AZ-900 Describe Azure management and governance Practice Test 3 — 15 Questions

Question 1

A company wants to view a consolidated list of all Azure resources across multiple subscriptions and query them using Kusto Query Language (KQL). Which Azure tool should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct tool because it provides a powerful, queryable view of all Azure resources across multiple subscriptions using Kusto Query Language (KQL). It allows you to explore, discover, and analyze resource properties and relationships at scale, making it ideal for consolidated inventory and governance queries.

Answer

Azure Resource Manager

Answer

Azure Monitor

Answer

Azure Policy

Question 2

A company has a policy that all Azure resources must have a 'CostCenter' tag. They want to automatically audit and deny the creation of any resource that does not include this tag. Which Azure Policy effect should they use?

Accepted Answer

Deny. The 'Deny' effect is correct because the company's policy requires that any resource creation attempt missing the 'CostCenter' tag must be blocked entirely, not just reported or modified. Azure Policy's Deny effect actively prevents the resource from being provisioned by rejecting the API call at the Azure Resource Manager level, ensuring non-compliant resources are never created.

Answer

Audit

Answer

Append

Answer

DeployIfNotExists

Question 3

A company uses Azure Policy to require encryption on storage accounts. They want to automatically deploy an encryption extension to any new storage account that does not have it enabled, without manual intervention. Which policy effect should they use?

Accepted Answer

DeployIfNotExists. DeployIfNotExists is the correct effect because it evaluates resources after creation and automatically deploys a required configuration (like an encryption extension) if it is missing, without requiring manual intervention. This effect is specifically designed for scenarios where you need to remediate non-compliant resources by deploying a template or extension, ensuring encryption is enabled on all storage accounts.

Answer

Modify

Answer

Append

Answer

AuditIfNotExists

Question 4

A company wants to set monthly spending limits for each department and receive alert emails when spending reaches 80% of the budget. Which Azure tool should they use?

Accepted Answer

Azure Budgets. Azure Budgets is the correct tool because it allows you to set specific spending limits (budgets) at the subscription, resource group, or management group scope and configure alert rules that trigger when costs reach a defined threshold, such as 80% of the budget. This directly meets the requirement for monthly departmental spending limits and proactive email alerts.

Answer

Azure Cost Management + Billing

Answer

Azure Advisor

Answer

Azure Policy

Question 5

An IT administrator needs to query all Azure resources across multiple subscriptions to find all virtual machines that were created in the last 30 days. They want to use a powerful query language. Which Azure service should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct service because it provides a powerful, Kusto Query Language (KQL)-based query engine that can efficiently explore and query Azure resources across multiple subscriptions, resource groups, and locations. It is specifically designed for resource discovery and inventory scenarios, such as finding all virtual machines created in the last 30 days, by filtering on properties like `createdTime`.

Answer

Azure Monitor

Answer

Azure Resource Manager

Answer

Azure CLI

Question 6

A company needs to enforce compliance by deploying a standard set of Azure resources, policies, and RBAC assignments for each new development subscription. They want to define this environment as a repeatable package. Which Azure service should they use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it enables the orchestrated deployment of a repeatable, governed environment that includes resource templates, policies, and RBAC assignments as a single, versioned package. Unlike individual services, Blueprints coordinates these components together, ensuring compliance from the moment a new subscription is created.

Answer

Azure Policy

Answer

Azure Resource Manager Templates

Answer

Management Groups

Question 7

A company has multiple Azure subscriptions for different development teams. They need to define a repeatable environment that includes a set of Azure policies, role assignments, and resource templates that must be applied to any new subscription created for a project. Which Azure service should they use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it enables the orchestrated deployment of a repeatable environment that includes Azure Policy assignments, role-based access control (RBAC) assignments, and Azure Resource Manager (ARM) template deployments as a single composable artifact. Unlike individual services, Blueprints packages these components together and supports versioning, allowing teams to consistently apply the same governance and resource definitions to any new subscription created for a project.

Answer

Azure Policy

Answer

Azure Resource Manager

Answer

Azure Management Groups

Question 8

A company's finance team needs to track Azure costs by project. Each resource is tagged with a 'Project' tag, but some resources were created without tags. The finance team wants to generate a report that shows costs grouped by project and also identifies untagged resources. Which Azure tool should they use?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing provides built-in cost analysis capabilities that allow you to group costs by tags (such as 'Project') and filter for untagged resources. It can generate reports that break down spending by tag values and explicitly show costs associated with resources that have no tags, meeting both requirements.

