AZ-900 Describe Azure management and governance — 100 Questions

Question 1

A company uses Azure Resource Manager templates to deploy and manage infrastructure. They need to ensure that resources are deployed in a consistent, repeatable manner across environments. Which two benefits does using ARM templates provide? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Declarative syntax ensures that deployments are idempotent and repeatable.. ARM templates use declarative syntax, meaning you define the desired state of your infrastructure rather than scripting the steps to achieve it. This makes deployments idempotent: running the same template multiple times produces the same result, ensuring consistency across environments without side effects. Additionally, ARM templates are JSON files that can be versioned and stored in source control, enabling Infrastructure as Code with change tracking and peer review alongside application code.

Answer

Templates automatically scale resources based on demand.

Answer

Templates are limited to a specific Azure region.

Question 2

A company has multiple Azure subscriptions. The IT team wants to apply common policies and role assignments across all subscriptions automatically when a new subscription is created. Which Azure service should they use?

Accepted Answer

D) Azure Management Groups. Azure Management Groups is the correct service because policies and role assignments applied at the management group scope are inherited by all subscriptions within that group. When a new subscription is created and placed in the management group, it automatically inherits these assignments, ensuring consistent governance without additional orchestration. Azure Blueprints can also deploy policies and role assignments, but it is primarily used for orchestrating a full environment of resources and artifacts, and it is not the standard mechanism for continuous inheritance across all subscriptions.

Answer

A) Azure Policy

Answer

B) Azure Blueprints

Answer

C) Azure Resource Manager

Question 3

A company wants to ensure that all resources in their Azure environment are created with mandatory tags for cost tracking. They have already assigned a policy to append tags, but existing resources are still missing tags. They want to automatically add the tags to existing resources without manual intervention. What should they do?

Accepted Answer

Create a remediation task for the policy.. None of the provided options correctly solve the problem. The 'append' effect does not support remediation tasks; remediation tasks are only available for 'deployIfNotExists' and 'modify' effects. To automatically add tags to existing resources, the policy effect must be changed to 'modify', and then a remediation task can be created. This option is not listed.

Answer

Modify the policy effect to 'deny' instead of 'append'.

Answer

Use Azure Resource Graph to identify and manually tag.

Answer

Reassign the policy with a new scope.

Question 4

A company wants to ensure a specific resource group cannot be deleted, but they also need to be able to delete it temporarily during maintenance windows. Which approach allows the most granular control?

Accepted Answer

Apply a 'CanNotDelete' resource lock and remove it before maintenance.. A 'CanNotDelete' resource lock prevents deletion of a resource group and its resources, but it can be removed and reapplied as needed, providing granular control during maintenance windows. This approach allows temporary deletion by removing the lock, performing the deletion, and then reapplying the lock afterward. It is the only option that directly supports the requirement for both protection and temporary removal without permanent configuration changes.

Answer

Assign an Azure Policy with deny effect on delete operations.

Answer

Use Azure RBAC with a custom role that denies delete.

Answer

Use Azure Blueprints to enforce protection.

Question 5

A company has a resource group named 'RG-Prod' that contains critical virtual machines, a SQL database, and a storage account. The infrastructure team needs to ensure that no one can accidentally delete this resource group or any of its resources. However, users must still be able to create, update, and delete individual resources within the group as needed for normal operations. Which type of Azure Resource Lock should the team apply to 'RG-Prod'?

Accepted Answer

CanNotDelete. To allow creation, update, and deletion of individual resources while protecting the resource group itself, you should not apply a resource lock at the resource group level. Instead, apply CanNotDelete locks to each critical resource individually, or use role-based access control (RBAC) to restrict deletion of the resource group. Since none of the provided options describes this correct approach, no option is valid as stated.

Answer

ReadOnly

Answer

DoNotDelete

Answer

ModifyOnly

Question 6

A company has an Azure Policy assigned at the root management group that denies the creation of resources without a 'Department' tag. The IT team needs to deploy a temporary set of resources in a specific resource group under a child management group. These resources will not have the required tag. The team must not alter the original policy definition or the policy assignment. What should the team create to allow this deployment?

