AZ-900 Describe Azure management and governance Practice Test 8 — 15 Questions

Question 1

A company has a resource group named 'RG-Prod' that contains critical virtual machines (VMs), virtual networks, and a SQL database. The infrastructure team needs to grant a group of developers the ability to start, stop, and restart only the VMs in RG-Prod. The developers must not be able to create new VMs, delete existing VMs, modify the virtual networks, or access the database. The company wants to follow the principle of least privilege. Which Azure role-based access control (RBAC) approach should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom RBAC role that includes only the specific actions required (e.g., Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action) and assign it to the developers.. The principle of least privilege requires granting only the exact permissions needed. The built-in Virtual Machine Contributor role includes permissions beyond start/stop/restart (e.g., it allows creating and deleting VMs), which violates the requirement. A custom RBAC role scoped to RG-Prod with only the specific actions (Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/restart/action) meets the need precisely.

Answer

Assign the Virtual Machine Contributor built-in role to the developers.

Answer

Assign the Contributor built-in role and then create an Azure Policy to deny any VM creation or deletion and VNet modifications in RG-Prod.

Answer

Assign the Reader role to the developers and use Azure Policy to automatically start, stop, and restart VMs on their behalf.

Question 2

A company uses a single Azure subscription for its development and production workloads. The finance team wants to set a monthly spending limit for the entire subscription and receive an email alert when the costs are projected to exceed 80% of that limit. The company does not want any resources to be automatically stopped or deleted when the limit is reached. Which Azure feature should the finance team configure?

Accepted Answer

Azure Budgets in Azure Cost Management + Billing. Azure Budgets in Azure Cost Management + Billing allows you to set a spending limit (budget) for a subscription and configure alert thresholds (e.g., 80% of the budget) that trigger email notifications when costs are projected to exceed that percentage. Crucially, Azure Budgets only sends alerts and does not automatically stop or delete resources, matching the company's requirement to avoid any automatic resource termination.

Answer

Azure Policy with the 'deny' effect

Answer

Azure Advisor cost recommendations

Answer

Azure Service Health alerts

Question 3

A company has multiple Azure subscriptions used by different departments. The governance team has created several Azure Policy definitions to enforce tagging rules, restrict allowed VM SKUs, and require HTTPS for storage accounts. The team wants to assign these policies as a single, manageable unit to a management group so that they can track overall compliance across all subscriptions in that group from one dashboard. The compliance summary should show how many resources are compliant against all the combined policies. Which Azure feature should the team use?

Accepted Answer

Azure Policy Initiative. Azure Policy Initiative is the correct choice because it allows the governance team to group multiple Azure Policy definitions (tagging rules, VM SKU restrictions, HTTPS requirement) into a single, manageable unit. Assigning this initiative to a management group enables aggregated compliance tracking across all subscriptions within that group, showing a unified compliance summary for all combined policies.

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Management Groups

Answer

Azure Resource Graph

Question 4

A company is adopting Azure and wants to ensure that every new subscription automatically includes a standard set of governance artifacts: two custom Azure Policy definitions (one for allowed locations, one for resource tagging), a custom Role-Based Access Control (RBAC) assignment for the security team, and an initial resource group with an Azure Resource Manager (ARM) template that sets up a network topology. The company wants to version these artifacts and update them over time, ensuring that new subscriptions always use the latest approved version. Which Azure service should the company use to package and deploy this standardized environment?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it is designed to orchestrate the deployment of a repeatable, versioned environment that includes policies, RBAC assignments, resource groups, and ARM templates. It allows you to define a blueprint with these artifacts, publish versions, and assign the latest approved version to new subscriptions, ensuring consistent governance across the organization.

Answer

Azure Management Groups

Answer

Azure Policy Initiatives

Answer

Azure Resource Manager (ARM) Templates

Question 5

A company uses Azure Policy to enforce governance. They want to prevent users from creating virtual machines of the Standard_DS3_v2 SKU in their subscription, and they also want to log any attempt to create such a VM (whether successful or not) for audit purposes. What is the minimum number of Azure Policy assignments required to meet both requirements?

Accepted Answer

Two – assign one policy definition with the Deny effect and another with the Audit effect.. Azure Policy can only enforce a single effect per policy definition. To both deny the creation of Standard_DS3_v2 VMs and log all attempts (successful or denied) for audit, you need two separate policy assignments: one with the Deny effect to block the action, and another with the Audit effect to log the attempt. A single policy cannot combine both effects, as each definition is limited to one effect type.