Answer

Azure Budgets

Answer

Azure Advisor

Answer

Azure Resource Graph

Question 9

A company wants to enforce that all Azure storage accounts must have encryption enabled. If a storage account is created without encryption, the policy should automatically enable encryption without manual intervention. Which Azure Policy effect should they use?

Accepted Answer

Modify. The Modify effect is correct because it can automatically enable encryption on a storage account that does not have it enabled, without requiring manual intervention. Unlike DeployIfNotExists, which only deploys resources if they don't exist, Modify can alter existing properties (like encryption settings) on the resource itself. This ensures compliance by remediating non-compliant resources in real time or during evaluation cycles.

Answer

Deny

Answer

Audit

Answer

DeployIfNotExists

Question 10

A company has a management group hierarchy: Root (tenant root group) > Contoso > Sales, Marketing. They want to assign an Azure policy that applies to all subscriptions under the Sales and Marketing management groups only. The policy must not affect any other subscriptions in the hierarchy. Where should they assign the policy?

Accepted Answer

Assign the policy separately at both the Sales and Marketing management groups.. Azure Policy assignments are inherited by all child resources within the scope where the policy is assigned. To restrict the policy to only the Sales and Marketing management groups without affecting other subscriptions under Contoso, you must assign the policy separately to each of those two management groups. Assigning at a higher scope (e.g., Contoso or Root) would cause the policy to apply to all subscriptions under that scope, including any other child management groups or subscriptions.

Answer

At the Root management group.

Answer

At the Contoso management group.

Answer

At the Sales management group only.

Question 11

A company needs to find all virtual machines that have the tag 'Environment:Production' and were created more than 6 months ago. They want to run a complex query across all subscriptions in their tenant. Which Azure tool should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct tool because it is designed to efficiently query across multiple subscriptions, resource groups, and resource types using the Kusto Query Language (KQL). It can filter virtual machines by the tag 'Environment:Production' and compare the 'createdTime' property to a date six months ago, all in a single, complex query that spans the entire tenant.

Answer

Azure CLI

Answer

Azure PowerShell

Answer

Azure Cost Management

Question 12

A company wants to ensure that all Azure resources are created within a specific set of approved regions. They want to automatically block any resource creation that is not in an approved region. Which Azure Policy effect should they use?

Accepted Answer

Deny. The Deny effect is correct because it actively blocks any resource creation or update that does not comply with the policy rule. In this scenario, the policy would evaluate the location property of the resource against the approved list, and if the region is not approved, the Deny effect prevents the deployment entirely, returning a 403 Forbidden error. This ensures that only resources in approved regions are created, meeting the company's requirement to automatically block non-compliant deployments.

Answer

Append

Answer

Audit

Answer

DeployIfNotExists

Question 13

A company has multiple departments, each with its own Azure subscription. They want to apply the same set of policies and role assignments to all subscriptions under the Sales department. They also plan to create more subscriptions for Sales in the future. Which Azure construct should they use?

Accepted Answer

Management group. Management groups allow you to apply Azure Policy and role-based access control (RBAC) assignments hierarchically across multiple subscriptions. By placing all Sales department subscriptions under a single management group, any policies or role assignments defined at that management group level will be inherited by all current and future subscriptions within it, ensuring consistent governance.

Answer

Resource group

Answer

Policy initiative

Answer

Blueprint

Question 14

A company uses Azure Blueprints to define a standard environment for all new development subscriptions. The blueprint includes a set of Azure policies, role assignments, and resource templates. However, after applying the blueprint, some resources are created that do not comply with the policies. The company wants to be notified of these non-compliant resources without blocking their creation. Which Azure Policy effect should be used in the blueprint?

Accepted Answer

Audit. The Audit effect is correct because it enables Azure Policy to evaluate resources against the defined policies and log compliance warnings in the activity log without blocking resource creation. This meets the requirement to be notified of non-compliant resources while allowing them to be created.

Answer

Deny

Answer

Append

Answer

DeployIfNotExists

Question 15

A company wants to query all Azure resources across multiple subscriptions to find all storage accounts without encryption enabled. They need to use a powerful query language to filter and join data. Which Azure tool should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph (ARG) is the correct tool because it provides a powerful, Kusto Query Language (KQL)-based query engine that can explore Azure resources across multiple subscriptions, resource groups, and management groups. It allows you to filter, project, and join resource data (e.g., find all storage accounts where encryption is disabled) using a single query, making it ideal for cross-subscription resource discovery and compliance checks.

Answer

Azure Monitor Logs

Answer

Azure Advisor

Answer

Azure Policy