Microsoft AZ-900 Practice Test 75

100% Latest & Updated Microsoft AZ-900 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!

Question 740

A regulated agency wants to prevent new resources in unapproved Azure regions. The team observes: Staff deploy resources outside approved regions despite policy documents. What should the team identify as the primary mechanism behind the problem?

It confused metadata governance with resource configuration enforcement.
The allowed-location policy was not assigned or enforced.
Infrastructure inventory was mistaken for enterprise data governance.
A parent-scope lock was inherited by the resource.

Explanation

Correct Answer

The allowed-location policy was not assigned or enforced. That explains the symptom: Staff deploy resources outside approved regions despite policy documents. The targeted corrective action is: Assign a policy with the intended effect and location list at appropriate scope.

Incorrect Answers

This cause is consistent with a different issue: The organization uses a data catalog but still permits prohibited Azure locations. It does not account for the reported symptom here: Staff deploy resources outside approved regions despite policy documents.

That explanation belongs to a different fault pattern: Teams find a VM inventory but no dataset lineage or glossary. It does not explain why staff deploy resources outside approved regions despite policy documents.

This cause is consistent with a different issue: A test cleanup fails although the individual resource shows no direct lock. It does not account for the reported symptom here: Staff deploy resources outside approved regions despite policy documents.

Question 741

A company wants to ensure newly deployed VMs have a required metadata tag. Which design choice best fits the stated business constraint?

Use Azure Policy to evaluate or enforce resource tagging conventions.
Differentiate data governance and classification from Azure resource configuration compliance.
Use Purview's supported data classification tools rather than deployment restrictions.
Consider a ReadOnly lock where the operational side effects are acceptable.

Explanation

Correct Answer

Use Azure Policy to evaluate or enforce resource tagging conventions. The governing requirement is: A company wants to ensure newly deployed VMs have a required metadata tag. This solution specifically supports the outcome that new deployments are compliant or remediated according to configured policy.

Incorrect Answers

That concept addresses this separate situation: A manager thinks Microsoft Purview is a replacement for Azure Policy. It does not by itself establish the result required here: New deployments are compliant or remediated according to configured policy.

This option solves a different planning problem: A data owner wants sensitive columns identified but not necessarily block resource creation. The current acceptance criterion is specific: New deployments are compliant or remediated according to configured policy.

This design is appropriate for a different requirement: A finance group wants to stop modifications and deletion of a frozen resource. Here the decisive outcome must instead be: New deployments are compliant or remediated according to configured policy.

Question 742

A company wants to ensure newly deployed VMs have a required metadata tag. Which Azure setup action best follows from this scenario?

Apply approved scanning/classification to the data sources.
Review both appropriate Defender recommendations and Policy compliance results.
Assign an appropriate tag policy effect for eligible resource types.
Create the deletion-protection lock with approved administrative ownership.

Explanation

Correct Answer

Assign an appropriate tag policy effect for eligible resource types. The implementation operationalizes this design choice: Use Azure Policy to evaluate or enforce resource tagging conventions. Acceptance should demonstrate: New deployments are compliant or remediated according to configured policy.

Incorrect Answers

This setup is relevant to another workload: A data owner wants sensitive columns identified but not necessarily block resource creation. The current configuration must instead achieve: New deployments are compliant or remediated according to configured policy.

That action implements a different requirement: A security committee wants a distinction between security posture recommendations and regulatory resource-policy compliance. It does not establish the required result in this case: New deployments are compliant or remediated according to configured policy.

This setup is relevant to another workload: An operations team wants to protect a critical resource from accidental deletion. The current configuration must instead achieve: New deployments are compliant or remediated according to configured policy.

Question 743

A company wants to ensure newly deployed VMs have a required metadata tag. Which verification outcome should the team expect from the right design?

New deployments are compliant or remediated according to configured policy.
Data classification and resource-policy checks have distinct owners and tools.
The audit separates remediation advice from enforceable policy outcomes.
An authorized user can have a role yet encounter a resource lock.

Explanation

Correct Answer

New deployments are compliant or remediated according to configured policy. That directly tests the stated requirement: A company wants to ensure newly deployed VMs have a required metadata tag. It contrasts with the observed failure: Many VMs lack required ownership metadata.

Incorrect Answers

That check tests another control: A manager thinks Microsoft Purview is a replacement for Azure Policy. The decisive result for this workload is: New deployments are compliant or remediated according to configured policy.

The test is relevant when a security committee wants a distinction between security posture recommendations and regulatory resource-policy compliance. It cannot establish the specified acceptance result: New deployments are compliant or remediated according to configured policy.

