AZ-900 Describe Azure management and governance Practice Question
An organization needs to ensure all VMs in Azure use approved VM sizes only. Which Azure feature enforces this?
⚠ Common exam trap
It's easy for candidates to confuse Azure Policy (which enforces resource configuration rules) with Azure RBAC (which controls user permissions), leading candidates to incorrectly choose RBAC when the question asks about enforcing specific resource properties.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy with allowed VM SKU policy
Azure Policy with the 'Allowed virtual machine SKUs' built-in policy definition enforces which VM sizes can be deployed in a subscription or resource group. When assigned, this policy evaluates all VM creation or update requests and denies any that use a SKU not included in the allowed list, ensuring compliance with organizational standards.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure RBAC
Why it's wrong here
Azure RBAC controls identity-based access by granting principals (users, groups, or service principals) roles such as Contributor or Virtual Machine Contributor. These roles permit the action Microsoft.Compute/virtualMachines/write, but RBAC does not evaluate the properties of the VM being created, such as the SKU or size. Therefore, a user with contributor rights can choose any available VM size, and RBAC cannot deny a specific size—it only determines who can perform the action, not what configuration is acceptable.
- ✓
Azure Policy with allowed VM SKU policy
Why this is correct
The built-in Azure Policy definition 'Allowed virtual machine size SKUs' is designed to evaluate the sku.name property of the Microsoft.Compute/virtualMachines resource type. When assigned with the Deny effect at a management group, subscription, or resource group scope, the policy blocks any VM creation or update that uses a SKU not listed in the allowed array. This provides a hard enforcement mechanism at deployment time, ensuring that only pre-approved VM sizes are used, and it is precisely the correct service for restricting VM sizes by configuration, not by identity.
- ✗
Azure Resource Manager locks
Why it's wrong here
Azure Resource Manager locks are applied to a resource, resource group, or subscription to protect against accidental deletion or modification, with two levels: CanNotDelete and ReadOnly. These locks are scoped to the specific resource or container and do not inspect the properties of resources being created; they either block all changes (ReadOnly) or only deletions (CanNotDelete). Locks cannot conditionally allow or deny a VM based on its SKU, so they are unrelated to enforcing allowed VM sizes at creation time.
- ✗
Azure Cost Management budgets
Why it's wrong here
Azure Cost Management budgets are a monitoring and notification feature that tracks actual or forecasted spending against defined thresholds, typically expressed as a currency amount or percentage of a budget. When thresholds are met, alerts are sent but no hard block is placed on resource creation—an unapproved VM SKU can still be deployed, and the budget simply reflects the resulting cost. Budgets are reactive and advisory, not proactive governance controls, so they cannot prevent the creation of a VM with a disallowed size.
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.