AZ-900 Describe Azure management and governance Practice Test 7 — 15 Questions

Question 1

A company has multiple Azure subscriptions. They need to enforce a rule that only specific virtual machine sizes (e.g., Standard_D2s_v3) can be used across all subscriptions. They also want this rule to automatically apply to any future subscriptions created. Which Azure service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Policy. Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules (such as allowed virtual machine SKUs) across your Azure environment. By assigning a built-in or custom policy definition (e.g., 'Allowed virtual machine SKUs') at the management group scope, the rule automatically applies to all existing and future subscriptions within that management group, ensuring consistent governance without manual intervention.

Answer

Azure Blueprints

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Resource Manager

Question 2

A company wants to receive proactive recommendations to reduce Azure costs, improve security, and increase reliability. They want a single dashboard that provides best practices for their deployed resources. Which Azure service should they use?

Accepted Answer

Azure Advisor. Azure Advisor is the correct service because it provides a personalized, consolidated dashboard of best-practice recommendations across cost optimization, security, reliability, operational excellence, and performance. It analyzes your deployed resources and proactively suggests actions such as resizing underutilized VMs, enabling geo-redundancy, or applying security policies, directly matching the company's need for proactive, single-pane-of-guidance.

Answer

Azure Cost Management + Billing

Answer

Azure Monitor

Answer

Azure Resource Graph

Question 3

A multinational company has multiple Azure subscriptions managed by different teams. The compliance team requires that all new virtual machines deployed in any subscription must have a specific tag (e.g., 'CostCenter') and must be deployed in approved regions only. They also want to automatically enforce these requirements without manual intervention. Which Azure service should the compliance team use to achieve this?

Accepted Answer

Azure Policy. Azure Policy is correct because it enables the compliance team to create, assign, and manage policies that enforce rules (like requiring a 'CostCenter' tag and restricting VM deployment to approved regions) across all subscriptions. Policies are evaluated during resource creation and can automatically deny or audit non-compliant resources, ensuring enforcement without manual intervention.

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Blueprints

Answer

Azure Management Groups

Question 4

A company has multiple Azure subscriptions that are managed by different departments. The governance team needs to ensure that every new subscription follows a standardized set of compliance requirements, including specific Azure Policy definitions, a predefined role assignment for a central security group, and a base set of network resources. The solution must be reusable and allow the governance team to update the requirements centrally, with changes automatically applied to all subscriptions that use the same definition. Which Azure service should the governance team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it enables the governance team to define a repeatable set of Azure resources and policies—including Azure Policy definitions, role assignments, and Resource Manager templates—that can be assigned to multiple subscriptions. When the blueprint definition is updated, all subscriptions using that blueprint receive the changes automatically, ensuring centralized compliance and versioning.

Answer

Azure Management Groups

Answer

Azure Resource Manager (ARM) templates

Answer

Azure Policy

Question 5

A company has deployed hundreds of virtual machines in Azure across multiple subscriptions. The governance team wants to generate a compliance report that identifies which VMs are using approved VM sizes and which are not, according to a corporate policy. The team must not block the deployment of non-compliant VMs; they only want to track compliance. Which Azure Policy effect should they use in the policy definition?

Accepted Answer

Audit. The Audit effect is the correct choice because it enables the governance team to log non-compliant resources (such as VMs using unapproved sizes) in the Azure Activity Log without blocking their deployment. This effect generates a compliance report while allowing the deployment to proceed, exactly matching the requirement to track compliance without enforcement.

Answer

Deny

Answer

Append

Answer

DeployIfNotExists

Question 6

A company has a critical Azure Storage account that stores immutable backups. The IT administrator wants to ensure that no one can delete or modify this storage account, even administrators with Contributor or Owner roles. The company still needs to allow read access to the data within the storage account. Which Azure governance feature should the administrator implement?

Accepted Answer

Azure Resource Manager read-only lock. An Azure Resource Manager read-only lock prevents any user, including those with Contributor or Owner roles, from deleting or modifying the storage account while still allowing read access to the data. This lock operates at the management plane, blocking DELETE and PATCH operations via the Azure Resource Manager API, but does not affect data plane operations like reading blobs or files.