This observation is evidence for a separate scenario: An architect needs to explain how a resource lock differs from RBAC. It does not test the necessary outcome here: New deployments are compliant or remediated according to configured policy.

Question 744

A company wants to ensure newly deployed VMs have a required metadata tag. The team observes: Many VMs lack required ownership metadata. Which underlying mistake most directly explains the reported symptom?

The chosen resource-governance tool did not scan data contents.
A tag standard existed without a policy-based enforcement process.
It confused metadata governance with resource configuration enforcement.
No deletion-protection lock guarded the resource.

Explanation

Correct Answer

A tag standard existed without a policy-based enforcement process. That explains the symptom: Many VMs lack required ownership metadata. The targeted corrective action is: Assign an appropriate tag policy effect for eligible resource types.

Incorrect Answers

This cause is consistent with a different issue: A resource-location policy report contains no data sensitivity inventory. It does not account for the reported symptom here: Many VMs lack required ownership metadata.

That explanation belongs to a different fault pattern: The organization uses a data catalog but still permits prohibited Azure locations. It does not explain why many VMs lack required ownership metadata.

This cause is consistent with a different issue: A resource is accidentally deleted despite the preservation requirement. It does not account for the reported symptom here: Many VMs lack required ownership metadata.

Question 745

An operations team wants to protect a critical resource from accidental deletion. What is the most appropriate cloud concept or service for this need?

Use Azure Policy to evaluate or enforce resource tagging conventions.
Apply a CanNotDelete resource lock to the protected scope.
Treat locks as safeguards against management changes even for authorized roles, while RBAC grants permissions.
Use supported Microsoft Purview data governance features for discovery and lineage.

Explanation

Correct Answer

Apply a CanNotDelete resource lock to the protected scope. The governing requirement is: An operations team wants to protect a critical resource from accidental deletion. This solution specifically supports the outcome that an authorized delete request is blocked until the lock is removed.

Incorrect Answers

This design is appropriate for a different requirement: A company wants to ensure newly deployed VMs have a required metadata tag. Here the decisive outcome must instead be: An authorized delete request is blocked until the lock is removed.

This option solves a different planning problem: An architect needs to explain how a resource lock differs from RBAC. The current acceptance criterion is specific: An authorized delete request is blocked until the lock is removed.

This design is appropriate for a different requirement: An enterprise requires a data catalog with lineage and business glossary for analysts. Here the decisive outcome must instead be: An authorized delete request is blocked until the lock is removed.

Question 746

An operations team wants to protect a critical resource from accidental deletion. What should the team configure or perform to implement the correct approach?

Configure a lock and an allowed-size policy at the necessary scopes.
Create the deletion-protection lock with approved administrative ownership.
Apply approved scanning/classification to the data sources.
Configure a staged Azure Policy assignment with planned remediation.

Explanation

Correct Answer

Create the deletion-protection lock with approved administrative ownership. The implementation operationalizes this design choice: Apply a CanNotDelete resource lock to the protected scope. Acceptance should demonstrate: An authorized delete request is blocked until the lock is removed.

Incorrect Answers

This setup is relevant to another workload: A cloud tenant wants to explain which governance tool prevents accidental deletion versus which enforces allowed SKUs. The current configuration must instead achieve: An authorized delete request is blocked until the lock is removed.

This change would be appropriate under a different condition: A data owner wants sensitive columns identified but not necessarily block resource creation. Here it would not validate: An authorized delete request is blocked until the lock is removed.

This setup is relevant to another workload: A cloud team wants to roll out a mandatory tag convention without immediately breaking all legacy deployments. The current configuration must instead achieve: An authorized delete request is blocked until the lock is removed.

Question 747

An operations team wants to protect a critical resource from accidental deletion. Which evidence best confirms the requirement is being met?

A prohibited-region deployment is denied or flagged as configured.
An authorized delete request is blocked until the lock is removed.
Deletion and disallowed-size tests are handled by the correct mechanisms.
The sensitive columns appear with appropriate classification metadata.

Explanation

Correct Answer

An authorized delete request is blocked until the lock is removed. That directly tests the stated requirement: An operations team wants to protect a critical resource from accidental deletion. It contrasts with the observed failure: A resource is accidentally deleted despite the preservation requirement.

Incorrect Answers

This observation is evidence for a separate scenario: A regulated agency wants to prevent new resources in unapproved Azure regions. It does not test the necessary outcome here: An authorized delete request is blocked until the lock is removed.

The test is relevant when a cloud tenant wants to explain which governance tool prevents accidental deletion versus which enforces allowed SKUs. It cannot establish the specified acceptance result: An authorized delete request is blocked until the lock is removed.

