AZ-900 Describe Azure management and governance Practice Test 12 — 15 Questions

Question 1

A large enterprise manages Azure subscriptions for three business units: Sales, Research & Development, and Information Technology. Each business unit has its own Azure subscription. The central governance team needs to ensure that a specific set of Azure Policy definitions (e.g., restricting allowed regions to 'East US' only) is applied to all current and future subscriptions belonging to these three business units. The team wants to minimize administrative overhead and ensure that any new subscription created for a business unit automatically inherits the same policies. Which Azure feature should the team use to achieve this goal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a management group for each business unit, place the corresponding subscription inside each management group, and assign the policy set to each management group.. Management groups provide a hierarchical structure above subscriptions, allowing Azure Policy assignments to be inherited by all subscriptions within a management group. By placing each business unit's subscription into its own management group and assigning the policy set (initiative) to each management group, the central governance team ensures that any current or future subscription under those management groups automatically inherits the policies, minimizing administrative overhead.

Answer

Assign each policy definition individually to every subscription.

Answer

Create a single resource group at the tenant root level and assign the policy definitions to that resource group.

Answer

Use Azure Blueprints to deploy a new subscription with the policies, then manually move each existing subscription into the blueprint's management group.

Question 2

A company runs a critical line-of-business application on Azure virtual machines. The operations team needs to receive proactive notifications about any upcoming planned maintenance events that could affect their virtual machines, as well as real-time alerts when a service incident occurs in the Azure region where the application is deployed. The team wants a native Azure solution that provides a personalized view of all service health events relevant to their subscriptions, including historical incident reports. Which Azure service should the operations team use?

Accepted Answer

Azure Service Health. Azure Service Health provides a personalized dashboard of service health events, including planned maintenance notifications, real-time service incident alerts, and historical reports, all scoped to the user's subscriptions. This makes it the correct native Azure solution for the operations team's requirements.

Answer

Azure Monitor

Answer

Azure Advisor

Answer

Azure Status Page (status.azure.com)

Question 3

A company has a policy that every Azure virtual machine must have the Azure Monitor Agent installed and configured to send metrics to a central Log Analytics workspace. To enforce this requirement without relying on manual user action, the governance team wants to automatically deploy the agent to any existing or new VM that is missing it. They also need to generate a compliance report showing any VMs where the installation failed. Which Azure Policy effect should the team use to meet these requirements?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it automatically deploys the Azure Monitor Agent to any VM that does not have it, and it can trigger remediation tasks to enforce compliance. This effect also supports generating compliance reports by evaluating the deployment status and flagging VMs where the installation failed, meeting both the automatic deployment and reporting requirements without manual intervention.

Answer

AuditIfNotExists

Answer

Deny

Answer

Modify

Question 4

A company wants to enforce a governance policy that only allows virtual machines of the SKU 'Standard_DS2_v2' to be deployed in their Azure subscription. If a user attempts to create a virtual machine with a different SKU (e.g., 'Standard_D2s_v3'), the deployment must be immediately rejected with an error, and the resource must not be created. Which Azure Policy effect should the team use to implement this requirement?

Accepted Answer

Deny. The Deny effect is the correct choice because it actively prevents the creation or deployment of resources that do not comply with the policy rule. In this scenario, when a user attempts to deploy a virtual machine with a SKU other than 'Standard_DS2_v2', the Deny effect immediately rejects the request and blocks the resource from being created, ensuring the governance policy is enforced without exception.

Answer

Append

Answer

Audit

Answer

DeployIfNotExists

Question 5

A large enterprise manages multiple Azure subscriptions for different business units. The central governance team wants to deploy a consistent landing zone across all subscriptions. The landing zone must include pre-defined Azure Policy definitions (e.g., allowed locations, allowed VM SKUs), standard RBAC role assignments (e.g., Owner, Contributor for specific security groups), and a predefined resource group structure (e.g., 'Networking', 'Security', 'Workloads'). The team wants a single, versioned artifact that can be assigned to any subscription to apply all these configurations together, with the ability to update the artifact and have changes propagate to existing assignments. Which Azure service should the team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it is designed to orchestrate the deployment of a consistent environment by packaging together Azure Policy definitions, RBAC role assignments, and resource groups into a single, versioned artifact. When the blueprint is updated and published, existing assignments can be updated to the latest version, ensuring changes propagate across all subscriptions.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Graph

Question 6

A company has a policy that all Azure resources must have a 'CostCenter' tag. The governance team wants to identify any resources that are missing the tag without preventing their creation. They need a compliance report generated automatically showing all non-compliant resources. Which Azure Policy effect should they use?

