AZ-900 Describe Azure management and governance Practice Test 9 — 15 Questions

Question 1

A company operates a hybrid IT environment with virtual machines running on-premises and in Amazon Web Services (AWS). The company also has a growing number of resources in Microsoft Azure. To simplify management, the company wants to use a single Azure service to apply Azure Policy definitions and enable unified inventory and tagging across all virtual machines, regardless of their location. Which Azure service should the company use?

Accepted Answer

Azure Arc. Azure Arc extends Azure Resource Manager (ARM) and Azure Policy to non-Azure environments, including on-premises and AWS virtual machines. By installing the Azure Connected Machine agent on each VM, the company can apply Azure Policy definitions and use unified inventory and tagging across all VMs from a single Azure control plane.

Answer

Azure Resource Manager

Answer

Azure Blueprints

Answer

Azure Management Groups

Question 2

A multinational company has a strict data residency requirement: all Azure virtual machines must be deployed only in the East US or West Europe Azure regions. The IT governance team wants to enforce this rule automatically so that any attempt to create a virtual machine in any other region is blocked immediately at the time of deployment. Users must receive a clear error message if they try to create a VM in a disallowed region. Which Azure feature should the governance team configure to meet this requirement?

Accepted Answer

Configure an Azure Policy with the Deny effect assigned to the subscription scope.. Azure Policy with the Deny effect is the correct choice because it enforces organizational rules by evaluating resource properties during deployment and blocking any non-compliant request. In this scenario, a policy can be defined to deny virtual machine creation in any region other than East US or West Europe, and the Deny effect ensures the deployment fails with a clear error message, meeting the real-time enforcement requirement.

Answer

Create a resource lock on the subscription to prevent all resource creation.

Answer

Assign an Azure RBAC role that denies create permissions for VMs in disallowed regions.

Answer

Set up a budget alert in Cost Management to notify when a VM is created in a disallowed region.

Question 3

A company has an Azure subscription used by several development teams. The governance team wants to identify any virtual machines that are not tagged with a mandatory 'CostCenter' tag. The team does not want to block the creation of untagged VMs; they only want to report on non-compliant resources in Azure Policy's compliance dashboard. Which Azure Policy effect should they use in their policy definition?

Accepted Answer

Audit. The Audit effect is correct because it enables Azure Policy to evaluate resources against the policy rule and report non-compliant resources in the compliance dashboard without blocking resource creation or modification. Since the governance team only wants visibility into untagged VMs, Audit logs the non-compliance as a warning in the activity log and marks the resource as non-compliant, but does not prevent the VM from being deployed.

Answer

Deny

Answer

Append

Answer

Disabled

Question 4

A company has an Azure Policy assignment that denies the creation of any virtual machine (VM) that does not have a mandatory 'CostCenter' tag. A development team needs to deploy a temporary test VM without the required tag for a short-term experiment. The governance team wants to allow this specific exception while recording the reason for the exception, ensuring the policy is still enforced for all other resources. The exception must also automatically expire after 30 days. Which Azure Policy feature should the governance team use?

Accepted Answer

Exemption. Azure Policy Exemption allows the governance team to create a specific exception for the test VM while recording the reason and setting an automatic expiration date (30 days). Unlike exclusion scopes, exemptions are explicitly designed to handle scenarios where a resource should be excluded from policy evaluation with a defined justification and expiry, ensuring the policy remains enforced for all other resources.

Answer

Exclusion scope

Answer

Audit effect

Answer

Override effect

Question 5

A company has an Azure subscription that contains production resources. The IT manager is concerned that a user who has the Contributor role might accidentally delete the entire subscription. The company wants a solution that prevents anyone from deleting the subscription, even users with the Owner role, while still allowing modifications to the resources inside the subscription. What should the administrator configure?

Accepted Answer

Apply a resource lock of type 'Delete' at the subscription level.. Option C is correct because a resource lock of type 'Delete' at the subscription level prevents any user, including those with the Owner role, from deleting the subscription. This lock overrides all RBAC permissions, ensuring that while modifications to resources inside the subscription are still allowed, the subscription itself cannot be removed. This directly addresses the IT manager's concern about accidental deletion.

