AZ-900 Describe Azure management and governance Practice Question
A company manages hundreds of Azure SQL databases across multiple subscriptions. The compliance team requires that every Azure SQL database has diagnostic settings enabled to send logs to a central Log Analytics workspace. The team wants a solution that automatically configures diagnostic settings for any new Azure SQL database when it is created, without requiring manual intervention or additional scripting. Which Azure governance feature should the team use?
⚠ Common exam trap
It's easy for candidates to confuse Azure Policy's DeployIfNotExists effect with Azure Blueprints or Azure Monitor data collection rules, mistakenly thinking those can automatically configure resources at creation time, but only Azure Policy provides native, automatic enforcement and remediation without additional scripting or manual triggers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy with the DeployIfNotExists effect
Azure Policy with the DeployIfNotExists effect is the correct choice because it automatically evaluates new Azure SQL databases against a policy rule and, if diagnostic settings are missing, triggers a remediation task to deploy them to the specified Log Analytics workspace. This effect operates at resource creation time without manual intervention or scripting, fulfilling the compliance team's requirement for automatic, consistent configuration across all subscriptions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy with the DeployIfNotExists effect
Why this is correct
Azure Policy's DeployIfNotExists effect is evaluated during resource creation and update operations, and if the SQL database lacks diagnostic settings, the policy engine automatically deploys the linked ARM template to configure them. This happens without human intervention because the policy is assigned at a management group or subscription scope and the effect is an immutable part of the policy definition. It also provides a compliance dashboard, remediation tasks, and can be extended to existing databases.
- ✗
Azure Blueprints with a resource group artifact
Why it's wrong here
While Blueprints can define policy assignments, the automatic remediation at resource creation time is a feature of the policy effect (DeployIfNotExists) itself, not the Blueprint artifact. Blueprints do not directly deploy configurations to new resources independently.
When this WOULD be correct
An organization needs to deploy a consistent environment that includes a pre-configured resource group with a Log Analytics workspace and a sample Azure SQL database with diagnostic settings already enabled. The team wants to replicate this environment across multiple subscriptions.
- ✗
Azure Resource Manager templates deployed via Azure DevOps
Why it's wrong here
ARM templates deployed via Azure DevOps are an imperative deployment mechanism: a pipeline must be explicitly triggered (by a commit, a schedule, or manual approval) before any template runs. When a developer creates an Azure SQL database directly in the portal, via the CLI, or through any non-template path, no template is automatically executed. Even a well-designed CI/CD pipeline cannot intercept arbitrary resource creation events, so this approach cannot guarantee diagnostic settings for every new database without additional manual or event-driven wiring.
When this WOULD be correct
A company needs to deploy a standardized environment (e.g., a resource group with a specific set of Azure SQL databases, networking, and monitoring) repeatedly across subscriptions, and they want to version-control the infrastructure as code using CI/CD pipelines.
- ✗
Azure Monitor with a data collection rule
Why it's wrong here
Azure Monitor data collection rules (DCRs) are designed specifically for the Azure Monitor Agent (AMA) to govern telemetry collection on virtual machines, not for Azure SQL database resource-level diagnostic settings. SQL database diagnostic logs are configured using a dedicated 'Diagnostic settings' blade or an ARM template, which routes logs to Log Analytics, Event Hubs, or Storage. A DCR cannot target a PaaS resource like SQL DB, and it has no built-in enforcement mechanism to apply settings automatically at creation, so this option fails the requirement.
When this WOULD be correct
An exam question might ask: 'A company wants to collect custom performance counters from all Azure VMs in a subscription and send them to a Log Analytics workspace. Which feature should be used to define the collection schema and apply it to multiple VMs?' In that case, Azure Monitor data collection rules would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Policy with the DeployIfNotExists effectCorrect answer▾
Why this is correct
Azure Policy's DeployIfNotExists effect is evaluated during resource creation and update operations, and if the SQL database lacks diagnostic settings, the policy engine automatically deploys the linked ARM template to configure them. This happens without human intervention because the policy is assigned at a management group or subscription scope and the effect is an immutable part of the policy definition. It also provides a compliance dashboard, remediation tasks, and can be extended to existing databases.
✗Azure Blueprints with a resource group artifactWrong answer — click to see why▾
Why this is wrong here
Azure Blueprints with a resource group artifact can deploy resources, but it cannot automatically enforce diagnostic settings on newly created Azure SQL databases across subscriptions without manual re-assignment or triggering.
★ When this WOULD be the correct answer
An organization needs to deploy a consistent environment that includes a pre-configured resource group with a Log Analytics workspace and a sample Azure SQL database with diagnostic settings already enabled. The team wants to replicate this environment across multiple subscriptions.
Why candidates choose this
Candidates may think Blueprints can automatically apply configurations to new resources, but Blueprints are for deploying initial environments, not for ongoing enforcement on new resources created after assignment.
✗Azure Resource Manager templates deployed via Azure DevOpsWrong answer — click to see why▾
Why this is wrong here
ARM templates deployed via Azure DevOps require manual or pipeline-triggered deployment for each new database, not automatic enforcement at creation time without scripting.
★ When this WOULD be the correct answer
A company needs to deploy a standardized environment (e.g., a resource group with a specific set of Azure SQL databases, networking, and monitoring) repeatedly across subscriptions, and they want to version-control the infrastructure as code using CI/CD pipelines.
Why candidates choose this
Candidates may think ARM templates are the only way to automate resource configuration, overlooking Azure Policy's native ability to enforce settings automatically at resource creation.
✗Azure Monitor with a data collection ruleWrong answer — click to see why▾
Why this is wrong here
Data collection rules (DCRs) in Azure Monitor define how to collect and send telemetry data from monitored resources, but they do not automatically configure diagnostic settings for new Azure SQL databases. DCRs are used for data ingestion rules in Azure Monitor, not for enforcing resource-level diagnostic settings at creation time.
★ When this WOULD be the correct answer
An exam question might ask: 'A company wants to collect custom performance counters from all Azure VMs in a subscription and send them to a Log Analytics workspace. Which feature should be used to define the collection schema and apply it to multiple VMs?' In that case, Azure Monitor data collection rules would be the correct answer.
Why candidates choose this
Candidates may confuse data collection rules with diagnostic settings because both involve sending logs to a Log Analytics workspace, leading them to think DCRs can automatically configure diagnostic settings for new resources.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Log Analytics
Log Analytics is a cloud-based service that collects, analyzes, and visualizes machine-generated log data from various sources to help IT teams monitor systems and troubleshoot issues.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.