AZ-900 Describe Azure management and governance Practice Test 8 — 15 Questions

Question 1

A company's security team needs to audit all virtual machines (VMs) that have a public IP address directly attached, across more than 50 Azure subscriptions organized under several management groups. The team wants to run a single query to get a list of these VMs along with the subscription and resource group details. The solution must provide fast results without the need to write custom scripts or iterate through each subscription individually. Which Azure service should the team use?

Accepted Answer

Azure Resource Graph. Azure Resource Graph (ARG) is the correct choice because it provides a powerful, queryable interface (using Kusto Query Language, KQL) that can search across all Azure subscriptions, management groups, and resource groups in a single query. It can quickly return a list of VMs with public IPs attached, along with their subscription and resource group metadata, without requiring custom scripts or iterative loops. This directly meets the requirement for fast, cross-subscription auditing with minimal overhead.

Answer

Azure Policy

Answer

Azure Monitor

Answer

Azure Resource Manager

Question 2

A company has 30 Azure subscriptions organized under a single management group. The governance team wants to enforce that all resource groups must have a specific tag 'CostCenter' with a valid value. They create an Azure Policy definition with the 'Deny' effect and assign it to the root management group. However, the development team complains that they have a sandbox subscription where they need to create resource groups without the 'CostCenter' tag for testing. The governance team still wants the policy to apply to all other subscriptions but exempt the sandbox subscription. Which solution should the governance team use?

Accepted Answer

Use a policy exemption on the sandbox subscription with category 'Waiver'.. Option C is correct because Azure Policy exemptions allow specific scopes (like the sandbox subscription) to be excluded from a policy's enforcement while keeping the policy assigned to the parent management group. A 'Waiver' exemption category is used when the intent is to temporarily or permanently exempt a resource from policy evaluation, which fits the governance team's requirement to exempt only the sandbox subscription without altering the policy assignment structure.

Answer

Create a second policy assignment at the sandbox subscription with the 'Disabled' effect.

Answer

Remove the policy assignment from the management group and assign it individually to all subscriptions except the sandbox.

Answer

Configure an Azure Blueprint for the management group and exclude the sandbox subscription.

Question 3

A company has multiple Azure subscriptions, each managed by different development teams. The central governance team wants to ensure that every subscription adheres to the same security baselines, including specific Azure Policy definitions, RBAC role assignments, and a standard resource group structure. The team needs a single, versioned package that brings these components together and can be consistently deployed across all subscriptions. Which Azure service should the governance team use to meet these requirements?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it is designed to orchestrate the deployment of a repeatable set of Azure resources and policies that adhere to organizational standards. It packages artifacts like Azure Policy definitions, RBAC role assignments, and resource group templates into a single, versioned blueprint that can be assigned to multiple subscriptions, ensuring consistent governance across all environments.

Answer

Azure Resource Manager templates

Answer

Azure Policy

Answer

Azure Management Groups

Question 4

A company stores critical financial records in an Azure Storage account. The operations team needs to ensure that the storage account cannot be deleted by any user, including administrators with Contributor permissions. However, authorized users must still be able to add and modify blobs. The solution should not affect the ability to update the account's configuration. Which Azure feature should the company implement?

Accepted Answer

Apply a CanNotDelete resource lock on the storage account.. A CanNotDelete resource lock on the storage account prevents any user, including those with Contributor permissions, from deleting the resource. This satisfies the requirement that even administrators cannot delete the account, while still allowing authorized users to add and modify blobs (since blob operations are controlled by Azure RBAC roles, not the lock) and update the account's configuration (the lock only blocks delete operations).

Answer

Assign the Storage Blob Data Owner role to the operations team.

Answer

Create an Azure Policy that denies delete operations on storage accounts.

Answer

Move the storage account to a new resource group.

Question 5

A company has 15 Azure subscriptions organized under multiple management groups. The security team has defined a standard set of 8 Azure Policy definitions that must be applied to every subscription. These definitions enforce required tags, deny creation of public IPs, require encryption for storage accounts, and restrict VM SKUs. The team wants to assign these policies as a single entity to simplify management and ensure consistent compliance. What should the team create and assign?

Accepted Answer

An Azure Policy initiative (policy set definition) containing the policy definitions. An Azure Policy initiative (policy set definition) allows grouping multiple individual policy definitions into a single set, which can then be assigned as one entity. This simplifies management and ensures consistent compliance across all subscriptions, as the security team requires. Assigning the initiative at the root management group applies it to all 15 subscriptions under the management groups.

