AZ-900 Describe Azure management and governance Practice Question
A company has a single Azure subscription that contains resource groups for several business units. The company's compliance team wants to enforce a rule: no virtual network (VNet) can be deployed in any resource group unless the VNet is in a specific allowed region (West Europe). The rule must also block the creation of VNets in disallowed regions, but the team must be able to selectively exempt certain resource groups (e.g., for disaster recovery testing) without altering the underlying rule definition. Which Azure feature should the compliance team implement?
⚠ Common exam trap
It's easy for candidates to confuse Azure Policy with RBAC or resource locks, thinking RBAC can restrict by region or that locks can prevent creation, when in fact only Azure Policy can enforce location-based rules with exemption capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy with the 'Deny' effect assigned to the subscription, and create policy exemptions for the resource groups that need to deploy VNets in other regions.
Azure Policy with the 'Deny' effect can enforce a rule at the subscription scope that blocks VNet creation in disallowed regions. Policy exemptions allow specific resource groups to be excluded from the policy without modifying the original rule definition, meeting the compliance team's requirement for selective exemption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy with the 'Deny' effect assigned to the subscription, and create policy exemptions for the resource groups that need to deploy VNets in other regions.
Why this is correct
Correct. Azure Policy with the 'Deny' effect prevents the creation of resources that do not meet the policy rule. Policy exemptions allow the team to exclude specific scopes from the policy assignment, enabling exceptions for disaster recovery testing without modifying the policy definition.
- ✗
Azure role-based access control (RBAC) by creating a custom role that restricts the 'Microsoft.Network/virtualNetworks/write' action to only the West Europe region, and assign that role to all users.
Why it's wrong here
Incorrect. RBAC controls who can perform actions, but it does not evaluate resource properties like region. Custom roles can restrict actions at a scope, but they cannot inspect the location parameter during the resource creation. Azure Policy is designed for this kind of property-based enforcement.
When this WOULD be correct
A question where the requirement is to restrict which users or groups can create VNets (e.g., only senior administrators can create VNets) and the solution must be based on identity and access management, not resource properties. For example: 'The company wants to ensure only the network team can create VNets.'
- ✗
A resource lock on each resource group that prevents the creation of any resource in disallowed regions.
Why it's wrong here
Incorrect. Resource locks only prevent deletion or modification of a resource group or resource; they cannot prevent creation of new resources based on properties like region. Also, a resource lock applies uniformly to a scope and cannot be selectively applied to specific resource types like VNets.
When this WOULD be correct
A question where the requirement is to prevent accidental deletion or modification of critical resources (e.g., production VNets) across an entire resource group, without needing region-specific or type-specific restrictions.
- ✗
Azure Blueprints by defining a blueprint that only includes VNets in West Europe and assigning it to all resource groups.
Why it's wrong here
Incorrect. Azure Blueprints are used to deploy and manage standardized environments (resource groups, policies, role assignments, etc.). However, they do not enforce ongoing compliance against future deployments outside the blueprint. To block non-compliant resources, a policy with 'Deny' effect is required.
When this WOULD be correct
A company needs to standardize the deployment of a multi-resource environment (e.g., a hub-and-spoke network with VNets, subnets, and NSGs) across multiple subscriptions, ensuring consistent configuration and compliance with organizational standards. Azure Blueprints would be correct to orchestrate and enforce that consistent environment.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Policy with the 'Deny' effect assigned to the subscription, and create policy exemptions for the resource groups that need to deploy VNets in other regions.Correct answer▾
Why this is correct
Correct. Azure Policy with the 'Deny' effect prevents the creation of resources that do not meet the policy rule. Policy exemptions allow the team to exclude specific scopes from the policy assignment, enabling exceptions for disaster recovery testing without modifying the policy definition.
✗Azure role-based access control (RBAC) by creating a custom role that restricts the 'Microsoft.Network/virtualNetworks/write' action to only the West Europe region, and assign that role to all users.Wrong answer — click to see why▾
Why this is wrong here
Azure RBAC cannot restrict actions based on region; it controls access to actions at a scope (e.g., subscription, resource group) but not based on resource properties like location. The custom role would need to use a condition, which is not supported for the 'Microsoft.Network/virtualNetworks/write' action in the way described.
★ When this WOULD be the correct answer
A question where the requirement is to restrict which users or groups can create VNets (e.g., only senior administrators can create VNets) and the solution must be based on identity and access management, not resource properties. For example: 'The company wants to ensure only the network team can create VNets.'
Why candidates choose this
Candidates may think RBAC can enforce location restrictions because they confuse RBAC with Azure Policy, or they believe custom roles can include location conditions similar to Azure Policy effects.
✗A resource lock on each resource group that prevents the creation of any resource in disallowed regions.Wrong answer — click to see why▾
Why this is wrong here
Resource locks prevent deletion or modification of resources but cannot filter by region or resource type; they apply to all resources in the scope, so they cannot selectively block VNet creation in disallowed regions while allowing other resources.
★ When this WOULD be the correct answer
A question where the requirement is to prevent accidental deletion or modification of critical resources (e.g., production VNets) across an entire resource group, without needing region-specific or type-specific restrictions.
Why candidates choose this
Candidates may confuse resource locks with policy enforcement, thinking locks can restrict creation based on region, but locks only protect against changes/deletion, not creation, and lack conditional logic.
✗Azure Blueprints by defining a blueprint that only includes VNets in West Europe and assigning it to all resource groups.Wrong answer — click to see why▾
Why this is wrong here
Azure Blueprints cannot enforce a deny rule on VNet creation in disallowed regions; they only package and deploy resources. They lack the ability to block non-compliant deployments or provide selective exemptions without altering the blueprint.
★ When this WOULD be the correct answer
A company needs to standardize the deployment of a multi-resource environment (e.g., a hub-and-spoke network with VNets, subnets, and NSGs) across multiple subscriptions, ensuring consistent configuration and compliance with organizational standards. Azure Blueprints would be correct to orchestrate and enforce that consistent environment.
Why candidates choose this
Candidates may think Blueprints can enforce region restrictions because they associate Blueprints with compliance and governance, but Blueprints are for deployment consistency, not runtime enforcement like Policy.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.