AZ-900 Describe Azure management and governance Practice Test 10 — 15 Questions

Question 1

A company needs to deploy a consistent set of Azure resources (a virtual network, two subnets, and a network security group) into multiple environments: dev, test, and prod. The IT operations team wants to define these resources in a declarative file that can be deployed repeatedly and reliably to different resource groups. The team also wants to version control the file and have the ability to update all environments by redeploying the same file. Which Azure feature should the team use?

Accepted Answer

Azure Resource Manager (ARM) templates. Azure Resource Manager (ARM) templates are the correct choice because they provide a declarative JSON-based file that defines the infrastructure and configuration of Azure resources. This allows the team to deploy a consistent set of resources (virtual network, subnets, network security group) repeatedly and reliably across different resource groups and environments (dev, test, prod). ARM templates support version control, idempotent deployments, and can be used to update all environments by simply redeploying the same template file.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Advisor

Question 2

A company uses Azure Policy to enforce resource tagging. The governance team creates a policy that requires all resources in a subscription to have a 'CostCenter' tag. However, the team does not want to block resource creation if the tag is missing. Instead, they want the policy to automatically add the tag with a default value of 'Unassigned' to any new resource that is created without the tag. Which Azure Policy effect should the team configure in the policy definition?

Accepted Answer

Modify. The Modify effect is correct because it allows Azure Policy to automatically add or change a tag on a resource during creation or update without blocking the operation. This matches the requirement to add the 'CostCenter' tag with a default value of 'Unassigned' to any new resource missing it, while still permitting resource creation.

Answer

Deny

Answer

Audit

Answer

DeployIfNotExists

Question 3

A large enterprise has multiple Azure subscriptions for different departments. The central IT team wants to enforce a policy that restricts the Azure regions where resources can be deployed. The policy must automatically apply to all existing subscriptions and to any new subscriptions created in the future, without requiring manual assignment to each subscription individually. Which Azure feature should the central IT team use to achieve this hierarchical governance?

Accepted Answer

Azure Management Groups. Azure Management Groups provide a hierarchical structure above subscriptions, allowing policies (like region restrictions) to be assigned at the management group level. This inheritance ensures the policy automatically applies to all existing subscriptions within the group and to any new subscriptions added later, without manual per-subscription assignment.

Answer

Azure Blueprints

Answer

Azure Resource Groups

Answer

Azure Policy alone assigned to each subscription

Question 4

A company has a critical Azure resource group that contains all production virtual machines and databases. The IT security administrator wants to ensure that no user, including members of the 'Owner' role, can accidentally or intentionally delete this resource group. The solution must not prevent modification of resources inside the resource group. The administrator needs to apply a governance control at the resource group level. What should the administrator do?

Accepted Answer

Apply a 'CanNotDelete' lock on the resource group.. Option B is correct because applying a 'CanNotDelete' lock at the resource group level prevents any user, including those with the Owner role, from deleting the resource group while still allowing modifications (e.g., adding or updating resources) inside it. This lock overrides all RBAC permissions for delete operations, making it the appropriate governance control for this requirement.

Answer

Apply a 'ReadOnly' lock on the resource group.

Answer

Assign a custom RBAC role that denies delete actions at the resource group scope.

Answer

Move the resource group to a separate subscription with billing separation.

Question 5

A company has an Azure subscription that contains hundreds of virtual machines (VMs) across multiple resource groups. The security team needs to enforce two governance rules: 1) All VMs must use managed disks. 2) All VMs must be deployed only in the East US region. The team wants to assign a single governance artifact that combines both rules so that the compliance state is evaluated as a group. The solution must not require assigning each rule individually. Which Azure feature should the team use to define and assign this combined set of rules?

Accepted Answer

Azure Policy initiative (policy set) definition. Azure Policy initiative (policy set) definitions allow you to group multiple individual policy definitions into a single, combined set of rules. By assigning the initiative, both the managed disks requirement and the East US region restriction are evaluated together as a single compliance artifact, meeting the requirement to avoid assigning each rule individually.

