Cost Management and Governance — Azure AZ-900 Fundamentals practice questions

Which BEST separates the roles of RBAC, Azure Policy and resource locks?

1. RBAC governs who acts, Policy what is allowed, locks stop deletes
2. All three enforce identical rules and can be swapped for each other
3. Azure Policy is the feature that assigns roles to users and groups
4. Resource locks are the primary way to tag resources for reporting

Answer: A — RBAC governs who acts, Policy what is allowed, locks stop deletes

A) Correct — the three are complementary: authorisation, configuration compliance and protection against accidental removal. B) Each addresses a different risk. C) Role assignment is an RBAC function. D) Tagging is metadata and unrelated to locks.

An Azure Policy initiative is BEST described as:

1. A grouping of related policy definitions assigned and tracked together
2. A single role assignment granting a user rights over a subscription
3. A lock that prevents a resource group from being deleted by mistake
4. A catalogue of virtual machine sizes available in a chosen region

Answer: A — A grouping of related policy definitions assigned and tracked together

A) Correct — an initiative bundles many definitions so they are assigned once and reported as a single compliance result. B) That is an RBAC assignment. C) That is a CanNotDelete resource lock. D) SKU availability is not a governance artefact.

Which activity is BEST supported by cost analysis in the Azure portal?

1. Estimating the price of an architecture that has not been built
2. Blocking resource creation in an unapproved region
3. Recovering charges already invoiced in a prior period
4. Breaking down accrued spend by resource group, service and tag

Answer: D — Breaking down accrued spend by resource group, service and tag

D) Correct — cost analysis slices actual and forecast spend by dimensions such as scope, service, location and tag so owners can see where money goes. A) Pre-build estimation is the pricing calculator's job. B) Restricting where resources may be created is an Azure Policy control. C) Cost analysis reports on charges; it is not a billing dispute or refund mechanism.

Microsoft Purview is best described as:

1. A SIEM tool
2. A networking service
3. An identity platform
4. Unified data governance — catalog, classify, manage sensitive data across cloud + on-prem + multicloud

Answer: D — Unified data governance — catalog, classify, manage sensitive data across cloud + on-prem + multicloud

A) Sentinel is SIEM. D) Correct — Purview unifies data governance: discover, classify, label, and protect sensitive data wherever it lives. C) That's Entra ID. B) Not a network product.

Which statement about Azure Policy and Azure RBAC is MOST accurate?

1. Policy controls what actions a user may take; RBAC controls resource properties
2. Both evaluate identity claims and are interchangeable in most designs
3. Policy governs resource properties; RBAC governs who may perform actions
4. Policy applies only to management groups; RBAC applies only to resources

Answer: C — Policy governs resource properties; RBAC governs who may perform actions

C) Correct — the clean split is that RBAC answers who is allowed to act, while policy answers what the resulting resource configuration is allowed to look like. A) Reverses the two, which is the most frequent confusion between them. B) Policy does not evaluate identity at all, so they solve different problems and are not substitutes. D) Both can be assigned at management group, subscription, resource group and resource scope.

An architect lists the factors that drive Azure cost. Which of the following has the LEAST direct effect on the bill?

1. The number of resource groups used for organization
2. The region in which each resource is deployed
3. The volume of data leaving an Azure region each month
4. The service tier chosen for a managed database

Answer: A — The number of resource groups used for organization

A) Correct — resource groups are a free organizational container; how many you create does not change consumption charges. B) Regional pricing genuinely differs because of local energy, labor and facility costs. C) Outbound data transfer is metered and is a classic source of surprise charges. D) Tier selection sets compute, storage and feature levels and is one of the largest cost levers available.

Cost analysis in Azure's cost management capabilities lets a customer:

1. Track actual spend and forecast future cost across selected scopes
2. Store application secrets and certificates in a hardened key store
3. Filter inbound and outbound traffic with network security group rules
4. Create user accounts and reset the passwords that they sign in with

Answer: A — Track actual spend and forecast future cost across selected scopes

A) Correct — cost analysis breaks down charges by scope, service and tag, and projects the trend forward. B) That is Azure Key Vault. C) That is a networking control. D) That is identity administration.

Azure Hybrid Benefit applies to which licences?

1. Windows Server and SQL Server licences covered by Software Assurance
2. Microsoft 365 subscriptions covering email and collaboration apps
3. Visual Studio subscriptions held by individual application developers
4. Power BI Pro licences assigned to business analysts in the tenant

Answer: A — Windows Server and SQL Server licences covered by Software Assurance

A) Correct — the benefit lets qualifying Windows Server and SQL Server licences offset the licence portion of Azure compute cost, and certain Linux subscriptions qualify too. B, C and D) Those are user or seat licences and carry no infrastructure entitlement.

Azure Reservations save money by:

1. Refunding unused capacity
2. Pay-as-you-go discounts
3. Committing to 1- or 3-year term for fixed resources, prepaid
4. Buying physical hardware

Answer: C — Committing to 1- or 3-year term for fixed resources, prepaid

A) Reservations don't refund. B) That's PAYG, the BASELINE. C) Correct — 1- or 3-year commitment for VMs/SQL/etc. with up to ~72% savings vs PAYG. D) Reservations don't buy hardware.

The Zero Trust model is BEST summarised as:

1. Verify explicitly, use least privilege, and assume breach at all times
2. Trust every request that originates inside the corporate network edge
3. Encrypt all stored data and consider the environment fully secured
4. Replace identity controls with firewall rules at the network boundary

Answer: A — Verify explicitly, use least privilege, and assume breach at all times

A) Correct — those three principles are the core of Zero Trust: authenticate every request, grant the minimum access needed and design as though an attacker is already inside. B) Implicit trust inside the perimeter is exactly what Zero Trust rejects. C) Encryption is one layer of defence in depth, not the whole model. D) Zero Trust strengthens identity rather than discarding it.

Spot VMs — savings vs reliability?

Up to ~90% off on-demand. Azure can evict with 30-sec notice when capacity needed. Best for batch/dev workloads.

Azure Hybrid Benefit?

Use existing Windows Server/SQL Server licenses with Software Assurance to save on Azure VM costs.

Microsoft Purview?

Unified data governance — catalog, classify, manage sensitive data across Azure + on-prem + multicloud.

Name the two Azure resource lock types and state their effect and their limitation.

CanNotDelete allows reading and modification but blocks deletion. ReadOnly allows reading only, blocking both modification and deletion. Locks are inherited by child resources and apply to everyone regardless of RBAC role, so an owner must remove the lock before deleting — but locks do nothing about actions inside the resource, such as data written to a database.