Answer

Assign a custom role-based access control (RBAC) role that denies the delete action for all users.

Answer

Configure an Azure Policy with the 'Deny' effect to block deletion of the subscription.

Answer

Apply a resource lock of type 'ReadOnly' at the subscription level.

Question 6

A company has an Azure subscription with 200 virtual machines. The compliance team requires that all virtual machines have diagnostic settings enabled to send metrics and logs to a central Log Analytics workspace. The team wants Azure to automatically configure these diagnostic settings on any VM that currently lacks them, without manual intervention. Which Azure Policy effect should the team use in the policy definition?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it automatically deploys a diagnostic settings configuration to any VM that lacks it, ensuring compliance without manual intervention. This effect evaluates resources and, if they do not meet the condition (missing diagnostic settings), triggers a deployment to remediate them. Audit only logs non-compliance without fixing it, and Deny blocks non-compliant creation but does not remediate existing VMs.

Answer

Audit

Answer

Deny

Answer

Modify

Question 7

A company requires that all resources deployed in a production Azure subscription must include a 'Department' tag. Resources without this tag must be automatically prevented from being created. Which Azure service should the company use to enforce this requirement?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules on your Azure resources. In this scenario, you can define a policy that requires the 'Department' tag on all resources, and configure a deny effect to automatically prevent the creation of any resource that does not include this tag. This ensures compliance at the time of resource creation, without manual intervention.

Answer

Azure Blueprints

Answer

Azure Resource Manager

Answer

Azure Cost Management

Question 8

A multinational corporation wants to deploy a standard set of Azure resources—including virtual networks, virtual machines, and SQL databases—to multiple departments. Each deployment must automatically include assigned Azure Policy definitions to enforce security rules, role-based access control (RBAC) assignments for the operations team, and a predefined naming convention. The solution must provide a single, repeatable package that can be versioned and updated centrally. Which Azure service should the company use?

Accepted Answer

Azure Blueprints. Azure Blueprints is designed to orchestrate the deployment of resource templates (such as ARM templates or Azure Resource Manager templates) along with governance artifacts like Azure Policy assignments, RBAC role assignments, and resource groups. It provides a versioned, repeatable definition that can be assigned to subscriptions or management groups, ensuring consistent and compliant deployments across an organization. Azure Policy alone only enforces rules but does not orchestrate resource deployment. ARM templates define the infrastructure but lack built-in governance artifact management. Management Groups provide hierarchical organization but do not package deployments with policies and RBAC.

Answer

Azure Policy

Answer

Azure Resource Manager templates

Answer

Azure Management Groups

Question 9

A large enterprise has multiple Azure subscriptions for different business units. The governance team wants to apply a set of Azure Policy initiatives, such as allowed locations and required tags, to all subscriptions in the organization. They also want to set up role-based access control for the compliance team at the root level so that they can monitor compliance across all subscriptions. Which Azure feature should they use to achieve this?

Accepted Answer

Azure management groups. Azure management groups provide a hierarchical structure above subscriptions, enabling you to apply Azure Policy initiatives and role-based access control (RBAC) at the root management group level. This ensures that policies like allowed locations and required tags are inherited by all subscriptions within the organization, and the compliance team can monitor compliance across the entire hierarchy without needing to configure each subscription individually.

Answer

Azure Resource Manager (ARM) templates

Answer

Azure resource groups

Answer

Azure Blueprints

Question 10

A company has deployed a critical production application in an Azure resource group. The security team wants to prevent accidental deletion or modification of any resources within that resource group. They have already configured Azure RBAC roles to grant only necessary permissions to the operations team. However, they need an additional protection that even users with Owner permissions cannot delete the resource group or its resources without a two-step process to remove the protection. Which Azure feature should the company implement?

Accepted Answer

Azure Resource Lock. Azure Resource Lock is the correct feature because it provides a protection mechanism that prevents accidental deletion or modification of resources, even for users with Owner permissions. Unlike RBAC, which controls who can perform actions, a resource lock enforces a restriction that must be explicitly removed (a two-step process) before any changes can be made. This directly addresses the requirement for an additional layer of protection beyond role-based access control.

