AZ-900 Describe Azure management and governance Practice Question
A company needs to ensure that all Azure resources in a subscription are created only in specific approved regions. Which Azure feature should they implement?
⚠ Common exam trap
Test-takers frequently confuse Azure Policy with Azure RBAC or Resource Locks, mistakenly thinking that access control or deletion protection can restrict resource locations, when in fact only Azure Policy provides the declarative enforcement rules for compliance like allowed regions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy with 'Allowed locations' policy
Azure Policy with the 'Allowed locations' policy definition is the correct choice because it enforces organizational compliance by restricting the Azure regions where resources can be deployed. This policy evaluates all resource creation requests against a defined list of approved regions and denies any request that does not match, ensuring that all resources in the subscription are created only in the specified approved locations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Resource Locks
Why it's wrong here
Resource Locks operate at the resource or resource group level and are applied to prevent accidental changes or deletion, either by setting CanNotDelete or ReadOnly. They do not govern where new resources are created; they only protect existing resources from being altered or removed. Since the requirement is to restrict deployment to specific regions, locks are irrelevant because they don't influence the location of future deployments.
- ✗
Azure RBAC
Why it's wrong here
Azure RBAC manages identity-based access by assigning roles to principals, granting permissions over resources. It determines whether a user can, for example, create a VM or modify a network, but it does not evaluate or constrain the location property of a resource within a deployment. RBAC can allow or deny actions, but not enforce that any created resource resides only in an approved geography; region allow-listing is an Azure Policy capability.
- ✓
Azure Policy with 'Allowed locations' policy
Why this is correct
Azure Policy provides built-in definition 'Allowed locations' that evaluates the location of a new resource during deployment and only permits resources where the location matches the allowed list. The policy can be assigned at a management group, subscription, or resource group scope, and it denies or prevents resource creation outside the defined regions. This directly satisfies the scenario's goal of restricting deployment to specific regions. It also applies to all resource types that have a location property, giving admin control over geographical compliance.
- ✗
Azure Blueprints
Why it's wrong here
Azure Blueprints are a packaging service that orchestrates the deployment of templates, policies, roles, and other resources into a subscription to create consistent environments. While a blueprint can include the 'Allowed locations' policy, the blueprint itself does not enforce the region restriction; it only assigns and deploys the policy. Relying on blueprints without also assigning the policy would not restrict deployment locations, so it is not the correct answer on its own—the enforcement is always delegated to Azure Policy.
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.