AZ-900 Describe Azure management and governance Practice Test 19 — 15 Questions

Question 1

Which Azure governance concept ensures that access to resources is granted only to users who need it for their job function?

Accepted Answer

Principle of least privilege. The principle of least privilege is an Azure governance concept that ensures users are granted only the minimum permissions necessary to perform their job functions. In Azure, this is implemented through Azure RBAC (Role-Based Access Control), where custom or built-in roles define specific actions allowed on resources, preventing over-permissioning.

Answer

Defense in depth

Answer

Role inheritance

Answer

Separation of duties

Question 2

Which Azure tool helps organizations evaluate and quantify the potential impact of Azure service disruptions on their operations?

Accepted Answer

Azure Service Health (post-incident reports). Azure Service Health provides post-incident reports (Root Cause Analyses or RCAs) that detail the impact of Azure service disruptions, including affected services, regions, and timelines. This allows organizations to quantify downtime and assess operational impact, which is the specific need described in the question.

Answer

Azure Monitor Alerts

Answer

Azure Application Insights failure analysis

Answer

Azure Advisor reliability recommendations

Question 3

Which Azure feature enables organizations to review and recertify privileged role assignments on a scheduled basis?

Accepted Answer

Azure AD Access Reviews. Azure AD Access Reviews allow administrators to configure periodic reviews of privileged role assignments, ensuring that only authorized users retain access. This feature directly supports recertification workflows by sending reviewers notifications and automatically removing stale assignments based on policy.

Answer

Azure AD Privileged Identity Management role history

Answer

Azure RBAC audit logs

Answer

Azure Policy RBAC compliance

Question 4

Which Azure portal blade allows you to view all resources across your subscriptions in a single place?

Accepted Answer

All Resources blade in the Azure portal. The All Resources blade in the Azure portal provides a single, unified view of every resource across all subscriptions you have access to. It allows you to filter, search, and manage resources without navigating between individual subscription blades, making it the correct answer for viewing all resources in one place.

Answer

Azure Cost Management

Answer

Azure Service Health

Answer

Azure Subscriptions blade

Question 5

What is the primary benefit of Azure Management Groups in a large enterprise with hundreds of subscriptions?

Accepted Answer

Applying governance policies and RBAC to all subscriptions in a hierarchy at once. Azure Management Groups allow you to organize subscriptions into a hierarchy and apply governance policies (via Azure Policy) and role-based access control (RBAC) at the management group level, which then cascades down to all subscriptions and resources within that group. This enables consistent governance across hundreds of subscriptions without needing to configure each one individually, which is the primary benefit for large enterprises.

Answer

Automatically reducing the cost of Azure subscriptions

Answer

Merging multiple subscriptions into a single billing account

Answer

Allowing resources in different subscriptions to share the same virtual network

Question 6

What is the purpose of Azure's 'Secure Score' in Microsoft Defender for Cloud?

Accepted Answer

To provide a quantified measurement of your security posture with actionable improvements. Azure Secure Score in Microsoft Defender for Cloud provides a quantified measurement of an organization's security posture based on security controls and recommendations. It calculates a percentage score from completed recommendations, and each recommendation includes actionable steps to improve the score, directly reflecting the security state of your Azure resources.

Answer

To measure the performance speed of Azure resources

Answer

To show the availability percentage of Azure security services

Answer

To audit user login attempts and failed authentications

Question 7

What does the Azure 'Reliability' pillar of the Well-Architected Framework focus on?

Accepted Answer

Ensuring workloads recover from failures and meet availability requirements. The Azure Well-Architected Framework's Reliability pillar is specifically designed to ensure that workloads can recover from failures and meet defined availability and resiliency targets. This involves designing for fault tolerance, implementing redundancy across regions or availability zones, and using features like Azure Site Recovery and Azure Load Balancer to maintain service continuity. The core goal is to minimize downtime and data loss, which directly aligns with option B.

Answer

Reducing unnecessary resource provisioning to minimize costs

Answer

Encrypting all data and managing access identities

Answer

Monitoring resource performance and responding to performance alerts

Question 8

Which Azure feature creates an audit trail showing who performed what actions on Azure resources and when?

