AZ-900 - Describe Azure Management and Governance (35% of the exam) - Section 3.2

Describe features and tools for governance and compliance including Azure Policy, resource locks, and the Service Trust Portal.

Describe how Azure Policy enforces organisational standards by evaluating resources against defined rules, how resource locks prevent accidental modification or deletion, and how the Service Trust Portal supplies compliance documentation for regulatory frameworks. Recognise the role of Microsoft Purview in cataloguing and governing data across the estate.

Azure Policyresource locksService Trust PortalMicrosoft PurviewAzure Blueprints

Practice question for this objective

Free sampleDescribe Azure Management and Governancemedium

An organisation runs Linux servers in its own datacentre and a fleet of virtual machines in a competing public cloud. It wants to manage and govern all of them through Azure Resource Manager as though they were native Azure resources. Which Azure tool delivers this?

AAzure Resource Manager applied directly to the servers
BAzure Arc, which projects those resources into ARM Correct
CARM templates describing the external machines in JSON
DAzure Cloud Shell connecting out to each remote host

Azure Arc projects on-premises and other-cloud resources into Azure Resource Manager so they are managed like native Azure resources. Azure Arc works with Azure Resource Manager to extend Azure compliance and monitoring across hybrid and multicloud configurations, projecting non-Azure servers, Kubernetes clusters, and databases into ARM so they can be managed as if they ran in Azure.

Why A is wrong: Azure Resource Manager is the management layer that processes Azure requests, but on its own it does not reach out to on-premises or other-cloud machines until something projects them into it.

Why B is correct: Correct. Azure Arc works with Azure Resource Manager to extend Azure compliance and monitoring across hybrid and multicloud configurations, projecting non-Azure servers, Kubernetes clusters, and databases into ARM so they can be managed as if they ran in Azure.

Why C is wrong: ARM templates declare desired Azure resources in JSON for deployment, but they do not onboard existing on-premises or rival-cloud machines into Azure for ongoing management.

Why D is wrong: Azure Cloud Shell gives you a browser command line for issuing Azure commands, but it does not project external infrastructure into Azure Resource Manager for unified governance.

See more AZ-900 practice questions, answers explained.

Exam traps in Describe Azure Management and Governance

Answers that look right on this material and are not. Each one is a distractor from a different question in the AZ-900 bank for this domain.

Resource locks, which guard resources from accidental deletion or changes
Why it is wrong: Resource locks protect existing resources from being deleted or modified, which a prepared candidate may associate with prevention, but they place no rules on what configuration a new resource may have, so they cannot block a disallowed VM size.
Azure Policy, to audit each data store's configuration for compliance
Why it is wrong: Azure Policy controls and audits resource configurations against rules, but it works on resource settings rather than discovering, classifying, or tracing the lineage of the data held inside those stores.
Azure Policy, which governs Azure resource configuration, not data
Why it is wrong: Azure Policy enforces rules on Azure resource configurations, which is a governance service, but it operates on resource settings rather than mapping and classifying the data estate, so it does not give a unified view of data.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.