AZ-900 Describe Azure management and governance Practice Question
A company has 30 Azure subscriptions organized under a single management group. The governance team wants to enforce that all resource groups must have a specific tag 'CostCenter' with a valid value. They create an Azure Policy definition with the 'Deny' effect and assign it to the root management group. However, the development team complains that they have a sandbox subscription where they need to create resource groups without the 'CostCenter' tag for testing. The governance team still wants the policy to apply to all other subscriptions but exempt the sandbox subscription. Which solution should the governance team use?
⚠ Common exam trap
Many exam-takers confuse policy exemptions with policy assignment effect changes or scope reassignment, mistakenly thinking they need to modify the policy assignment or create a separate policy instead of using the built-in exemption feature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a policy exemption on the sandbox subscription with category 'Waiver'.
Azure Policy exemptions allow specific scopes (like the sandbox subscription) to be excluded from a policy's enforcement while keeping the policy assigned to the parent management group. A 'Waiver' exemption category is used when the intent is to temporarily or permanently exempt a resource from policy evaluation, which fits the governance team's requirement to exempt only the sandbox subscription without altering the policy assignment structure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a second policy assignment at the sandbox subscription with the 'Disabled' effect.
Why it's wrong here
Azure Policy does not support a 'Disabled' effect. You cannot override a parent policy assignment by assigning the same policy with a different effect at a child scope. The only way to exclude a scope from a policy assignment is to use an exemption.
When this WOULD be correct
If the question asked about disabling a policy definition entirely (not an assignment) or if there was a feature to turn off a policy assignment at a lower scope, but Azure Policy does not support a 'Disabled' effect on assignments.
- ✗
Remove the policy assignment from the management group and assign it individually to all subscriptions except the sandbox.
Why it's wrong here
This approach is extremely inefficient and error-prone for 30 subscriptions. It defeats the purpose of using a management group to apply policy centrally. The correct method is to keep the management group assignment and use an exemption for the sandbox.
When this WOULD be correct
This option would be correct if the governance team needed to apply different policy definitions or parameters to individual subscriptions, and the management group assignment could not be used due to conflicting requirements. For example, if each subscription required a unique set of tags or allowed values.
- ✓
Use a policy exemption on the sandbox subscription with category 'Waiver'.
Why this is correct
Correct. A policy exemption allows you to exclude a scope from an existing policy assignment. The 'Waiver' category is appropriate for a planned, temporary exemption where the scope is not expected to comply, such as a development sandbox.
- ✗
Configure an Azure Blueprint for the management group and exclude the sandbox subscription.
Why it's wrong here
Azure Blueprints can include policy assignments, but they do not have a built-in exclusion mechanism. To exclude a subscription from a blueprint's policy assignment, you would still need to create an exemption on that subscription. Additionally, moving from a direct policy assignment to a blueprint is unnecessary complexity.
When this WOULD be correct
A company needs to deploy a standardized environment (including resource groups, RBAC, and policies) to multiple subscriptions, but one subscription requires a slightly different configuration. An Azure Blueprint with the sandbox subscription excluded from the blueprint assignment would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use a policy exemption on the sandbox subscription with category 'Waiver'.Correct answer▾
Why this is correct
Correct. A policy exemption allows you to exclude a scope from an existing policy assignment. The 'Waiver' category is appropriate for a planned, temporary exemption where the scope is not expected to comply, such as a development sandbox.
✗Create a second policy assignment at the sandbox subscription with the 'Disabled' effect.Wrong answer — click to see why▾
Why this is wrong here
The 'Disabled' effect is not a valid effect for Azure Policy; valid effects include 'Deny', 'Audit', 'Append', etc. You cannot set a policy assignment to 'Disabled' to exempt a subscription.
★ When this WOULD be the correct answer
If the question asked about disabling a policy definition entirely (not an assignment) or if there was a feature to turn off a policy assignment at a lower scope, but Azure Policy does not support a 'Disabled' effect on assignments.
Why candidates choose this
Candidates may think that setting the effect to 'Disabled' would effectively turn off the policy for that subscription, similar to disabling a feature, but this is not a valid Azure Policy effect.
✗Remove the policy assignment from the management group and assign it individually to all subscriptions except the sandbox.Wrong answer — click to see why▾
Why this is wrong here
Removing the policy from the management group and assigning it individually to each subscription except the sandbox is inefficient and violates the principle of centralized management. It also fails to enforce the policy on new subscriptions added to the management group.
★ When this WOULD be the correct answer
This option would be correct if the governance team needed to apply different policy definitions or parameters to individual subscriptions, and the management group assignment could not be used due to conflicting requirements. For example, if each subscription required a unique set of tags or allowed values.
Why candidates choose this
Candidates may think that excluding the sandbox subscription requires removing the policy from the management group and manually assigning it elsewhere, not realizing that policy exemptions provide a simpler and more manageable solution.
✗Configure an Azure Blueprint for the management group and exclude the sandbox subscription.Wrong answer — click to see why▾
Why this is wrong here
Azure Blueprints are used to define a repeatable set of Azure resources and policies, but they do not support excluding specific subscriptions from a policy assignment. The correct approach is to use a policy exemption on the sandbox subscription.
★ When this WOULD be the correct answer
A company needs to deploy a standardized environment (including resource groups, RBAC, and policies) to multiple subscriptions, but one subscription requires a slightly different configuration. An Azure Blueprint with the sandbox subscription excluded from the blueprint assignment would be correct.
Why candidates choose this
Candidates may think Blueprints can exclude subscriptions from policy enforcement because Blueprints allow excluding subscriptions from the blueprint assignment itself, but policy assignments are separate and not inherently excluded by Blueprint exclusions.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Policy assignment
Policy assignment is the process of attaching a set of rules or permissions to a specific resource, user, or group so that those rules are enforced in a cloud or IT environment.
Key term
Tag
A tag is a metadata label attached to a cloud resource or IT asset to organize, track, and manage it based on custom attributes like environment, owner, or cost center.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.