AZ-900 Describe Azure Management and Governance Practice Questions

Free AZ-900 Describe Azure Management and Governance practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main AZ-900 page. Sign up free to practice the full set.

1. Question 1Describe Azure Management and Governance

   Which governance capability allows you to restrict the types of resources that can be deployed in an Azure subscription?

   • AAzure PolicyCorrect
   • BAzure Blueprints
   • CAzure Monitor
   • DAzure Advisor
   ✓ Correct answer: A

   Azure Policy is a governance service that allows organizations to create, assign, and manage policies that enforce rules and restrictions on Azure resources. By defining policies, administrators can restrict the types of resources that can be deployed, enforce naming conventions, require specific configurations, and ensure compliance with organizational standards. For example, a policy can prevent the creation of virtual machines in unapproved regions or block certain resource types entirely.

   Why the other options are wrong

   • BAzure Blueprints is a service for defining repeatable sets of Azure resources and policies as templates for environment setup, but it is not the primary tool for restricting specific resource types within a subscription.
   • CAzure Monitor is a service for collecting, analyzing, and acting on telemetry data from Azure resources, focused on monitoring and alerting rather than enforcing deployment restrictions.
   • DAzure Advisor provides personalized best practice recommendations for optimizing Azure deployments across cost, security, reliability, and performance, but it does not enforce restrictions on resource deployment.
2. Question 2Describe Azure Management and GovernanceSelect all that apply

   Litware Inc is implementing a governance strategy. Which THREE of the following are built-in roles available in Azure RBAC? (Choose three.)

   • AContributorCorrect
   • BOperator
   • COwnerCorrect
   • DReaderCorrect
   • EAuditor
   ✓ Correct answer: A, C, D

   Azure RBAC includes three fundamental built-in roles that form the foundation of access management. Owner has full access to all resources, including the ability to delegate access to others through role assignments. Contributor can create and manage all types of Azure resources but cannot grant access to others. Reader can view existing Azure resources but cannot make any changes. These three roles, along with User Access Administrator, are the most commonly used built-in roles in Azure RBAC.

   Why the other options are wrong

   • BOperator is not a built-in Azure RBAC role; while some service-specific roles contain "Operator" in their name, there is no fundamental built-in role called simply "Operator."
   • EAuditor is not a built-in Azure RBAC role; auditing capabilities are provided through services like Azure Monitor and Microsoft Defender for Cloud rather than through a dedicated RBAC role.
3. Question 3Describe Azure Management and Governance

   Margie's Travel is deploying Azure infrastructure and wants to use an infrastructure-as-code approach with a language that is simpler than JSON. Which tool should they consider?

   • AAzure CLI
   • BAzure Portal
   • CAzure Advisor
   • DBicepCorrect
   ✓ Correct answer: D

   Bicep is a domain-specific language created by Microsoft for deploying Azure resources declaratively using an infrastructure-as-code approach. It provides a significantly simpler and more readable syntax compared to the verbose JSON format used by ARM templates. Bicep files are transpiled into standard ARM template JSON during deployment, so they offer the same capabilities and resource coverage as ARM templates while being much easier to author and maintain.

   Why the other options are wrong

   • AAzure CLI is a command-line tool for managing Azure resources imperatively through individual commands, not a declarative infrastructure-as-code language.
   • BAzure Portal is a graphical web interface for managing Azure resources manually and does not support an infrastructure-as-code workflow.
   • CAzure Advisor provides optimization recommendations for existing Azure deployments and is not an infrastructure deployment tool.
4. Question 4Describe Azure Management and Governance

   What does Azure Cost Management help organizations do?

   • ADeploy and provision new resources
   • BMonitor, allocate, and optimize cloud spendingCorrect
   • CConfigure networks and routing
   • DManage user identities and access
   ✓ Correct answer: B

   Azure Cost Management is a suite of tools that helps organizations monitor their cloud usage and expenditures, allocate costs to teams and projects, and optimize spending through actionable recommendations. It provides cost analysis, budget creation with alerts, and integration with billing data across Azure and other cloud providers, enabling comprehensive financial governance of cloud resources.

   Why the other options are wrong

   • ADeploying and provisioning resources is done through ARM templates or the portal; Cost Management analyzes and optimizes what you spend, not what you deploy.
   • CConfiguring networks is the role of Azure Virtual Network; Cost Management tracks and controls spending, not network topology.
   • DManaging identities and access is handled by Microsoft Entra ID; Cost Management deals with budgets and billing, not user accounts.
5. Question 5Describe Azure Management and GovernanceSelect all that apply

   A company is implementing defense-in-depth security for its Azure environment. Which TWO of the following represent distinct layers in the defense-in-depth security model? (Choose two.)

   • ANetwork layer (network segmentation and filtering)Correct
   • BPricing layer (cost optimization controls)
   • CMarketing layer (brand protection controls)
   • DSubscription layer (subscription naming conventions)
   • EPhysical security layer (datacenter access controls)Correct
   ✓ Correct answer: A, E

   The defense-in-depth security model uses multiple layers of security to protect data and resources. The standard layers include physical security (datacenter access controls, building security), identity and access (authentication and authorization), perimeter (DDoS protection, firewalls), network (network segmentation, network security groups), compute (VM security, endpoint protection), application (secure coding, vulnerability management), and data (encryption at rest and in transit). The network layer and physical security layer are both recognized distinct layers in this model.