Answer

An Azure Blueprint containing the policy definitions

Answer

An Azure Policy assignment for each individual definition at the root management group

Answer

An Azure Resource Manager template that deploys the policy definitions

Question 6

A company has 10 Azure subscriptions used by different departments. The finance team wants to receive automated, prioritized recommendations to reduce cloud costs. Specifically, they want suggestions for identifying idle virtual machines and rightsizing underutilized resources across all subscriptions. Which Azure service should the finance team use to get these recommendations?

Accepted Answer

Azure Advisor. Azure Advisor is the correct service because it provides personalized, prioritized recommendations across Azure subscriptions, including cost optimization suggestions such as identifying idle virtual machines and rightsizing underutilized resources. It analyzes resource usage and configuration to deliver actionable insights, making it ideal for the finance team's needs.

Answer

Azure Cost Management + Billing

Answer

Azure Policy

Answer

Azure Monitor

Question 7

A company uses multiple Azure subscriptions for development and production. The finance team wants to set a monthly budget of $1,000 for a specific dev subscription. When the actual cost reaches 80% of the budget, the team wants to receive an email alert. If the cost exceeds 100%, they want to automatically stop a specific virtual machine in that subscription to prevent overspending. Which Azure feature should the team use to automate the stopping of the VM when the budget is exceeded?

Accepted Answer

Azure Cost Management + Budgets with an action group configured to run a Runbook. Azure Cost Management + Budgets allows you to set a budget and configure alerts based on actual or forecasted cost thresholds. When the cost exceeds 100% of the budget, you can trigger an action group that runs an Azure Automation Runbook, which can be scripted to stop a specific virtual machine. This provides automated cost control without manual intervention.

Answer

Azure Policy with a Deny effect

Answer

Azure Advisor cost recommendations

Answer

Azure Resource Graph queries with Azure Monitor alerts

Question 8

A company manages hundreds of Azure SQL databases across multiple subscriptions. The compliance team requires that every Azure SQL database has diagnostic settings enabled to send logs to a central Log Analytics workspace. The team wants a solution that automatically configures diagnostic settings for any new Azure SQL database when it is created, without requiring manual intervention or additional scripting. Which Azure governance feature should the team use?

Accepted Answer

Azure Policy with the DeployIfNotExists effect. Azure Policy with the DeployIfNotExists effect is the correct choice because it automatically evaluates new Azure SQL databases against a policy rule and, if diagnostic settings are missing, triggers a remediation task to deploy them to the specified Log Analytics workspace. This effect operates at resource creation time without manual intervention or scripting, fulfilling the compliance team's requirement for automatic, consistent configuration across all subscriptions.

Answer

Azure Blueprints with a resource group artifact

Answer

Azure Resource Manager templates deployed via Azure DevOps

Answer

Azure Monitor with a data collection rule

Question 9

A company has a regulatory requirement that all Azure resources must be deployed only in the West Europe region. The governance team needs to automatically prevent any user or application from creating resources in any other region. The team must also ensure that this restriction is applied to all existing and future subscriptions within the tenant. Which Azure service should the governance team use?

Accepted Answer

Azure Policy. Azure Policy is correct because it enforces organizational standards by evaluating resources for compliance with defined rules, such as restricting allowed regions. By creating a policy definition that denies resource creation outside West Europe and assigning it at the management group scope, the restriction applies to all existing and future subscriptions within the tenant automatically.

Answer

Azure Blueprints

Answer

Management Groups

Answer

Azure Role-Based Access Control (RBAC)

Question 10

A company has a root management group that contains all Azure subscriptions. A centralized governance team needs to create and assign Azure Policy definitions and set initiatives that apply to all subscriptions. Which built-in role should be assigned to the governance team at the root management group scope to grant the minimum required permissions?

Accepted Answer

Policy Contributor. The Policy Contributor built-in role grants the minimum required permissions to create and assign Azure Policy definitions and initiatives, including the ability to read policy assignments and manage policy resources, without granting full write access to all resources. Assigning this role at the root management group scope ensures the governance team can apply policies across all subscriptions while adhering to the principle of least privilege.

