AZ-900 Describe Azure management and governance Practice Test 13 — 15 Questions

Question 1

A multinational company has 10 Azure subscriptions, each managed by a different department. The central governance team wants to deploy a standardized environment that includes a specific network topology (virtual network, subnets, and network security groups), a set of Azure Policy definitions to enforce tagging and encryption, and a role assignment granting the 'Reader' role to a central security team in every subscription. The team must be able to update this standard definition in one place, and any changes should automatically apply to all existing deployments that were created from the definition. Which Azure service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it enables the central governance team to define a repeatable, versioned environment that includes network topology, Azure Policy definitions, and role assignments. Blueprints support versioning and automatic updates: when a blueprint is updated and published, existing blueprint assignments can be upgraded to apply the new definitions to all deployed resources, ensuring consistency across all 10 subscriptions.

Answer

Azure Policy

Answer

Azure Resource Manager (ARM) templates

Answer

Azure Management Groups

Question 2

A company has a critical production resource group that contains several virtual machines and an Azure SQL Database. The IT manager wants to prevent anyone from accidentally deleting the resource group or any of its resources. However, authorized administrators must still be able to add, update, or delete individual resources within the group (except deletion of the group itself). Which Azure feature should the manager apply to the resource group?

Accepted Answer

Apply a CanNotDelete lock on the resource group.. A CanNotDelete lock on the resource group prevents deletion of the group itself while still allowing authorized administrators to add, update, or delete individual resources within the group. This lock type specifically blocks delete operations on the locked scope, but does not restrict read, write, or other management operations, aligning perfectly with the requirement to protect the resource group from accidental deletion while permitting ongoing resource management.

Answer

Apply an Azure Policy with the 'Deny' effect to prevent all operations on the resource group.

Answer

Apply a Read-Only lock on the resource group.

Answer

Remove the Contributor role from all users and assign the Owner role to the IT manager only.

Question 3

A company has multiple Azure subscriptions, each belonging to a different department. The finance department wants to set spending limits per subscription and receive automated email notifications whenever actual spending reaches 80% of the allocated budget. Which Azure feature should they configure?

Accepted Answer

Azure Budgets. Azure Budgets is the correct feature because it allows you to set spending limits (budgets) on Azure subscriptions or resource groups and configure alerts that trigger automated email notifications when actual spending reaches a specified threshold, such as 80% of the allocated budget. This directly meets the finance department's requirement for per-subscription spending limits and proactive notifications.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Resource Graph

Question 4

A company's security policy requires that all Azure Storage accounts must enforce a minimum TLS version of 1.2. The governance team needs to continuously audit all existing storage accounts for compliance with this requirement, and also ensure that any new storage account that does not meet the TLS version requirement is automatically flagged as non-compliant in the Azure portal compliance dashboard. The team does not want to block the creation of non-compliant resources; they only need to report them. Which Azure feature should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct choice because it can continuously audit existing Azure resources and evaluate new resources against a defined policy rule—in this case, requiring a minimum TLS version of 1.2 on all storage accounts. It can be configured in audit-only mode, which flags non-compliant resources in the Azure portal compliance dashboard without blocking their creation, exactly matching the team's requirement to report rather than deny.

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Blueprints

Answer

Azure Locks

Question 5

A company has a single Azure subscription that contains resource groups for several business units. The company's compliance team wants to enforce a rule: no virtual network (VNet) can be deployed in any resource group unless the VNet is in a specific allowed region (West Europe). The rule must also block the creation of VNets in disallowed regions, but the team must be able to selectively exempt certain resource groups (e.g., for disaster recovery testing) without altering the underlying rule definition. Which Azure feature should the compliance team implement?

Accepted Answer

Azure Policy with the 'Deny' effect assigned to the subscription, and create policy exemptions for the resource groups that need to deploy VNets in other regions.. Azure Policy with the 'Deny' effect can enforce a rule at the subscription scope that blocks VNet creation in disallowed regions. Policy exemptions allow specific resource groups to be excluded from the policy without modifying the original rule definition, meeting the compliance team's requirement for selective exemption.

