AZ-900 Describe Azure management and governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure RBAC

  Why it's wrong here

  Azure RBAC (Role-Based Access Control) is an identity and access management layer that determines who can perform lifecycle operations on resources through role assignments at management group, subscription, resource group, or resource scope. It answers 'can this principal start or stop a VM or delete a resource,' not 'may this resource exist with these properties or in this location.' RBAC permissions are evaluated only against management-plane actions, whereas Azure Policy evaluates resource properties and configuration against rule definitions, so RBAC cannot enforce the organizational rules described in the question.

• ✗

  Azure Blueprints

  Why it's wrong here

  Azure Blueprints is an orchestration and packaging service that bundles Azure Resource Manager templates, RBAC role assignments, policy definitions, and resource groups into a single assignable blueprint for creating repeatable environments. When a blueprint is assigned, the included Azure Policy assignments are pushed to the target scope, but the actual enforcement and compliance assessment are executed by Azure Policy, not by Blueprints itself. Because the question asks for the service that enforces governance rules over resource configuration, Blueprints is merely a delivery vehicle and therefore insufficient.

• ✓

  Azure Policy

  Why this is correct

  Azure Policy is the correct service because it defines business rules as policy definitions that apply to resource types and properties, using effects such as Deny, Audit, Modify, Append, and DeployIfNotExists to govern resource configurations. Policies are assigned to scopes ranging from a management group to an entire subscription or resource group, and the service continuously scans all existing resources for compliance, marking them compliant or non-compliant. This exactly matches the requirement to enforce organizational rules and assess compliance across resources at scale rather than manage identities or provide recommendations.

• ✗

  Azure Advisor

  Why it's wrong here

  Azure Advisor is a personalized advisory engine that analyzes your deployed Azure resources and provides best-practice recommendations in categories such as high availability, security, performance, and cost optimization. It never blocks or enforces changes; it only suggests actions you can take, so it does not assess compliance against your own organizational policies, and it cannot prevent a user from provisioning a resource that violates a rule. The question's 'enforce' and 'assess compliance' language points to Azure Policy, not Advisor.

Go deeper

Related to this question