AZ-900 Describe Azure management and governance Practice Test 21 — 15 Questions

Question 1

A company wants to prevent any Azure resource from being accidentally deleted by anyone, including subscription owners. Which Azure feature accomplishes this?

Accepted Answer

Azure Resource Manager CanNotDelete lock. The Azure Resource Manager CanNotDelete lock is the correct feature because it prevents any user, including subscription owners, from deleting a resource. This lock overrides all RBAC permissions, ensuring that even users with Owner or Contributor roles cannot delete the resource until the lock is removed. It is specifically designed for accidental deletion prevention at the resource, resource group, or subscription level.

Answer

Azure Policy with Deny effect

Answer

RBAC Reader role

Answer

Azure Blueprints

Question 2

Which Azure tool enables administrators to run PowerShell or Bash commands to manage Azure resources directly from a web browser without installing any tools locally?

Accepted Answer

Azure Cloud Shell. Azure Cloud Shell is a browser-accessible shell environment that provides both PowerShell and Bash interfaces, allowing administrators to run commands against Azure resources without any local installation. It authenticates automatically via the Azure portal session and includes pre-installed tools like Azure CLI, AzCopy, and kubectl, making it the correct answer for managing Azure resources directly from a web browser.

Answer

Azure portal dashboard

Answer

Azure DevOps

Answer

Azure Mobile App

Question 3

An organization wants to track which team or project each Azure resource belongs to for cost allocation purposes. Which Azure feature is BEST for this?

Accepted Answer

Azure tags. Azure tags are metadata key-value pairs that can be applied to resources, resource groups, and subscriptions to logically organize them. They are the best choice for tracking cost allocation by team or project because Azure Cost Management can filter and group costs by tag values, enabling chargeback and showback scenarios.

Answer

Azure resource groups

Answer

Management groups

Answer

Azure Subscriptions

Question 4

What is the Azure free account, and what does it provide?

Accepted Answer

12 months of popular free services, $200 credit, and 55+ always-free services. The Azure free account provides new users with 12 months of popular free services (e.g., 750 hours of B1s Linux VM, 5 GB of Blob storage), a $200 credit valid for the first 30 days, and access to more than 55 services that are always free (e.g., Azure Functions with 1 million requests per month). This is designed to help users explore and learn Azure without incurring costs, but it does not grant unlimited or permanent free access.

Answer

An account with unlimited free access to all Azure services permanently

Answer

Free access for students only

Answer

A subscription that never incurs any charges

Question 5

Which Azure service provides a centralized view of all Azure resources and their health status, showing which resources are healthy, degraded, or unavailable?

Accepted Answer

Azure Resource Health. Azure Resource Health is the correct answer because it provides a personalized dashboard that shows the health of your individual Azure resources, indicating whether they are available, degraded, or unavailable. Unlike Azure Service Health, which focuses on Azure service-wide outages, Resource Health gives a resource-by-resource view, including past health events and root cause analyses.

Answer

Azure Monitor

Answer

Azure Service Health

Answer

Azure Advisor

Question 6

Which Azure feature provides a way to organize and manage access to resources by creating a hierarchy above subscriptions?

Accepted Answer

Management Groups. Management Groups provide a hierarchical structure above Azure subscriptions, enabling centralized policy and access management across multiple subscriptions. This allows you to apply Azure Policy and Role-Based Access Control (RBAC) at a higher level, which then cascades down to all child subscriptions and resource groups within the hierarchy.

Answer

Resource groups

Answer

Azure tags

Answer

Azure tenants

Question 7

A company has resources across multiple Azure subscriptions and needs a single dashboard to view cost data across all of them. Which Azure service provides this?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing is the correct service because it provides a unified dashboard that aggregates cost data across multiple Azure subscriptions, enabling centralized monitoring and analysis of spending. It supports cross-subscription views, budget tracking, and cost allocation, which directly addresses the requirement for a single dashboard to view cost data across all subscriptions.

Answer

Azure Monitor

Answer

Azure Advisor

Answer

Azure Policy

Question 8

An organization wants to ensure new Azure subscriptions always have specific resources (policies, RBAC roles, resource groups, and ARM templates) deployed automatically. Which Azure service is BEST suited?

Accepted Answer

Azure Blueprints. Azure Blueprints is the best choice because it is designed to orchestrate the deployment of a complete environment that includes policies, RBAC roles, resource groups, and ARM templates in a repeatable, versioned manner. Unlike individual services, Blueprints packages these components into a single 'blueprint' definition that can be assigned to subscriptions to ensure consistent governance from the start.

