AZ-900 Describe Azure management and governance Practice Question
A multinational corporation must ensure that every new Azure subscription automatically conforms to corporate security and compliance baselines. The team wants to deploy a predefined set of Azure resources (e.g., a central logging storage account, a network security group configuration) and apply a standard set of Azure Policy definitions (e.g., restricting allowed VM sizes, enforcing encryption) to any new subscription. They want to manage these as a single, versioned package that can be updated and re-assigned to existing subscriptions. Which Azure service should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Blueprints
Azure Blueprints is the service that enables the orchestrated deployment of resource templates (such as ARM templates) and policy assignments as a single, versioned package. It allows organizations to define a repeatable set of Azure resources and policies that can be applied to new or existing subscriptions to ensure consistency and compliance. Azure Policy alone can enforce rules but cannot deploy resources. Azure Management Groups only organize subscriptions for hierarchical management. Azure Resource Manager templates can deploy resources but cannot natively enforce policies or be versioned as a governance package in the same way as Blueprints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy
Why it's wrong here
Azure Policy can enforce rules and compliance on resources, but it cannot deploy Azure resources such as storage accounts or network security groups. It is primarily for auditing and governing existing and new resources, not for deploying infrastructure.
When this WOULD be correct
An exam question asking: 'Which service allows you to enforce compliance rules across subscriptions by applying policies that restrict resource configurations and ensure encryption?' would make Azure Policy the correct answer, as it focuses solely on policy enforcement without resource deployment.
- ✓
Azure Blueprints
Why this is correct
Azure Blueprints is designed to define a repeatable set of Azure resources and policies that can be deployed together as a single, versioned artifact. It orchestrates the deployment of ARM templates, policy assignments, role assignments, and other artifacts to ensure new subscriptions meet corporate baselines.
- ✗
Azure Management Groups
Why it's wrong here
Azure Management Groups provide a hierarchical structure to organize and manage subscriptions, and they can apply policies at scale. However, they cannot deploy resources or define a complete package of resources and policies that can be versioned and updated. They are a management container, not a deployment service.
When this WOULD be correct
A question asking how to centrally manage and enforce compliance across multiple subscriptions by grouping them into a hierarchy, where policies and RBAC are inherited from the management group level.
- ✗
Azure Resource Manager templates
Why it's wrong here
Azure Resource Manager (ARM) templates are declarative JSON files that define the infrastructure and configuration for Azure resources. While they can deploy resources, they cannot natively include policy assignments or be easily versioned as a governance package that updates existing subscriptions. Azure Blueprints builds on ARM templates by adding versioning and orchestration of multiple artifacts.
When this WOULD be correct
A question asking for a declarative, repeatable way to deploy identical infrastructure (e.g., a set of VMs, storage, and networking) across multiple environments, where the focus is on resource provisioning rather than governance or policy enforcement.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure BlueprintsCorrect answer▾
Why this is correct
Azure Blueprints is designed to define a repeatable set of Azure resources and policies that can be deployed together as a single, versioned artifact. It orchestrates the deployment of ARM templates, policy assignments, role assignments, and other artifacts to ensure new subscriptions meet corporate baselines.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy can enforce compliance rules (e.g., restricting VM sizes, encryption) but cannot deploy resources like a central logging storage account or network security group configuration. It lacks the capability to orchestrate resource deployment as a versioned package.
★ When this WOULD be the correct answer
An exam question asking: 'Which service allows you to enforce compliance rules across subscriptions by applying policies that restrict resource configurations and ensure encryption?' would make Azure Policy the correct answer, as it focuses solely on policy enforcement without resource deployment.
Why candidates choose this
Candidates see 'apply a standard set of Azure Policy definitions' in the question and assume Azure Policy alone suffices, overlooking the requirement to deploy resources and manage everything as a versioned package.
✗Azure Management GroupsWrong answer — click to see why▾
Why this is wrong here
Azure Management Groups organize subscriptions hierarchically for access and policy inheritance, but they cannot deploy resources or manage versioned packages of policies and resources as a single unit.
★ When this WOULD be the correct answer
A question asking how to centrally manage and enforce compliance across multiple subscriptions by grouping them into a hierarchy, where policies and RBAC are inherited from the management group level.
Why candidates choose this
Candidates may think Management Groups can deploy resources and policies together because they are used for governance and can assign policies to subscriptions.
✗Azure Resource Manager templatesWrong answer — click to see why▾
Why this is wrong here
Azure Resource Manager templates can deploy resources but cannot enforce compliance policies or manage policy assignments as a versioned package that can be updated and reassigned to existing subscriptions.
★ When this WOULD be the correct answer
A question asking for a declarative, repeatable way to deploy identical infrastructure (e.g., a set of VMs, storage, and networking) across multiple environments, where the focus is on resource provisioning rather than governance or policy enforcement.
Why candidates choose this
Candidates may confuse ARM templates with Blueprints because both use JSON and can deploy resources, but they overlook that Blueprints uniquely combine policy, role assignments, and resource templates into a single versioned artifact for governance.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.