A public cloud is a cloud deployment model in which a cloud provider owns and operates the infrastructure and delivers computing resources over the public internet to multiple tenants.

A private cloud is a cloud deployment model in which cloud resources are used exclusively by a single organization, either hosted on-premises or by a third-party provider.

What is Azure portal?

A web-based, graphical user interface for creating, managing, and monitoring Azure resources.

Final Review and Exam Tactics for AZ-900 Success — Microsoft Azure Fundamentals (AZ-900) Deep-Dive Exam Prep

Q: A company wants to automatically enforce that all new storage accounts have secure transfer enabled and are created only in specific regions. Which Azure feature should they use?

Azure Policy. This is about enforcing configuration rules and keeping resources compliant with corporate standards. That is exactly what Azure Policy does: "Azure Policy is a service in Azure that you use to create, assign, and manage policies that enforce rules and effects over your resources, so those resources stay compliant with your corporate standards and service level agreements." RBAC controls permissions, Entra ID manages identities, and NSGs filter network traffic.

Big Picture: What AZ-900 Really Tests

Why This Final Module Matters

You already learned the content. This module focuses on locking in key concepts and sharpening how you take AZ-900, not just what you know.

Exam Domains Snapshot

AZ-900 is organized into three domains: Cloud Concepts: 28%, Azure Architecture and Services: 38%, Azure Management and Governance: 34%.

Your Pre-flight Checklist

Your goals now: refresh canonical definitions, reconnect governance tools to scenarios, and practice a repeatable method for reading and answering questions.

Using Skarp Effectively

As you notice weak spots, remember: upcoming Skarp mock exams, spaced review, and gap guides will target exactly those domains for you.

Core Cloud Concepts and Deployment Models

Cloud Computing Definition

cloud computing: "Cloud computing is the delivery of computing services over the internet, enabling faster innovation, flexible resources, and economies of scale."

Deployment Models: Canonical List

Cloud deployment models (know all three): public cloud, private cloud, hybrid cloud. AZ-900 loves to test these via scenarios.

Public vs Private Cloud

public cloud: shared provider-owned infrastructure over the internet.

private cloud: used exclusively by one organization, on-prem or third-party hosted.

Hybrid Cloud in Practice

hybrid cloud: public + private with data and apps that can move or be shared between them, e.g., on-prem database with Azure VMs for burst compute.

Common Exam Traps

Trap: thinking public cloud means weak security, or private cloud must be on-prem. Focus on who shares the infrastructure and how environments connect.

Cloud Service Models: IaaS, PaaS, SaaS

Service Models: Canonical List

Cloud service models (all three): Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS).

IaaS Definition and Examples

IaaS: provides virtualized servers, storage, networking on demand. Example: Azure Virtual Machines plus virtual networks and disks.

PaaS Definition and Examples

PaaS: full dev and deployment environment (infra + middleware + tools). Examples: Azure App Service, Azure Functions, Azure SQL Database.

SaaS Definition and Examples

SaaS: complete applications delivered over the internet on subscription. Examples: Microsoft 365, Dynamics 365, many business SaaS apps.

How Exams Hide the Labels

Questions often describe who manages OS, runtime, and app. If you manage almost everything: IaaS. If you just use the app: SaaS. In between: PaaS.

Identity, Access, and Governance: Entra ID, RBAC, Azure Policy

Microsoft Entra ID

Microsoft Entra ID manages identities and sign-in to resources like Microsoft 365, the Azure portal, and thousands of SaaS apps.

RBAC in One Sentence

RBAC: fine-grained authorization over Azure resources, based on roles assigned to users, groups, and service principals.

Azure Policy in One Sentence

Azure Policy: define and enforce rules so resources stay compliant with corporate standards and SLAs (for example, allowed regions).

Who vs What vs How Configured

Think: Entra ID = who can sign in; RBAC = what actions on which resources; Azure Policy = how those resources must be configured.

Scenario Mapping Practice

If the question is about permissions, think RBAC. If about config rules, think Azure Policy. If about sign-in and SSO, think Entra ID.

Azure Architecture and Management Tools: What Goes Where

Core Architecture: Canonical List

Azure core architectural components: Azure regions, region pairs, Availability Zones, Azure datacenters, Azure resources, resource groups, subscriptions.

Physical to Logical Layers

Physical: datacenters → regions → region pairs → Availability Zones. Logical: resources grouped into resource groups, under subscriptions.

Management Tools: Canonical List

Azure management tools: Azure portal, Azure PowerShell, Azure Command-Line Interface (CLI), Azure Resource Manager templates.

Picking the Right Tool

Portal = browser GUI, PowerShell = automation for Windows admins, CLI = cross-platform scripts, ARM templates = JSON infrastructure as code.

Exam Tip

If the question mentions "repeatable deployments" or "infrastructure as code", think Azure Resource Manager templates first.

The Shared Responsibility Model and Security Questions

Shared Responsibility Model

"The shared responsibility model is a framework that defines how security and compliance responsibilities are divided between the cloud provider and the customer."

Of the Cloud vs In the Cloud

Microsoft: security of the cloud (datacenters, hosts). Customer: security in the cloud (data, identities, configs), with details varying by IaaS/PaaS/SaaS.

