AZ-900 Describe Azure management and governance Practice Test 11 — 15 Questions

Question 1

A large enterprise manages hundreds of Azure subscriptions. The compliance team needs to run an on-demand report that shows all virtual machines with their current power state (running or deallocated), operating system, and VM size, filtering by specific resource groups or subscriptions. The team wants to use a native Azure tool that allows querying Azure resources at scale using a Kusto Query Language (KQL) syntax. Which Azure service should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct choice because it is a native Azure service designed for querying Azure resources at scale using Kusto Query Language (KQL). It allows you to run on-demand, complex queries across multiple subscriptions, resource groups, and resource types, and can return properties such as power state, operating system, and VM size. This directly matches the compliance team's requirement for a scalable, KQL-based query tool that works across hundreds of subscriptions.

Answer

Azure Monitor Logs

Answer

Azure Resource Explorer

Answer

Azure Advisor

Question 2

A large enterprise manages hundreds of Azure subscriptions. The central governance team wants to ensure that every resource deployed across all subscriptions always has two required tags: 'Department' and 'CostCenter'. If a resource is created without these tags, the governance policy must automatically add the missing tags with placeholder values (e.g., 'Department: Unknown') and generate a compliance report. The team does not want to rely on user training or manual audits. Which Azure service should the team use to meet these requirements?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it can enforce tagging rules across all subscriptions in a management group. By using a policy definition with the 'modify' effect, Azure Policy can automatically add missing tags with placeholder values (e.g., 'Department: Unknown') during resource creation or at scale via remediation tasks. It also integrates with Azure Policy compliance reports to provide continuous governance without relying on user training or manual audits.

Answer

Azure Cost Management

Answer

Azure Blueprints

Answer

Azure Resource Groups

Question 3

A large enterprise manages Azure subscriptions for three business units: Sales, Research & Development, and Information Technology. Each business unit has its own Azure subscription. The central governance team needs to ensure that a specific set of Azure Policy definitions (e.g., restricting allowed regions to 'East US' only) is applied to all current and future subscriptions belonging to these three business units. The team wants to minimize administrative overhead and ensure that any new subscription created for a business unit automatically inherits the same policies. Which Azure feature should the team use to achieve this goal?

Accepted Answer

Create a management group for each business unit, place the corresponding subscription inside each management group, and assign the policy set to each management group.. Option B is correct because management groups provide a hierarchical structure above subscriptions, allowing Azure Policy assignments to be inherited by all subscriptions within a management group. By placing each business unit's subscription into its own management group and assigning the policy set (initiative) to each management group, the central governance team ensures that any current or future subscription under those management groups automatically inherits the policies, minimizing administrative overhead.

Answer

Assign each policy definition individually to every subscription.

Answer

Create a single resource group at the tenant root level and assign the policy definitions to that resource group.

Answer

Use Azure Blueprints to deploy a new subscription with the policies, then manually move each existing subscription into the blueprint's management group.

Question 4

A company runs a critical line-of-business application on Azure virtual machines. The operations team needs to receive proactive notifications about any upcoming planned maintenance events that could affect their virtual machines, as well as real-time alerts when a service incident occurs in the Azure region where the application is deployed. The team wants a native Azure solution that provides a personalized view of all service health events relevant to their subscriptions, including historical incident reports. Which Azure service should the operations team use?

Accepted Answer

Azure Service Health. Azure Service Health provides a personalized dashboard of service health events, including planned maintenance notifications, real-time service incident alerts, and historical reports, all scoped to the user's subscriptions. This makes it the correct native Azure solution for the operations team's requirements.

Answer

Azure Monitor

Answer

Azure Advisor

Answer

Azure Status Page (status.azure.com)

Question 5

A company has a policy that every Azure virtual machine must have the Azure Monitor Agent installed and configured to send metrics to a central Log Analytics workspace. To enforce this requirement without relying on manual user action, the governance team wants to automatically deploy the agent to any existing or new VM that is missing it. They also need to generate a compliance report showing any VMs where the installation failed. Which Azure Policy effect should the team use to meet these requirements?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it automatically deploys the Azure Monitor Agent to any VM that does not have it, and it can trigger remediation tasks to enforce compliance. This effect also supports generating compliance reports by evaluating the deployment status and flagging VMs where the installation failed, meeting both the automatic deployment and reporting requirements without manual intervention.

