AZ-900 · Microsoft · Azure Management and Governance · Bank updated 2026-11-03
AZ-900 practice questions: Azure Management and Governance
5 free questions from 55 on this area · answer and explanation for each · no sign-up
These 5 questions come from the Azure Management and Governance section of our AZ-900 bank (55 questions on this area, which carries 33% of the real exam). Every question is original, with the correct answer explained and linked to the source it is drawn from.
Free: 6 questions in study mode, no card. All 55 Azure Management and Governance questions and the full AZ-900 bank: $15 one-time.
1/5 · Azure Management and Governance
A team buys a one-year reservation for the size of Windows virtual machine it runs continuously. Which change to its bill does Microsoft's documentation describe?
AThe compute and the Windows licence are both covered by the reservation.
BThe machines are reserved in the region and the licence is billed hourly.
CThe compute is discounted; the Windows licence continues to be charged.
DThe compute is discounted once the machines have been redeployed.
Answer: C. Bullet 'Describe factors that can affect costs in Azure'. The article 'What are Azure Reservations?' states that reservations provide a billing discount and don't affect the runtime state of your resources, and that after you purchase a reservation the discount automatically applies to matching resources. Under 'Charges covered by reservation' it states that a reserved virtual machine instance only covers the virtual machine and cloud services compute costs and doesn't cover additional software, Windows, networking or storage charges, and that for Windows virtual machines and SQL Database the reservation discount doesn't apply to the software costs, which can be covered with Azure Hybrid Benefit.
Source: Microsoft Learn - AZ-900 study guide: Describe Azure management and governance
2/5 · Azure Management and Governance
A pipeline deploys the same Resource Manager template on every merge, and the storage account it defines already exists with the properties written in the file. What does Microsoft's documentation say the next deployment does?
AIt creates a second storage account under a generated unique name.
BIt leaves the storage account as it is; no changes are made.
CIt fails validation and reports that the storage account already exists.
DIt deletes the storage account and creates it again from the file.
Answer: B. Bullet 'Describe infrastructure as code (IaC)'. The article 'Templates overview' states under 'Repeatable results' that you can repeatedly deploy your infrastructure throughout the development lifecycle and have confidence your resources are deployed in a consistent manner, that templates are idempotent, meaning you can deploy the same template many times and get the same resource types in the same state, and that for the storage account example given, if you deploy this template and the storage account with the specified properties already exists, no changes are made.
Source: Microsoft Learn - AZ-900 study guide: Describe Azure management and governance
3/5 · Azure Management and Governance · hard
A team deploys one Resource Manager template that defines a virtual network, a subnet inside it and three virtual machines attached to that subnet. Nobody has written any ordering logic into the file. What does Azure do with that deployment?
AIt runs the resources in the order in which the file lists them
BIt refuses the deployment until the dependencies are declared
CIt creates the resources one at a time, in alphabetical order
DIt creates the resources in the correct order, in parallel where it can
Answer: D. Bullet 'Describe Azure Resource Manager (ARM) and ARM templates'. The Learn unit 'Describe Azure Resource Manager and Azure ARM templates' states that Resource Manager templates describe desired Azure resources in declarative JSON, that Azure validates the template before deployment and then orchestrates resource creation in the right order and in parallel when possible, and that teams define the desired end state while Azure Resource Manager handles deployment execution. Orchestration - dependency order and parallel deployment handled automatically - is one of the listed benefits.
Source: Microsoft Learn - AZ-900 study guide: Describe Azure management and governance
4/5 · Azure Management and Governance
A team's Resource Manager template creates a storage account, and a certificate has to be imported onto a machine right after the deployment finishes. What does Learn say the template can do about that step?
ANothing; a declarative template cannot reach outside itself.
BNothing; the step belongs in a separate imperative deployment.
CIt can call a PowerShell or Bash script as part of the work.
DIt can hold the step until an operator confirms it by hand.
Answer: C. Bullet 'Describe infrastructure as code (IaC)'. The Learn unit 'Describe Azure Resource Manager and Azure ARM templates' states that Azure Resource Manager templates describe desired Azure resources in declarative JSON, that Azure validates the template and then orchestrates resource creation in the right order and in parallel when possible, and that 'templates can also call PowerShell or Bash deployment scripts when setup steps are needed before or after resource creation'. It lists extensibility, 'add deployment scripts when additional setup actions are required', among the benefits of templates.
Source: Microsoft Learn - AZ-900 study guide: Describe Azure management and governance
5/5 · Azure Management and Governance · hard
Some weeks after a key vault went live, an auditor asks for the record of each secret read from it. The vault was deployed from the team's standard template, which sets only its access policies and network rules. Which statement about the vault's resource logs holds?
AThey sit in the activity log for 90 days, free of charge
BThey weren't collected; that takes a diagnostic setting
CThey are kept in the vault's own Logs view for 30 days
DThey weren't collected; that takes the vault's Premium tier
Answer: B. Bullet 'Describe Azure Monitor, including Log Analytics'. The article 'Resource logs in Azure Monitor' states that resource logs 'provide insight into operations that are performed in an Azure resource' and, under 'Collecting resource logs': 'Resource logs aren't collected by default. To collect them, you must create a diagnostic setting for each Azure resource.' The article 'Activity Log in Azure Monitor' draws the line with this very example: 'In contrast to the activity log, Azure resource logs capture data plane operations performed within a resource. For example, these operations include getting a secret from a key vault or making a request to a database. Resource logs aren't collected by default and require configuration with a diagnostic setting.' It adds that 'The activity log doesn't typically capture read operations.' Reads of individual secrets are operations within the vault, so with no diagnostic setting in place there is no record of them to hand to the auditor.
Source: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/resource-logs
Other AZ-900 areas
The same kind of free sample for every other section of the AZ-900 bank:
Practise AZ-900 with instant feedback
6 free questions in study mode · no card · full AZ-900 bank with area filters and the error log: $15 one-time · no dumps, no ads.
Start AZ-900 free →
ExamDeck is an independent study tool, not affiliated with, endorsed by, or sponsored by Microsoft. AZ-900 and related marks are trademarks of their respective owners, used for identification only. Exam facts checked against official Microsoft materials (as of November 2026); always confirm current details with the vendor before booking.