AZ-900 Describe Azure management and governance Practice Test 11 — 15 Questions

Question 1

A company has a critical Azure resource group that contains all production virtual machines and databases. The IT security administrator wants to ensure that no user, including members of the 'Owner' role, can accidentally or intentionally delete this resource group. The solution must not prevent modification of resources inside the resource group. The administrator needs to apply a governance control at the resource group level. What should the administrator do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a 'CanNotDelete' lock on the resource group.. Applying a 'CanNotDelete' lock at the resource group level prevents any user, including those with the Owner role, from deleting the resource group while still allowing modifications (e.g., adding or updating resources) inside it. This lock overrides all RBAC permissions for delete operations, making it the appropriate governance control for this requirement.

Answer

Apply a 'ReadOnly' lock on the resource group.

Answer

Assign a custom RBAC role that denies delete actions at the resource group scope.

Answer

Move the resource group to a separate subscription with billing separation.

Question 2

A company has an Azure subscription that contains hundreds of virtual machines (VMs) across multiple resource groups. The security team needs to enforce two governance rules: 1) All VMs must use managed disks. 2) All VMs must be deployed only in the East US region. The team wants to assign a single governance artifact that combines both rules so that the compliance state is evaluated as a group. The solution must not require assigning each rule individually. Which Azure feature should the team use to define and assign this combined set of rules?

Accepted Answer

Azure Policy initiative (policy set) definition. Azure Policy initiative (policy set) definitions allow you to group multiple individual policy definitions into a single, combined set of rules. By assigning the initiative, both the managed disks requirement and the East US region restriction are evaluated together as a single compliance artifact, meeting the requirement to avoid assigning each rule individually.

Answer

Azure Policy group definition

Answer

Azure Blueprints artifact

Answer

Azure compliance bundle

Question 3

A company has a single Azure subscription that contains multiple resource groups for different departments. The security team needs to ensure that only members of the 'VM Operators' Azure Active Directory group can create virtual machines in the subscription. All other users, including subscription Owners, must be blocked from creating virtual machines. Which Azure feature should the security team use to enforce this requirement?

Accepted Answer

Azure role-based access control (RBAC). Azure RBAC allows you to assign specific roles (like 'Virtual Machine Contributor') to a security principal (e.g., the 'VM Operators' group) at a scope (the subscription). By granting the 'Virtual Machine Contributor' role only to the 'VM Operators' group and removing any built-in roles that allow VM creation from other users (including Owners), you can ensure that only that group can create VMs. This is the correct mechanism because RBAC is designed for fine-grained, role-based permission management.

Answer

Azure Policy with a deny effect

Answer

Azure Resource Lock at the subscription level

Answer

Azure Blueprints

Question 4

A multinational company has multiple Azure subscriptions for different business units. The central governance team wants to define a standardized environment that must be automatically applied to every new subscription. The standard must include a set of Azure Policy definitions (e.g., allowed regions), a specific Azure RBAC role assignment (e.g., a contributor access for a central security group), and a preconfigured resource group with a virtual network. The team wants to package all these components together so that they can be deployed consistently and updated centrally. Which Azure service should the team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the service designed to package together Azure Policy definitions, RBAC role assignments, and Azure Resource Manager templates (including resource groups and resources) into a single, versioned artifact that can be assigned to subscriptions. This enables organizations to enforce a consistent governance and compliance baseline across multiple subscriptions. Azure Policy alone cannot deploy RBAC assignments or resources. Azure Management Groups provide hierarchical organization and policy inheritance but do not deploy resources. ARM templates can deploy resources but cannot natively include policy or RBAC assignments as a cohesive package.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Manager templates

Question 5

A company has an Azure subscription that hosts multiple virtual machines, databases, and storage accounts. The finance team wants to receive an automated email notification when the forecasted monthly spending for the subscription exceeds $10,000. The team needs to use a native Azure feature that can track actual and forecasted costs and trigger alerts based on a monetary threshold. The solution must not require custom scripts or third-party tools. Which Azure feature should the team configure?

Accepted Answer

Azure Budgets. Azure Budgets is the correct native feature because it allows you to set a monetary threshold (e.g., $10,000) for forecasted or actual costs, and it can automatically trigger an email alert when that threshold is reached. It integrates directly with Azure Cost Management and requires no custom scripts or third-party tools, meeting the finance team's requirements exactly.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Resource Graph

Question 6

A company uses Azure for multiple projects. The IT governance team wants to ensure that every new Azure resource within a subscription is automatically assigned a 'CostCenter' tag based on the resource group it is created in. The team does not want to rely on users manually applying the tag. They need a built-in Azure solution that enforces this rule without custom scripts. Which Azure feature should they use?

