AZ-900 Describe Azure management and governance Practice Question
Which Azure feature enables you to create policy definitions, RBAC role assignments, and ARM templates as a single package and track their deployment relationship?
⚠ Common exam trap
It's easy for candidates to confuse Azure Blueprints with ARM Templates or Azure Policy Initiatives, not realizing that Blueprints uniquely combine multiple artifact types into a single, versioned, trackable package with deployment relationship tracking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Blueprints
Azure Blueprints is the correct answer because it is specifically designed to package together policy definitions, RBAC role assignments, ARM templates, and other artifacts into a single, versioned, and trackable deployment unit. Unlike individual ARM templates or policy initiatives, Blueprints maintain a relationship between the deployed resources and the blueprint definition, enabling you to audit and track which blueprint version was used for each deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ARM Templates
Why it's wrong here
ARM Templates are declarative JSON files used to define and deploy Azure infrastructure, but they are fundamentally a one-time deployment artifact. While you can embed RBAC role assignments and Policy definitions within a template, the template itself does not provide a native versioning and assignment-tracking mechanism that records the relationship between the deployed infrastructure and its associated governance. A blueprint packages these artifacts together and tracks which version of the package was assigned, something an ARM template alone cannot do.
- ✗
Azure Policy Initiative
Why it's wrong here
An Azure Policy Initiative (policySetDefinition) is a collection of policy definitions intended to aggregate compliance rules for a common goal. It can only contain policy-related artifacts; it does not include ARM templates or RBAC role assignments, which are separate artifact types. Thus, while an initiative can be one artifact within a blueprint, a standalone initiative lacks the broader environment-defining capabilities and the versioned, auditable assignment tracking that make blueprints suitable for packaging an entire governance-aware environment.
- ✓
Azure Blueprints
Why this is correct
Azure Blueprints is a native Azure governance service that packages ARM templates, RBAC role assignments, and Policy assignments (including initiatives) into a single, versioned definition. When you publish and assign a blueprint, Azure creates an auditable relationship that tracks exactly which blueprint version was deployed to which subscription, along with the resulting resources, roles, and policies. This built-in assignment tracking and versioning distinguish Blueprints from standalone tools and make it the correct choice when you need a repeatable, governance-bundled environment with a clear audit trail.
- ✗
Azure DevOps Pipelines
Why it's wrong here
Azure DevOps Pipelines is a CI/CD service that orchestrates build, test, and deployment steps, often including ARM template deployments or policy application via scripts. However, a pipeline is an automation engine, not a native governance artifact—it does not offer a versioned package that bundles RBAC and Policy together with auditable assignment relationships. Blueprints provide that higher-level package, allowing you to assign a blueprint to a subscription and track the exact definition version, whereas pipelines merely execute actions without maintaining the same governance-specific tracking.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
ARM
ARM stands for Azure Resource Manager, the management layer that enables you to create, update, and delete resources in your Azure account.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.