AZ-900 Describe Azure management and governance Practice Test 15 — 15 Questions

Question 1

Which Azure service allows customers to extend Azure management and governance to non-Azure resources, including on-premises servers and other cloud providers?

Accepted Answer

Azure Arc. Azure Arc is the correct answer because it is specifically designed to extend Azure's management plane and governance policies (such as Azure Policy and Azure RBAC) to resources outside of Azure, including on-premises servers, Kubernetes clusters, and other cloud providers like AWS or GCP. It does this by installing the Azure Connected Machine agent on non-Azure machines, which registers them as Azure resources and enables consistent management through the Azure portal, CLI, and APIs.

Answer

Azure Stack Hub

Answer

Azure ExpressRoute

Answer

Azure VPN Gateway

Question 2

A company needs to ensure that all Azure resources in a subscription are created only in specific approved regions. Which Azure feature should they implement?

Accepted Answer

Azure Policy with 'Allowed locations' policy. Azure Policy with the 'Allowed locations' policy definition is the correct choice because it enforces organizational compliance by restricting the Azure regions where resources can be deployed. This policy evaluates all resource creation requests against a defined list of approved regions and denies any request that does not match, ensuring that all resources in the subscription are created only in the specified approved locations.

Answer

Azure Resource Locks

Answer

Azure RBAC

Answer

Azure Blueprints

Question 3

Which Azure service provides a cloud-native SIEM (Security Information and Event Management) solution for detecting and responding to threats?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct answer because it is a cloud-native SIEM (Security Information and Event Management) solution that provides intelligent security analytics and threat intelligence across the enterprise. It collects data from various sources, including Azure, on-premises, and other clouds, and uses built-in AI and machine learning to detect and respond to threats in real time.

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Answer

Azure DDoS Protection

Question 4

What is the primary purpose of Azure subscriptions?

Accepted Answer

To serve as the billing unit and access boundary for Azure resources. Azure subscriptions serve as the primary billing unit, aggregating resource usage into a single invoice, and as an access boundary where Azure RBAC policies and management groups define administrative scope. Without a subscription, resources cannot be deployed or tracked for cost. This dual role makes B correct.

Answer

To provide a private network for Azure resources

Answer

To authenticate users accessing Azure resources

Answer

To enforce compliance policies across resource groups

Question 5

Which Azure tool helps identify compliance issues by continuously evaluating your resource configurations against defined policies?

Accepted Answer

Azure Policy compliance dashboard. Azure Policy compliance dashboard is the correct answer because it provides a centralized view of the compliance state of your Azure resources against the defined policy assignments. It continuously evaluates resource configurations and displays which resources are compliant or non-compliant, allowing you to identify and remediate compliance issues proactively.

Answer

Azure Monitor

Answer

Azure Advisor

Answer

Azure Resource Graph

Question 6

What is the Microsoft Trust Center?

Accepted Answer

A website providing information about Microsoft's security, privacy, and compliance practices. The Microsoft Trust Center is a dedicated website that provides detailed information about Microsoft's security, privacy, and compliance practices. It serves as a central resource for customers to review certifications, audit reports, and documentation that demonstrate how Microsoft cloud services adhere to industry standards and regulatory requirements.

Answer

A portal for managing Azure subscriptions and billing

Answer

A service for encrypting data stored in Azure

Answer

A compliance management tool for creating organizational policies

Question 7

What is the purpose of Azure Active Directory B2C?

Accepted Answer

To provide customer identity management for consumer-facing applications. Azure Active Directory B2C (Business-to-Consumer) is a customer identity access management (CIAM) solution designed specifically for external-facing applications. It allows developers to manage customer sign-up, sign-in, and profile management using social identity providers (e.g., Google, Facebook) or local accounts, while keeping customer identities isolated from the organization's employee directory (Microsoft Entra ID). This directly supports consumer-facing applications, not internal employee access.

Answer

To manage employee identities and corporate application access

Answer

To replicate on-premises Active Directory to Azure

Answer

To manage service-to-service authentication using managed identities

Question 8

Which Azure compliance feature allows organizations to understand which standards and regulations Azure services comply with?

Accepted Answer

Azure Compliance Documentation / Trust Center. Azure Compliance Documentation (often accessed via the Trust Center) provides detailed information about certifications, attestations, and regulatory standards that Azure services adhere to, such as ISO 27001, SOC 2, and GDPR. This is the dedicated resource for understanding which specific compliance frameworks Azure meets, rather than enforcing or monitoring compliance.

