AZ-900 Describe Azure management and governance Practice Test 18 — 15 Questions

Question 1

What is the purpose of Azure Policy initiatives (policy sets)?

Accepted Answer

To group related policy definitions for assignment and management as a single unit. Azure Policy initiatives, also known as policy sets, allow you to group together multiple related policy definitions into a single, manageable unit. This simplifies assignment and management by enabling you to apply a collection of compliance rules (e.g., for security or cost control) to a scope as one entity, rather than assigning each policy individually.

Answer

To deploy a group of Azure resources as a single unit

Answer

To create hierarchical management of Azure subscriptions

Answer

To set spending limits across multiple resource groups

Question 2

Which Azure feature automatically moves blob data between access tiers based on defined rules to optimize storage costs?

Accepted Answer

Azure Blob Storage lifecycle management policies. Azure Blob Storage lifecycle management policies allow you to define rules that automatically move blob data between access tiers (hot, cool, cold, archive) or delete data based on age or last modification time. This reduces storage costs by ensuring data is stored in the most cost-effective tier without manual intervention.

Answer

Azure Storage Explorer

Answer

Azure Intelligent-Tiering

Answer

Azure Cost Management auto-optimization

Question 3

Which Azure service helps organizations understand their compliance status against regulatory standards like ISO 27001, PCI DSS, and NIST?

Accepted Answer

Microsoft Defender for Cloud Regulatory Compliance. Microsoft Defender for Cloud Regulatory Compliance provides built-in compliance assessments against major regulatory standards such as ISO 27001, PCI DSS, and NIST. It continuously monitors your Azure environment and maps the compliance state of your resources to specific controls within each standard, offering a clear dashboard of your compliance posture.

Answer

Azure Security Center Secure Score

Answer

Azure Policy compliance view

Answer

Azure Advisor security recommendations

Question 4

What is the Azure portal?

Accepted Answer

A web-based graphical console for creating, managing, and monitoring Azure resources. The Azure portal is a web-based graphical user interface (GUI) that allows users to create, manage, and monitor Azure resources through a browser. It provides a unified console for tasks such as deploying virtual machines, configuring networking, and viewing cost analytics, without requiring command-line tools or local software.

Answer

A marketplace for purchasing Azure hardware for on-premises deployment

Answer

A command-line tool for automating Azure resource deployments

Answer

A documentation site for Azure services

Question 5

Which Azure tool helps you compare the 5-year cost of running an on-premises datacenter versus migrating those workloads to Azure?

Accepted Answer

Azure TCO Calculator. The Azure TCO (Total Cost of Ownership) Calculator is specifically designed to compare the costs of running an on-premises datacenter with the costs of migrating those workloads to Azure. It takes inputs such as server, storage, and network specifications, then generates a detailed report showing potential savings over a customizable period, including 5 years. This tool accounts for hardware, software, labor, electricity, and other on-premises costs, then maps them to equivalent Azure services.

Answer

Azure Pricing Calculator

Answer

Azure Cost Management + Billing

Answer

Azure Advisor cost recommendations

Question 6

Which aspect of Azure governance ensures that resources are protected from accidental or unauthorized deletion regardless of RBAC role?

Accepted Answer

Azure Resource Locks overriding RBAC. Azure Resource Locks override RBAC because they are applied at the subscription, resource group, or resource level and enforce a 'Deny' effect that cannot be bypassed by any RBAC role, including Owner. This ensures that even users with Contributor or Owner permissions cannot delete or modify a locked resource unless the lock is first removed by an Owner or User Access Administrator.

Answer

Azure RBAC deny assignments

Answer

Azure Policy deny effects

Answer

Azure AD Privileged Identity Management restrictions

Question 7

Which Azure feature enables governance teams to define standard, repeatable Azure environments for new projects?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct answer because it enables governance teams to define a repeatable set of Azure resources that adheres to organizational standards, patterns, and requirements. Unlike ARM templates, Blueprints can include role assignments, policy assignments, and resource groups, and they maintain a live linkage to the original blueprint for ongoing compliance tracking.

Answer

ARM templates in Azure Repos

Answer

Azure Cost Management budgets

Answer

Azure AD application registration templates

Question 8

What is Microsoft's definition of 'cloud computing' as used in the context of Azure?

Accepted Answer

Delivery of computing services over the internet with flexible, pay-as-you-go pricing. Microsoft defines cloud computing as the delivery of computing services—including servers, storage, databases, networking, software, analytics, and intelligence—over the internet (the cloud) with flexible, pay-as-you-go pricing. This definition is foundational to Azure, enabling customers to scale resources up or down as needed and only pay for what they use, rather than investing in and maintaining physical infrastructure.

