AZ-900 Describe Azure management and governance Practice Test 3 — 15 Questions

Question 1

A company has a critical Azure resource group that contains production resources. They want to ensure that no one can accidentally delete or modify the resources in this group, even if they have Contributor permissions. Which Azure feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Resource Locks. Resource Locks are the correct choice because they provide a way to prevent accidental deletion or modification of critical Azure resources by applying a lock at the resource, resource group, or subscription level. Even users with Contributor or Owner permissions are blocked from performing delete or modify operations when a lock is set to 'CanNotDelete' or 'ReadOnly'. This ensures that production resources are protected beyond the permissions granted by RBAC.

Answer

Azure Policy

Answer

Role-Based Access Control (RBAC)

Answer

Management Groups

Question 2

A company wants to receive notifications when Azure services in their region experience an outage or planned maintenance that might affect their resources. Which Azure service should they set up alerts for?

Accepted Answer

Azure Service Health. Azure Service Health is the correct service because it provides personalized alerts and notifications specifically for Azure service issues—such as outages and planned maintenance—that affect your subscriptions and resources in a given region. It combines global service health information with region-specific and resource-specific impacts, allowing you to configure alerts via Azure Service Health alerts (formerly known as Service Health Alerts).

Answer

Azure Monitor

Answer

Azure Advisor

Answer

Azure Resource Health

Question 3

A company wants to ensure that all Azure resources are tagged with a 'CostCenter' tag at creation time. If a resource is created without the tag, it should be automatically denied. Which Azure Policy effect should they use?

Accepted Answer

A) deny. The 'deny' effect is correct because it actively blocks any resource creation request that does not include the required 'CostCenter' tag. Azure Policy with the 'deny' effect evaluates the resource against the policy rule at creation or update time and rejects the request if the condition is not met, ensuring compliance before the resource is provisioned.

Answer

B) audit

Answer

C) append

Answer

D) deployIfNotExists

Question 4

A company wants to track resource usage across departments and projects. They have multiple Azure subscriptions. They need to assign costs to specific departments based on resource usage. Which Azure feature enables them to view and analyze costs by resource tags?

Accepted Answer

A) Azure Cost Management + Billing. Azure Cost Management + Billing provides the tools to view, analyze, and allocate costs across subscriptions and resources. By enabling tag inheritance and using cost analysis filters, you can group costs by resource tags (e.g., Department or Project) to assign spending to specific departments. This is the correct feature because it directly supports cost tracking and allocation by tags.

Answer

B) Azure Policy

Answer

C) Azure Tags

Answer

D) Azure Resource Groups

Question 5

A company has a policy that requires all storage accounts to have secure transfer enabled. They want to automatically audit all existing storage accounts and enforce the setting on new ones. They also want to automatically fix non-compliant new storage accounts. Which Azure Policy effect combination should they use?

Accepted Answer

D) modify and audit. The correct combination is 'audit' and 'modify'. 'audit' logs non-compliant existing storage accounts without changing them, satisfying the audit requirement. 'modify' automatically changes the secure transfer property on new storage accounts during creation, enforcing the policy without blocking deployment. 'deployIfNotExists' is incorrect because it only deploys additional resources (e.g., a diagnostic setting), it does not modify properties of the resource itself.

Answer

A) audit and deny

Answer

B) audit and deployIfNotExists

Answer

C) append and deny

Question 6

A company uses Azure Resource Manager templates to deploy infrastructure. They need to manage secrets such as database connection strings and passwords securely. Which Azure service should they use to store and retrieve these secrets during deployment?

Accepted Answer

A) Azure Key Vault. Azure Key Vault is the correct service because it is designed specifically to securely store and manage secrets such as database connection strings, passwords, and certificates. During Azure Resource Manager (ARM) template deployments, you can reference Key Vault secrets directly in the template using a linked template or a parameter file, allowing the secrets to be retrieved at deployment time without exposing them in plaintext. This integration ensures that sensitive values are never hardcoded or stored in source control.

Answer

B) Azure Policy

Answer

C) Azure Managed Identity

Answer

D) Azure Service Principal

Question 7

A company manages multiple Azure subscriptions for different business units. They want to define a standard set of policies, such as allowed VM SKUs and required resource tags, and ensure these policies are always applied whenever a new subscription is created. Which Azure feature should they use to enforce governance at this level?

Accepted Answer

Azure Management Groups. Azure Management Groups allow you to organize subscriptions into a hierarchy and apply governance policies at the management group level. When a new subscription is created under a management group, it automatically inherits the policies assigned to that group, ensuring consistent enforcement across all subscriptions without manual intervention.

