Azure AZ-900 common mistakes
Azure AZ-900 · Understand the traps and how to avoid them.
When a question describes a company moving from buying servers up front to paying monthly for cloud usage, the candidate labels it 'CapEx' because the company still pays every month, or labels a fixed-fee reserved purchase as 'OpEx' because it happens in the cloud.
They memorised 'cloud = OpEx' as a slogan and never learned the actual distinction is upfront capital outlay versus ongoing operating expense recognised as consumed, so any recurring bill reading feels like OpEx regardless of commitment type.
What to do instead
Before answering, write two words on scratch paper: 'upfront = CapEx' and 'pay-as-you-go/consumption = OpEx'. Then decide by asking 'is money spent before the resource exists?' not 'is it cloud?'. Practice with 5 scenarios including reserved instances and hybrid owned hardware.
On responsibility questions the candidate assigns OS patching, runtime, or middleware to the customer in a PaaS scenario, or assigns physical datacenter security to the customer in an IaaS scenario.
They hold a single blurred mental model of 'shared responsibility' as a percentage split rather than a layer stack, so they default to either 'cloud provider does everything' or 'I still own everything'.
What to do instead
Draw the four-column layer stack (on-premises, IaaS, PaaS, SaaS) with rows for data/info, devices, accounts/identities, and then physical hosts, network, datacenter, OS, runtime, app, and mark 'Always customer' versus 'Always provider' at the top and bottom. Re-derive answers from that drawing rather than memory.
The candidate uses 'scalability', 'elasticity', 'high availability' and 'disaster recovery' interchangeably, so a scenario about adding VMs ahead of a known busy season gets answered as elasticity, and a scenario about surviving a region outage gets answered as high availability.
The terms are all described as 'handling more or less load' in casual reading, and the exam deliberately uses scenarios without the trigger words 'automatic' or 'region'.
What to do instead
Build a one-line discriminator for each: vertical scale = bigger SKU, horizontal scale = more instances, elasticity = automatic and demand-driven, HA = stays up within a region via zones/replicas, DR = recovers in another region after loss. Classify each practice scenario by the discriminator, not by the vocabulary in the stem.
The candidate treats availability zones, region pairs, and geographies as the same thing, answering that a zone-protected app survives a regional failure, or that a region pair guarantees data residency within one country.
All three appear in diagrams as nested boxes and all are described with the word 'isolated', so the candidate remembers that isolation exists but not the scope at which it operates.
What to do instead
Anchor on scale and purpose: a zone is a physically separate datacenter group within one region (protects against datacenter failure), a region pair is two regions in the same geography linked for replication and sequenced updates (protects against large-scale regional loss), a geography is a data-residency boundary containing multiple regions. For each practice question, first name which of the three scopes the scenario's failure is at.
The candidate mis-nests the resource hierarchy, for example saying resource groups contain subscriptions, or that a management group sits inside a subscription, or that a resource can belong to two resource groups at once.
The four levels are learned as a list rather than as a containment model, and resource groups are mentally filed as 'folders' that behave like tags.
What to do instead
Memorise the containment sentence in one direction only: management groups contain subscriptions, subscriptions contain resource groups, resource groups contain resources, and a resource lives in exactly one resource group but can be in only one subscription. Redraw the tree from memory before each practice set on governance.
The candidate answers storage redundancy questions by picking the option with the most replication (often GRS or RA-GRS) whenever high durability is mentioned, even when the requirement is read access during a regional outage or lowest cost within a single region.
The acronyms differ by two letters and all are described as 'replicated', so the candidate optimises on 'more copies sounds safer' instead of matching the option to the stated failure scenario and read requirement.
What to do instead
Make a four-row table with columns: copies, scope (single datacenter / multiple zones in one region / paired region), read access to secondary, and relative cost. Then map requirement keywords: 'datacenter failure only' to LRS, 'zone failure, same region' to ZRS, 'region failure' to GRS, 'read during region failure' to RA-GRS. Practise by classifying requirement sentences before looking at options.
The candidate answers identity questions as if Microsoft Entra ID were a hosted version of Active Directory Domain Services, expecting organisational unit group policy and Kerberos domain join behaviour from it, or conflates authentication with authorisation.
The product names share the word 'Active Directory', and both authentication and authorisation are described in questions as 'access control', so the candidate pattern-matches on the name and on the phrase rather than on the mechanism.
What to do instead
Keep a two-column contrast: Entra ID is cloud identity for users, apps, devices and uses HTTP-based protocols with no domain controller or OU structure; AD DS is a server-based directory with domains, OUs and Group Policy, run in a VM or via Entra Domain Services. For authorisation questions, check whether the question asks 'who are you' (authentication) or 'what may you do' (authorisation, RBAC).
The candidate treats Azure Policy, role-based access control, and resource locks as interchangeable 'guardrails', choosing a resource lock to enforce allowed locations, or choosing Azure Policy to stop a specific user from deleting a resource.
All three are described as controls that prevent bad things, and none of the exam stems uses the words 'enforce', 'permission' or 'delete protection' consistently enough to be a giveaway.
What to do instead
Assign one verb to each tool and answer by verb: Policy = enforce/audit rules on resource properties (allowed locations, required tags, allowed SKUs), RBAC = grant/deny who can perform which operations, Lock = block delete or block modification on an existing resource regardless of permissions. When reading a stem, underline the verb and match it to the tool.
The candidate confuses cost tooling, using the Total Cost of Ownership calculator to estimate the monthly price of a new VM configuration, or using Cost Management to compare on-premises versus cloud costs before migration.
All three live under 'cost' in the study material and each description mentions savings, so the candidate picks whichever name they saw most recently rather than reasoning from the tool's input and output.
What to do instead
Bind each tool to its output artefact: Pricing Calculator produces an estimate for a defined set of Azure resources, TCO Calculator compares existing on-premises cost against Azure over time, Cost Management plus budgets and alerts tracks and controls actual and forecast spend after deployment. Match the question's input (do they already have Azure resources?) and output (a forecast? a comparison? actuals?) to choose.
After a region or zone question, the candidate works out a composite SLA by averaging the component SLAs, or assumes adding a redundant component lowers availability.
Composite SLA arithmetic is not intuitive, and the candidate falls back on everyday averaging logic instead of the multiplication rule for components in series.
What to do instead
Learn the two rules explicitly: components in series multiply (0.999 x 0.999 lowers the number), and independent redundant paths improve availability. In practice questions, first state whether the components are chained (all must work) or redundant (one must work), then apply multiply versus improve, rather than averaging.