AZ-900 Describe Azure management and governance Practice Test 10 — 15 Questions

Question 1

A multinational company has a strict data residency requirement: all Azure virtual machines must be deployed only in the East US or West Europe Azure regions. The IT governance team wants to enforce this rule automatically so that any attempt to create a virtual machine in any other region is blocked immediately at the time of deployment. Users must receive a clear error message if they try to create a VM in a disallowed region. Which Azure feature should the governance team configure to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an Azure Policy with the Deny effect assigned to the subscription scope.. Azure Policy with the Deny effect is the correct choice because it enforces organizational rules by evaluating resource properties during deployment and blocking any non-compliant request. In this scenario, a policy can be defined to deny virtual machine creation in any region other than East US or West Europe, and the Deny effect ensures the deployment fails with a clear error message, meeting the real-time enforcement requirement.

Answer

Create a resource lock on the subscription to prevent all resource creation.

Answer

Assign an Azure RBAC role that denies create permissions for VMs in disallowed regions.

Answer

Set up a budget alert in Cost Management to notify when a VM is created in a disallowed region.

Question 2

A company has an Azure subscription used by several development teams. The governance team wants to identify any virtual machines that are not tagged with a mandatory 'CostCenter' tag. The team does not want to block the creation of untagged VMs; they only want to report on non-compliant resources in Azure Policy's compliance dashboard. Which Azure Policy effect should they use in their policy definition?

Accepted Answer

Audit. The Audit effect is correct because it enables Azure Policy to evaluate resources against the policy rule and report non-compliant resources in the compliance dashboard without blocking resource creation or modification. Since the governance team only wants visibility into untagged VMs, Audit logs the non-compliance as a warning in the activity log and marks the resource as non-compliant, but does not prevent the VM from being deployed.

Answer

Deny

Answer

Append

Answer

Disabled

Question 3

A company has an Azure Policy assignment that denies the creation of any virtual machine (VM) that does not have a mandatory 'CostCenter' tag. A development team needs to deploy a temporary test VM without the required tag for a short-term experiment. The governance team wants to allow this specific exception while recording the reason for the exception, ensuring the policy is still enforced for all other resources. The exception must also automatically expire after 30 days. Which Azure Policy feature should the governance team use?

Accepted Answer

Exemption. Azure Policy Exemption allows the governance team to create a specific exception for the test VM while recording the reason and setting an automatic expiration date (30 days). Unlike exclusion scopes, exemptions are explicitly designed to handle scenarios where a resource should be excluded from policy evaluation with a defined justification and expiry, ensuring the policy remains enforced for all other resources.

Answer

Exclusion scope

Answer

Audit effect

Answer

Override effect

Question 4

A company has an Azure subscription that contains production resources. The IT manager is concerned that a user who has the Contributor role might accidentally delete the entire subscription. The company wants a solution that prevents anyone from deleting the subscription, even users with the Owner role, while still allowing modifications to the resources inside the subscription. What should the administrator configure?

Accepted Answer

Apply a resource lock of type 'Delete' at the subscription level.. A resource lock of type 'Delete' at the subscription level prevents any user, including those with the Owner role, from deleting the subscription. This lock overrides all RBAC permissions, ensuring that while modifications to resources inside the subscription are still allowed, the subscription itself cannot be removed. This directly addresses the IT manager's concern about accidental deletion.

Answer

Assign a custom role-based access control (RBAC) role that denies the delete action for all users.

Answer

Configure an Azure Policy with the 'Deny' effect to block deletion of the subscription.

Answer

Apply a resource lock of type 'ReadOnly' at the subscription level.

Question 5

A company has an Azure subscription with 200 virtual machines. The compliance team requires that all virtual machines have diagnostic settings enabled to send metrics and logs to a central Log Analytics workspace. The team wants Azure to automatically configure these diagnostic settings on any VM that currently lacks them, without manual intervention. Which Azure Policy effect should the team use in the policy definition?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it automatically deploys a diagnostic settings configuration to any VM that lacks it, ensuring compliance without manual intervention. This effect evaluates resources and, if they do not meet the condition (missing diagnostic settings), triggers a deployment to remediate them. Audit only logs non-compliance without fixing it, and Deny blocks non-compliant creation but does not remediate existing VMs.

