AZ-900 Describe Azure management and governance: 154 practice questions

12 of the 154 Describe Azure management and governance questions in the Certsqill AZ-900 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for AZ-900? Take the free 5-min readiness check →

1. Outbound data transfers from Azure Blob Storage to viewers: Which type of data transfer is most likely respons

1. Outbound data transfers from Azure Blob Storage to viewers on the public internet ✓

   Correct. Outbound data transfers (egress) from Azure to the public internet incur charges. Streaming video to worldwide viewers sends large volumes of data from Azure to the internet, which is billed based on volume and destination region.
2. Inbound data transfers from the company's on-premises servers uploading content to Azure Blob Storage

   Incorrect. Inbound data transfers (ingress) into Azure are generally free. Uploading content to Blob Storage would not explain the charges.
3. Data transfers between Azure Blob Storage and an Azure VM in the same Azure region

   Incorrect. Data transfers between Azure services within the same region are typically free. Blob Storage reads from a co-located VM would not incur transfer charges.
4. Data transferred from Azure Blob Storage to Azure CDN within the same region

   Incorrect. Transfers from Azure Blob Storage to Azure CDN within the same region are typically free or very low cost. CDN is designed to reduce egress costs by caching content at edge nodes — using CDN would actually reduce the charges the company is seeing.

Outbound data transfers (egress) from Azure to the public internet incur charges; streaming video to worldwide viewers generates significant egress volume.

2. The Azure Total Cost of Ownership Calculator: Which tool should the company use?

1. Azure Advisor, which recommends optimizations for existing Azure deployments rather than migration comparisons

   Incorrect. Azure Advisor gives optimization recommendations for existing Azure deployments and does not perform migration cost comparisons.
2. Microsoft Cost Management, which analyzes actual Azure spending after deployment and cannot model hypothetical scenarios

   Incorrect. Microsoft Cost Management analyzes actual Azure spending after deployment and cannot model hypothetical on-premises versus Azure comparisons.
3. The Azure Total Cost of Ownership (TCO) Calculator, comparing full on-premises costs to equivalent Azure services ✓

   Correct. The TCO Calculator helps build a cloud migration business case by comparing fully loaded on-premises costs (hardware, software, electricity, datacenter space, IT staff) against equivalent Azure services.
4. The Azure Pricing Calculator, which estimates only Azure resource costs and omits on-premises hardware and staffing

   Incorrect. The Azure Pricing Calculator estimates only Azure resource costs and ignores on-premises hardware, electricity, and staff, making it unsuitable for an on-premises versus Azure comparison.

The TCO Calculator compares fully-loaded on-premises costs (hardware, electricity, staff) against equivalent Azure costs — the correct tool for migration business cases.

3. Microsoft Cost Management: Which Azure tool allows you to set budget thresholds and receive email alerts when

1. Azure Monitor, which collects performance and log telemetry from resources rather than tracking billing budgets

   Incorrect. Azure Monitor collects telemetry (performance, logs) from resources. It is not primarily a billing tool, though it can alert on metrics.
2. Azure Pricing Calculator, which estimates costs before deployment and cannot alert on real ongoing spend

   Incorrect. The Azure Pricing Calculator estimates costs before deployment and cannot monitor actual spending or send budget alerts.
3. Azure Advisor, which recommends ways to optimize spending but does not set budgets or send spend alerts

   Incorrect. Azure Advisor recommends ways to optimize spending but does not set budget thresholds or send spending alerts.
4. Microsoft Cost Management, which monitors actual spending and sends alerts as budget thresholds are approached ✓

   Correct. Microsoft Cost Management lets you monitor actual Azure spending, set budget thresholds, and configure alerts when spending approaches or exceeds a defined budget.

Microsoft Cost Management monitors actual Azure spending and can send alerts when budgets are approached or exceeded.

4. Resource tags: Which Azure feature should they use?

1. Resource tags ✓

   Correct. Resource tags are name-value pairs applied to Azure resources (e.g., Department=Finance). They allow the company to group resources by department and generate cost reports filtered by those tags in Microsoft Cost Management.
2. Subscriptions

   Incorrect. Using separate subscriptions for each department is one approach to cost separation, but it creates significant management overhead and is not the recommended approach specifically for tagging and cost tracking within a single organization.
3. Resource groups

   Incorrect. Resource groups are containers for organizing resources, but each resource can only belong to one resource group. Tags are more flexible for cross-cutting cost tracking because they can be applied across multiple resource groups.
4. Management groups

   Incorrect. Management groups organize subscriptions at the highest level for governance. They are not used for individual resource cost tracking by department.

Resource tags (name-value pairs like Department=Finance) allow cost tracking by department within Microsoft Cost Management reports.

