AZ-900 Describe Azure management and governance Practice Test 4 — 15 Questions

Question 1

A company has an Azure Policy assigned to all subscriptions that denies creation of any resource without a 'CostCenter' tag. During an emergency, a team needs to create a resource without the tag. They want a temporary exception without changing the policy. What should they create?

Accepted Answer

Policy exemption. A Policy exemption allows you to create an exception for a specific resource or subscription without modifying the underlying policy definition. In this scenario, the team can request an exemption (e.g., 'Emergency' or 'Waiver' category) to bypass the 'CostCenter' tag requirement temporarily, while the policy remains enforced for all other resources.

Answer

Policy initiative

Answer

Role assignment

Answer

Blueprint

Question 2

A company has multiple Azure subscriptions for different projects. They want to apply the same set of Azure policies and role assignments to all subscriptions under a specific department, and they plan to add more subscriptions in the future. Which Azure construct should they use?

Accepted Answer

Management group. A management group is the correct construct because it allows you to manage governance, policy, and role assignments across multiple Azure subscriptions hierarchically. By placing all subscriptions for a department under a single management group, you can apply the same Azure Policy and role-based access control (RBAC) assignments once, and any new subscriptions added to that group will automatically inherit those settings.

Answer

Resource group

Answer

Azure Policy initiative

Answer

Azure Blueprint

Question 3

A company wants to organize their Azure subscriptions into a hierarchy for policy and cost management. They have multiple departments, each with multiple subscriptions. What should they create first to establish this structure?

Accepted Answer

Management groups. Management groups are the correct first step because they provide a hierarchical structure above subscriptions, enabling you to organize multiple subscriptions into logical groupings for policy and cost management. By creating management groups first, you can then apply Azure Policy and cost controls at the management group level, which automatically cascades to all child subscriptions and resource groups. This aligns with the Azure governance hierarchy: management groups → subscriptions → resource groups → resources.

Answer

Resource groups

Answer

Policies

Answer

Subscriptions

Question 4

A company uses Azure Policy to enforce encryption on storage accounts. They discover some existing storage accounts are non-compliant. They want to automatically enable encryption on these accounts without manual intervention. Which combination of policy effects should they use?

Accepted Answer

Audit and DeployIfNotExists. The correct combination is Audit and DeployIfNotExists. Audit logs non-compliant storage accounts without blocking them, while DeployIfNotExists automatically enables encryption on those accounts by deploying a remediation task. This ensures existing non-compliant resources are brought into compliance without manual intervention.

Answer

Deny and Audit

Answer

Append and Modify

Answer

Audit and Disabled

Question 5

A company needs to ensure that all Azure resources have a mandatory 'CostCenter' tag. If a resource is created without this tag, the resource creation should be blocked. Which Azure Policy effect should they use?

Accepted Answer

Deny. The Deny effect is correct because it actively blocks any resource creation or update that does not comply with the policy rule, such as missing the mandatory 'CostCenter' tag. This ensures that non-compliant resources are never provisioned, enforcing governance at the point of creation.

Answer

Append

Answer

Audit

Answer

DeployIfNotExists

Question 6

A company wants to track and manage costs across multiple Azure subscriptions. They have created a hierarchy of management groups: Root -> Department A -> Project 1, Project 2. They want to see the total cost for Department A across all its projects. Which Azure tool should they use?

Accepted Answer

Cost Management + Billing. Cost Management + Billing is the correct tool because it provides consolidated cost tracking and analysis across multiple subscriptions and management groups. By organizing subscriptions under the Department A management group, Cost Management can aggregate costs from Project 1 and Project 2, allowing the company to view the total cost for Department A in a single dashboard or report.

Answer

Azure Policy

Answer

Azure Advisor

Answer

Azure Monitor

Question 7

A company wants to ensure that all Azure resources are tagged with metadata such as 'Environment' and 'Department'. They have created an Azure Policy that appends the required tags and their values when a resource is created. However, they notice that some resources created before the policy assignment are missing tags. They want to automatically add those tags without manual effort. What should they do?

Accepted Answer

Create a new policy with DeployIfNotExists effect. Option B is correct because the DeployIfNotExists (DINE) policy effect can automatically remediate non-compliant resources, including those created before the policy assignment. When combined with a managed identity, DINE triggers a deployment task that adds the required tags without manual intervention, addressing the gap left by the 'append' effect which only acts on new resources.

Answer

Create a remediation task for the policy

Answer

Use Azure Resource Graph to query and update

Answer

Create an Azure Automation runbook

Question 8

A company wants to enforce a set of security policies across all their Azure subscriptions. They have created several individual policy definitions. Which Azure construct should they use to group these policies together and assign them as a single package?

Accepted Answer

Policy Initiative. A Policy Initiative (also known as a policy set) in Azure allows you to group multiple individual policy definitions into a single package. This enables you to assign the entire set of security policies together across subscriptions, ensuring consistent enforcement. It simplifies management by applying a collection of related policies as one unit.