Answer

Azure Policy with Deny effect

Answer

Azure Blueprint with role assignment

Answer

Azure role-based access control (RBAC) with Reader role

Question 7

A company has a policy that all Azure Storage accounts must have diagnostic settings enabled to send logs and metrics to a specific Log Analytics workspace. The governance team wants to automatically configure these diagnostic settings when a new storage account is created, without blocking the initial creation. The solution must not require manual intervention. Which Azure Policy effect should the team use in their policy definition?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it automatically deploys a remediation task to configure diagnostic settings on storage accounts that lack them, without blocking the initial creation of the resource. This effect evaluates resources after creation and triggers a deployment to bring non-compliant resources into compliance, which aligns with the requirement for automatic configuration without manual intervention.

Answer

Audit

Answer

Deny

Answer

Append

Question 8

A company uses Azure for its production workloads. The security team wants to receive proactive, personalized recommendations to improve the security of their Azure resources, such as enabling Microsoft Defender for Cloud on subscriptions that do not have it enabled. Which Azure service provides these security recommendations?

Accepted Answer

Azure Advisor. Azure Advisor provides personalized, proactive recommendations to optimize Azure resources for security, reliability, performance, and cost. The question specifically asks for security recommendations, and Azure Advisor includes a dedicated 'Security' category that surfaces actions such as enabling Microsoft Defender for Cloud on subscriptions that lack it. This matches the scenario exactly.

Answer

Azure Policy

Answer

Azure Service Health

Answer

Azure Monitor

Question 9

A company runs multiple projects in Azure, each project is placed in a separate resource group. The finance team wants to set a monthly spending limit of $10,000 per project and receive automated email alerts when a project's spending reaches 80% of the limit and again when it exceeds the limit. The solution must use native Azure capabilities and be configurable per resource group. Which Azure service should the finance team use?

Accepted Answer

Azure Cost Management budgets with alert rules. Azure Cost Management budgets allow you to set spending limits at the scope of a resource group and configure alert rules that trigger automated email notifications when costs reach a specified threshold (e.g., 80% of the budget) and again when the limit is exceeded. This meets all requirements natively without additional automation or custom scripting.

Answer

Azure Policy with a built-in policy definition to enforce spending limits

Answer

Azure Advisor cost recommendations

Answer

Azure Resource Graph queries triggered by Azure Automation runbooks on a schedule

Question 10

A healthcare organization needs to enforce a set of compliance requirements (e.g., enable encryption on all storage accounts, restrict public network access to SQL databases, and enforce a specific TLS version) across all Azure subscriptions. The organization has defined these requirements as individual Azure Policy definitions. The governance team wants to assign all these policies together as a single unit to a management group, ensuring that any new subscription created under that group automatically receives all the policies. Which Azure object should the governance team create first?

Accepted Answer

Azure Policy initiative. An Azure Policy initiative is a collection of individual policy definitions designed to group related policies together for assignment as a single unit. By creating an initiative that contains the required compliance policies (encryption, network restrictions, TLS version) and assigning it to a management group, any new subscription under that group automatically inherits the initiative, ensuring consistent enforcement.

Answer

Azure Blueprint

Answer

Azure Management Group

Answer

Azure Resource Manager template

Question 11

A company is adopting a landing zone approach in Azure. The governance team wants to automatically provision a standardized environment for each new Azure subscription. The environment must include: a predefined set of Azure Policy assignments (e.g., enforce resource tagging), specific RBAC role assignments for a central operations team, and a baseline resource group containing a storage account with a specific configuration. The team wants to package all these components into a single, versioned object that can be assigned to a management group and updated over time as requirements change. Which Azure governance service should the team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it is designed to orchestrate the deployment of a repeatable, versioned environment that includes Azure Policy assignments, RBAC role assignments, and resource groups/templates as a single, composable artifact. Unlike Azure Policy alone, Blueprints can package multiple governance components together and assign them to management groups or subscriptions, with versioning support for updates over time.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Graph

Question 12

A company has a policy that all Azure resources must have a tag named 'CostCenter'. The governance team wants to automatically add the tag with a default value 'IT' to any new resource that is created without it. The team wants the tag to be applied during resource creation, not just report non-compliance. The solution must also support remediation for existing non-compliant resources if needed later. Which Azure Policy effect should the team use in their policy definition?