Answer

Azure Policy group definition

Answer

Azure Blueprints artifact

Answer

Azure compliance bundle

Question 6

A company has a single Azure subscription that contains multiple resource groups for different departments. The security team needs to ensure that only members of the 'VM Operators' Azure Active Directory group can create virtual machines in the subscription. All other users, including subscription Owners, must be blocked from creating virtual machines. Which Azure feature should the security team use to enforce this requirement?

Accepted Answer

Azure role-based access control (RBAC). Azure RBAC allows you to assign specific roles (like 'Virtual Machine Contributor') to a security principal (e.g., the 'VM Operators' group) at a scope (the subscription). By granting the 'Virtual Machine Contributor' role only to the 'VM Operators' group and removing any built-in roles that allow VM creation from other users (including Owners), you can ensure that only that group can create VMs. This is the correct mechanism because RBAC is designed for fine-grained, role-based permission management.

Answer

Azure Policy with a deny effect

Answer

Azure Resource Lock at the subscription level

Answer

Azure Blueprints

Question 7

A multinational company has multiple Azure subscriptions for different business units. The central governance team wants to define a standardized environment that must be automatically applied to every new subscription. The standard must include a set of Azure Policy definitions (e.g., allowed regions), a specific Azure RBAC role assignment (e.g., a contributor access for a central security group), and a preconfigured resource group with a virtual network. The team wants to package all these components together so that they can be deployed consistently and updated centrally. Which Azure service should the team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the service designed to package together Azure Policy definitions, RBAC role assignments, and Azure Resource Manager templates (including resource groups and resources) into a single, versioned artifact that can be assigned to subscriptions. This enables organizations to enforce a consistent governance and compliance baseline across multiple subscriptions. Azure Policy alone cannot deploy RBAC assignments or resources. Azure Management Groups provide hierarchical organization and policy inheritance but do not deploy resources. ARM templates can deploy resources but cannot natively include policy or RBAC assignments as a cohesive package.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Manager templates

Question 8

A company has an Azure subscription that hosts multiple virtual machines, databases, and storage accounts. The finance team wants to receive an automated email notification when the forecasted monthly spending for the subscription exceeds $10,000. The team needs to use a native Azure feature that can track actual and forecasted costs and trigger alerts based on a monetary threshold. The solution must not require custom scripts or third-party tools. Which Azure feature should the team configure?

Accepted Answer

Azure Budgets. Azure Budgets is the correct native feature because it allows you to set a monetary threshold (e.g., $10,000) for forecasted or actual costs, and it can automatically trigger an email alert when that threshold is reached. It integrates directly with Azure Cost Management and requires no custom scripts or third-party tools, meeting the finance team's requirements exactly.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Resource Graph

Question 9

A company uses Azure for multiple projects. The IT governance team wants to ensure that every new Azure resource within a subscription is automatically assigned a 'CostCenter' tag based on the resource group it is created in. The team does not want to rely on users manually applying the tag. They need a built-in Azure solution that enforces this rule without custom scripts. Which Azure feature should they use?

Accepted Answer

Azure Policy with the 'Inherit a tag from the resource group if missing' effect. Azure Policy with the 'Inherit a tag from the resource group if missing' effect is correct because it automatically applies the 'CostCenter' tag from the resource group to any new resource created within that resource group, without requiring manual intervention or custom scripts. This built-in policy effect enforces governance rules at scale, ensuring compliance across the subscription.

Answer

Azure Resource Graph

Answer

Azure Management Groups

Answer

Azure Tags (manual tagging feature)

Question 10

A company has multiple Azure subscriptions used by different departments. The security team wants to enforce a requirement that all Azure Storage accounts in every subscription must be encrypted at rest using customer-managed keys (CMK). The solution must automatically evaluate existing and new storage accounts for compliance, and it must be able to automatically remediate non-compliant resources by enabling CMK encryption. The team wants to use a single, centralized Azure feature that can be assigned once and apply to all subscriptions. Which Azure feature should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct choice because it can enforce organizational standards and assess compliance across all Azure subscriptions from a single assignment. By using a built-in or custom policy definition that requires storage accounts to use customer-managed keys (CMK) for encryption at rest, Azure Policy can automatically evaluate both existing and new storage accounts. With the 'DeployIfNotExists' effect, it can also trigger remediation tasks to enable CMK encryption on non-compliant resources without manual intervention.

