AZ-900 Describe Azure management and governance Practice Test 4 — 15 Questions

Question 1

A company wants to enforce a naming convention for all Azure resources. For example, all resources must start with 'Contoso-'. They want to automatically audit and deny creation of resources that do not follow the naming convention. Which Azure Policy effect should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deny. The Deny effect is correct because it actively prevents the creation of Azure resources that do not match the defined naming convention rule, such as requiring all resources to start with 'Contoso-'. This effect evaluates the resource against the policy rule during deployment and rejects the request with a 403 Forbidden status if the condition is not met, ensuring compliance before the resource is created.

Answer

Audit

Answer

Modify

Answer

Append

Question 2

A company uses Azure Blueprints to define a repeatable set of Azure resources and policies for new subscriptions. They want to ensure that when a new subscription is created, a specific role assignment is automatically applied. What should they include in the blueprint definition?

Accepted Answer

A role assignment artifact. Azure Blueprints allow you to define artifacts that are applied to new subscriptions. A role assignment artifact is the correct choice because it directly assigns a specific Azure RBAC role to a user, group, or service principal at the subscription scope, ensuring the role is automatically applied when the blueprint is assigned to a new subscription.

Answer

An Azure Policy assignment

Answer

An Azure Resource Manager template

Answer

A resource group

Question 3

A company has a policy that all Azure resources must have an 'Owner' tag. They want to automatically add the 'Owner' tag with a value 'Default' to any resource created without it. Which Azure Policy effect should they use?

Accepted Answer

Append. The Append effect is correct because it allows Azure Policy to add the 'Owner' tag with a value 'Default' to any resource that is created without that tag. Append works by adding specified fields (like tags) to the resource during creation or update, without blocking the operation. This ensures compliance with the tagging policy automatically, without denying the resource creation.

Answer

Modify

Answer

Deny

Answer

Audit

Question 4

A company wants to view a consolidated list of all Azure resources across multiple subscriptions and query them using Kusto Query Language (KQL). Which Azure tool should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct tool because it provides a powerful, queryable view of all Azure resources across multiple subscriptions using Kusto Query Language (KQL). It allows you to explore, discover, and analyze resource properties and relationships at scale, making it ideal for consolidated inventory and governance queries.

Answer

Azure Resource Manager

Answer

Azure Monitor

Answer

Azure Policy

Question 5

A company has a policy that all Azure resources must have a 'CostCenter' tag. They want to automatically audit and deny the creation of any resource that does not include this tag. Which Azure Policy effect should they use?

Accepted Answer

Deny. The 'Deny' effect is correct because the company's policy requires that any resource creation attempt missing the 'CostCenter' tag must be blocked entirely, not just reported or modified. Azure Policy's Deny effect actively prevents the resource from being provisioned by rejecting the API call at the Azure Resource Manager level, ensuring non-compliant resources are never created.

Answer

Audit

Answer

Append

Answer

DeployIfNotExists

Question 6

A company uses Azure Policy to require encryption on storage accounts. They want to automatically deploy an encryption extension to any new storage account that does not have it enabled, without manual intervention. Which policy effect should they use?

Accepted Answer

DeployIfNotExists. DeployIfNotExists is the correct effect because it evaluates resources after creation and automatically deploys a required configuration (like an encryption extension) if it is missing, without requiring manual intervention. This effect is specifically designed for scenarios where you need to remediate non-compliant resources by deploying a template or extension, ensuring encryption is enabled on all storage accounts.

Answer

Modify

Answer

Append

Answer

AuditIfNotExists

Question 7

A company wants to set monthly spending limits for each department and receive alert emails when spending reaches 80% of the budget. Which Azure tool should they use?

Accepted Answer

Azure Budgets. Azure Budgets is the correct tool because it allows you to set specific spending limits (budgets) at the subscription, resource group, or management group scope and configure alert rules that trigger when costs reach a defined threshold, such as 80% of the budget. This directly meets the requirement for monthly departmental spending limits and proactive email alerts.

Answer

Azure Cost Management + Billing

Answer

Azure Advisor

Answer

Azure Policy

Question 8

An IT administrator needs to query all Azure resources across multiple subscriptions to find all virtual machines that were created in the last 30 days. They want to use a powerful query language. Which Azure service should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct service because it provides a powerful, Kusto Query Language (KQL)-based query engine that can efficiently explore and query Azure resources across multiple subscriptions, resource groups, and locations. It is specifically designed for resource discovery and inventory scenarios, such as finding all virtual machines created in the last 30 days, by filtering on properties like `createdTime`.