Accepted Answer

Create a policy exemption on the resource group.. A policy exemption allows the IT team to bypass the 'Department' tag denial policy for a specific scope (the resource group) without modifying the original policy definition or assignment. Exemptions are designed for temporary or special circumstances where compliance is not required, such as deploying resources that lack the required tag. This aligns with the requirement to not alter the original policy, as exemptions are additive and scoped to the resource group.

Answer

Create a policy exclusion on the resource group.

Answer

Modify the policy assignment to include a compliance exception.

Answer

Create a resource lock on the resource group.

Question 7

A large enterprise has multiple Azure subscriptions for different business units. The governance team wants to apply a set of Azure Policy initiatives, such as allowed locations and required tags, to all subscriptions in the organization. They also want to set up role-based access control for the compliance team at the root level so that they can monitor compliance across all subscriptions. Which Azure feature should they use to achieve this?

Accepted Answer

Azure management groups. Azure management groups provide a hierarchical structure above subscriptions, enabling you to apply Azure Policy initiatives and role-based access control (RBAC) at the root management group level. This ensures that policies like allowed locations and required tags are inherited by all subscriptions within the organization, and the compliance team can monitor compliance across the entire hierarchy without needing to configure each subscription individually.

Answer

Azure Resource Manager (ARM) templates

Answer

Azure resource groups

Answer

Azure Blueprints

Question 8

A company runs a development subscription in Azure. The finance team wants to set a monthly spending limit of $5,000 for this subscription and receive email alerts when spending reaches 80% and 100% of that limit. The team must also be able to review historical spending trends. Which Azure tool should the finance team use to configure these alerts and track spending?

Accepted Answer

Azure Budgets. Azure Budgets is the correct tool because it allows you to set a spending limit (budget) at the subscription level, configure alerts at specific thresholds (e.g., 80% and 100%), and send email notifications when those thresholds are exceeded. Additionally, Azure Budgets is part of Azure Cost Management, which provides cost analysis and historical spending trends, enabling the finance team to review spending patterns over time.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Pricing Calculator

Question 9

A company has a critical resource group named 'Prod-Databases' that contains Azure SQL databases and virtual machines used by a production order-processing system. The database administrator wants to prevent any user, including administrators, from accidentally deleting or modifying resources in this resource group. The operations team needs a safeguard that requires an explicit action to be taken before any changes become possible, without affecting the ability to manage resources in other resource groups. Which Azure feature should the team implement?

Accepted Answer

Azure Resource Lock (ReadOnly). Azure Resource Locks include CanNotDelete and ReadOnly. CanNotDelete prevents deletion but still allows modification. ReadOnly prevents both deletion and modification, which matches the requirement to protect critical production resources from accidental deletion or modification while also requiring the lock to be removed before changes can be made. This lock applies to the Prod-Databases resource group and does not affect management of resources in other resource groups.

Answer

Azure Policy with the Deny effect

Answer

Azure RBAC role assignment (e.g., restrict to Reader role)

Answer

Azure management group

Question 10

A company has a management group hierarchy with a root management group that contains all subscriptions. The governance team assigns a built-in Azure policy definition 'Allowed Locations' to the root management group with the 'Deny' effect, restricting resource deployment to East US and West US only. After six months, a new regulatory requirement forces the marketing department's subscription (placed under the root) to deploy resources in North Europe for a specific pilot project. The governance team must allow this exception without changing the original policy assignment and without allowing any other subscription to deploy to North Europe. What should the governance team do?

Accepted Answer

Create an Azure Policy exemption for the marketing subscription with 'Waiver' category and specify the policy assignment to exclude.. Azure Policy exemptions exclude a scope from a policy assignment without altering the assignment. To allow only the marketing subscription to deploy to North Europe, create an exemption at the subscription scope referencing the existing 'Allowed Locations' policy assignment. The exemption category must be 'Waiver' or 'Mitigated' (not 'Exempt'), and the exemption should specify the assignment and scope to exclude. This leaves the original 'Deny' assignment intact for all other subscriptions.

