100% Latest & Updated Microsoft AZ-900 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 760
A data governance group needs to discover and classify sensitive data across supported systems. The team observes: A team has no central inventory of sensitive datasets. Which underlying mistake most directly explains the reported symptom?
- Data governance discovery and scanning were not established.
- The allowed-location policy was not assigned or enforced.
- The team used deletion-only protection instead of ReadOnly restriction.
- It confused metadata governance with resource configuration enforcement.
Explanation
Correct Answer
A:Data governance discovery and scanning were not established. That explains the symptom: A team has no central inventory of sensitive datasets. The targeted corrective action is: Configure appropriate data-source scanning and classification coverage.
Incorrect Answers
B:The alternate mechanism would more directly produce this other failure: Staff deploy resources outside approved regions despite policy documents. The current incident instead involves: A team has no central inventory of sensitive datasets.
C:That explanation belongs to a different fault pattern: Administrators can still alter a supposedly frozen resource. It does not explain why a team has no central inventory of sensitive datasets.
D:This cause is consistent with a different issue: The organization uses a data catalog but still permits prohibited Azure locations. It does not account for the reported symptom here: A team has no central inventory of sensitive datasets.
Question 761
A manager thinks Microsoft Purview is a replacement for Azure Policy. What is the most appropriate cloud concept or service for this need?
- Differentiate data governance and classification from Azure resource configuration compliance.
- Govern Azure Policy exemptions carefully at justified scope.
- Treat locks as safeguards against management changes even for authorized roles, while RBAC grants permissions.
- Apply a CanNotDelete resource lock to the protected scope.
Explanation
Correct Answer
A:Differentiate data governance and classification from Azure resource configuration compliance. The governing requirement is: A manager thinks Microsoft Purview is a replacement for Azure Policy. This solution specifically supports the outcome that data classification and resource-policy checks have distinct owners and tools.
Incorrect Answers
B:That concept addresses this separate situation: An IT team needs an exception for one approved workload from a policy restriction. It does not by itself establish the result required here: Data classification and resource-policy checks have distinct owners and tools.
C:This option solves a different planning problem: An architect needs to explain how a resource lock differs from RBAC. The current acceptance criterion is specific: Data classification and resource-policy checks have distinct owners and tools.
D:This design is appropriate for a different requirement: An operations team wants to protect a critical resource from accidental deletion. Here the decisive outcome must instead be: Data classification and resource-policy checks have distinct owners and tools.
Question 762
A manager thinks Microsoft Purview is a replacement for Azure Policy. What should the team configure or perform to implement the correct approach?
- Assign an appropriate tag policy effect for eligible resource types.
- Register and scan eligible sources and connect stewardship metadata.
- Choose Purview for data catalog needs and Azure Policy for deployment constraints.
- Identify the parent lock and follow approved removal/reapplication procedure.
Explanation
Correct Answer
C:Choose Purview for data catalog needs and Azure Policy for deployment constraints. The implementation operationalizes this design choice: Differentiate data governance and classification from Azure resource configuration compliance. Acceptance should demonstrate: Data classification and resource-policy checks have distinct owners and tools.
Incorrect Answers
A:This setup is relevant to another workload: A company wants to ensure newly deployed VMs have a required metadata tag. The current configuration must instead achieve: Data classification and resource-policy checks have distinct owners and tools.
B:That action implements a different requirement: An enterprise requires a data catalog with lineage and business glossary for analysts. It does not establish the required result in this case: Data classification and resource-policy checks have distinct owners and tools.
D:This setup is relevant to another workload: An operator wants to remove a resource that has an inherited lock during planned maintenance. The current configuration must instead achieve: Data classification and resource-policy checks have distinct owners and tools.
Question 763
A manager thinks Microsoft Purview is a replacement for Azure Policy. Which evidence best confirms the requirement is being met?
- Analysts discover datasets and available lineage through catalog tools.
- Deletion of protected contained resources is blocked as intended.
- Data classification and resource-policy checks have distinct owners and tools.
- A prohibited-region deployment is denied or flagged as configured.
Explanation
Correct Answer
C:Data classification and resource-policy checks have distinct owners and tools. That directly tests the stated requirement: A manager thinks Microsoft Purview is a replacement for Azure Policy. It contrasts with the observed failure: The organization uses a data catalog but still permits prohibited Azure locations.
Incorrect Answers
A:This observation is evidence for a separate scenario: An enterprise requires a data catalog with lineage and business glossary for analysts. It does not test the necessary outcome here: Data classification and resource-policy checks have distinct owners and tools.
