AZ-900 Describe Azure management and governance Practice Question
A company needs to enforce compliance by deploying a standard set of Azure resources, policies, and RBAC assignments for each new development subscription. They want to define this environment as a repeatable package. Which Azure service should they use?
⚠ Common exam trap
It's easy for candidates to confuse Azure Policy (which only enforces rules) with Azure Blueprints (which orchestrates policies, RBAC, and resources together), or they think ARM templates alone can handle governance, ignoring the need for policy and role assignments as part of a repeatable package.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Blueprints
Azure Blueprints is the correct service because it enables the orchestrated deployment of a repeatable, governed environment that includes resource templates, policies, and RBAC assignments as a single, versioned package. Unlike individual services, Blueprints coordinates these components together, ensuring compliance from the moment a new subscription is created.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Blueprints
Why this is correct
Azure Blueprints enables you to deploy a standard set of cloud artifacts by packaging ARM templates, policy assignments, role assignments, and resource groups into a single, versioned definition. When assigned to a subscription, Blueprints automatically creates the resources, applies governance rules, and aligns the environment to compliance mandates like ISO 27001. It is the only service purpose-built to orchestrate this entire stack as one coherent unit.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is a compliance engine that evaluates resources against rules and can enforce standards such as allowed locations or deny insecure configurations, but it does not deploy resources or assign roles as part of a coordinated package. While policy definitions can be included in Blueprints, Policy itself only provides gatekeeping and mitigation on resource creation, not the declarative delivery of a full environment, so it cannot be the mechanism that deploys a standard set in this scenario.
When this WOULD be correct
A company needs to ensure that all resources in a subscription comply with specific tagging requirements or allowed locations. Azure Policy would be correct when the goal is to enforce or audit individual compliance rules across existing and new resources, not to deploy a full environment.
- ✗
Azure Resource Manager Templates
Why it's wrong here
Azure Resource Manager (ARM) templates are Infrastructure-as-Code files that declaratively deploy a set of resources, but each template stands alone and doesn't inherently bundle policy definitions and role assignments as managed artifacts with versioning and assignment control. Even though you can embed Microsoft.Authorization resources into an ARM template, the template lacks Blueprints' lifecycle management of the entire package, its role across management groups, and its compliance dashboard. Therefore, ARM templates are a building block for Blueprints rather than the full orchestration layer.
When this WOULD be correct
An exam question asking for a service to deploy a repeatable set of Azure resources (e.g., VMs, storage) using declarative JSON templates, without needing to enforce policies or RBAC, would have ARM templates as the correct answer.
- ✗
Management Groups
Why it's wrong here
Management Groups are subscription containers that provide hierarchy and centralized governance control, allowing you to apply policies and RBAC at a high level and enforce compliance across multiple subscriptions. However, they are purely organizational constructs — they do not actively deploy a predefined set of resources or physical artifacts, and they don't create the environment. In this scenario, management groups serve as the structure that could receive a Blueprint, not as the deployment mechanism.
When this WOULD be correct
A company wants to centrally manage governance, compliance, and access control across multiple subscriptions by grouping them into a hierarchy. Which service should they use to apply policies and RBAC at scale?
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure BlueprintsCorrect answer▾
Why this is correct
Azure Blueprints enables you to deploy a standard set of cloud artifacts by packaging ARM templates, policy assignments, role assignments, and resource groups into a single, versioned definition. When assigned to a subscription, Blueprints automatically creates the resources, applies governance rules, and aligns the environment to compliance mandates like ISO 27001. It is the only service purpose-built to orchestrate this entire stack as one coherent unit.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy enforces individual rules and effects on existing resources, but does not package multiple resources, policies, and RBAC assignments into a repeatable environment. The question requires deploying a standard set of resources, policies, and RBAC together, which is the purpose of Azure Blueprints.
★ When this WOULD be the correct answer
A company needs to ensure that all resources in a subscription comply with specific tagging requirements or allowed locations. Azure Policy would be correct when the goal is to enforce or audit individual compliance rules across existing and new resources, not to deploy a full environment.
Why candidates choose this
Candidates often confuse Azure Policy with Azure Blueprints because both involve compliance and governance. They may think Policy can deploy resources, but Policy only enforces rules, not deploy entire environments.
✗Azure Resource Manager TemplatesWrong answer — click to see why▾
Why this is wrong here
Azure Resource Manager (ARM) templates deploy infrastructure as code but do not enforce compliance policies, RBAC assignments, or provide versioning and update management for the entire environment package like Azure Blueprints do.
★ When this WOULD be the correct answer
An exam question asking for a service to deploy a repeatable set of Azure resources (e.g., VMs, storage) using declarative JSON templates, without needing to enforce policies or RBAC, would have ARM templates as the correct answer.
Why candidates choose this
Candidates know ARM templates can deploy resources repeatedly, so they mistakenly think they can also enforce policies and RBAC, not realizing Azure Blueprints is the service designed to orchestrate those together.
✗Management GroupsWrong answer — click to see why▾
Why this is wrong here
Management Groups provide hierarchical organization and policy inheritance across subscriptions, but they do not package a repeatable set of resources, policies, and RBAC assignments into a deployable artifact. Azure Blueprints is designed for that purpose.
★ When this WOULD be the correct answer
A company wants to centrally manage governance, compliance, and access control across multiple subscriptions by grouping them into a hierarchy. Which service should they use to apply policies and RBAC at scale?
Why candidates choose this
Candidates may confuse Management Groups with Blueprints because both are used for governance across subscriptions, but Management Groups lack the ability to define and deploy a repeatable environment package.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Environment
An environment is a dedicated set of computing resources, configurations, and services used to develop, test, or host software applications in a controlled and repeatable way.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.