Describe Azure management and governance →mediumMultiple ChoiceObjective-mapped

AZ-900 Describe Azure management and governance Practice Question

A company has a production Azure subscription used by multiple teams. The governance team wants to enforce a rule that only virtual machines (VMs) of specific SKU sizes (e.g., Standard_D2s_v3 and Standard_D4s_v3) can be deployed. If a team attempts to deploy a VM of a different SKU size, the deployment must be blocked immediately and the user must see an error message explaining the restriction. Which Azure feature should the governance team use?

⚠ Common exam trap

A common mix-up: candidates confuse Azure Policy with Azure RBAC, thinking that RBAC can filter by resource properties, but RBAC only controls access to actions (e.g., write) at a scope, not the specific configuration of the resource being created.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Azure Policy with the 'Deny' effect

Azure Policy with the 'Deny' effect is the correct choice because it allows the governance team to define and enforce rules that prevent the deployment of non-compliant resources, such as VMs with disallowed SKU sizes. When a policy with the 'Deny' effect is assigned, any attempt to create or update a resource that violates the policy is blocked immediately, and the user receives a clear error message explaining the restriction. This is the only Azure feature that provides proactive, resource-level enforcement with a built-in denial mechanism.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Azure Role-Based Access Control (RBAC) with a custom role that denies the 'Microsoft.Compute/virtualMachines/write' action
Why it's wrong here
This is incorrect because Azure RBAC controls who can perform actions on resources (authorization), but it does not evaluate the configuration or properties of the resource being created. A Deny assignment for the write action would block all VM creations, not just those with disallowed SKU sizes. RBAC is not designed for policy enforcement based on resource properties.
When this WOULD be correct
If the governance team wanted to prevent all VM deployments by a specific user or group (e.g., non-admins), a custom RBAC role denying the 'Microsoft.Compute/virtualMachines/write' action would be appropriate. The question would specify blocking all VM creation, not just certain SKUs.
✓
Azure Policy with the 'Deny' effect
Why this is correct
Azure Policy with the 'Deny' effect is the correct solution. A policy definition can specify allowed VM SKU sizes using conditions. When assigned to a scope (e.g., subscription or resource group), any deployment of a VM that does not comply with the condition is blocked before the resource is created. This is the appropriate service for enforcing rules on resource configuration.
✗
Azure Blueprints with a resource lock
Why it's wrong here
Azure Blueprints is used to deploy a set of repeatable and governed environments, including policies, role assignments, and resource groups. However, a resource lock only prevents deletion or modification of existing resources; it does not block the creation of new resources with disallowed properties. Additionally, Blueprints alone cannot enforce a deny on SKU sizes without an accompanying Azure Policy.
When this WOULD be correct
An exam question where the requirement is to ensure that a set of resources (e.g., a network topology) is deployed consistently across subscriptions and cannot be accidentally deleted or modified, and the solution must include locking those resources after deployment.
✗
Azure resource locks at the resource group level
Why it's wrong here
Resource locks are used to prevent accidental deletion or modification of critical resources. A 'CanNotDelete' or 'ReadOnly' lock on a resource group would block all deletions or modifications, but it does not evaluate the properties of new resources being deployed. It cannot prevent the creation of a VM with a disallowed SKU size.
When this WOULD be correct
A question where the requirement is to prevent accidental deletion or modification of critical resources, such as a production database, by applying a read-only or delete lock at the resource group level.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

✓Azure Policy with the 'Deny' effectCorrect answer▾

Why this is correct

Azure Policy with the 'Deny' effect is the correct solution. A policy definition can specify allowed VM SKU sizes using conditions. When assigned to a scope (e.g., subscription or resource group), any deployment of a VM that does not comply with the condition is blocked before the resource is created. This is the appropriate service for enforcing rules on resource configuration.

✗Azure Role-Based Access Control (RBAC) with a custom role that denies the 'Microsoft.Compute/virtualMachines/write' actionWrong answer — click to see why▾

Why this is wrong here

Azure RBAC denies the entire 'Microsoft.Compute/virtualMachines/write' action, blocking all VM deployments regardless of SKU size. It cannot enforce granular restrictions on specific SKU sizes, which is required by the question.

★ When this WOULD be the correct answer

If the governance team wanted to prevent all VM deployments by a specific user or group (e.g., non-admins), a custom RBAC role denying the 'Microsoft.Compute/virtualMachines/write' action would be appropriate. The question would specify blocking all VM creation, not just certain SKUs.

Why candidates choose this

Candidates may confuse RBAC's ability to deny actions with Azure Policy's ability to enforce resource properties. Both can block deployments, but RBAC lacks the granularity to filter by SKU size.

✗Azure Blueprints with a resource lockWrong answer — click to see why▾

Why this is wrong here

Azure Blueprints with a resource lock cannot block VM deployments based on SKU size; resource locks only prevent deletion or modification of resources, not creation based on specific properties.

★ When this WOULD be the correct answer

An exam question where the requirement is to ensure that a set of resources (e.g., a network topology) is deployed consistently across subscriptions and cannot be accidentally deleted or modified, and the solution must include locking those resources after deployment.

Why candidates choose this

Candidates may confuse Blueprints as a governance tool that enforces rules, but they do not provide real-time denial of non-compliant deployments like Azure Policy does.

✗Azure resource locks at the resource group levelWrong answer — click to see why▾

Why this is wrong here

Resource locks prevent deletion or modification of resources but do not enforce restrictions on VM SKU sizes during deployment; they cannot block deployment of disallowed SKUs.

★ When this WOULD be the correct answer

A question where the requirement is to prevent accidental deletion or modification of critical resources, such as a production database, by applying a read-only or delete lock at the resource group level.

Why candidates choose this

Candidates may confuse resource locks with policy enforcement, thinking locks can restrict resource configurations, but locks only protect against changes to existing resources, not control allowed SKUs.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

AZ-900 Describe Azure management and governance Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question