Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure Policy Governance Enforcement and Compliance Auditing
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise wants to establish comprehensive cloud governance across its Azure subscriptions. The IT management team needs a solution that automatically enforces corporate standards, such as restricting deployments to approved resource sizes to control costs, blocking insecure resource configurations, and continuously evaluating overall compliance in real time.
Which Azure service should the enterprise implement to meet these governance requirements?
Explanations
Azure Role-Based Access Control (Azure RBAC)
Azure Role-Based Access Control (Azure RBAC)
What Azure RBAC Is
Azure Role-Based Access Control (Azure RBAC) is an authorization system built on Azure Resource Manager that manages user permissions by granting granular access to Azure resources based on user roles and responsibilities.
Why It Doesn't Meet the Requirement
While Azure RBAC controls who can perform actions on resources (e.g., who has permission to create a storage account or virtual machine), it does not evaluate resource properties or enforce configuration rules. For example, if a user has the Contributor role, Azure RBAC allows them to deploy any virtual machine size or storage configuration, even if it violates corporate cost or security standards.
Key Characteristics and Limitations
- Focuses on identity authorization: Manages user, group, and service principal permissions rather than resource configurations.
- No configuration evaluation: Cannot inspect or restrict specific resource properties (such as encryption settings or allowed SKUs).
- No compliance scoring: Does not audit running resources against regulatory frameworks like CIS or FedRAMP.
This Answer Would Be Correct If
The organization needed to restrict deployment access to authorized administrators and enforce the principle of least privilege for user accounts.
Azure Policy
Azure Policy
What Azure Policy Is
Azure Policy is a dedicated governance service in Microsoft Azure designed to create, assign, and manage policy definitions across Azure environments. It evaluates your cloud resources against defined business rules and conventions to maintain consistent security, cost management, and regulatory compliance.
How It Meets the Requirements
- Continuous evaluation and enforcement: Azure Policy continuously assesses existing resources and evaluates new deployment requests in real time. If a deployment request violates an established rule (such as creating an unapproved virtual machine size), Azure Policy can immediately deny the operation.
- Cost management: By assigning built-in or custom policies such as allowed resource SKUs, organizations prevent the creation of excessively expensive resource sizes.
- Security and regulatory compliance: Policies enforce standards like requiring infrastructure encryption, disabling public endpoints, or auditing non-compliant configurations against benchmarks such as CIS Microsoft Azure Foundations and FedRAMP.
Key Advantages and Capabilities
- Real-time enforcement: Blocks non-compliant deployment requests before resources are provisioned in the control plane.
- Continuous compliance auditing: Continuously checks running resources and reports non-compliant assets across subscriptions.
- Automated remediation: Automatically applies tags or deploys required configurations using
DeployIfNotExistsandModifyeffects. - Broad scope management: Can be assigned across Management Groups, Subscriptions, or specific Resource Groups.
Why This Is Optimal
Azure Policy operates at the control plane level via Azure Resource Manager (ARM), ensuring centralized, proactive governance without requiring custom scripts or manual approval gates.
Azure Key Vault
Azure Key Vault
What Azure Key Vault Is
Azure Key Vault is a centralized cloud service for securely storing and managing application secrets, encryption keys, and SSL/TLS certificates.
Why It Doesn't Meet the Requirement
Azure Key Vault provides secure key management and cryptography services, but it is not a governance or compliance management engine. It cannot evaluate resource deployments, prevent oversized resource deployments to control costs, or enforce organization-wide compliance standards.
Key Characteristics and Limitations
- Secrets management: Securely stores tokens, passwords, database connection strings, and API keys.
- Key lifecycle management: Creates and manages encryption keys (such as customer-managed keys) used by storage or automation services.
- Certificate management: Manages the provisioning, rotation, and deployment of public and private certificates.
- No policy enforcement capability: Cannot audit or deny resource creation based on configuration properties across an Azure tenant.
This Answer Would Be Correct If
The organization required a secure repository to store database connection strings, cryptographic keys, and SSL certificates with automated lifecycle rotation.
Azure Rights Management
Azure Rights Management
What Azure Rights Management Is
Azure Rights Management (part of Microsoft Purview Information Protection) is a cloud-based protection service that uses encryption, identity, and authorization policies to secure files and email messages across devices.
Why It Doesn't Meet the Requirement
Azure Rights Management protects document content and communications (data-level protection) rather than Azure cloud infrastructure resources. It cannot restrict infrastructure deployments, enforce Azure resource configurations, or provide continuous compliance auditing for cloud resources.
Key Characteristics and Limitations
- Document and email protection: Applies persistent encryption and access restrictions to sensitive files, emails, and Office documents.
- Cross-platform document access: Enforces access permissions on Windows, macOS, iOS, and Android client devices.
- Information tracking: Tracks document usage and enables administrators to revoke access to encrypted files after they leave organizational boundaries.
- No infrastructure governance: Does not interact with Azure Resource Manager control plane policies or cloud resource configurations.
This Answer Would Be Correct If
The enterprise needed to encrypt corporate documents and prevent unauthorized external recipients from viewing sensitive financial spreadsheets or emails.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Compliance Enforcement
Describe the purpose of Azure Policy
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Remediation Tasks
Describe the purpose of Azure Policy
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Initiative Definition
Describe the purpose of Azure Policy
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy Allowed Locations Built-In
Describe the purpose of Azure Policy
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Key Vault HSM Keys
Describe platform as a service (PaaS)
ExpertAZ-305 Designing Microsoft Azure Infrastructure Solutions Exam
Azure Monitor Cost Optimization Design
Recommend a monitoring solution
Last updated Validated