What the AZ-900 actually feels like on test day

AZ-900 is an entry-level exam, but Microsoft still writes questions in a way that punishes vague understanding. The exam is usually around 30–50 questions with roughly 45 minutes of exam time, plus the usual check-in/tutorial overhead. The pressure is not brutal, but the wording is slippery enough that people lose time second-guessing basic cloud concepts.

The item mix matters. Expect a blend of:

Single-choice and multiple-choice questions
True/false or yes/no statement sets
Matching / drag-and-drop style items
Short scenario questions where the answer depends on one Azure service capability

AZ-900 usually does not behave like a hands-on admin exam. You are not configuring resources in a lab. Microsoft is testing whether you can identify the right service, pricing concept, governance tool, or architectural principle from a short business scenario.

A few practical things about the format:

If the exam includes a grouped scenario or statement set, treat it as a unit. Microsoft loves giving three statements about the same setup, and one changed word flips the answer.
The exam often uses "best" wording even when more than one answer sounds plausible. On AZ-900, that usually means you should pick the service with the most direct fit, not the one that could technically work with extra effort.
Watch for the difference between "can reduce cost", "can enforce", and "can provide recommendations". Microsoft uses those verbs very deliberately. For example, Azure Policy enforces, Azure Advisor recommends, and Reservations reduce predictable long-term cost.

Time-wise, this exam is generous if you know the content. The trap is spending too long on easy-looking service-identification questions. If you cannot immediately separate, say, Azure Firewall from Network Security Groups, mark it mentally and move on. The exam is easier when you preserve time for the wording-heavy governance and pricing items.

Where the score really comes from: don’t misread the domain weights

The biggest scoring mistake on AZ-900 is overstudying random Azure services and understudying the domains Microsoft weights more heavily. The exam blueprint shifts over time, but the broad pattern stays similar: the heavier areas are usually cloud concepts, Azure architecture and services, and Azure management/governance. Security, privacy, compliance, and pricing are always present, but they tend to be mixed into scenario wording rather than isolated as pure memorization.

If I were prioritizing from scratch, I would spend the most time here:

Core cloud concepts
- Public, private, hybrid cloud
- IaaS vs PaaS vs SaaS
- High availability, scalability, elasticity, reliability, predictability
- OpEx vs CapEx
Core Azure services
- Compute: VMs, containers, App Service, virtual desktop basics, functions
- Networking: VNets, subnets, VPN Gateway, ExpressRoute, DNS, load balancing basics
- Storage: Blob, Files, Disk, Archive/Cool/Hot access tiers, redundancy options
- Identity: Microsoft Entra ID, SSO, MFA, Conditional Access basics
Governance and management
- Azure Policy, resource locks, tags, management groups, subscriptions, resource groups
- Cost Management, Reservations, Azure Advisor, Service Health, Monitor
- Defender for Cloud, Blueprints legacy references if they appear in older material, though Policy is more important now

What I would not do is memorize every product page bullet for every service. AZ-900 is not testing whether you can architect a production platform. It is testing whether you can map a need to a category correctly. For example:

Need event-driven serverless code: think Azure Functions
Need host web apps without managing servers: think Azure App Service
Need managed container orchestration: think AKS
Need simple object storage for unstructured data: think Blob Storage

That sounds obvious, but Microsoft writes distractors that are all valid Azure services. Passing depends on recognizing the one that matches the scenario with the least extra infrastructure.

The service-confusion questions that show up again and again

Most AZ-900 misses happen because two Azure services sound close enough under time pressure. This exam is full of 'which service fits this business requirement' questions. You need clean separation lines in your head.

Here are the pairings and clusters I would drill until they feel automatic:

Virtual Machines vs App Service vs Azure Functions vs Containers
- VMs: full OS control, lift-and-shift, traditional workloads
- App Service: managed hosting for web apps/APIs without server management
- Functions: event-driven, short-running, serverless execution
- Containers / AKS: packaged apps, portability, orchestration needs
Blob Storage vs Azure Files vs Managed Disks
- Blob: object storage for images, backups, logs, data lakes, static content
- Azure Files: shared file shares over SMB/NFS
- Managed Disks: block storage for Azure VMs
VPN Gateway vs ExpressRoute
- VPN Gateway: encrypted connection over the public internet
- ExpressRoute: private dedicated connection, more predictable for enterprise connectivity
NSG vs Azure Firewall vs DDoS Protection
- NSG: traffic filtering at subnet/NIC level with allow/deny rules
- Azure Firewall: managed, centralized network security service with more advanced control
- DDoS Protection: protects against volumetric attacks, not a general packet-filter replacement
Load Balancer vs Application Gateway
- Load Balancer: Layer 4, TCP/UDP balancing
- Application Gateway: Layer 7, HTTP/HTTPS, web traffic features like WAF support
Microsoft Entra ID vs Azure subscription / resource permissions
- Entra ID handles identity and authentication
- RBAC handles authorization to Azure resources
- Microsoft likes questions where people confuse sign-in identity features with resource access control

A recurring AZ-900 trap is that the wrong answers are not absurd. Example: if a question asks for running code in response to an event with minimal infrastructure management, VMs, App Service, and Functions can all technically run code. But only Functions is the clean exam answer because it matches the event-driven serverless pattern.

