Azure Architecture & Services is the largest slice of the AZ-900, in the 35–40% range of the exam. It is also the most name-heavy: the domain rarely asks you to design anything, it asks whether you can point at a scenario and name the right Azure service. Get comfortable sorting services by category and this becomes the most scriptable part of the exam. The diagram above is that sort, done once — four service categories over the region backbone they all run on.
Learn the four categories, then the services inside them
Almost every service question lands in one of four buckets: compute, storage, networking, identity. Fix the buckets first and each question tells you which shelf to reach for.
Compute — how your code runs. Three names cover most of it. Azure Virtual Machines is a full server you control from the operating system up — the answer whenever a scenario says “full control” or “run it unchanged.” Azure App Service is a managed home for web apps and APIs: you deploy code, Microsoft runs the platform. Azure Functions is event-driven and serverless — small code that fires on a trigger with nothing to manage. Full control, managed web app, event-driven snippet: three services, three tells.
Storage — how your data sits. Blob Storage is the object store for unstructured media, backups and anything reached over HTTP. Azure Files is a managed file share you mount like a network drive. Managed disks are the block storage attached to a virtual machine. Objects, file share, VM disk — pick by shape of the data.
Networking — how resources reach each other. A Virtual Network (VNet), carved into subnets, is the private network your resources live in. A Network Security Group (NSG) is the basic traffic filter: allow or deny by port, protocol and IP. That pair — private network plus basic filter — answers most beginner networking questions.
Identity — who gets in. Microsoft Entra ID (formerly Azure Active Directory) is the one to know: it signs users in and controls access to apps and resources. Any “who can access this” question resolves here.
Two one-liners the exam likes to test
A couple of “which one, not what is it” comparisons show up often enough to learn cold:
- Load balancer vs Application Gateway. A load balancer distributes network traffic at the transport layer (Layer 4). Application Gateway is a web load balancer that works at the HTTP layer (Layer 7), so it can route by URL path and add a web application firewall. Plain traffic spreading = load balancer; smart web routing = Application Gateway.
- Azure Resource Manager (ARM). Every deployment request — portal, CLI, PowerShell, or a JSON template — goes through ARM, the single management layer that creates, updates and deletes your resources. ARM templates are written in JSON. Remember: ARM is the front door, JSON is the template language.
The backbone under everything: regions and zones
Every service in the diagram is deployed into a region, and the strongest regions are built from Availability Zones — physically separate datacenters, each with its own power and network, so a single datacenter fault does not take your app down. A region pair is a different idea: two regions linked for disaster recovery. Separate datacenters in one region = zones; two regions for recovery = a pair. That distinction alone answers a surprising number of questions.
Work the seven questions below one at a time, and read each “Why not the others” past the correct answer — on exam day the three wrong options will not announce themselves, and the linked compute and storage summaries take the two busiest categories a level deeper.
Updated for AZ-900 (July 2026). The sample questions above are our own work
in the style of the exam — not real exam items. The exam itself is set and marked
by the certification body.