AZ-900 Describe Azure architecture and services Practice Question
A company wants to ensure that all Azure resources they deploy are created in the Europe West region to comply with data sovereignty requirements. They want to block creation of resources in any other region. Which Azure service should they use?
⚠ Common exam trap
Many candidates confuse Azure Policy with Azure Blueprints, thinking Blueprints directly enforce restrictions, when in fact Blueprints package policies but the enforcement itself comes from Azure Policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy with allowed locations
Azure Policy with the 'allowed locations' built-in policy definition can enforce that all resources are deployed only in the Europe West region. When assigned to a subscription or resource group scope, this policy denies any resource creation outside the specified regions, directly meeting the data sovereignty requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Resource groups
Why it's wrong here
Resource groups serve as logical containers that group resources sharing a common lifecycle or management requirement. A resource group has an Azure region, but that region is merely the location where metadata about the resource group is stored, not a constraint on where its contained resources can be created. Individual resources within a resource group may reside in different geographies, and the resource group itself cannot reject an operation based on the resource's target location. Thus, resource groups provide organization and lifecycle cohesion but do not enforce region restrictions.
When this WOULD be correct
A company wants to organize resources by department and apply role-based access control (RBAC) at the resource group level. Resource groups would be the correct service to group resources for management and access control.
- ✗
Management groups
Why it's wrong here
Management groups are hierarchical containers that allow centralized access management and efficient assignment of policies and RBAC across multiple subscriptions. However, a management group does not, by itself, possess any inherent capability to restrict resource creation regions; it simply acts as an organizational boundary for governance controls. You can assign Azure Policy at the management group scope to enforce location restrictions, but the enforcement is entirely delegated to Azure Policy, not to the management group's own mechanics. Therefore, selecting management groups as an answer misidentifies the governance tool's role.
When this WOULD be correct
A company needs to apply consistent access control policies (e.g., RBAC) across multiple Azure subscriptions. Management groups would be the correct service to use for hierarchical management of subscriptions.
- ✓
Azure Policy with allowed locations
Why this is correct
Azure Policy is a governance mechanism that can enforce business rules on resource deployments. When assigned a built-in or custom policy definition such as 'Allowed Locations', the policy intercepts every create, update, or delete request at the Azure Resource Manager and denies any deployment specifying a region not on the allowed list. The 'deny' effect is hard enforcement, not an alert, so resources simply cannot be provisioned outside permitted geographies. This makes Azure Policy the direct, enforceable method for guaranteeing all resources are created in required locations, regardless of which subscription or resource group the deployment targets.
- ✗
Azure Blueprints
Why it's wrong here
Azure Blueprints is an orchestration service that packages Azure Policy definitions, RBAC assignments, ARM templates, and other artifacts into a single deployable definition. While you could include an 'Allowed Locations' policy within a blueprint, the blueprint merely assigns that policy to a subscription; it does not independently enforce location rules. If the policy artifact is missing or removed, the blueprint itself has no native capability to block resources outside permitted regions. Consequently, the policy inside the blueprint is what enforces the restriction, not the blueprint itself.
When this WOULD be correct
A company needs to deploy a standardized set of Azure resources (e.g., VMs, databases) with consistent configurations and policies across multiple subscriptions. They want to ensure compliance and repeatability. Azure Blueprints would be the correct answer because it packages policies, role assignments, and resource templates into a single deployable artifact.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Policy with allowed locationsCorrect answer▾
Why this is correct
Azure Policy is a governance mechanism that can enforce business rules on resource deployments. When assigned a built-in or custom policy definition such as 'Allowed Locations', the policy intercepts every create, update, or delete request at the Azure Resource Manager and denies any deployment specifying a region not on the allowed list. The 'deny' effect is hard enforcement, not an alert, so resources simply cannot be provisioned outside permitted geographies. This makes Azure Policy the direct, enforceable method for guaranteeing all resources are created in required locations, regardless of which subscription or resource group the deployment targets.
✗Resource groupsWrong answer — click to see why▾
Why this is wrong here
Resource groups are logical containers for resources, but they do not enforce regional restrictions. They can contain resources from multiple regions, so they cannot block creation outside Europe West.
★ When this WOULD be the correct answer
A company wants to organize resources by department and apply role-based access control (RBAC) at the resource group level. Resource groups would be the correct service to group resources for management and access control.
Why candidates choose this
Candidates may think resource groups can restrict regions because they are often used to group resources by location, but they lack policy enforcement capabilities.
✗Management groupsWrong answer — click to see why▾
Why this is wrong here
Management groups are used for organizing and managing access, policy, and compliance across multiple subscriptions, not for enforcing region restrictions on resource creation.
★ When this WOULD be the correct answer
A company needs to apply consistent access control policies (e.g., RBAC) across multiple Azure subscriptions. Management groups would be the correct service to use for hierarchical management of subscriptions.
Why candidates choose this
Candidates may confuse management groups with policy enforcement because both operate at a high level, but management groups do not directly block resource creation in specific regions.
✗Azure BlueprintsWrong answer — click to see why▾
Why this is wrong here
Azure Blueprints is used to orchestrate the deployment of resource templates and policies, but it does not itself enforce region restrictions. The actual enforcement of allowed locations is done by Azure Policy, not Blueprints.
★ When this WOULD be the correct answer
A company needs to deploy a standardized set of Azure resources (e.g., VMs, databases) with consistent configurations and policies across multiple subscriptions. They want to ensure compliance and repeatability. Azure Blueprints would be the correct answer because it packages policies, role assignments, and resource templates into a single deployable artifact.
Why candidates choose this
Candidates may think Blueprints can enforce region restrictions because it can include policy definitions, but they overlook that the policy itself (not Blueprints) is the service that enforces the rule. Blueprints just bundles the policy for deployment.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.