AZ-900 Describe Azure management and governance Practice Test 2 — 15 Questions

Question 1

A company wants to track resource usage across departments and projects. They have multiple Azure subscriptions. They need to assign costs to specific departments based on resource usage. Which Azure feature enables them to view and analyze costs by resource tags?

Accepted Answer

A) Azure Cost Management + Billing. Azure Cost Management + Billing provides the tools to view, analyze, and allocate costs across subscriptions and resources. By enabling tag inheritance and using cost analysis filters, you can group costs by resource tags (e.g., Department or Project) to assign spending to specific departments. This is the correct feature because it directly supports cost tracking and allocation by tags.

Answer

B) Azure Policy

Answer

C) Azure Tags

Answer

D) Azure Resource Groups

Question 2

A company has a policy that requires all storage accounts to have secure transfer enabled. They want to automatically audit all existing storage accounts and enforce the setting on new ones. They also want to automatically fix non-compliant new storage accounts. Which Azure Policy effect combination should they use?

Accepted Answer

B) audit and deployIfNotExists. The correct combination is 'audit' and 'deployIfNotExists'. The 'audit' effect logs non-compliant existing storage accounts without changing them, satisfying the audit requirement. The 'deployIfNotExists' effect automatically remediates new non-compliant storage accounts by enabling secure transfer (HTTPS) during deployment, enforcing the policy on new resources without blocking creation.

Answer

A) audit and deny

Answer

C) append and deny

Answer

D) modify and audit

Question 3

A company uses Azure Resource Manager templates to deploy infrastructure. They need to manage secrets such as database connection strings and passwords securely. Which Azure service should they use to store and retrieve these secrets during deployment?

Accepted Answer

A) Azure Key Vault. Azure Key Vault is the correct service because it is designed specifically to securely store and manage secrets such as database connection strings, passwords, and certificates. During Azure Resource Manager (ARM) template deployments, you can reference Key Vault secrets directly in the template using a linked template or a parameter file, allowing the secrets to be retrieved at deployment time without exposing them in plaintext. This integration ensures that sensitive values are never hardcoded or stored in source control.

Answer

B) Azure Policy

Answer

C) Azure Managed Identity

Answer

D) Azure Service Principal

Question 4

A company manages multiple Azure subscriptions for different business units. They want to define a standard set of policies, such as allowed VM SKUs and required resource tags, and ensure these policies are always applied whenever a new subscription is created. Which Azure feature should they use to enforce governance at this level?

Accepted Answer

Azure Management Groups. Azure Management Groups allow you to organize subscriptions into a hierarchy and apply governance policies at the management group level. When a new subscription is created under a management group, it automatically inherits the policies assigned to that group, ensuring consistent enforcement across all subscriptions without manual intervention.

Answer

Azure Policy

Answer

Azure Resource Manager templates

Answer

Azure Blueprints

Question 5

A company uses Azure Policy to require that all storage accounts must have blob soft delete enabled. They also want to automatically create a remediation task that fixes any existing non-compliant storage accounts. Which policy effect should they include in the policy definition to achieve automatic remediation?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is designed to automatically remediate non-compliant resources by deploying a defined template (e.g., enabling blob soft delete) when the resource is evaluated as non-compliant. This effect triggers a remediation task that can be run on existing resources, ensuring all storage accounts meet the policy requirement without manual intervention.

Answer

Deny

Answer

Audit

Answer

Append

Question 6

A company has a policy that all Azure resources deployed to production subscriptions must be tagged with a 'CostCenter' tag. They want to automatically prevent the creation of any resource that does not include this tag. Which Azure Policy effect should they use in their policy definition?

Accepted Answer

Deny. The Deny effect is correct because it actively prevents the creation or deployment of any Azure resource that does not comply with the policy rule, such as missing the required 'CostCenter' tag. Unlike Audit, which only logs compliance violations without blocking the operation, Deny enforces the policy at the time of the resource creation request, ensuring non-compliant resources are never provisioned.

Answer

Audit

Answer

DeployIfNotExists

Answer

Modify

Question 7

A company wants to analyze historical spending data across all Azure subscriptions and set proactive budget alerts to prevent cost overruns. They also need to identify spending trends by resource type. Which Azure tool should they use to meet all these requirements?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing is the correct tool because it provides native capabilities for analyzing historical spending data across all Azure subscriptions, setting proactive budget alerts with cost thresholds, and generating detailed cost analysis reports that can be filtered by resource type to identify spending trends. It integrates directly with Azure billing data and supports multi-subscription views, making it the single solution for all three requirements.

