AZ-900 Describe Azure management and governance Practice Question
A company uses Azure Blueprints to enforce a standard landing zone for all development subscriptions. The blueprint includes a virtual network, subnets, and network security groups. After the blueprint is assigned to a subscription, a development team manually adds a new subnet to the virtual network. The company plans to update the blueprint to add a new network security group rule. When the updated blueprint is published and the assignment is updated, what will happen to the manually added subnet?
⚠ Common exam trap
Test-takers frequently confuse Azure Blueprints with Azure Policy, assuming blueprints enforce ongoing compliance and automatically revert manual changes, when in fact blueprints only deploy resources at assignment time and do not manage them afterward.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The manually added subnet will be preserved because blueprints do not manage resources after creation.
Azure Blueprints are designed to establish a desired configuration for a subscription, but they do not actively manage resources after creation. Once a resource is deployed, the blueprint does not enforce ongoing compliance or revert manual changes. Therefore, when the blueprint is updated and reassigned, only resources defined in the blueprint are affected; the manually added subnet remains untouched because it was not part of the blueprint definition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The manually added subnet will be removed because the blueprint definition now takes precedence.
Why it's wrong here
This is incorrect. Azure Blueprints use incremental deployment mode, which does not delete resources that exist but are not defined in the blueprint. The manually added subnet is not part of the blueprint definition, so it is not removed.
When this WOULD be correct
If the question specified that the blueprint uses a resource group lock (e.g., ReadOnly or CanNotDelete) on the virtual network, then updating the blueprint to remove the subnet would cause the update to fail because the lock prevents changes to existing resources.
- ✓
The manually added subnet will be preserved because blueprints do not manage resources after creation.
Why this is correct
This is correct. By default, Azure Blueprints do not actively manage resources after they are deployed. When the blueprint assignment is updated, only the resources defined in the blueprint are added or modified; manually added resources that are not in the blueprint remain unchanged.
- ✗
The manually added subnet will be overwritten by the updated blueprint definition.
Why it's wrong here
The statement is incorrect. Azure Blueprints perform incremental deployment when an assignment is updated, meaning only resources explicitly defined in the blueprint are added or modified. The updated blueprint contains the original subnets and a new network security group rule, but it does not reference the manually added subnet. Since that subnet is outside the blueprint's resource set, the deployment engine will not overwrite or alter it in any way. Overwriting would occur only if the blueprint template explicitly targeted the same subnet with different properties, which is not the case here.
- ✗
The blueprint update will fail because the subnet already exists.
Why it's wrong here
This is incorrect. The presence of an extra subnet that is not defined in the blueprint does not cause a failure. The blueprint update simply applies its template; existing resources that conflict may cause an error only if the template attempts to create a resource that already exists and the properties are different, but a manually added subnet is not being recreated by the blueprint.
When this WOULD be correct
If the question described a scenario where an Azure Policy with a deny effect is assigned to prevent subnet creation outside the blueprint, then attempting to add a subnet would fail due to policy enforcement, not blueprint update failure.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓The manually added subnet will be preserved because blueprints do not manage resources after creation.Correct answer▾
Why this is correct
This is correct. By default, Azure Blueprints do not actively manage resources after they are deployed. When the blueprint assignment is updated, only the resources defined in the blueprint are added or modified; manually added resources that are not in the blueprint remain unchanged.
✗The manually added subnet will be removed because the blueprint definition now takes precedence.Wrong answer — click to see why▾
Why this is wrong here
Azure Blueprints do not manage resources after creation; they only set up the initial environment. Manually added resources are not removed or overwritten by blueprint updates.
★ When this WOULD be the correct answer
If the question specified that the blueprint uses a resource group lock (e.g., ReadOnly or CanNotDelete) on the virtual network, then updating the blueprint to remove the subnet would cause the update to fail because the lock prevents changes to existing resources.
Why candidates choose this
Candidates may assume that blueprints enforce continuous compliance, similar to Azure Policy, and that any deviation from the blueprint definition would be automatically corrected.
✗The blueprint update will fail because the subnet already exists.Wrong answer — click to see why▾
Why this is wrong here
Azure Blueprints do not manage or modify resources after creation; they only enforce initial configuration. The manually added subnet exists independently and will not cause the blueprint update to fail.
★ When this WOULD be the correct answer
If the question described a scenario where an Azure Policy with a deny effect is assigned to prevent subnet creation outside the blueprint, then attempting to add a subnet would fail due to policy enforcement, not blueprint update failure.
Why candidates choose this
Candidates may confuse blueprints with Azure Policy or ARM templates that enforce ongoing compliance, leading them to think that a conflict with existing resources would cause the update to fail.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.