AZ-900 Describe Azure management and governance Practice Test 5 — 15 Questions

Question 1

A company has multiple departments, each with its own Azure subscription. They want to apply the same set of policies and role assignments to all subscriptions under the Sales department. They also plan to create more subscriptions for Sales in the future. Which Azure construct should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Management group. Management groups allow you to apply Azure Policy and role-based access control (RBAC) assignments hierarchically across multiple subscriptions. By placing all Sales department subscriptions under a single management group, any policies or role assignments defined at that management group level will be inherited by all current and future subscriptions within it, ensuring consistent governance.

Answer

Resource group

Answer

Policy initiative

Answer

Blueprint

Question 2

A company uses Azure Blueprints to define a standard environment for all new development subscriptions. The blueprint includes a set of Azure policies, role assignments, and resource templates. However, after applying the blueprint, some resources are created that do not comply with the policies. The company wants to be notified of these non-compliant resources without blocking their creation. Which Azure Policy effect should be used in the blueprint?

Accepted Answer

Audit. The Audit effect is correct because it enables Azure Policy to evaluate resources against the defined policies and log compliance warnings in the activity log without blocking resource creation. This meets the requirement to be notified of non-compliant resources while allowing them to be created.

Answer

Deny

Answer

Append

Answer

DeployIfNotExists

Question 3

A company wants to query all Azure resources across multiple subscriptions to find all storage accounts without encryption enabled. They need to use a powerful query language to filter and join data. Which Azure tool should they use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph (ARG) is the correct tool because it provides a powerful, Kusto Query Language (KQL)-based query engine that can explore Azure resources across multiple subscriptions, resource groups, and management groups. It allows you to filter, project, and join resource data (e.g., find all storage accounts where encryption is disabled) using a single query, making it ideal for cross-subscription resource discovery and compliance checks.

Answer

Azure Monitor Logs

Answer

Azure Advisor

Answer

Azure Policy

Question 4

A company has an Azure Policy assigned to all subscriptions that denies creation of any resource without a 'CostCenter' tag. During an emergency, a team needs to create a resource without the tag. They want a temporary exception without changing the policy. What should they create?

Accepted Answer

Policy exemption. A Policy exemption allows you to create an exception for a specific resource or subscription without modifying the underlying policy definition. In this scenario, the team can request an exemption (e.g., 'Emergency' or 'Waiver' category) to bypass the 'CostCenter' tag requirement temporarily, while the policy remains enforced for all other resources.

Answer

Policy initiative

Answer

Role assignment

Answer

Blueprint

Question 5

A company has multiple Azure subscriptions for different projects. They want to apply the same set of Azure policies and role assignments to all subscriptions under a specific department, and they plan to add more subscriptions in the future. Which Azure construct should they use?

Accepted Answer

Management group. A management group is the correct construct because it allows you to manage governance, policy, and role assignments across multiple Azure subscriptions hierarchically. By placing all subscriptions for a department under a single management group, you can apply the same Azure Policy and role-based access control (RBAC) assignments once, and any new subscriptions added to that group will automatically inherit those settings.

Answer

Resource group

Answer

Azure Policy initiative

Answer

Azure Blueprint

Question 6

A company wants to organize their Azure subscriptions into a hierarchy for policy and cost management. They have multiple departments, each with multiple subscriptions. What should they create first to establish this structure?

Accepted Answer

Management groups. Management groups are the correct first step because they provide a hierarchical structure above subscriptions, enabling you to organize multiple subscriptions into logical groupings for policy and cost management. By creating management groups first, you can then apply Azure Policy and cost controls at the management group level, which automatically cascades to all child subscriptions and resource groups. This aligns with the Azure governance hierarchy: management groups → subscriptions → resource groups → resources.

Answer

Resource groups

Answer

Policies

Answer

Subscriptions

Question 7

A company uses Azure Policy to enforce encryption on storage accounts. They discover some existing storage accounts are non-compliant. They want to automatically enable encryption on these accounts without manual intervention. Which combination of policy effects should they use?

Accepted Answer

Audit and DeployIfNotExists. The correct combination is Audit and DeployIfNotExists. Audit logs non-compliant storage accounts without blocking them, while DeployIfNotExists automatically enables encryption on those accounts by deploying a remediation task. This ensures existing non-compliant resources are brought into compliance without manual intervention.

Answer

Deny and Audit

Answer

Append and Modify

Answer

Audit and Disabled

Question 8

A company needs to ensure that all Azure resources have a mandatory 'CostCenter' tag. If a resource is created without this tag, the resource creation should be blocked. Which Azure Policy effect should they use?

Accepted Answer

Deny. The Deny effect is correct because it actively blocks any resource creation or update that does not comply with the policy rule, such as missing the mandatory 'CostCenter' tag. This ensures that non-compliant resources are never provisioned, enforcing governance at the point of creation.

