Describe Azure management and governance →mediumMultiple ChoiceObjective-mapped

AZ-900 Describe Azure management and governance Practice Question

A company has an Azure Policy assigned to all subscriptions that denies creation of any resource without a 'CostCenter' tag. During an emergency, a team needs to create a resource without the tag. They want a temporary exception without changing the policy. What should they create?

⚠ Common exam trap

Test-takers frequently confuse Policy exemptions with Policy initiatives or Role assignments, mistakenly thinking a new policy set or a role change can bypass an existing deny effect, when only an exemption directly alters policy evaluation for a specific scope.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Policy exemption

A Policy exemption allows you to create an exception for a specific resource or subscription without modifying the underlying policy definition. In this scenario, the team can request an exemption (e.g., 'Emergency' or 'Waiver' category) to bypass the 'CostCenter' tag requirement temporarily, while the policy remains enforced for all other resources.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Policy exemption
Why this is correct
A policy exemption is a formal mechanism within Azure Policy that excludes a specific resource or resource group from the evaluation of a policy assignment. When you need to allow resource creation that is otherwise denied by a policy, you create an exemption on the scope where the policy is applied, specifying an exemption category and optional expiration date. This is the correct approach because it directly addresses the policy's enforcement without modifying the policy definition itself, and it is time-bound so you can control how long the exception lasts.
✗
Policy initiative
Why it's wrong here
A policy initiative in Azure Policy is a collection of one or more policy definitions grouped together to achieve a high-level compliance goal, such as monitoring security or governance. While an initiative can bundle multiple policies for easier assignment and management, it is still a set of enforcement rules, not a mechanism to create exceptions. Assigning an initiative that contains a denying policy will apply that deny effect, so an initiative cannot be used to allow resources that an underlying policy denies.
When this WOULD be correct
When an organization needs to apply a set of related policies (e.g., tagging and allowed locations) together as a single group for compliance monitoring across multiple subscriptions.
✗
Role assignment
Why it's wrong here
A role assignment in Azure is a way to grant permission and control access to resources through Azure RBAC, using role definitions like Owner or Contributor to determine what actions a security principal can perform. Role assignments govern who can perform management operations, but they do not alter how Azure Policy evaluates compliance or enforces deny effects. Even if a user has high-level permissions via role assignment, Azure Policy still evaluates and denies the resource creation request, so role assignments cannot provide an exception to a policy.
When this WOULD be correct
A user needs to grant a team temporary permissions to create resources in a subscription. Creating a custom role assignment would allow them to bypass Azure RBAC restrictions without changing the built-in roles.
✗
Blueprint
Why it's wrong here
A blueprint is an Azure service that packages a set of artifacts, such as resource templates, policy assignments, role assignments, and resource groups, into a single declarative environment definition. Blueprints are used to compose and orchestrate standardized environments, ensuring consistency across subscriptions, but they do not create exceptions to existing policies. Assigning a blueprint that includes a policy still enforces that policy; it has no capability to bypass or exempt a policy that is already assigned and denies resource creation.
When this WOULD be correct
A company needs to deploy a standardized environment (e.g., a set of VMs, networking, and policies) that must be consistently applied across multiple subscriptions. They should create a blueprint to package the resource templates and policy assignments for repeatable deployment.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

✓Policy exemptionCorrect answer▾

Why this is correct

A policy exemption is a formal mechanism within Azure Policy that excludes a specific resource or resource group from the evaluation of a policy assignment. When you need to allow resource creation that is otherwise denied by a policy, you create an exemption on the scope where the policy is applied, specifying an exemption category and optional expiration date. This is the correct approach because it directly addresses the policy's enforcement without modifying the policy definition itself, and it is time-bound so you can control how long the exception lasts.

✗Policy initiativeWrong answer — click to see why▾

Why this is wrong here

A policy initiative is a group of policy definitions, not a mechanism to grant temporary exceptions. It cannot bypass the deny effect of an existing policy assignment.

★ When this WOULD be the correct answer

When an organization needs to apply a set of related policies (e.g., tagging and allowed locations) together as a single group for compliance monitoring across multiple subscriptions.

Why candidates choose this

Candidates may confuse 'initiative' with 'exception' because both involve modifying policy behavior, but initiatives are for grouping policies, not for creating exemptions.

✗Role assignmentWrong answer — click to see why▾

Why this is wrong here

Role assignments control permissions (who can do what), not policy enforcement. They cannot exempt a resource from Azure Policy requirements like mandatory tags.

★ When this WOULD be the correct answer

A user needs to grant a team temporary permissions to create resources in a subscription. Creating a custom role assignment would allow them to bypass Azure RBAC restrictions without changing the built-in roles.

Why candidates choose this

Candidates may confuse policy exemptions with role-based access control, thinking that assigning a role can override policy enforcement, or they may believe that a 'bypass' permission exists for policies.

✗BlueprintWrong answer — click to see why▾

Why this is wrong here

Blueprints are used to create a repeatable set of Azure resources that adhere to organizational standards, not to grant temporary exceptions to policies. They cannot provide a temporary exemption from an existing policy assignment.

★ When this WOULD be the correct answer

A company needs to deploy a standardized environment (e.g., a set of VMs, networking, and policies) that must be consistently applied across multiple subscriptions. They should create a blueprint to package the resource templates and policy assignments for repeatable deployment.

Why candidates choose this

Candidates may confuse blueprints with policy exemptions because both involve managing compliance, but blueprints focus on resource orchestration rather than temporary policy waivers.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

AZ-900 Describe Azure management and governance Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question