AZ-900 Describe Azure management and governance Practice Question
A company needs to deploy a consistent set of Azure resources (a virtual network, two subnets, and a network security group) into multiple environments: dev, test, and prod. The IT operations team wants to define these resources in a declarative file that can be deployed repeatedly and reliably to different resource groups. The team also wants to version control the file and have the ability to update all environments by redeploying the same file. Which Azure feature should the team use?
⚠ Common exam trap
Watch out — candidates often confuse Azure Policy (a governance tool for enforcing rules) with ARM templates (a deployment tool for defining and provisioning resources), leading them to select Policy when the question explicitly asks for a declarative file to deploy resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Resource Manager (ARM) templates
Azure Resource Manager (ARM) templates are the correct choice because they provide a declarative JSON-based file that defines the infrastructure and configuration of Azure resources. This allows the team to deploy a consistent set of resources (virtual network, subnets, network security group) repeatedly and reliably across different resource groups and environments (dev, test, prod). ARM templates support version control, idempotent deployments, and can be used to update all environments by simply redeploying the same template file.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Resource Manager (ARM) templates
Why this is correct
ARM templates are declarative JSON files that define the desired state of an Azure environment, including virtual networks, subnets, and other resources. Because they are idempotent, you can deploy the same template repeatedly to different resource groups to create a consistent set of resources, and redeploy it to apply updates. They also integrate with version control and can be parameterized to customize names, regions, or settings across environments.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is a governance service that enforces organizational standards and compliance through rules and effects such as deny, audit, append, or deployIfNotExists. While the deployIfNotExists effect can deploy a single defined resource during evaluation (e.g., a diagnostic setting), it is not intended to orchestrate the deployment of a complete, consistent set of infrastructure like a virtual network and its dependencies. Policies are about controlling and auditing resources, not building environments.
When this WOULD be correct
A company needs to ensure that all deployed virtual networks have a specific tag and a minimum subnet size. The team wants to automatically audit and enforce these rules across all subscriptions. Azure Policy would be the correct feature to define and apply these compliance policies.
- ✗
Azure Management Groups
Why it's wrong here
Management Groups are logical containers that give you a hierarchy above Azure subscriptions for applying governance controls such as RBAC assignments and Azure Policy at scale. They help organize and manage multiple subscriptions for cost and compliance management, but they do not contain or define resources. Deployment is a separate action performed against a subscription or resource group, not through management groups.
When this WOULD be correct
A company needs to apply a common set of Azure Policy definitions (e.g., allowed regions) across multiple subscriptions. The IT team wants to manage these policies at scale by grouping subscriptions under a management group hierarchy to enforce consistent governance.
- ✗
Azure Advisor
Why it's wrong here
Azure Advisor is a free, personalized cloud consultant that analyzes your deployed resources and usage telemetry, then provides recommendations in five categories: cost, security, reliability, operational excellence, and performance. It can help you optimize existing infrastructure, but it has no capability to define, provision, or deploy resources. At best, it suggests actions for you to take, but it does not execute them.
When this WOULD be correct
An exam question asks: 'Which Azure service provides recommendations to optimize costs, improve security, and increase reliability for deployed resources?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Resource Manager (ARM) templatesCorrect answer▾
Why this is correct
ARM templates are declarative JSON files that define the desired state of an Azure environment, including virtual networks, subnets, and other resources. Because they are idempotent, you can deploy the same template repeatedly to different resource groups to create a consistent set of resources, and redeploy it to apply updates. They also integrate with version control and can be parameterized to customize names, regions, or settings across environments.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy is used to enforce compliance rules and audit resource configurations, not to define and deploy a set of resources declaratively. It cannot create resources like virtual networks or subnets.
★ When this WOULD be the correct answer
A company needs to ensure that all deployed virtual networks have a specific tag and a minimum subnet size. The team wants to automatically audit and enforce these rules across all subscriptions. Azure Policy would be the correct feature to define and apply these compliance policies.
Why candidates choose this
Candidates may confuse Azure Policy's ability to enforce rules on resources with the declarative deployment of resources, thinking that Policy can also define and create the infrastructure.
✗Azure Management GroupsWrong answer — click to see why▾
Why this is wrong here
Azure Management Groups are used for organizing and managing access, policies, and compliance across multiple subscriptions, not for defining and deploying infrastructure resources like virtual networks and subnets.
★ When this WOULD be the correct answer
A company needs to apply a common set of Azure Policy definitions (e.g., allowed regions) across multiple subscriptions. The IT team wants to manage these policies at scale by grouping subscriptions under a management group hierarchy to enforce consistent governance.
Why candidates choose this
Candidates may confuse management groups with resource groups or think they can be used to define resource configurations, because both involve organizing Azure resources hierarchically.
✗Azure AdvisorWrong answer — click to see why▾
Why this is wrong here
Azure Advisor provides personalized recommendations for cost, performance, security, and reliability, but it does not define or deploy infrastructure resources declaratively.
★ When this WOULD be the correct answer
An exam question asks: 'Which Azure service provides recommendations to optimize costs, improve security, and increase reliability for deployed resources?'
Why candidates choose this
Candidates may confuse Advisor's recommendation capabilities with the ability to define and deploy resources, especially since both involve managing Azure environments.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
ARM
ARM stands for Azure Resource Manager, the management layer that enables you to create, update, and delete resources in your Azure account.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.