B:That check tests another control: A team adds a CanNotDelete lock to a resource group of critical production objects. The decisive result for this workload is: Data classification and resource-policy checks have distinct owners and tools.
D:This observation is evidence for a separate scenario: A regulated agency wants to prevent new resources in unapproved Azure regions. It does not test the necessary outcome here: Data classification and resource-policy checks have distinct owners and tools.
Question 764
A manager thinks Microsoft Purview is a replacement for Azure Policy. The team observes: The organization uses a data catalog but still permits prohibited Azure locations. What is the most likely cause of the observed failure?
- Governance scope was not placed above all relevant subscriptions.
- The team confused advisory posture findings with active governance enforcement.
- It confused metadata governance with resource configuration enforcement.
- Data governance discovery and scanning were not established.
Explanation
Correct Answer
C:It confused metadata governance with resource configuration enforcement. That explains the symptom: The organization uses a data catalog but still permits prohibited Azure locations. The targeted corrective action is: Choose Purview for data catalog needs and Azure Policy for deployment constraints.
Incorrect Answers
A:This cause is consistent with a different issue: The location rule exists only in one departmental subscription. It does not account for the reported symptom here: The organization uses a data catalog but still permits prohibited Azure locations.
B:The alternate mechanism would more directly produce this other failure: A Defender recommendation is treated as an automatically deployed Azure Policy deny rule. The current incident instead involves: The organization uses a data catalog but still permits prohibited Azure locations.
D:This cause is consistent with a different issue: A team has no central inventory of sensitive datasets. It does not account for the reported symptom here: The organization uses a data catalog but still permits prohibited Azure locations.
Question 765
A company requires proof that deployments follow internal security policy. Which architectural decision meets the described priority?
- Understand inherited locks and arrange authorized temporary change control.
- Use Azure Policy compliance evaluations for applicable resource settings.
- Evaluate Microsoft Purview capabilities for data discovery, classification and governance.
- Treat locks as safeguards against management changes even for authorized roles, while RBAC grants permissions.
Explanation
Correct Answer
B:Use Azure Policy compliance evaluations for applicable resource settings. The governing requirement is: A company requires proof that deployments follow internal security policy. This solution specifically supports the outcome that resource compliance results identify configurations outside the standard.
Incorrect Answers
A:This design is appropriate for a different requirement: An operator wants to remove a resource that has an inherited lock during planned maintenance. Here the decisive outcome must instead be: Resource compliance results identify configurations outside the standard.
C:This option solves a different planning problem: A data governance group needs to discover and classify sensitive data across supported systems. The current acceptance criterion is specific: Resource compliance results identify configurations outside the standard.
D:This design is appropriate for a different requirement: An architect needs to explain how a resource lock differs from RBAC. Here the decisive outcome must instead be: Resource compliance results identify configurations outside the standard.
Question 766
A company requires proof that deployments follow internal security policy. Which configuration or operating action most directly puts that decision into practice?
- Register and scan eligible sources and connect stewardship metadata.
- Choose Purview for data catalog needs and Azure Policy for deployment constraints.
- Assign and review relevant policy definitions and compliance states.
- Apply a scoped ReadOnly lock after validating required operations.
Explanation
Correct Answer
C:Assign and review relevant policy definitions and compliance states. The implementation operationalizes this design choice: Use Azure Policy compliance evaluations for applicable resource settings. Acceptance should demonstrate: Resource compliance results identify configurations outside the standard.
Incorrect Answers
A:This setup is relevant to another workload: An enterprise requires a data catalog with lineage and business glossary for analysts. The current configuration must instead achieve: Resource compliance results identify configurations outside the standard.
B:That action implements a different requirement: A manager thinks Microsoft Purview is a replacement for Azure Policy. It does not establish the required result in this case: Resource compliance results identify configurations outside the standard.
D:This setup is relevant to another workload: A finance group wants to stop modifications and deletion of a frozen resource. The current configuration must instead achieve: Resource compliance results identify configurations outside the standard.
Question 767
A company requires proof that deployments follow internal security policy. Which observation is the strongest acceptance test for this scenario?
- Data classification and resource-policy checks have distinct owners and tools.
- Analysts discover datasets and available lineage through catalog tools.
- Resource compliance results identify configurations outside the standard.
- Deletion and disallowed-size tests are handled by the correct mechanisms.