Answer

Azure Policy

Answer

Azure Resource Manager templates

Answer

Azure Blueprints

Question 8

A company uses Azure Policy to require that all storage accounts must have blob soft delete enabled. They also want to automatically create a remediation task that fixes any existing non-compliant storage accounts. Which policy effect should they include in the policy definition to achieve automatic remediation?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is designed to automatically remediate non-compliant resources by deploying a defined template (e.g., enabling blob soft delete) when the resource is evaluated as non-compliant. This effect triggers a remediation task that can be run on existing resources, ensuring all storage accounts meet the policy requirement without manual intervention.

Answer

Deny

Answer

Audit

Answer

Append

Question 9

A company has a policy that all Azure resources deployed to production subscriptions must be tagged with a 'CostCenter' tag. They want to automatically prevent the creation of any resource that does not include this tag. Which Azure Policy effect should they use in their policy definition?

Accepted Answer

Deny. The Deny effect is correct because it actively prevents the creation or deployment of any Azure resource that does not comply with the policy rule, such as missing the required 'CostCenter' tag. Unlike Audit, which only logs compliance violations without blocking the operation, Deny enforces the policy at the time of the resource creation request, ensuring non-compliant resources are never provisioned.

Answer

Audit

Answer

DeployIfNotExists

Answer

Modify

Question 10

A company wants to analyze historical spending data across all Azure subscriptions and set proactive budget alerts to prevent cost overruns. They also need to identify spending trends by resource type. Which Azure tool should they use to meet all these requirements?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing is the correct tool because it provides native capabilities for analyzing historical spending data across all Azure subscriptions, setting proactive budget alerts with cost thresholds, and generating detailed cost analysis reports that can be filtered by resource type to identify spending trends. It integrates directly with Azure billing data and supports multi-subscription views, making it the single solution for all three requirements.

Answer

Azure Advisor

Answer

Azure Monitor

Answer

Azure Policy

Question 11

A company has an Azure policy requirement that all new resources in a specific resource group must have a 'Department' tag. If a resource is created without this tag, the tag should be automatically added with a default value of 'Finance'. Which Azure Policy effect should be used?

Accepted Answer

Append. The Append effect is correct because it allows Azure Policy to automatically add a 'Department' tag with a default value of 'Finance' to any resource created without it in the specified resource group. This effect modifies the resource during creation or update to enforce compliance without blocking the operation.

Answer

Deny

Answer

Audit

Answer

Modify

Question 12

A company has multiple Azure subscriptions for different departments. The IT team wants to apply a common set of policies (e.g., allowed VM sizes) and assign the same role-based access control (RBAC) permissions across all subscriptions automatically. Which Azure feature should they use?

Accepted Answer

Azure Management Groups. Azure Management Groups allow you to organize Azure subscriptions hierarchically and apply governance conditions, such as RBAC assignments and Azure Policy definitions, at the management group level. These conditions are inherited by all subscriptions within the group, enabling automatic and consistent application of policies and permissions across multiple subscriptions without manual per-subscription configuration.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Resource Manager (ARM) templates

Question 13

A company wants to track spending across different projects. They have multiple Azure subscriptions and need to assign costs to specific departments based on resource usage. Which Azure feature enables them to view and analyze costs by resource tags?

Accepted Answer

Azure Cost Management. Azure Cost Management provides tools to view, analyze, and optimize cloud spending. It supports filtering and grouping costs by resource tags, enabling you to assign costs to specific departments or projects based on tagged resource usage.

Answer

Azure Policy

Answer

Azure Advisor

Answer

Azure Monitor

Question 14

A company has multiple Azure subscriptions for different departments. The IT team wants to ensure that all resources in a specific subscription are only deployed in the 'West Europe' region. Which Azure feature should they use to enforce this restriction?

Accepted Answer

Azure Policy. Azure Policy is correct because it allows you to create, assign, and manage policies that enforce specific rules or effects on your resources. By defining a policy that restricts allowed locations to 'West Europe' and assigning it to the subscription scope, Azure Policy will deny or audit any resource deployment that does not comply with this geographic restriction.

Answer

Azure RBAC

Answer

Azure Blueprints

Answer

Azure Resource Graph

Question 15

A company wants to track costs by department across multiple Azure subscriptions. They have tagged resources with 'Department' tags. However, some resources are missing tags. They want to see a report of costs grouped by department, including untagged resources. Which Azure tool should they use?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing provides native cost analysis and reporting capabilities that can group costs by custom tags (like 'Department') and includes an 'Untagged' category for resources missing the specified tag. This allows the company to see a complete cost breakdown by department, including untagged resources, across multiple subscriptions in a single view.

Answer

Azure Policy

Answer

Azure Resource Graph

Answer

Azure Advisor