5. No, because tags on a resource group are not automatically: Does the new VM automatically inherit the Departme

1. Yes, because Azure Resource Manager automatically enforces tag inheritance for every new resource created

   Incorrect. Azure Resource Manager does not enforce tag inheritance by default. It can be configured with Azure Policy, but it is not automatic.
2. No, because tags on a resource group are not automatically inherited by the resources created within it ✓

   Correct. Unlike RBAC permissions and policies, which inherit down the hierarchy, tags are not inherited automatically. Resources must be tagged individually, or inheritance can be enforced with Azure Policy.
3. No, because tags can only be applied to individual resources and never to a resource group itself

   Incorrect. Tags can be applied to resource groups, subscriptions, and individual resources. They are simply not inherited by child resources automatically.
4. Yes, because every resource in a resource group automatically inherits all tags applied to that group

   Incorrect. Tags are not inherited automatically. Azure explicitly states that tags on a resource group do not propagate to child resources.

Tags are NOT automatically inherited — resources must be tagged individually or tag inheritance enforced via Azure Policy.

6. Azure Reserved VM Instances with a 1- or 3-year commitment: Which Azure pricing option would provide the great

1. Azure Hybrid Benefit, which applies existing Windows or SQL Server licenses to reduce VM licensing cost

   Incorrect. Azure Hybrid Benefit lowers cost by applying existing on-premises Windows Server or SQL Server licenses with Software Assurance. It complements reservations but is not the primary discount here.
2. Pay-as-you-go pricing, the most flexible option but the most expensive for continuous steady-state workloads

   Incorrect. Pay-as-you-go is the most flexible but most expensive option for steady-state workloads. For predictable 3-year workloads, reservations save much more.
3. Azure Reserved VM Instances with a 1- or 3-year commitment for steady, predictable long-term workloads ✓

   Correct. Reserved VM Instances offer up to 72% off pay-as-you-go in exchange for a 1- or 3-year commitment. For continuously running, predictable long-term workloads, they provide the greatest savings.
4. Azure Spot VMs, which give deep discounts but can be evicted at any time when Azure reclaims capacity

   Incorrect. Spot VMs offer up to 90% off but can be evicted with 30 seconds' notice when Azure needs capacity, so they are unsuitable for 24/7 production workloads.

Reserved Instances provide the greatest savings (up to 72%) for predictable, continuous 24/7 workloads — the commitment trade-off is appropriate for a 3-year stable workload.

7. Azure Spot VMs: Which Azure VM pricing option is most appropriate?

1. Azure Savings Plans

   Incorrect. Azure Savings Plans offer discounts for committing to a consistent hourly spend on compute. They are better for predictable baseline usage, not for maximizing cost savings on interruptible batch jobs.
2. Pay-as-you-go VMs

   Incorrect. Pay-as-you-go is the most flexible but also the most expensive compute option. It is not optimal for cost-sensitive interruptible workloads.
3. Azure Reserved VM Instances

   Incorrect. Reserved Instances require a 1- or 3-year commitment for continuous use. Overnight batch jobs with variable frequency do not fully utilize a reserved instance, so they do not offer the same per-job cost savings as Spot.
4. Azure Spot VMs ✓

   Correct. Spot VMs use unused Azure compute capacity at discounts up to 90%. Because the ML training jobs can tolerate interruption and restart, they are ideal Spot VM workloads — interruptible, cost-sensitive batch processing.

Spot VMs are ideal for interruptible workloads — they offer up to 90% discount for using Azure's unused capacity, with the trade-off of possible 30-second eviction notice.

8. Deny: Which Azure Policy effect should they configure to enforce this requirement?

1. DeployIfNotExists

   Incorrect. DeployIfNotExists deploys a related resource if it doesn't already exist (such as deploying a monitoring agent alongside a VM). It does not restrict where resources can be deployed.
2. Deny ✓

   Correct. The Deny effect blocks the deployment of resources that do not comply with the policy conditions. In this case, any attempt to deploy a VM in a region other than West Europe or North Europe would be rejected at deployment time.
3. Audit

   Incorrect. The Audit effect logs non-compliant resources but does NOT prevent their deployment. Using Audit, a VM could still be deployed in an unauthorized region — the system would simply record the violation.
4. Append

   Incorrect. The Append effect adds additional fields to the resource during deployment (such as adding a required tag). It does not block deployment based on region.

The Deny effect blocks deployment of non-compliant resources — Audit only logs violations without preventing deployment.

