AZ-900 Describe Azure management and governance Practice Question
A company has a management group hierarchy: Root → UK → Production. They assign a policy at the Root level that allows only certain VM sizes. Later, they assign another policy at the UK level that denies all resources. What is the effective effect on the Production subscription?
⚠ Common exam trap
The trap here is that candidates mistakenly apply a 'closest match' or 'most specific wins' logic from networking or RBAC to Azure Policy, whereas Azure Policy uses cumulative inheritance with deny overriding allow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Both policies apply, and the most restrictive (Deny) takes precedence.
D is correct because Azure Policy is inherited and cumulative down the management group hierarchy. The Root-level policy (allow only certain VM sizes) and the UK-level policy (deny all resources) both apply to the Production subscription. When a deny policy conflicts with an allow policy, the deny effect always takes precedence, making the most restrictive policy effective.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Only the Root policy applies because it is at the highest level.
Why it's wrong here
The statement is incorrect because Azure Policy assignments are not mutually exclusive based on hierarchy depth. All policies assigned at the root and at any intermediate management group (like UK) propagate downward and apply to child resources. The root policy does not supersede lower-level assignments; instead, both are evaluated together as part of the effective policy set. Therefore, the UK-level policy also applies.
When this WOULD be correct
If the question stated that policies are not inherited by default, or that only policies assigned directly to a scope apply, then option A would be correct. For example: 'A company assigns a policy at the Root level and another at a child scope. Policies are not inherited. Which policy applies?'
- ✗
Only the UK policy applies because it is more specific.
Why it's wrong here
This statement conflates scope proximity with exclusivity. A policy assigned at a more specific scope (UK) does not replace or eliminate policies assigned at ancestor scopes (root); Azure Policy aggregates all assignments across the hierarchy. The UK Deny policy does not make the root policy inapplicable—it simply has a more restrictive effect, which takes precedence during conflict resolution. Thus both policies apply, and the Deny effect is what actually blocks creation.
When this WOULD be correct
This option would be correct if the question stated that policies are evaluated only at the scope where they are assigned, without inheritance, or if the UK policy was assigned with a parameter that overrides the Root policy (e.g., using a policy effect that explicitly excludes inheritance).
- ✗
Both policies apply, and the order of evaluation could cause a conflict.
Why it's wrong here
There is no order-of-evaluation conflict because Azure Policy resolves multiple applicable effects by ranking them according to restrictiveness, not by sequence. If one assignment is Deny and another is Audit or Append, the Deny effect always wins, regardless of which policy was assigned first or evaluated at runtime. The effective outcome is a single, predictable effect per resource. So while both policies apply, they do not cause an evaluative conflict.
When this WOULD be correct
This option would be correct if the question described two policies with the same effect (e.g., both allow or both deny) but with different conditions that could conflict, and the exam asked about the order of evaluation causing a conflict. For example, a policy at Root allows VM sizes A and B, and a policy at UK allows VM sizes B and C; the effective set might be ambiguous without explicit precedence rules.
- ✓
Both policies apply, and the most restrictive (Deny) takes precedence.
Why this is correct
Both the root-level and UK-level policy assignments are evaluated against resources in the UK management group; Azure Policy inheritance combines all assignments from every ancestor scope. When these policies produce different effects, Azure Policy does not use ordering but instead applies the most restrictive effect. Deny is the highest-precedence effect, so the UK's Deny policy overrides the root's less restrictive effect, blocking all resource creation. This is deterministic and designed to enforce guardrails across hierarchy levels.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Both policies apply, and the most restrictive (Deny) takes precedence.Correct answer▾
Why this is correct
Both the root-level and UK-level policy assignments are evaluated against resources in the UK management group; Azure Policy inheritance combines all assignments from every ancestor scope. When these policies produce different effects, Azure Policy does not use ordering but instead applies the most restrictive effect. Deny is the highest-precedence effect, so the UK's Deny policy overrides the root's less restrictive effect, blocking all resource creation. This is deterministic and designed to enforce guardrails across hierarchy levels.
✗Only the Root policy applies because it is at the highest level.Wrong answer — click to see why▾
Why this is wrong here
In Azure, policies are inherited by default, so both the Root and UK policies apply to the Production subscription. The Root policy does not override the UK policy; instead, the most restrictive policy (Deny) takes precedence.
★ When this WOULD be the correct answer
If the question stated that policies are not inherited by default, or that only policies assigned directly to a scope apply, then option A would be correct. For example: 'A company assigns a policy at the Root level and another at a child scope. Policies are not inherited. Which policy applies?'
Why candidates choose this
Candidates may mistakenly think that higher-level policies always override lower-level ones, similar to organizational hierarchies where top-level decisions take precedence.
✗Only the UK policy applies because it is more specific.Wrong answer — click to see why▾
Why this is wrong here
In Azure, policies are inherited by default, so both the Root and UK policies apply to the Production subscription. The UK policy does not override the Root policy; instead, the most restrictive effect (Deny) takes precedence, not specificity.
★ When this WOULD be the correct answer
This option would be correct if the question stated that policies are evaluated only at the scope where they are assigned, without inheritance, or if the UK policy was assigned with a parameter that overrides the Root policy (e.g., using a policy effect that explicitly excludes inheritance).
Why candidates choose this
Candidates may mistakenly think that a more specific scope (UK) overrides a broader scope (Root), similar to role-based access control (RBAC) where more specific assignments can override broader ones, but policy inheritance works differently.
✗Both policies apply, and the order of evaluation could cause a conflict.Wrong answer — click to see why▾
Why this is wrong here
In Azure Policy, policies are additive and inherited; there is no conflict or evaluation order issue. The deny policy at the UK level overrides the allow policy from Root because deny takes precedence over allow, not because of evaluation order.
★ When this WOULD be the correct answer
This option would be correct if the question described two policies with the same effect (e.g., both allow or both deny) but with different conditions that could conflict, and the exam asked about the order of evaluation causing a conflict. For example, a policy at Root allows VM sizes A and B, and a policy at UK allows VM sizes B and C; the effective set might be ambiguous without explicit precedence rules.
Why candidates choose this
Candidates may think of policy evaluation as sequential or conflicting, similar to firewall rules or group policy, where order matters. They might not realize that Azure Policy uses additive inheritance with explicit deny override, not a conflict resolution based on evaluation order.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.