AZ-900 Describe Azure management and governance Practice Question
A company uses Azure Management Groups to organize subscriptions. The hierarchy is: Root Management Group -> Contoso Management Group -> Sales (management group) and R&D (management group). Under Sales there are two subscriptions: Sales-Prod and Sales-Dev. Under R&D there is one subscription: R&D-Prod. The governance team assigns an Azure Policy definition that denies the creation of resources in the East US region. They assign this policy to the Contoso Management Group, but they add an exclusion for the Sales-Dev subscription. A developer in the Sales-Dev subscription attempts to create a virtual machine in the East US region. What will happen?
⚠ Common exam trap
Many candidates assume exclusions are not allowed when a policy is assigned at a higher scope, or mistakenly think that exclusions only work at the same scope as the assignment, rather than understanding that Azure Policy supports exclusions at any child scope (management group, subscription, or resource group).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The creation will succeed because the Sales-Dev subscription is excluded from the policy assignment.
Azure Policy allows exclusions at any child scope when a policy is assigned at a parent management group. The policy assigned to the Contoso Management Group denies resources in East US, but the Sales-Dev subscription is explicitly excluded from that assignment. Therefore, the developer's virtual machine creation in East US will succeed, as the exclusion overrides the deny effect for that subscription.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The creation will fail because the policy is assigned to the Contoso Management Group, and all subscriptions under it must comply.
Why it's wrong here
This claim overlooks the exclusion that was configured for the Sales-Dev subscription. While policy inheritance normally propagates from the Contoso Management Group down to all child subscriptions, exclusions are an explicit override mechanism in the assignment. Because the Sales-Dev subscription was excluded, it is removed from the policy's effective scope and is not required to comply. Thus, the statement that all subscriptions under the management group must comply is incorrect when a subscription is explicitly excluded.
When this WOULD be correct
This option would be correct if the policy was assigned to the Contoso Management Group without any exclusions, and a subscription under it attempted to create a resource in a denied region. In that case, all subscriptions inherit the policy and must comply.
- ✗
The creation will succeed because the policy is assigned only to the Sales and R&D management groups, not directly to subscriptions.
Why it's wrong here
This is incorrect. The policy is assigned to the Contoso Management Group, which is a parent of both Sales and R&D. Policy inheritance means it applies to child management groups and their subscriptions unless excluded.
- ✓
The creation will succeed because the Sales-Dev subscription is excluded from the policy assignment.
Why this is correct
The creation will succeed because the Sales-Dev subscription is explicitly excluded from the policy assignment. In Azure Policy, an assignment at a management group scope applies to all child subscriptions by default, but the assignment's exclusion list can remove specific subscriptions, resource groups, or resources from evaluation. Because the Sales-Dev subscription is listed as an exclusion, the Deny effect of the policy never evaluates resources there, so the virtual machine creation is allowed.
- ✗
The creation will fail because exclusions cannot be applied at the subscription level when the policy is assigned at a management group scope.
Why it's wrong here
This is false because Azure Policy explicitly supports exclusions at the subscription level even when the policy is assigned at a management group scope. The assignment's 'exclusion' property is designed to let you opt out child scopes, such as subscriptions or resource groups, from policy evaluation regardless of the assigned scope. Therefore, applying an exclusion to the Sales-Dev subscription is a valid and supported configuration, and the creation will not fail for this reason.
When this WOULD be correct
If the policy assignment had an effect that does not support exclusions (e.g., 'Append' or 'AuditIfNotExists') or if the exclusion was applied to a resource group within a subscription that is not allowed by policy definition, then the creation would fail.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓The creation will succeed because the Sales-Dev subscription is excluded from the policy assignment.Correct answer▾
Why this is correct
The creation will succeed because the Sales-Dev subscription is explicitly excluded from the policy assignment. In Azure Policy, an assignment at a management group scope applies to all child subscriptions by default, but the assignment's exclusion list can remove specific subscriptions, resource groups, or resources from evaluation. Because the Sales-Dev subscription is listed as an exclusion, the Deny effect of the policy never evaluates resources there, so the virtual machine creation is allowed.
✗The creation will fail because the policy is assigned to the Contoso Management Group, and all subscriptions under it must comply.Wrong answer — click to see why▾
Why this is wrong here
The policy is assigned to the Contoso Management Group, but the Sales-Dev subscription is explicitly excluded from the assignment. Exclusions override inheritance, so the policy does not apply to Sales-Dev, and the VM creation succeeds.
★ When this WOULD be the correct answer
This option would be correct if the policy was assigned to the Contoso Management Group without any exclusions, and a subscription under it attempted to create a resource in a denied region. In that case, all subscriptions inherit the policy and must comply.
Why candidates choose this
Candidates may mistakenly believe that policy assignments at a management group scope always apply to all descendant subscriptions without exception, overlooking the ability to exclude specific subscriptions from the assignment.
✗The creation will fail because exclusions cannot be applied at the subscription level when the policy is assigned at a management group scope.Wrong answer — click to see why▾
Why this is wrong here
Exclusions can be applied at the subscription level even when the policy is assigned at a management group scope, so the Sales-Dev subscription's exclusion is valid and allows the creation.
★ When this WOULD be the correct answer
If the policy assignment had an effect that does not support exclusions (e.g., 'Append' or 'AuditIfNotExists') or if the exclusion was applied to a resource group within a subscription that is not allowed by policy definition, then the creation would fail.
Why candidates choose this
Candidates may mistakenly believe that exclusions cannot override assignments at higher scopes, or they confuse exclusion with exemption, thinking that exclusions are not allowed at subscription level for management group assignments.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.