Answer

Azure Policy

Answer

ARM templates alone

Answer

Azure DevOps pipelines

Question 9

Which Azure tool helps estimate the cost savings of migrating on-premises workloads to Azure compared to current on-premises costs?

Accepted Answer

Azure TCO Calculator. The Azure TCO (Total Cost of Ownership) Calculator is specifically designed to compare the costs of running on-premises workloads against the equivalent Azure services. It takes inputs such as server, storage, and network specifications, then estimates the cost savings by factoring in Azure pricing, labor, and operational expenses. This makes it the correct tool for estimating cost savings from migration.

Answer

Azure Pricing Calculator

Answer

Azure Cost Management

Answer

Azure Advisor

Question 10

What is the difference between the Azure portal and Azure CLI?

Accepted Answer

Azure portal is a web GUI; Azure CLI is a command-line scripting tool. Option B is correct because the Azure portal is a web-based graphical user interface (GUI) for managing Azure resources through a browser, while Azure CLI is a cross-platform command-line tool that allows you to script and automate resource management using commands. Both tools can be used for production and development tasks, and they both manage resources—just through different interaction methods.

Answer

Azure portal is for production; Azure CLI is only for development

Answer

Azure portal only works on Windows; Azure CLI works cross-platform

Answer

Azure portal manages resources; Azure CLI only deploys applications

Question 11

Which feature allows Azure administrators to require users to complete an additional verification step (beyond password) before accessing Azure resources?

Accepted Answer

Azure Active Directory Multi-Factor Authentication. Azure Active Directory Multi-Factor Authentication (MFA) is the correct feature because it specifically requires users to provide an additional form of verification (e.g., a phone call, text message, or app notification) beyond just a password before accessing Azure resources. This directly addresses the need for an extra security step, which is the core of MFA. Azure RBAC, Policy, and PIM do not enforce additional authentication factors.

Answer

Azure RBAC

Answer

Azure Policy

Answer

Azure Privileged Identity Management

Question 12

An organization needs to ensure all VMs in Azure use approved VM sizes only. Which Azure feature enforces this?

Accepted Answer

Azure Policy with allowed VM SKU policy. Azure Policy with the 'Allowed virtual machine SKUs' built-in policy definition enforces which VM sizes can be deployed in a subscription or resource group. When assigned, this policy evaluates all VM creation or update requests and denies any that use a SKU not included in the allowed list, ensuring compliance with organizational standards.

Answer

Azure RBAC

Answer

Azure Resource Manager locks

Answer

Azure Cost Management budgets

Question 13

Which Azure pricing model allows customers to pay less per hour by committing to a 1-year or 3-year term for Azure services like VMs and SQL Database?

Accepted Answer

Azure Reservations. Azure Reservations (also known as Reserved Instances) allow customers to commit to a 1-year or 3-year term for specific Azure services, such as VMs and SQL Database, in exchange for a significant discount (up to 72%) on the pay-as-you-go hourly rate. This pricing model is ideal for workloads with predictable usage, as the upfront commitment lowers the per-hour cost compared to on-demand pricing.

Answer

Pay-as-you-go

Answer

Azure Spot pricing

Answer

Azure Dev/Test pricing

Question 14

An Azure administrator needs to review all changes made to Azure resources over the past 90 days, including who made each change and when. Which Azure service provides this information?

Accepted Answer

Azure Activity Log. The Azure Activity Log is a platform log in Azure that provides insight into subscription-level events. It records all control-plane operations (e.g., creating, modifying, or deleting resources) and includes details such as who initiated the operation, what the operation was, and when it occurred. The log retains this data for 90 days by default, making it the correct service for reviewing changes over that period.

Answer

Azure Monitor Metrics

Answer

Azure Resource Health

Answer

Azure Policy compliance reports

Question 15

Which Azure feature allows an organization to provide temporary, time-limited access to Azure resources without permanent role assignment?

Accepted Answer

Azure Privileged Identity Management. Azure Privileged Identity Management (PIM) is the correct answer because it provides just-in-time (JIT) privileged access to Azure resources, allowing organizations to grant time-bound, temporary permissions that automatically expire. Unlike permanent role assignments, PIM requires activation with approval, duration, and justification, ensuring least-privilege security without persistent access.

Answer

Azure Conditional Access

Answer

Azure RBAC role assignment

Answer

Azure Policy