AZ-900 Describe Azure architecture and services Practice Question
A company is deploying a web application in Azure. The application consists of an Azure App Service, an Azure SQL Database, and a Storage account. The development team maintains three separate environments: development, test, and production. The team wants to be able to delete all resources associated with a specific environment (e.g., development) in a single action, without affecting the other environments. The solution must also allow applying role-based access control (RBAC) and tags consistently to all resources within each environment. Which Azure component should the team use to achieve these requirements?
⚠ Common exam trap
Test-takers frequently confuse resource groups with subscriptions or management groups, thinking that a subscription is needed to isolate environments, but subscriptions are billing boundaries, not lifecycle containers for a single environment's resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure resource group
An Azure resource group is a logical container that holds related resources for an Azure solution. By placing all resources for a specific environment (e.g., development) into a single resource group, the team can delete the entire environment in one action by deleting the resource group, without affecting other environments. Additionally, RBAC roles and tags applied at the resource group level are inherited by all resources within that group, ensuring consistent governance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure subscription
Why it's wrong here
An Azure subscription is a billing and management boundary, but it typically contains all environments. Deleting a subscription would remove all resources and billing, which is too broad for managing individual environments. It also does not allow granular grouping within a single subscription.
When this WOULD be correct
When the requirement is to isolate billing, apply subscription-level policies (e.g., spending limits), or manage all resources under a single cost center. For example, a company wants separate subscriptions for production and non-production workloads to enforce different budget constraints and compliance policies.
- ✓
Azure resource group
Why this is correct
A resource group is a container that holds related resources for an Azure solution. It allows you to manage, delete, and apply policies, tags, and RBAC to all resources in that group together. This is exactly what the team needs to manage each environment independently.
- ✗
Azure management group
Why it's wrong here
Management groups are used to organize subscriptions hierarchically and apply governance policies at scale across multiple subscriptions. They do not contain individual Azure resources like App Services or databases, so they cannot be used to group resources within a single subscription by environment.
When this WOULD be correct
A company has multiple Azure subscriptions for different departments and wants to apply a common set of policies (e.g., allowed regions) and RBAC assignments across all subscriptions. The team should use Azure management groups to create a hierarchy and assign policies at the management group level, which will be inherited by all subscriptions.
- ✗
Azure availability zone
Why it's wrong here
An availability zone is a physically separate datacenter (or set of datacenters) within an Azure region, designed to protect applications and data from datacenter-level failures. It provides high availability and fault tolerance by distributing compute, storage, networking, and data resources across independent facilities, but it does not offer any logical grouping mechanism for lifecycle management, RBAC, or policy enforcement. Choosing an availability zone is about redundancy and resilience, not about organizing resources by environment or access boundaries, so it cannot fulfill the requirement to manage each deployment environment independently.
When this WOULD be correct
A question asks: 'A company needs to ensure that its virtual machines are resilient to datacenter failures within a region. Which Azure feature should they use?' In that scenario, availability zones would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure resource groupCorrect answer▾
Why this is correct
A resource group is a container that holds related resources for an Azure solution. It allows you to manage, delete, and apply policies, tags, and RBAC to all resources in that group together. This is exactly what the team needs to manage each environment independently.
✗Azure subscriptionWrong answer — click to see why▾
Why this is wrong here
An Azure subscription is a billing and management container, not designed for grouping resources by environment. Deleting a subscription would remove all resources across all environments, not just one, and RBAC/tags would apply at the subscription level, not per environment.
★ When this WOULD be the correct answer
When the requirement is to isolate billing, apply subscription-level policies (e.g., spending limits), or manage all resources under a single cost center. For example, a company wants separate subscriptions for production and non-production workloads to enforce different budget constraints and compliance policies.
Why candidates choose this
Candidates may think a subscription can group resources by environment because it is a top-level container, but it lacks the granularity to manage multiple environments within the same subscription without affecting others.
✗Azure management groupWrong answer — click to see why▾
Why this is wrong here
Azure management groups are used for hierarchical organization of subscriptions and applying governance policies across multiple subscriptions, not for grouping resources within a single subscription for lifecycle management or RBAC at the resource level.
★ When this WOULD be the correct answer
A company has multiple Azure subscriptions for different departments and wants to apply a common set of policies (e.g., allowed regions) and RBAC assignments across all subscriptions. The team should use Azure management groups to create a hierarchy and assign policies at the management group level, which will be inherited by all subscriptions.
Why candidates choose this
Candidates may confuse management groups with resource groups because both involve grouping, but management groups operate at a higher level (subscriptions) and are not designed for per-environment resource lifecycle management.
✗Azure availability zoneWrong answer — click to see why▾
Why this is wrong here
Azure availability zones are physically separate datacenters within an Azure region used for high availability and disaster recovery, not for grouping and managing resources by environment with RBAC and tags.
★ When this WOULD be the correct answer
A question asks: 'A company needs to ensure that its virtual machines are resilient to datacenter failures within a region. Which Azure feature should they use?' In that scenario, availability zones would be the correct answer.
Why candidates choose this
Candidates may confuse availability zones with resource groups because both involve organizing resources, but availability zones are about fault isolation, not logical grouping for management.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Azure SQL Database
Azure SQL Database is a fully managed relational database-as-a-service (DBaaS) in Microsoft Azure, based on the SQL Server engine, that handles scaling, backups, patching, and high availability automatically.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.