   Why the other options are wrong

   • BPricing layer (cost optimization controls) is not a layer in the defense-in-depth security model, as cost optimization is a financial concern unrelated to security architecture.
   • CMarketing layer (brand protection controls) is not a recognized layer in the defense-in-depth security model, as marketing is a business function outside the scope of security architecture.
   • DSubscription layer (subscription naming conventions) is not a layer in the defense-in-depth model, as naming conventions are an organizational practice rather than a security control layer.
6. Question 6Describe Azure Management and Governance

   What is the primary purpose of the Azure Pricing Calculator?

   • ATo estimate the projected cost of Azure services before you deploy themCorrect
   • BTo report the actual charges already incurred on your subscription
   • CTo compare the cost savings of moving from on-premises to Azure over time
   • DTo apply spending limits that automatically stop resources when a budget is reached
   ✓ Correct answer: A

   The Azure Pricing Calculator is a planning tool that lets you select Azure services, configure their options (such as region, tier, and quantity), and see an estimated cost. It is used before deployment to model and compare different configurations and to support budgeting decisions. It produces estimates only; it does not track real consumption or actual billing. Distinguishing it from cost-tracking tools is a common Azure Fundamentals concept: the Pricing Calculator is for forward-looking estimates, while other tools report actual spend.

   Why the other options are wrong

   • BActual incurred charges are shown by Azure Cost Management and the billing pages, not the Pricing Calculator.
   • CComparing on-premises versus Azure total cost of ownership over time is the role of the Total Cost of Ownership (TCO) Calculator, a separate tool.
   • DEnforcing budgets and triggering actions when thresholds are reached is done with Azure Cost Management budgets, not the Pricing Calculator.
7. Question 7Describe Azure Management and Governance

   Which Azure Cloud Shell environment would you use to run cmdlets that follow the Verb-Noun naming convention (e.g., Get-AzVM, New-AzResourceGroup)?

   • ABash with Azure CLI
   • BPowerShell with Azure PowerShell moduleCorrect
   • CAzure Resource Manager REST API
   • DAzure Advisor
   ✓ Correct answer: B

   Azure PowerShell uses cmdlets that follow the Verb-Noun naming convention, such as Get-AzVM, New-AzResourceGroup, Set-AzStorageAccount, and Remove-AzWebApp. Azure Cloud Shell provides a pre-configured PowerShell environment with the Azure PowerShell module (Az module) already installed, allowing you to run these cmdlets immediately. This naming convention makes cmdlets self-descriptive and easy to discover using PowerShell's built-in Get-Command and Get-Help features.

   Why the other options are wrong

   • ABash with Azure CLI uses a different command syntax based on the pattern az <service> <action> (for example, az vm list or az group create), not the Verb-Noun convention.
   • CAzure Resource Manager REST API uses HTTP methods (GET, POST, PUT, DELETE) with resource URIs, which is a different interaction pattern from PowerShell cmdlets.
   • DAzure Advisor is a recommendation service accessed through the portal or API and is not a command-line environment for running cmdlets.
8. Question 8Describe Azure Management and Governance

   A company is reviewing its Azure bill and notices charges for data egress. What does data egress refer to?

   • AData transferred into Azure from the internet or from an on-premises network
   • BData transferred out of Azure to the internet or to other Azure regionsCorrect
   • CData that is written to and retained in Azure Blob Storage over time
   • DData that is actively processed in memory by Azure compute services
   ✓ Correct answer: B

   Data egress is outbound data transfer - data leaving an Azure region for the public internet or for a different Azure region. Azure meters and bills most egress, whereas data ingress (data coming into Azure) is generally free. That is why the bank sees egress charges: the cost reflects data moving out of Azure, not data that is stored, ingested, or processed in place. Knowing the direction of the data flow is the key to predicting and controlling network transfer costs.

   Why the other options are wrong

   • AData moving into Azure is ingress, which is generally free; egress refers specifically to data leaving Azure, which is what incurs the charge.
   • CData written to Blob Storage is a storage capacity charge, not a data-transfer charge; egress is about movement of data out of Azure.
   • DData processed by compute services is a compute cost, not a transfer cost; egress specifically measures data flowing out of Azure.

How Describe Azure Management and Governance is tested

This domain holds 340 of the 972 questions in the AZ-900 bank, about 35%. The mix is 235 single-answer multiple choice, 44 true/false, 35 multiple-response, 9 yes/no scenario, 9 hotspot and 8 ordering, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Describe Azure Management and Governance on its own rather than re-running full-length mocks.

Other AZ-900 exam domains

• Describe Cloud Concepts292 questions
• Describe Azure Architecture and Services340 questions
• All AZ-900 practice questions972 total
• Describe Azure Management and Governance study notesKey concepts
• Microsoft practice examsAll Microsoft

AZ-900 Describe Azure Management and Governance FAQ