AZ-900 Describe Azure management and governance Practice Question
A company has multiple Azure subscriptions for different departments. They want to enforce consistent policies across all subscriptions regarding allowed virtual machine sizes and require compliance reporting. Which Azure feature should they use?
⚠ Common exam trap
Many exam-takers confuse Azure Policy (which enforces rules and compliance) with Azure Blueprints (which packages multiple resources and policies together for repeatable deployments), leading them to choose Blueprints when the question focuses on policy enforcement and reporting rather than environment setup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy
Azure Policy is the correct choice because it enables you to create, assign, and manage policies that enforce specific rules (such as allowed VM sizes) across multiple subscriptions. It provides built-in compliance reporting via the Compliance dashboard, showing which resources are non-compliant. Unlike Blueprints or ARM templates, Policy focuses solely on governance rules and does not deploy resources or define the environment's architecture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Blueprints
Why it's wrong here
Azure Blueprints enable a cloud architect to package ARM templates, Azure Policies, and RBAC assignments into a single environment definition that can be applied to multiple subscriptions. After the blueprint is assigned and resources are deployed, the blueprint service does not continuously re-evaluate existing resources or provide a compliance report for resource properties; ongoing enforcement and reporting remain the job of Azure Policy. Thus Blueprints support consistency at deployment time but do not replace Policy for continuous governance.
When this WOULD be correct
A company needs to deploy a standardized environment that includes a specific set of resources, policies, and role assignments across multiple subscriptions, and they want to version and track the deployment as a single package. In that scenario, Azure Blueprints would be the correct answer.
- ✗
Azure Resource Manager templates
Why it's wrong here
Azure Resource Manager (ARM) templates are JSON files that define infrastructure declaratively and deploy resources such as VMs or networks in a repeatable way. However, ARM templates only act at deployment time—they create or update resources, but they do not monitor, evaluate, or enforce rules on those resources after deployment. Without a policy engine attached, templates cannot provide ongoing compliance dashboards or block non-compliant changes made by other tooling or users.
When this WOULD be correct
A company needs to deploy a standardized set of Azure resources (e.g., VMs, networks) consistently across multiple environments. They would use ARM templates to define and repeat the deployment.
- ✓
Azure Policy
Why this is correct
Azure Policy is the correct choice because it can be assigned at management group or subscription scope to enforce resource rules—such as allowed VM SKUs or required tags—across all department subscriptions. Policy definitions use effects like Deny, Audit, or Append, and every existing or newly created resource is continuously evaluated for compliance. A built-in compliance dashboard reports which resources are compliant or non-compliant, giving the centralized governance and reporting the departments require.
- ✗
Role-Based Access Control (RBAC)
Why it's wrong here
Role-Based Access Control (RBAC) governs who can perform actions on Azure resources by assigning roles such as Contributor or Reader to users, groups, or service principals. It determines authorization—whether a user is allowed to create or modify a resource—but it does not evaluate whether the resource itself meets configuration standards like VM size limits or required tags. RBAC can help delegate department access, yet it cannot enforce the property-level rules and compliance dashboards that Azure Policy provides.
When this WOULD be correct
A company needs to grant specific users permission to manage virtual machines in a subscription while preventing them from deleting resources. RBAC would be the correct answer to assign the appropriate built-in role, such as Virtual Machine Contributor.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure PolicyCorrect answer▾
Why this is correct
Azure Policy is the correct choice because it can be assigned at management group or subscription scope to enforce resource rules—such as allowed VM SKUs or required tags—across all department subscriptions. Policy definitions use effects like Deny, Audit, or Append, and every existing or newly created resource is continuously evaluated for compliance. A built-in compliance dashboard reports which resources are compliant or non-compliant, giving the centralized governance and reporting the departments require.
✗Azure BlueprintsWrong answer — click to see why▾
Why this is wrong here
Azure Blueprints orchestrates deployment of resource groups, policies, role assignments, and ARM templates, but it does not itself enforce policies or provide compliance reporting. The question asks for enforcing consistent policies and compliance reporting, which is directly provided by Azure Policy.
★ When this WOULD be the correct answer
A company needs to deploy a standardized environment that includes a specific set of resources, policies, and role assignments across multiple subscriptions, and they want to version and track the deployment as a single package. In that scenario, Azure Blueprints would be the correct answer.
Why candidates choose this
Candidates may confuse Blueprints with Policy because both are used for governance and can include policy definitions, but Blueprints is a packaging and orchestration tool, not the enforcement engine itself.
✗Azure Resource Manager templatesWrong answer — click to see why▾
Why this is wrong here
Azure Resource Manager templates are used for deploying infrastructure as code, not for enforcing policies or compliance reporting across subscriptions.
★ When this WOULD be the correct answer
A company needs to deploy a standardized set of Azure resources (e.g., VMs, networks) consistently across multiple environments. They would use ARM templates to define and repeat the deployment.
Why candidates choose this
Candidates may confuse ARM templates with policy enforcement because both can enforce consistency, but ARM templates focus on resource deployment, not ongoing compliance rules.
✗Role-Based Access Control (RBAC)Wrong answer — click to see why▾
Why this is wrong here
RBAC controls who can perform actions on Azure resources, not what resources are allowed or compliance enforcement. The question asks for enforcing consistent policies on allowed VM sizes and compliance reporting, which is Azure Policy's function.
★ When this WOULD be the correct answer
A company needs to grant specific users permission to manage virtual machines in a subscription while preventing them from deleting resources. RBAC would be the correct answer to assign the appropriate built-in role, such as Virtual Machine Contributor.
Why candidates choose this
Candidates may confuse RBAC's access control with policy enforcement, thinking that restricting permissions can enforce allowed VM sizes, but RBAC does not enforce resource configuration or compliance rules.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
ARM
ARM stands for Azure Resource Manager, the management layer that enables you to create, update, and delete resources in your Azure account.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.