AZ-900 Describe Azure management and governance Practice Question
A company has multiple Azure subscriptions, each managed by different development teams. The central governance team wants to ensure that every subscription adheres to the same security baselines, including specific Azure Policy definitions, RBAC role assignments, and a standard resource group structure. The team needs a single, versioned package that brings these components together and can be consistently deployed across all subscriptions. Which Azure service should the governance team use to meet these requirements?
⚠ Common exam trap
Many exam-takers confuse Azure Policy (which enforces rules) with Azure Blueprints (which orchestrates a full governance package), leading them to choose Policy because they see 'security baselines' and 'Azure Policy definitions' in the question, missing the requirement for a single, versioned package that includes multiple component types.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Blueprints
Azure Blueprints is the correct choice because it is designed to orchestrate the deployment of a repeatable set of Azure resources and policies that adhere to organizational standards. It packages artifacts like Azure Policy definitions, RBAC role assignments, and resource group templates into a single, versioned blueprint that can be assigned to multiple subscriptions, ensuring consistent governance across all environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Blueprints
Why this is correct
Azure Blueprints allows you to define a repeatable set of Azure resources that adhere to organizational standards, including policies, role assignments, and resource templates. It supports versioning and can be deployed to multiple subscriptions, making it the ideal choice for this scenario.
- ✗
Azure Resource Manager templates
Why it's wrong here
Azure Resource Manager templates can declaratively deploy infrastructure resources such as virtual machines and networks, but they are not designed to bundle governance controls like Azure Policy definitions or RBAC role assignments. Unlike Azure Blueprints, ARM templates focus solely on resource provisioning and do not natively support versioning, assignment tracking, or subscription-level orchestration of compliance artifacts. For this scenario, an ARM template could provision infrastructure but would leave the necessary policy and role assignments out of the deployable package.
When this WOULD be correct
A company needs to deploy a standardized set of Azure resources (e.g., VMs, storage accounts) with consistent configurations across multiple environments. They want to version and reuse the deployment template. In this scenario, ARM templates are the correct answer because they define and deploy resources declaratively.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is used to enforce rules and ensure compliance, but it cannot deploy resource groups or RBAC assignments. It is only one component of governance, not a deployable package that combines multiple governance elements.
When this WOULD be correct
An exam scenario where the requirement is to enforce specific compliance rules (e.g., requiring a tag on all resources) across subscriptions, without needing to deploy RBAC or resource groups. Azure Policy would be the correct answer for defining and applying such rules at scale.
- ✗
Azure Management Groups
Why it's wrong here
Management Groups are used to organize subscriptions and apply policies at scale, but they do not provide a deployable package of resources. They are a hierarchical structure, not a service for deploying a collection of settings and templates.
When this WOULD be correct
A company needs to apply consistent governance (e.g., policy, RBAC) across multiple subscriptions based on organizational structure, such as departments or environments. The central team wants to assign policies and RBAC at a management group level so that all subscriptions under it inherit the settings automatically, without needing to deploy a package per subscription.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure BlueprintsCorrect answer▾
Why this is correct
Azure Blueprints allows you to define a repeatable set of Azure resources that adhere to organizational standards, including policies, role assignments, and resource templates. It supports versioning and can be deployed to multiple subscriptions, making it the ideal choice for this scenario.
✗Azure Resource Manager templatesWrong answer — click to see why▾
Why this is wrong here
Azure Resource Manager (ARM) templates are infrastructure-as-code for deploying resources, but they do not provide a versioned, composable package that includes RBAC assignments and Azure Policy definitions as a single artifact. Azure Blueprints is designed specifically to orchestrate these components together.
★ When this WOULD be the correct answer
A company needs to deploy a standardized set of Azure resources (e.g., VMs, storage accounts) with consistent configurations across multiple environments. They want to version and reuse the deployment template. In this scenario, ARM templates are the correct answer because they define and deploy resources declaratively.
Why candidates choose this
Candidates may confuse ARM templates with Blueprints because both involve deploying resources consistently. They might think ARM templates can also include policy and RBAC, but ARM templates require separate deployment of those components, whereas Blueprints natively bundles them.
✗Azure PolicyWrong answer — click to see why▾
Why this is wrong here
Azure Policy enforces individual rules and effects on resources, but it cannot package multiple components like RBAC assignments and resource group structures into a single, versioned deployment artifact. The question requires a cohesive, versioned package, which is beyond Azure Policy's scope.
★ When this WOULD be the correct answer
An exam scenario where the requirement is to enforce specific compliance rules (e.g., requiring a tag on all resources) across subscriptions, without needing to deploy RBAC or resource groups. Azure Policy would be the correct answer for defining and applying such rules at scale.
Why candidates choose this
Candidates may confuse Azure Policy's ability to enforce security baselines with the need to deploy a complete environment, overlooking that Policy only handles rules, not the deployment of RBAC or resource groups.
✗Azure Management GroupsWrong answer — click to see why▾
Why this is wrong here
Azure Management Groups organize subscriptions hierarchically for policy and access management, but they do not provide a versioned, deployable package of governance components like Azure Policy definitions, RBAC assignments, and resource group structures. The requirement is for a single, versioned artifact that bundles these elements, which is the purpose of Azure Blueprints.
★ When this WOULD be the correct answer
A company needs to apply consistent governance (e.g., policy, RBAC) across multiple subscriptions based on organizational structure, such as departments or environments. The central team wants to assign policies and RBAC at a management group level so that all subscriptions under it inherit the settings automatically, without needing to deploy a package per subscription.
Why candidates choose this
Candidates may confuse Management Groups with Blueprints because both are used for governance at scale, and Management Groups can apply policies and RBAC across subscriptions. However, they do not package multiple components into a versioned artifact that can be deployed consistently.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Resource group
A logical container in Microsoft Azure that holds related resources for an application or solution, enabling unified management, security, and billing.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.