AZ-900 Describe Azure management and governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Policy

  Why it's wrong here

  Azure Policy is an evaluation and enforcement engine that applies rules—such as allowed resource types, tagging requirements, or location restrictions—to resources at a chosen scope. While policies can be assigned to management groups, subscriptions, or resource groups, they only govern existing and new resources; they do not package or deploy RBAC role assignments or ARM templates. A policy alone cannot create resource groups or provision the resources needed for a full environment, so it addresses compliance but not the orchestrated deployment that Azure Blueprints provides.

  When this WOULD be correct

  When the question asks for a service to enforce compliance rules (e.g., restrict resource types or locations) across resources in a subscription, Azure Policy would be the correct answer.

• ✓

  Azure Blueprints

  Why this is correct

  Azure Blueprints is the correct answer because it orchestrates the deployment of a complete, versioned environment that bundles resource groups, Azure Policy assignments, RBAC role assignments, and ARM templates into a single, repeatable artifact. This native service enables cloud architects to define and re-deploy a standardized governance and resource architecture across multiple subscriptions, ensuring consistency and auditability. Unlike a raw template, Blueprints maintains a versioned relationship between the blueprint definition and assigned resources, making it the only option that specifically packages all governance components together.

• ✗

  Azure Resource Manager

  Why it's wrong here

  Azure Resource Manager (ARM) is the underlying deployment and management service for all Azure resources, and ARM templates declaratively deploy a set of resources. However, an ARM template is a single infrastructure-as-code artifact focused on resources such as VMs, storage, and networking—it does not inherently package Azure Policy definitions, RBAC role assignments, or the versioned governance lifecycle that Blueprints offers. While Blueprints leverages ARM templates internally, ARM itself lacks the orchestration layer that manages policy and role assignments as part of a repeatable environment package, making it an incomplete answer to the requirement.

  When this WOULD be correct

  A question that asks: 'Which service is used to define and deploy infrastructure as code using JSON templates for a single resource group or subscription?' would make Azure Resource Manager (ARM) the correct answer, as ARM templates are the primary tool for declarative resource deployment.

• ✗

  Azure Management Groups

  Why it's wrong here

  Azure Management Groups are a hierarchical organizational layer for managing access, policy, and compliance across multiple subscriptions, but they do not deploy resource groups, RBAC roles, or templates. They provide a scope above subscriptions for applying governance rules that are inherited by child subscriptions and management groups. This makes them a valuable governance container for organizing and enforcing policies at scale, yet they lack the deployment orchestration and versioning capabilities of Azure Blueprints, which is why they cannot be used to deploy a standardized environment directly.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question