Answer

Azure Blueprints

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Security Center (Microsoft Defender for Cloud)

Question 11

A company has a production resource group that contains several Azure virtual machines and a SQL database. The company wants to ensure that no user can accidentally delete these resources, but authorized administrators must still be able to modify the configuration and update the resources. The company needs a straightforward governance feature that can be applied directly to the resource group and can be removed only by an authorized user with the Owner role. Which Azure feature should the company use?

Accepted Answer

A Delete lock on the resource group.. A Delete lock on the resource group prevents users from deleting the resource group and its resources, while still allowing authorized administrators with the Owner role to modify configurations and update resources. This lock can only be removed by a user with the Owner role, meeting the requirement for a straightforward governance feature applied directly to the resource group.

Answer

Azure Policy with a Deny effect to block resource deletions.

Answer

A Read-Only lock on the resource group.

Answer

An Azure RBAC role assignment that excludes the Delete action for all users.

Question 12

A company has deployed multiple Azure virtual machines for a production workload. The IT administrator wants a centralized list of prioritized recommendations to improve the security, high availability, and cost efficiency of the virtual machines. The administrator also wants to be able to view the potential impact of implementing each recommendation. Which Azure service should the administrator use?

Accepted Answer

Azure Advisor. Azure Advisor is the correct service because it provides a centralized, personalized list of best practice recommendations across five categories: Reliability, Security, Performance, Cost, and Operational Excellence. It specifically offers prioritized recommendations for Azure VMs with an 'Impact' column (High, Medium, Low) that indicates the potential effect of implementing each suggestion, directly matching the administrator's requirement for security, high availability, and cost efficiency improvements with impact visibility.

Answer

Azure Security Center

Answer

Azure Monitor

Answer

Azure Policy

Question 13

A company has a team of support engineers who need to be able to restart Azure virtual machines when they become unresponsive. The support engineers must not be able to modify the VM configuration, delete the VMs, or access VM data. The company wants to use the principle of least privilege. No built-in Azure role meets these exact requirements. What should the company do?

Accepted Answer

Create a custom role in Azure RBAC that includes only the 'Microsoft.Compute/virtualMachines/restart/action' permission and assign it to the support engineers.. Option C is correct because it adheres to the principle of least privilege by creating a custom role that grants only the specific 'Microsoft.Compute/virtualMachines/restart/action' permission. This ensures support engineers can restart VMs without being able to modify configurations, delete VMs, or access data, which no built-in role provides.

Answer

Assign the support engineers the Virtual Machine Contributor built-in role.

Answer

Assign the support engineers the Owner built-in role on the resource group containing the VMs.

Answer

Configure an Azure Policy definition that allows only the restart operation on virtual machines.

Question 14

A company is adopting Azure and needs to deploy a standardized environment that includes a resource group, a virtual network with specific IP address ranges, and a set of Azure Policy definitions to restrict allowed deployment locations. The environment will be deployed to multiple subscriptions used by different departments. The company requires a repeatable, versioned package that defines the resources, policies, and role assignments as a single item. The solution must allow updates to be managed and enforced over time. Which Azure feature should the company use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it enables the orchestrated deployment of a standardized environment—including resource groups, virtual networks, Azure Policy definitions, and role assignments—as a single, versioned, and updatable package. Unlike ARM templates, Blueprints natively supports versioning, policy assignment, and role assignment as first-class artifacts, and it allows the blueprint to be assigned to multiple subscriptions while maintaining a central source of truth for updates and enforcement.

Answer

Azure Policy

Answer

ARM templates

Answer

Management groups

Question 15

A company uses multiple Azure subscriptions for different departments. The finance team wants to monitor spending across all subscriptions and receive automated email alerts when a subscription's actual spending reaches 80% of its monthly budget. The team does not want to write custom scripts or use external tools. Which Azure feature should they use?

Accepted Answer

Azure Cost Management + Budgets. Azure Cost Management + Budgets is the correct feature because it allows you to create budgets at the subscription or resource group level, set alert thresholds (e.g., 80% of actual spend), and configure automated email notifications when the threshold is met—all without custom scripts or external tools. This directly addresses the finance team's requirement to monitor spending across multiple subscriptions and receive alerts.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Resource Locks