Source 2.6).

Azure SQL Database is Microsoft's fully managed, relational Platform-as-a-Service (PaaS) database. This directly matches the description of a "managed relational cloud database service."

Azure Synapse Analytics integrates what was formerly Azure SQL Data Warehouse. Its dedicated SQL pools use a massively parallel processing (MPP) architecture specifically designed to run complex queries on petabyte-scale relational data warehouses.

Azure Data Lake Analytics (now being retired, but historically correct) was an on-demand analytics job service designed to run massively parallel data transformation and processing programs (using U-SQL) across petabytes of data in a data lake.

Azure HDInsight is the managed service for open-source distributed analytics frameworks, most notably Apache Hadoop and Apache Spark. The description "An open-source framework for the distributed..." clearly points to this service.

Azure SQL Database:

Source: Microsoft Azure Documentation, "What is Azure SQL Database?"

Reference: "Azure SQL Database is a fully managed platform as a service (PaaS) database engine... SQL Database is a relational data service..."

Azure Synapse Analytics (MPP):

Source: Microsoft Azure Documentation, "Dedicated SQL pool (formerly SQL DW) architecture in Azure Synapse Analytics"

Reference: "Dedicated SQL pool (formerly SQL DW) leverages a scale-out architecture to distribute computational processing of data across multiple nodes. The unit of scale is a Data Warehouse Unit (DWU), which represents an abstract bundle of compute resources... Dedicated SQL pool (formerly SQL DW) uses a massively parallel processing (MPP) architecture..."

Azure Data Lake Analytics:

Source: Microsoft Azure Documentation, "What is Azure Data Lake Analytics?"

Reference: "Azure Data Lake Analytics is an on-demand analytics job service that simplifies big data... you can write queries to transform your data... The analytics service can handle jobs of any scale instantly..." This service was known for its massively parallel execution of U-SQL jobs.

Azure HDInsight:

Source: Microsoft Azure Documentation, "What is Azure HDInsight?"

Reference: "Azure HDInsight is a managed, full-spectrum, open-source analytics service in the cloud for enterprises. With HDInsight, you can use open-source frameworks such as Apache Spark, Apache Hadoop, Apache Kafka, Apache HBase, and Storm in your Azure environment."

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. Its core function is to collect security data from various sources, including Azure Active Directory (Azure AD), and use intelligent analytics and threat intelligence to detect, investigate, and automatically respond to security threats. By using the built-in Azure AD data connector, Sentinel can ingest sign-in logs, audit logs, and provisioning logs for automated analysis, making it the correct tool for the specified task.

B. Azure Key Vault: This service securely stores and manages secrets, keys, and certificates. It does not collect or analyze security events from other services.

C. Azure Synapse Analytics: This is an enterprise analytics service for big data and data warehousing, not a specialized tool for real-time security event analysis and threat detection.

D. Azure AD Connect: This tool synchronizes on-premises identity directories with Azure AD. It does not analyze security events generated within Azure AD.

1. Microsoft Learn. (2023). "What is Microsoft Sentinel?". Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/azure/sentinel/overview. In the introduction, it states, "Microsoft Sentinel is a scalable, cloud-native solution that provides... Security information and event management (SIEM)... Security orchestration, automation, and response (SOAR)."

2. Microsoft Learn. (2023). "Connect Azure Active Directory (Azure AD) data to Microsoft Sentinel". Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/azure/sentinel/connect-azure-active-directory. This document explicitly details how to "stream logs from Azure Active Directory (Azure AD) into Microsoft Sentinel."

3. Microsoft Learn. (2023). "Describe the capabilities of Microsoft Sentinel". AZ-900: Microsoft Azure Fundamentals learning path. Retrieved from https://learn.microsoft.com/en-us/training/modules/describe-security-management-capabilities-azure/4-describe-capabilities-of-microsoft-sentinel. This official courseware states Sentinel's purpose is to "Collect data at cloud scale across all users, devices, applications, and infrastructure."

4. Microsoft Learn. (2023). "What is Azure Key Vault?". Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/azure/key-vault/general/overview. This source confirms Key Vault's role is to safeguard cryptographic keys and other secrets.

The proposed solution is incorrect. A script written in PowerShell to manage Azure resources uses Azure PowerShell cmdlets, which are part of the Azure PowerShell (Az) module. To run such a script, the computer must have PowerShell and the Az module installed.

