2.1 - Core architecture (regions, availability zones, resource groups)
AZ-900 objective 2.1 covers the core architectural components of Azure. A region is a geographical area holding one or more datacenters connected by a low-latency network, and most region pairs sit inside the same geography so replication stays under the same data-residency rules. A region that supports availability zones offers at least three physically separate datacenters, so a zone-redundant configuration keeps a workload running even if one datacenter loses power - and enabling zone redundancy on a service spreads replicas across zones without you picking one. Sovereign clouds like Azure Government are physically isolated instances for specific customers, and Azure China is run by a local operator. On the organizational side, a resource group holds the actual deployed resources and lets you manage and delete a project's resources together, while a separate subscription gives each business unit its own invoice and spending limits. Expect scenarios that describe a residency, resilience or billing boundary need and ask which Azure construct fits.
A zone-capable region has at least three availability zones; spread across zones to survive a datacenter power loss. Container for deployed resources you manage and delete together = resource group; separate invoice and spending limits = separate subscription.
Practice questions
1. Within a single Azure region, what does deploying VMs across availability zones protect against?
- The failure of an entire datacenter within the region (correct answer)
- The simultaneous failure of every region on a continent
- A misconfiguration made by an administrator on one of the VMs
- The accidental deletion of a resource group by an authorized user
Availability zones are physically separate datacenters within a region, each with independent power, cooling, and networking; spreading VMs across zones protects against the loss of an entire datacenter. They do not protect against continent-wide outages (use region pairs), nor against human errors like misconfiguration or deletion.
2. An administrator wants to group all resources of one project so they share the same lifecycle and can be deleted together. What should be used?
- A dedicated Azure subscription created only for that single project
- A resource group (correct answer)
- A management group placed above the current subscription
- An availability set spanning the project's virtual machines
A resource group is a logical container whose resources share a lifecycle: deleting the group deletes everything in it, which is ideal per project or per application. A subscription is a billing and quota boundary, management groups sit above subscriptions for governance, and availability sets concern VM placement, not lifecycle.
3. A company has dozens of subscriptions and wants to apply governance conditions, such as policies, to several subscriptions at once from a single level. What should it use?
- Resource groups shared between the different subscriptions
- Management groups (correct answer)
- Tags applied consistently to every subscription and resource
- An administrative unit created inside Microsoft Entra ID
Management groups sit above subscriptions: policies and RBAC assigned at a management group are inherited by all subscriptions underneath, giving one point of control. Resource groups cannot span subscriptions, tags label but do not enforce, and Entra administrative units organize identities, not subscriptions.
4. In Azure terminology, what BEST describes a region?
- A worldwide content delivery endpoint that caches static files close to end users
- A single physical building that hosts every Azure service offered to the customers of an entire continent
- A geographical area containing one or more datacenters connected through a low-latency network (correct answer)
- A logical container used to group virtual machines that share one lifecycle
A region is a geographical area containing at least one, and usually several, datacenters networked together within a low-latency perimeter. It is not a single building (a region spans multiple facilities), not a CDN edge location (that is a point of presence), and not a logical container (that role belongs to resource groups).
5. Why does Microsoft organize most Azure regions into region pairs?
- To guarantee that customer data of every deployed service is automatically and synchronously replicated between the two paired regions
- So planned maintenance reaches one region of the pair at a time and one region is prioritized for recovery after a broad outage (correct answer)
- To let customers receive one combined invoice covering the resources of both regions
- To double the default vCPU quota granted to every subscription
Region pairs exist for resilience: planned platform updates are rolled out to only one region of the pair at a time, and if a widespread outage hits, one region of each pair is prioritized for restoration. Pairing does not by itself replicate every service's data (only some services offer geo-replication), and it has no effect on invoices or quotas.
6. A German company must replicate workloads to a second region while keeping the data inside the same geography for residency reasons. Which Azure design supports this?
- Most region pairs are located within the same geography, so replication stays under the same residency rules (correct answer)
- Every Azure region automatically synchronizes all customer data to a sister region located on another continent for additional protection
- Availability zones extend across national borders so data always remains inside Europe
- Sovereign clouds automatically receive a copy of any data stored in public regions
With few exceptions, both regions of a pair sit inside the same geography (such as Europe or the United States), so geo-replicated data stays under the same data-residency and compliance boundary. Azure never force-copies data to another continent, availability zones stay within one region, and sovereign clouds are isolated, not automatic replicas.