AZ-900 Describe Azure management and governance Practice Test 12 — 15 Questions

Question 1

A retail company has 50 on-premises servers in multiple branch offices that run legacy applications that cannot be migrated to Azure. The company wants to govern these servers using the same Azure Policy and tagging standards that they use for their Azure virtual machines. They also want to view these servers alongside Azure resources in the Azure portal. Which Azure service should they deploy to extend Azure management capabilities to these on-premises servers?

Accepted Answer

Azure Arc. Azure Arc is the correct service because it extends Azure Resource Manager (ARM) control plane to on-premises servers, allowing them to be projected as Azure resources. This enables you to apply Azure Policy and tagging standards to these servers and view them alongside Azure VMs in the Azure portal, even though the legacy applications cannot be migrated.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Manager

Question 2

A company uses Azure for multiple workloads. The finance team wants to identify virtual machines that are consistently underutilized (average CPU usage below 5%) so they can reduce costs by resizing or shutting down those VMs. They want a built-in Azure tool that automatically analyzes resource usage and provides actionable recommendations. Which Azure service should they use?

Accepted Answer

Azure Advisor. Azure Advisor is the correct service because it is a built-in Azure tool that automatically analyzes resource usage and provides actionable recommendations to optimize costs, including identifying underutilized virtual machines. It specifically evaluates CPU usage patterns and suggests resizing or shutting down VMs with consistently low utilization (e.g., average CPU below 5%) to reduce costs without manual intervention.

Answer

Azure Monitor

Answer

Azure Cost Management

Answer

Azure Policy

Question 3

A company has a root management group that contains two child management groups: Production and Development. Each child management group contains several subscriptions. The security team assigns a built-in Azure Policy definition with the 'Deny' effect to the Production management group to enforce encryption on all storage accounts. Later, the Development team requests that storage accounts in their subscriptions must not be encrypted because they host temporary test data that needs to be quickly deleted and recreated. The security team must allow this exception for Development only, without changing the policy for Production. What should the security team do?

Accepted Answer

Create an Azure Policy exemption for the Development management group with the 'Mitigated' category.. Option D is correct because Azure Policy exemptions allow specific scopes (like the Development management group) to be excluded from a policy assignment's effect without modifying the original assignment. The 'Mitigated' category is used when a policy's intent is addressed by another method or when an exception is justified, such as for temporary test data that requires no encryption. This preserves the Deny effect for Production while permitting Development to have unencrypted storage accounts.

Answer

Assign a new policy with the 'Audit' effect at the Development management group to override the Deny effect.

Answer

Remove the policy assignment from the root management group and assign it individually to each Production subscription.

Answer

Create an Azure RBAC role assignment that grants the Development team permission to bypass the policy.

Question 4

A company has a policy that every Azure resource must have a 'CostCenter' tag assigned at creation time. The governance team wants to automatically prevent any resource creation if the tag is missing, without requiring manual review after deployment. Which Azure feature should they use to enforce this requirement?

Accepted Answer

Azure Policy. Azure Policy is correct because it enables the enforcement of organizational standards by evaluating resources against custom or built-in policies at creation time. In this scenario, a policy can be configured with a 'deny' effect to automatically block any resource deployment that lacks the required 'CostCenter' tag, preventing non-compliant resources from being created without manual intervention.

Answer

Azure Blueprints

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Tags

Question 5

A company has several Azure subscriptions that contain hundreds of virtual machines. A new corporate standard requires that all VMs must use Azure managed disks instead of unmanaged disks. The governance team needs to automatically identify existing VMs with unmanaged disks and convert them to managed disks without requiring manual intervention for each VM. The team also wants to ensure that any new VMs created in the future automatically use managed disks. Which Azure feature should they use to meet both requirements?

Accepted Answer

Azure Policy with the DeployIfNotExists effect (with remediation). Azure Policy with the DeployIfNotExists effect can automatically identify VMs using unmanaged disks and, when combined with remediation tasks, convert them to managed disks without manual intervention. It also enforces that any new VMs are created with managed disks by evaluating and automatically deploying the required configuration at creation time. This meets both the identification/conversion of existing resources and the enforcement for future resources.

Answer

Azure Blueprints

Answer

Azure Resource Manager (ARM) templates

Answer

Azure Cost Management + Budgets

Question 6

A company has an Azure subscription with multiple resource groups. The governance team wants to ensure that every new resource created in the subscription automatically receives a 'Department' tag with a default value of 'Finance' if the creator did not specify one. The team wants the tag to be applied without blocking the creation of the resource. Which Azure feature should they use?