Answer

Azure Advisor

Answer

Azure Monitor

Answer

Azure Policy

Question 8

A company has an Azure policy requirement that all new resources in a specific resource group must have a 'Department' tag. If a resource is created without this tag, the tag should be automatically added with a default value of 'Finance'. Which Azure Policy effect should be used?

Accepted Answer

Append. The Append effect is correct because it allows Azure Policy to automatically add a 'Department' tag with a default value of 'Finance' to any resource created without it in the specified resource group. This effect modifies the resource during creation or update to enforce compliance without blocking the operation.

Answer

Deny

Answer

Audit

Answer

Modify

Question 9

A company has multiple Azure subscriptions for different departments. The IT team wants to apply a common set of policies (e.g., allowed VM sizes) and assign the same role-based access control (RBAC) permissions across all subscriptions automatically. Which Azure feature should they use?

Accepted Answer

Azure Management Groups. Azure Management Groups allow you to organize Azure subscriptions hierarchically and apply governance conditions, such as RBAC assignments and Azure Policy definitions, at the management group level. These conditions are inherited by all subscriptions within the group, enabling automatic and consistent application of policies and permissions across multiple subscriptions without manual per-subscription configuration.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Resource Manager (ARM) templates

Question 10

A company wants to track spending across different projects. They have multiple Azure subscriptions and need to assign costs to specific departments based on resource usage. Which Azure feature enables them to view and analyze costs by resource tags?

Accepted Answer

Azure Cost Management. Azure Cost Management provides tools to view, analyze, and optimize cloud spending. It supports filtering and grouping costs by resource tags, enabling you to assign costs to specific departments or projects based on tagged resource usage.

Answer

Azure Policy

Answer

Azure Advisor

Answer

Azure Monitor

Question 11

A company has multiple Azure subscriptions for different departments. The IT team wants to ensure that all resources in a specific subscription are only deployed in the 'West Europe' region. Which Azure feature should they use to enforce this restriction?

Accepted Answer

Azure Policy. Azure Policy is correct because it allows you to create, assign, and manage policies that enforce specific rules or effects on your resources. By defining a policy that restricts allowed locations to 'West Europe' and assigning it to the subscription scope, Azure Policy will deny or audit any resource deployment that does not comply with this geographic restriction.

Answer

Azure RBAC

Answer

Azure Blueprints

Answer

Azure Resource Graph

Question 12

A company wants to track costs by department across multiple Azure subscriptions. They have tagged resources with 'Department' tags. However, some resources are missing tags. They want to see a report of costs grouped by department, including untagged resources. Which Azure tool should they use?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing provides native cost analysis and reporting capabilities that can group costs by custom tags (like 'Department') and includes an 'Untagged' category for resources missing the specified tag. This allows the company to see a complete cost breakdown by department, including untagged resources, across multiple subscriptions in a single view.

Answer

Azure Policy

Answer

Azure Resource Graph

Answer

Azure Advisor

Question 13

A company wants to enforce a naming convention for all Azure resources. For example, all resources must start with 'Contoso-'. They want to automatically audit and deny creation of resources that do not follow the naming convention. Which Azure Policy effect should they use?

Accepted Answer

Deny. The Deny effect is correct because it actively prevents the creation of Azure resources that do not match the defined naming convention rule, such as requiring all resources to start with 'Contoso-'. This effect evaluates the resource against the policy rule during deployment and rejects the request with a 403 Forbidden status if the condition is not met, ensuring compliance before the resource is created.

Answer

Audit

Answer

Modify

Answer

Append

Question 14

A company uses Azure Blueprints to define a repeatable set of Azure resources and policies for new subscriptions. They want to ensure that when a new subscription is created, a specific role assignment is automatically applied. What should they include in the blueprint definition?

Accepted Answer

A role assignment artifact. Azure Blueprints allow you to define artifacts that are applied to new subscriptions. A role assignment artifact is the correct choice because it directly assigns a specific Azure RBAC role to a user, group, or service principal at the subscription scope, ensuring the role is automatically applied when the blueprint is assigned to a new subscription.

Answer

An Azure Policy assignment

Answer

An Azure Resource Manager template

Answer

A resource group

Question 15

A company has a policy that all Azure resources must have an 'Owner' tag. They want to automatically add the 'Owner' tag with a value 'Default' to any resource created without it. Which Azure Policy effect should they use?

Accepted Answer

Append. The Append effect is correct because it allows Azure Policy to add the 'Owner' tag with a value 'Default' to any resource that is created without that tag. Append works by adding specified fields (like tags) to the resource during creation or update, without blocking the operation. This ensures compliance with the tagging policy automatically, without denying the resource creation.

Answer

Modify

Answer

Deny

Answer

Audit