AZ-900 Describe Azure management and governance Practice Question
Which Azure feature allows organizations to apply the same governance at a hierarchy of subscriptions and resource groups?
⚠ Common exam trap
Many exam-takers confuse Azure Resource Locks inheritance (which does not exist) with the hierarchical inheritance of Azure Policy and RBAC, or mistakenly think Azure Blueprints auto-assignment is the mechanism for inheritance rather than a deployment tool.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy and RBAC inheritance through the management hierarchy
Azure Policy and RBAC (Role-Based Access Control) inheritance through the management hierarchy allows organizations to apply consistent governance across multiple subscriptions and resource groups. When a policy or RBAC assignment is applied at a management group, it is inherited by all child subscriptions and resource groups, ensuring uniform compliance and access control without manual reconfiguration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Resource Locks inheritance
Why it's wrong here
Resource Locks operate at the scope of an individual resource or resource group, preventing deletion or modification, and they do propagate to child resources within that resource group. However, they do not inherit through the management group hierarchy: a lock placed on a management group has no effect on nested subscriptions or resources. The question asks about inheritance through management groups, which is a feature unique to Policy and RBAC, not to locks.
- ✓
Azure Policy and RBAC inheritance through the management hierarchy
Why this is correct
Azure Policy and RBAC assignments are inherited down the management group hierarchy: a policy or role assignment placed on a management group automatically applies to all child subscriptions and resource groups, and to every resource within those scopes. This ensures that governance rules and access permissions are consistently enforced across an entire enterprise hierarchy, eliminating the need to configure each scope individually. Inherited assignments can be overridden or complemented by assignments at more specific scopes.
- ✗
Azure Blueprints auto-assignment
Why it's wrong here
Azure Blueprints are a packaging mechanism that bundles templates, policies, and role assignments, but a blueprint must be explicitly assigned to a subscription to become effective. Even when assigned to a management group, the assignment applies only to the specific subscriptions included in that assignment, not automatically to every subscription under the management group. Thus, blueprints do not exhibit the same automatic inheritance as Policy or RBAC.
- ✗
Azure Cost Management budget inheritance
Why it's wrong here
Cost Management budgets and alerts are defined per subscription or resource group, and they do not cascade down the management group hierarchy. Setting a budget on a management group does not apply that budget to each child subscription, nor does it aggregate child costs automatically; each budget must be individually created at the desired scope. This lack of inheritance means budgets are not a governance control that propagates hierarchically.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Management group
A Management group is a container in Microsoft Azure that helps you organize and manage access, policies, and compliance across multiple Azure subscriptions.
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.