Answer

AuditIfNotExists

Answer

Deny

Answer

Modify

Question 6

A company wants to enforce a governance policy that only allows virtual machines of the SKU 'Standard_DS2_v2' to be deployed in their Azure subscription. If a user attempts to create a virtual machine with a different SKU (e.g., 'Standard_D2s_v3'), the deployment must be immediately rejected with an error, and the resource must not be created. Which Azure Policy effect should the team use to implement this requirement?

Accepted Answer

Deny. The Deny effect is the correct choice because it actively prevents the creation or deployment of resources that do not comply with the policy rule. In this scenario, when a user attempts to deploy a virtual machine with a SKU other than 'Standard_DS2_v2', the Deny effect immediately rejects the request and blocks the resource from being created, ensuring the governance policy is enforced without exception.

Answer

Append

Answer

Audit

Answer

DeployIfNotExists

Question 7

A large enterprise manages multiple Azure subscriptions for different business units. The central governance team wants to deploy a consistent landing zone across all subscriptions. The landing zone must include pre-defined Azure Policy definitions (e.g., allowed locations, allowed VM SKUs), standard RBAC role assignments (e.g., Owner, Contributor for specific security groups), and a predefined resource group structure (e.g., 'Networking', 'Security', 'Workloads'). The team wants a single, versioned artifact that can be assigned to any subscription to apply all these configurations together, with the ability to update the artifact and have changes propagate to existing assignments. Which Azure service should the team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it is designed to orchestrate the deployment of a consistent environment by packaging together Azure Policy definitions, RBAC role assignments, and resource groups into a single, versioned artifact. When the blueprint is updated and published, existing assignments can be updated to the latest version, ensuring changes propagate across all subscriptions.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Graph

Question 8

A company has a policy that all Azure resources must have a 'CostCenter' tag. The governance team wants to identify any resources that are missing the tag without preventing their creation. They need a compliance report generated automatically showing all non-compliant resources. Which Azure Policy effect should they use?

Accepted Answer

audit. The 'audit' effect is correct because it allows the company to monitor and report on resources that are missing the 'CostCenter' tag without blocking their creation. Azure Policy's audit effect logs a compliance event in the activity log for non-compliant resources, which can then be used to generate automatic compliance reports via Azure Policy's compliance dashboard or exported to Log Analytics. This meets the requirement of identifying non-compliant resources while not preventing their deployment.

Answer

deny

Answer

deployIfNotExists

Answer

append

Question 9

A company has an Azure subscription with hundreds of existing virtual machines. The governance team wants to enforce a policy that every virtual machine must have a tag named 'CostCenter' with a valid value. The team wants to automatically add the 'CostCenter' tag with a default value of 'Undefined' to any existing or new virtual machine that is missing the tag. They do not want to block the creation of virtual machines that are missing the tag, but they do want the tag to be added automatically within a few minutes of detection. Which Azure Policy effect should the team use?

Accepted Answer

Modify. The Modify effect is correct because it can automatically add or change tags on existing and new resources without blocking creation. Unlike Append, which only works during resource creation and cannot modify existing resources, Modify uses a 'remediation' task to fix non-compliant resources after they are created, aligning with the requirement to add the tag within minutes of detection.

Answer

Audit

Answer

Deny

Answer

Append

Question 10

A company has 10 Azure subscriptions organized under two management groups: Production and Non-Production. The governance team needs to enforce a policy that all Azure resources must be deployed only in the East US or West US Azure regions. The policy must apply to every subscription under both management groups, including any new subscriptions added in the future, without requiring separate assignments per subscription. Which Azure feature should the team use to achieve this with the least administrative effort?

Accepted Answer

Assign the 'Allowed Locations' Azure Policy definition to the root management group.. Assigning the 'Allowed Locations' Azure Policy definition to the root management group ensures the policy is inherited by all child management groups (Production and Non-Production) and all subscriptions under them, including any new subscriptions added in the future. This approach requires only a single assignment and minimizes administrative effort compared to per-subscription assignments.

Answer

Assign the 'Allowed Locations' Azure Policy definition to each individual subscription.

Answer

Create a custom Azure RBAC role that restricts the region property and assign it to all users.

Answer

Apply an Azure Resource Manager read-only lock to each subscription.

Question 11

A company has a critical resource group named 'Prod-Databases' that contains Azure SQL databases and virtual machines used by a production order-processing system. The database administrator wants to prevent any user, including administrators, from accidentally deleting or modifying resources in this resource group. The operations team needs a safeguard that requires an explicit action to be taken before any changes become possible, without affecting the ability to manage resources in other resource groups. Which Azure feature should the team implement?