Answer

Azure role-based access control (RBAC) by creating a custom role that restricts the 'Microsoft.Network/virtualNetworks/write' action to only the West Europe region, and assign that role to all users.

Answer

A resource lock on each resource group that prevents the creation of any resource in disallowed regions.

Answer

Azure Blueprints by defining a blueprint that only includes VNets in West Europe and assigning it to all resource groups.

Question 6

A multinational company uses Azure management groups to organize its subscriptions. The company has a root management group (tenant root group) containing three child management groups: 'Finance', 'HR', and 'IT'. Each child management group contains multiple subscriptions. The global governance team needs to enforce an Azure Policy that restricts all resource deployments across every subscription in the organization to only the 'West US' and 'East US' regions. The policy must automatically apply to any new subscriptions that are created under any management group in the future. The team wants to assign the policy once and have it affect all current and future subscriptions with minimal administrative overhead. At which Azure scope should the team assign the policy?

Accepted Answer

The root management group. Assigning the policy to the root management group ensures it is inherited by all child management groups (Finance, HR, IT) and their subscriptions, including any new subscriptions created in the future. This approach enforces the allowed regions policy across the entire tenant with a single assignment, minimizing administrative overhead. Azure Policy inheritance flows from the root management group down through all levels of the hierarchy.

Answer

Each subscription individually

Answer

Each child management group (Finance, HR, IT) individually

Answer

A single resource group

Question 7

A company has a production Azure subscription used by multiple teams. The governance team wants to enforce a rule that only virtual machines (VMs) of specific SKU sizes (e.g., Standard_D2s_v3 and Standard_D4s_v3) can be deployed. If a team attempts to deploy a VM of a different SKU size, the deployment must be blocked immediately and the user must see an error message explaining the restriction. Which Azure feature should the governance team use?

Accepted Answer

Azure Policy with the 'Deny' effect. Azure Policy with the 'Deny' effect is the correct choice because it allows the governance team to define and enforce rules that prevent the deployment of non-compliant resources, such as VMs with disallowed SKU sizes. When a policy with the 'Deny' effect is assigned, any attempt to create or update a resource that violates the policy is blocked immediately, and the user receives a clear error message explaining the restriction. This is the only Azure feature that provides proactive, resource-level enforcement with a built-in denial mechanism.

Answer

Azure Role-Based Access Control (RBAC) with a custom role that denies the 'Microsoft.Compute/virtualMachines/write' action

Answer

Azure Blueprints with a resource lock

Answer

Azure resource locks at the resource group level

Question 8

A company manages multiple Azure subscriptions for development, testing, and production environments. The governance team needs to ensure that every new subscription automatically includes a consistent baseline consisting of Azure Policy definitions, role assignments, and a predefined resource group structure. The team wants to package these governance components into a single deployable artifact that can be applied to any subscription with minimal manual effort. Which Azure feature should the team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it is specifically designed to orchestrate the deployment of a consistent baseline—including Azure Policy definitions, role assignments, and resource groups—as a single, versioned, and repeatable artifact. Unlike other tools, Blueprints packages these governance components together and can be applied to any subscription with minimal manual effort, ensuring every new subscription automatically inherits the defined baseline.

Answer

Azure Policy

Answer

Azure Resource Manager (ARM) templates

Answer

Azure Management Groups

Question 9

A company uses Azure Policy to enforce governance rules across its subscriptions. The governance team wants to ensure that every resource in the 'Production' subscription has a tag named 'Environment' with the value 'Production'. If a resource is created without this tag, or with a different value, the tag must be automatically corrected to 'Production' without blocking the creation of the resource. Which Azure Policy effect should the team configure?

Accepted Answer

Modify. The Modify effect is correct because it automatically applies the required tag value to resources during creation or update without blocking the operation. Unlike Append, which only adds tags to new resources but cannot change existing values, Modify can alter both new and existing resources to enforce the desired tag value. This ensures that any resource created without the 'Environment' tag or with a different value is automatically corrected to 'Production'.