Accepted Answer

Azure Activity Log. The Azure Activity Log is a platform log in Azure that provides insight into subscription-level events, recording all control-plane operations (e.g., creating a VM, deleting a resource group) with details on who performed the action (via Azure AD principal), what the action was, and when it occurred. This makes it the correct feature for creating an audit trail of resource management actions.

Answer

Azure Monitor Metrics

Answer

Azure AD Sign-in logs

Answer

Azure Network Watcher packet captures

Question 9

Which Azure feature can be used to prevent Azure resources in a subscription from being moved to a different resource group?

Accepted Answer

Azure Resource Locks (ReadOnly). Azure Resource Locks can prevent resources from being modified or deleted. A CanNotDelete lock prevents deletion. A ReadOnly lock prevents both modification and deletion — including moving a resource to a different resource group (which is considered a modification operation). Locks are inherited by child resources.

Answer

Azure Policy deny effect for resource moves

Answer

Azure RBAC without 'move' permissions

Answer

Azure Subscription spending limits

Question 10

Which Azure service provides a centralized console for monitoring the health, performance, and security of your entire Azure environment?

Accepted Answer

Azure Monitor. Azure Monitor is the correct answer because it provides a centralized, unified console for collecting, analyzing, and acting on telemetry data from your entire Azure environment. It covers health, performance, and security metrics, logs, and alerts across resources, enabling proactive monitoring and troubleshooting. Unlike specialized services, Azure Monitor aggregates data from multiple sources into a single pane of glass.

Answer

Azure Service Health

Answer

Microsoft Sentinel

Answer

Azure Security Center

Question 11

What is the purpose of Azure's 'Cost Management + Billing' service?

Accepted Answer

To monitor, analyze, and optimize Azure spending across subscriptions. Azure Cost Management + Billing is the dedicated service for monitoring, analyzing, and optimizing Azure spending. It provides tools to track costs across subscriptions, set budgets, create alerts, and generate reports, enabling organizations to control cloud expenditure and improve cost efficiency.

Answer

To provision and manage Azure resources automatically

Answer

To enforce security policies across Azure resources

Answer

To manage Azure support tickets and technical issues

Question 12

What is Azure Policy's 'audit' effect used for?

Accepted Answer

To evaluate and flag non-compliant resources without blocking them. Azure Policy's 'audit' effect evaluates resources against policy rules and flags any non-compliant resources in the compliance logs, but it does not block or automatically remediate them. This allows administrators to see which resources violate policies without impacting existing workloads or preventing creation of new resources.

Answer

To automatically fix non-compliant resources to match the policy

Answer

To deny creation of resources that don't comply with the policy

Answer

To send security alerts when resources are modified

Question 13

Which Azure service provides recommendations for improving the security posture of your Azure SQL databases?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL (formerly Azure Defender for SQL) provides security assessments and actionable recommendations to improve the security posture of Azure SQL databases. It identifies vulnerabilities, misconfigurations, and potential threats, then offers remediation steps directly in the Azure Security Center or Microsoft Defender for Cloud interface.

Answer

Azure SQL Auditing

Answer

Azure Key Vault for SQL

Answer

Azure Monitor SQL Insights

Question 14

Which Azure feature reduces costs by allowing customers to use existing on-premises Windows Server licenses in Azure?

Accepted Answer

Azure Hybrid Benefit for Windows Server. Azure Hybrid Benefit for Windows Server allows customers to use their existing on-premises Windows Server licenses with active Software Assurance (or subscription licenses) to run Windows Server virtual machines in Azure at a reduced cost. This benefit effectively covers the Windows Server operating system licensing cost, so customers only pay for the underlying compute (VM) infrastructure, leading to significant savings.

Answer

Azure Reserved Instances

Answer

Azure Spot VMs with Windows

Answer

Azure Free Tier VMs

Question 15

Which Azure service generates automatic recommendations for right-sizing, reserved instance purchasing, and idle resource cleanup?

Accepted Answer

Azure Advisor. Azure Advisor is a built-in, personalized cloud consultant that continuously analyzes your Azure resource configuration and usage telemetry. It then generates automatic recommendations across four pillars: cost (right-sizing, reserved instance purchases, idle resource cleanup), security, reliability, and operational excellence. This makes it the correct service for automated cost optimization suggestions.

Answer

Azure Cost Management budget alerts

Answer

Azure Pricing Calculator

Answer

Microsoft Defender for Cloud cost alerts