AZ-900 Describe Azure management and governance Practice Test 5 — 15 Questions

Question 1

A company wants to enforce a naming convention on all Azure resources by automatically adding a tag with the environment name (e.g., 'Env-Prod' or 'Env-Dev') when a resource is created. They do not want to block resource creation if the tag is missing. Which Azure Policy effect should they use?

Accepted Answer

Append. The Append effect adds a specified tag (e.g., 'Env-Prod' or 'Env-Dev') to a resource during creation or update without blocking the operation. This matches the requirement to enforce a naming convention via tags automatically while allowing resource creation to proceed even if the tag is missing.

Answer

Deny

Answer

Audit

Answer

DeployIfNotExists

Question 2

A company has created an Azure Blueprint to define a standard environment with role assignments and policies. They have published multiple versions. They want all existing subscriptions that were created from an older version to automatically receive the updates from the latest version. What should they do?

Accepted Answer

Upgrade the blueprint assignment on the existing subscriptions. Option B is correct because Azure Blueprints allow you to update assignments on existing subscriptions to the latest published version. When you upgrade the blueprint assignment, it applies any new role assignments, policies, or artifacts defined in the newer version to the target subscriptions, ensuring they remain compliant with the updated standard environment.

Answer

Create a new subscription from the latest blueprint version

Answer

Reassign the blueprint to the subscriptions

Answer

Nothing, updates apply automatically

Question 3

A company wants to ensure that all new Azure storage accounts have a specific encryption setting enabled. They also want to automatically remediate any existing non-compliant storage accounts without manual effort. Which Azure Policy effect should they use?

Accepted Answer

DeployIfNotExists. DeployIfNotExists is the correct effect because it not only evaluates the compliance of storage accounts against the encryption policy but also automatically deploys a remediation task (e.g., enabling encryption via a linked ARM template or Azure function) to bring non-compliant resources into compliance without manual intervention. This effect is specifically designed for scenarios where the resource itself needs to be modified or configured to meet the policy requirement.

Answer

Append

Answer

AuditIfNotExists

Answer

Deny

Question 4

A company has multiple Azure subscriptions for different departments. They want to track and analyze costs, and allocate costs to each department based on tags applied to resources. Which Azure tool should they use?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing provides native capabilities to monitor, analyze, and optimize cloud costs. It supports filtering and grouping costs by custom tags applied to resources, enabling allocation of charges to specific departments or cost centers. This directly meets the requirement to track and allocate costs based on tags.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Advisor

Question 5

A company needs to grant a specific user the ability to restart virtual machines in a specific resource group, but not to create, delete, or modify them in any other way. The built-in 'Virtual Machine Contributor' role grants too many permissions. What is the most appropriate solution?

Accepted Answer

Assign the 'Reader' role and create a custom RBAC role with only the 'Microsoft.Compute/virtualMachines/restart/action' permission. Option A is correct because it combines the 'Reader' role (which allows read-only access to all resources) with a custom RBAC role that grants only the specific 'Microsoft.Compute/virtualMachines/restart/action' permission. This ensures the user can restart VMs in the target resource group without being able to create, delete, or modify them, meeting the exact requirement.

Answer

Assign the 'Virtual Machine Operator' built-in role

Answer

Create a custom role with 'Contributor' and then add a deny assignment for delete and create

Answer

Assign the 'Owner' role and then remove permissions

Question 6

A company has multiple subscriptions. They want to apply a policy that denies creation of resources without a specific tag at the top-level management group. Later, they need to allow a specific subscription to create resources without that tag. What should they do?

Accepted Answer

Create an exclusion for that subscription in the policy assignment.. Azure Policy allows you to assign policies at the management group scope, which applies to all child subscriptions. When you need to exempt a specific subscription from a policy effect (like 'Deny'), you can configure an exclusion on the policy assignment at the management group level. This exclusion removes the policy evaluation for that subscription, allowing resources to be created without the required tag.

Answer

Assign a different policy at the subscription level that allows untagged resources.

Answer

Modify the top-level policy to include an exemption.

Answer

Remove the subscription from the management group.

Question 7

A company wants to ensure that all resources in their Azure environment are created with mandatory tags for cost tracking. They have already assigned a policy to append tags, but existing resources are still missing tags. They want to automatically add the tags to existing resources without manual intervention. What should they do?

Accepted Answer

Create a remediation task for the policy.. A remediation task is the correct solution because Azure Policy's 'append' effect only applies to new or updated resources. To automatically add the missing tags to existing non-compliant resources, you must create a remediation task that triggers a deployment to apply the policy's 'deployIfNotExists' or 'modify' effect. This task runs on demand or on a schedule to bring existing resources into compliance without manual intervention.

Answer

Modify the policy effect to 'deny' instead of 'append'.

Answer

Use Azure Resource Graph to identify and manually tag.

Answer

Reassign the policy with a new scope.

Question 8

A company wants to enforce that all storage accounts use the 'Standard' performance tier and block creation of any 'Premium' storage accounts. Which Azure Policy effect could achieve this?

