Microsoft Azure Fundamentals AZ-900 practice test

A company uses Azure and wants to organize all their virtual machines, databases, and storage accounts into logical containers for management and billing purposes. Which Azure component should they use to group these resources?

Trap 1: Azure Policy

Azure Policy is used to enforce compliance rules on resources, not to group them.

Trap 2: Management Group

Management groups are used to manage governance and access across multiple subscriptions, not to group resources within a subscription.

Trap 3: Azure Subscription

An Azure subscription provides billing and access boundaries, but it is not the container for individual resources; resource groups are inside subscriptions.

A
Azure Policy
Why wrong: Azure Policy is used to enforce compliance rules on resources, not to group them.
B
Resource Group
A resource group is a logical container for resources like VMs, databases, and storage accounts. It enables unified management and billing tracking.
C
Management Group
Why wrong: Management groups are used to manage governance and access across multiple subscriptions, not to group resources within a subscription.
D
Azure Subscription
Why wrong: An Azure subscription provides billing and access boundaries, but it is not the container for individual resources; resource groups are inside subscriptions.

Question 2mediummultiple choice

A company uses multiple Azure subscriptions for different departments. The finance team wants to monitor spending across all subscriptions and receive automated email alerts when a subscription's actual spending reaches 80% of its monthly budget. The team does not want to write custom scripts or use external tools. Which Azure feature should they use?

Trap 1: Azure Policy

Azure Policy is used to enforce compliance rules on resource configurations (e.g., allowed locations or SKUs), not to monitor spending or send budget alerts.

Trap 2: Azure Blueprints

Azure Blueprints enables the creation of repeatable, versioned environments including policies, role assignments, and resources. It does not provide cost monitoring or budget alerts.

Trap 3: Azure Resource Locks

Resource Locks prevent deletion or modification of critical resources. They do not track costs or generate spending alerts.

A
Azure Policy
Why wrong: Azure Policy is used to enforce compliance rules on resource configurations (e.g., allowed locations or SKUs), not to monitor spending or send budget alerts.
B
Azure Cost Management + Budgets
This is the correct service. It allows creation of budgets at the subscription or resource group scope, with alerts triggered when actual or forecasted costs exceed defined thresholds. Email notifications are built in.
C
Azure Blueprints
Why wrong: Azure Blueprints enables the creation of repeatable, versioned environments including policies, role assignments, and resources. It does not provide cost monitoring or budget alerts.
D
Azure Resource Locks
Why wrong: Resource Locks prevent deletion or modification of critical resources. They do not track costs or generate spending alerts.

Question 3easymultiple choice

A company wants to ensure that all Azure resources are tagged with a 'CostCenter' tag at creation time. If a resource is created without the tag, it should be automatically denied. Which Azure Policy effect should they use?

Trap 1: B) audit

Audit only logs non-compliant resources; it does not block their creation.

Trap 2: C) append

Append adds the missing tag but does not deny creation if the tag cannot be added.

Trap 3: D) deployIfNotExists

DeployIfNotExists deploys additional resources to correct non-compliance, but does not block the original resource creation.

A
A) deny
The deny effect prevents resources from being created if they do not comply with the policy condition.
B
B) audit
Why wrong: Audit only logs non-compliant resources; it does not block their creation.
C
C) append
Why wrong: Append adds the missing tag but does not deny creation if the tag cannot be added.
D
D) deployIfNotExists
Why wrong: DeployIfNotExists deploys additional resources to correct non-compliance, but does not block the original resource creation.

Question 4hardmultiple choice

A company uses Azure Blueprints to define a repeatable set of Azure resources and policies for new subscriptions. They want to ensure that when a new subscription is created, a specific role assignment is automatically applied. What should they include in the blueprint definition?

Trap 1: An Azure Policy assignment

Policy assignments enforce compliance rules, not RBAC role assignments.

Trap 2: An Azure Resource Manager template

ARM templates deploy resources, but role assignments in blueprints are better handled by the role assignment artifact.

