AZ-900 Describe Azure management and governance Practice Question
A company's security policy requires that all Azure Storage accounts must enforce a minimum TLS version of 1.2. The governance team needs to continuously audit all existing storage accounts for compliance with this requirement, and also ensure that any new storage account that does not meet the TLS version requirement is automatically flagged as non-compliant in the Azure portal compliance dashboard. The team does not want to block the creation of non-compliant resources; they only need to report them. Which Azure feature should they use?
⚠ Common exam trap
Watch out — candidates often confuse Azure Policy's audit effect with Azure Blueprints' deployment capabilities, assuming Blueprints can enforce ongoing compliance, when in fact Blueprints only sets up initial resources and policies, not continuous auditing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Policy
Azure Policy is the correct choice because it can continuously audit existing Azure resources and evaluate new resources against a defined policy rule—in this case, requiring a minimum TLS version of 1.2 on all storage accounts. It can be configured in audit-only mode, which flags non-compliant resources in the Azure portal compliance dashboard without blocking their creation, exactly matching the team's requirement to report rather than deny.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Policy
Why this is correct
Correct. Azure Policy can evaluate existing resources and monitor new ones for compliance with rules such as a minimum TLS version. The 'audit' effect creates a compliance record without blocking creation, making it ideal for this reporting requirement.
- ✗
Azure Role-Based Access Control (RBAC)
Why it's wrong here
Azure RBAC controls what identities can do (actions) via role assignments, but it has no awareness of resource configuration state. It answers 'who can' not 'is it compliant'. Even with full permissions, RBAC cannot evaluate storage account TLS settings; it only manages access to perform actions.
When this WOULD be correct
If the question asked about controlling which users or groups can create or modify storage accounts, or granting specific permissions to manage storage account settings, Azure RBAC would be the correct answer.
- ✗
Azure Blueprints
Why it's wrong here
Incorrect. Azure Blueprints helps deploy a consistent set of Azure resources and policies at subscription or management group scope. While a blueprint can include Azure Policy definitions, it is not designed for continuously auditing existing resources that were created outside the blueprint.
When this WOULD be correct
Azure Blueprints would be correct if the question asked for a way to package and deploy a set of compliant Azure resources (including policies, role assignments, and resource groups) as a single, versioned artifact that can be assigned to subscriptions or management groups to ensure consistent environments.
- ✗
Azure Locks
Why it's wrong here
Azure Locks (CanNotDelete/ReadOnly) are designed to protect resources from accidental deletion or modification, operating at the resource lifecycle level. They do not inspect or report on configuration properties like the minimum TLS version of a storage account. Thus, while a lock might prevent someone from changing TLS settings, it cannot audit or enforce compliance with the security policy.
When this WOULD be correct
Azure Locks would be correct in a scenario where the requirement is to prevent deletion or modification of critical storage accounts, such as locking a production storage account to avoid accidental changes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure PolicyCorrect answer▾
Why this is correct
Correct. Azure Policy can evaluate existing resources and monitor new ones for compliance with rules such as a minimum TLS version. The 'audit' effect creates a compliance record without blocking creation, making it ideal for this reporting requirement.
✗Azure Role-Based Access Control (RBAC)Wrong answer — click to see why▾
Why this is wrong here
Azure RBAC manages access permissions (who can do what), not compliance auditing or enforcement of resource configurations like TLS version. It cannot continuously audit or flag non-compliant storage accounts.
★ When this WOULD be the correct answer
If the question asked about controlling which users or groups can create or modify storage accounts, or granting specific permissions to manage storage account settings, Azure RBAC would be the correct answer.
Why candidates choose this
Candidates may confuse access control (RBAC) with compliance enforcement, thinking that restricting who can create resources ensures compliance, but RBAC does not audit or report on configuration drift.
✗Azure BlueprintsWrong answer — click to see why▾
Why this is wrong here
Azure Blueprints is used to orchestrate the deployment of resource templates and policies, but it does not continuously audit existing resources or flag non-compliant resources in the compliance dashboard. The requirement is for ongoing auditing and reporting, which is a core function of Azure Policy.
★ When this WOULD be the correct answer
Azure Blueprints would be correct if the question asked for a way to package and deploy a set of compliant Azure resources (including policies, role assignments, and resource groups) as a single, versioned artifact that can be assigned to subscriptions or management groups to ensure consistent environments.
Why candidates choose this
Candidates may confuse Blueprints with Policy because both are used for governance and compliance. Blueprints can include policy definitions, leading to the misconception that Blueprints alone can perform continuous auditing and compliance reporting.
✗Azure LocksWrong answer — click to see why▾
Why this is wrong here
Azure Locks prevent accidental deletion or modification of resources but do not audit or enforce configuration settings like TLS version. They cannot continuously monitor compliance or flag non-compliant resources in the compliance dashboard.
★ When this WOULD be the correct answer
Azure Locks would be correct in a scenario where the requirement is to prevent deletion or modification of critical storage accounts, such as locking a production storage account to avoid accidental changes.
Why candidates choose this
Candidates may think that locking a resource can enforce compliance by preventing changes, but locks only protect against deletion or modification, not against non-compliant configurations.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Dashboard
A dashboard is a visual display of key metrics and data points that helps IT professionals monitor, analyze, and manage systems or processes in real time.
Key term
Azure portal
The Azure portal is a web-based, unified console that lets you build, manage, and monitor everything from simple web apps to complex cloud deployments using a graphical user interface.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.