Accepted Answer

Deny. The Deny effect is the correct choice because it actively prevents the creation of Azure resources that do not comply with the policy definition. In this scenario, by assigning a policy with the Deny effect that targets storage accounts with the 'Premium' performance tier, Azure Resource Manager will block any request to create a Premium storage account, ensuring only 'Standard' tier accounts are provisioned.

Answer

Append

Answer

Audit

Answer

Disabled

Question 9

A company uses Azure Blueprints to define a standard environment with policies, role assignments, and resource groups. They publish a new version of the blueprint that adds a new role assignment. However, existing subscriptions created from older versions do not have this new role assignment. What must they do to apply the update to existing subscriptions?

Accepted Answer

They need to update the existing blueprint assignment to use the latest published version.. Azure Blueprints assignments are not automatically updated when a new version of the blueprint is published. To apply the new role assignment to existing subscriptions, you must update the existing blueprint assignment to reference the latest published version. This triggers Azure to evaluate and apply the changes defined in the new version, including the new role assignment, to the assigned subscriptions.

Answer

Delete and recreate the subscriptions using the new blueprint.

Answer

The blueprint version update is automatically applied to all existing subscriptions.

Answer

They must manually assign the role to each subscription.

Question 10

A company wants to ensure a specific resource group cannot be deleted, but they also need to be able to delete it temporarily during maintenance windows. Which approach allows the most granular control?

Accepted Answer

Apply a 'CanNotDelete' resource lock and remove it before maintenance.. A 'CanNotDelete' resource lock prevents deletion of a resource group and its resources, but it can be removed and reapplied as needed, providing granular control during maintenance windows. This approach allows temporary deletion by removing the lock, performing the deletion, and then reapplying the lock afterward. It is the only option that directly supports the requirement for both protection and temporary removal without permanent configuration changes.

Answer

Assign an Azure Policy with deny effect on delete operations.

Answer

Use Azure RBAC with a custom role that denies delete.

Answer

Use Azure Blueprints to enforce protection.

Question 11

A company wants to enforce a policy that all Azure resources must have a 'CostCenter' tag. They want to automatically apply the tag to new resources, and also to existing resources that are missing it. Which Azure service should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it can enforce tagging rules by evaluating resources against a policy definition and automatically applying the 'CostCenter' tag to new resources via the 'deployIfNotExists' effect. It can also remediate existing non-compliant resources by triggering a remediation task that applies the missing tag. This makes Azure Policy the ideal tool for governance and compliance at scale.

Answer

Azure Blueprints

Answer

Azure Resource Manager

Answer

Azure Cost Management

Question 12

A company has multiple Azure subscriptions organized under a management group hierarchy. They need to assign the 'Contributor' role to a security team for all subscriptions under the 'Production' management group. They also want new subscriptions added later to automatically inherit this role assignment. What should they do?

Accepted Answer

Assign the role at the management group level. Assigning the 'Contributor' role at the management group level ensures that all subscriptions under that management group inherit the role assignment. When new subscriptions are added to the 'Production' management group, they automatically inherit the role assignment because Azure RBAC supports inheritance down the management group hierarchy. This meets both requirements: immediate coverage and automatic inheritance for future subscriptions.

Answer

Assign the role at the tenant root management group level

Answer

Assign the role at each subscription individually

Answer

Use an Azure Blueprint to assign the role

Question 13

A company wants to ensure that no one can create virtual machines without approval from the IT department. They want to block all VM creation attempts and notify the requester that they need to request access. Which Azure Policy effect should they use?

Accepted Answer

Deny. The Deny effect is correct because it actively prevents the creation of virtual machines by blocking the resource creation request at the Azure Resource Manager level. When a policy with the Deny effect is assigned, any attempt to create a VM that does not meet the policy's conditions is rejected with a 403 (Forbidden) status code, and the requester receives an error message indicating the policy violation and the need to request access. This directly enforces the requirement to block all VM creation attempts without requiring manual intervention.

Answer

Audit

Answer

Append

Answer

Disabled

Question 14

A company wants to track and analyze Azure costs across multiple departments. They have tagged resources with 'Department' tags. Which tool should they use to view cost breakdowns by department?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing is the correct tool because it provides native capabilities to analyze and visualize Azure spending, including the ability to filter and group costs by custom tags such as 'Department'. This allows the company to break down costs per department without needing additional configuration or external tools.

Answer

Azure Policy

Answer

Azure Advisor

Answer

Azure Service Health

Question 15

A company has multiple Azure subscriptions. They need to enforce a rule that only specific virtual machine sizes (e.g., Standard_D2s_v3) can be used across all subscriptions. They also want this rule to automatically apply to any future subscriptions created. Which Azure service should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules (such as allowed virtual machine SKUs) across your Azure environment. By assigning a built-in or custom policy definition (e.g., 'Allowed virtual machine SKUs') at the management group scope, the rule automatically applies to all existing and future subscriptions within that management group, ensuring consistent governance without manual intervention.

Answer

Azure Blueprints

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Resource Manager