Chapter 1

Cloud Concepts

Microsoft Azure Fundamentals (AZ-900) Study GuideBased on the Microsoft AZ-900 exam objectives

The single most-tested domain on the AZ-900. Roughly a quarter to a third of your exam questions come from this chapter alone — and unlike later chapters, this material has almost no Azure-specific memorization. It's pure understanding. Master it here, and you walk into the exam with a head start.

What Is Cloud Computing, Really?

Ask ten people what "the cloud" is and you'll get ten vague answers. The exam, fortunately, is not vague at all. Microsoft's definition — and the one you need — is this: cloud computing is the delivery of computing services over the internet, on a pay-as-you-go basis. Those computing services include servers, storage, databases, networking, software, analytics, and AI. Instead of buying and owning physical hardware, you rent access to someone else's, and you pay only for what you use.

Here's the picture that makes it click. Imagine a startup with a great idea for a mobile app. In the old world — the pre-cloud world — launching meant buying servers, leasing space in a data center or building a server room, hiring someone to rack and cable the equipment, installing operating systems, configuring networks, buying database licenses, and setting up backups. Six weeks and tens of thousands of dollars before a single customer could use the product.

In the cloud world, that same startup opens an Azure account, clicks a few buttons, and has a database, a web server, and global file storage running before lunch — for a few dollars. If the app goes viral overnight, they don't scramble to buy more servers. They drag a slider, and the cloud provides more capacity automatically. If the app flops, they shut it all down and pay almost nothing. That difference — from heavy upfront investment to near-zero startup cost, from weeks of procurement to minutes of provisioning — is the heart of what cloud computing is.

The Five Pillars of the Cloud

The cloud rests on five characteristics that Microsoft tests constantly. Learn them as a set, because the exam loves to describe one and ask you to name it:

On-demand self-service. You provision resources yourself, whenever you need them, without human interaction from the provider. No calling Microsoft, no filing a ticket, no waiting for a sales rep. You click, and the resource exists. This is the opposite of the old model, where getting a new server meant submitting a request and waiting days or weeks.

Broad network access. Cloud services are available over the network — the internet — and accessible from anywhere, on any device. Your Azure virtual machine doesn't care whether you connect from a laptop in Toronto, a phone in Lagos, or a tablet in Berlin. The resources live in Microsoft's data centers, and the network is the delivery mechanism.

Resource pooling. The provider's computing resources are pooled to serve multiple customers using a multi-tenant model. Your workloads share physical hardware with other organizations' workloads — securely isolated, but drawing from the same vast pool. This is what makes the economics work: Microsoft buys servers at enormous scale, and thousands of customers share them, so each customer pays a fraction of the cost.

Rapid elasticity. You can scale resources up and out quickly — and, crucially, back down. Elasticity is not just "getting bigger." It's the ability to grow AND shrink in response to demand. A retailer that needs ten times the computing power on Black Friday and normal capacity the rest of the year doesn't pay for Black Friday capacity year-round. They scale up for the weekend and scale back down on Monday.

Measured service. Usage is metered, monitored, and reported. You pay for exactly what you consume — compute hours, gigabytes stored, data transferred — just like a utility bill. This is the consumption-based model, and it's the financial engine of the cloud. You get a bill showing exactly what you used, which means you can measure, optimize, and control costs.

Why Organizations Move to the Cloud

Companies don't migrate to the cloud because it's fashionable. They move because the cloud solves concrete business problems. The exam tests these benefits relentlessly, so understand each one as a story, not a vocabulary word.

Scalability and Elasticity

The exam treats these as the signature benefit of the cloud, and for good reason. Traditional infrastructure forced a painful choice: buy enough hardware for your peak load (and watch most of it sit idle 90% of the time) or buy for your average load (and crash during spikes). The cloud eliminates the dilemma. Need more? It's there in minutes. Need less? Release it and stop paying.

Think about a tax preparation company. For ten months a year they need modest computing power. During tax season they need fifty times that. In the on-premises world, they'd buy fifty times the servers and let them gather dust most of the year. In the cloud, they scale up in April and scale down in May. The savings aren't marginal — they're transformative.

Agility

Agility means the ability to deploy and configure resources quickly as business needs change. A product team that wants to test a new feature doesn't wait for the infrastructure team to provision servers — they spin up a test environment in minutes, run the experiment, and tear it down. Ideas become prototypes in hours instead of months. For the exam, agility is about speed of change: how fast can the organization respond to new requirements?