Answer

Audit

Answer

Deny

Answer

Modify

Question 6

A company requires that all resources deployed in a production Azure subscription must include a 'Department' tag. Resources without this tag must be automatically prevented from being created. Which Azure service should the company use to enforce this requirement?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules on your Azure resources. In this scenario, you can define a policy that requires the 'Department' tag on all resources, and configure a deny effect to automatically prevent the creation of any resource that does not include this tag. This ensures compliance at the time of resource creation, without manual intervention.

Answer

Azure Blueprints

Answer

Azure Resource Manager

Answer

Azure Cost Management

Question 7

A multinational corporation wants to deploy a standard set of Azure resources—including virtual networks, virtual machines, and SQL databases—to multiple departments. Each deployment must automatically include assigned Azure Policy definitions to enforce security rules, role-based access control (RBAC) assignments for the operations team, and a predefined naming convention. The solution must provide a single, repeatable package that can be versioned and updated centrally. Which Azure service should the company use?

Accepted Answer

Azure Blueprints. Azure Blueprints is designed to orchestrate the deployment of resource templates (such as ARM templates or Azure Resource Manager templates) along with governance artifacts like Azure Policy assignments, RBAC role assignments, and resource groups. It provides a versioned, repeatable definition that can be assigned to subscriptions or management groups, ensuring consistent and compliant deployments across an organization. Azure Policy alone only enforces rules but does not orchestrate resource deployment. ARM templates define the infrastructure but lack built-in governance artifact management. Management Groups provide hierarchical organization but do not package deployments with policies and RBAC.

Answer

Azure Policy

Answer

Azure Resource Manager templates

Answer

Azure Management Groups

Question 8

A company has deployed a critical production application in an Azure resource group. The security team wants to prevent accidental deletion or modification of any resources within that resource group. They have already configured Azure RBAC roles to grant only necessary permissions to the operations team. However, they need an additional protection that even users with Owner permissions cannot delete the resource group or its resources without a two-step process to remove the protection. Which Azure feature should the company implement?

Accepted Answer

Azure Resource Lock. Azure Resource Lock is the correct feature because it provides a protection mechanism that prevents accidental deletion or modification of resources, even for users with Owner permissions. Unlike RBAC, which controls who can perform actions, a resource lock enforces a restriction that must be explicitly removed (a two-step process) before any changes can be made. This directly addresses the requirement for an additional layer of protection beyond role-based access control.

Answer

Azure Policy

Answer

Azure Blueprint

Answer

Azure Resource Tag

Question 9

A company operates a fleet of on-premises servers running legacy applications. Due to strict regulatory compliance requirements, these servers cannot be migrated to Azure. However, the IT team wants to centrally manage these servers using Azure tools, including applying Azure Policy to enforce configuration standards and using Azure Monitor for log collection and performance monitoring. The team needs to treat these on-premises servers as Azure resources without moving them. Which Azure service should the company use?

Accepted Answer

Azure Arc. Azure Arc is the correct service because it extends Azure Resource Manager (ARM) and Azure management plane to on-premises servers, allowing them to be treated as Azure resources without migration. With Azure Arc, you can apply Azure Policy to enforce configuration standards and use Azure Monitor for log collection and performance monitoring on these servers, meeting the regulatory compliance requirement of keeping them on-premises.

Answer

Azure Stack Edge

Answer

Azure Site Recovery

Answer

Azure Policy

Question 10

A company uses Azure Policy to enforce that all virtual machines must have the Azure Monitor agent extension installed. The policy is assigned to a subscription and uses the 'DeployIfNotExists' effect, which automatically installs the agent on new VMs. However, the security team notices that several existing VMs are non-compliant because they were provisioned before the policy was assigned. The team wants to automatically make these existing VMs compliant without manual intervention. What should the team do?

Accepted Answer

Create a remediation task for the policy assignment.. A remediation task on a 'DeployIfNotExists' policy assignment triggers the policy engine to evaluate existing non-compliant resources and automatically deploy the required extension (Azure Monitor agent) to those VMs. This is the designed mechanism to bring pre-existing resources into compliance without manual intervention.