9. Create a policy initiative containing all 12 policies: What is the most efficient way to manage this?

1. Create a policy initiative and then assign it individually to each of the 15 subscriptions, repeating the same assignment 15 separate times

   Incorrect. Assigning to each subscription separately requires 15 assignments and does not leverage management group inheritance. The scenario specifically asks for the most efficient approach.
2. Create 12 individual policy definitions and assign each one separately to the management group as its own assignment

   Incorrect. While assigning individual policies to the management group reduces the total from 180 to 12, a policy initiative is more efficient because it groups all 12 into a single assignable unit, improving manageability.
3. Create a policy initiative containing all 12 policies and assign it to the management group — it will inherit to all subscriptions ✓

   Correct. A policy initiative (policy set) groups multiple policy definitions into a single unit. Assigning the initiative to the management group causes it to inherit down to all 15 subscriptions automatically, requiring only 1 assignment instead of 180.
4. Create a resource lock at the management group level to block any non-compliant resource configuration across subscriptions

   Incorrect. Resource locks prevent deletion or modification of resources but do not enforce configuration compliance policies. Locks are not a substitute for Azure Policy.

A policy initiative groups multiple policies into one unit — assigning it to the management group requires only 1 assignment and inherits to all subscriptions automatically.

10. Read and modify the storage account: Which operations can authorized users still perform on that storage accou

1. Read the storage account only — no modifications or deletions allowed

   Incorrect. Read-only with no modifications describes a ReadOnly lock, not a Delete lock. A Delete lock specifically only blocks deletion; modifications are still permitted.
2. Delete the storage account only after first requesting approval from the subscription Owner

   Incorrect. A Delete lock does not create an approval workflow. It completely prevents deletion — no one can delete the resource while the lock is in place without first removing the lock, regardless of their role.
3. No operations — a Delete lock prevents all access to the resource

   Incorrect. A Delete lock does not prevent access or modification. It only prevents the deletion action. All read and update operations continue to work normally.
4. Read and modify the storage account (including changing settings), but cannot delete it ✓

   Correct. A Delete lock prevents deletion of the resource but still allows authorized users to read and modify it. Users can update configurations, upload files, and change settings — they simply cannot delete the storage account itself.

A Delete lock prevents deletion but allows read and modify operations — users can manage the resource, they simply cannot delete it.

11. The operation fails because a ReadOnly lock prevents all: What is the result?

1. The operation fails because a ReadOnly lock prevents all write operations, including tag updates, and overrides RBAC permissions ✓

   Correct. Resource locks override RBAC permissions — even the Owner role cannot perform write operations on a resource protected by a ReadOnly lock. Adding a tag is a write (metadata) operation and will be blocked. The lock must be removed first.
2. The operation succeeds because the Owner role has full control over the group and can override any resource lock at will

   Incorrect. Resource locks explicitly override RBAC. Even an Owner-role user cannot perform write operations while a ReadOnly lock is in place. The Owner role can manage the lock itself (remove it), not bypass it.
3. The operation succeeds because adding a tag is only a metadata change, which ReadOnly locks are designed not to restrict

   Incorrect. Adding or modifying tags is a write operation in Azure Resource Manager. A ReadOnly lock blocks all write operations on the resource, including tag modifications.
4. The operation fails only when the ReadOnly lock is applied at the subscription scope rather than directly at the resource group level

   Incorrect. A ReadOnly lock applied at the resource group level inherits to all resources within the group. The lock level does not affect whether the restriction applies — it applies at all levels and inherits downward.

A ReadOnly lock blocks all write operations including tag updates, and overrides RBAC — even an Owner cannot write while the lock is active.

12. Azure Arc: Which Azure service enables this?

1. Azure Migrate

   Incorrect. Azure Migrate is used to discover, assess, and migrate workloads to Azure. It is a migration tool, not a hybrid management platform for non-Azure resources.
2. Azure Arc ✓

   Correct. Azure Arc extends Azure management capabilities — including Azure Policy, RBAC, tagging, and Azure Monitor — to resources running outside of Azure, including on-premises servers and servers in other cloud providers like AWS.
3. Azure Resource Manager

   Incorrect. Azure Resource Manager is the management layer for Azure resources only. It does not natively extend to on-premises servers or resources in other clouds without Azure Arc.
4. Microsoft Entra Connect

   Incorrect. Microsoft Entra Connect synchronizes on-premises Active Directory identities to Microsoft Entra ID. It is an identity synchronization tool, not a resource management or governance platform.

Azure Arc extends Azure management (Policy, RBAC, Monitor) to on-premises and multi-cloud resources — enabling a single control plane across all environments.

Other AZ-900 domains

• Describe Azure architecture and services — 237 questions →
• Describe cloud concepts — 94 questions →
• All 485 AZ-900 questions →