Geo-distribution

Microsoft operates Azure data centers — called regions — in more than 60 locations around the world, more than any other cloud provider. Geo-distribution means you can place your applications close to your users, wherever they are. A company with customers in Europe, Asia, and North America can deploy its application in regions on each continent. Users connect to the nearest deployment, which means lower latency — faster load times, snappier applications.

But geo-distribution isn't just about speed. It's also about data residency — the legal requirement in many countries that certain data stay within national borders. A German bank may be legally required to keep customer data in Germany. With Azure's Germany regions, that's a configuration choice, not a construction project.

Disaster Recovery

Disaster recovery (DR) is the plan for keeping a business running when something catastrophic happens — a fire, a flood, a ransomware attack, a regional power failure. In the on-premises world, real disaster recovery meant building or renting a second data center, keeping it synchronized, and hoping you'd never need it. Most small and mid-size companies simply couldn't afford it, so they gambled.

The cloud changes the math completely. With Azure, a company can replicate its data and applications to a region hundreds of miles away for a modest cost, and fail over automatically if the primary region goes down. A capability that once required a second building now requires a few checkboxes. The exam frames this as the cloud providing cost-effective disaster recovery — emphasize "cost-effective," because that's the contrast with the on-premises approach.

High Availability

Closely related to disaster recovery but distinct: high availability means your application stays running despite failures of individual components. If one server dies, another takes over. If one disk fails, the data is already mirrored. Azure builds this in through features like availability zones (separate physical locations within a region) and automatic failover. The exam distinction: disaster recovery is about surviving catastrophes (whole regions), high availability is about surviving component failures (a server, a disk, a rack) without downtime.

Fault Tolerance

Fault tolerance is high availability's stronger cousin. A fault-tolerant system doesn't just recover from failures — it continues operating through them with no interruption whatsoever. The classic example is data replication: your data exists in three places simultaneously, so the loss of any one copy is invisible to users. When the exam mentions "no single point of failure," it's describing fault tolerance.

CapEx vs OpEx: The Money Story

This is one of the most heavily tested topics in the entire chapter, and it's really a finance lesson disguised as a technology question. Understand it deeply.

Capital expenditure (CapEx) is spending money upfront on physical infrastructure — buying servers, building data centers, purchasing network equipment. It's a big one-time investment, and then you own the asset. The traditional on-premises model is CapEx-heavy: you pay a fortune before you serve a single customer, and the money is spent whether you use the equipment or not.

Operational expenditure (OpEx) is spending money on services as you consume them — the monthly Azure bill, the electricity for the office, the salaries. The cloud model is OpEx: you pay for what you use, when you use it, and you can stop paying when you stop using it.

Why does this matter so much to businesses? Three reasons the exam cares about:

1. No upfront costs. A startup doesn't need venture funding just to buy servers. This lowers the barrier to entry enormously.
2. Predictable budgeting. OpEx is a regular operating cost, like rent or utilities. Finance teams prefer predictable monthly bills to massive irregular capital outlays.
3. No wasted capacity. With CapEx, you buy for the peak and waste the rest. With OpEx and the consumption-based model, you pay for the peak only during the peak.

The Consumption-Based Model

The consumption-based model is the pricing philosophy of the cloud: you pay only for the resources you use, measured precisely. Leave a virtual machine running for 3 hours and 17 minutes? You're billed for 3 hours and 17 minutes of compute. Store 500 GB for half a month? Billed accordingly. Shut everything down on weekends? The meter stops.

This is fundamentally different from the old model, where the meter never stopped — you paid for the server whether it was busy or idle, because you owned it. The consumption-based model aligns cost with value: your infrastructure bill rises and falls with your actual business activity.

Cloud Models: Public, Private, and Hybrid

Not every organization wants the same kind of cloud. The three cloud deployment models — public, private, and hybrid — answer a simple question: whose infrastructure is it, and who can use it?

Public Cloud

The public cloud is cloud services offered over the public internet and available to anyone who wants to purchase them. Microsoft Azure, Amazon Web Services, and Google Cloud are public clouds. The provider owns and operates all the infrastructure; you rent slices of it on demand.

The defining trait of the public cloud is that resources are shared among many organizations (that's the multi-tenant model from earlier), which drives costs down through economies of scale. You get instant scalability, no hardware to maintain, and the consumption-based pricing model.

When to use it: Web applications, development and test environments, big data analytics, and any workload with variable demand. A startup launching a mobile app backend is the textbook case — they need to scale fast, spend little upfront, and reach users globally.

