AZ-900 Describe Azure management and governance Practice Question
A financial services company must deploy a standardized environment for a new customer-facing application. The environment must include a specific set of Azure resources (such as virtual networks, databases, and App Service plans), pre-configured role assignments for the compliance team, and a collection of Azure Policy definitions that enforce encryption and tagging rules. The company needs to package all these components into a single, versioned artifact that can be consistently deployed across multiple subscriptions and regions, with the ability to track changes and updates. Which Azure service should the company use to achieve this?
⚠ Common exam trap
Test-takers frequently confuse ARM templates with Azure Blueprints, not realizing that Blueprints adds versioning, change tracking, and the ability to bundle policies and role assignments as a single artifact, whereas ARM templates are just one component within a Blueprint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Blueprints
Azure Blueprints is the correct choice because it is designed to package a standardized environment—including resource templates, role assignments, and policy definitions—into a single, versioned artifact that can be deployed consistently across multiple subscriptions and regions. Unlike ARM templates, Blueprints natively supports versioning, tracking changes, and updating deployments, which meets the company's requirement for a versioned artifact with change tracking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is used to enforce compliance rules on existing resources (e.g., requiring tags or encryption). It cannot deploy new infrastructure, assign roles, or package multiple components into a single deployable artifact. While policies can be included in a blueprint, Azure Policy alone does not meet the full requirement.
When this WOULD be correct
An organization needs to audit and enforce specific tagging and encryption rules across all existing and new resources in a subscription, without deploying infrastructure or role assignments.
- ✓
Azure Blueprints
Why this is correct
Azure Blueprints exactly fits this scenario. It allows you to define a desired state that includes ARM templates, role assignments, and policy assignments, and then assign that blueprint to subscriptions. Blueprints support versioning and can be managed centrally, enabling consistent, repeatable deployments across multiple environments.
- ✗
Azure Resource Manager (ARM) templates
Why it's wrong here
ARM templates are infrastructure-as-code files that deploy Azure resources. However, they do not natively include role assignments or policy assignments in a governance-focused way. You can embed those using nested templates and custom scripts, but ARM templates lack built-in versioning for governance artifacts and are not designed specifically as a governance packaging tool.
When this WOULD be correct
A company needs to deploy a consistent set of Azure resources (e.g., VMs, storage) using infrastructure as code, with version control and repeatable deployments across environments, but does not require pre-configured role assignments or policy definitions as part of the artifact.
- ✗
Azure Management Groups
Why it's wrong here
Management Groups provide a hierarchical structure for organizing subscriptions and applying access control (RBAC) and policies at scale. They do not deploy resources or define the composition of an environment. Management Groups are used to organize subscriptions, not to package and deploy a standardized environment.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure BlueprintsCorrect answer▾
Why this is correct
Azure Blueprints exactly fits this scenario. It allows you to define a desired state that includes ARM templates, role assignments, and policy assignments, and then assign that blueprint to subscriptions. Blueprints support versioning and can be managed centrally, enabling consistent, repeatable deployments across multiple environments.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy enforces compliance rules (e.g., encryption, tagging) but does not package multiple resource types, role assignments, and policies into a single versioned artifact for deployment across subscriptions and regions.
★ When this WOULD be the correct answer
An organization needs to audit and enforce specific tagging and encryption rules across all existing and new resources in a subscription, without deploying infrastructure or role assignments.
Why candidates choose this
Candidates see 'Azure Policy definitions' in the question and assume Policy is the answer, overlooking that the requirement is to deploy a full environment, not just enforce rules.
✗Azure Resource Manager (ARM) templatesWrong answer — click to see why▾
Why this is wrong here
ARM templates can deploy infrastructure as code but lack built-in capabilities for packaging role assignments and Azure Policy definitions as a single versioned artifact with change tracking across subscriptions and regions; Azure Blueprints is designed specifically for that purpose.
★ When this WOULD be the correct answer
A company needs to deploy a consistent set of Azure resources (e.g., VMs, storage) using infrastructure as code, with version control and repeatable deployments across environments, but does not require pre-configured role assignments or policy definitions as part of the artifact.
Why candidates choose this
Candidates know ARM templates are used for deploying Azure resources and may assume they can also handle role assignments and policies, overlooking that Azure Blueprints provides a higher-level, environment-scoped packaging solution.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Environment
An environment is a dedicated set of computing resources, configurations, and services used to develop, test, or host software applications in a controlled and repeatable way.
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.