AZ-900 Describe Azure management and governance — 100 Questions

Question 1

A company has multiple Azure subscriptions for different departments. They want to enforce consistent policies across all subscriptions regarding allowed virtual machine sizes and require compliance reporting. Which Azure feature should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct choice because it enables you to create, assign, and manage policies that enforce specific rules (such as allowed VM sizes) across multiple subscriptions. It provides built-in compliance reporting via the Compliance dashboard, showing which resources are non-compliant. Unlike Blueprints or ARM templates, Policy focuses solely on governance rules and does not deploy resources or define the environment's architecture.

Answer

Azure Blueprints

Answer

Azure Resource Manager templates

Answer

Role-Based Access Control (RBAC)

Question 2

A company uses Azure and wants to ensure that their IT team receives alerts when virtual machines are deallocated unexpectedly. Which Azure service should they use to create a rule that triggers an action when a VM is deallocated?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a unified platform for collecting, analyzing, and acting on telemetry from Azure resources. By creating an alert rule in Azure Monitor with a signal type of 'Administrative' (Azure Activity Log), you can trigger an action group (e.g., email, SMS, webhook) specifically when a virtual machine is deallocated, as this event is logged as an administrative operation in the Activity Log.

Answer

Azure Service Health

Answer

Azure Advisor

Answer

Azure Policy

Question 3

A company needs to track and optimize costs across multiple Azure subscriptions. They want to allocate budgets and receive notifications when spending exceeds forecasted amounts. Which Azure tool should they use?

Accepted Answer

Azure Cost Management. Azure Cost Management is the correct tool because it provides native capabilities to track, analyze, and optimize cloud costs across multiple subscriptions. It allows you to set budgets, configure cost alerts, and receive notifications when actual or forecasted spending exceeds defined thresholds, directly addressing the requirement for budget allocation and proactive spending notifications.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Budgets

Question 4

A global company wants to organize its Azure resources by department and project. They need to enforce cost allocation and apply governance policies consistently across all subscriptions. Which two Azure features should they use together? (Select two.)

Accepted Answer

Management groups. Management groups (B) are correct because they provide a hierarchical structure above subscriptions, enabling consistent governance and policy assignment across multiple subscriptions. Tags (C) are correct because they allow you to attach metadata (e.g., department and project) to resources for cost allocation and organization. Together, management groups enforce policies at scale, while tags enable granular cost tracking and reporting.

Answer

Resource groups

Answer

Azure Policies

Question 5

A company wants to ensure that all new Azure resources in a subscription are automatically tagged with a 'Department' tag. Which Azure service should they use to enforce this requirement?

Accepted Answer

Azure Policy. Azure Policy is correct because it allows you to create, assign, and manage policies that enforce specific rules on your Azure resources. In this scenario, you can use a built-in or custom policy definition to require a 'Department' tag on all new resources, and Azure Policy will automatically evaluate and enforce this rule during resource creation, preventing non-compliant resources from being provisioned.

Answer

Azure Blueprints

Answer

Azure RBAC

Answer

Azure Resource Lock

Question 6

A company has multiple Azure subscriptions for different departments. They want to receive budget alerts when spending in any subscription exceeds 80% of the allocated amount. Which Azure feature enables them to set up these alerts?

Accepted Answer

Azure Cost Management + Billing budgets. Azure Cost Management + Billing budgets allow you to create budget alerts based on actual or forecasted costs. You can set a budget amount and configure alerts to trigger when costs reach a specified percentage (e.g., 80%) of that budget. This directly meets the requirement to receive alerts when spending in any subscription exceeds 80% of the allocated amount.

Answer

Azure Advisor

Answer

Azure Monitor

Answer

Azure Policy

Question 7

A company wants to ensure that whenever a new Azure subscription is created, it automatically inherits a set of baseline policies, role assignments, and resource groups. Which Azure tool should they use to package and deploy these governance components consistently?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct tool because it is specifically designed to orchestrate the deployment of a repeatable set of Azure resources, policies, role assignments, and resource groups into a new subscription. It packages these governance components into a single blueprint definition that can be assigned to a subscription, ensuring consistent inheritance and compliance from creation.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Manager templates

Question 8

A company uses Azure Resource Manager templates to deploy and manage infrastructure. They need to ensure that resources are deployed in a consistent, repeatable manner across environments. Which two benefits does using ARM templates provide? (Choose two.)