Answer

Create a new Azure Policy assignment at the marketing subscription scope with the 'Allowed Locations' initiative set to 'Audit' instead of 'Deny' and include North Europe in the allowed list.

Answer

Create an Azure Blueprint that includes the 'Allowed Locations' policy and assign it to the marketing subscription.

Answer

Assign a custom RBAC role to the marketing subscription that bypasses the policy.

Question 11

A company has a root management group that contains two child management groups: Production and Development. Each child management group contains several subscriptions. The security team assigns a built-in Azure Policy definition with the 'Deny' effect to the Production management group to enforce encryption on all storage accounts. Later, the Development team requests that storage accounts in their subscriptions must not be encrypted because they host temporary test data that needs to be quickly deleted and recreated. The security team must allow this exception for Development only, without changing the policy for Production. What should the security team do?

Accepted Answer

Create an Azure Policy exemption for the Development management group with the 'Mitigated' category.. Since the Deny policy is scoped to Production management group, it does not apply to Development management group. Therefore Development already allows unencrypted storage accounts. No action is required. If the policy were assigned at root or inherited, an exemption with category 'Waiver' would be appropriate because the policy intent (encryption) is not met, but that is not the case here.

Answer

Assign a new policy with the 'Audit' effect at the Development management group to override the Deny effect.

Answer

Remove the policy assignment from the root management group and assign it individually to each Production subscription.

Answer

Create an Azure RBAC role assignment that grants the Development team permission to bypass the policy.

Question 12

Which Azure service helps you manage and automate the deployment of virtual machines at scale across development, testing, and production environments?

Accepted Answer

Azure Automation. Azure Automation is the correct answer because it provides a centralized service for automating the deployment and management of Azure resources, including virtual machines, across multiple environments (development, testing, and production). Through runbooks and configuration management, it enables consistent, repeatable deployments at scale. Azure DevTest Labs is specifically designed for dev/test workloads only, not production, and Azure Virtual Machine Scale Sets are for scaling identical VMs within a single environment, not for managing lifecycle across separate environments.

Answer

Azure Virtual Machine Scale Sets

Answer

Azure DevTest Labs

Answer

Azure Batch

Question 13

What is the minimum Azure support plan that provides 24/7 access to technical support via phone and email?

Accepted Answer

Business. Azure support plans are Basic, Developer, Standard, Professional Direct, and Enterprise. Basic provides no technical support; Developer offers email support only during business hours; Standard provides 24/7 phone and email support; Enterprise also provides 24/7 but is not the minimum. Since 'Standard' is missing, no listed option is correct.

Answer

Basic

Answer

Developer

Answer

Enterprise

Question 14

Which Azure security feature prevents accidental deletion of a critical production resource group?

Accepted Answer

Applying a CanNotDelete resource lock to the resource group. A CanNotDelete resource lock prevents any user or process from deleting the resource group, regardless of their permissions (including Owner). This is the correct mechanism to guard against accidental deletion of critical production resources because it overrides role-based access control (RBAC) permissions for delete operations.

Answer

Assigning Reader role to all users

Answer

Setting an Azure Policy to deny resource group deletion

Answer

Enabling Azure Backup for the resource group

Question 15

What does the Azure SLA guarantee for a single Virtual Machine with Premium SSD disk?

Accepted Answer

99.9% uptime per month. The Azure SLA for a single Virtual Machine using Premium SSD or Ultra Disk for all OS and data disks guarantees 99.9% uptime. For VMs with two or more instances, the SLA is higher: 99.95% within the same Availability Set or Availability Zone, and 99.99% across two Availability Zones. A single instance lacks redundancy against host or rack failures, so the SLA is 99.9%.

Answer

99% uptime per month

Answer

99.95% uptime per month

Answer

99.99% uptime per month

Question 16

Which Azure feature allows you to set a maximum amount that can be spent on Azure services within a billing period?

Accepted Answer

Azure Spending Limit. Azure Spending Limit is the feature that sets a maximum amount that can be spent on Azure services, acting as a hard cap that disables services when the limit is reached. Azure Budgets, on the other hand, are used for monitoring and alerting on spending, but they do not enforce a maximum spend limit unless you configure automation to take action. Therefore, for a maximum spend cap, the correct answer is Spending Limit.