This observation is evidence for a separate scenario: A data owner wants sensitive columns identified but not necessarily block resource creation. It does not test the necessary outcome here: An authorized delete request is blocked until the lock is removed.

Question 748

An operations team wants to protect a critical resource from accidental deletion. The team observes: A resource is accidentally deleted despite the preservation requirement. What is the most likely cause of the observed failure?

The chosen resource-governance tool did not scan data contents.
No deletion-protection lock guarded the resource.
The allowed-location policy was not assigned or enforced.
A role assignment was mistaken for an independent delete lock.

Explanation

Correct Answer

No deletion-protection lock guarded the resource. That explains the symptom: A resource is accidentally deleted despite the preservation requirement. The targeted corrective action is: Create the deletion-protection lock with approved administrative ownership.

Incorrect Answers

This cause is consistent with a different issue: A resource-location policy report contains no data sensitivity inventory. It does not account for the reported symptom here: A resource is accidentally deleted despite the preservation requirement.

That explanation belongs to a different fault pattern: Staff deploy resources outside approved regions despite policy documents. It does not explain why a resource is accidentally deleted despite the preservation requirement.

This cause is consistent with a different issue: An Owner deletes a supposedly protected resource without any lock obstacle. It does not account for the reported symptom here: A resource is accidentally deleted despite the preservation requirement.

Question 749

A finance group wants to stop modifications and deletion of a frozen resource. Which architectural decision meets the described priority?

Use ongoing Azure Policy compliance monitoring, not one-time manual inspection.
Differentiate data governance and classification from Azure resource configuration compliance.
Evaluate Microsoft Purview capabilities for data discovery, classification and governance.
Consider a ReadOnly lock where the operational side effects are acceptable.

Explanation

Correct Answer

Consider a ReadOnly lock where the operational side effects are acceptable. The governing requirement is: A finance group wants to stop modifications and deletion of a frozen resource. This solution specifically supports the outcome that write operations are blocked under the lock, not merely deletion.

Incorrect Answers

This design is appropriate for a different requirement: A compliance lead wants resource policy evaluation to continue as infrastructure changes. Here the decisive outcome must instead be: Write operations are blocked under the lock, not merely deletion.

That concept addresses this separate situation: A manager thinks Microsoft Purview is a replacement for Azure Policy. It does not by itself establish the result required here: Write operations are blocked under the lock, not merely deletion.

This option solves a different planning problem: A data governance group needs to discover and classify sensitive data across supported systems. The current acceptance criterion is specific: Write operations are blocked under the lock, not merely deletion.

Question 750

A finance group wants to stop modifications and deletion of a frozen resource. Which configuration or operating action most directly puts that decision into practice?

Apply a scoped ReadOnly lock after validating required operations.
Inspect policy definitions and proposed resource settings before release.
Configure a lock and an allowed-size policy at the necessary scopes.
Configure roles and locks separately for the required control boundary.

Explanation

Correct Answer

Apply a scoped ReadOnly lock after validating required operations. The implementation operationalizes this design choice: Consider a ReadOnly lock where the operational side effects are acceptable. Acceptance should demonstrate: Write operations are blocked under the lock, not merely deletion.

Incorrect Answers

That action implements a different requirement: An engineer wants to check policy compliance before copying a deployment into production. It does not establish the required result in this case: Write operations are blocked under the lock, not merely deletion.

This change would be appropriate under a different condition: A cloud tenant wants to explain which governance tool prevents accidental deletion versus which enforces allowed SKUs. Here it would not validate: Write operations are blocked under the lock, not merely deletion.

This setup is relevant to another workload: An architect needs to explain how a resource lock differs from RBAC. The current configuration must instead achieve: Write operations are blocked under the lock, not merely deletion.

Microsoft AZ-900 Exam Dumps, Practice Test Questions

Question 740

Explanation

Correct Answer

Incorrect Answers

Question 741

Explanation

Correct Answer

Incorrect Answers

Question 742

Explanation

Correct Answer

Incorrect Answers

Question 743

Explanation

Correct Answer

Incorrect Answers

Question 744

Explanation

Correct Answer

Incorrect Answers

Question 745

Explanation

Correct Answer

Incorrect Answers

Question 746

Explanation

Correct Answer

Incorrect Answers

Question 747

Explanation

Correct Answer

Incorrect Answers

Question 748

Explanation

Correct Answer

Incorrect Answers

Question 749

Explanation

Correct Answer

Incorrect Answers

Question 750

Explanation

Correct Answer

Incorrect Answers