Accepted Answer

Declarative syntax ensures that deployments are idempotent and repeatable.. Option A is correct because ARM templates use declarative syntax, meaning you define the desired state of your infrastructure rather than scripting the steps to achieve it. This makes deployments idempotent: running the same template multiple times produces the same result, ensuring consistency across environments without side effects.

Answer

Templates automatically scale resources based on demand.

Answer

Templates are limited to a specific Azure region.

Question 9

A company wants to deploy a standardized environment that includes Azure Policy assignments, RBAC roles, and resource group templates. They need to version these components and apply them to multiple subscriptions. Which Azure service should they use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it is designed to orchestrate the deployment of a standardized environment by packaging Azure Policy assignments, RBAC roles, and resource group templates into a single, versioned, and repeatable artifact. It allows you to assign these components to multiple subscriptions while maintaining a consistent configuration and tracking changes through versioning.

Answer

Azure Policy

Answer

Azure Resource Manager

Answer

Azure Management Groups

Question 10

A company has multiple Azure subscriptions. The finance team needs to analyze spending trends and create budgets to prevent cost overruns. Which Azure tool should they use to visualize historical spending and set budget alerts?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing is the correct tool because it provides native capabilities for analyzing historical spending trends, creating budgets, and setting cost-based alerts. It integrates directly with Azure's billing data to visualize costs across subscriptions and resource groups, and its budget alerts can trigger actions (e.g., email notifications or automation runbooks) when spending exceeds defined thresholds.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Monitor

Question 11

A company uses Azure Policy to enforce that all virtual machines must be from an approved list of SKUs. They want to ensure that any non-compliant VMs that already exist are automatically remediated by changing the VM size to a compliant SKU. Which policy effect should they use?

Accepted Answer

Modify. The Modify effect is correct because it allows Azure Policy to automatically change non-compliant resources to a compliant state during evaluation. In this scenario, it can alter the VM size to an approved SKU without manual intervention, ensuring continuous compliance.

Answer

Deny

Answer

Audit

Answer

Append

Question 12

A company has a critical Azure resource group that contains production resources. They want to ensure that no one can accidentally delete or modify the resources in this group, even if they have Contributor permissions. Which Azure feature should they use?

Accepted Answer

Resource Locks. Resource Locks are the correct choice because they provide a way to prevent accidental deletion or modification of critical Azure resources by applying a lock at the resource, resource group, or subscription level. Even users with Contributor or Owner permissions are blocked from performing delete or modify operations when a lock is set to 'CanNotDelete' or 'ReadOnly'. This ensures that production resources are protected beyond the permissions granted by RBAC.

Answer

Azure Policy

Answer

Role-Based Access Control (RBAC)

Answer

Management Groups

Question 13

A company wants to receive notifications when Azure services in their region experience an outage or planned maintenance that might affect their resources. Which Azure service should they set up alerts for?

Accepted Answer

Azure Service Health. Azure Service Health is the correct service because it provides personalized alerts and notifications specifically for Azure service issues—such as outages and planned maintenance—that affect your subscriptions and resources in a given region. It combines global service health information with region-specific and resource-specific impacts, allowing you to configure alerts via Azure Service Health alerts (formerly known as Service Health Alerts).

Answer

Azure Monitor

Answer

Azure Advisor

Answer

Azure Resource Health

Question 14

A company wants to ensure that all Azure resources are tagged with a 'CostCenter' tag at creation time. If a resource is created without the tag, it should be automatically denied. Which Azure Policy effect should they use?

Accepted Answer

A) deny. The 'deny' effect is correct because it actively blocks any resource creation request that does not include the required 'CostCenter' tag. Azure Policy with the 'deny' effect evaluates the resource against the policy rule at creation or update time and rejects the request if the condition is not met, ensuring compliance before the resource is provisioned.

