AZ-900 Describe Azure management and governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Policy

  Why it's wrong here

  Azure Policy does not prevent deletion of a production resource group because policy rules evaluate resource configuration and properties during create, update, and compliance checks, not the actual delete operation. Even with a 'Deny' effect, a policy can block non-compliant resource creation or modification, but a delete action by a user with RBAC delete permission is not typically a policy target. Azure Policy is for governance and compliance, such as enforcing allowed locations or requiring tags, not for locking down critical resources from being removed.

  When this WOULD be correct

  An exam question where the company needs to ensure that all resources in a subscription are deployed only in specific regions (e.g., 'East US') to meet data residency requirements. Azure Policy would be the correct answer to enforce this rule.

• ✗

  Role-Based Access Control (RBAC)

  Why it's wrong here

  Role-Based Access Control (RBAC) is not sufficient to protect a production resource group from deletion because RBAC governs what actions a user is permitted to perform, not what they are forbidden from doing at a higher precedence level. A user with the Contributor role has the 'Microsoft.Resources/subscriptions/resourceGroups/delete' permission, allowing them to delete the resource group entirely. RBAC alone cannot block that deletion unless you remove the user's role assignment, which is a privilege management issue, not a resource protection mechanism.

  When this WOULD be correct

  A company wants to grant specific users read-only access to a storage account while allowing other users full access. RBAC would be correct to assign the Reader role to the first group and Contributor to the second.

• ✓

  Resource Locks

  Why this is correct

  Resource Locks are the correct protection mechanism for a production resource group. They are applied at the resource group or individual resource scope and override any RBAC role, even Owner or Contributor, by blocking delete or modification operations. A CanNotDelete lock prevents deletion, while a ReadOnly lock prevents both deletion and changes to resource properties, ensuring critical production assets are safeguarded against accidental or malicious actions.

• ✗

  Management Groups

  Why it's wrong here

  Management Groups are hierarchical containers that organize multiple Azure subscriptions for high-level governance, such as assigning RBAC roles, Azure Policy, and cost controls at the management group level. They do not provide any direct lock on resources or resource groups within those subscriptions; a resource lock must be set at the subscription, resource group, or resource scope. Management groups simply cascade policy and role assignments, but they cannot prevent a user with Contributor rights from deleting a production resource group.

  When this WOULD be correct

  A company needs to apply governance policies (like allowed regions or resource types) across multiple subscriptions. Management Groups would be the correct answer to organize subscriptions and apply policies at scale.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question