The trade-off, and the exam wants you to see this clearly: you give up some control. You don't choose the exact physical servers, you can't walk into the data center, and your data sits on shared infrastructure (though securely isolated). For most workloads this doesn't matter. For some — government systems, certain financial data, legacy applications with strict compliance rules — it does.

Private Cloud

A private cloud is cloud infrastructure used exclusively by a single organization. It delivers the cloud experience — self-service provisioning, scalability, resource pooling — but the resources aren't shared with anyone else. The organization can own and operate it in its own data center, or a third party can host it, but either way, it's dedicated to one tenant.

Why would anyone choose this? Control and compliance. A hospital handling patient records, a bank under strict financial regulation, or a government agency with classified data may need guarantees that go beyond what a shared environment can promise — dedicated hardware, physical isolation, custom security configurations. The private cloud gives them cloud-like agility without surrendering the keys.

The trade-off: you lose the economies of scale. Dedicated infrastructure costs more, and you (or your hosting provider) are responsible for maintaining it. You also can't scale as dramatically — there's a physical ceiling to what you own.

Hybrid Cloud

The hybrid cloud combines public and private clouds, bound together by technology that allows data and applications to be shared between them. It's not "we use some cloud and some on-premises servers" in a disconnected way — it's an integrated environment where workloads can move between the two.

Here's the scenario that makes hybrid click. A bank keeps its core transaction systems and customer databases in a private cloud (for regulatory compliance and control), but runs its customer-facing mobile app and its data analytics in the public cloud (for scalability and cost). During a marketing campaign that drives a surge of new account sign-ups, the bank "bursts" extra capacity into the public cloud to handle the spike — then scales back down. The sensitive data never leaves the private environment; the elastic workloads live in the public one.

Microsoft's hybrid story is particularly strong, and the exam knows it. Azure Arc extends Azure management to on-premises and multi-cloud resources. Azure Stack lets organizations run Azure services in their own data centers. For companies with existing investments in Windows Server and on-premises infrastructure, the path to the cloud runs through hybrid — and Microsoft built its tools for exactly that journey.

When to use it: Organizations with strict compliance needs for some workloads but a desire for cloud economics on the rest. Companies migrating gradually — moving applications to the cloud in phases rather than all at once. Businesses that need to keep certain data on-premises for legal reasons while using the cloud for everything else.

Comparing the Models

Cloud Service Types: IaaS, PaaS, and SaaS

If cloud models answer "whose infrastructure is it?", cloud service types answer a different question: how much do you want to manage yourself? This is the second pillar of the chapter, and the exam tests it as heavily as anything else.

Think of the classic analogy — and yes, the exam essentially expects you to know this mental model. Imagine you want pizza:

• On-premises is making pizza at home from scratch. You buy the ingredients, make the dough, fire the oven, do the dishes. Total control, total work.
• IaaS is ordering a pizza kit — the dough and toppings arrive prepared, but you assemble and bake it. Less work, still your kitchen.
• PaaS is ordering delivery — the restaurant makes it, you just eat. You don't manage the kitchen at all.
• SaaS is going to the restaurant — you don't even think about the kitchen. You consume the finished product.

Now translate that to computing.

IaaS: Infrastructure as a Service

IaaS provides virtualized computing resources over the internet — virtual machines, storage, networks, load balancers. You rent the fundamental building blocks and you manage everything above the virtualization layer: the operating system, middleware, runtime, applications, and data.

The Azure example is Azure Virtual Machines. You provision a VM, choose Windows or Linux, install your software, configure it exactly as you like. It's like renting an empty apartment — the building (physical infrastructure) is managed for you, but you furnish it, decorate it, and maintain everything inside.

When to use it: Migrating existing applications without redesigning them ("lift and shift"), running custom software that needs specific OS configurations, test and development environments, or any scenario where you need maximum control over the environment. A company moving its existing Windows-based application to Azure with minimal changes would choose IaaS.

What you manage with IaaS: the OS, applications, runtime, middleware, and data. What Microsoft manages: virtualization, servers, storage, networking hardware.

PaaS: Platform as a Service

PaaS provides a complete development and deployment environment in the cloud — you bring your code and data, and the platform handles everything underneath. No managing operating systems, no patching servers, no configuring web servers.

The Azure example is Azure App Service. A developer writes a web application, deploys the code to App Service, and Microsoft handles the servers, the OS, the runtime, scaling, and patching. It's like renting a furnished apartment — you bring your belongings (code and data), and everything else is taken care of.