Answer

Azure Budgets

Answer

Azure Reserved Instances

Answer

Azure Quota limits

Question 17

Which Azure portal feature enables you to manage multiple Azure cloud environments (Azure Commercial, Azure Government, Azure China) from a single location?

Accepted Answer

Azure Arc. Azure Arc is designed to manage hybrid and multi-cloud resources (e.g., on-premises, AWS, GCP) by projecting them as Azure resources in the Azure portal of the cloud where Arc is deployed. It does not bridge between Azure Commercial, Government, and China clouds. There is no portal feature that allows cross-cloud management across sovereign clouds because they are isolated by design.

Answer

Azure Management Groups spanning clouds

Answer

Azure portal with subscription filter

Answer

Azure Cloud Shell multi-tenant mode

Question 18

An organization wants to ensure new Azure subscriptions always have specific resources (policies, RBAC roles, resource groups, and ARM templates) deployed automatically. Which Azure service is BEST suited?

Accepted Answer

Azure Blueprints. Azure Blueprints is the best choice because it is designed to orchestrate the deployment of a complete environment that includes policies, RBAC roles, resource groups, and ARM templates in a repeatable, versioned manner. Unlike individual services, Blueprints packages these components into a single 'blueprint' definition that can be assigned to subscriptions to ensure consistent governance from the start.

Answer

Azure Policy

Answer

ARM templates alone

Answer

Azure DevOps pipelines

Question 19

Sequence the steps to set up Azure Active Directory (Azure AD) single sign-on (SSO) for a SaaS application.

Accepted Answer

Step 1: Register the application in Azure AD. Step 2: Configure single sign-on (e.g., SAML). Step 3: Map user attributes between Azure AD and the SaaS application. Step 4: Assign users and groups to the application. Step 5: Test the SSO configuration.. The correct sequence for setting up Azure AD SSO for a SaaS application begins with registering the application in Azure AD to create a service principal. Next, configure single sign-on (e.g., SAML) to define the SSO settings. Then, map user attributes between Azure AD and the SaaS application as part of the SSO configuration. After mapping, assign users and groups to the application to grant access. Finally, test the SSO configuration to ensure it works. This order ensures that SSO settings and attribute mapping are established before users are assigned.

Answer

Step 1: Register the application in Azure AD. Step 2: Map user attributes between Azure AD and the SaaS application. Step 3: Assign users and groups to the application. Step 4: Configure single sign-on (e.g., SAML). Step 5: Test the SSO configuration.

Answer

Step 1: Assign users and groups to the application. Step 2: Register the application in Azure AD. Step 3: Map user attributes between Azure AD and the SaaS application. Step 4: Configure single sign-on (e.g., SAML). Step 5: Test the SSO configuration.

Answer

Step 1: Configure single sign-on (e.g., SAML). Step 2: Register the application in Azure AD. Step 3: Map user attributes between Azure AD and the SaaS application. Step 4: Assign users and groups to the application. Step 5: Test the SSO configuration.

Question 20

Sequence the steps to deploy a virtual network (VNet) with subnets in Azure.

Accepted Answer

Access Azure Portal, Create Virtual Network, Define Address Space, Add Subnets, Configure DNS, Review and Create. The correct order is: Access Azure Portal → Create Virtual Network → Define Address Space → Add Subnets → Configure DNS → Review and Create. The address space must be defined before adding subnets because each subnet's address range must fall within the virtual network's address space. DNS settings are configured after subnets in the same IP Addresses tab, and Review + create is the final validation and deployment step.

Answer

Access Azure Portal, Create Virtual Network, Add Subnets, Define Address Space, Configure DNS, Review and Create

Answer

Access Azure Portal, Create Virtual Network, Configure DNS, Define Address Space, Add Subnets, Review and Create

Answer

Access Azure Portal, Create Virtual Network, Review and Create, Define Address Space, Add Subnets, Configure DNS