Answer

Azure Security Center

Answer

Azure Policy

Answer

Azure Blueprints

Question 9

What is Azure Role-Based Access Control (RBAC)?

Accepted Answer

A system for granting specific permissions to users and groups for Azure resources. Azure Role-Based Access Control (RBAC) is an authorization system built on Azure Resource Manager that enables fine-grained access management for Azure resources. It works by assigning roles (collections of permissions) to users, groups, service principals, or managed identities at a specific scope (management group, subscription, resource group, or resource). This allows you to grant only the necessary permissions (e.g., 'Reader' to view resources, 'Contributor' to create and manage them) without sharing account credentials or using a single authentication method.

Answer

A way to authenticate users to Azure using passwords and MFA

Answer

A tool for monitoring resource usage and performance

Answer

A service for encrypting data stored in Azure

Question 10

Which Azure feature provides continuous application performance monitoring with automatic anomaly detection?

Accepted Answer

Azure Application Insights. Azure Application Insights is the correct answer because it is an extensible Application Performance Management (APM) service specifically designed for continuous monitoring of live applications. It automatically detects performance anomalies through features like Smart Detection, which uses machine learning algorithms to analyze telemetry data (e.g., request rates, response times, failure rates) and proactively identify unusual patterns without manual threshold configuration.

Answer

Azure Monitor

Answer

Azure Log Analytics

Answer

Azure Network Watcher

Question 11

A company needs to ensure that no resources in any subscription can be created without a specific cost center tag. Which Azure feature accomplishes this?

Accepted Answer

Azure Policy with a 'require tag' definition in deny mode. Azure Policy with a 'require tag' definition in deny mode is the correct choice because it enforces a rule that blocks the creation of any resource that does not include the specified cost center tag. Azure Policy evaluates resource creation requests against defined policies and can deny non-compliant requests before the resource is provisioned, ensuring governance at the subscription or management group level.

Answer

Azure Blueprints with tag templates

Answer

Azure RBAC with custom roles

Answer

Azure Resource Groups with tag inheritance

Question 12

Which Azure feature allows organizations to apply the same governance at a hierarchy of subscriptions and resource groups?

Accepted Answer

Azure Policy and RBAC inheritance through the management hierarchy. Azure Policy and RBAC (Role-Based Access Control) inheritance through the management hierarchy allows organizations to apply consistent governance across multiple subscriptions and resource groups. When a policy or RBAC assignment is applied at a management group, it is inherited by all child subscriptions and resource groups, ensuring uniform compliance and access control without manual reconfiguration.

Answer

Azure Resource Locks inheritance

Answer

Azure Blueprints auto-assignment

Answer

Azure Cost Management budget inheritance

Question 13

What does 'compliance' mean in the context of Azure?

Accepted Answer

Meeting regulatory standards, laws, and organizational policies for data and security. In Azure, compliance refers to adhering to regulatory standards, laws, and organizational policies that govern data security, privacy, and handling. Azure provides a compliance framework with over 100 offerings (e.g., ISO 27001, SOC 2, GDPR, HIPAA) and tools like Microsoft Purview Compliance Manager to assess and manage compliance posture. This ensures that workloads meet specific legal and industry requirements, not just performance or error-free operation.

Answer

Achieving maximum performance for Azure workloads

Answer

Ensuring all Azure resources are running without errors

Answer

Using only Microsoft-approved Azure services in your environment

Question 14

Which tool allows you to automate the creation and management of Azure resources using declarative JSON or Bicep templates?

Accepted Answer

ARM templates / Bicep. ARM templates and Bicep are declarative Infrastructure as Code (IaC) tools that allow you to define Azure resources in JSON or Bicep syntax. They enable repeatable, idempotent deployments by describing the desired state of resources, which Azure Resource Manager then orchestrates to create or update resources accordingly.

Answer

Azure PowerShell

Answer

Azure CLI

Answer

Azure Cloud Shell

Question 15

Which Azure governance tool provides a way to audit all changes made to resources in your Azure subscription?

Accepted Answer

Azure Activity Log. The Azure Activity Log is the correct tool because it provides a complete audit trail of all control-plane operations (management-plane actions) performed on resources in an Azure subscription. Every create, update, delete, and other write operation (PUT, POST, DELETE) is logged, enabling you to answer 'who, what, when, where, and how' for any change. This makes it the primary governance tool for auditing resource modifications.

Answer

Azure Monitor Metrics

Answer

Azure Application Insights

Answer

Azure Resource Health