Accepted Answer

Azure Policy with the 'Append' effect. Azure Policy with the 'Append' effect is the correct choice because it adds the 'Department' tag with a default value of 'Finance' to a resource during creation or update, without blocking the operation. Unlike 'Deny', which prevents non-compliant resources, 'Append' modifies the resource request to include the missing tag, ensuring compliance without interrupting the creation process.

Answer

Azure Policy with the 'Deny' effect

Answer

Azure Resource Lock

Answer

Azure role-based access control (RBAC) with a custom role

Question 7

A multinational company has 10 Azure subscriptions, each managed by a different department. The central governance team wants to deploy a standardized environment that includes a specific network topology (virtual network, subnets, and network security groups), a set of Azure Policy definitions to enforce tagging and encryption, and a role assignment granting the 'Reader' role to a central security team in every subscription. The team must be able to update this standard definition in one place, and any changes should automatically apply to all existing deployments that were created from the definition. Which Azure service should they use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it enables the central governance team to define a repeatable, versioned environment that includes network topology, Azure Policy definitions, and role assignments. Blueprints support versioning and automatic updates: when a blueprint is updated and published, existing blueprint assignments can be upgraded to apply the new definitions to all deployed resources, ensuring consistency across all 10 subscriptions.

Answer

Azure Policy

Answer

Azure Resource Manager (ARM) templates

Answer

Azure Management Groups

Question 8

A company has a critical production resource group that contains several virtual machines and an Azure SQL Database. The IT manager wants to prevent anyone from accidentally deleting the resource group or any of its resources. However, authorized administrators must still be able to add, update, or delete individual resources within the group (except deletion of the group itself). Which Azure feature should the manager apply to the resource group?

Accepted Answer

Apply a CanNotDelete lock on the resource group.. Option C is correct because a CanNotDelete lock on the resource group prevents deletion of the group itself while still allowing authorized administrators to add, update, or delete individual resources within the group. This lock type specifically blocks delete operations on the locked scope, but does not restrict read, write, or other management operations, aligning perfectly with the requirement to protect the resource group from accidental deletion while permitting ongoing resource management.

Answer

Apply an Azure Policy with the 'Deny' effect to prevent all operations on the resource group.

Answer

Apply a Read-Only lock on the resource group.

Answer

Remove the Contributor role from all users and assign the Owner role to the IT manager only.

Question 9

A company has multiple Azure subscriptions, each belonging to a different department. The finance department wants to set spending limits per subscription and receive automated email notifications whenever actual spending reaches 80% of the allocated budget. Which Azure feature should they configure?

Accepted Answer

Azure Budgets. Azure Budgets is the correct feature because it allows you to set spending limits (budgets) on Azure subscriptions or resource groups and configure alerts that trigger automated email notifications when actual spending reaches a specified threshold, such as 80% of the allocated budget. This directly meets the finance department's requirement for per-subscription spending limits and proactive notifications.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Resource Graph

Question 10

A company's security policy requires that all Azure Storage accounts must enforce a minimum TLS version of 1.2. The governance team needs to continuously audit all existing storage accounts for compliance with this requirement, and also ensure that any new storage account that does not meet the TLS version requirement is automatically flagged as non-compliant in the Azure portal compliance dashboard. The team does not want to block the creation of non-compliant resources; they only need to report them. Which Azure feature should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct choice because it can continuously audit existing Azure resources and evaluate new resources against a defined policy rule—in this case, requiring a minimum TLS version of 1.2 on all storage accounts. It can be configured in audit-only mode, which flags non-compliant resources in the Azure portal compliance dashboard without blocking their creation, exactly matching the team's requirement to report rather than deny.

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Blueprints

Answer

Azure Locks

Question 11

A company has a single Azure subscription that contains resource groups for several business units. The company's compliance team wants to enforce a rule: no virtual network (VNet) can be deployed in any resource group unless the VNet is in a specific allowed region (West Europe). The rule must also block the creation of VNets in disallowed regions, but the team must be able to selectively exempt certain resource groups (e.g., for disaster recovery testing) without altering the underlying rule definition. Which Azure feature should the compliance team implement?

