AZ-900 Describe Azure management and governance Practice Test 13 — 15 Questions

Question 1

A company has an Azure tenant with a management group hierarchy. The 'Production' management group contains five subscriptions used by the operations team. The IT security team wants to grant the 'Network Contributor' role to a group of network administrators for all subscriptions under the 'Production' management group. The role assignment must automatically apply to any new subscription added under the 'Production' management group in the future. The network administrators already exist as a security group in Azure AD. What is the most efficient way to achieve this?

Accepted Answer

Assign the 'Network Contributor' role to the security group at the 'Production' management group scope.. Assigning the 'Network Contributor' role at the 'Production' management group scope is the most efficient method because management groups provide a hierarchical scope that automatically inherits role assignments to all child subscriptions, including any new subscriptions added in the future. This eliminates the need for manual assignments per subscription and ensures consistent access control across the entire management group hierarchy.

Answer

Assign the 'Network Contributor' role at the scope of each existing subscription individually, and remember to assign it to new subscriptions manually.

Answer

Create an Azure Policy that assigns the 'Network Contributor' role to the security group for all subscriptions under 'Production'.

Answer

Assign the 'Network Contributor' role to the security group at the root management group scope.

Question 2

A company stores critical configuration data in an Azure Storage account. The IT administrator wants to prevent accidental deletion of this storage account. However, the administrator must still be able to read and update the data within the storage account. The company uses Azure Role-Based Access Control (RBAC) to manage permissions. Which Azure governance feature should the administrator implement to achieve this goal?

Accepted Answer

A Delete lock on the storage account. Option D is correct because a Delete lock on the storage account prevents deletion of the resource while still allowing read and update operations on the data within it. Azure resource locks operate at the resource level, overriding any RBAC permissions that would otherwise allow deletion, but they do not restrict data plane operations like reading or writing blobs or tables. This directly meets the administrator's requirement to protect against accidental deletion while maintaining full read/update access.

Answer

Azure Policy with the deny effect to block deletion of the storage account

Answer

An Azure Blueprint that includes the storage account with a policy to prevent deletion

Answer

A Read-only lock on the storage account

Question 3

Which Azure tool provides personalized recommendations to improve the security, performance, cost, and reliability of your Azure resources?

Accepted Answer

Azure Advisor. Azure Advisor is the correct tool because it provides personalized, actionable recommendations across four pillars: security, performance, cost, and reliability. It analyzes your deployed Azure resources and configuration telemetry to generate best-practice guidance, making it the only service that explicitly covers all four areas in a unified dashboard.

Answer

Azure Monitor

Answer

Azure Policy

Answer

Azure Security Center

Question 4

Which Azure feature allows you to organize resources into logical groups for billing, management, and access control purposes?

Accepted Answer

Azure Resource Groups. Azure Resource Groups are logical containers that hold related resources for an Azure solution. They enable you to manage resources collectively, apply consistent access control policies via RBAC, and track costs at the group level. This directly supports organizing resources for billing, management, and access control purposes.

Answer

Azure Subscriptions

Answer

Azure Management Groups

Answer

Azure Blueprints

Question 5

Which Azure service provides a way to enforce organizational standards and assess compliance at scale across Azure resources?

Accepted Answer

Azure Policy. Azure Policy allows you to create, assign, and manage policies that enforce rules over your resources. These policies ensure resources stay compliant with corporate standards and service level agreements. Azure Policy can deny non-compliant deployments or audit existing resources.

Answer

Azure RBAC

Answer

Azure Blueprints

Answer

Azure Advisor

Question 6

What does an Azure Service Level Agreement (SLA) define?

Accepted Answer

Microsoft's uptime and connectivity commitments for Azure services. An Azure Service Level Agreement (SLA) is a formal document from Microsoft that defines the uptime and connectivity guarantees for each Azure service. For example, a typical SLA for a virtual machine deployed across two availability zones promises 99.99% uptime, meaning Microsoft commits to a maximum of 52.56 minutes of downtime per year. If Microsoft fails to meet these commitments, customers may be eligible for service credits or a refund, making the SLA a critical component of Azure's governance and reliability framework.

Answer

The maximum number of resources you can create in Azure

Answer

The pricing model for Azure services

Answer

The geographic locations where services are available

Question 7

Which Azure feature allows you to prevent accidental deletion or modification of critical Azure resources?

Accepted Answer

Azure Resource Locks. Azure Resource Locks are designed to prevent accidental deletion or modification of critical Azure resources by applying a lock at the subscription, resource group, or resource level. There are two types: CanNotDelete (prevents deletion but allows modifications) and ReadOnly (prevents both deletion and modification). This directly addresses the scenario of protecting resources from unintended changes.