Accepted Answer

Azure Policy with the 'Inherit a tag from the resource group if missing' effect. Azure Policy with the 'Inherit a tag from the resource group if missing' effect is correct because it automatically applies the 'CostCenter' tag from the resource group to any new resource created within that resource group, without requiring manual intervention or custom scripts. This built-in policy effect enforces governance rules at scale, ensuring compliance across the subscription.

Answer

Azure Resource Graph

Answer

Azure Management Groups

Answer

Azure Tags (manual tagging feature)

Question 7

A company has multiple Azure subscriptions used by different departments. The security team wants to enforce a requirement that all Azure Storage accounts in every subscription must be encrypted at rest using customer-managed keys (CMK). The solution must automatically evaluate existing and new storage accounts for compliance, and it must be able to automatically remediate non-compliant resources by enabling CMK encryption. The team wants to use a single, centralized Azure feature that can be assigned once and apply to all subscriptions. Which Azure feature should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct choice because it can enforce organizational standards and assess compliance across all Azure subscriptions from a single assignment. By using a built-in or custom policy definition that requires storage accounts to use customer-managed keys (CMK) for encryption at rest, Azure Policy can automatically evaluate both existing and new storage accounts. With the 'DeployIfNotExists' effect, it can also trigger remediation tasks to enable CMK encryption on non-compliant resources without manual intervention.

Answer

Azure Blueprints

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Security Center (Microsoft Defender for Cloud)

Question 8

A company has a production resource group that contains several Azure virtual machines and a SQL database. The company wants to ensure that no user can accidentally delete these resources, but authorized administrators must still be able to modify the configuration and update the resources. The company needs a straightforward governance feature that can be applied directly to the resource group and can be removed only by an authorized user with the Owner role. Which Azure feature should the company use?

Accepted Answer

A Delete lock on the resource group.. A Delete lock on the resource group prevents users from deleting the resource group and its resources, while still allowing authorized administrators with the Owner role to modify configurations and update resources. This lock can only be removed by a user with the Owner role, meeting the requirement for a straightforward governance feature applied directly to the resource group.

Answer

Azure Policy with a Deny effect to block resource deletions.

Answer

A Read-Only lock on the resource group.

Answer

An Azure RBAC role assignment that excludes the Delete action for all users.

Question 9

A company has deployed multiple Azure virtual machines for a production workload. The IT administrator wants a centralized list of prioritized recommendations to improve the security, high availability, and cost efficiency of the virtual machines. The administrator also wants to be able to view the potential impact of implementing each recommendation. Which Azure service should the administrator use?

Accepted Answer

Azure Advisor. Azure Advisor is the correct service because it provides a centralized, personalized list of best practice recommendations across five categories: Reliability, Security, Performance, Cost, and Operational Excellence. It specifically offers prioritized recommendations for Azure VMs with an 'Impact' column (High, Medium, Low) that indicates the potential effect of implementing each suggestion, directly matching the administrator's requirement for security, high availability, and cost efficiency improvements with impact visibility.

Answer

Azure Security Center

Answer

Azure Monitor

Answer

Azure Policy

Question 10

A company has a team of support engineers who need to be able to restart Azure virtual machines when they become unresponsive. The support engineers must not be able to modify the VM configuration, delete the VMs, or access VM data. The company wants to use the principle of least privilege. No built-in Azure role meets these exact requirements. What should the company do?

Accepted Answer

Create a custom role in Azure RBAC that includes only the 'Microsoft.Compute/virtualMachines/restart/action' permission and assign it to the support engineers.. It adheres to the principle of least privilege by creating a custom role that grants only the specific 'Microsoft.Compute/virtualMachines/restart/action' permission. This ensures support engineers can restart VMs without being able to modify configurations, delete VMs, or access data, which no built-in role provides.

Answer

Assign the support engineers the Virtual Machine Contributor built-in role.

Answer

Assign the support engineers the Owner built-in role on the resource group containing the VMs.

Answer

Configure an Azure Policy definition that allows only the restart operation on virtual machines.

