AZ-900 Describe Azure management and governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Assign Contributor role to only trusted users

  Why it's wrong here

  Assigning the Contributor role to only trusted users is not sufficient because the Contributor role allows users to create, modify, and delete Azure resources, though it cannot manage access to them. While narrowing the set of people with this role reduces the attack surface, any Contributor can still change configuration settings, delete resources, or deploy new resources that alter the environment. This approach depends on trust and constant vigilance; it does not technically prevent changes, so it fails the requirement of guaranteeing configurations remain unchanged.

• ✓

  Azure Blueprints with locked assignment mode

  Why this is correct

  Azure Blueprints with locked assignment mode is the correct answer because it bundles Azure Resource Manager templates, policies, and RBAC assignments into a blueprint, and the assignment lock is enforced through Azure RBAC deny assignments. These deny assignments prevent any principal—even an Owner—from deleting or modifying blueprint-managed resources, ensuring the desired configuration remains immutable. Thus, the defined resources cannot be changed, meeting the exact requirement of unchangeable configurations.

• ✗

  Azure Policy with audit effect

  Why it's wrong here

  Azure Policy with the audit effect only evaluates resources and writes compliance details to the activity log; it does not block or deny modification actions in real time. Because the audit effect is purely reactive, a user can still alter settings and cause configuration drift, after which the policy merely reports that a resource is non-compliant. To actively prevent changes, Azure Policy would need a 'deny' effect or a 'modify' effect, so audit-only does not satisfy the requirement that configurations cannot be changed.

• ✗

  Azure Resource Manager conditional access

  Why it's wrong here

  Azure Resource Manager conditional access is not a real or valid capability—conditional access is an Azure Active Directory (Azure AD) feature used to control sign-in and access to applications based on conditions like user location, group membership, or device compliance. It does not apply to resource management actions at the Azure Resource Manager (ARM) or resource-level API, and it certainly does not enforce specific resource configurations. Once a user is granted access, they can freely change resources, so this option provides no enforcement against configuration changes.

Go deeper

Related to this question