Answer

Azure RBAC

Answer

Azure Policy

Answer

Azure Blueprints

Question 8

Which Azure service monitors the health of Azure services and infrastructure in your region, and provides notifications about planned maintenance?

Accepted Answer

Azure Service Health. Azure Service Health is the correct service because it provides a personalized view of the health of Azure services, regions, and resources you use, including notifications about planned maintenance. It combines three layers: Azure Status (global view), Service Health (personalized view), and Resource Health (individual resource status). This makes it the specific tool for monitoring regional service health and planned maintenance events.

Answer

Azure Monitor

Answer

Azure Advisor

Answer

Azure Status Page

Question 9

What is the purpose of Azure tags?

Accepted Answer

To apply metadata to resources for organization, billing tracking, and filtering. Azure tags are key-value pairs that you can assign to Azure resources to apply metadata for organization, billing tracking, and filtering. They enable you to categorize resources by department, environment, cost center, or any custom taxonomy, which is essential for managing costs and resource inventory at scale. Tags are not used for access control, compliance enforcement, or backup automation.

Answer

To control access to Azure resources based on user roles

Answer

To enforce compliance policies across resource configurations

Answer

To back up resource configurations automatically

Question 10

Which Azure cost management feature allows you to analyze historical spending and forecast future costs?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing provides tools for analyzing historical spending patterns and generating cost forecasts based on usage trends. It includes features like budgets, alerts, and cost analysis views that allow you to review past expenditures and predict future costs using machine learning models.

Answer

Azure Advisor

Answer

Azure Pricing Calculator

Answer

Azure Monitor

Question 11

Which Azure feature helps organizations maintain compliance by managing and auditing privileged access to Azure resources using just-in-time access?

Accepted Answer

Azure AD Privileged Identity Management (PIM). Azure AD Privileged Identity Management (PIM) is the correct answer because it provides just-in-time (JIT) privileged access to Azure resources, enabling organizations to grant time-bound, approval-based roles that reduce standing admin privileges. PIM also generates audit logs for all activations and deactivations, directly supporting compliance requirements by ensuring privileged access is managed and auditable.

Answer

Azure RBAC

Answer

Azure AD Conditional Access

Answer

Azure Key Vault

Question 12

Which Azure governance feature allows you to create a repeatable, deployable package of Azure resources, role assignments, and policies for new subscriptions?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct answer because it is specifically designed to orchestrate the deployment of a repeatable, deployable package that includes Azure Resource Manager templates, role assignments, and policies. Unlike a single ARM template, Blueprints enables you to define a set of standard Azure resources and governance artifacts that can be applied consistently to new subscriptions, ensuring compliance and organizational standards from the start.

Answer

Azure Resource Manager templates

Answer

Azure Policy

Answer

Azure Management Groups

Question 13

Which Azure feature provides a unified compliance score and consolidated view of your organization's compliance posture across different regulatory standards?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) provides a unified compliance score and a consolidated view of your organization's compliance posture across multiple regulatory standards (e.g., SOC 2, ISO 27001, PCI DSS). It continuously assesses your Azure and hybrid workloads against these standards, calculates a compliance score based on the percentage of compliant controls, and offers actionable recommendations to improve your overall security and compliance posture.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Active Directory

Question 14

What is the purpose of Azure Management Groups?

Accepted Answer

To organize multiple Azure subscriptions and apply governance policies across them. Azure Management Groups provide a hierarchical structure above subscriptions, enabling you to efficiently manage access, policies, and compliance across multiple Azure subscriptions. By applying Azure Policy or Role-Based Access Control (RBAC) at the management group level, those settings are inherited by all subscriptions within that group, ensuring consistent governance without per-subscription configuration.

Answer

To group Azure resources within a single subscription for billing purposes

Answer

To manage Kubernetes clusters across multiple regions

Answer

To monitor resource health across different Azure services

Question 15

A company wants to estimate the cost of a new Azure solution before deploying it. Which tool should they use?

Accepted Answer

Azure Pricing Calculator. The Azure Pricing Calculator is the correct tool because it allows users to estimate the cost of Azure services by configuring specific resources (e.g., VMs, storage, networking) with their desired settings (region, tier, quantity) before deployment. This provides a detailed, itemized cost projection based on current pay-as-you-go or reserved pricing, enabling informed budgeting without incurring actual charges.

Answer

Azure Cost Management + Billing

Answer

Azure Advisor

Answer

Azure TCO Calculator