Question 11

A company is adopting Azure and needs to deploy a standardized environment that includes a resource group, a virtual network with specific IP address ranges, and a set of Azure Policy definitions to restrict allowed deployment locations. The environment will be deployed to multiple subscriptions used by different departments. The company requires a repeatable, versioned package that defines the resources, policies, and role assignments as a single item. The solution must allow updates to be managed and enforced over time. Which Azure feature should the company use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it enables the orchestrated deployment of a standardized environment—including resource groups, virtual networks, Azure Policy definitions, and role assignments—as a single, versioned, and updatable package. Unlike ARM templates, Blueprints natively supports versioning, policy assignment, and role assignment as first-class artifacts, and it allows the blueprint to be assigned to multiple subscriptions while maintaining a central source of truth for updates and enforcement.

Answer

Azure Policy

Answer

ARM templates

Answer

Management groups

Question 12

A company uses multiple Azure subscriptions for different departments. The finance team wants to monitor spending across all subscriptions and receive automated email alerts when a subscription's actual spending reaches 80% of its monthly budget. The team does not want to write custom scripts or use external tools. Which Azure feature should they use?

Accepted Answer

Azure Cost Management + Budgets. Azure Cost Management + Budgets is the correct feature because it allows you to create budgets at the subscription or resource group level, set alert thresholds (e.g., 80% of actual spend), and configure automated email notifications when the threshold is met—all without custom scripts or external tools. This directly addresses the finance team's requirement to monitor spending across multiple subscriptions and receive alerts.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Resource Locks

Question 13

A large enterprise manages hundreds of Azure subscriptions. The compliance team needs to run an on-demand report that shows all virtual machines with their current power state (running or deallocated), operating system, and VM size, filtering by specific resource groups or subscriptions. The team wants to use a native Azure tool that allows querying Azure resources at scale using a Kusto Query Language (KQL) syntax. Which Azure service should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct choice because it is a native Azure service designed for querying Azure resources at scale using Kusto Query Language (KQL). It allows you to run on-demand, complex queries across multiple subscriptions, resource groups, and resource types, and can return properties such as power state, operating system, and VM size. This directly matches the compliance team's requirement for a scalable, KQL-based query tool that works across hundreds of subscriptions.

Answer

Azure Monitor Logs

Answer

Azure Resource Explorer

Answer

Azure Advisor

Question 14

A large enterprise manages hundreds of Azure subscriptions. The central governance team wants to ensure that every resource deployed across all subscriptions always has two required tags: 'Department' and 'CostCenter'. If a resource is created without these tags, the governance policy must automatically add the missing tags with placeholder values (e.g., 'Department: Unknown') and generate a compliance report. The team does not want to rely on user training or manual audits. Which Azure service should the team use to meet these requirements?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it can enforce tagging rules across all subscriptions in a management group. By using a policy definition with the 'modify' effect, Azure Policy can automatically add missing tags with placeholder values (e.g., 'Department: Unknown') during resource creation or at scale via remediation tasks. It also integrates with Azure Policy compliance reports to provide continuous governance without relying on user training or manual audits.

Answer

Azure Cost Management

Answer

Azure Blueprints

Answer

Azure Resource Groups

Question 15

A large enterprise manages Azure subscriptions for three business units: Sales, Research & Development, and Information Technology. Each business unit has its own Azure subscription. The central governance team needs to ensure that a specific set of Azure Policy definitions (e.g., restricting allowed regions to 'East US' only) is applied to all current and future subscriptions belonging to these three business units. The team wants to minimize administrative overhead and ensure that any new subscription created for a business unit automatically inherits the same policies. Which Azure feature should the team use to achieve this goal?

Accepted Answer

Create a management group for each business unit, place the corresponding subscription inside each management group, and assign the policy set to each management group.. Management groups provide a hierarchical structure above subscriptions, allowing Azure Policy assignments to be inherited by all subscriptions within a management group. By placing each business unit's subscription into its own management group and assigning the policy set (initiative) to each management group, the central governance team ensures that any current or future subscription under those management groups automatically inherits the policies, minimizing administrative overhead.

Answer

Assign each policy definition individually to every subscription.

Answer

Create a single resource group at the tenant root level and assign the policy definitions to that resource group.

Answer

Use Azure Blueprints to deploy a new subscription with the policies, then manually move each existing subscription into the blueprint's management group.