Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Declarative JSON Deployments with ARM Templates
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization wants to automate the deployment of multiple Azure services into a resource group across development, test, and production environments.
The solution must meet the following requirements:
- Use a declarative JSON format that defines the required infrastructure
- Support repeated, consistent deployments without manual configuration errors
- Automatically manage dependencies between related resources
Which Azure solution should the organization implement?
Explanations
Resource locks
Resource locks
What Resource Locks Are
Resource locks are governance controls configured on subscriptions, resource groups, or individual resources to safeguard cloud assets from accidental modification or deletion by administrators and users.
Why Resource Locks Do Not Meet the Requirement
Resource locks do not provide automated deployment capabilities, template processing, or dependency management:
- Locks are preventive controls applied after resources are already provisioned, not deployment tools.
- They do not interpret infrastructure definitions or create new cloud services.
- They enforce operational constraints (such as
ReadOnlyorCanNotDelete) rather than provisioning environments.
Key Characteristics and Limitations
- Accidental Deletion Prevention: Stops authorized users from deleting critical resources within a resource group.
- Modification Blocking: Prevents unwanted updates and configuration changes to protected infrastructure.
- Scope Inheritance: Inherited automatically by all child resources contained within the locked resource group or subscription.
This Answer Would Be Correct If
The organization needed a mechanism to prevent administrators from accidentally deleting or altering production databases or virtual networks within a resource group.
Additional Context
While resource locks are essential for protecting deployed resources, they operate entirely independently of the automation mechanisms used to deploy those resources.
Azure role-based access control (Azure RBAC)
Azure role-based access control (Azure RBAC)
What Azure Role-Based Access Control Is
Azure role-based access control (Azure RBAC) is an authorization system built on Azure Resource Manager that provides fine-grained access management to cloud resources.
Why Azure RBAC Does Not Meet the Requirement
Azure RBAC manages user and service identity permissions, not resource provisioning:
- RBAC evaluates whether an identity (user, group, or service principal) has permission to perform specific actions on a scope, such as reading, writing, or deleting resources.
- It does not contain declarative templates for spinning up virtual machines, storage accounts, or networking services.
- RBAC does not manage resource dependencies or automated environmental rollouts.
Key Characteristics and Limitations
- Principle of Least Privilege: Ensures users only receive the minimum permissions necessary to complete their job duties.
- Granular Scopes: Applies role assignments across management groups, subscriptions, resource groups, or individual resources.
- Built-in and Custom Roles: Supports standard roles (such as Owner, Contributor, and Reader) as well as customized permission sets.
This Answer Would Be Correct If
The organization needed to grant administrators permission to manage resources within a specific resource group without granting full access to the entire Azure subscription.
Additional Context
Users deploying ARM templates must have appropriate RBAC permissions (such as Contributor) on the target resource group to successfully create the defined infrastructure.
Azure Resource Manager (ARM) templates
Azure Resource Manager (ARM) templates
What Azure Resource Manager (ARM) Templates Are
Azure Resource Manager (ARM) templates are JavaScript Object Notation (JSON) files that define the infrastructure and configuration for your Azure solutions using declarative syntax. Rather than writing custom scripts that specify the step-by-step commands needed to build resources, you describe the desired end state of the infrastructure.
How ARM Templates Meet the Requirements
ARM templates directly solve the organization's need for automated and repeatable infrastructure deployments:
- Declarative Infrastructure: Templates allow teams to define all necessary services, configurations, and settings in standard JSON files.
- Repeatability and Consistency: Because ARM templates are idempotent, deploying the same template across development, testing, and production environments produces identical results without configuration drift.
- Dependency Management: Azure Resource Manager analyzes resource dependencies defined in the template, creating dependent items in the correct order while spinning up independent resources concurrently in parallel.
Key Advantages and Capabilities
- Infrastructure as Code (IaC): Enables development teams to version control, test, and share deployment definitions alongside application source code.
- Built-in Validation: Azure Resource Manager validates the template syntax and parameters before executing the deployment, minimizing failed mid-deployment states.
- Pre-deployment Visibility: Supports what-if operations that show what resources will be created, modified, or deleted before initiating changes.
- CI/CD Integration: Seamlessly integrates into automated release pipelines like Azure Pipelines and GitHub Actions.
Why This Is Optimal
ARM templates provide a native, fully supported automation engine within Azure that eliminates manual portal interaction, standardizes resource group configurations, and guarantees reliable multi-environment provisioning.
Resource tags
Resource tags
What Resource Tags Are
Resource tags are metadata key-value pairs assigned to Azure resources and resource groups to assist with asset organization, categorization, and reporting.
Why Resource Tags Do Not Meet the Requirement
Resource tags cannot deploy or automate resources within Azure:
- Tags store descriptive metadata (such as
Environment: ProductionorCostCenter: IT), but have no execution engine or declarative provisioning capabilities. - Tagging does not automate resource creation, manage complex infrastructure dependencies, or maintain deployment templates.
Key Characteristics and Limitations
- Metadata Association: Labels resources with useful business and technical context.
- Cost Allocation: Allows organizations to track and categorize expenditures by project, department, or owner.
- Search and Filter: Simplifies finding and grouping related resources in the Azure portal and management scripts.
This Answer Would Be Correct If
The organization needed to categorize resources by cost center, environment type, or business unit for reporting and billing purposes.
Additional Context
Resource tags can be declared inside ARM templates to ensure that deployed resources receive standard organizational metadata automatically during creation, but tags themselves do not deploy infrastructure.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Group
Describe Azure resources and resource groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
New-AzResourceGroup Cmdlet
Describe Azure resources and resource groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC and Azure Policy
Describe Azure resources and resource groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Blob Storage
Describe Azure resources and resource groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Virtual Network Peering
Describe virtual networking, including the purpose of Azure virtual networks, subnets, peering, Azure DNS, Azure VPN Gateway, and ExpressRoute
IntermediateAZ-800 Administering Windows Server Hybrid Core Infrastructure Exam
Azure File Sync Event Logs and Azure Monitor
Configure and manage Azure File Sync
Last updated Validated