Azure Fundamentals (AZ-900) Exam Cheat Sheet — 2026

> One-page quick reference for exam day | citadelcloudmanagement.com

---

Exam Overview

• Code: AZ-900 | Questions: 40-60 | Time: 65 minutes | Passing: 700/1000
• Cost: $99 USD

---

Domain 1: Cloud Concepts (25-30%)

• IaaS (VMs): most control, most responsibility
• PaaS (App Service): you manage app + data only
• SaaS (Microsoft 365): vendor manages everything
• Public (Azure), Private (on-prem), Hybrid (Azure Arc/VPN)
• CapEx to OpEx shift; scalability; elasticity; high availability via SLAs

Shared Responsibility: Microsoft manages physical infra. Customer manages data, accounts, access. Shared: identity, apps, network controls.

Domain 2: Architecture & Services (35-40%)

Infrastructure: 60+ regions, 3+ AZs per region, region pairs for DR, sovereign clouds (Gov, China)

Compute: VMs (IaaS), App Service (PaaS), Functions (serverless), ACI (containers), AKS (Kubernetes), Virtual Desktop

Networking: VNet, Subnets, NSGs, VPN Gateway (encrypted over internet), ExpressRoute (private dedicated), Load Balancer (L4), App Gateway (L7+WAF), Front Door (global CDN+WAF)

Storage: Blob (objects), Azure Files (SMB/NFS shares), Queue (messaging), Table (NoSQL). Redundancy: LRS, ZRS, GRS, GZRS

Database: Azure SQL (managed), Cosmos DB (global NoSQL), MySQL/PostgreSQL managed

Identity: Microsoft Entra ID (cloud identity), MFA, Conditional Access, RBAC

Domain 3: Management & Governance (30-35%)

Cost: Pricing Calculator, TCO Calculator, Cost Management. Save with Reserved Instances, Spot VMs, Hybrid Benefit.

Governance: Azure Policy (enforce standards), Blueprints (repeatable envs), Resource Locks (prevent deletion), Tags (organize costs)

Hierarchy: Management Groups > Subscriptions > Resource Groups > Resources

Monitoring: Azure Monitor, Advisor, Service Health

Tools: Portal, CLI, PowerShell, Cloud Shell, Azure Arc

Exam Tips

1. Know Shared Responsibility at IaaS/PaaS/SaaS levels
2. "Reduce costs" = Reserved Instances, Hybrid Benefit, Spot VMs
3. ExpressRoute = private; VPN Gateway = over internet
4. Microsoft Entra ID is the current name (not "Azure AD")
5. Azure Policy = enforcement; Resource Locks = protection

---

*Full study guide at citadelcloudmanagement.com/pages/free-courses*