Trap 3: A resource group

Resource groups are containers for resources, not artifacts that assign roles.

A
A role assignment artifact
Blueprint artifacts include role assignments that automatically grant permissions.
B
An Azure Policy assignment
Why wrong: Policy assignments enforce compliance rules, not RBAC role assignments.
C
An Azure Resource Manager template
Why wrong: ARM templates deploy resources, but role assignments in blueprints are better handled by the role assignment artifact.
D
A resource group
Why wrong: Resource groups are containers for resources, not artifacts that assign roles.

Question 5mediummultiple choice

A company uses Azure Policy to enforce governance. They want to prevent users from creating virtual machines of the Standard_DS3_v2 SKU in their subscription, and they also want to log any attempt to create such a VM (whether successful or not) for audit purposes. What is the minimum number of Azure Policy assignments required to meet both requirements?

Trap 1: One – assign a policy definition with the Deny effect.

A single Deny effect prevents creation but does not produce a separate compliance state for audit purposes; it only logs a denial event. The requirement explicitly asks for logging attempts for audit, which is more clearly satisfied by an Audit effect.

Trap 2: One – assign a policy definition with the Audit effect.

An Audit effect logs the attempt and shows compliance state, but it does not block the creation of the VM. The requirement also includes preventing the VM from being created.

Trap 3: Two – assign one policy definition with the Deny effect and another…

The Append effect adds tags or settings but does not log attempts for audit. Combining Deny with Append still does not address the logging/audit requirement.

A
One – assign a policy definition with the Deny effect.
Why wrong: A single Deny effect prevents creation but does not produce a separate compliance state for audit purposes; it only logs a denial event. The requirement explicitly asks for logging attempts for audit, which is more clearly satisfied by an Audit effect.
B
One – assign a policy definition with the Audit effect.
Why wrong: An Audit effect logs the attempt and shows compliance state, but it does not block the creation of the VM. The requirement also includes preventing the VM from being created.
C
Two – assign one policy definition with the Deny effect and another with the Audit effect.
Assigning two policies, one with Deny and one with Audit, simultaneously blocks forbidden VM SKU creation and provides a clear compliance view of all attempts (both successful and blocked) for auditing. This is the minimum configuration to satisfy both requirements.
D
Two – assign one policy definition with the Deny effect and another with the Append effect.
Why wrong: The Append effect adds tags or settings but does not log attempts for audit. Combining Deny with Append still does not address the logging/audit requirement.

Question 6mediummultiple choice

A company wants to ensure that all Azure resources are tagged with metadata such as 'Environment' and 'Department'. They have created an Azure Policy that appends the required tags and their values when a resource is created. However, they notice that some resources created before the policy assignment are missing tags. They want to automatically add those tags without manual effort. What should they do?

Trap 1: Create a remediation task for the policy

Remediation tasks are only available for policies with effects like DeployIfNotExists or Modify, not for policies with Append effect.

Trap 2: Use Azure Resource Graph to query and update

Azure Resource Graph can query resources but does not automatically update them; you would need additional scripting or tooling.

Trap 3: Create an Azure Automation runbook

An Automation runbook can be used to update tags, but it would require manual or scheduled execution and is not natively integrated with Azure Policy for automatic remediation.

A
Create a remediation task for the policy
Why wrong: Remediation tasks are only available for policies with effects like DeployIfNotExists or Modify, not for policies with Append effect.
B
Create a new policy with DeployIfNotExists effect
A policy with DeployIfNotExists effect can deploy a resource (like a script) to add tags to existing resources. After assignment, a remediation task can run to apply the fix.
C
Use Azure Resource Graph to query and update
Why wrong: Azure Resource Graph can query resources but does not automatically update them; you would need additional scripting or tooling.
D
Create an Azure Automation runbook
Why wrong: An Automation runbook can be used to update tags, but it would require manual or scheduled execution and is not natively integrated with Azure Policy for automatic remediation.