AZ-900 Describe Azure management and governance Practice Test 14 — 15 Questions

Question 1

Which Azure feature allows you to prevent accidental deletion or modification of critical Azure resources?

Accepted Answer

Azure Resource Locks. Azure Resource Locks are designed to prevent accidental deletion or modification of critical Azure resources by applying a lock at the subscription, resource group, or resource level. There are two types: CanNotDelete (prevents deletion but allows modifications) and ReadOnly (prevents both deletion and modification). This directly addresses the scenario of protecting resources from unintended changes.

Answer

Azure RBAC

Answer

Azure Policy

Answer

Azure Blueprints

Question 2

Which Azure service monitors the health of Azure services and infrastructure in your region, and provides notifications about planned maintenance?

Accepted Answer

Azure Service Health. Azure Service Health is the correct service because it provides a personalized view of the health of Azure services, regions, and resources you use, including notifications about planned maintenance. It combines three layers: Azure Status (global view), Service Health (personalized view), and Resource Health (individual resource status). This makes it the specific tool for monitoring regional service health and planned maintenance events.

Answer

Azure Monitor

Answer

Azure Advisor

Answer

Azure Status Page

Question 3

What is the purpose of Azure tags?

Accepted Answer

To apply metadata to resources for organization, billing tracking, and filtering. Azure tags are key-value pairs that you can assign to Azure resources to apply metadata for organization, billing tracking, and filtering. They enable you to categorize resources by department, environment, cost center, or any custom taxonomy, which is essential for managing costs and resource inventory at scale. Tags are not used for access control, compliance enforcement, or backup automation.

Answer

To control access to Azure resources based on user roles

Answer

To enforce compliance policies across resource configurations

Answer

To back up resource configurations automatically

Question 4

Which Azure cost management feature allows you to analyze historical spending and forecast future costs?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing provides tools for analyzing historical spending patterns and generating cost forecasts based on usage trends. It includes features like budgets, alerts, and cost analysis views that allow you to review past expenditures and predict future costs using machine learning models.

Answer

Azure Advisor

Answer

Azure Pricing Calculator

Answer

Azure Monitor

Question 5

Which Azure feature helps organizations maintain compliance by managing and auditing privileged access to Azure resources using just-in-time access?

Accepted Answer

Azure AD Privileged Identity Management (PIM). Azure AD Privileged Identity Management (PIM) is the correct answer because it provides just-in-time (JIT) privileged access to Azure resources, enabling organizations to grant time-bound, approval-based roles that reduce standing admin privileges. PIM also generates audit logs for all activations and deactivations, directly supporting compliance requirements by ensuring privileged access is managed and auditable.

Answer

Azure RBAC

Answer

Azure AD Conditional Access

Answer

Azure Key Vault

Question 6

Which Azure governance feature allows you to create a repeatable, deployable package of Azure resources, role assignments, and policies for new subscriptions?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct answer because it is specifically designed to orchestrate the deployment of a repeatable, deployable package that includes Azure Resource Manager templates, role assignments, and policies. Unlike a single ARM template, Blueprints enables you to define a set of standard Azure resources and governance artifacts that can be applied consistently to new subscriptions, ensuring compliance and organizational standards from the start.

Answer

Azure Resource Manager templates

Answer

Azure Policy

Answer

Azure Management Groups

Question 7

Which Azure feature provides a unified compliance score and consolidated view of your organization's compliance posture across different regulatory standards?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) provides a unified compliance score and a consolidated view of your organization's compliance posture across multiple regulatory standards (e.g., SOC 2, ISO 27001, PCI DSS). It continuously assesses your Azure and hybrid workloads against these standards, calculates a compliance score based on the percentage of compliant controls, and offers actionable recommendations to improve your overall security and compliance posture.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Active Directory

Question 8

What is the purpose of Azure Management Groups?

Accepted Answer

To organize multiple Azure subscriptions and apply governance policies across them. Azure Management Groups provide a hierarchical structure above subscriptions, enabling you to efficiently manage access, policies, and compliance across multiple Azure subscriptions. By applying Azure Policy or Role-Based Access Control (RBAC) at the management group level, those settings are inherited by all subscriptions within that group, ensuring consistent governance without per-subscription configuration.