Answer

One – assign a policy definition with the Deny effect.

Answer

One – assign a policy definition with the Audit effect.

Answer

Two – assign one policy definition with the Deny effect and another with the Append effect.

Question 6

A company has an Azure subscription used by multiple development teams. The security team wants to ensure that every virtual network (VNet) created in the subscription automatically has a specific network security group (NSG) associated with its default subnet. The NSG rules are defined by the security team, and developers should not have to perform any extra steps after creating a VNet. Which Azure Policy effect should the security team use in the policy definition?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it automatically deploys a specific NSG to the default subnet of any VNet that does not already have it, ensuring compliance without requiring developer intervention. This effect evaluates the resource after creation and triggers a deployment to remediate non-compliant states, aligning with the requirement for zero extra steps.

Answer

Deny

Answer

Audit

Answer

Append

Question 7

A company uses Azure Management Groups to organize subscriptions. The hierarchy is: Root Management Group -> Contoso Management Group -> Sales (management group) and R&D (management group). Under Sales there are two subscriptions: Sales-Prod and Sales-Dev. Under R&D there is one subscription: R&D-Prod. The governance team assigns an Azure Policy definition that denies the creation of resources in the East US region. They assign this policy to the Contoso Management Group, but they add an exclusion for the Sales-Dev subscription. A developer in the Sales-Dev subscription attempts to create a virtual machine in the East US region. What will happen?

Accepted Answer

The creation will succeed because the Sales-Dev subscription is excluded from the policy assignment.. Azure Policy allows exclusions at any child scope when a policy is assigned at a parent management group. The policy assigned to the Contoso Management Group denies resources in East US, but the Sales-Dev subscription is explicitly excluded from that assignment. Therefore, the developer's virtual machine creation in East US will succeed, as the exclusion overrides the deny effect for that subscription.

Answer

The creation will fail because the policy is assigned to the Contoso Management Group, and all subscriptions under it must comply.

Answer

The creation will succeed because the policy is assigned only to the Sales and R&D management groups, not directly to subscriptions.

Answer

The creation will fail because exclusions cannot be applied at the subscription level when the policy is assigned at a management group scope.

Question 8

A company wants to proactively monitor and control its Azure spending. The finance team has set a monthly budget of $10,000 for the 'Marketing' subscription. They want to receive an email notification when the actual spending reaches 80% of the budget and another notification when it reaches 100%. Additionally, if the spending ever exceeds $12,000 in a month, they want to automatically trigger a runbook that scales down non-critical resources. Which Azure feature should the finance team use to achieve all these requirements?

Accepted Answer

Azure Budgets in Microsoft Cost Management with action groups. Azure Budgets in Microsoft Cost Management allows you to set spending thresholds and configure alerts based on actual or forecasted costs. By linking an action group to the budget, you can trigger email notifications at 80% and 100% of the $10,000 budget, and also invoke an Azure Automation runbook when spending exceeds $12,000, meeting all requirements.

Answer

Azure Advisor cost recommendations

Answer

Azure Policy with the 'append' effect

Answer

Azure Cost Management invoices

Question 9

A company uses Azure Policy to enforce governance on their subscriptions. They want to ensure that every newly created Azure resource automatically receives two tags: 'Owner' and 'CostCenter'. If a user or an automated process creates a resource without specifying these tags, the policy should add the missing tags with default values of 'Unassigned' without blocking the resource creation. Which Azure Policy effect should be used in the policy definitions?

Accepted Answer

Append. (Append) is correct because the Append effect adds specified fields (such as tags) to a resource during creation or update without blocking the operation. In this scenario, the policy must automatically add the 'Owner' and 'CostCenter' tags with default values of 'Unassigned' when they are missing, which is exactly what Append does—it modifies the resource request to include the missing tags before the resource is created.

Answer

Deny

Answer

Audit

Answer

DeployIfNotExists

Question 10

A financial services company must deploy a standardized environment for a new customer-facing application. The environment must include a specific set of Azure resources (such as virtual networks, databases, and App Service plans), pre-configured role assignments for the compliance team, and a collection of Azure Policy definitions that enforce encryption and tagging rules. The company needs to package all these components into a single, versioned artifact that can be consistently deployed across multiple subscriptions and regions, with the ability to track changes and updates. Which Azure service should the company use to achieve this?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it is designed to package a standardized environment—including resource templates, role assignments, and policy definitions—into a single, versioned artifact that can be deployed consistently across multiple subscriptions and regions. Unlike ARM templates, Blueprints natively supports versioning, tracking changes, and updating deployments, which meets the company's requirement for a versioned artifact with change tracking.