Accepted Answer

Azure Resource Lock (CanNotDelete). Option C is correct because Azure Resource Locks provide a safeguard that prevents accidental deletion or modification of critical resources at the subscription, resource group, or individual resource level. The CanNotDelete lock specifically blocks delete operations while allowing all read and update operations, and it requires an explicit unlock action before any changes can be made, even by administrators. This meets the requirement of protecting the 'Prod-Databases' resource group without affecting other resource groups.

Answer

Azure Policy with the Deny effect

Answer

Azure RBAC role assignment (e.g., restrict to Reader role)

Answer

Azure management group

Question 12

A company's finance team wants to proactively monitor Azure spending and receive automated email notifications when costs reach 80% of a predefined monthly limit. They want to avoid manual cost tracking and set up alerts without custom scripting. Which Azure feature should they use?

Accepted Answer

Create a budget in Azure Cost Management with an alert at 80% of the budget amount.. Azure Cost Management budgets allow you to set a spending limit and configure alert thresholds (e.g., 80%) that trigger automated email notifications when costs reach that percentage. This meets the finance team's requirement for proactive monitoring without custom scripting or manual tracking.

Answer

Use Azure Advisor cost recommendations and configure an alert on the recommendations.

Answer

Configure an Azure Policy with a deny effect to block any spending that exceeds the monthly limit.

Answer

Use the Azure Pricing Calculator to estimate costs and set a manual reminder to check the Azure portal each month.

Question 13

A company manages 50 Azure subscriptions that contain thousands of resources. The DevOps team needs to identify all virtual machines that are tagged with 'Environment: Production' across all subscriptions. They need a single query that returns the VM name, resource group, and location for every such VM. The team does not want to write PowerShell commands or loop through each subscription manually. Which Azure service should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph (ARG) is the correct service because it enables efficient, cross-subscription querying of Azure resources using the Kusto Query Language (KQL). With a single ARG query, the DevOps team can filter all virtual machines tagged with 'Environment: Production' across all 50 subscriptions and project only the VM name, resource group, and location, without needing to loop through subscriptions or write PowerShell scripts.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Resource Manager

Question 14

A company has a management group hierarchy with a root management group that contains all subscriptions. The governance team assigns a built-in Azure Policy initiative 'Allowed Locations' to the root management group with the 'Deny' effect, restricting resource deployment to East US and West US only. After six months, a new regulatory requirement forces the marketing department's subscription (placed under the root) to deploy resources in North Europe for a specific pilot project. The governance team must allow this exception without changing the original policy assignment and without allowing any other subscription to deploy to North Europe. What should the governance team do?

Accepted Answer

Create an Azure Policy exemption for the marketing subscription with 'Exempt' category and specify the policy definition and effect to be excluded.. Option C is correct because Azure Policy exemptions allow you to exclude a specific scope from the effect of a policy assignment without modifying the original assignment. By creating an exemption with the 'Exempt' category on the marketing subscription, the governance team can allow resource deployment to North Europe for that subscription only, while the 'Deny' effect remains enforced for all other subscriptions under the root management group.

Answer

Create a new Azure Policy assignment at the marketing subscription scope with the 'Allowed Locations' initiative set to 'Audit' instead of 'Deny' and include North Europe in the allowed list.

Answer

Create an Azure Blueprint that includes the 'Allowed Locations' policy and assign it to the marketing subscription.

Answer

Assign a custom RBAC role to the marketing subscription that bypasses the policy.

Question 15

A multinational corporation must ensure that every new Azure subscription automatically conforms to corporate security and compliance baselines. The team wants to deploy a predefined set of Azure resources (e.g., a central logging storage account, a network security group configuration) and apply a standard set of Azure Policy definitions (e.g., restricting allowed VM sizes, enforcing encryption) to any new subscription. They want to manage these as a single, versioned package that can be updated and re-assigned to existing subscriptions. Which Azure service should they use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the service that enables the orchestrated deployment of resource templates (such as ARM templates) and policy assignments as a single, versioned package. It allows organizations to define a repeatable set of Azure resources and policies that can be applied to new or existing subscriptions to ensure consistency and compliance. Azure Policy alone can enforce rules but cannot deploy resources. Azure Management Groups only organize subscriptions for hierarchical management. Azure Resource Manager templates can deploy resources but cannot natively enforce policies or be versioned as a governance package in the same way as Blueprints.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Manager templates