When to use it: Building new applications quickly, especially web and mobile apps. Development teams that want to focus on code, not infrastructure. Scenarios requiring automatic scaling — App Service can scale out as traffic grows without the team touching a server. Analytics workloads, API development, and business process automation also fit naturally.

What you manage with PaaS: your applications and data. What Microsoft manages: everything else — runtime, middleware, OS, virtualization, servers, storage, networking.

SaaS: Software as a Service

SaaS delivers complete software applications over the internet, on demand. You don't manage anything — not the code, not the platform, not the infrastructure. You simply use the software, typically through a web browser.

The Microsoft examples are the ones you already know: Microsoft 365 (Word, Excel, Outlook, Teams in the browser), Dynamics 365 (CRM and ERP software). You sign in and work. Microsoft handles every layer beneath.

When to use it: Email and collaboration (Microsoft 365), customer relationship management (Dynamics 365), any scenario where you need software immediately with zero setup. The trade-off is customization — you get what the software offers, configured to your preferences but not rebuilt to your specifications.

What you manage with SaaS: essentially just your data and user settings. What Microsoft manages: everything else.

Comparing the Service Types

The exam's favorite way to test this is the responsibility question: given a service type, who manages what? Here's the framework:

Read it from top to bottom: with IaaS you manage the most, with SaaS you manage the least, and PaaS sits in the middle. As you move from IaaS toward SaaS, Microsoft takes on more responsibility and you take on less.

The Shared Responsibility Model

This is the concept the exam returns to again and again, across multiple domains. It's simple to state and easy to get wrong under pressure: security and management responsibilities are shared between Microsoft and the customer — and the split changes depending on the service type.

The core principle: Microsoft is always responsible for the physical infrastructure — the data centers, the physical servers, the network hardware, the physical security of the buildings. That's non-negotiable and never the customer's job in any cloud service. Beyond that physical layer, responsibility shifts based on how much of the stack you control.

Here's the critical insight the exam tests: the customer is always responsible for their data and for identity and access management, regardless of service type. Even in SaaS, where Microsoft manages everything else, you decide who can access your data, you classify your data, and you're accountable for it. This surprises people, and the exam exploits that surprise.

The Responsibility Split by Service Type

On-premises (for contrast): You manage everything — from the physical building to the data. Total control, total responsibility.

IaaS: Microsoft handles physical security, physical network, physical hosts, and virtualization. You handle everything from the operating system upward — OS patches, application security, network controls (firewalls, network security groups), identity management, and data protection. This is the model with the most customer responsibility in the cloud.

PaaS: Microsoft takes on the OS, middleware, and runtime in addition to the physical layer. You handle your applications, your data, identity management, and network controls around your application. Less to manage than IaaS, but your code and your data are still yours to secure.

SaaS: Microsoft manages nearly the entire stack. You handle your data, user identities and access, and endpoint devices (the laptops and phones your people use to access the software). That's it — but "that's it" still matters enormously. Most SaaS breaches happen because of misconfigured sharing settings or compromised user credentials, not because Microsoft's infrastructure failed.

Visualize it as a sliding line. On the far left (on-premises), the customer does everything. As you move right — IaaS, PaaS, SaaS — Microsoft's portion grows and the customer's shrinks. But the customer's portion never reaches zero. Data, identity, and access are always yours.

What's Always Microsoft's Job

No matter the service type, Microsoft is responsible for:

• Physical security of data centers (guards, biometrics, mantraps — you will never touch a server)
• Physical network infrastructure and hardware
• Physical hosts — the actual machines running the virtualization layer

What's Always Your Job

No matter the service type, you are responsible for:

• Your data — classification, protection, backup strategy, compliance
• Identity and access management — who can sign in, what they can touch, multi-factor authentication
• Endpoint protection — the devices your users access cloud services from

Putting It All Together

You've now covered the full "Describe cloud concepts" domain. Before the practice questions, here's how the pieces connect — because the exam tests connections, not isolated facts.

The consumption-based model (pay for what you use) is the financial foundation. CapEx vs OpEx is the business framing of that model. Elasticity is the technical capability that makes the financial model work — you can only pay for what you use if you can actually scale usage up and down.

Cloud models (public, private, hybrid) describe deployment — whose infrastructure, who uses it. Cloud service types (IaaS, PaaS, SaaS) describe management — who handles which layers. These are independent dimensions: you can run IaaS in a public cloud, or PaaS in a private cloud, or SaaS in a hybrid setup. The exam sometimes mixes them in one scenario, so keep the two axes separate in your mind.