Answer

Azure Policy

Answer

Azure Resource Manager (ARM) templates

Answer

Azure Management Groups

Question 11

A company uses Azure Blueprints to enforce a standard landing zone for all development subscriptions. The blueprint includes a virtual network, subnets, and network security groups. After the blueprint is assigned to a subscription, a development team manually adds a new subnet to the virtual network. The company plans to update the blueprint to add a new network security group rule. When the updated blueprint is published and the assignment is updated, what will happen to the manually added subnet?

Accepted Answer

The manually added subnet will be preserved because blueprints do not manage resources after creation.. Azure Blueprints are designed to establish a desired configuration for a subscription, but they do not actively manage resources after creation. Once a resource is deployed, the blueprint does not enforce ongoing compliance or revert manual changes. Therefore, when the blueprint is updated and reassigned, only resources defined in the blueprint are affected; the manually added subnet remains untouched because it was not part of the blueprint definition.

Answer

The manually added subnet will be removed because the blueprint definition now takes precedence.

Answer

The manually added subnet will be overwritten by the updated blueprint definition.

Answer

The blueprint update will fail because the subnet already exists.

Question 12

A company has deployed a production Azure SQL Database that is used by a critical line-of-business application. The database administrators need to be able to change the database schema and scaling settings. However, the operations team must ensure that no one can accidentally delete the database or its server. The company does not want to implement a complex backup strategy for this prevention; they want a simple control that can be applied at the resource level without affecting other management operations. What should the operations team configure to meet these requirements?

Accepted Answer

A 'CanNotDelete' resource lock on the database and the server. A 'CanNotDelete' resource lock on the database and the server prevents accidental deletion while still allowing all other management operations, including schema changes and scaling. This meets the requirement for a simple, resource-level control that does not affect read or update permissions.

Answer

An Azure Policy definition with the 'Deny' effect assigned to the resource group containing the database

Answer

A custom Azure Role-Based Access Control (RBAC) role that excludes the delete action

Answer

An Azure Blueprint that includes a policy enforcing a read-only state

Question 13

A company runs several Azure virtual machines and an Azure SQL Database in a single subscription. The operations team needs a single, personalized dashboard that displays the current health status of these specific resources, as well as any upcoming planned maintenance events from Microsoft that might affect them. The team wants to see all this information in one place without having to navigate multiple tools. Which Azure service should the operations team use to meet these requirements?

Accepted Answer

Azure Service Health. Azure Service Health provides a personalized dashboard that shows the health of your specific Azure services and resources, including Azure virtual machines and SQL Database, in a single subscription. It also surfaces upcoming planned maintenance events from Microsoft that could affect those resources, meeting the requirement for a unified view without navigating multiple tools.

Answer

Azure Resource Health

Answer

Azure Monitor

Answer

Azure Advisor

Question 14

A company uses Azure to host multiple virtual machines and virtual networks. The network team is responsible for configuring and maintaining virtual networks, subnets, and network security groups. The company wants to ensure that the network team can manage these network resources but cannot modify or delete virtual machines. Which Azure built-in role should the company assign to the network team?

Accepted Answer

Network Contributor. The Network Contributor role grants full management permissions for network resources, including virtual networks, subnets, and network security groups, but does not allow modification or deletion of virtual machines. This aligns exactly with the requirement to restrict the network team to network resources only.

Answer

Owner

Answer

Contributor

Answer

Virtual Machine Contributor

Question 15

A company uses Azure Policy to govern its Azure environment. The governance team wants to enforce that all virtual machines (VMs) deployed in the production subscription use only approved operating system images from a specific Azure Compute Gallery. However, during a transition period, the team does not want to block the creation of VMs that use non-approved images; instead, they need to identify and report on any non-compliant VMs. They also want to track compliance over time. Which Azure Policy effect should the governance team use in the policy definition to meet these requirements?

Accepted Answer

Audit. The Audit effect is correct because it enables the governance team to identify and report non-compliant VMs without blocking their creation. Azure Policy's Audit effect logs a warning in the activity log for resources that violate the policy, allowing the team to track compliance over time via Azure Policy compliance reports and Azure Monitor, while the transition period remains unblocked.

Answer

Deny

Answer

Append

Answer

Modify