Responsibility Examples

Patching guest OS on a VM? Customer. Physical security of datacenters? Microsoft. Enabling MFA for users? Customer via Microsoft Entra ID.

Spotting Bad Answers

Beware options claiming Microsoft handles all security, or that customers secure physical Azure buildings. Those conflict with the shared model.

Thought Exercise: Map the Scenario to the Concept

Work through these short scenarios. For each, decide which core concept is being tested. Just think or jot your answers before revealing explanations in your mind.

Scenario A

A hospital wants to keep patient records in its on-premises datacenter but use Azure to run analytics workloads on anonymized data during peak hours.
Question: Which deployment model best fits this description?
Hint: Data and workloads move between on-prem and Azure.

Scenario B

A startup uses Microsoft 365 for email and collaboration. They do not manage any servers or application updates for these tools.
Question: Which cloud service model is Microsoft 365 using?
Hint: They just consume the app.

Scenario C

A company wants to ensure that no one can create Azure resources in regions outside the EU, to support GDPR-related data residency requirements.
Question: Which governance service enforces this rule automatically?
Hint: Think about enforcing configuration rules.

Scenario D

A team lead wants to allow a developer to manage a specific resource group but not see or change resources in any other resource groups.
Question: Which access mechanism would you use to grant this limited access?
Hint: Think roles on scopes.

As a self-check, map your answers to:

Deployment model: public cloud, private cloud, or hybrid cloud.
Service model: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS).
Governance/identity: Microsoft Entra ID, RBAC, or Azure Policy.

Quiz 1: Concepts and Definitions

Test your recall of canonical definitions and basic mappings.

Which statement best describes a hybrid cloud, according to the canonical definition?

A hybrid cloud is a cloud deployment model in which a cloud provider owns and operates the infrastructure and delivers computing resources over the public internet to multiple tenants.
A hybrid cloud is a computing environment that combines public and private clouds, allowing data and applications to be shared between them.
A hybrid cloud is a cloud deployment model in which cloud resources are used exclusively by a single organization, either hosted on-premises or by a third-party provider.
A hybrid cloud is a cloud service model that delivers software applications over the internet on a subscription basis.

Show Answer

Answer: B) A hybrid cloud is a computing environment that combines public and private clouds, allowing data and applications to be shared between them.

The canonical definition is: "A hybrid cloud is a computing environment that combines public and private clouds, allowing data and applications to be shared between them." Option 1 is the definition of a public cloud, option 3 is a private cloud, and option 4 is describing SaaS, which is a service model, not a deployment model.

Quiz 2: Scenario-to-Service Mapping

Apply your understanding to exam-style scenarios.

A company wants to automatically enforce that all new storage accounts have secure transfer enabled and are created only in specific regions. Which Azure feature should they use?

Microsoft Entra ID
Network Security Groups
Azure Policy
Role-based access control (RBAC)

Show Answer

Answer: C) Azure Policy

This is about enforcing configuration rules and keeping resources compliant with corporate standards. That is exactly what Azure Policy does: "Azure Policy is a service in Azure that you use to create, assign, and manage policies that enforce rules and effects over your resources, so those resources stay compliant with your corporate standards and service level agreements." RBAC controls permissions, Entra ID manages identities, and NSGs filter network traffic.

Question Dissection and Elimination Strategy

Start With the Question Stem

Read the last sentence first to know exactly what is being asked (cost, security, performance, governance) before diving into the scenario text.

Find the Constraint

Mentally highlight words like "minimize cost" or "must enforce compliance". These constraints often eliminate one or two options immediately.

Classify the Topic

Ask: is this about deployment model, service model, identity/governance, architecture, or costs/SLAs? Classification shrinks the option space.

Structured Elimination

First drop obviously wrong answers; then remove those that ignore key constraints. You should usually get to two plausible options.

Prefer Native Azure Services

When in doubt, choose the answer that uses an Azure service built exactly for that need (e.g., Azure Policy for compliance, RBAC for permissions).

Time Management, Flagging, and Guessing Smart

First Pass Strategy

Answer the easy 70–80% first. If a question is still fuzzy after ~45–60 seconds, flag it and move on to protect your time and confidence.

When to Flag

Flag if you are stuck between 2 options or missing a key fact. Do not flag every slightly uncertain item; some uncertainty is normal.

Second Pass Focus

On your second pass, work only on flagged questions. Re-apply your structured reading and elimination tactics with the remaining time.

Smart Guessing

Never leave blanks. Eliminate what you can, then pick the option that best matches Azure best practices: managed, secure, and cost-aware.

Practice Under Exam Conditions

Use Skarp mock exams as rehearsals: do a full timed run, use flags, then review which questions you flagged and why afterward.