Accepted Answer

audit. The 'audit' effect is correct because it allows the company to monitor and report on resources that are missing the 'CostCenter' tag without blocking their creation. Azure Policy's audit effect logs a compliance event in the activity log for non-compliant resources, which can then be used to generate automatic compliance reports via Azure Policy's compliance dashboard or exported to Log Analytics. This meets the requirement of identifying non-compliant resources while not preventing their deployment.

Answer

deny

Answer

deployIfNotExists

Answer

append

Question 7

A company has an Azure subscription with hundreds of existing virtual machines. The governance team wants to enforce a policy that every virtual machine must have a tag named 'CostCenter' with a valid value. The team wants to automatically add the 'CostCenter' tag with a default value of 'Undefined' to any existing or new virtual machine that is missing the tag. They do not want to block the creation of virtual machines that are missing the tag, but they do want the tag to be added automatically within a few minutes of detection. Which Azure Policy effect should the team use?

Accepted Answer

Modify. The Modify effect is correct because it can automatically add or change tags on existing and new resources without blocking creation. Unlike Append, which only works during resource creation and cannot modify existing resources, Modify uses a 'remediation' task to fix non-compliant resources after they are created, aligning with the requirement to add the tag within minutes of detection.

Answer

Audit

Answer

Deny

Answer

Append

Question 8

A company has 10 Azure subscriptions organized under two management groups: Production and Non-Production. The governance team needs to enforce a policy that all Azure resources must be deployed only in the East US or West US Azure regions. The policy must apply to every subscription under both management groups, including any new subscriptions added in the future, without requiring separate assignments per subscription. Which Azure feature should the team use to achieve this with the least administrative effort?

Accepted Answer

Assign the 'Allowed Locations' Azure Policy definition to the root management group.. Assigning the 'Allowed Locations' Azure Policy definition to the root management group ensures the policy is inherited by all child management groups (Production and Non-Production) and all subscriptions under them, including any new subscriptions added in the future. This approach requires only a single assignment and minimizes administrative effort compared to per-subscription assignments.

Answer

Assign the 'Allowed Locations' Azure Policy definition to each individual subscription.

Answer

Create a custom Azure RBAC role that restricts the region property and assign it to all users.

Answer

Apply an Azure Resource Manager read-only lock to each subscription.

Question 9

A company's finance team wants to proactively monitor Azure spending and receive automated email notifications when costs reach 80% of a predefined monthly limit. They want to avoid manual cost tracking and set up alerts without custom scripting. Which Azure feature should they use?

Accepted Answer

Create a budget in Azure Cost Management with an alert at 80% of the budget amount.. Azure Cost Management budgets allow you to set a spending limit and configure alert thresholds (e.g., 80%) that trigger automated email notifications when costs reach that percentage. This meets the finance team's requirement for proactive monitoring without custom scripting or manual tracking.

Answer

Use Azure Advisor cost recommendations and configure an alert on the recommendations.

Answer

Configure an Azure Policy with a deny effect to block any spending that exceeds the monthly limit.

Answer

Use the Azure Pricing Calculator to estimate costs and set a manual reminder to check the Azure portal each month.

