___________________________________________________________________
AZ-900 Cloud Governance & Compliance
Practice Test 2 2026–2027 | 100 Hard
Scenario Questions, Answers & Detailed
Rationales
1. A multinational company has 40 Azure subscriptions divided among
finance, engineering, and research. Corporate security wants one policy
requiring approved Azure regions across all subscriptions. The subscriptions
should remain independently managed. What is the best governance
design?
A. Put every resource into one resource group
B. Create a management-group hierarchy and assign the policy at the appropriate
management-group scope
C. Create a separate Azure Policy for every resource
D. Use resource locks on every subscription
Answer: Create a management-group hierarchy and assign the policy at the
appropriate management-group scope
Rationale: Management groups provide governance scope above subscriptions,
allowing policies to be inherited by many subscriptions without combining their
resources.
, 2. A company wants development subscriptions to permit East US and West
Europe, while production subscriptions may use only East US. Which Azure
capability makes one policy definition reusable with different allowed-
region values?
A. Resource locks
B. Policy parameters
C. Resource tags
D. Azure Advisor
Answer: Policy parameters
Rationale: Policy parameters allow a reusable policy definition to accept
different values when assigned at different scopes.
3. A security team discovers that several existing storage accounts violate a
newly introduced organizational policy. The organization wants to identify
the violations without disrupting existing workloads. What should it do
first?
A. Use a Deny policy
B. Use an Audit policy
C. Apply a ReadOnly lock
D. Delete the resources
Answer: Use an Audit policy
Rationale: Audit allows the organization to discover existing noncompliance
before introducing enforcement that could affect workloads.
4. After several weeks of auditing, the organization confirms that all
production applications can comply with a required configuration. It now
wants to prevent future noncompliant deployments. Which policy effect is
most appropriate?
A. Audit
B. Deny
,C. Disabled
D. Append
Answer: Deny
Rationale: Deny prevents resource creation or modification when the requested
configuration violates the policy.
5. An administrator needs to require a particular tag on resources while also
correcting existing resources that lack the tag. Which Azure governance
capability is designed for this type of enforcement and remediation?
A. Azure Policy
B. Azure Service Health
C. Azure Advisor
D. Resource locks
Answer: Azure Policy
Rationale: Azure Policy can enforce tagging requirements and, with suitable
policy effects and remediation, help bring existing resources into compliance.
6. A company has separate policies for allowed locations, required tags,
approved VM SKUs, and diagnostic settings. The compliance team wants to
assign them as one logical governance package. What should it use?
A. Policy initiative
B. Resource group
C. Resource lock
D. Management subscription
Answer: Policy initiative
Rationale: An initiative groups related policy definitions so they can be managed
and assigned together.
, 7. A developer has sufficient Azure RBAC permissions to create virtual
machines but receives a policy-related deployment failure when selecting
an unapproved VM size. What is the most likely explanation?
A. Azure Policy is restricting the VM SKU
B. Resource tags removed the developer's permissions
C. Azure Advisor disabled the VM deployment
D. Microsoft Purview blocked the VM
Answer: Azure Policy is restricting the VM SKU
Rationale: RBAC determines whether a user can perform an operation, while
Azure Policy can determine whether the resulting resource configuration is
permitted.
8. A production database must remain modifiable by database administrators,
but accidental deletion must be prevented. Which lock is most
appropriate?
A. ReadOnly
B. CanNotDelete
C. Audit
D. Deny
Answer: CanNotDelete
Rationale: CanNotDelete prevents deletion while allowing authorized users to
modify the resource.
9. A critical configuration must not be modified or deleted by ordinary
administrative operations. Which lock is the strongest choice?
A. CanNotDelete
B. ReadOnly
C. Audit
D. Append
Answer: ReadOnly
AZ-900 Cloud Governance & Compliance
Practice Test 2 2026–2027 | 100 Hard
Scenario Questions, Answers & Detailed
Rationales
1. A multinational company has 40 Azure subscriptions divided among
finance, engineering, and research. Corporate security wants one policy
requiring approved Azure regions across all subscriptions. The subscriptions
should remain independently managed. What is the best governance
design?
A. Put every resource into one resource group
B. Create a management-group hierarchy and assign the policy at the appropriate
management-group scope
C. Create a separate Azure Policy for every resource
D. Use resource locks on every subscription
Answer: Create a management-group hierarchy and assign the policy at the
appropriate management-group scope
Rationale: Management groups provide governance scope above subscriptions,
allowing policies to be inherited by many subscriptions without combining their
resources.
, 2. A company wants development subscriptions to permit East US and West
Europe, while production subscriptions may use only East US. Which Azure
capability makes one policy definition reusable with different allowed-
region values?
A. Resource locks
B. Policy parameters
C. Resource tags
D. Azure Advisor
Answer: Policy parameters
Rationale: Policy parameters allow a reusable policy definition to accept
different values when assigned at different scopes.
3. A security team discovers that several existing storage accounts violate a
newly introduced organizational policy. The organization wants to identify
the violations without disrupting existing workloads. What should it do
first?
A. Use a Deny policy
B. Use an Audit policy
C. Apply a ReadOnly lock
D. Delete the resources
Answer: Use an Audit policy
Rationale: Audit allows the organization to discover existing noncompliance
before introducing enforcement that could affect workloads.
4. After several weeks of auditing, the organization confirms that all
production applications can comply with a required configuration. It now
wants to prevent future noncompliant deployments. Which policy effect is
most appropriate?
A. Audit
B. Deny
,C. Disabled
D. Append
Answer: Deny
Rationale: Deny prevents resource creation or modification when the requested
configuration violates the policy.
5. An administrator needs to require a particular tag on resources while also
correcting existing resources that lack the tag. Which Azure governance
capability is designed for this type of enforcement and remediation?
A. Azure Policy
B. Azure Service Health
C. Azure Advisor
D. Resource locks
Answer: Azure Policy
Rationale: Azure Policy can enforce tagging requirements and, with suitable
policy effects and remediation, help bring existing resources into compliance.
6. A company has separate policies for allowed locations, required tags,
approved VM SKUs, and diagnostic settings. The compliance team wants to
assign them as one logical governance package. What should it use?
A. Policy initiative
B. Resource group
C. Resource lock
D. Management subscription
Answer: Policy initiative
Rationale: An initiative groups related policy definitions so they can be managed
and assigned together.
, 7. A developer has sufficient Azure RBAC permissions to create virtual
machines but receives a policy-related deployment failure when selecting
an unapproved VM size. What is the most likely explanation?
A. Azure Policy is restricting the VM SKU
B. Resource tags removed the developer's permissions
C. Azure Advisor disabled the VM deployment
D. Microsoft Purview blocked the VM
Answer: Azure Policy is restricting the VM SKU
Rationale: RBAC determines whether a user can perform an operation, while
Azure Policy can determine whether the resulting resource configuration is
permitted.
8. A production database must remain modifiable by database administrators,
but accidental deletion must be prevented. Which lock is most
appropriate?
A. ReadOnly
B. CanNotDelete
C. Audit
D. Deny
Answer: CanNotDelete
Rationale: CanNotDelete prevents deletion while allowing authorized users to
modify the resource.
9. A critical configuration must not be modified or deleted by ordinary
administrative operations. Which lock is the strongest choice?
A. CanNotDelete
B. ReadOnly
C. Audit
D. Append
Answer: ReadOnly