Accepted Answer

Azure Policy with the 'Deny' effect assigned to the subscription, and create policy exemptions for the resource groups that need to deploy VNets in other regions.. Azure Policy with the 'Deny' effect can enforce a rule at the subscription scope that blocks VNet creation in disallowed regions. Policy exemptions allow specific resource groups to be excluded from the policy without modifying the original rule definition, meeting the compliance team's requirement for selective exemption.

Answer

Azure role-based access control (RBAC) by creating a custom role that restricts the 'Microsoft.Network/virtualNetworks/write' action to only the West Europe region, and assign that role to all users.

Answer

A resource lock on each resource group that prevents the creation of any resource in disallowed regions.

Answer

Azure Blueprints by defining a blueprint that only includes VNets in West Europe and assigning it to all resource groups.

Question 12

A multinational company uses Azure management groups to organize its subscriptions. The company has a root management group (tenant root group) containing three child management groups: 'Finance', 'HR', and 'IT'. Each child management group contains multiple subscriptions. The global governance team needs to enforce an Azure Policy that restricts all resource deployments across every subscription in the organization to only the 'West US' and 'East US' regions. The policy must automatically apply to any new subscriptions that are created under any management group in the future. The team wants to assign the policy once and have it affect all current and future subscriptions with minimal administrative overhead. At which Azure scope should the team assign the policy?

Accepted Answer

The root management group. Assigning the policy to the root management group ensures it is inherited by all child management groups (Finance, HR, IT) and their subscriptions, including any new subscriptions created in the future. This approach enforces the allowed regions policy across the entire tenant with a single assignment, minimizing administrative overhead. Azure Policy inheritance flows from the root management group down through all levels of the hierarchy.

Answer

Each subscription individually

Answer

Each child management group (Finance, HR, IT) individually

Answer

A single resource group

Question 13

A company has a production Azure subscription used by multiple teams. The governance team wants to enforce a rule that only virtual machines (VMs) of specific SKU sizes (e.g., Standard_D2s_v3 and Standard_D4s_v3) can be deployed. If a team attempts to deploy a VM of a different SKU size, the deployment must be blocked immediately and the user must see an error message explaining the restriction. Which Azure feature should the governance team use?

Accepted Answer

Azure Policy with the 'Deny' effect. Azure Policy with the 'Deny' effect is the correct choice because it allows the governance team to define and enforce rules that prevent the deployment of non-compliant resources, such as VMs with disallowed SKU sizes. When a policy with the 'Deny' effect is assigned, any attempt to create or update a resource that violates the policy is blocked immediately, and the user receives a clear error message explaining the restriction. This is the only Azure feature that provides proactive, resource-level enforcement with a built-in denial mechanism.

Answer

Azure Role-Based Access Control (RBAC) with a custom role that denies the 'Microsoft.Compute/virtualMachines/write' action

Answer

Azure Blueprints with a resource lock

Answer

Azure resource locks at the resource group level

Question 14

A company manages multiple Azure subscriptions for development, testing, and production environments. The governance team needs to ensure that every new subscription automatically includes a consistent baseline consisting of Azure Policy definitions, role assignments, and a predefined resource group structure. The team wants to package these governance components into a single deployable artifact that can be applied to any subscription with minimal manual effort. Which Azure feature should the team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it is specifically designed to orchestrate the deployment of a consistent baseline—including Azure Policy definitions, role assignments, and resource groups—as a single, versioned, and repeatable artifact. Unlike other tools, Blueprints packages these governance components together and can be applied to any subscription with minimal manual effort, ensuring every new subscription automatically inherits the defined baseline.

Answer

Azure Policy

Answer

Azure Resource Manager (ARM) templates

Answer

Azure Management Groups

Question 15

A company uses Azure Policy to enforce governance rules across its subscriptions. The governance team wants to ensure that every resource in the 'Production' subscription has a tag named 'Environment' with the value 'Production'. If a resource is created without this tag, or with a different value, the tag must be automatically corrected to 'Production' without blocking the creation of the resource. Which Azure Policy effect should the team configure?

Accepted Answer

Modify. The Modify effect is correct because it automatically applies the required tag value to resources during creation or update without blocking the operation. Unlike Append, which only adds tags to new resources but cannot change existing values, Modify can alter both new and existing resources to enforce the desired tag value. This ensures that any resource created without the 'Environment' tag or with a different value is automatically corrected to 'Production'.

Answer

Deny

Answer

Audit

Answer

Append