Answer

Storing all data on physical servers in the customer's own building

Answer

Using only virtual machines in a third-party data center

Answer

A type of software that runs in web browsers without installation

Question 9

What is the purpose of Azure Resource Graph?

Accepted Answer

To query and explore Azure resource inventory and properties at scale using KQL. Azure Resource Graph is a service in Azure designed to enable efficient querying and exploration of resource inventory and properties across subscriptions at scale. It uses Kusto Query Language (KQL) to allow complex filtering, grouping, and aggregation of resource data, making it ideal for governance, compliance, and operational audits. This capability is distinct from visualization, diagramming, or billing tools.

Answer

To visualize the network topology of Azure virtual networks

Answer

To create visual diagrams of Azure architectural deployments

Answer

To track changes in Azure subscription billing

Question 10

Which Azure governance feature enables organizations to enforce that all virtual machines be tagged with a specific 'Owner' tag before deployment?

Accepted Answer

Azure Policy with 'Require tag' in deny mode. Azure Policy with the 'Require tag' effect in deny mode is the correct choice because it can enforce tagging rules at resource creation time by evaluating the request against the policy definition and denying any deployment that does not include the specified 'Owner' tag. This is a native governance feature designed to ensure compliance before resources are provisioned, unlike RBAC or templates which do not enforce tag values.

Answer

Azure RBAC with custom permissions

Answer

Azure Resource Manager template validation

Answer

Azure DevOps deployment gates

Question 11

Which Azure service enables organizations to identify and classify sensitive data (like credit card numbers and passport numbers) stored in Azure?

Accepted Answer

Microsoft Purview. Microsoft Purview (formerly Azure Purview) is the correct service because it provides unified data governance, including automated data classification and sensitivity labeling across Azure, on-premises, and multi-cloud environments. It uses built-in classifiers to detect sensitive data types such as credit card numbers (based on Luhn algorithm validation) and passport numbers, and can apply Microsoft Information Protection (MIP) sensitivity labels to the classified data.

Answer

Azure Key Vault

Answer

Azure Information Protection

Answer

Azure Security Center

Question 12

What is the Azure Well-Architected Framework?

Accepted Answer

A set of architectural guiding principles for building reliable, secure, and efficient cloud workloads. The Azure Well-Architected Framework is a set of five architectural pillars (Reliability, Security, Cost Optimization, Operational Excellence, and Performance Efficiency) that provide best practices and guiding principles for designing and operating reliable, secure, and efficient cloud workloads on Azure. It is not a billing structure, compliance program, or migration tool, but rather a prescriptive framework to help architects evaluate and improve their cloud architectures.

Answer

A billing structure for Azure services

Answer

A compliance certification program for Azure partners

Answer

A tool for migrating on-premises applications to Azure

Question 13

Which Azure feature automatically identifies and informs you of Azure service issues that may be affecting your resources in your region?

Accepted Answer

Azure Service Health alerts. Azure Service Health alerts proactively notify you about Azure service issues, planned maintenance, and health advisories that may affect your resources in a specific region. This feature combines global service issues with regional impacts, allowing you to configure alerts based on service health events. It is the correct choice because it directly addresses the requirement of automatically identifying and informing you of Azure service issues affecting your resources.

Answer

Azure Monitor resource health

Answer

Azure Advisor notifications

Answer

Azure Policy compliance alerts

Question 14

Which Azure feature provides a way to audit and track access to sensitive resources using detailed logs?

Accepted Answer

Azure Activity Log and Diagnostic Logs. Azure Activity Log and Diagnostic Logs together provide a comprehensive auditing and tracking mechanism for sensitive resources. The Activity Log records control-plane events (e.g., who created or deleted a resource), while Diagnostic Logs capture data-plane events (e.g., read/write operations on a storage account or key vault). This combination allows administrators to trace every access attempt, including successful and failed operations, with detailed timestamps, caller identities, and request payloads.

Answer

Azure AD Sign-in logs

Answer

Azure Network Security Group flow logs

Answer

Azure Advisor audit recommendations

Question 15

An organization wants to ensure that no one can create Azure resources outside of approved geographic locations across all of their subscriptions. What is the most scalable way to enforce this?

Accepted Answer

Assign 'Allowed locations' Azure Policy at the Management Group level. Azure Policy at the Management Group level allows you to define a single 'Allowed locations' policy that applies to all subscriptions within that group, ensuring consistent enforcement across the entire organization. This approach is the most scalable because it centralizes governance, automatically covering new subscriptions added to the management group without manual intervention.

Answer

Configure RBAC to deny resource creation permissions in all subscriptions

Answer

Create separate 'Allowed locations' policies in each subscription

Answer

Use Azure Blueprints to restrict locations in each new subscription