Another trap is the phrase "without managing servers". That phrase usually points away from VMs and toward PaaS/serverless options like App Service or Functions. If the scenario also mentions full OS customization, then Microsoft is steering you back to VMs.

Storage and networking look basic on AZ-900, but this is where wording gets nasty

People underestimate storage and networking because AZ-900 only covers fundamentals. That is exactly why Microsoft makes the questions annoyingly subtle: the concepts are simple, but the service boundaries are easy to blur.

For storage, know the redundancy terms well enough to answer from one keyword:

LRS: copies within a single datacenter
ZRS: copies across availability zones in a region
GRS: replicates to a secondary geographic region
RA-GRS: like GRS, but read access to the secondary region

Typical trap: Microsoft asks for highest availability for reads during a regional outage. That is not just geo-replication; that points to RA-GRS because the secondary can be read.

Also learn the access tiers without overcomplicating them:

Hot for frequently accessed data
Cool for infrequently accessed data but still available quickly
Archive for rarely accessed data with retrieval delay/cost tradeoffs

The exam likes cost-focused questions where the right answer is not a discount feature but simply the correct storage tier.

On networking, the exam stays conceptual, but you still need precise distinctions:

A Virtual Network is the private network boundary in Azure.
A Subnet is a segmented range within a VNet.
Azure DNS handles domain hosting/resolution scenarios, but it is not the same thing as connectivity.
ExpressRoute is not just 'faster VPN'; it is private dedicated connectivity.
Availability Zones are about resiliency within a region; geographies/regions are broader placement concepts.

One wording trick Microsoft uses: asking whether a service provides secure connectivity, name resolution, or traffic distribution. Those are three different jobs. If you see a question about directing requests across servers, think load balancing. If it asks how on-premises users privately connect to Azure without traversing the public internet, think ExpressRoute. If it asks how a human-friendly name maps to an IP, that is DNS.

Do not let broad cloud intuition override the exam language. AZ-900 rewards textbook distinctions more than real-world 'well, you could build it this way too' reasoning.

Governance, compliance, and cost: the supposedly easy section that burns points

This is where a lot of candidates get sloppy because the products sound administrative rather than technical. In reality, Microsoft asks a ton of practical business questions here: enforce standards, organize resources, reduce spend, review recommendations, and prove compliance.

The big must-know separations are these:

Resource Groups group related resources for a solution.
Subscriptions are billing and access boundaries.
Management Groups organize multiple subscriptions for governance at scale.
Tags are metadata for organization and cost tracking, but they do not enforce compliance.
Resource Locks prevent accidental deletion or modification.
Azure Policy evaluates/enforces rules and compliance.
RBAC controls who can do what.

That list alone answers a surprising number of AZ-900 questions.

Common trap examples:

If the requirement is to ensure resources meet naming/location/SKU rules, the answer is usually Azure Policy, not tags.
If the requirement is to categorize costs by department, the answer is usually tags, not management groups.
If the requirement is to stop admins from accidentally deleting a critical resource, the answer is resource locks, not RBAC.
If the requirement is to assign permissions, the answer is RBAC, not Entra ID alone.

For cost management, know Microsoft’s favorite distinctions:

Reservations are for predictable long-term workloads and can reduce cost versus pay-as-you-go.
Azure Cost Management is for tracking, analyzing, and controlling spend.
Pricing calculator estimates future cost.
TCO calculator compares on-premises versus Azure cost scenarios.

Microsoft loves asking which tool you would use before migration versus after deployment. That is the key split:

Before migration planning: Pricing Calculator or TCO Calculator depending on the wording
After resources are running: Cost Management

Security/governance items also blur together unless you anchor the verbs:

Microsoft Defender for Cloud: security posture, recommendations, protection insights
Azure Advisor: optimization recommendations across cost, reliability, performance, operational excellence, security
Azure Service Health: information about Azure service incidents and advisories affecting you
Azure Monitor: telemetry, metrics, logs, alerting

If a question says 'get personalized best practice recommendations,' read carefully. If it sounds broad and optimization-focused, that is often Advisor. If it focuses on security posture and protection, that is Defender for Cloud. If it is about platform outages in your subscribed services/regions, that is Service Health.

