AZ-900 Describe Azure management and governance Practice Question
An organization needs to ensure that all Azure resources comply with internal standards and automatically remediate non-compliant resources. Which Azure service provides this capability?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Blueprints (which can include policies but does not perform remediation) with Azure Policy's remediation tasks, or they think Azure Security Center handles all compliance, when in fact it focuses on security-specific compliance (e.g., CIS benchmarks) rather than general internal standards.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy with remediation tasks
Azure Policy with remediation tasks is the correct service because it allows organizations to define compliance rules for Azure resources and automatically remediate non-compliant resources using managed identities and policy effects like 'deployIfNotExists' or 'modify'. This ensures ongoing compliance with internal standards without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Blueprints
Why it's wrong here
Azure Blueprints orchestrates the deployment of governance artifacts—such as Azure Policy assignments, RBAC role assignments, and resource groups—as a single package at subscription creation time. However, Blueprints only performs the initial provisioning; it does not continuously evaluate resources for compliance after deployment, nor does it have any built-in mechanism to remediate non-compliant resources over time. Because the question specifically asks about automatically remediating non-compliant resources, Blueprints is incorrect—it is a declarative deployment tool, not a continuous enforcement or remediation engine.
- ✓
Azure Policy with remediation tasks
Why this is correct
Azure Policy is the correct answer because it evaluates Azure resources against defined rules and, when configured with the DeployIfNotExists or Modify policy effects, can automatically remediate non-compliant resources using remediation tasks. These remediation tasks are executed by Azure Policy on a scheduled basis or after a policy assignment is updated, and they deploy the necessary resource changes (e.g., enabling encryption, adding a diagnostic setting) so that resources converge to a compliant state. This goes beyond simple alerting or recommendations—Policy actively enforces and corrects misconfigurations, making it the compliance enforcement and remediation engine in Azure.
- ✗
Azure RBAC
Why it's wrong here
Azure RBAC (Role-Based Access Control) manages who can perform actions on Azure resources by assigning roles at certain scopes, such as owner, contributor, or custom roles. RBAC is purely an authorization control—it does not inspect the configuration of resources (e.g., whether a storage account allows public access) and has no capability to enforce or remediate compliance settings. The question concerns automatic remediation of non-compliant resource configuration, which is a policy-driven activity, not an access-control activity. Therefore, RBAC is incorrect because it addresses identity and permissions, not resource compliance.
- ✗
Azure Security Center
Why it's wrong here
Azure Security Center (now Microsoft Defender for Cloud) provides security posture management by assessing resources against a set of built-in security benchmarks and generating recommendations—for example, enabling encryption or updating network security groups. While Security Center identifies compliance vulnerabilities and may suggest corrective actions, it does not directly execute remediation of non-compliant resources; instead, for many recommendations, it relies on the underlying Azure Policy definitions and remediation tasks to actually deploy the required fix. Thus, Security Center is a monitoring and alerting service, not the primary engine for automatic remediation, making it an incorrect answer to this question.
Go deeper
Related to this question
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.