AZ-900 Describe Azure management and governance Practice Test 6 — 15 Questions

Question 1

A company wants to organize their Azure subscriptions into a hierarchy to manage access policies and cost across different departments. They have three departments: Sales, Marketing, IT. What should they create first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Management groups. Management groups are the correct first step because they allow you to organize Azure subscriptions into a hierarchy for centralized management of access policies and cost across departments. By creating a management group hierarchy (e.g., Root → Departments → Sales, Marketing, IT), you can apply Azure Policy and role-based access control (RBAC) at the management group level, which then cascades down to all subscriptions and resources within that branch. This enables consistent governance and cost tracking across the entire department without needing to configure each subscription individually.

Answer

Resource groups

Answer

Azure Policy

Answer

Tagging

Question 2

A company has multiple Azure subscriptions for different projects. They want to apply a common set of policies and role assignments to all subscriptions under the 'Research' department. They also plan to add more subscriptions for Research in the future. What should they use?

Accepted Answer

Azure management group. Azure management groups allow you to efficiently manage access, policies, and compliance across multiple Azure subscriptions. By placing all 'Research' subscriptions under a single management group, you can apply a common set of Azure Policy assignments and Azure role-based access control (RBAC) assignments at the management group scope, which automatically cascades to all current and future subscriptions within that group. This hierarchical structure is specifically designed for enterprise-scale governance across departments.

Answer

Azure resource group

Answer

Azure Blueprint

Answer

Azure Policy initiative

Question 3

A company has a management group hierarchy: Root → UK → Production. They assign a policy at the Root level that allows only certain VM sizes. Later, they assign another policy at the UK level that denies all resources. What is the effective effect on the Production subscription?

Accepted Answer

Both policies apply, and the most restrictive (Deny) takes precedence.. D is correct because Azure Policy is inherited and cumulative down the management group hierarchy. The Root-level policy (allow only certain VM sizes) and the UK-level policy (deny all resources) both apply to the Production subscription. When a deny policy conflicts with an allow policy, the deny effect always takes precedence, making the most restrictive policy effective.

Answer

Only the Root policy applies because it is at the highest level.

Answer

Only the UK policy applies because it is more specific.

Answer

Both policies apply, and the order of evaluation could cause a conflict.

Question 4

A company wants to enforce a naming convention on all Azure resources by automatically adding a tag with the environment name (e.g., 'Env-Prod' or 'Env-Dev') when a resource is created. They do not want to block resource creation if the tag is missing. Which Azure Policy effect should they use?

Accepted Answer

Append. The Append effect adds a specified tag (e.g., 'Env-Prod' or 'Env-Dev') to a resource during creation or update without blocking the operation. This matches the requirement to enforce a naming convention via tags automatically while allowing resource creation to proceed even if the tag is missing.

Answer

Deny

Answer

Audit

Answer

DeployIfNotExists

Question 5

A company has created an Azure Blueprint to define a standard environment with role assignments and policies. They have published multiple versions. They want all existing subscriptions that were created from an older version to automatically receive the updates from the latest version. What should they do?

Accepted Answer

Upgrade the blueprint assignment on the existing subscriptions. Azure Blueprints allow you to update assignments on existing subscriptions to the latest published version. When you upgrade the blueprint assignment, it applies any new role assignments, policies, or artifacts defined in the newer version to the target subscriptions, ensuring they remain compliant with the updated standard environment.

Answer

Create a new subscription from the latest blueprint version

Answer

Reassign the blueprint to the subscriptions

Answer

Nothing, updates apply automatically

Question 6

A company wants to ensure that all new Azure storage accounts have a specific encryption setting enabled. They also want to automatically remediate any existing non-compliant storage accounts without manual effort. Which Azure Policy effect should they use?

Accepted Answer

DeployIfNotExists. DeployIfNotExists is the correct effect because it not only evaluates the compliance of storage accounts against the encryption policy but also automatically deploys a remediation task (e.g., enabling encryption via a linked ARM template or Azure function) to bring non-compliant resources into compliance without manual intervention. This effect is specifically designed for scenarios where the resource itself needs to be modified or configured to meet the policy requirement.

Answer

Append

Answer

AuditIfNotExists

Answer

Deny

Question 7

A company has multiple Azure subscriptions for different departments. They want to track and analyze costs, and allocate costs to each department based on tags applied to resources. Which Azure tool should they use?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing provides native capabilities to monitor, analyze, and optimize cloud costs. It supports filtering and grouping costs by custom tags applied to resources, enabling allocation of charges to specific departments or cost centers. This directly meets the requirement to track and allocate costs based on tags.

Answer

Azure Policy

Answer

Azure Blueprints

Answer

Azure Advisor

Question 8

A company needs to grant a specific user the ability to restart virtual machines in a specific resource group, but not to create, delete, or modify them in any other way. The built-in 'Virtual Machine Contributor' role grants too many permissions. What is the most appropriate solution?