The solution incorrectly recommends installing the Azure CLI. The Azure CLI is a separate, distinct command-line tool with its own syntax (e.g., az group create) and cannot execute scripts written with PowerShell cmdlets (e.g., New-AzResourceGroup). While PowerShell can be installed on Linux, the specified tool (Azure CLI) is the wrong one for executing a PowerShell script.

A. Yes: This is incorrect because the solution specifies the wrong tool. The Azure CLI cannot execute a script written with Azure PowerShell cmdlets; the Azure PowerShell module is required.

1. Microsoft Learn. (2023). What is Azure PowerShell? "Azure PowerShell is a set of cmdlets for managing Azure resources directly from PowerShell... The Az PowerShell module is the recommended PowerShell module for interacting with Azure." Retrieved from https://learn.microsoft.com/en-us/powershell/azure/what-is-azure-powershell

2. Microsoft Learn. (2024). What is the Azure CLI? "The Azure command-line interface (Azure CLI) is a set of commands used to create and manage Azure resources." This documentation shows the distinct az command syntax, which is different from PowerShell's Verb-Noun cmdlet syntax. Retrieved from https://learn.microsoft.com/en-us/cli/azure/what-is-azure-cli

3. Microsoft Learn. (2024). Install the Azure Az PowerShell module. This document outlines the prerequisites for running Azure PowerShell scripts, stating, "The Azure Az PowerShell module is a rollup module. Installing it downloads the generally available Az PowerShell modules and makes their cmdlets available for use." It provides installation instructions for Windows, Linux, and macOS, none of which involve installing the Azure CLI. Retrieved from https://learn.microsoft.com/en-us/powershell/azure/install-az-ps

The Help + support blade is the correct selection because it contains the Azure Service Health feature. Service Health provides a personalized view of the health of the Azure services and regions you use. This includes active service incidents, upcoming planned maintenance events, and health advisories that could impact the availability of your resources within a specific subscription.

Microsoft Learn. (2024). Tutorial: View service health notifications by using the Azure portal. Microsoft Docs. Retrieved November 3, 2025.

Reference (Section "Get a link to your service health notification"): "Sign in to the portal, and then navigate to the Help + Support blade and select Service Health."

Microsoft Learn. (2024). What is Azure Service Health?. Microsoft Docs. Retrieved November 3, 2025.

Reference (Section "Service Health events"): "Service Health provides you with a personalized dashboard of the health of your Azure services and regions. It's the best place to look for service-impacting communications about availability... The Service Health dashboard in the Azure portal (available from Help + Support > Service Health) displays any active service issues, planned maintenance, and health advisories..."

Azure Cost Management is a comprehensive tool that provides visibility into costs and usage across various scopes.

1. It supports analysis at high-level containers like management groups, allowing for an aggregated view of costs across multiple subscriptions.
2. It also supports granular analysis at the resource group and individual resource level, which is a fundamental feature of the Cost Analysis tool.
3. The third statement is correct because "usage" in this context refers to billable usage quantities (e.g., "Compute Hours," "Data Transfer"), not real-time performance metrics. Azure Cost Management tracks and displays this consumption data, allowing you to analyze the quantity of services used over time. This data is available for at least the last 13 months.

Microsoft Learn. (2024). Overview of Cost Management. In: "Azure Cost Management documentation." This document states that Cost Management is "available from every subscription, resource group, and management group" and helps you "track usage, monitor expenses, identify cost anomalies, and forecast your expenditures."

Microsoft Learn. (2024). Understand and work with scopes. In: "Azure Cost Management documentation." This page explicitly lists management groups, subscriptions, and resource groups as the scopes at which you can apply permissions and view cost data.

Microsoft Learn. (2024). View and download Azure usage and charges. In: "Azure Cost Management documentation." This document details how to download "Usage Details" from the "Usage + charges" page within Cost Management + Billing. This report provides granular details on consumption.

Microsoft Learn. (2024). Understanding Azure virtual machine usage. In: "Azure Virtual Machines documentation." This document explains the specific billing meters for VMs, such as "Meter Name" (e.g., "Compute Hours"), "Unit" (e.g., "Hours"), and "Consumed" (the quantity used). This is the "usage" data that is fed into Azure Cost Management for analysis.

Microsoft Learn. (2024). Understand Cost Management data. In: "Azure Cost Management documentation." Section: "Cost and usage data updates and retention." This document confirms that "Summarized data in Cost Analysis is only available for the last 13 months," which satisfies the "last three months" requirement.