Answer

B) audit

Answer

C) append

Answer

D) deployIfNotExists

Question 15

A company has multiple Azure subscriptions. The IT team wants to apply common policies and role assignments across all subscriptions automatically when a new subscription is created. Which Azure service should they use?

Accepted Answer

B) Azure Blueprints. Azure Blueprints is the correct service because it enables the orchestrated deployment of resource templates, policies, and role assignments as a single composable artifact. When a new subscription is created, a blueprint assignment can automatically apply the defined governance artifacts, ensuring consistent compliance and access control across all subscriptions.

Answer

A) Azure Policy

Answer

C) Azure Resource Manager

Answer

D) Azure Management Groups

Question 16

A company wants to track resource usage across departments and projects. They have multiple Azure subscriptions. They need to assign costs to specific departments based on resource usage. Which Azure feature enables them to view and analyze costs by resource tags?

Accepted Answer

A) Azure Cost Management + Billing. Azure Cost Management + Billing provides the tools to view, analyze, and allocate costs across subscriptions and resources. By enabling tag inheritance and using cost analysis filters, you can group costs by resource tags (e.g., Department or Project) to assign spending to specific departments. This is the correct feature because it directly supports cost tracking and allocation by tags.

Answer

B) Azure Policy

Answer

C) Azure Tags

Answer

D) Azure Resource Groups

Question 17

A company has a policy that requires all storage accounts to have secure transfer enabled. They want to automatically audit all existing storage accounts and enforce the setting on new ones. They also want to automatically fix non-compliant new storage accounts. Which Azure Policy effect combination should they use?

Accepted Answer

B) audit and deployIfNotExists. The correct combination is 'audit' and 'deployIfNotExists'. The 'audit' effect logs non-compliant existing storage accounts without changing them, satisfying the audit requirement. The 'deployIfNotExists' effect automatically remediates new non-compliant storage accounts by enabling secure transfer (HTTPS) during deployment, enforcing the policy on new resources without blocking creation.

Answer

A) audit and deny

Answer

C) append and deny

Answer

D) modify and audit

Question 18

A company uses Azure Resource Manager templates to deploy infrastructure. They need to manage secrets such as database connection strings and passwords securely. Which Azure service should they use to store and retrieve these secrets during deployment?

Accepted Answer

A) Azure Key Vault. Azure Key Vault is the correct service because it is designed specifically to securely store and manage secrets such as database connection strings, passwords, and certificates. During Azure Resource Manager (ARM) template deployments, you can reference Key Vault secrets directly in the template using a linked template or a parameter file, allowing the secrets to be retrieved at deployment time without exposing them in plaintext. This integration ensures that sensitive values are never hardcoded or stored in source control.

Answer

B) Azure Policy

Answer

C) Azure Managed Identity

Answer

D) Azure Service Principal

Question 19

A company manages multiple Azure subscriptions for different business units. They want to define a standard set of policies, such as allowed VM SKUs and required resource tags, and ensure these policies are always applied whenever a new subscription is created. Which Azure feature should they use to enforce governance at this level?

Accepted Answer

Azure Management Groups. Azure Management Groups allow you to organize subscriptions into a hierarchy and apply governance policies at the management group level. When a new subscription is created under a management group, it automatically inherits the policies assigned to that group, ensuring consistent enforcement across all subscriptions without manual intervention.

Answer

Azure Policy

Answer

Azure Resource Manager templates

Answer

Azure Blueprints

Question 20

A company uses Azure Policy to require that all storage accounts must have blob soft delete enabled. They also want to automatically create a remediation task that fixes any existing non-compliant storage accounts. Which policy effect should they include in the policy definition to achieve automatic remediation?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is designed to automatically remediate non-compliant resources by deploying a defined template (e.g., enabling blob soft delete) when the resource is evaluated as non-compliant. This effect triggers a remediation task that can be run on existing resources, ensuring all storage accounts meet the policy requirement without manual intervention.

Answer

Deny

Answer

Audit

Answer

Append