AZ-900 Describe Azure management and governance Practice Question
Which Azure concept represents the hierarchical organization of management groups, subscriptions, resource groups, and resources?
⚠ Common exam trap
Candidates often confuse the Azure Resource Hierarchy with geographic or tenant concepts, but the hierarchy is specifically about management groups, subscriptions, resource groups, and resources—not physical locations or identity boundaries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Resource Hierarchy
The Azure Resource Hierarchy is the correct answer because it defines the four-level structure—management groups, subscriptions, resource groups, and resources—that Azure uses to organize and manage access, policy, and compliance. This hierarchy allows you to apply Azure Policy and role-based access control (RBAC) at any level, with inheritance flowing downward. It is the foundational model for governance in Azure, distinct from geographic or deployment concepts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Geographic hierarchy
Why it's wrong here
Azure Geographies are high-level boundaries (e.g., Americas, Europe) that group regions for data residency and compliance purposes; a Region is a set of datacenters within a geography. This geographic structure determines where data can be stored and served, but it has nothing to do with how management, billing, or access control is delegated. Unlike the management hierarchy, geographies and regions are not containers that own subscriptions or resources in a governance sense, so they are the wrong answer here.
- ✓
Azure Resource Hierarchy
Why this is correct
This is the actual governance structure in Azure: Management Groups sit at the top to organize subscriptions, each subscription contains Resource Groups, and each Resource Group holds individual Resources. Policies and RBAC assignments applied at a higher level are inherited down the chain, so you can enforce compliance or access rules across many subscriptions at once. It is a purely logical, organizational hierarchy used for billing, policy, and access management, not a physical or deployment topology.
- ✗
Azure Deployment slots hierarchy
Why it's wrong here
Deployment slots are an Azure App Service feature used for staged releases, where each slot is a separate endpoint (e.g., staging, production) sharing the same underlying app service plan and resources. They support swap operations for blue-green deployment, but they do not define any organizational governance, policy inheritance, or access-scope boundaries. Since slots are scoped to a single web app rather than representing cloud-wide management containers, they cannot be the correct answer for Azure's resource management hierarchy.
- ✗
Azure Tenant and Region structure
Why it's wrong here
While an Azure tenant (Azure AD) is indeed the root identity and billing boundary that contains subscriptions and management groups, the term 'Tenant and Region structure' confuses identity/geography with the management hierarchy. Regions refer to the physical data center locations where resources are hosted, and they have their own concepts like availability zones and paired regions, none of which participate in RBAC or policy inheritance. The full management hierarchy extends below the tenant to include resource groups and resources, so naming only tenant and region omits the bottom half of the governance chain.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.