AZ-900 Describe Azure management and governance Practice Question
A company has multiple subscriptions. They want to apply a policy that denies creation of resources without a specific tag at the top-level management group. Later, they need to allow a specific subscription to create resources without that tag. What should they do?
⚠ Common exam trap
A common mix-up: candidates confuse 'exclusion' (which removes a scope from policy evaluation) with 'exemption' (which marks a resource as compliant despite non-compliance) or thinking a lower-level policy assignment can override a higher-level 'Deny' effect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an exclusion for that subscription in the policy assignment.
Azure Policy allows you to assign policies at the management group scope, which applies to all child subscriptions. When you need to exempt a specific subscription from a policy effect (like 'Deny'), you can configure an exclusion on the policy assignment at the management group level. This exclusion removes the policy evaluation for that subscription, allowing resources to be created without the required tag.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign a different policy at the subscription level that allows untagged resources.
Why it's wrong here
Assigning a different policy at the subscription level that 'allows' untagged resources will not override the deny policy from the management group because policy evaluation applies all policies that are in scope, and the deny effect still takes precedence. Azure Policy also does not have an 'allow' effect for tag existence; it can only audit or deny nonconforming resources. The only clean way to avoid the deny is to exclude the subscription from the original policy assignment.
When this WOULD be correct
This option would be correct if the question described a scenario where the top-level policy is an audit or append policy (not deny), and the subscription needs a different effect, such as allowing resources without the tag. In that case, a subscription-level policy with a different effect could override the inherited policy.
- ✓
Create an exclusion for that subscription in the policy assignment.
Why this is correct
Creating an exclusion on the policy assignment is the correct approach because Azure Policy allows you to specify child scopes (such as a single subscription) that should be exempt from the policy's evaluation, while the assignment still applies to all other subscriptions in the management group. Exclusions are defined directly on the assignment, so the policy definition remains unchanged and governance for the rest of the hierarchy stays intact. This is the intended mechanism for carving out a scope from an inherited policy without losing oversight.
- ✗
Modify the top-level policy to include an exemption.
Why it's wrong here
You cannot embed an exemption inside a policy definition itself; exemptions are separate Azure Policy resources that must be created and assigned to a scope. Even if you could modify the policy, it would change behavior for every subscription in the management group, not just the one you want to spare. The proper way to waive the policy for a specific subscription is to configure an exclusion on the assignment or create a subscription-level exemption, not to alter the shared policy definition.
When this WOULD be correct
A company has a policy that denies creation of resources without a specific tag, but they need to temporarily allow a specific resource group to create untagged resources for a limited time due to a migration project. They would use an exemption (e.g., 'waiver' or 'mitigated') on that resource group to bypass the policy enforcement.
- ✗
Remove the subscription from the management group.
Why it's wrong here
Removing the subscription from the management group would take it out of the policy assignment's scope entirely, which means all policies assigned at that management group would stop applying to it, not just the one denying untagged resources. This is a heavy-handed action that breaks the overall governance structure and could allow other compliance issues beyond tags. It also does not create an explicit allowance for untagged resources; it simply removes the deny, leaving the subscription without the intended guardrail.
When this WOULD be correct
If a subscription needs to be completely isolated from all management group policies and governance, such as for a sensitive or legacy workload that cannot comply with any top-level policies, then removing it from the management group would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create an exclusion for that subscription in the policy assignment.Correct answer▾
Why this is correct
Creating an exclusion on the policy assignment is the correct approach because Azure Policy allows you to specify child scopes (such as a single subscription) that should be exempt from the policy's evaluation, while the assignment still applies to all other subscriptions in the management group. Exclusions are defined directly on the assignment, so the policy definition remains unchanged and governance for the rest of the hierarchy stays intact. This is the intended mechanism for carving out a scope from an inherited policy without losing oversight.
✗Assign a different policy at the subscription level that allows untagged resources.Wrong answer — click to see why▾
Why this is wrong here
Assigning a different policy at the subscription level that allows untagged resources would conflict with the deny policy at the management group, as Azure Policy inheritance is cumulative and deny effects override allow effects. This approach does not override the top-level deny policy.
★ When this WOULD be the correct answer
This option would be correct if the question described a scenario where the top-level policy is an audit or append policy (not deny), and the subscription needs a different effect, such as allowing resources without the tag. In that case, a subscription-level policy with a different effect could override the inherited policy.
Why candidates choose this
Candidates may think that policies can be overridden by assigning a conflicting policy at a lower scope, misunderstanding that deny policies take precedence and cannot be overridden by allow policies. They may also confuse policy assignment with RBAC permissions.
✗Modify the top-level policy to include an exemption.Wrong answer — click to see why▾
Why this is wrong here
An exemption is used to reduce the effect of a policy for specific resources, but it does not allow creation of resources that violate the policy; it only waives enforcement or compliance. To allow a subscription to create untagged resources, an exclusion is needed to exclude that subscription from the policy assignment.
★ When this WOULD be the correct answer
A company has a policy that denies creation of resources without a specific tag, but they need to temporarily allow a specific resource group to create untagged resources for a limited time due to a migration project. They would use an exemption (e.g., 'waiver' or 'mitigated') on that resource group to bypass the policy enforcement.
Why candidates choose this
Candidates confuse 'exemption' with 'exclusion' because both terms imply an exception, but exemption is for individual resources or resource groups, not for entire subscriptions, and it does not allow policy-violating resource creation; it only exempts from compliance evaluation.
✗Remove the subscription from the management group.Wrong answer — click to see why▾
Why this is wrong here
Removing the subscription from the management group would break the hierarchical structure and could affect other policies or governance applied at the management group level. It does not selectively allow the subscription to bypass the tag requirement while keeping other policies intact.
★ When this WOULD be the correct answer
If a subscription needs to be completely isolated from all management group policies and governance, such as for a sensitive or legacy workload that cannot comply with any top-level policies, then removing it from the management group would be appropriate.
Why candidates choose this
Candidates may think that removing the subscription from the management group is a simple way to avoid the policy, without understanding that it also removes all other benefits and controls applied at that level.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.