Accepted Answer

Modify. The Modify effect is correct because it can automatically add or change tags on resources during creation or update, enforcing compliance in real-time. Unlike Append, Modify supports both creation and remediation of existing resources, and unlike DeployIfNotExists, it directly alters the resource properties without deploying a separate remediation task.

Answer

Append

Answer

DeployIfNotExists

Answer

Audit

Question 13

A company has three departments: Sales, Marketing, and IT. Each department has its own Azure subscription. The IT department manages all networking and security policies across all subscriptions. The Sales and Marketing departments should be able to create and manage their own resources but cannot modify networking or security policies. The IT department wants to apply a consistent set of policies (e.g., enforce tagging, restrict VM SKUs) across all subscriptions without needing to assign policies to each subscription individually. Additionally, the IT department wants to delegate administration of a specific custom role to a junior administrator who can assign that role to users within the Sales subscription only. Which combination of Azure governance features should the IT department use?

Accepted Answer

Create a management group containing all three subscriptions, assign Azure Policy initiatives at the management group, and use Azure RBAC with a custom role scoped to the Sales subscription.. Azure management groups allow hierarchical policy inheritance: assigning an Azure Policy initiative at the management group level automatically applies it to all child subscriptions (Sales, Marketing, IT). This satisfies the requirement for consistent policies without individual assignment. Additionally, Azure RBAC with a custom role scoped to the Sales subscription enables the IT department to delegate administration of that role to a junior administrator, who can then assign it only within the Sales subscription, meeting the delegation requirement precisely.

Answer

Create a management group for each department, assign Azure Policy initiatives at each management group, and use Azure Blueprints to manage role assignments.

Answer

Use Azure Resource Manager templates to deploy policies and role assignments to each subscription, and use Azure Active Directory administrative units to manage delegation.

Answer

Assign Azure Policy initiatives to each subscription individually, and create a custom role that is scoped to the management group.

Question 14

A company manages a production Azure subscription that contains critical resources. The security team wants to prevent any user, including users with the Owner role, from accidentally deleting the entire subscription or any resource within it. The team still wants authorized users to be able to modify settings and create new resources. Which Azure feature should the team use?

Accepted Answer

Apply a global 'CanNotDelete' resource lock at the subscription scope.. A 'CanNotDelete' resource lock at the subscription scope prevents any user, including those with the Owner role, from deleting the subscription or any resource within it. This lock overrides all RBAC permissions for delete operations, while still allowing authorized users to modify settings and create new resources, meeting the security team's requirement.

Answer

Create a custom RBAC role that denies the 'Microsoft.Resources/subscriptions/delete' action and assign it to the subscription.

Answer

Configure an Azure Policy that audits delete operations and sends an alert to the security team.

Answer

Create a management group, move the subscription into it, and assign an Azure Policy definition with the 'Deny' effect targeting delete operations.

Question 15

A company has a resource group named 'RG-Prod' that contains critical virtual machines (VMs), virtual networks, and a SQL database. The infrastructure team needs to grant a group of developers the ability to start, stop, and restart only the VMs in RG-Prod. The developers must not be able to create new VMs, delete existing VMs, modify the virtual networks, or access the database. The company wants to follow the principle of least privilege. Which Azure role-based access control (RBAC) approach should the company use?

Accepted Answer

Create a custom RBAC role that includes only the specific actions required (e.g., Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action) and assign it to the developers.. The principle of least privilege requires granting only the exact permissions needed. The built-in Virtual Machine Contributor role includes permissions beyond start/stop/restart (e.g., it allows creating and deleting VMs), which violates the requirement. A custom RBAC role scoped to RG-Prod with only the specific actions (Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/restart/action) meets the need precisely.

Answer

Assign the Virtual Machine Contributor built-in role to the developers.

Answer

Assign the Contributor built-in role and then create an Azure Policy to deny any VM creation or deletion and VNet modifications in RG-Prod.

Answer

Assign the Reader role to the developers and use Azure Policy to automatically start, stop, and restart VMs on their behalf.