Question patterns Microsoft uses on AZ-900

After enough practice, you start seeing the same patterns with different wording. AZ-900 is less about surprise and more about whether you can recognize the template fast.

Pattern 1: Business requirement to service mapping

Example structure: a company wants to host a web app, avoid server management, scale automatically, or run code on a schedule/event. The answer will be one of App Service, Functions, VMs, or containers. The deciding phrase is usually one feature:

'full control of the OS' → VMs
'host a web app/API' → App Service
'execute code when triggered' → Functions
'containerized workload orchestration' → AKS

Pattern 2: Shared responsibility / cloud model

Microsoft still asks this because candidates overthink it. If the question is about what the customer manages in IaaS, think more responsibility; in SaaS, much less. For PaaS, the platform is managed, but your app/data/config still matter.

Pattern 3: Resiliency wording

They will switch between high availability, fault tolerance, scalability, and elasticity. These are not synonyms.

Scalability: ability to handle growth by adding resources
Elasticity: automatic or dynamic scaling up/down as demand changes
High availability: service remains accessible despite failures

Pattern 4: True/false statement sets with one changed noun

These are dangerous because two statements may be correct and one wrong due to a tiny detail like region vs availability zone, or Policy vs RBAC. Slow down only enough to isolate the changed term.

Pattern 5: Compare two valid tools, choose the one with enforcement

This shows up constantly with:

Policy vs Tags
Advisor vs Defender for Cloud
Monitor vs Service Health
VPN Gateway vs ExpressRoute

If you practice only general Azure reading and not these direct comparisons, the exam feels harder than it should.

What I would do in the final week for AZ-900

The last week should not be broad reading. It should be a cleanup pass focused on the exact areas that produce the most avoidable misses.

My final-week checklist would look like this:

Build a one-page comparison sheet for these sets:
- VMs / App Service / Functions / AKS
- Blob / Files / Disks
- VPN Gateway / ExpressRoute
- NSG / Azure Firewall / DDoS Protection
- Policy / RBAC / Tags / Locks
- Advisor / Monitor / Service Health / Defender for Cloud
Rehearse cloud model responsibilities:
- What changes between IaaS, PaaS, and SaaS
- Which one minimizes infrastructure management
Memorize core hierarchy and organization:
- Management groups > subscriptions > resource groups > resources
Drill storage redundancy and access tiers until instant recall:
- LRS, ZRS, GRS, RA-GRS
- Hot, Cool, Archive
Review pricing tools and cost controls:
- Pricing Calculator vs TCO Calculator vs Cost Management vs Reservations
Review identity basics:
- Entra ID, MFA, SSO, Conditional Access, RBAC distinction

I would also spend time on Microsoft’s own phrasing. AZ-900 is a terminology exam more than a build exam. If your understanding is practical but imprecise, you can still miss questions. For example, many people know generally what governance means, but they cannot instantly say whether tags organize, Policy enforces, and locks protect from deletion. That hesitation is exactly what costs points.

One more blunt point: do not waste your last week memorizing niche service details that almost never decide an AZ-900 answer. Clean up the fundamentals and the service boundaries first. That is where the score is.

Microsoft exam interface quirks and how to use them to your advantage

The Microsoft exam interface is straightforward, but AZ-900 has a few habits worth planning for. Some items are fast, some are deceptively sticky. The interface itself is not the issue; the structure of the item sets is.

A few practical tips specific to how these questions behave:

On statement-based items, read the scenario once, then evaluate each statement independently. Microsoft often makes candidates carry over an assumption from statement one into statement two.
On matching/drag-and-drop items, identify the obvious anchors first. For example, if one option is clearly Azure Policy because the phrase says 'enforce', place that immediately and narrow the rest.
If you get a block of questions that all feel like governance vocabulary, stay in vocabulary mode. Do not over-engineer the answer with architect-level thinking.
If the exam presents a scenario screen and then multiple related prompts, make note of the exact constraints: minimize cost, reduce administrative effort, provide private connectivity, prevent deletion, ensure compliance. Those phrases usually map directly to one Azure feature.

On review, the best use of your remaining time is not to reopen every question. Revisit only the ones involving classic AZ-900 collisions:

App Service vs Functions
Policy vs RBAC vs Tags
Advisor vs Defender for Cloud
VPN Gateway vs ExpressRoute
Load Balancer vs Application Gateway
Storage redundancy choices

Those are the places where one word can flip the answer. That is much more productive than re-reading questions about basic cloud benefits that you already answered confidently.

If you have been using practice questions, do not just track your score. Track your confusion pairs. On AZ-900, most wrong answers come from the same handful of service mix-ups. Fix those, and the exam score usually moves quickly.