Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Enforcing Regional Compliance with Azure Policy
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise is setting up its cloud governance framework in Azure to maintain regulatory compliance across multiple departments.
The security and governance team has established the following requirements:
- Prevent deployments of virtual machines and storage accounts in unapproved geographic regions
- Automatically scan, identify, and report on existing resources that do not adhere to company configuration standards
- Ensure governance rules applied at the subscription level are inherited by all resource groups and underlying resources
Which Azure management tool should the organization implement to enforce these compliance standards?
Explanations
Azure Policy
Azure Policy
What Azure Policy Is
Azure Policy is a dedicated governance and compliance management service in Azure that enables organizations to define, assign, and manage business rules and standards across cloud environments. By evaluating resource properties against user-defined or built-in rules, Azure Policy ensures that newly created and existing resources stay compliant with corporate and regulatory standards.
How It Meets the Requirements
- Preventing unapproved configurations: Azure Policy can block the provisioning of resources in non-allowed regions through enforcement effects like
deny, preventing non-compliant deployments before they occur. - Scanning and reporting compliance: It continuously evaluates deployed resources to identify non-compliant items and generates real-time compliance dashboards and state reports.
- Scope and inheritance: When assigned at higher levels of management hierarchy—such as a management group or subscription—policies are automatically inherited across all child resource groups and individual resources.
Key Advantages and Capabilities
- Real-time evaluation: Evaluates requests during resource deployment through the Azure Resource Manager control plane.
- Built-in policy definitions: Includes pre-configured templates for common standards, such as allowed locations, allowed VM SKUs, and required tags.
- Automated remediation: Can automatically modify or deploy missing extensions and configurations on non-compliant resources using
modifyordeployIfNotExistseffects. - Hierarchical scope application: Enables centralized compliance enforcement across enterprise subscriptions and workloads.
Why This Is Optimal
Unlike metadata tags or basic locks, Azure Policy actively validates and controls resource properties during lifecycle operations, making it the premier tool for establishing guardrails and ensuring continuous regulatory compliance.
Resource Locks
Resource Locks
What Resource Locks Are
Resource locks are protection mechanisms applied via Azure Resource Manager to prevent unauthorized or accidental modifications and deletions of critical Azure resources. They offer two primary levels of protection: CanNotDelete (preventing deletion) and ReadOnly (preventing modification and deletion).
Why It Doesn't Meet the Requirement
Resource locks protect resources from being altered or deleted once they are deployed, but they cannot evaluate resource configurations against organizational rules, restrict resource deployments to specific geographical locations, or generate compliance reports.
Key Characteristics and Limitations
- Focused on accidental destruction: Designed specifically to prevent accidental deletion or configuration tampering on critical infrastructure.
- Binary states: Applies broad
ReadOnlyorCanNotDeleterestrictions rather than granular rule evaluations. - No regional enforcement: Cannot validate or enforce acceptable deployment locations or resource parameters.
This Answer Would Be Correct If
This option would be correct if an administrator needed to ensure that a critical production database or core virtual network could not be accidentally deleted by team members.
Additional Context
Like policies, resource locks are inherited by child resources from parent scopes, but their purpose remains strictly disaster and deletion prevention.
Azure Update Manager
Azure Update Manager
What Azure Update Manager Is
Azure Update Manager is a management solution designed to monitor, govern, and deploy operating system updates and security patches across Windows and Linux virtual machines running in Azure, on-premises, or across multicloud environments.
Why It Doesn't Meet the Requirement
Although Azure Update Manager contributes to security by keeping operating systems patched against known vulnerabilities, it operates inside the guest OS layer for patch management. It does not govern Azure control plane deployments, enforce approved deployment regions, or evaluate infrastructure-as-a-service configuration compliance.
Key Characteristics and Limitations
- Operating system focus: Primarily manages system patches, hotpatches, and software updates for server operating systems.
- No resource provisioning control: Does not restrict the creation of resources or validate architectural configuration settings across Azure services.
- Maintenance window scheduling: Focuses on scheduling automated guest patching and reboot cycles rather than general cloud governance.
This Answer Would Be Correct If
This option would be ideal if the requirement focused on scheduling recurring monthly OS security patches across a fleet of virtual machines without manual intervention.
Additional Context
Azure Update Manager actually integrates with Azure Policy to automate periodic update assessments at scale across enterprise machines.
Resource Tags
Resource Tags
What Resource Tags Are
Resource tags are metadata elements composed of key-value pairs that administrators attach to Azure resources, resource groups, or subscriptions. Their primary function is to help categorize, filter, and track resources for billing, organizational management, and department reporting.
Why It Doesn't Meet the Requirement
While resource tags provide descriptive metadata, they do not have enforcement capabilities on their own. Tagging a resource cannot block an administrator from deploying a virtual machine in an unauthorized geographic region, nor can tags autonomously evaluate and enforce organizational security configurations.
Key Characteristics and Limitations
- Informational only: Tags serve as descriptive labels and do not modify runtime behavior or deployment permissions.
- No inherent inheritance: Child resources do not automatically inherit tags applied to parent resource groups or subscriptions.
- No blocking mechanism: Tags cannot intercept provisioning requests to prevent non-compliant resource creation.
This Answer Would Be Correct If
This option would be the right choice if the enterprise needed to group cloud spending by department or track resource ownership across project teams for cost accounting.
Additional Context
Organizations frequently combine Azure Policy and resource tags by creating policies that require specific tags to exist before resource creation is permitted.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Portal
Describe the benefits of manageability in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Resource Manager Templates
Describe the benefits of manageability in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Autoscale
Describe the benefits of manageability in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Monitor
Describe the benefits of manageability in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Locally Redundant Storage
Describe redundancy options
ExpertAZ-305 Designing Microsoft Azure Infrastructure Solutions Exam
Azure Monitor Cost Optimization Design
Recommend a monitoring solution
Last updated Validated