Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure Policy Regulatory Compliance Enforcement
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
A financial enterprise is deploying infrastructure across multiple Azure subscriptions. The security and governance team must ensure that all deployed cloud resources consistently comply with industry standards (such as CIS benchmarks and ISO certifications).
The team requires a built-in governance solution that can evaluate resource properties against specific compliance controls, flag non-compliant resources, and automatically enforce or remediate configurations.
Which Azure service should the enterprise implement to meet these regulatory compliance requirements?
Explanations
Azure Cost Management
Azure Cost Management
What Azure Cost Management Is
Azure Cost Management (part of Microsoft Cost Management) is a financial governance and monitoring tool suite that helps organizations analyze, track, and optimize their cloud expenditures.
Why It Doesn't Meet the Requirement
Azure Cost Management focuses on cloud economics rather than technical configurations or regulatory frameworks. It cannot evaluate whether cloud resources satisfy security benchmarks, encrypt data, or adhere to compliance standards.
Key Characteristics and Limitations
- Financial tracking and budgets: Generates cost allocation reports, budget thresholds, and spending alerts.
- Cost anomaly detection: Highlights unexpected spending spikes or underutilized resources.
- Lacks configuration governance: Cannot block unapproved resource creation or audit security properties such as access control policies or network filtering.
This Answer Would Be Correct If
The scenario required the finance or IT team to establish departmental budgets, monitor monthly cloud spend, and receive automated billing threshold alerts.
Additional Context
Financial governance and regulatory compliance governance are distinct disciplines in cloud architecture; Cost Management addresses financial tracking, whereas compliance requires configuration policy engines.
Azure Policy
Azure Policy
What Azure Policy Is
Azure Policy is a core cloud governance service designed to create, assign, and manage resource configuration rules across Azure environments. It continuously evaluates cloud resources against predefined organizational standards and regulatory frameworks to maintain operational integrity.
How It Meets the Compliance Requirements
Azure Policy directly solves compliance challenges by offering built-in regulatory compliance initiatives mapped to international and industry standards such as CIS Microsoft Azure Foundations Benchmark, ISO 27001, PCI DSS, and NIST. Key operational capabilities include:
- Evaluating resource configurations: Automatically scanning resource properties during deployment and at scheduled intervals.
- Auditing and alerting: Flagging non-compliant configurations (such as unencrypted storage or subnets missing network security groups) in real-time dashboards.
- Preventing and remediating: Enforcing policies via
Denyeffects to block non-compliant deployments or usingDeployIfNotExists/Modifyeffects to remediate configurations automatically.
Key Advantages and Capabilities
- Regulatory compliance dashboards: Provides dedicated compliance views showing how resources align with specific regulatory domains and controls.
- Centralized governance at scale: Allows policies and policy initiatives to be assigned at management group, subscription, or resource group scopes.
- Continuous compliance monitoring: Evaluates existing resources periodically to detect and remediate configuration drift.
- Rich built-in library: Includes hundreds of pre-configured policy definitions for compute, networking, data protection, and identity.
Why This Is Optimal
Azure Policy operates natively within Azure Resource Manager (ARM), providing proactive governance before resources are created without requiring third-party management tools or custom agent installations.
Azure ExpressRoute
Azure ExpressRoute
What Azure ExpressRoute Is
Azure ExpressRoute is a dedicated private connectivity service that connects on-premises networks directly to Microsoft cloud services over a private connection facilitated by a connectivity provider.
Why It Doesn't Meet the Requirement
While ExpressRoute enhances network security by avoiding the public internet, it has no functionality related to evaluating resource configurations, tracking industry compliance frameworks, or enforcing governance policies.
Key Characteristics and Limitations
- Private network connectivity: Establishes Layer 3 private circuits between customer data centers and Azure datacenters.
- No governance or auditing capabilities: Cannot inspect or govern how Azure resources (such as virtual machines, storage accounts, or firewalls) are configured.
- Network infrastructure layer: Focuses entirely on throughput, reliability, and low-latency network transit.
This Answer Would Be Correct If
The organization required a private, high-speed, and dedicated connection between their on-premises datacenter and Azure that bypasses the public internet entirely.
Additional Context
Although configuring secure networking can contribute toward overall security objectives, ExpressRoute itself is purely transport infrastructure and cannot audit or enforce compliance controls.
Azure Load Balancer
Azure Load Balancer
What Azure Load Balancer Is
Azure Load Balancer is a high-performance, ultra-low-latency Layer 4 (TCP/UDP) traffic distribution service designed to distribute incoming network traffic across healthy backend instances.
Why It Doesn't Meet the Requirement
Azure Load Balancer is a traffic routing mechanism, not a governance or compliance monitoring tool. It cannot audit resource configurations, enforce corporate standards, or generate compliance reports against industry benchmarks.
Key Characteristics and Limitations
- Layer 4 traffic routing: Balances traffic based on IP address, port, and protocol without inspecting payload content or resource settings.
- High availability and health probes: Redirects traffic away from failed nodes to ensure service availability.
- No policy evaluation engine: Cannot enforce security baselines or evaluate compliance status across Azure subscriptions.
This Answer Would Be Correct If
The team needed to distribute incoming web or network traffic across a scalable pool of backend virtual machines to achieve high availability and fault tolerance.
Additional Context
While a load balancer can be a resource subject to compliance policies (e.g., auditing whether health probes are enabled), it cannot enforce compliance across other cloud resources.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Policy
Describe the benefits of security and governance in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Key Vault
Describe the benefits of security and governance in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Sentinel
Describe the benefits of security and governance in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure RBAC
Describe the benefits of security and governance in the cloud
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
IaaS Maximum Control Over Infrastructure
Identify appropriate use cases for each cloud service type (IaaS, PaaS, and SaaS)
IntermediateAZ-204 Developing Solutions for Microsoft Azure Exam
Azure Blob System Properties vs User-Defined Metadata
Set and retrieve properties and metadata
Last updated Validated