Accepted Answer

Assign the 'Reader' role and create a custom RBAC role with only the 'Microsoft.Compute/virtualMachines/restart/action' permission. It combines the 'Reader' role (which allows read-only access to all resources) with a custom RBAC role that grants only the specific 'Microsoft.Compute/virtualMachines/restart/action' permission. This ensures the user can restart VMs in the target resource group without being able to create, delete, or modify them, meeting the exact requirement.

Answer

Assign the 'Virtual Machine Operator' built-in role

Answer

Create a custom role with 'Contributor' and then add a deny assignment for delete and create

Answer

Assign the 'Owner' role and then remove permissions

Question 9

A company has multiple subscriptions. They want to apply a policy that denies creation of resources without a specific tag at the top-level management group. Later, they need to allow a specific subscription to create resources without that tag. What should they do?

Accepted Answer

Create an exclusion for that subscription in the policy assignment.. Azure Policy allows you to assign policies at the management group scope, which applies to all child subscriptions. When you need to exempt a specific subscription from a policy effect (like 'Deny'), you can configure an exclusion on the policy assignment at the management group level. This exclusion removes the policy evaluation for that subscription, allowing resources to be created without the required tag.

Answer

Assign a different policy at the subscription level that allows untagged resources.

Answer

Modify the top-level policy to include an exemption.

Answer

Remove the subscription from the management group.

Question 10

A company wants to enforce that all storage accounts use the 'Standard' performance tier and block creation of any 'Premium' storage accounts. Which Azure Policy effect could achieve this?

Accepted Answer

Deny. The Deny effect is the correct choice because it actively prevents the creation of Azure resources that do not comply with the policy definition. In this scenario, by assigning a policy with the Deny effect that targets storage accounts with the 'Premium' performance tier, Azure Resource Manager will block any request to create a Premium storage account, ensuring only 'Standard' tier accounts are provisioned.

Answer

Append

Answer

Audit

Answer

Disabled

Question 11

A company uses Azure Blueprints to define a standard environment with policies, role assignments, and resource groups. They publish a new version of the blueprint that adds a new role assignment. However, existing subscriptions created from older versions do not have this new role assignment. What must they do to apply the update to existing subscriptions?

Accepted Answer

They need to update the existing blueprint assignment to use the latest published version.. Azure Blueprints assignments are not automatically updated when a new version of the blueprint is published. To apply the new role assignment to existing subscriptions, you must update the existing blueprint assignment to reference the latest published version. This triggers Azure to evaluate and apply the changes defined in the new version, including the new role assignment, to the assigned subscriptions.

Answer

Delete and recreate the subscriptions using the new blueprint.

Answer

The blueprint version update is automatically applied to all existing subscriptions.

Answer

They must manually assign the role to each subscription.

Question 12

A company wants to enforce a policy that all Azure resources must have a 'CostCenter' tag. They want to automatically apply the tag to new resources, and also to existing resources that are missing it. Which Azure service should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it can enforce tagging rules by evaluating resources against a policy definition and automatically applying the 'CostCenter' tag to new resources via the 'deployIfNotExists' effect. It can also remediate existing non-compliant resources by triggering a remediation task that applies the missing tag. This makes Azure Policy the ideal tool for governance and compliance at scale.

Answer

Azure Blueprints

Answer

Azure Resource Manager

Answer

Azure Cost Management

Question 13

A company has multiple Azure subscriptions organized under a management group hierarchy. They need to assign the 'Contributor' role to a security team for all subscriptions under the 'Production' management group. They also want new subscriptions added later to automatically inherit this role assignment. What should they do?

Accepted Answer

Assign the role at the management group level. Assigning the 'Contributor' role at the management group level ensures that all subscriptions under that management group inherit the role assignment. When new subscriptions are added to the 'Production' management group, they automatically inherit the role assignment because Azure RBAC supports inheritance down the management group hierarchy. This meets both requirements: immediate coverage and automatic inheritance for future subscriptions.

Answer

Assign the role at the tenant root management group level

Answer

Assign the role at each subscription individually

Answer

Use an Azure Blueprint to assign the role

Question 14

A company wants to ensure that no one can create virtual machines without approval from the IT department. They want to block all VM creation attempts and notify the requester that they need to request access. Which Azure Policy effect should they use?

Accepted Answer

Deny. The Deny effect is correct because it actively prevents the creation of virtual machines by blocking the resource creation request at the Azure Resource Manager level. When a policy with the Deny effect is assigned, any attempt to create a VM that does not meet the policy's conditions is rejected with a 403 (Forbidden) status code, and the requester receives an error message indicating the policy violation and the need to request access. This directly enforces the requirement to block all VM creation attempts without requiring manual intervention.

Answer

Audit

Answer

Append

Answer

Disabled

Question 15

A company wants to track and analyze Azure costs across multiple departments. They have tagged resources with 'Department' tags. Which tool should they use to view cost breakdowns by department?

Accepted Answer

Azure Cost Management + Billing. Azure Cost Management + Billing is the correct tool because it provides native capabilities to analyze and visualize Azure spending, including the ability to filter and group costs by custom tags such as 'Department'. This allows the company to break down costs per department without needing additional configuration or external tools.

Answer

Azure Policy

Answer

Azure Advisor

Answer

Azure Service Health