Answer

Azure Policy

Answer

Azure Blueprint

Answer

Azure Resource Tag

Question 11

A company runs a development subscription in Azure. The finance team wants to set a monthly spending limit of $5,000 for this subscription and receive email alerts when spending reaches 80% and 100% of that limit. The team must also be able to review historical spending trends. Which Azure tool should the finance team use to configure these alerts and track spending?

Accepted Answer

Azure Budgets. Azure Budgets is the correct tool because it allows you to set a spending limit (budget) at the subscription level, configure alerts at specific thresholds (e.g., 80% and 100%), and send email notifications when those thresholds are exceeded. Additionally, Azure Budgets integrates with Azure Monitor to provide historical cost data and trends, enabling the finance team to review spending patterns over time.

Answer

Azure Advisor

Answer

Azure Policy

Answer

Azure Pricing Calculator

Question 12

A company operates a fleet of on-premises servers running legacy applications. Due to strict regulatory compliance requirements, these servers cannot be migrated to Azure. However, the IT team wants to centrally manage these servers using Azure tools, including applying Azure Policy to enforce configuration standards and using Azure Monitor for log collection and performance monitoring. The team needs to treat these on-premises servers as Azure resources without moving them. Which Azure service should the company use?

Accepted Answer

Azure Arc. Azure Arc is the correct service because it extends Azure Resource Manager (ARM) and Azure management plane to on-premises servers, allowing them to be treated as Azure resources without migration. With Azure Arc, you can apply Azure Policy to enforce configuration standards and use Azure Monitor for log collection and performance monitoring on these servers, meeting the regulatory compliance requirement of keeping them on-premises.

Answer

Azure Stack Edge

Answer

Azure Site Recovery

Answer

Azure Policy

Question 13

A company uses Azure Policy to enforce that all virtual machines must have the Azure Monitor agent extension installed. The policy is assigned to a subscription and uses the 'DeployIfNotExists' effect, which automatically installs the agent on new VMs. However, the security team notices that several existing VMs are non-compliant because they were provisioned before the policy was assigned. The team wants to automatically make these existing VMs compliant without manual intervention. What should the team do?

Accepted Answer

Create a remediation task for the policy assignment.. Option A is correct because a remediation task on a 'DeployIfNotExists' policy assignment triggers the policy engine to evaluate existing non-compliant resources and automatically deploy the required extension (Azure Monitor agent) to those VMs. This is the designed mechanism to bring pre-existing resources into compliance without manual intervention.

Answer

Change the policy effect to 'Deny'.

Answer

Assign the policy at the management group scope.

Answer

Use Azure Automation Update Management.

Question 14

A company uses Azure Policy to enforce governance rules across its Azure subscriptions. The security team wants to ensure that all virtual machines deployed in a subscription must be of an approved size from a predefined list. If a user attempts to deploy a virtual machine with a size not on the list, the deployment must be immediately blocked. Which Azure Policy effect should the company use in the policy definition?

Accepted Answer

Deny. The 'Deny' effect is correct because it actively blocks any deployment that violates the policy rule, such as deploying a virtual machine with a size not on the approved list. This effect evaluates the request during resource creation or update and denies it if the condition is met, ensuring immediate enforcement. In contrast, other effects like 'Audit' only log non-compliant resources without blocking them, which does not meet the security team's requirement to prevent unauthorized VM sizes.

Answer

Audit

Answer

DeployIfNotExists

Answer

Append

Question 15

A company has multiple Azure subscriptions for different departments. The governance team needs to ensure that every new subscription is automatically provisioned with a consistent set of resources, including a predefined network topology, mandatory Azure Policy assignments (e.g., allowed locations), and specific role-based access control (RBAC) assignments for the security team. The solution must be repeatable, version-controlled, and allow the team to update the defined artifacts and apply updates to existing subscriptions. Which Azure service should the team use to define and deploy this collection of governance artifacts?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it enables the orchestrated deployment of a repeatable set of Azure resources, policies, and RBAC assignments as a single, version-controlled artifact. Unlike Azure Policy alone, Blueprints can include resource templates (e.g., network topology) and RBAC assignments, and it supports updating existing subscriptions by publishing new versions of the blueprint and assigning them to subscriptions.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Manager templates