Question 10

A company manages 50 Azure subscriptions that contain thousands of resources. The DevOps team needs to identify all virtual machines that are tagged with 'Environment: Production' across all subscriptions. They need a single query that returns the VM name, resource group, and location for every such VM. The team does not want to write PowerShell commands or loop through each subscription manually. Which Azure service should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph (ARG) is the correct service because it enables efficient, cross-subscription querying of Azure resources using the Kusto Query Language (KQL). With a single ARG query, the DevOps team can filter all virtual machines tagged with 'Environment: Production' across all 50 subscriptions and project only the VM name, resource group, and location, without needing to loop through subscriptions or write PowerShell scripts.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Resource Manager

Question 11

A multinational corporation must ensure that every new Azure subscription automatically conforms to corporate security and compliance baselines. The team wants to deploy a predefined set of Azure resources (e.g., a central logging storage account, a network security group configuration) and apply a standard set of Azure Policy definitions (e.g., restricting allowed VM sizes, enforcing encryption) to any new subscription. They want to manage these as a single, versioned package that can be updated and re-assigned to existing subscriptions. Which Azure service should they use?

Accepted Answer

Azure Blueprints. Azure Blueprints is designed to package resource templates (ARM templates), policy assignments, role assignments, and resource groups into a single versioned artifact that can be assigned to subscriptions. It supports updating the blueprint and re-publishing versions, then re-assigning to existing subscriptions, which matches the requirement for a versioned, re-assignable governance package. Azure Policy alone cannot deploy resources, and ARM templates alone cannot bundle policy definitions with resource deployments in a managed, versioned way.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Manager templates

Question 12

A retail company has 50 on-premises servers in multiple branch offices that run legacy applications that cannot be migrated to Azure. The company wants to govern these servers using the same Azure Policy and tagging standards that they use for their Azure virtual machines. They also want to view these servers alongside Azure resources in the Azure portal. Which Azure service should they deploy to extend Azure management capabilities to these on-premises servers?

Accepted Answer

Azure Arc. Azure Arc is the correct service because it extends Azure Resource Manager (ARM) control plane to on-premises servers, allowing them to be projected as Azure resources. This enables you to apply Azure Policy and tagging standards to these servers and view them alongside Azure VMs in the Azure portal, even though the legacy applications cannot be migrated.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Manager

Question 13

A company uses Azure for multiple workloads. The finance team wants to identify virtual machines that are consistently underutilized (average CPU usage below 5%) so they can reduce costs by resizing or shutting down those VMs. They want a built-in Azure tool that automatically analyzes resource usage and provides actionable recommendations. Which Azure service should they use?

Accepted Answer

Azure Advisor. Azure Advisor is the correct service because it is a built-in Azure tool that automatically analyzes resource usage and provides actionable recommendations to optimize costs, including identifying underutilized virtual machines. It specifically evaluates CPU usage patterns and suggests resizing or shutting down VMs with consistently low utilization (e.g., average CPU below 5%) to reduce costs without manual intervention.

Answer

Azure Monitor

Answer

Azure Cost Management

Answer

Azure Policy

Question 14

A company has a policy that every Azure resource must have a 'CostCenter' tag assigned at creation time. The governance team wants to automatically prevent any resource creation if the tag is missing, without requiring manual review after deployment. Which Azure feature should they use to enforce this requirement?

Accepted Answer

Azure Policy. Azure Policy is correct because it enables the enforcement of organizational standards by evaluating resources against custom or built-in policies at creation time. In this scenario, a policy can be configured with a 'deny' effect to automatically block any resource deployment that lacks the required 'CostCenter' tag, preventing non-compliant resources from being created without manual intervention.

Answer

Azure Blueprints

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Tags

Question 15

A company has several Azure subscriptions that contain hundreds of virtual machines. A new corporate standard requires that all VMs must use Azure managed disks instead of unmanaged disks. The governance team needs to automatically identify existing VMs with unmanaged disks and convert them to managed disks without requiring manual intervention for each VM. The team also wants to ensure that any new VMs created in the future automatically use managed disks. Which Azure feature should they use to meet both requirements?

Accepted Answer

Azure Policy with the DeployIfNotExists effect (with remediation). Azure Policy with the DeployIfNotExists effect can automatically identify VMs using unmanaged disks and, when combined with remediation tasks, convert them to managed disks without manual intervention. It also enforces that any new VMs are created with managed disks by evaluating and automatically deploying the required configuration at creation time. This meets both the identification/conversion of existing resources and the enforcement for future resources.

Answer

Azure Blueprints

Answer

Azure Resource Manager (ARM) templates

Answer

Azure Cost Management + Budgets