AZ-900 Describe Azure management and governance Practice Test 20 — 15 Questions

Question 1

A company needs to ensure that Azure resources are deployed with specific settings enforced without the ability for any user to change them. Which approach achieves this?

Accepted Answer

Azure Blueprints with locked assignment mode. Azure Blueprints with locked assignment mode enforces that all resources deployed from the blueprint inherit the blueprint's configuration and cannot be modified or deleted by any user, including those with Owner permissions. This is achieved by setting the blueprint assignment to 'locked' mode, which applies a deny assignment to all resources created by the blueprint, ensuring settings are immutable.

Answer

Assign Contributor role to only trusted users

Answer

Azure Policy with audit effect

Answer

Azure Resource Manager conditional access

Question 2

Which Azure concept represents the hierarchical organization of management groups, subscriptions, resource groups, and resources?

Accepted Answer

Azure Resource Hierarchy. The Azure Resource Hierarchy is the correct answer because it defines the four-level structure—management groups, subscriptions, resource groups, and resources—that Azure uses to organize and manage access, policy, and compliance. This hierarchy allows you to apply Azure Policy and role-based access control (RBAC) at any level, with inheritance flowing downward. It is the foundational model for governance in Azure, distinct from geographic or deployment concepts.

Answer

Azure Geographic hierarchy

Answer

Azure Deployment slots hierarchy

Answer

Azure Tenant and Region structure

Question 3

Which Azure feature automatically turns off virtual machines at a scheduled time daily to reduce development costs?

Accepted Answer

Azure VM Auto-Shutdown. Azure VM Auto-Shutdown is a built-in feature that allows you to schedule automatic shutdown of virtual machines at a specified time daily, reducing costs by ensuring VMs are not running when not needed. It is configured directly on the VM blade in the Azure portal and requires no additional scripting or automation services.

Answer

Azure Policy VM power state enforcement

Answer

Azure DevTest Labs cost controls

Answer

Azure Automation runbooks for VM shutdown

Question 4

Which Azure feature enables centralized governance for multiple Azure AD tenants in a managed service provider (MSP) scenario?

Accepted Answer

Azure Lighthouse. Azure Lighthouse enables centralized governance across multiple Azure AD tenants by allowing managed service providers (MSPs) to manage resources in customer tenants from their own tenant using delegated administration. It uses Azure Resource Manager (ARM) with delegated access, eliminating the need for separate credentials or VPNs, and supports cross-tenant management at scale.

Answer

Azure Management Groups

Answer

Azure AD B2B guest access

Answer

Azure Enterprise Agreement multi-tenant billing

Question 5

An administrator wants to ensure that all Azure resources in a subscription have a 'CostCenter' tag applied. Which Azure service enforces this requirement?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules and effects over your resources. In this scenario, you can define a policy that requires the 'CostCenter' tag on all resources, and Azure Policy will automatically evaluate compliance and prevent creation of non-compliant resources or flag existing ones.

Answer

Azure Resource Manager locks

Answer

Azure Blueprints

Answer

Role-Based Access Control

Question 6

An organization wants to review the compliance status of all resources across multiple subscriptions against a set of regulatory standards. Which Azure tool provides this consolidated view?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) provides a unified view of compliance posture across all Azure subscriptions by continuously assessing resources against built-in regulatory standards (e.g., SOC 2, ISO 27001, PCI DSS) and custom policies. It aggregates compliance scores, recommendations, and security findings into a single dashboard, enabling centralized compliance management.

Answer

Azure Monitor

Answer

Azure Advisor

Answer

Azure Policy

Question 7

Which feature of Azure subscriptions allows an organization to separate billing and access management for different departments?

Accepted Answer

Multiple subscriptions. Multiple subscriptions allow an organization to create separate billing invoices and independent access management boundaries for different departments. Each subscription has its own billing relationship and can be assigned distinct Azure AD tenants or RBAC configurations, enabling cost tracking and administrative isolation per department.

Answer

Resource groups

Answer

Azure tags

Answer

Azure RBAC

Question 8

Which Azure tool provides personalized recommendations to optimize Azure resources for cost, security, reliability, performance, and operational excellence?