The shared responsibility model ties to service types directly — it's the security lens on the same IaaS/PaaS/SaaS stack. When a question asks about responsibility, think service type first, then apply the split.

---

End-of-Chapter Test

1. A company wants to deploy a web application without managing the underlying servers, operating system, or runtime. Developers should focus only on writing code. Which cloud service type should they choose?

A. Infrastructure as a Service (IaaS) B. Platform as a Service (PaaS) C. Software as a Service (SaaS) D. On-premises virtualization

2. A financial institution is required by regulation to keep all customer data in its own data center, but it wants to use the public cloud for its marketing website and analytics workloads. Which cloud model best fits this requirement?

A. Public cloud B. Private cloud C. Hybrid cloud D. Multi-tenant cloud

3. Which of the following is ALWAYS the customer's responsibility, regardless of whether they use IaaS, PaaS, or SaaS?

A. Physical security of data centers B. Patching the hypervisor C. Managing identity and access to data D. Maintaining network hardware

4. A retail company experiences a massive spike in website traffic every holiday season but has low traffic the rest of the year. Which cloud benefit allows them to handle the spike without paying for extra capacity year-round?

A. Geo-distribution B. Elasticity C. High availability D. Fault tolerance

5. A startup wants to avoid large upfront investments in servers and networking equipment. Instead, they want to pay only for the computing resources they actually consume each month. This is an example of:

A. Capital expenditure (CapEx) B. Operational expenditure (OpEx) C. Fixed cost allocation D. Depreciation

6. An organization is running virtual machines in Azure. Who is responsible for installing operating system security patches on those virtual machines?

A. Microsoft, because Azure is a managed service B. The customer, because OS management is part of IaaS C. Microsoft, because patching is always the provider's job D. Neither — Azure virtual machines patch themselves

7. Which Azure service is an example of Platform as a Service (PaaS)?

A. Azure Virtual Machines B. Azure App Service C. Microsoft 365 D. Azure physical data centers

8. A company wants to ensure its application remains accessible even if an entire Azure region experiences a natural disaster. Which concept describes this planning?

A. High availability B. Scalability C. Disaster recovery D. Resource pooling

9. What is the defining characteristic of the consumption-based model?

A. Paying a fixed monthly fee regardless of usage B. Paying only for the resources you actually use, as measured C. Purchasing hardware upfront at a discount D. Sharing costs equally among all cloud customers

10. A development team needs complete control over the operating system to install custom drivers for specialized hardware testing. They want to run this environment in Azure. Which service type should they choose?

A. SaaS, because it requires the least management B. PaaS, because it supports custom code C. IaaS, because it provides OS-level control D. Hybrid cloud, because it combines all service types

---

Answer Key

1. B — PaaS (Azure App Service) lets developers deploy code without managing servers, the OS, or the runtime. IaaS would require OS management; SaaS provides finished software, not a platform for custom code.

2. C — Hybrid cloud. The requirement to keep some data on-premises while using the public cloud for other workloads is the textbook hybrid scenario. Public cloud alone can't satisfy the data residency rule; private cloud alone misses the cloud benefits for the other workloads.

3. C — Identity and access management (along with data protection) is always the customer's responsibility in every cloud service type. Physical security, the hypervisor, and network hardware are always Microsoft's.

4. B — Elasticity: automatically scaling resources up during the spike and back down afterward. High availability keeps things running during failures; elasticity handles demand changes.

5. B — OpEx. Paying for consumed resources over time with no upfront hardware investment is operational expenditure. CapEx is the large upfront purchase model they're trying to avoid.

6. B — The customer. Azure Virtual Machines are IaaS, and in IaaS the customer manages everything from the operating system upward, including OS patches. Microsoft manages the physical layer and virtualization only.

7. B — Azure App Service is PaaS: you deploy code, Microsoft manages the platform beneath. Azure Virtual Machines are IaaS; Microsoft 365 is SaaS.

8. C — Disaster recovery: planning for continued operations after a catastrophic event like a regional natural disaster. High availability covers individual component failures, not whole-region loss.

9. B — The consumption-based model means metered, pay-for-what-you-use billing. Fixed fees and upfront purchases are the opposite of this model.

10. C — IaaS. Complete OS control, including custom driver installation, requires Infrastructure as a Service (Azure Virtual Machines). PaaS abstracts the OS away; SaaS provides only finished applications.