AZ-900 Describe Azure architecture and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Policy

  Why it's wrong here

  Azure Policy is a governance and compliance service that enforces rules and effects on resources, such as requiring specific VM sizes or tagging. It evaluates resources against assigned policy definitions at management group, subscription, or resource group scopes, but it never acts as a container or grouping mechanism. Policies can be applied to resource groups, yet they do not organize resources; they only audit or modify them. Since the goal is to organize virtual machines, Azure Policy is an unrelated tool and an incorrect answer.

  When this WOULD be correct

  A question asking how to enforce tagging requirements or restrict resource locations across all resources in a subscription would have Azure Policy as the correct answer.

• ✓

  Resource Group

  Why this is correct

  A resource group is a logical container in Azure that holds related resources for an application or solution, such as VMs, databases, and storage accounts. It enables you to manage those resources collectively, applying lifecycle operations like deployment, updating, and deletion as a unit. Access control is also scoped at the resource group level using Azure RBAC, and you can track costs for the group, though billing aggregates at the subscription. For organizing virtual machines specifically, the resource group is the precise, correct tier.

• ✗

  Management Group

  Why it's wrong here

  Management groups sit above subscriptions in the Azure hierarchy and are used to organize multiple subscriptions for governance, compliance, and access control across an entire enterprise. They can contain subscriptions but not resources directly; resources are always nested within resource groups inside subscriptions. While management groups let you apply policies and RBAC inherited by all subscriptions underneath them, they do not serve as containers for VMs or other individual assets. Thus, using a management group to organize virtual machines is architecturally incorrect.

  When this WOULD be correct

  A company has multiple Azure subscriptions and needs to apply consistent access control and policies across all subscriptions. Which Azure component should they use to organize subscriptions into a hierarchy?

• ✗

  Azure Subscription

  Why it's wrong here

  An Azure subscription is primarily a billing and access boundary, not a physical container for individual resources like virtual machines. Resources are placed into resource groups that reside inside a subscription, and the subscription provides a scope for applying RBAC, policies, and cost management. You could theoretically create separate subscriptions to segment environments, but that is a much broader organizational mechanism. For grouping VMs within the same service or project, resource groups are used, so a subscription is the wrong granularity.

  When this WOULD be correct

  A question asks: 'Which Azure component defines a billing boundary and access control scope for resources?' or 'Which entity is required to create resources and is associated with billing?'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question