Answer

Azure Monitor

Answer

Azure Resource Manager

Answer

Azure CLI

Question 9

A company needs to enforce compliance by deploying a standard set of Azure resources, policies, and RBAC assignments for each new development subscription. They want to define this environment as a repeatable package. Which Azure service should they use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it enables the orchestrated deployment of a repeatable, governed environment that includes resource templates, policies, and RBAC assignments as a single, versioned package. Unlike individual services, Blueprints coordinates these components together, ensuring compliance from the moment a new subscription is created.

Answer

Azure Policy

Answer

Azure Resource Manager Templates

Answer

Management Groups

Question 10

A company has multiple Azure subscriptions for different development teams. They need to define a repeatable environment that includes a set of Azure policies, role assignments, and resource templates that must be applied to any new subscription created for a project. Which Azure service should they use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it enables the orchestrated deployment of a repeatable environment that includes Azure Policy assignments, role-based access control (RBAC) assignments, and Azure Resource Manager (ARM) template deployments as a single composable artifact. Unlike individual services, Blueprints packages these components together and supports versioning, allowing teams to consistently apply the same governance and resource definitions to any new subscription created for a project.

Answer

Azure Policy

Answer

Azure Resource Manager

Answer

Azure Management Groups

Question 11

A company's finance team needs to track Azure costs by project. Each resource is tagged with a 'Project' tag, but some resources were created without tags. The finance team wants to generate a report that shows costs grouped by project and also identifies untagged resources. Which Azure tool should they use?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing provides built-in cost analysis capabilities that allow you to group costs by tags (such as 'Project') and filter for untagged resources. It can generate reports that break down spending by tag values and explicitly show costs associated with resources that have no tags, meeting both requirements.

Answer

Azure Budgets

Answer

Azure Advisor

Answer

Azure Resource Graph

Question 12

A company wants to enforce that all Azure storage accounts must have encryption enabled. If a storage account is created without encryption, the policy should automatically enable encryption without manual intervention. Which Azure Policy effect should they use?

Accepted Answer

Modify. The Modify effect is correct because it can automatically enable encryption on a storage account that does not have it enabled, without requiring manual intervention. Unlike DeployIfNotExists, which only deploys resources if they don't exist, Modify can alter existing properties (like encryption settings) on the resource itself. This ensures compliance by remediating non-compliant resources in real time or during evaluation cycles.

Answer

Deny

Answer

Audit

Answer

DeployIfNotExists

Question 13

A company has a management group hierarchy: Root (tenant root group) > Contoso > Sales, Marketing. They want to assign an Azure policy that applies to all subscriptions under the Sales and Marketing management groups only. The policy must not affect any other subscriptions in the hierarchy. Where should they assign the policy?

Accepted Answer

Assign the policy separately at both the Sales and Marketing management groups.. Azure Policy assignments are inherited by all child resources within the scope where the policy is assigned. To restrict the policy to only the Sales and Marketing management groups without affecting other subscriptions under Contoso, you must assign the policy separately to each of those two management groups. Assigning at a higher scope (e.g., Contoso or Root) would cause the policy to apply to all subscriptions under that scope, including any other child management groups or subscriptions.

Answer

At the Root management group.

Answer

At the Contoso management group.

Answer

At the Sales management group only.

Question 14

A company needs to find all virtual machines that have the tag 'Environment:Production' and were created more than 6 months ago. They want to run a complex query across all subscriptions in their tenant. Which Azure tool should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph is the correct tool because it is designed to efficiently query across multiple subscriptions, resource groups, and resource types using the Kusto Query Language (KQL). It can filter virtual machines by the tag 'Environment:Production' and compare the 'createdTime' property to a date six months ago, all in a single, complex query that spans the entire tenant.

Answer

Azure CLI

Answer

Azure PowerShell

Answer

Azure Cost Management

Question 15

A company wants to ensure that all Azure resources are created within a specific set of approved regions. They want to automatically block any resource creation that is not in an approved region. Which Azure Policy effect should they use?

Accepted Answer

Deny. The Deny effect is correct because it actively blocks any resource creation or update that does not comply with the policy rule. In this scenario, the policy would evaluate the location property of the resource against the approved list, and if the region is not approved, the Deny effect prevents the deployment entirely, returning a 403 Forbidden error. This ensures that only resources in approved regions are created, meeting the company's requirement to automatically block non-compliant deployments.

Answer

Append

Answer

Audit

Answer

DeployIfNotExists