Answer

To group Azure resources within a single subscription for billing purposes

Answer

To manage Kubernetes clusters across multiple regions

Answer

To monitor resource health across different Azure services

Question 9

A company wants to estimate the cost of a new Azure solution before deploying it. Which tool should they use?

Accepted Answer

Azure Pricing Calculator. The Azure Pricing Calculator is the correct tool because it allows users to estimate the cost of Azure services by configuring specific resources (e.g., VMs, storage, networking) with their desired settings (region, tier, quantity) before deployment. This provides a detailed, itemized cost projection based on current pay-as-you-go or reserved pricing, enabling informed budgeting without incurring actual charges.

Answer

Azure Cost Management + Billing

Answer

Azure Advisor

Answer

Azure TCO Calculator

Question 10

What is the purpose of the Azure Total Cost of Ownership (TCO) Calculator?

Accepted Answer

To compare the cost of running workloads on-premises versus on Azure. The Azure TCO Calculator is designed to help organizations estimate the cost savings of migrating on-premises workloads to Azure by comparing the total cost of ownership (including hardware, software, labor, and facility costs) of running those workloads on-premises versus running them on Azure. It does not generate a monthly bill for existing services or provide a cost estimate for new deployments; instead, it focuses on the financial comparison between on-premises and cloud environments.

Answer

To calculate the monthly bill for existing Azure services

Answer

To estimate the cost of new Azure services before deployment

Answer

To allocate Azure costs to different departments

Question 11

Which Azure service provides centralized log collection, querying, and analysis from multiple Azure resources and services?

Accepted Answer

Azure Log Analytics. Azure Log Analytics is the correct answer because it is the primary Azure service designed for centralized log collection, querying, and analysis across multiple Azure resources and services. It uses a powerful query language (Kusto Query Language, KQL) to aggregate and analyze data from various sources, including Azure Monitor, virtual machines, and custom logs, providing a unified workspace for troubleshooting and monitoring.

Answer

Azure Application Insights

Answer

Azure Service Health

Answer

Azure Network Watcher

Question 12

Which Azure RBAC role allows a user to manage all Azure resources but cannot grant access to others?

Accepted Answer

Contributor. The Contributor role in Azure RBAC grants full management access to all Azure resources, including the ability to create, modify, and delete them, but explicitly denies the ability to assign roles to other users. This makes it the correct answer because the question specifies a user who can manage all resources but cannot grant access to others.

Answer

Owner

Answer

Reader

Answer

User Access Administrator

Question 13

What is Azure Active Directory Conditional Access?

Accepted Answer

A policy engine that enforces access rules based on conditions like location, device, and risk. Azure Active Directory Conditional Access is a policy engine that evaluates signals such as user location, device compliance, and sign-in risk to enforce access rules before granting access to resources. It allows organizations to implement granular controls like requiring multi-factor authentication (MFA) from untrusted networks or blocking access from non-compliant devices, making it a core identity-driven security feature.

Answer

A feature that blocks all access to Azure resources from outside the organization

Answer

A tool for encrypting user data in Azure AD

Answer

A way to provision users automatically in Azure AD

Question 14

Which Azure monitoring capability sends automated alerts when resource metrics exceed defined thresholds?

Accepted Answer

Azure Monitor Alerts. Azure Monitor Alerts is the correct capability because it proactively notifies you when metrics (e.g., CPU percentage, disk I/O) from Azure resources cross user-defined thresholds. It works by evaluating log search queries or metric signals at a specified frequency and triggering actions (email, SMS, webhook) when conditions are met. This is the core monitoring and alerting service in Azure, not a recommendation or health dashboard.

Answer

Azure Advisor

Answer

Azure Service Health

Answer

Azure Policy

Question 15

Which Azure service allows customers to extend Azure management and governance to non-Azure resources, including on-premises servers and other cloud providers?

Accepted Answer

Azure Arc. Azure Arc is the correct answer because it is specifically designed to extend Azure's management plane and governance policies (such as Azure Policy and Azure RBAC) to resources outside of Azure, including on-premises servers, Kubernetes clusters, and other cloud providers like AWS or GCP. It does this by installing the Azure Connected Machine agent on non-Azure machines, which registers them as Azure resources and enables consistent management through the Azure portal, CLI, and APIs.

Answer

Azure Stack Hub

Answer

Azure ExpressRoute

Answer

Azure VPN Gateway