Answer

Deny

Answer

Audit

Answer

Append

Question 10

A company has an Azure tenant with a management group hierarchy. The 'Production' management group contains five subscriptions used by the operations team. The IT security team wants to grant the 'Network Contributor' role to a group of network administrators for all subscriptions under the 'Production' management group. The role assignment must automatically apply to any new subscription added under the 'Production' management group in the future. The network administrators already exist as a security group in Azure AD. What is the most efficient way to achieve this?

Accepted Answer

Assign the 'Network Contributor' role to the security group at the 'Production' management group scope.. Assigning the 'Network Contributor' role at the 'Production' management group scope is the most efficient method because management groups provide a hierarchical scope that automatically inherits role assignments to all child subscriptions, including any new subscriptions added in the future. This eliminates the need for manual assignments per subscription and ensures consistent access control across the entire management group hierarchy.

Answer

Assign the 'Network Contributor' role at the scope of each existing subscription individually, and remember to assign it to new subscriptions manually.

Answer

Create an Azure Policy that assigns the 'Network Contributor' role to the security group for all subscriptions under 'Production'.

Answer

Assign the 'Network Contributor' role to the security group at the root management group scope.

Question 11

A company stores critical configuration data in an Azure Storage account. The IT administrator wants to prevent accidental deletion of this storage account. However, the administrator must still be able to read and update the data within the storage account. The company uses Azure Role-Based Access Control (RBAC) to manage permissions. Which Azure governance feature should the administrator implement to achieve this goal?

Accepted Answer

A Delete lock on the storage account. A Delete lock on the storage account prevents deletion of the resource while still allowing read and update operations on the data within it. Azure resource locks operate at the resource level, overriding any RBAC permissions that would otherwise allow deletion, but they do not restrict data plane operations like reading or writing blobs or tables. This directly meets the administrator's requirement to protect against accidental deletion while maintaining full read/update access.

Answer

Azure Policy with the deny effect to block deletion of the storage account

Answer

An Azure Blueprint that includes the storage account with a policy to prevent deletion

Answer

A Read-only lock on the storage account

Question 12

Which Azure tool provides personalized recommendations to improve the security, performance, cost, and reliability of your Azure resources?

Accepted Answer

Azure Advisor. Azure Advisor is the correct tool because it provides personalized, actionable recommendations across four pillars: security, performance, cost, and reliability. It analyzes your deployed Azure resources and configuration telemetry to generate best-practice guidance, making it the only service that explicitly covers all four areas in a unified dashboard.

Answer

Azure Monitor

Answer

Azure Policy

Answer

Azure Security Center

Question 13

Which Azure feature allows you to organize resources into logical groups for billing, management, and access control purposes?

Accepted Answer

Azure Resource Groups. Azure Resource Groups are logical containers that hold related resources for an Azure solution. They enable you to manage resources collectively, apply consistent access control policies via RBAC, and track costs at the group level. This directly supports organizing resources for billing, management, and access control purposes.

Answer

Azure Subscriptions

Answer

Azure Management Groups

Answer

Azure Blueprints

Question 14

Which Azure service provides a way to enforce organizational standards and assess compliance at scale across Azure resources?

Accepted Answer

Azure Policy. Azure Policy allows you to create, assign, and manage policies that enforce rules over your resources. These policies ensure resources stay compliant with corporate standards and service level agreements. Azure Policy can deny non-compliant deployments or audit existing resources.

Answer

Azure RBAC

Answer

Azure Blueprints

Answer

Azure Advisor

Question 15

What does an Azure Service Level Agreement (SLA) define?

Accepted Answer

Microsoft's uptime and connectivity commitments for Azure services. An Azure Service Level Agreement (SLA) is a formal document from Microsoft that defines the uptime and connectivity guarantees for each Azure service. For example, a typical SLA for a virtual machine deployed across two availability zones promises 99.99% uptime, meaning Microsoft commits to a maximum of 52.56 minutes of downtime per year. If Microsoft fails to meet these commitments, customers may be eligible for service credits or a refund, making the SLA a critical component of Azure's governance and reliability framework.

Answer

The maximum number of resources you can create in Azure

Answer

The pricing model for Azure services

Answer

The geographic locations where services are available