Answer

Owner

Answer

Contributor

Answer

Security Admin

Question 11

A company has a governance requirement that every Azure virtual machine must have a tag named 'CostCenter' with the value 'Unassigned'. If a user creates a VM without the tag, or with a different value for that tag, the tag should be automatically corrected to 'Unassigned' immediately upon resource creation. The IT team is writing an Azure Policy definition to enforce this. Which Policy effect should they use?

Accepted Answer

Modify. The Modify effect is correct because it automatically corrects non-compliant tags (missing or wrong value) to the specified value ('Unassigned') during resource creation or update, without blocking the deployment. This satisfies the requirement for immediate, automatic remediation without denying the VM creation entirely.

Answer

Deny

Answer

Audit

Answer

DeployIfNotExists

Question 12

A global company creates a new Azure subscription for each major project. To ensure compliance and consistency, the governance team needs a single, versioned, auditable package that, when assigned to a subscription, automatically deploys a standard set of Azure Policy assignments, role assignments, a resource group structure, and a pre-configured virtual network. The solution must allow these packages to be updated centrally and have changes tracked for auditing. Which Azure service should the governance team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it provides a single, versioned, auditable package that can be assigned to a subscription to orchestrate the deployment of Azure Policy assignments, role assignments, resource groups, and resource templates (like a virtual network). Blueprints support versioning and central update management, with changes tracked in the blueprint definition history for auditing. This aligns exactly with the requirement for a governance team to enforce compliance and consistency across subscriptions.

Answer

Azure Policy

Answer

Azure Resource Manager templates

Answer

Management groups

Question 13

A company manages its production workloads in a dedicated Azure subscription under the root management group. The infrastructure team recently created a critical resource group named 'rg-prod-core' that contains networking resources. To prevent accidental deletion of this entire resource group, the team needs a mechanism that blocks delete operations on 'rg-prod-core' while still allowing changes to resources within it. The solution must not affect any other resource groups in the subscription. Which Azure feature should the team apply to 'rg-prod-core'?

Accepted Answer

Apply a resource lock with the 'CanNotDelete' setting to the resource group.. Option B is correct because a resource lock with the 'CanNotDelete' setting prevents deletion of the resource group while still allowing read and update operations on resources within it. This lock applies only to the specific resource group scope, so it does not affect any other resource groups in the subscription. This directly meets the requirement to block deletion of 'rg-prod-core' without impacting other groups.

Answer

Assign an Azure Policy with the 'deny' effect at the management group scope to block deletions of any resource group.

Answer

Create a custom RBAC role that explicitly denies the delete action, and assign it to the infrastructure team at the resource group scope.

Answer

Deploy an Azure Blueprint that includes a policy to audit deletions of the resource group.

Question 14

A company's finance team uses Azure Cost Management + Billing to monitor cloud spending. They want to configure a rule that sends an email notification to the finance team's distribution list when the monthly cost for resources tagged with Department=Marketing exceeds $10,000. Which Azure Cost Management feature should they configure?

Accepted Answer

Budget. Azure Budgets allow you to set cost or usage thresholds and configure alerts that trigger when spending reaches a specified percentage of the budget. In this scenario, the finance team can create a budget with a $10,000 threshold for the Department=Marketing tag, and configure an alert rule to send an email notification to the distribution list when costs exceed that amount.

Answer

Invoice

Answer

Cost analysis

Answer

Recommendations

Question 15

A company has a root management group containing three subscriptions: Production, Development, and Sandbox. The governance team assigns an Azure Policy initiative to the root management group that enforces tagging requirements. The Sandbox subscription is used for experimental testing and needs to be temporarily excluded from the tagging requirements while the team evaluates a new tagging schema. The team must ensure the policy assignment remains active in Production and Development but does not affect resources in Sandbox. Which Azure Policy feature should the team use?

Accepted Answer

Policy Exemption. Option A is correct because a Policy Exemption allows the team to exclude a specific scope (the Sandbox subscription) from the enforcement of an Azure Policy initiative while keeping the policy assignment active at the root management group. This feature is designed for temporary exceptions, such as evaluating a new tagging schema, without modifying the underlying policy assignment or creating exclusions at the resource level. The exemption can be set with an expiration date, ensuring the Sandbox subscription automatically returns to compliance after the evaluation period.

Answer

Policy Remediation

Answer

Policy Exclusion

Answer

Policy Override