Explanation
Correct Answer
C:Resource compliance results identify configurations outside the standard. That directly tests the stated requirement: A company requires proof that deployments follow internal security policy. It contrasts with the observed failure: Auditors receive a list of resource names with no policy compliance evaluation.
Incorrect Answers
A:This observation is evidence for a separate scenario: A manager thinks Microsoft Purview is a replacement for Azure Policy. It does not test the necessary outcome here: Resource compliance results identify configurations outside the standard.
B:That check tests another control: An enterprise requires a data catalog with lineage and business glossary for analysts. The decisive result for this workload is: Resource compliance results identify configurations outside the standard.
D:This observation is evidence for a separate scenario: A cloud tenant wants to explain which governance tool prevents accidental deletion versus which enforces allowed SKUs. It does not test the necessary outcome here: Resource compliance results identify configurations outside the standard.
Question 768
A company requires proof that deployments follow internal security policy. The team observes: Auditors receive a list of resource names with no policy compliance evaluation. Which planning or configuration error best accounts for this result?
- Data governance discovery and scanning were not established.
- The team never established automated policy assessment.
- The team confused advisory posture findings with active governance enforcement.
- A role assignment was mistaken for an independent delete lock.
Explanation
Correct Answer
B:The team never established automated policy assessment. That explains the symptom: Auditors receive a list of resource names with no policy compliance evaluation. The targeted corrective action is: Assign and review relevant policy definitions and compliance states.
Incorrect Answers
A:This cause is consistent with a different issue: A team has no central inventory of sensitive datasets. It does not account for the reported symptom here: Auditors receive a list of resource names with no policy compliance evaluation.
C:That explanation belongs to a different fault pattern: A Defender recommendation is treated as an automatically deployed Azure Policy deny rule. It does not explain why auditors receive a list of resource names with no policy compliance evaluation.
D:This cause is consistent with a different issue: An Owner deletes a supposedly protected resource without any lock obstacle. It does not account for the reported symptom here: Auditors receive a list of resource names with no policy compliance evaluation.
Question 769
An IT team needs an exception for one approved workload from a policy restriction. Which Azure or cloud concept most directly matches the requirement?
- Use supported Microsoft Purview data governance features for discovery and lineage.
- Treat locks as safeguards against management changes even for authorized roles, while RBAC grants permissions.
- Differentiate data governance and classification from Azure resource configuration compliance.
- Govern Azure Policy exemptions carefully at justified scope.
Explanation
Correct Answer
D:Govern Azure Policy exemptions carefully at justified scope. The governing requirement is: An IT team needs an exception for one approved workload from a policy restriction. This solution specifically supports the outcome that compliance reports show the exception as governed rather than silently ignored.
Incorrect Answers
A:This design is appropriate for a different requirement: An enterprise requires a data catalog with lineage and business glossary for analysts. Here the decisive outcome must instead be: Compliance reports show the exception as governed rather than silently ignored.
B:That concept addresses this separate situation: An architect needs to explain how a resource lock differs from RBAC. It does not by itself establish the result required here: Compliance reports show the exception as governed rather than silently ignored.
C:This option solves a different planning problem: A manager thinks Microsoft Purview is a replacement for Azure Policy. The current acceptance criterion is specific: Compliance reports show the exception as governed rather than silently ignored.
Question 770
An IT team needs an exception for one approved workload from a policy restriction. Which implementation step would best fulfill the stated requirement?
- Apply a scoped ReadOnly lock after validating required operations.
- Record an approved exemption with owner, reason and expiration where applicable.
- Apply approved scanning/classification to the data sources.
- Review both appropriate Defender recommendations and Policy compliance results.
Explanation
Correct Answer
B:Record an approved exemption with owner, reason and expiration where applicable. The implementation operationalizes this design choice: Govern Azure Policy exemptions carefully at justified scope. Acceptance should demonstrate: Compliance reports show the exception as governed rather than silently ignored.
Incorrect Answers
A:This setup is relevant to another workload: A finance group wants to stop modifications and deletion of a frozen resource. The current configuration must instead achieve: Compliance reports show the exception as governed rather than silently ignored.
C:This change would be appropriate under a different condition: A data owner wants sensitive columns identified but not necessarily block resource creation. Here it would not validate: Compliance reports show the exception as governed rather than silently ignored.
D:This setup is relevant to another workload: A security committee wants a distinction between security posture recommendations and regulatory resource-policy compliance. The current configuration must instead achieve: Compliance reports show the exception as governed rather than silently ignored.
Microsoft Azure Fundamentals (AZ-900) Practice Tests