Answer

Azure Blueprint

Answer

Management Group

Answer

Resource Group

Question 9

A company needs to grant a group of users the ability to restart and start/stop virtual machines, but not to create or delete them. They want to assign this permission at the resource group level. What should they do?

Accepted Answer

Create a custom role with the required actions. Option B is correct because Azure's built-in roles do not provide a granular permission set that allows restarting and starting/stopping VMs while explicitly denying creation and deletion. A custom role must be created with specific actions such as 'Microsoft.Compute/virtualMachines/start/action', 'Microsoft.Compute/virtualMachines/restart/action', and 'Microsoft.Compute/virtualMachines/deallocate/action', and exclude actions like 'Microsoft.Compute/virtualMachines/write' and 'Microsoft.Compute/virtualMachines/delete'. This custom role can then be assigned at the resource group scope to grant the precise permissions required.

Answer

Assign the built-in Contributor role

Answer

Assign the built-in Virtual Machine Contributor role

Answer

Use Azure Policy to restrict operations

Question 10

A company has a management group hierarchy: Root > Europe > Production. They assign a policy at the Root level that denies creation of resources without a tag. Later, they assign a different policy at the Europe level. What is the effective effect on the Production subscription?

Accepted Answer

Both policies apply. Azure Policy is inherited by default from higher-level management groups down to subscriptions. When a policy is assigned at the Root management group, it applies to all child management groups and subscriptions, including the Production subscription. Assigning an additional policy at the Europe management group does not remove or override the Root-level policy; instead, both policies are evaluated and enforced, with the most restrictive effect taking precedence. Therefore, the Production subscription is subject to both policies.

Answer

Only the policy at the Europe level applies

Answer

Only the policy at the Root level applies

Answer

The policy at the lower level overrides the Root policy

Question 11

A company uses Azure Blueprints to define a standard environment. They publish a new version of the blueprint with an updated role assignment. All existing subscriptions that were created from an older version need to receive the new role assignment. What should they do?

Accepted Answer

Use the 'Update existing assignments' option. Option D is correct because Azure Blueprints provides a built-in 'Update existing assignments' option that propagates changes from a published blueprint version to all existing assigned subscriptions. This ensures that updated role assignments are applied without manual intervention, maintaining consistency across the environment.

Answer

Reassign the blueprint to each subscription manually

Answer

The blueprint updates automatically

Answer

Manually add the role assignment to each subscription

Question 12

A company wants to monitor the performance of their Azure VMs and receive alerts when CPU usage exceeds 90%. Which Azure service should they use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a comprehensive solution for collecting, analyzing, and acting on telemetry from Azure resources, including VMs. It includes metrics like CPU percentage and allows you to configure metric alerts that trigger when a threshold (e.g., 90% CPU usage) is exceeded. This directly meets the requirement for performance monitoring and alerting.

Answer

Azure Policy

Answer

Azure Security Center

Answer

Azure Cost Management

Question 13

A company wants to organize their Azure subscriptions into a hierarchy to manage access policies and cost across different departments. They have three departments: Sales, Marketing, IT. What should they create first?

Accepted Answer

Management groups. Management groups are the correct first step because they allow you to organize Azure subscriptions into a hierarchy for centralized management of access policies and cost across departments. By creating a management group hierarchy (e.g., Root → Departments → Sales, Marketing, IT), you can apply Azure Policy and role-based access control (RBAC) at the management group level, which then cascades down to all subscriptions and resources within that branch. This enables consistent governance and cost tracking across the entire department without needing to configure each subscription individually.

Answer

Resource groups

Answer

Azure Policy

Answer

Tagging

Question 14

A company has multiple Azure subscriptions for different projects. They want to apply a common set of policies and role assignments to all subscriptions under the 'Research' department. They also plan to add more subscriptions for Research in the future. What should they use?

Accepted Answer

Azure management group. Azure management groups allow you to efficiently manage access, policies, and compliance across multiple Azure subscriptions. By placing all 'Research' subscriptions under a single management group, you can apply a common set of Azure Policy assignments and Azure role-based access control (RBAC) assignments at the management group scope, which automatically cascades to all current and future subscriptions within that group. This hierarchical structure is specifically designed for enterprise-scale governance across departments.

Answer

Azure resource group

Answer

Azure Blueprint

Answer

Azure Policy initiative

Question 15

A company has a management group hierarchy: Root → UK → Production. They assign a policy at the Root level that allows only certain VM sizes. Later, they assign another policy at the UK level that denies all resources. What is the effective effect on the Production subscription?

Accepted Answer

Both policies apply, and the most restrictive (Deny) takes precedence.. D is correct because Azure Policy is inherited and cumulative down the management group hierarchy. The Root-level policy (allow only certain VM sizes) and the UK-level policy (deny all resources) both apply to the Production subscription. When a deny policy conflicts with an allow policy, the deny effect always takes precedence, making the most restrictive policy effective.

Answer

Only the Root policy applies because it is at the highest level.

Answer

Only the UK policy applies because it is more specific.

Answer

Both policies apply, and the order of evaluation could cause a conflict.