Accepted Answer

Azure Advisor. Azure Advisor is the correct tool because it provides personalized, actionable recommendations across five pillars: cost, security, reliability, performance, and operational excellence. It analyzes your deployed resources and usage patterns to suggest optimizations, such as right-sizing underutilized VMs or enabling geo-redundancy for storage.

Answer

Azure Monitor

Answer

Azure Security Center

Answer

Azure Service Health

Question 9

Which Azure feature allows administrators to set a maximum spending limit to prevent unexpected charges on a subscription?

Accepted Answer

Azure Cost Management budgets. Azure Cost Management budgets allow administrators to set spending limits and receive alerts when costs exceed thresholds, preventing unexpected charges. This feature directly controls subscription spending by defining budget amounts and actions, such as disabling resources or sending notifications, when the budget is reached.

Answer

Azure Policy

Answer

Azure Reservations

Answer

Azure Advisor cost recommendations

Question 10

A global organization wants to apply a consistent set of Azure policies and RBAC roles across all new subscriptions automatically as they are created. Which Azure capability enables this?

Accepted Answer

Policy inheritance via Management Groups. Management Groups allow you to apply Azure Policy and RBAC role assignments at the management group level, which are inherited by all subscriptions within that group. When a new subscription is created under the management group, it automatically receives those policies and roles, ensuring consistent governance without manual intervention.

Answer

Azure Blueprints deployment

Answer

Azure Policy initiatives

Answer

Subscription tags

Question 11

Which Azure feature allows you to define and enforce naming conventions for Azure resources?

Accepted Answer

Azure Policy with naming conditions. Azure Policy includes built-in or custom policy definitions that can enforce naming conventions on resources. When you assign a policy with naming conditions (e.g., requiring a specific prefix or suffix), Azure Policy evaluates all resource creation or update requests and denies or audits those that do not comply. This ensures consistent naming across your subscription without manual intervention.

Answer

Azure Resource Manager templates

Answer

Azure RBAC

Answer

Azure Blueprints

Question 12

An IT administrator needs to manage Azure resources via command line across both Windows and Linux systems. Which tools support this?

Accepted Answer

Azure CLI and Azure PowerShell (both cross-platform). Both Azure CLI and Azure PowerShell are cross-platform tools that run on Windows, Linux, and macOS. The Azure CLI uses Python-based commands, while Azure PowerShell uses PowerShell cmdlets with the Az module; both authenticate via Azure AD and interact with the Azure Resource Manager REST API. This allows the IT administrator to manage Azure resources from the command line on any operating system.

Answer

Azure CLI only (Linux) and PowerShell (Windows)

Answer

Azure portal only

Answer

Azure Cloud Shell (Linux only)

Question 13

What is the purpose of Azure Service Health?

Accepted Answer

To provide personalized alerts about Azure service issues and planned maintenance. Azure Service Health provides a personalized view of the health of Azure services, regions, and resources you use. It delivers proactive alerts and notifications about service-impacting events, planned maintenance, and health advisories, allowing you to take action before or during an incident. This is distinct from monitoring individual resource performance, which is handled by Azure Monitor.

Answer

To monitor the performance of virtual machines

Answer

To enforce security policies across Azure resources

Answer

To provide cost optimization recommendations

Question 14

Which Azure service provides a unified security management system that strengthens the security posture of data centers and cloud workloads?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center) is a unified security management system that provides continuous assessment, security recommendations, and threat protection across hybrid cloud workloads. It strengthens the security posture of data centers and cloud workloads by offering features like secure score, regulatory compliance dashboards, and just-in-time VM access, making it the correct answer.

Answer

Azure Firewall

Answer

Azure DDoS Protection

Answer

Azure Key Vault

Question 15

An administrator needs to grant a user the ability to manage virtual machines in a specific resource group but NOT allow them to modify networking or storage. Which approach is BEST?

Accepted Answer

Assign Virtual Machine Contributor role scoped to the resource group. The Virtual Machine Contributor role provides exactly the permissions needed to manage virtual machines, including starting, stopping, and restarting them, but explicitly excludes access to the virtual network and storage account resources. By scoping this role to the specific resource group, the administrator ensures the user cannot modify networking or storage resources outside of the VM's operational scope. This is the most precise and secure approach because it follows the principle of least privilege.

Answer

Assign Owner role at the subscription level

Answer

Assign Contributor role at the resource group level

Answer

Use Azure Policy to restrict the user's actions