Answer

Change the policy effect to 'Deny'.

Answer

Assign the policy at the management group scope.

Answer

Use Azure Automation Update Management.

Question 11

A company uses Azure Policy to enforce governance rules across its Azure subscriptions. The security team wants to ensure that all virtual machines deployed in a subscription must be of an approved size from a predefined list. If a user attempts to deploy a virtual machine with a size not on the list, the deployment must be immediately blocked. Which Azure Policy effect should the company use in the policy definition?

Accepted Answer

Deny. The 'Deny' effect is correct because it actively blocks any deployment that violates the policy rule, such as deploying a virtual machine with a size not on the approved list. This effect evaluates the request during resource creation or update and denies it if the condition is met, ensuring immediate enforcement. In contrast, other effects like 'Audit' only log non-compliant resources without blocking them, which does not meet the security team's requirement to prevent unauthorized VM sizes.

Answer

Audit

Answer

DeployIfNotExists

Answer

Append

Question 12

A company has multiple Azure subscriptions for different departments. The governance team needs to ensure that every new subscription is automatically provisioned with a consistent set of resources, including a predefined network topology, mandatory Azure Policy assignments (e.g., allowed locations), and specific role-based access control (RBAC) assignments for the security team. The solution must be repeatable, version-controlled, and allow the team to update the defined artifacts and apply updates to existing subscriptions. Which Azure service should the team use to define and deploy this collection of governance artifacts?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it enables the orchestrated deployment of a repeatable set of Azure resources, policies, and RBAC assignments as a single, version-controlled artifact. Unlike Azure Policy alone, Blueprints can include resource templates (e.g., network topology) and RBAC assignments, and it supports updating existing subscriptions by publishing new versions of the blueprint and assigning them to subscriptions.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Manager templates

Question 13

A company needs to deploy a consistent set of Azure resources (a virtual network, two subnets, and a network security group) into multiple environments: dev, test, and prod. The IT operations team wants to define these resources in a declarative file that can be deployed repeatedly and reliably to different resource groups. The team also wants to version control the file and have the ability to update all environments by redeploying the same file. Which Azure feature should the team use?

Accepted Answer

Azure Resource Manager (ARM) templates. Azure Resource Manager (ARM) templates are the correct choice because they provide a declarative JSON-based file that defines the infrastructure and configuration of Azure resources. This allows the team to deploy a consistent set of resources (virtual network, subnets, network security group) repeatedly and reliably across different resource groups and environments (dev, test, prod). ARM templates support version control, idempotent deployments, and can be used to update all environments by simply redeploying the same template file.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Advisor

Question 14

A company uses Azure Policy to enforce resource tagging. The governance team creates a policy that requires all resources in a subscription to have a 'CostCenter' tag. However, the team does not want to block resource creation if the tag is missing. Instead, they want the policy to automatically add the tag with a default value of 'Unassigned' to any new resource that is created without the tag. Which Azure Policy effect should the team configure in the policy definition?

Accepted Answer

Modify. The Modify effect is correct because it allows Azure Policy to automatically add or change a tag on a resource during creation or update without blocking the operation. This matches the requirement to add the 'CostCenter' tag with a default value of 'Unassigned' to any new resource missing it, while still permitting resource creation.

Answer

Deny

Answer

Audit

Answer

DeployIfNotExists

Question 15

A large enterprise has multiple Azure subscriptions for different departments. The central IT team wants to enforce a policy that restricts the Azure regions where resources can be deployed. The policy must automatically apply to all existing subscriptions and to any new subscriptions created in the future, without requiring manual assignment to each subscription individually. Which Azure feature should the central IT team use to achieve this hierarchical governance?

Accepted Answer

Azure Management Groups. Azure Management Groups provide a hierarchical structure above subscriptions, allowing policies (like region restrictions) to be assigned at the management group level. This inheritance ensures the policy automatically applies to all existing subscriptions within the group and to any new subscriptions added later, without manual per-subscription assignment.

Answer

Azure Blueprints

Answer

Azure Resource Groups

Answer

Azure Policy alone assigned to each subscription