Describe Azure management and governance
Domain 3 of AZ-900 accounts for 30-35% of the exam. EarnYourCert has 153 original questions for this domain, all with explanations: 101 multiple choice, 25 yes/no and 27 completion or ordering items, like the real exam.
What this domain covers
- Cost factors, pricing calculator and Cost Management
- Tags, Azure Policy and resource locks
- Microsoft Purview for data governance
- Portal, Cloud Shell, CLI, PowerShell, Azure Arc and ARM or Bicep templates
- Azure Advisor, Service Health and Azure Monitor
Domain 3 sample questions
8 questions from our 153-question bank for this domain. Try to answer before revealing the solution.
1. A finance team needs to automatically generate a file each month with detailed Azure cost data to load into their accounting system, without manually logging into the portal. Which Microsoft Cost Management feature should they configure?
- Azure Advisor with cost recommendations based on analysis of historical CPU and memory usage of VMs
- A Microsoft Cost Management budget with automatic email alerts when the threshold is exceeded
- A scheduled cost data export to a storage account
- The Azure pricing calculator for estimating the monthly cost of services before deploying them
Show answer
Correct answer: C. Microsoft Cost Management exports let you schedule the periodic (daily, weekly, or monthly) generation of files with detailed cost data and automatically save them to a storage account, from which other systems can consume them. A budget only triggers alerts when a threshold is exceeded, it doesn't export detailed data; Azure Advisor provides recommendations, and the pricing calculator estimates future costs, not historical ones.
2. A company with on-premises SQL Server workloads, with licenses covered by Software Assurance, plans to migrate those databases to Azure SQL Database. Which benefit lets it reduce Azure compute costs by reusing those licenses?
- Azure Hybrid Benefit
- A Spot VM
- Dev/Test pricing
- A storage savings plan
Show answer
Correct answer: A. Azure Hybrid Benefit allows customers with SQL Server or Windows Server licenses covered by Software Assurance (or equivalent subscriptions) to apply those licenses to Azure resources such as Azure SQL Database or virtual machines, significantly reducing compute costs. Spot VMs offer discounts on unused capacity unrelated to licensing, Dev/Test pricing is limited to development and test environments, and there is no such thing as a 'storage savings plan' in Azure.
3. A company wants to identify virtual machines that are underutilized and could be resized to reduce costs, based on historical CPU and memory usage. Which tool should it consult first?
- The Azure pricing calculator for comparing the theoretical cost of different VM sizes in each region
- Azure Advisor, in its cost recommendations section
- The Service Trust Portal for reviewing Microsoft audit reports and security certifications
- Azure Blueprints for deploying standardized environments with predefined policies and role assignments
Show answer
Correct answer: B. Azure Advisor analyzes the configuration and usage patterns of deployed resources and, in its cost category, suggests actions like resizing or shutting down underutilized VMs to save money. The pricing calculator is used to estimate costs before deployment, not to analyze existing resources; Azure Blueprints is used to define governance templates; and the Service Trust Portal provides compliance documentation, not cost optimization recommendations.
4. A European company needs to ensure that its handling of customers' personal data complies with the GDPR. What type of requirement does this primarily describe?
- A requirement related only to virtual machine sizing
- A requirement exclusively related to network performance
- A compliance requirement related to data protection
- A requirement that only affects local backups
Show answer
Correct answer: C. The GDPR is a data protection regulation that imposes compliance requirements on how personal data is collected, stored, and processed, which organizations must consider when using cloud services.
5. A resource group contains a critical production database. An administrator applies a 'ReadOnly' lock to that resource group. What effect does this have on operations that other users with Contributor permissions can perform?
- The ReadOnly lock does not affect users with the Contributor role; it only restricts users with the Reader role
- Users with the Contributor role can still modify resource configurations, but cannot delete them
- Users with the Contributor role can delete resources individually, but cannot modify their configuration
- They won't be able to modify or delete any resource in the group, even though RBAC grants them Contributor permissions
Show answer
Correct answer: D. A 'ReadOnly' lock operates independently of RBAC: it prevents any modify or delete operation on the resources within the locked scope, regardless of what RBAC permissions the user has, even administrators. This contrasts with 'CanNotDelete', which only prevents deletion but allows modification. The lock applies to all users, not just those with the Reader role.
6. What does Azure Monitor autoscale allow you to configure for a virtual machine scale set?
- The default language of the virtual machines
- Rules that scale instances by metrics or schedule
- The encryption of the scale set's disks
- The tags applied to the entire subscription
Show answer
Correct answer: B. Azure Monitor autoscale allows defining rules that add or remove instances of a scale set based on metrics, such as CPU usage, or on a time-based schedule.
7. A developer writes a Bicep file to define a storage account, a virtual network, and a virtual machine. What happens to that file before Azure Resource Manager processes it?
- It is transpiled (compiled) into a JSON-based ARM template, which is what Resource Manager ultimately processes
- It is automatically converted into an Azure Automation runbook executable in a PowerShell 7 environment
- It is executed directly as a PowerShell script with no prior transformation by Azure
- Azure Resource Manager natively interprets Bicep code without conversion thanks to the bicep-runtime module
Show answer
Correct answer: A. Bicep is a declarative language with simplified syntax that gets transpiled into a JSON-based ARM template; it's that resulting JSON template that Azure Resource Manager actually processes to deploy the resources. It is not executed as a PowerShell script, it's not converted into a runbook, and although the process is transparent to the user, Resource Manager still internally works with JSON, not Bicep directly.
8. An engineer configures diagnostic settings on a storage account to send activity logs to a Log Analytics workspace. What is primarily achieved with this configuration?
- Access to the storage account is restricted to allow connections only from internal IP ranges
- A daily backup copy of all data stored in the Blob Storage account is automatically created
- Additional encryption with customer-managed keys in Azure Key Vault is applied to all data at rest
- The resource's platform logs are routed to a destination where they can be queried, analyzed, and used for alerts or dashboards
Show answer
Correct answer: D. Diagnostic settings let you route a resource's platform logs (for example, activity logs or metrics) to destinations such as a Log Analytics workspace, a storage account, or Event Hubs, where the data can be queried with KQL, visualized in workbooks, or used as the basis for alerts. They don't create backup copies of the resource's data, they don't apply additional encryption, and they aren't a network restriction mechanism.