Answer

Append

Answer

Audit

Answer

DeployIfNotExists

Question 9

A company wants to track and manage costs across multiple Azure subscriptions. They have created a hierarchy of management groups: Root -> Department A -> Project 1, Project 2. They want to see the total cost for Department A across all its projects. Which Azure tool should they use?

Accepted Answer

Cost Management + Billing. Cost Management + Billing is the correct tool because it provides consolidated cost tracking and analysis across multiple subscriptions and management groups. By organizing subscriptions under the Department A management group, Cost Management can aggregate costs from Project 1 and Project 2, allowing the company to view the total cost for Department A in a single dashboard or report.

Answer

Azure Policy

Answer

Azure Advisor

Answer

Azure Monitor

Question 10

A company wants to ensure that all Azure resources are tagged with metadata such as 'Environment' and 'Department'. They have created an Azure Policy that appends the required tags and their values when a resource is created. However, they notice that some resources created before the policy assignment are missing tags. They want to automatically add those tags without manual effort. What should they do?

Accepted Answer

Create a new policy with DeployIfNotExists effect. The DeployIfNotExists (DINE) policy effect can automatically remediate non-compliant resources, including those created before the policy assignment. When combined with a managed identity, DINE triggers a deployment task that adds the required tags without manual intervention, addressing the gap left by the 'append' effect which only acts on new resources.

Answer

Create a remediation task for the policy

Answer

Use Azure Resource Graph to query and update

Answer

Create an Azure Automation runbook

Question 11

A company wants to enforce a set of security policies across all their Azure subscriptions. They have created several individual policy definitions. Which Azure construct should they use to group these policies together and assign them as a single package?

Accepted Answer

Policy Initiative. A Policy Initiative (also known as a policy set) in Azure allows you to group multiple individual policy definitions into a single package. This enables you to assign the entire set of security policies together across subscriptions, ensuring consistent enforcement. It simplifies management by applying a collection of related policies as one unit.

Answer

Azure Blueprint

Answer

Management Group

Answer

Resource Group

Question 12

A company needs to grant a group of users the ability to restart and start/stop virtual machines, but not to create or delete them. They want to assign this permission at the resource group level. What should they do?

Accepted Answer

Create a custom role with the required actions. Azure's built-in roles do not provide a granular permission set that allows restarting and starting/stopping VMs while explicitly denying creation and deletion. A custom role must be created with specific actions such as 'Microsoft.Compute/virtualMachines/start/action', 'Microsoft.Compute/virtualMachines/restart/action', and 'Microsoft.Compute/virtualMachines/deallocate/action', and exclude actions like 'Microsoft.Compute/virtualMachines/write' and 'Microsoft.Compute/virtualMachines/delete'. This custom role can then be assigned at the resource group scope to grant the precise permissions required.

Answer

Assign the built-in Contributor role

Answer

Assign the built-in Virtual Machine Contributor role

Answer

Use Azure Policy to restrict operations

Question 13

A company has a management group hierarchy: Root > Europe > Production. They assign a policy at the Root level that denies creation of resources without a tag. Later, they assign a different policy at the Europe level. What is the effective effect on the Production subscription?

Accepted Answer

Both policies apply. Azure Policy is inherited by default from higher-level management groups down to subscriptions. When a policy is assigned at the Root management group, it applies to all child management groups and subscriptions, including the Production subscription. Assigning an additional policy at the Europe management group does not remove or override the Root-level policy; instead, both policies are evaluated and enforced, with the most restrictive effect taking precedence. Therefore, the Production subscription is subject to both policies.

Answer

Only the policy at the Europe level applies

Answer

Only the policy at the Root level applies

Answer

The policy at the lower level overrides the Root policy

Question 14

A company uses Azure Blueprints to define a standard environment. They publish a new version of the blueprint with an updated role assignment. All existing subscriptions that were created from an older version need to receive the new role assignment. What should they do?

Accepted Answer

Use the 'Update existing assignments' option. Azure Blueprints provides a built-in 'Update existing assignments' option that propagates changes from a published blueprint version to all existing assigned subscriptions. This ensures that updated role assignments are applied without manual intervention, maintaining consistency across the environment.

Answer

Reassign the blueprint to each subscription manually

Answer

The blueprint updates automatically

Answer

Manually add the role assignment to each subscription

Question 15

A company wants to monitor the performance of their Azure VMs and receive alerts when CPU usage exceeds 90%. Which Azure service should they use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a comprehensive solution for collecting, analyzing, and acting on telemetry from Azure resources, including VMs. It includes metrics like CPU percentage and allows you to configure metric alerts that trigger when a threshold (e.g., 90% CPU usage) is exceeded. This directly meets the requirement for performance monitoring and alerting.

Answer

Azure Policy

Answer

Azure Security Center

Answer

Azure Cost Management