Rapid-Fire Flashcards: Canonical Terms

Use these flashcards to solidify the key definitions you must recall instantly on exam day.

cloud computing: Cloud computing is the delivery of computing services over the internet, enabling faster innovation, flexible resources, and economies of scale.
public cloud: A public cloud is a cloud deployment model in which a cloud provider owns and operates the infrastructure and delivers computing resources over the public internet to multiple tenants.
private cloud: A private cloud is a cloud deployment model in which cloud resources are used exclusively by a single organization, either hosted on-premises or by a third-party provider.
hybrid cloud: A hybrid cloud is a computing environment that combines public and private clouds, allowing data and applications to be shared between them.
Infrastructure as a Service (IaaS): Infrastructure as a Service (IaaS) is a cloud service model that provides virtualized computing resources such as servers, storage, and networking on demand.
Platform as a Service (PaaS): Platform as a Service (PaaS) is a cloud service model that provides a complete development and deployment environment in the cloud, including infrastructure, middleware, and development tools.
Software as a Service (SaaS): Software as a Service (SaaS) is a cloud service model that delivers software applications over the internet on a subscription basis.
Microsoft Entra ID: Microsoft Entra ID is Microsoft’s cloud-based identity and access management service that helps employees sign in and access resources such as Microsoft 365, the Azure portal, and thousands of other SaaS applications.
role-based access control (RBAC): Role-based access control (RBAC) is an authorization system built on Azure Resource Manager that provides fine-grained access management of Azure resources based on roles assigned to users, groups, and service principals.
Azure Policy: Azure Policy is a service in Azure that you use to create, assign, and manage policies that enforce rules and effects over your resources, so those resources stay compliant with your corporate standards and service level agreements.
shared responsibility model: The shared responsibility model is a framework that defines how security and compliance responsibilities are divided between the cloud provider and the customer.

After AZ-900: Next Steps and Learning Paths

Review Your Strengths

After AZ-900, ask which domain felt strongest: Cloud Concepts, Architecture and Services, or Management and Governance. That hints at your best next path.

Role-based Next Steps

Infra-focused? Think AZ-104. App-focused? Think AZ-204. Data-focused? DP-900 pairs well with what you know now.

Use Skarp Signals

Let Skarp diagnostics, mock exams, and gap guides show where you naturally excel and where deeper study will give you the biggest payoff.

Staying Current

Azure changes fast. As of 2026, identity, security, and governance tools keep evolving. Use the Azure portal to notice new options and updated features.

Focus for Now

For the moment, focus on executing your AZ-900 plan. After your next mock exam, use the gap guide to choose an admin, dev, data, or security path.

Key Terms

Azure Policy: Azure Policy is a service in Azure that you use to create, assign, and manage policies that enforce rules and effects over your resources, so those resources stay compliant with your corporate standards and service level agreements.
Azure portal: A web-based, graphical user interface for creating, managing, and monitoring Azure resources.
hybrid cloud: A hybrid cloud is a computing environment that combines public and private clouds, allowing data and applications to be shared between them.
public cloud: A public cloud is a cloud deployment model in which a cloud provider owns and operates the infrastructure and delivers computing resources over the public internet to multiple tenants.
region pairs: Linked Azure regions within the same geography used for replication and disaster recovery to increase resiliency.
Azure regions: Geographic areas that contain one or more Azure datacenters, where you deploy and run Azure resources.
private cloud: A private cloud is a cloud deployment model in which cloud resources are used exclusively by a single organization, either hosted on-premises or by a third-party provider.
subscriptions: Units of management, billing, and scale in Azure that group resource groups and resources under a common account.
Azure resources: Manageable items available through Azure, such as virtual machines, storage accounts, web apps, and databases.
cloud computing: Cloud computing is the delivery of computing services over the internet, enabling faster innovation, flexible resources, and economies of scale.
resource groups: Logical containers that hold related Azure resources, enabling unified management of lifecycle, permissions, and policies.
Azure PowerShell: A set of PowerShell cmdlets for automating the creation, configuration, and management of Azure resources.
Azure datacenters: Physical facilities that house the servers and infrastructure that run Azure services.
Availability Zones: Physically separate locations within an Azure region, each with independent power, cooling, and networking, used to run highly available applications.
Microsoft Entra ID: Microsoft Entra ID is Microsoft’s cloud-based identity and access management service that helps employees sign in and access resources such as Microsoft 365, the Azure portal, and thousands of other SaaS applications.
shared responsibility model: The shared responsibility model is a framework that defines how security and compliance responsibilities are divided between the cloud provider and the customer.
Platform as a Service (PaaS): Platform as a Service (PaaS) is a cloud service model that provides a complete development and deployment environment in the cloud, including infrastructure, middleware, and development tools.
Software as a Service (SaaS): Software as a Service (SaaS) is a cloud service model that delivers software applications over the internet on a subscription basis.
Azure Resource Manager templates: JSON-based templates used to define and deploy Azure infrastructure as code in a consistent, repeatable way.
role-based access control (RBAC): Role-based access control (RBAC) is an authorization system built on Azure Resource Manager that provides fine-grained access management of Azure resources based on roles assigned to users, groups, and service principals.
Azure Command-Line Interface (CLI): A cross-platform command-line tool for managing Azure resources from Windows, macOS, and Linux.
Infrastructure as a Service (IaaS): Infrastructure as a Service (IaaS) is a cloud service model that provides virtualized computing resources such as servers, storage, and networking on demand.