AZ-900 Describe Azure management and governance Practice Question
A multinational company has a strict data residency requirement: all Azure virtual machines must be deployed only in the East US or West Europe Azure regions. The IT governance team wants to enforce this rule automatically so that any attempt to create a virtual machine in any other region is blocked immediately at the time of deployment. Users must receive a clear error message if they try to create a VM in a disallowed region. Which Azure feature should the governance team configure to meet this requirement?
⚠ Common exam trap
Many exam-takers confuse Azure Policy (which enforces rules on resource properties) with Azure RBAC (which controls user permissions), leading them to incorrectly choose RBAC when the requirement is about restricting specific resource configurations rather than user actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an Azure Policy with the Deny effect assigned to the subscription scope.
Azure Policy with the Deny effect is the correct choice because it enforces organizational rules by evaluating resource properties during deployment and blocking any non-compliant request. In this scenario, a policy can be defined to deny virtual machine creation in any region other than East US or West Europe, and the Deny effect ensures the deployment fails with a clear error message, meeting the real-time enforcement requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a resource lock on the subscription to prevent all resource creation.
Why it's wrong here
Resource locks (CanNotDelete or ReadOnly) are designed to protect resources from accidental deletion or modification, not to block the creation of new resources. A resource lock on the subscription would prevent deletion of the subscription itself, but it does not block deployments of virtual machines in disallowed regions.
When this WOULD be correct
If the requirement were to prevent accidental deletion of a critical resource (e.g., a production database) by locking it at the resource group level, a resource lock (e.g., CanNotDelete) would be correct.
- ✓
Configure an Azure Policy with the Deny effect assigned to the subscription scope.
Why this is correct
Azure Policy with the Deny effect evaluates resource creation or update requests and denies them if they do not comply with the policy rules (e.g., VM location). The denial includes a clear error message explaining which policy prevented the action. This is the standard method to enforce location restrictions proactively.
- ✗
Assign an Azure RBAC role that denies create permissions for VMs in disallowed regions.
Why it's wrong here
Azure RBAC roles manage permissions based on actions (e.g., Microsoft.Compute/virtualMachines/write) but cannot easily restrict by resource property such as region. Even with a custom role, you would need to specify each disallowed region in NotActions, which is cumbersome and error-prone. Azure Policy is the correct service for rules based on resource properties.
When this WOULD be correct
A question where the requirement is to prevent a specific user or group from creating any VMs (regardless of region) by assigning a custom role that denies Microsoft.Compute/virtualMachines/write at the subscription scope.
- ✗
Set up a budget alert in Cost Management to notify when a VM is created in a disallowed region.
Why it's wrong here
Setting up a budget alert in Azure Cost Management is fundamentally a financial monitoring mechanism, not a governance or enforcement tool. It triggers notifications when usage or spending exceeds configured thresholds, but it cannot inspect the region of a newly created VM, nor can it intercept or block the deployment request. Because budget data is aggregated and refreshed on a delay, the alert would only notify you after the fact—if at all—and it would not provide any information about which specific resource or why it is non-compliant. This makes it a purely reactive, post-deployment observation method that cannot satisfy a strict data residency requirement.
When this WOULD be correct
A company wants to receive an email notification when spending in a specific region exceeds a threshold, but does not need to block deployments.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Configure an Azure Policy with the Deny effect assigned to the subscription scope.Correct answer▾
Why this is correct
Azure Policy with the Deny effect evaluates resource creation or update requests and denies them if they do not comply with the policy rules (e.g., VM location). The denial includes a clear error message explaining which policy prevented the action. This is the standard method to enforce location restrictions proactively.
✗Create a resource lock on the subscription to prevent all resource creation.Wrong answer — click to see why▾
Why this is wrong here
A resource lock prevents deletion or modification of resources but does not block creation of new resources in disallowed regions; it cannot enforce region restrictions.
★ When this WOULD be the correct answer
If the requirement were to prevent accidental deletion of a critical resource (e.g., a production database) by locking it at the resource group level, a resource lock (e.g., CanNotDelete) would be correct.
Why candidates choose this
Candidates may confuse resource locks with policy enforcement, thinking locks can block all operations including creation, but locks only protect existing resources from deletion or modification.
✗Assign an Azure RBAC role that denies create permissions for VMs in disallowed regions.Wrong answer — click to see why▾
Why this is wrong here
Azure RBAC roles cannot deny creation based on region; they control access at a broader scope (e.g., subscription or resource group) and cannot enforce region-specific constraints. The Deny effect in Azure Policy is required for such granular, rule-based enforcement.
★ When this WOULD be the correct answer
A question where the requirement is to prevent a specific user or group from creating any VMs (regardless of region) by assigning a custom role that denies Microsoft.Compute/virtualMachines/write at the subscription scope.
Why candidates choose this
Candidates may confuse RBAC (identity-based access control) with Azure Policy (resource governance), thinking that denying permissions for specific regions is possible via RBAC, but RBAC lacks region-based conditions.
✗Set up a budget alert in Cost Management to notify when a VM is created in a disallowed region.Wrong answer — click to see why▾
Why this is wrong here
Budget alerts only notify after a VM is created, they do not block deployment or enforce data residency in real-time.
★ When this WOULD be the correct answer
A company wants to receive an email notification when spending in a specific region exceeds a threshold, but does not need to block deployments.
Why candidates choose this
Candidates may think budget alerts can prevent deployments because they associate alerts with cost control, but alerts are reactive, not preventive.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.